// Copyright 2021 The Tint Authors. // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. #include "fuzzers/tint_common_fuzzer.h" #include <cassert> #include <cstring> #include <fstream> #include <memory> #include <sstream> #include <string> #include <utility> #include <vector> #if TINT_BUILD_SPV_READER #include "spirv-tools/libspirv.hpp" #endif // TINT_BUILD_SPV_READER #include "src/ast/module.h" #include "src/diagnostic/formatter.h" #include "src/program.h" #include "src/utils/hash.h" namespace tint { namespace fuzzers { namespace { // A macro is used to avoid FATAL_ERROR creating its own stack frame. This leads // to better de-duplication of bug reports, because ClusterFuzz only uses the // top few stack frames for de-duplication, and a FATAL_ERROR stack frame // provides no useful information. #define FATAL_ERROR(diags, msg_string) \ do { \ std::string msg = msg_string; \ auto printer = tint::diag::Printer::create(stderr, true); \ if (!msg.empty()) { \ printer->write(msg + "\n", {diag::Color::kRed, true}); \ } \ tint::diag::Formatter().format(diags, printer.get()); \ __builtin_trap(); \ } while (false) [[noreturn]] void TintInternalCompilerErrorReporter( const tint::diag::List& diagnostics) { FATAL_ERROR(diagnostics, ""); } // Wrapping this in a macro so it can be a one-liner in the code, but not // introducing another level in the stack trace. This will help with de-duping // ClusterFuzz issues. #define CHECK_INSPECTOR(inspector) \ do { \ if (inspector.has_error()) { \ FATAL_ERROR(program->Diagnostics(), \ "Inspector failed: " + inspector.error()); \ } \ } while (false) bool SPIRVToolsValidationCheck(const tint::Program& program, const std::vector<uint32_t>& spirv) { spvtools::SpirvTools tools(SPV_ENV_VULKAN_1_1); const tint::diag::List& diags = program.Diagnostics(); tools.SetMessageConsumer([diags](spv_message_level_t, const char*, const spv_position_t& pos, const char* msg) { std::stringstream out; out << "Unexpected spirv-val error:\n" << (pos.line + 1) << ":" << (pos.column + 1) << ": " << msg << std::endl; auto printer = tint::diag::Printer::create(stderr, true); printer->write(out.str(), {diag::Color::kYellow, false}); tint::diag::Formatter().format(diags, printer.get()); }); return tools.Validate(spirv.data(), spirv.size(), spvtools::ValidatorOptions()); } } // namespace void GenerateSpirvOptions(DataBuilder* b, writer::spirv::Options* options) { *options = b->build<writer::spirv::Options>(); } void GenerateWgslOptions(DataBuilder* b, writer::wgsl::Options* options) { *options = b->build<writer::wgsl::Options>(); } void GenerateHlslOptions(DataBuilder* b, writer::hlsl::Options* options) { *options = b->build<writer::hlsl::Options>(); } void GenerateMslOptions(DataBuilder* b, writer::msl::Options* options) { *options = b->build<writer::msl::Options>(); } CommonFuzzer::CommonFuzzer(InputFormat input, OutputFormat output) : input_(input), output_(output) {} CommonFuzzer::~CommonFuzzer() = default; int CommonFuzzer::Run(const uint8_t* data, size_t size) { tint::SetInternalCompilerErrorReporter(&TintInternalCompilerErrorReporter); Program program; #if TINT_BUILD_SPV_READER std::vector<uint32_t> spirv_input(size / sizeof(uint32_t)); #endif // TINT_BUILD_SPV_READER #if TINT_BUILD_WGSL_READER || TINT_BUILD_SPV_READER auto dump_input_data = [&](auto& content, const char* extension) { size_t hash = utils::Hash(content); auto filename = "fuzzer_input_" + std::to_string(hash) + extension; // std::ofstream fout(filename, std::ios::binary); fout.write(reinterpret_cast<const char*>(data), static_cast<std::streamsize>(size)); std::cout << "Dumped input data to " << filename << std::endl; }; #endif switch (input_) { #if TINT_BUILD_WGSL_READER case InputFormat::kWGSL: { // Clear any existing diagnostics, as these will hold pointers to file_, // which we are about to release. diagnostics_ = {}; std::string str(reinterpret_cast<const char*>(data), size); file_ = std::make_unique<Source::File>("test.wgsl", str); if (dump_input_) { dump_input_data(str, ".wgsl"); } program = reader::wgsl::Parse(file_.get()); break; } #endif // TINT_BUILD_WGSL_READER #if TINT_BUILD_SPV_READER case InputFormat::kSpv: { // `spirv_input` has been initialized with the capacity to store `size / // sizeof(uint32_t)` uint32_t values. If `size` is not a multiple of // sizeof(uint32_t) then not all of `data` can be copied into // `spirv_input`, and any trailing bytes are discarded. std::memcpy(spirv_input.data(), data, spirv_input.size() * sizeof(uint32_t)); if (spirv_input.empty()) { return 0; } if (dump_input_) { dump_input_data(spirv_input, ".spv"); } program = reader::spirv::Parse(spirv_input); break; } #endif // TINT_BUILD_SPV_READER } if (!program.IsValid()) { diagnostics_ = program.Diagnostics(); return 0; } #if TINT_BUILD_SPV_READER if (input_ == InputFormat::kSpv && !SPIRVToolsValidationCheck(program, spirv_input)) { FATAL_ERROR( program.Diagnostics(), "Fuzzing detected invalid input spirv not being caught by Tint"); } #endif // TINT_BUILD_SPV_READER RunInspector(&program); if (transform_manager_) { auto out = transform_manager_->Run(&program, *transform_inputs_); if (!out.program.IsValid()) { // Transforms can produce error messages for bad input. // Catch ICEs and errors from non transform systems. for (const auto& diag : out.program.Diagnostics()) { if (diag.severity > diag::Severity::Error || diag.system != diag::System::Transform) { FATAL_ERROR(out.program.Diagnostics(), "Fuzzing detected valid input program being transformed " "into an invalid output program"); } } } program = std::move(out.program); RunInspector(&program); } switch (output_) { case OutputFormat::kWGSL: { #if TINT_BUILD_WGSL_WRITER auto result = writer::wgsl::Generate(&program, options_wgsl_); generated_wgsl_ = std::move(result.wgsl); if (!result.success) { FATAL_ERROR(program.Diagnostics(), "WGSL writer errored on validated input:\n" + result.error); } #endif // TINT_BUILD_WGSL_WRITER break; } case OutputFormat::kSpv: { #if TINT_BUILD_SPV_WRITER auto result = writer::spirv::Generate(&program, options_spirv_); generated_spirv_ = std::move(result.spirv); if (!result.success) { FATAL_ERROR( program.Diagnostics(), "SPIR-V writer errored on validated input:\n" + result.error); } if (!SPIRVToolsValidationCheck(program, generated_spirv_)) { FATAL_ERROR(program.Diagnostics(), "Fuzzing detected invalid spirv being emitted by Tint"); } #endif // TINT_BUILD_SPV_WRITER break; } case OutputFormat::kHLSL: { #if TINT_BUILD_HLSL_WRITER auto result = writer::hlsl::Generate(&program, options_hlsl_); generated_hlsl_ = std::move(result.hlsl); if (!result.success) { FATAL_ERROR(program.Diagnostics(), "HLSL writer errored on validated input:\n" + result.error); } #endif // TINT_BUILD_HLSL_WRITER break; } case OutputFormat::kMSL: { #if TINT_BUILD_MSL_WRITER auto result = writer::msl::Generate(&program, options_msl_); generated_msl_ = std::move(result.msl); if (!result.success) { FATAL_ERROR(program.Diagnostics(), "MSL writer errored on validated input:\n" + result.error); } #endif // TINT_BUILD_MSL_WRITER break; } } return 0; } void CommonFuzzer::RunInspector(Program* program) { inspector::Inspector inspector(program); auto entry_points = inspector.GetEntryPoints(); CHECK_INSPECTOR(inspector); auto constant_ids = inspector.GetConstantIDs(); CHECK_INSPECTOR(inspector); auto constant_name_to_id = inspector.GetConstantNameToIdMap(); CHECK_INSPECTOR(inspector); for (auto& ep : entry_points) { inspector.GetRemappedNameForEntryPoint(ep.name); CHECK_INSPECTOR(inspector); inspector.GetStorageSize(ep.name); CHECK_INSPECTOR(inspector); inspector.GetResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetUniformBufferResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetStorageBufferResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetReadOnlyStorageBufferResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetSamplerResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetComparisonSamplerResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetSampledTextureResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetMultisampledTextureResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetWriteOnlyStorageTextureResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetDepthTextureResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetDepthMultisampledTextureResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetExternalTextureResourceBindings(ep.name); CHECK_INSPECTOR(inspector); inspector.GetSamplerTextureUses(ep.name); CHECK_INSPECTOR(inspector); inspector.GetWorkgroupStorageSize(ep.name); CHECK_INSPECTOR(inspector); } } } // namespace fuzzers } // namespace tint