Test parts of API with libFuzzer.

Co-authored-by: omar.ahmed@codeplay.com
oneapi-src · Aug 18, 2023 · d25e5e2 · d25e5e2
1 parent f7a1a7a
commit d25e5e2
Show file tree

Hide file tree

Showing 13 changed files with 988 additions and 1 deletion.
diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
@@ -88,6 +88,60 @@ jobs:
       working-directory: ${{github.workspace}}/build
       run: ctest -C ${{matrix.build_type}} --output-on-failure -L "python|umf|loader|validation|tracing|unit|urtrace"
 
+  fuzztest-build:
+    name: Build and run quick fuzztest scenarios
+    strategy:
+      matrix:
+        build_type: [Debug, Release]
+        compiler: [{c: clang, cxx: clang++}]
+
+    runs-on: 'ubuntu-22.04'
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Install apt packages
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y doxygen ${{matrix.compiler.c}}
+
+    - name: Install pip packages
+      run: pip install -r third_party/requirements.txt
+
+    - name: Download DPC++
+      run: |
+        sudo apt install libncurses5
+        wget -O ${{github.workspace}}/dpcpp_compiler.tar.gz https://github.com/intel/llvm/releases/download/sycl-nightly%2F20230626/dpcpp-compiler.tar.gz
+        tar -xvf ${{github.workspace}}/dpcpp_compiler.tar.gz
+
+    - name: Setup DPC++
+      run: |
+        source ${{github.workspace}}/dpcpp_compiler/startup.sh
+
+    - name: Configure CMake
+      run: >
+        cmake
+        -B${{github.workspace}}/build
+        -DCMAKE_C_COMPILER=${{matrix.compiler.c}}
+        -DCMAKE_CXX_COMPILER=${{matrix.compiler.cxx}}
+        -DUR_ENABLE_TRACING=OFF
+        -DCMAKE_BUILD_TYPE=${{matrix.build_type}}
+        -DUR_BUILD_TESTS=ON
+        -DUR_FORMAT_CPP_STYLE=ON
+        -DUR_USE_ASAN=ON
+        -DUR_USE_UBSAN=ON
+        -DUR_DPCXX=${{github.workspace}}/dpcpp_compiler/bin/clang++
+
+    - name: Generate source from spec, check for uncommitted diff
+      run: cmake --build ${{github.workspace}}/build --target check-generated
+
+    - name: Build
+      run: cmake --build ${{github.workspace}}/build -j $(nproc)
+
+    - name: Fuzz test
+      working-directory: ${{github.workspace}}/build
+      run: ctest -C ${{matrix.build_type}} --output-on-failure -L "fuzz$"
+
   adapter-build:
     name: Build - Adapters on Ubuntu
     strategy:

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
@@ -0,0 +1,60 @@
+name: Nightly
+
+on:
+  schedule:
+    - cron: '0 23 * * *'
+
+jobs:
+  ubuntu-build:
+    name: Build - Ubuntu
+    strategy:
+      matrix:
+        build_type: [Debug, Release]
+        compiler: [{c: clang, cxx: clang++}]
+
+    runs-on: 'ubuntu-22.04'
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Install apt packages
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y doxygen ${{matrix.compiler.c}}
+
+    - name: Install pip packages
+      run: pip install -r third_party/requirements.txt
+
+    - name: Download DPC++
+      run: |
+        sudo apt install libncurses5
+        wget -O ${{github.workspace}}/dpcpp_compiler.tar.gz https://github.com/intel/llvm/releases/download/sycl-nightly%2F20230626/dpcpp-compiler.tar.gz
+        tar -xvf ${{github.workspace}}/dpcpp_compiler.tar.gz
+
+    - name: Setup DPC++
+      run: |
+        source ${{github.workspace}}/dpcpp_compiler/startup.sh
+
+    - name: Configure CMake
+      run: >
+        cmake
+        -B${{github.workspace}}/build
+        -DCMAKE_C_COMPILER=${{matrix.compiler.c}}
+        -DCMAKE_CXX_COMPILER=${{matrix.compiler.cxx}}
+        -DUR_ENABLE_TRACING=OFF
+        -DCMAKE_BUILD_TYPE=${{matrix.build_type}}
+        -DUR_BUILD_TESTS=ON
+        -DUR_FORMAT_CPP_STYLE=ON
+        -DUR_USE_ASAN=ON
+        -DUR_USE_UBSAN=ON
+        -DUR_DPCXX=${{github.workspace}}/dpcpp_compiler/bin/clang++
+
+    - name: Generate source from spec, check for uncommitted diff
+      run: cmake --build ${{github.workspace}}/build --target check-generated
+
+    - name: Build
+      run: cmake --build ${{github.workspace}}/build -j $(nproc)
+
+    - name: Fuzz long test
+      working-directory: ${{github.workspace}}/build
+      run: ctest -C ${{matrix.build_type}} --output-on-failure -L "fuzz-long"
diff --git a/source/adapters/null/ur_null.cpp b/source/adapters/null/ur_null.cpp
@@ -163,5 +163,68 @@ context_t::context_t() {
             }
             return UR_RESULT_SUCCESS;
         };
+
+    //////////////////////////////////////////////////////////////////////////
+    urDdiTable.USM.pfnHostAlloc =
+        [](ur_context_handle_t hContext, const ur_usm_desc_t *pUSMDesc,
+           ur_usm_pool_handle_t pool, size_t size, void **ppMem) {
+            if (size == 0) {
+                *ppMem = nullptr;
+                return UR_RESULT_ERROR_UNSUPPORTED_SIZE;
+            }
+            *ppMem = malloc(size);
+            if (ppMem == nullptr) {
+                return UR_RESULT_ERROR_OUT_OF_HOST_MEMORY;
+            }
+            return UR_RESULT_SUCCESS;
+        };
+
+    //////////////////////////////////////////////////////////////////////////
+    urDdiTable.USM.pfnDeviceAlloc =
+        [](ur_context_handle_t hContext, ur_device_handle_t hDevice,
+           const ur_usm_desc_t *pUSMDesc, ur_usm_pool_handle_t pool,
+           size_t size, void **ppMem) {
+            if (size == 0) {
+                *ppMem = nullptr;
+                return UR_RESULT_ERROR_UNSUPPORTED_SIZE;
+            }
+            *ppMem = malloc(size);
+            if (ppMem == nullptr) {
+                return UR_RESULT_ERROR_OUT_OF_HOST_MEMORY;
+            }
+            return UR_RESULT_SUCCESS;
+        };
+
+    //////////////////////////////////////////////////////////////////////////
+    urDdiTable.USM.pfnFree = [](ur_context_handle_t hContext, void *pMem) {
+        free(pMem);
+        return UR_RESULT_SUCCESS;
+    };
+
+    //////////////////////////////////////////////////////////////////////////
+    urDdiTable.USM.pfnGetMemAllocInfo =
+        [](ur_context_handle_t hContext, const void *pMem,
+           ur_usm_alloc_info_t propName, size_t propSize, void *pPropValue,
+           size_t *pPropSizeRet) {
+            switch (propName) {
+            case UR_USM_ALLOC_INFO_TYPE:
+                *reinterpret_cast<ur_usm_type_t *>(pPropValue) =
+                    pMem ? UR_USM_TYPE_DEVICE : UR_USM_TYPE_UNKNOWN;
+                if (pPropSizeRet != nullptr) {
+                    *pPropSizeRet = sizeof(ur_usm_type_t);
+                }
+                break;
+            case UR_USM_ALLOC_INFO_SIZE:
+                *reinterpret_cast<size_t *>(pPropValue) = pMem ? SIZE_MAX : 0;
+                if (pPropSizeRet != nullptr) {
+                    *pPropSizeRet = sizeof(size_t);
+                }
+                break;
+            default:
+                pPropValue = nullptr;
+                break;
+            }
+            return UR_RESULT_SUCCESS;
+        };
 }
 } // namespace driver
diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
@@ -24,3 +24,6 @@ add_subdirectory(unit)
 if(UR_BUILD_TOOLS)
   add_subdirectory(tools)
 endif()
+if(CMAKE_CXX_COMPILER_ID STREQUAL "Clang" AND DEFINED UR_DPCXX)
+    add_subdirectory(fuzz)
+endif()
diff --git a/test/conformance/CMakeLists.txt b/test/conformance/CMakeLists.txt
@@ -88,7 +88,7 @@ if(DEFINED UR_DPCXX)
     add_custom_target(generate_device_binaries)
 
     set(UR_CONFORMANCE_DEVICE_BINARIES_DIR
-        "${CMAKE_CURRENT_BINARY_DIR}/device_binaries/")
+        "${CMAKE_CURRENT_BINARY_DIR}/device_binaries" CACHE INTERNAL UR_CONFORMANCE_DEVICE_BINARIES_DIR)
     file(MAKE_DIRECTORY ${UR_CONFORMANCE_DEVICE_BINARIES_DIR})
 
     if(DEFINED UR_CONFORMANCE_TARGET_TRIPLES)

diff --git a/test/fuzz/CMakeLists.txt b/test/fuzz/CMakeLists.txt
@@ -0,0 +1,44 @@
+# Copyright (C) 2023 Intel Corporation
+# Part of the Unified-Runtime Project, under the Apache License v2.0 with LLVM Exceptions.
+# See LICENSE.TXT
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+function(add_fuzz_test name label)
+    set(TEST_TARGET_NAME fuzztest-${name})
+    add_ur_executable(${TEST_TARGET_NAME}
+        urFuzz.cpp)
+    target_link_libraries(${TEST_TARGET_NAME}
+        PRIVATE
+        ${PROJECT_NAME}::loader
+        ${PROJECT_NAME}::headers
+        ${PROJECT_NAME}::common
+        -fsanitize=fuzzer)
+    add_test(NAME ${TEST_TARGET_NAME}
+        COMMAND ${TEST_TARGET_NAME} ${ARGN}
+        WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+    set_tests_properties(${TEST_TARGET_NAME} PROPERTIES
+        LABELS ${label}
+        ENVIRONMENT
+            "UR_ENABLE_LAYERS=UR_LAYER_FULL_VALIDATION;UR_ADAPTERS_FORCE_LOAD=\"$<TARGET_FILE:ur_adapter_null>\"")
+    target_compile_options(${TEST_TARGET_NAME} PRIVATE -g -fsanitize=fuzzer)
+    target_compile_definitions(${TEST_TARGET_NAME} PRIVATE -DKERNEL_IL_PATH="${UR_CONFORMANCE_DEVICE_BINARIES_DIR}/bar/sycl_spir641.spv")
+    target_include_directories(${TEST_TARGET_NAME} PRIVATE ${UR_CONFORMANCE_DEVICE_BINARIES_DIR})
+
+    add_dependencies(${TEST_TARGET_NAME} generate_device_binaries)
+endfunction()
+
+add_fuzz_test(base fuzz-long
+    -max_total_time=600 -seed=1 -verbosity=1)
+
+set(CORPUS_DIR ${CMAKE_CURRENT_SOURCE_DIR}/corpus)
+add_fuzz_test(alloc fuzz
+    ${CORPUS_DIR}/alloc -verbosity=1)
+
+add_fuzz_test(create-release fuzz
+    ${CORPUS_DIR}/create-release -verbosity=1)
+
+add_fuzz_test(kernel-launch fuzz
+    ${CORPUS_DIR}/kernel-launch -verbosity=1)
+
+add_fuzz_test(pool-alloc fuzz
+    ${CORPUS_DIR}/pool-alloc -verbosity=1)
diff --git a/test/fuzz/corpus/README.md b/test/fuzz/corpus/README.md
@@ -0,0 +1,87 @@
+# Corpra for fuzz tests with fixed API calls scenarios
+These corpra contain UR API calls in a predefined order described below.
+All scenarios begin with single calls to urInit() and urAdapterGet().
+
+## create-release
+Test device/context/pool create and release
+
+urPlatformGet()
+urPlatformGet()
+urDeviceGet()
+urDeviceGet()
+urDeviceRelease()
+urDeviceGet()
+urDeviceGet()
+urContextCreate()
+urContextRelease()
+urContextCreate()
+urUSMPoolCreate()
+urUSMPoolCreate()
+urUSMPoolRelease()
+urUSMPoolRelease()
+urUSMPoolCreate()
+urUSMPoolCreate()
+urUSMPoolCreate()
+urUSMPoolCreate()
+urUSMPoolRelease()
+urUSMPoolRelease()
+urUSMPoolRelease()
+urUSMPoolRelease()
+urContextRelease()
+
+## pool-alloc
+Allocate with host and device pools
+
+urPlatformGet()
+urPlatformGet()
+urDeviceGet()
+urDeviceGet()
+urContextCreate()
+urUSMPoolCreate()
+urUSMPoolCreate()
+urUSMPoolCreate()
+urUSMPoolCreate()
+urUSMHostAlloc()
+urUSMDeviceAlloc()
+urUSMFree()
+urUSMPoolRelease()
+urUSMPoolRelease()
+urUSMFree()
+urUSMPoolRelease()
+urUSMPoolRelease()
+urContextRelease()
+
+## alloc
+Allocate on host/device, no pools
+
+urPlatformGet()
+urPlatformGet()
+urDeviceGet()
+urDeviceGet()
+urContextCreate()
+urUSMHostAlloc()
+urUSMDeviceAlloc()
+urUSMFree()
+urUSMFree()
+urContextRelease()
+
+## kernel-launch
+Launch kernel
+
+urPlatformGet()
+urPlatformGet()
+urDeviceGet()
+urDeviceGet()
+urContextCreate()
+urProgramCreateWithIL()
+urProgramBuild()
+urKernelCreate()
+urQueueCreate()
+urEnqueueKernelLaunch()
+urEventWait()
+urEventRelease()
+urQueueFinish()
+urQueueRelease()
+urKernelRelease()
+urProgramRelease()
+urContextRelease()
diff --git a/test/fuzz/corpus/alloc b/test/fuzz/corpus/alloc
diff --git a/test/fuzz/corpus/create-release b/test/fuzz/corpus/create-release
diff --git a/test/fuzz/corpus/kernel-launch b/test/fuzz/corpus/kernel-launch
diff --git a/test/fuzz/corpus/pool-alloc b/test/fuzz/corpus/pool-alloc