This is an archive of the discontinued LLVM Phabricator instance.

[SanitizerCoverage] Add instrumentation callbacks for FP cmp instructions
Needs RevisionPublic

Authored by shouc on Feb 11 2022, 11:40 PM.

Details

Summary

Fuzzers need to add branch instrumentation. Current callbacks only consider integer instrumentation (i.e., integer related branches). This commit adds similar sancov trace callback funcs for floating point (half, float, and double) comparisons:

+  void __sanitizer_cov_trace_cmp_fp2(half Arg1, half Arg2);
+  void __sanitizer_cov_trace_cmp_fp4(float Arg1, float Arg2);
+  void __sanitizer_cov_trace_cmp_fp8(double Arg1, double Arg2);
+  void __sanitizer_cov_trace_const_cmp_fp2(half Arg1, half Arg2);
+  void __sanitizer_cov_trace_const_cmp_fp4(float Arg1, float Arg2);
+  void __sanitizer_cov_trace_const_cmp_fp8(double Arg1, double Arg2);

Diff Detail

Event Timeline

shouc created this revision.Feb 11 2022, 11:40 PM
shouc requested review of this revision.Feb 11 2022, 11:40 PM
Herald added projects: Restricted Project, Restricted Project, Restricted Project. · View Herald TranscriptFeb 11 2022, 11:40 PM
Herald added subscribers: llvm-commits, Restricted Project, cfe-commits. · View Herald Transcript
shouc updated this revision to Diff 408164.Feb 11 2022, 11:49 PM
shouc updated this revision to Diff 408214.Feb 12 2022, 1:27 PM

Add support for dfsan

vitalybuka added inline comments.Mar 29 2022, 1:44 PM
compiler-rt/lib/sanitizer_common/sanitizer_interface_internal.h
91 ↗(On Diff #408214)

please rebase and clang-format the patch

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp
967–983

Can you please, in a separate patch, extract utility method:
void InsertCallbackForTraceForCmp(CallbackIdx, CallbackArgsTy, A0, A1...

And than in the D119621
you can do

if (isa<ICmpInst>(I)) {
  ...
  InsertCallbackForTraceForCmp
} else if isa<FCmpInst>(I)) {
  ...
  InsertCallbackForTraceForCmp
}

Please link them into stack using "edit related revisions" in the top of the review

Herald added a project: Restricted Project. · View Herald TranscriptMar 29 2022, 1:44 PM
browneee added inline comments.Mar 29 2022, 2:59 PM
compiler-rt/lib/dfsan/dfsan_custom.cpp
2515–2540 ↗(On Diff #408214)

This (including the existing code) wouldn't work if dfsan-track-origins=1.

I guess this is something no one has tried, so probably not important? I'm also unsure where dfsan + sancov is used?

compiler-rt/lib/fuzzer/dataflow/DataFlowCallbacks.cpp
92 ↗(On Diff #408214)

Note that many of the lib/fuzzer/dataflow/ tests were disabled, as no one was using this... and I think they are still disabled.

vitalybuka requested changes to this revision.Dec 7 2022, 1:29 PM

Please update if it's still relevant

This revision now requires changes to proceed.Dec 7 2022, 1:29 PM