X-Git-Url: http://plrg.eecs.uci.edu/git/?a=blobdiff_plain;f=lib%2FFuzzer%2FFuzzerTraceState.cpp;h=80dd6bc8c41fbb48ed809a015716aeda7996d29b;hb=ccb762ceea71b86cdf40af65d26ce86515037e58;hp=9d1ac281b1f44df6adb86d6ffbde7c5cb7430c1d;hpb=de65922947afd4f8c51ff404fdce33314f9327e9;p=oota-llvm.git diff --git a/lib/Fuzzer/FuzzerTraceState.cpp b/lib/Fuzzer/FuzzerTraceState.cpp index 9d1ac281b1f..80dd6bc8c41 100644 --- a/lib/Fuzzer/FuzzerTraceState.cpp +++ b/lib/Fuzzer/FuzzerTraceState.cpp @@ -67,38 +67,34 @@ clang -fPIC -c -g -O2 -std=c++11 Fuzzer*.cpp clang++ -O0 -std=c++11 -fsanitize-coverage=edge,trace-cmp \ -fsanitize=dataflow \ - test/dfsan/DFSanSimpleCmpTest.cpp Fuzzer*.o - ./a.out + test/SimpleCmpTest.cpp Fuzzer*.o + ./a.out -use_traces=1 ) */ +#include "FuzzerDFSan.h" #include "FuzzerInternal.h" -#include #include #include -#include #include +#if !LLVM_FUZZER_SUPPORTS_DFSAN +// Stubs for dfsan for platforms where dfsan does not exist and weak +// functions don't work. extern "C" { -__attribute__((weak)) -dfsan_label dfsan_create_label(const char *desc, void *userdata); -__attribute__((weak)) -void dfsan_set_label(dfsan_label label, void *addr, size_t size); -__attribute__((weak)) -void dfsan_add_label(dfsan_label label, void *addr, size_t size); -__attribute__((weak)) -const struct dfsan_label_info *dfsan_get_label_info(dfsan_label label); -__attribute__((weak)) -dfsan_label dfsan_read_label(const void *addr, size_t size); +dfsan_label dfsan_create_label(const char *desc, void *userdata) { return 0; } +void dfsan_set_label(dfsan_label label, void *addr, size_t size) {} +void dfsan_add_label(dfsan_label label, void *addr, size_t size) {} +const struct dfsan_label_info *dfsan_get_label_info(dfsan_label label) { + return nullptr; +} +dfsan_label dfsan_read_label(const void *addr, size_t size) { return 0; } } // extern "C" +#endif // !LLVM_FUZZER_SUPPORTS_DFSAN namespace fuzzer { -static bool ReallyHaveDFSan() { - return &dfsan_create_label != nullptr; -} - // These values are copied from include/llvm/IR/InstrTypes.h. // We do not include the LLVM headers here to remain independent. // If these values ever change, an assertion in ComputeCmp will fail. @@ -139,7 +135,9 @@ static bool ComputeCmp(size_t CmpSize, size_t CmpType, uint64_t Arg1, if (CmpSize == 4) return ComputeCmp(CmpType, Arg1, Arg2); if (CmpSize == 2) return ComputeCmp(CmpType, Arg1, Arg2); if (CmpSize == 1) return ComputeCmp(CmpType, Arg1, Arg2); - assert(0 && "unsupported type size"); + // Other size, == + if (CmpType == ICMP_EQ) return Arg1 == Arg2; + // assert(0 && "unsupported cmp and type size combination"); return true; } @@ -165,10 +163,6 @@ struct LabelRange { } }; -std::ostream &operator<<(std::ostream &os, const LabelRange &LR) { - return os << "[" << LR.Beg << "," << LR.End << ")"; -} - // For now, very simple: put Size bytes of Data at position Pos. struct TraceBasedMutation { size_t Pos; @@ -185,8 +179,13 @@ class TraceState { void DFSanCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, uint64_t Arg1, uint64_t Arg2, dfsan_label L1, dfsan_label L2); - void TraceCmpCallback(size_t CmpSize, size_t CmpType, uint64_t Arg1, - uint64_t Arg2); + void DFSanSwitchCallback(uint64_t PC, size_t ValSizeInBits, uint64_t Val, + size_t NumCases, uint64_t *Cases, dfsan_label L); + void TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, + uint64_t Arg1, uint64_t Arg2); + + void TraceSwitchCallback(uintptr_t PC, size_t ValSizeInBits, uint64_t Val, + size_t NumCases, uint64_t *Cases); int TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData, size_t DataSize); @@ -196,9 +195,8 @@ class TraceState { Mutations.clear(); } - size_t StopTraceRecording() { + size_t StopTraceRecording(FuzzerRandomBase &Rand) { RecordingTraces = false; - std::random_shuffle(Mutations.begin(), Mutations.end()); return Mutations.size(); } @@ -231,7 +229,7 @@ void TraceState::ApplyTraceBasedMutation(size_t Idx, fuzzer::Unit *U) { assert(Idx < Mutations.size()); auto &M = Mutations[Idx]; if (Options.Verbosity >= 3) - std::cerr << "TBM " << M.Pos << " " << M.Size << " " << M.Data << "\n"; + Printf("TBM %zd %zd %zd\n", M.Pos, M.Size, M.Data); if (M.Pos + M.Size > U->size()) return; memcpy(U->data() + M.Pos, &M.Data, M.Size); } @@ -260,16 +258,36 @@ void TraceState::DFSanCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, if (Options.Verbosity >= 3) - std::cerr << "DFSAN:" - << " PC " << std::hex << PC << std::dec - << " S " << CmpSize - << " T " << CmpType - << " A1 " << Arg1 << " A2 " << Arg2 << " R " << Res - << " L" << L1 - << " L" << L2 - << " R" << LR - << " MU " << Mutations.size() - << "\n"; + Printf("DFSanCmpCallback: PC %lx S %zd T %zd A1 %llx A2 %llx R %d L1 %d L2 " + "%d MU %zd\n", + PC, CmpSize, CmpType, Arg1, Arg2, Res, L1, L2, Mutations.size()); +} + +void TraceState::DFSanSwitchCallback(uint64_t PC, size_t ValSizeInBits, + uint64_t Val, size_t NumCases, + uint64_t *Cases, dfsan_label L) { + assert(ReallyHaveDFSan()); + if (!RecordingTraces) return; + if (!L) return; // Not actionable. + LabelRange LR = GetLabelRange(L); + size_t ValSize = ValSizeInBits / 8; + bool TryShort = IsTwoByteData(Val); + for (size_t i = 0; i < NumCases; i++) + TryShort &= IsTwoByteData(Cases[i]); + + for (size_t Pos = LR.Beg; Pos + ValSize <= LR.End; Pos++) + for (size_t i = 0; i < NumCases; i++) + Mutations.push_back({Pos, ValSize, Cases[i]}); + + if (TryShort) + for (size_t Pos = LR.Beg; Pos + 2 <= LR.End; Pos++) + for (size_t i = 0; i < NumCases; i++) + Mutations.push_back({Pos, 2, Cases[i]}); + + if (Options.Verbosity >= 3) + Printf("DFSanSwitchCallback: PC %lx Val %zd SZ %zd # %zd L %d: {%d, %d} " + "TryShort %d\n", + PC, Val, ValSize, NumCases, L, LR.Beg, LR.End, TryShort); } int TraceState::TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData, @@ -277,28 +295,27 @@ int TraceState::TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData, int Res = 0; const uint8_t *Beg = CurrentUnit.data(); const uint8_t *End = Beg + CurrentUnit.size(); - for (const uint8_t *Cur = Beg; Cur < End; Cur += DataSize) { + for (const uint8_t *Cur = Beg; Cur < End; Cur++) { Cur = (uint8_t *)memmem(Cur, End - Cur, &PresentData, DataSize); if (!Cur) break; - // std::cerr << "Cur " << (void*)Cur << "\n"; size_t Pos = Cur - Beg; assert(Pos < CurrentUnit.size()); + if (Mutations.size() > 100000U) return Res; // Just in case. Mutations.push_back({Pos, DataSize, DesiredData}); Mutations.push_back({Pos, DataSize, DesiredData + 1}); Mutations.push_back({Pos, DataSize, DesiredData - 1}); - Cur += DataSize; Res++; } return Res; } -void TraceState::TraceCmpCallback(size_t CmpSize, size_t CmpType, uint64_t Arg1, - uint64_t Arg2) { +void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, + uint64_t Arg1, uint64_t Arg2) { if (!RecordingTraces) return; int Added = 0; if (Options.Verbosity >= 3) - std::cerr << "TraceCmp: " << Arg1 << " " << Arg2 << "\n"; + Printf("TraceCmp %zd/%zd: %p %zd %zd\n", CmpSize, CmpType, PC, Arg1, Arg2); Added += TryToAddDesiredData(Arg1, Arg2, CmpSize); Added += TryToAddDesiredData(Arg2, Arg1, CmpSize); if (!Added && CmpSize == 4 && IsTwoByteData(Arg1) && IsTwoByteData(Arg2)) { @@ -307,16 +324,40 @@ void TraceState::TraceCmpCallback(size_t CmpSize, size_t CmpType, uint64_t Arg1, } } +void TraceState::TraceSwitchCallback(uintptr_t PC, size_t ValSizeInBits, + uint64_t Val, size_t NumCases, + uint64_t *Cases) { + if (!RecordingTraces) return; + size_t ValSize = ValSizeInBits / 8; + bool TryShort = IsTwoByteData(Val); + for (size_t i = 0; i < NumCases; i++) + TryShort &= IsTwoByteData(Cases[i]); + + if (Options.Verbosity >= 3) + Printf("TraceSwitch: %p %zd # %zd; TryShort %d\n", PC, Val, NumCases, + TryShort); + + for (size_t i = 0; i < NumCases; i++) { + TryToAddDesiredData(Val, Cases[i], ValSize); + if (TryShort) + TryToAddDesiredData(Val, Cases[i], 2); + } + +} + static TraceState *TS; void Fuzzer::StartTraceRecording() { if (!TS) return; + if (ReallyHaveDFSan()) + for (size_t i = 0; i < static_cast(Options.MaxLen); i++) + dfsan_set_label(i + 1, &CurrentUnit[i], 1); TS->StartTraceRecording(); } size_t Fuzzer::StopTraceRecording() { if (!TS) return 0; - return TS->StopTraceRecording(); + return TS->StopTraceRecording(USF.GetRand()); } void Fuzzer::ApplyTraceBasedMutation(size_t Idx, Unit *U) { @@ -333,11 +374,19 @@ void Fuzzer::InitializeTraceState() { for (size_t i = 0; i < static_cast(Options.MaxLen); i++) { dfsan_label L = dfsan_create_label("input", (void*)(i + 1)); // We assume that no one else has called dfsan_create_label before. - assert(L == i + 1); - dfsan_set_label(L, &CurrentUnit[i], 1); + if (L != i + 1) { + Printf("DFSan labels are not starting from 1, exiting\n"); + exit(1); + } } } +static size_t InternalStrnlen(const char *S, size_t MaxLen) { + size_t Len = 0; + for (; Len < MaxLen && S[Len]; Len++) {} + return Len; +} + } // namespace fuzzer using fuzzer::TS; @@ -346,7 +395,7 @@ extern "C" { void __dfsw___sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1, uint64_t Arg2, dfsan_label L0, dfsan_label L1, dfsan_label L2) { - assert(TS); + if (!TS) return; assert(L0 == 0); uintptr_t PC = reinterpret_cast(__builtin_return_address(0)); uint64_t CmpSize = (SizeAndType >> 32) / 8; @@ -354,12 +403,35 @@ void __dfsw___sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1, TS->DFSanCmpCallback(PC, CmpSize, Type, Arg1, Arg2, L1, L2); } +void __dfsw___sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases, + dfsan_label L1, dfsan_label L2) { + if (!TS) return; + uintptr_t PC = reinterpret_cast(__builtin_return_address(0)); + TS->DFSanSwitchCallback(PC, Cases[1], Val, Cases[0], Cases+2, L1); +} + void dfsan_weak_hook_memcmp(void *caller_pc, const void *s1, const void *s2, size_t n, dfsan_label s1_label, dfsan_label s2_label, dfsan_label n_label) { - assert(TS); + if (!TS) return; + uintptr_t PC = reinterpret_cast(caller_pc); + uint64_t S1 = 0, S2 = 0; + // Simplification: handle only first 8 bytes. + memcpy(&S1, s1, std::min(n, sizeof(S1))); + memcpy(&S2, s2, std::min(n, sizeof(S2))); + dfsan_label L1 = dfsan_read_label(s1, n); + dfsan_label L2 = dfsan_read_label(s2, n); + TS->DFSanCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2, L1, L2); +} + +void dfsan_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2, + size_t n, dfsan_label s1_label, + dfsan_label s2_label, dfsan_label n_label) { + if (!TS) return; uintptr_t PC = reinterpret_cast(caller_pc); uint64_t S1 = 0, S2 = 0; + n = std::min(n, fuzzer::InternalStrnlen(s1, n)); + n = std::min(n, fuzzer::InternalStrnlen(s2, n)); // Simplification: handle only first 8 bytes. memcpy(&S1, s1, std::min(n, sizeof(S1))); memcpy(&S2, s2, std::min(n, sizeof(S2))); @@ -368,12 +440,80 @@ void dfsan_weak_hook_memcmp(void *caller_pc, const void *s1, const void *s2, TS->DFSanCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2, L1, L2); } +void dfsan_weak_hook_strcmp(void *caller_pc, const char *s1, const char *s2, + dfsan_label s1_label, dfsan_label s2_label) { + if (!TS) return; + uintptr_t PC = reinterpret_cast(caller_pc); + uint64_t S1 = 0, S2 = 0; + size_t Len1 = strlen(s1); + size_t Len2 = strlen(s2); + size_t N = std::min(Len1, Len2); + if (N <= 1) return; // Not interesting. + // Simplification: handle only first 8 bytes. + memcpy(&S1, s1, std::min(N, sizeof(S1))); + memcpy(&S2, s2, std::min(N, sizeof(S2))); + dfsan_label L1 = dfsan_read_label(s1, Len1); + dfsan_label L2 = dfsan_read_label(s2, Len2); + TS->DFSanCmpCallback(PC, N, fuzzer::ICMP_EQ, S1, S2, L1, L2); +} + +void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1, + const void *s2, size_t n) { + if (!TS) return; + uintptr_t PC = reinterpret_cast(caller_pc); + uint64_t S1 = 0, S2 = 0; + // Simplification: handle only first 8 bytes. + memcpy(&S1, s1, std::min(n, sizeof(S1))); + memcpy(&S2, s2, std::min(n, sizeof(S2))); + TS->TraceCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2); +} + +void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1, + const char *s2, size_t n) { + if (!TS) return; + uintptr_t PC = reinterpret_cast(caller_pc); + uint64_t S1 = 0, S2 = 0; + size_t Len1 = fuzzer::InternalStrnlen(s1, n); + size_t Len2 = fuzzer::InternalStrnlen(s2, n); + n = std::min(n, Len1); + n = std::min(n, Len2); + if (n <= 1) return; // Not interesting. + // Simplification: handle only first 8 bytes. + memcpy(&S1, s1, std::min(n, sizeof(S1))); + memcpy(&S2, s2, std::min(n, sizeof(S2))); + TS->TraceCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2); +} + +void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1, + const char *s2) { + if (!TS) return; + uintptr_t PC = reinterpret_cast(caller_pc); + uint64_t S1 = 0, S2 = 0; + size_t Len1 = strlen(s1); + size_t Len2 = strlen(s2); + size_t N = std::min(Len1, Len2); + if (N <= 1) return; // Not interesting. + // Simplification: handle only first 8 bytes. + memcpy(&S1, s1, std::min(N, sizeof(S1))); + memcpy(&S2, s2, std::min(N, sizeof(S2))); + TS->TraceCmpCallback(PC, N, fuzzer::ICMP_EQ, S1, S2); +} + +__attribute__((visibility("default"))) void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1, uint64_t Arg2) { if (!TS) return; + uintptr_t PC = reinterpret_cast(__builtin_return_address(0)); uint64_t CmpSize = (SizeAndType >> 32) / 8; uint64_t Type = (SizeAndType << 32) >> 32; - TS->TraceCmpCallback(CmpSize, Type, Arg1, Arg2); + TS->TraceCmpCallback(PC, CmpSize, Type, Arg1, Arg2); +} + +__attribute__((visibility("default"))) +void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases) { + if (!TS) return; + uintptr_t PC = reinterpret_cast(__builtin_return_address(0)); + TS->TraceSwitchCallback(PC, Cases[1], Val, Cases[0], Cases + 2); } } // extern "C"