1 //===--- llvm-opt-fuzzer.cpp - Fuzzer for instruction selection ----------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // Tool to fuzz optimization passes using libFuzzer.
11 //
12 //===----------------------------------------------------------------------===//
13
14 #include "llvm/Bitcode/BitcodeReader.h"
15 #include "llvm/Bitcode/BitcodeWriter.h"
16 #include "llvm/CodeGen/CommandFlags.inc"
17 #include "llvm/FuzzMutate/FuzzerCLI.h"
18 #include "llvm/FuzzMutate/IRMutator.h"
19 #include "llvm/IR/Verifier.h"
20 #include "llvm/Passes/PassBuilder.h"
21 #include "llvm/Support/SourceMgr.h"
22 #include "llvm/Support/TargetRegistry.h"
23 #include "llvm/Support/TargetSelect.h"
24
25 using namespace llvm;
26
27 static cl::opt<std::string>
28 TargetTripleStr("mtriple", cl::desc("Override target triple for module"));
29
30 // Passes to run for this fuzzer instance. Expects new pass manager syntax.
31 static cl::opt<std::string> PassPipeline(
32 "passes",
33 cl::desc("A textual description of the pass pipeline for testing"));
34
35 static std::unique_ptr<IRMutator> Mutator;
36 static std::unique_ptr<TargetMachine> TM;
37
createOptMutator()38 std::unique_ptr<IRMutator> createOptMutator() {
39 std::vector<TypeGetter> Types{
40 Type::getInt1Ty, Type::getInt8Ty, Type::getInt16Ty, Type::getInt32Ty,
41 Type::getInt64Ty, Type::getFloatTy, Type::getDoubleTy};
42
43 std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
44 Strategies.push_back(
45 llvm::make_unique<InjectorIRStrategy>(
46 InjectorIRStrategy::getDefaultOps()));
47 Strategies.push_back(
48 llvm::make_unique<InstDeleterIRStrategy>());
49
50 return llvm::make_unique<IRMutator>(std::move(Types), std::move(Strategies));
51 }
52
LLVMFuzzerCustomMutator(uint8_t * Data,size_t Size,size_t MaxSize,unsigned int Seed)53 extern "C" LLVM_ATTRIBUTE_USED size_t LLVMFuzzerCustomMutator(
54 uint8_t *Data, size_t Size, size_t MaxSize, unsigned int Seed) {
55
56 assert(Mutator &&
57 "IR mutator should have been created during fuzzer initialization");
58
59 LLVMContext Context;
60 auto M = parseAndVerify(Data, Size, Context);
61 if (!M) {
62 errs() << "error: mutator input module is broken!\n";
63 return 0;
64 }
65
66 Mutator->mutateModule(*M, Seed, Size, MaxSize);
67
68 if (verifyModule(*M, &errs())) {
69 errs() << "mutation result doesn't pass verification\n";
70 #ifndef NDEBUG
71 M->dump();
72 #endif
73 // Avoid adding incorrect test cases to the corpus.
74 return 0;
75 }
76
77 std::string Buf;
78 {
79 raw_string_ostream OS(Buf);
80 WriteBitcodeToFile(*M, OS);
81 }
82 if (Buf.size() > MaxSize)
83 return 0;
84
85 // There are some invariants which are not checked by the verifier in favor
86 // of having them checked by the parser. They may be considered as bugs in the
87 // verifier and should be fixed there. However until all of those are covered
88 // we want to check for them explicitly. Otherwise we will add incorrect input
89 // to the corpus and this is going to confuse the fuzzer which will start
90 // exploration of the bitcode reader error handling code.
91 auto NewM = parseAndVerify(
92 reinterpret_cast<const uint8_t*>(Buf.data()), Buf.size(), Context);
93 if (!NewM) {
94 errs() << "mutator failed to re-read the module\n";
95 #ifndef NDEBUG
96 M->dump();
97 #endif
98 return 0;
99 }
100
101 memcpy(Data, Buf.data(), Buf.size());
102 return Buf.size();
103 }
104
LLVMFuzzerTestOneInput(const uint8_t * Data,size_t Size)105 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
106 assert(TM && "Should have been created during fuzzer initialization");
107
108 if (Size <= 1)
109 // We get bogus data given an empty corpus - ignore it.
110 return 0;
111
112 // Parse module
113 //
114
115 LLVMContext Context;
116 auto M = parseAndVerify(Data, Size, Context);
117 if (!M) {
118 errs() << "error: input module is broken!\n";
119 return 0;
120 }
121
122 // Set up target dependant options
123 //
124
125 M->setTargetTriple(TM->getTargetTriple().normalize());
126 M->setDataLayout(TM->createDataLayout());
127 setFunctionAttributes(TM->getTargetCPU(), TM->getTargetFeatureString(), *M);
128
129 // Create pass pipeline
130 //
131
132 PassBuilder PB(TM.get());
133
134 LoopAnalysisManager LAM;
135 FunctionAnalysisManager FAM;
136 CGSCCAnalysisManager CGAM;
137 ModulePassManager MPM;
138 ModuleAnalysisManager MAM;
139
140 FAM.registerPass([&] { return PB.buildDefaultAAPipeline(); });
141 PB.registerModuleAnalyses(MAM);
142 PB.registerCGSCCAnalyses(CGAM);
143 PB.registerFunctionAnalyses(FAM);
144 PB.registerLoopAnalyses(LAM);
145 PB.crossRegisterProxies(LAM, FAM, CGAM, MAM);
146
147 bool Ok = PB.parsePassPipeline(MPM, PassPipeline, false, false);
148 assert(Ok && "Should have been checked during fuzzer initialization");
149 (void)Ok; // silence unused variable warning on release builds
150
151 // Run passes which we need to test
152 //
153
154 MPM.run(*M, MAM);
155
156 // Check that passes resulted in a correct code
157 if (verifyModule(*M, &errs())) {
158 errs() << "Transformation resulted in an invalid module\n";
159 abort();
160 }
161
162 return 0;
163 }
164
handleLLVMFatalError(void *,const std::string & Message,bool)165 static void handleLLVMFatalError(void *, const std::string &Message, bool) {
166 // TODO: Would it be better to call into the fuzzer internals directly?
167 dbgs() << "LLVM ERROR: " << Message << "\n"
168 << "Aborting to trigger fuzzer exit handling.\n";
169 abort();
170 }
171
LLVMFuzzerInitialize(int * argc,char *** argv)172 extern "C" LLVM_ATTRIBUTE_USED int LLVMFuzzerInitialize(
173 int *argc, char ***argv) {
174 EnableDebugBuffering = true;
175
176 // Make sure we print the summary and the current unit when LLVM errors out.
177 install_fatal_error_handler(handleLLVMFatalError, nullptr);
178
179 // Initialize llvm
180 //
181
182 InitializeAllTargets();
183 InitializeAllTargetMCs();
184
185 PassRegistry &Registry = *PassRegistry::getPassRegistry();
186 initializeCore(Registry);
187 initializeCoroutines(Registry);
188 initializeScalarOpts(Registry);
189 initializeObjCARCOpts(Registry);
190 initializeVectorization(Registry);
191 initializeIPO(Registry);
192 initializeAnalysis(Registry);
193 initializeTransformUtils(Registry);
194 initializeInstCombine(Registry);
195 initializeAggressiveInstCombine(Registry);
196 initializeInstrumentation(Registry);
197 initializeTarget(Registry);
198
199 // Parse input options
200 //
201
202 handleExecNameEncodedOptimizerOpts(*argv[0]);
203 parseFuzzerCLOpts(*argc, *argv);
204
205 // Create TargetMachine
206 //
207
208 if (TargetTripleStr.empty()) {
209 errs() << *argv[0] << ": -mtriple must be specified\n";
210 exit(1);
211 }
212 Triple TargetTriple = Triple(Triple::normalize(TargetTripleStr));
213
214 std::string Error;
215 const Target *TheTarget =
216 TargetRegistry::lookupTarget(MArch, TargetTriple, Error);
217 if (!TheTarget) {
218 errs() << *argv[0] << ": " << Error;
219 exit(1);
220 }
221
222 TargetOptions Options = InitTargetOptionsFromCodeGenFlags();
223 TM.reset(TheTarget->createTargetMachine(
224 TargetTriple.getTriple(), getCPUStr(), getFeaturesStr(),
225 Options, getRelocModel(), getCodeModel(), CodeGenOpt::Default));
226 assert(TM && "Could not allocate target machine!");
227
228 // Check that pass pipeline is specified and correct
229 //
230
231 if (PassPipeline.empty()) {
232 errs() << *argv[0] << ": at least one pass should be specified\n";
233 exit(1);
234 }
235
236 PassBuilder PB(TM.get());
237 ModulePassManager MPM;
238 if (!PB.parsePassPipeline(MPM, PassPipeline, false, false)) {
239 errs() << *argv[0] << ": can't parse pass pipeline\n";
240 exit(1);
241 }
242
243 // Create mutator
244 //
245
246 Mutator = createOptMutator();
247
248 return 0;
249 }
250