Add fuzzers for SPIRV-Cross
This CL adds in fuzzers for SPIRV-Cross for HLSL, GLSL, and MSL
outputs. These fuzzers live in Dawn because there is not appropriate
location in the Chromium source repo for them and it is unlikely they
would be land-able in the SPIRV-Cross repo, because it is not coupled
with Chromium's build system and thus Clusterfuzz so would be
effectively dead code. Dawn depends on this code, but it is also
integrated into the Chromium build system, so this was the best place
I could find for them
The code under fuzz unfortunately uses exceptions/aborting as its
error reporting mechanism. This is an acknowledge short coming and
there are efforts to remove this behaviour. To work around this and
reduce the number of false positives found by the fuzzers, a signal
trap has been implemented which will be removed once the code under
fuzz has been updated.
The trap replaces the existing signal handler and silencing signals
while running the code under test. This allows the code under test to
call abort() and not crash the fuzzing process. Theoretically, only
SIGABRT should need to be trapped, but something is causing the signal
from abort() to be converted to SIGSEGV when running under ASAN.
This signal trap has been tested with the fuzzing/sanitizers by
intentionally inserting bad calls that will occur after a few thousand
test cases. It was confirmed that the fuzzer detected the issue and
stops fuzzing.
The alternate to implementing this signal trap would be to turn on
exceptions for the fuzzer. This was attempted, but proved to be
fruitless due to what was reported as an ODR issue, but couldn't
couldn't be silenced. The likely underlying issue was a pre-built
library or other object being built without exceptions was causing
different versions of symbols or the exception version of the standard
library not being instrumented by ASAN. Given the majority of Chromium
eco-system turns off exceptions, fixing this issue would not be
helpful to the larger community and was looking like it would require
significant effort.
BUG=chromium:903380
Change-Id: I63a5595383f99b7a0e150d72bb04c89b8d722631
Reviewed-on: https://dawn-review.googlesource.com/c/2260
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
2018-11-12 12:20:21 +00:00
|
|
|
// Copyright 2018 The Dawn Authors
|
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
#include <csetjmp>
|
|
|
|
#include <csignal>
|
|
|
|
#include <cstdint>
|
|
|
|
#include <string>
|
|
|
|
#include <vector>
|
|
|
|
|
|
|
|
#include "DawnSPIRVCrossFuzzer.h"
|
|
|
|
|
|
|
|
namespace {
|
|
|
|
|
|
|
|
std::jmp_buf jump_buffer;
|
|
|
|
void (*old_signal_handler)(int);
|
|
|
|
|
|
|
|
// Handler to trap signals, so that it doesn't crash the fuzzer when running
|
|
|
|
// the code under test. Currently the
|
|
|
|
// code being fuzzed uses abort() to report errors like bad input instead of
|
|
|
|
// returning an error code. This will be changing in the future.
|
|
|
|
//
|
|
|
|
// TODO(rharrison): Remove all of this signal trapping once SPIRV-Cross has
|
|
|
|
// been changed to not use abort() for reporting errors.
|
|
|
|
[[noreturn]] static void sigabrt_trap(int sig) {
|
|
|
|
std::longjmp(jump_buffer, 1);
|
|
|
|
}
|
|
|
|
|
|
|
|
// Setup the SIGABRT trap
|
|
|
|
void BeginSIGABRTTrap() {
|
|
|
|
old_signal_handler = signal(SIGABRT, sigabrt_trap);
|
|
|
|
if (old_signal_handler == SIG_ERR)
|
|
|
|
abort();
|
|
|
|
}
|
|
|
|
|
|
|
|
// Restore the previous signal handler
|
|
|
|
void EndSIGABRTTrap() {
|
|
|
|
signal(SIGABRT, old_signal_handler);
|
|
|
|
}
|
|
|
|
|
|
|
|
} // namespace
|
|
|
|
|
|
|
|
namespace DawnSPIRVCrossFuzzer {
|
|
|
|
|
2018-11-19 19:20:08 +00:00
|
|
|
void ExecuteWithSignalTrap(std::function<void()> exec) {
|
Add fuzzers for SPIRV-Cross
This CL adds in fuzzers for SPIRV-Cross for HLSL, GLSL, and MSL
outputs. These fuzzers live in Dawn because there is not appropriate
location in the Chromium source repo for them and it is unlikely they
would be land-able in the SPIRV-Cross repo, because it is not coupled
with Chromium's build system and thus Clusterfuzz so would be
effectively dead code. Dawn depends on this code, but it is also
integrated into the Chromium build system, so this was the best place
I could find for them
The code under fuzz unfortunately uses exceptions/aborting as its
error reporting mechanism. This is an acknowledge short coming and
there are efforts to remove this behaviour. To work around this and
reduce the number of false positives found by the fuzzers, a signal
trap has been implemented which will be removed once the code under
fuzz has been updated.
The trap replaces the existing signal handler and silencing signals
while running the code under test. This allows the code under test to
call abort() and not crash the fuzzing process. Theoretically, only
SIGABRT should need to be trapped, but something is causing the signal
from abort() to be converted to SIGSEGV when running under ASAN.
This signal trap has been tested with the fuzzing/sanitizers by
intentionally inserting bad calls that will occur after a few thousand
test cases. It was confirmed that the fuzzer detected the issue and
stops fuzzing.
The alternate to implementing this signal trap would be to turn on
exceptions for the fuzzer. This was attempted, but proved to be
fruitless due to what was reported as an ODR issue, but couldn't
couldn't be silenced. The likely underlying issue was a pre-built
library or other object being built without exceptions was causing
different versions of symbols or the exception version of the standard
library not being instrumented by ASAN. Given the majority of Chromium
eco-system turns off exceptions, fixing this issue would not be
helpful to the larger community and was looking like it would require
significant effort.
BUG=chromium:903380
Change-Id: I63a5595383f99b7a0e150d72bb04c89b8d722631
Reviewed-on: https://dawn-review.googlesource.com/c/2260
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
2018-11-12 12:20:21 +00:00
|
|
|
BeginSIGABRTTrap();
|
|
|
|
|
|
|
|
// On the first pass through setjmp will return 0, if returning here
|
|
|
|
// from the longjmp in the signal handler it will return 1.
|
|
|
|
if (setjmp(jump_buffer) == 0) {
|
2018-11-19 19:20:08 +00:00
|
|
|
exec();
|
Add fuzzers for SPIRV-Cross
This CL adds in fuzzers for SPIRV-Cross for HLSL, GLSL, and MSL
outputs. These fuzzers live in Dawn because there is not appropriate
location in the Chromium source repo for them and it is unlikely they
would be land-able in the SPIRV-Cross repo, because it is not coupled
with Chromium's build system and thus Clusterfuzz so would be
effectively dead code. Dawn depends on this code, but it is also
integrated into the Chromium build system, so this was the best place
I could find for them
The code under fuzz unfortunately uses exceptions/aborting as its
error reporting mechanism. This is an acknowledge short coming and
there are efforts to remove this behaviour. To work around this and
reduce the number of false positives found by the fuzzers, a signal
trap has been implemented which will be removed once the code under
fuzz has been updated.
The trap replaces the existing signal handler and silencing signals
while running the code under test. This allows the code under test to
call abort() and not crash the fuzzing process. Theoretically, only
SIGABRT should need to be trapped, but something is causing the signal
from abort() to be converted to SIGSEGV when running under ASAN.
This signal trap has been tested with the fuzzing/sanitizers by
intentionally inserting bad calls that will occur after a few thousand
test cases. It was confirmed that the fuzzer detected the issue and
stops fuzzing.
The alternate to implementing this signal trap would be to turn on
exceptions for the fuzzer. This was attempted, but proved to be
fruitless due to what was reported as an ODR issue, but couldn't
couldn't be silenced. The likely underlying issue was a pre-built
library or other object being built without exceptions was causing
different versions of symbols or the exception version of the standard
library not being instrumented by ASAN. Given the majority of Chromium
eco-system turns off exceptions, fixing this issue would not be
helpful to the larger community and was looking like it would require
significant effort.
BUG=chromium:903380
Change-Id: I63a5595383f99b7a0e150d72bb04c89b8d722631
Reviewed-on: https://dawn-review.googlesource.com/c/2260
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
2018-11-12 12:20:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
EndSIGABRTTrap();
|
2018-11-19 19:20:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int Run(const uint8_t* data, size_t size, Task task) {
|
|
|
|
size_t sizeInU32 = size / sizeof(uint32_t);
|
|
|
|
const uint32_t* u32Data = reinterpret_cast<const uint32_t*>(data);
|
|
|
|
std::vector<uint32_t> input(u32Data, u32Data + sizeInU32);
|
|
|
|
|
2019-01-30 16:12:28 +00:00
|
|
|
if (input.size() != 0) {
|
|
|
|
task(input);
|
|
|
|
}
|
|
|
|
|
Add fuzzers for SPIRV-Cross
This CL adds in fuzzers for SPIRV-Cross for HLSL, GLSL, and MSL
outputs. These fuzzers live in Dawn because there is not appropriate
location in the Chromium source repo for them and it is unlikely they
would be land-able in the SPIRV-Cross repo, because it is not coupled
with Chromium's build system and thus Clusterfuzz so would be
effectively dead code. Dawn depends on this code, but it is also
integrated into the Chromium build system, so this was the best place
I could find for them
The code under fuzz unfortunately uses exceptions/aborting as its
error reporting mechanism. This is an acknowledge short coming and
there are efforts to remove this behaviour. To work around this and
reduce the number of false positives found by the fuzzers, a signal
trap has been implemented which will be removed once the code under
fuzz has been updated.
The trap replaces the existing signal handler and silencing signals
while running the code under test. This allows the code under test to
call abort() and not crash the fuzzing process. Theoretically, only
SIGABRT should need to be trapped, but something is causing the signal
from abort() to be converted to SIGSEGV when running under ASAN.
This signal trap has been tested with the fuzzing/sanitizers by
intentionally inserting bad calls that will occur after a few thousand
test cases. It was confirmed that the fuzzer detected the issue and
stops fuzzing.
The alternate to implementing this signal trap would be to turn on
exceptions for the fuzzer. This was attempted, but proved to be
fruitless due to what was reported as an ODR issue, but couldn't
couldn't be silenced. The likely underlying issue was a pre-built
library or other object being built without exceptions was causing
different versions of symbols or the exception version of the standard
library not being instrumented by ASAN. Given the majority of Chromium
eco-system turns off exceptions, fixing this issue would not be
helpful to the larger community and was looking like it would require
significant effort.
BUG=chromium:903380
Change-Id: I63a5595383f99b7a0e150d72bb04c89b8d722631
Reviewed-on: https://dawn-review.googlesource.com/c/2260
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
2018-11-12 12:20:21 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
} // namespace DawnSPIRVCrossFuzzer
|