[CFI-Verify] Created llvm-cfi-verify-fuzzer.

[hctim]

Summary

Uses libFuzzer to generate in-memory object files, and then attempts to interpret them for CFI-correctness.
Also implemented the "-q" and "--quiet" flags in the llvm-cfi-verify
tool, which silences intermediate error output when parsing the object
file (but does not suppress the final result output).

llvm/tools/llvm-cfi-verify-fuzzer/CMakeLists.txt

+set(LLVM_LINK_COMPONENTS
+  AllTargetsAsmPrinters
+  AllTargetsAsmParsers
+  AllTargetsDescs
+  AllTargetsDisassemblers
+  AllTargetsInfos
+  Support
+  FuzzMutate
+)
+
+add_llvm_fuzzer(llvm-cfi-verify-fuzzer
+  cfi-verify-fuzzer.cpp
+  DUMMY_MAIN DummyCFIVerifyFuzzer.cpp
+)
+
+target_link_libraries(llvm-cfi-verify-fuzzer PRIVATE LLVMCFIVerify)

llvm/tools/llvm-cfi-verify-fuzzer/DummyCFIVerifyFuzzer.cpp

+//===--- DummyCFIVerifyFuzzer.cpp -----------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Implementation of main so we can build and test without linking libFuzzer.
+//
+//===----------------------------------------------------------------------===//
+
+#include "llvm/FuzzMutate/FuzzerCLI.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
+int main(int argc, char *argv[]) {
+  return llvm::runFuzzerOnInputs(argc, argv, LLVMFuzzerTestOneInput);
+}

llvm/tools/llvm-cfi-verify-fuzzer/cfi-verify-fuzzer.cpp

+//===--- cfi-verify-fuzzer.cpp - Fuzzer for llvm's cfi-verify tool --------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "../tools/llvm-cfi-verify/lib/FileAnalysis.h"
+#include "../tools/llvm-cfi-verify/lib/GraphBuilder.h"
+
+#include "llvm/ADT/ArrayRef.h"
+#include "llvm/ADT/StringRef.h"
+#include "llvm/Support/Error.h"
+
+#include <cstdlib>
+
+namespace llvm {
+namespace cfi_verify_fuzzer {
+
+class FileAnalysisStub : public llvm::cfi_verify::FileAnalysis {
+public:
+  FileAnalysisStub(StringRef Trip)
+      : FileAnalysis(Triple(Trip), SubtargetFeatures()) {}
+
+  // Expose this method publicly for fuzzing.
+  void parseSectionContents(ArrayRef<uint8_t> SectionBytes,
+                            uint64_t SectionAddress) {
+    FileAnalysis::parseSectionContents(SectionBytes, SectionAddress);
+  }
+
+  Error initialiseDisassemblyMembers() {
+    return FileAnalysis::initialiseDisassemblyMembers();
+  }
+};
+
+} // namespace cfi_verify_fuzzer
+} // namespace llvm
+
+bool DoInitialisation() {
+  llvm::InitializeAllTargetInfos();
+  llvm::InitializeAllTargetMCs();
+  llvm::InitializeAllAsmParsers();
+  llvm::InitializeAllDisassemblers();
+
+  llvm::cfi_verify::IgnoreDWARFFlag = true;
+  llvm::cfi_verify::QuietFlag = true;
+  return true;
+}
+
+using llvm::cfi_verify::GraphBuilder;
+using llvm::cfi_verify::GraphResult;
+using llvm::cfi_verify::UnsupportedDisassembly;
+using llvm::cfi_verify_fuzzer::FileAnalysisStub;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  static bool Init = DoInitialisation();
+  (void)(Init); // Suppress unused-variable warning.
+
+  if (Size < sizeof(uint64_t))
+    return 0;
+
+  FileAnalysisStub Stub("x86_64--");
+
+  if (auto Err = Stub.initialiseDisassemblyMembers()) {
+    handleAllErrors(std::move(Err), [&](const UnsupportedDisassembly &E) {
+      printf("Note: CFI-verify-fuzzer is disabled due to lack of architecture "
+             "support on this build.\n");
+      exit(EXIT_SUCCESS);
+    });
+  }
+
+  // Parse the "object file", generated by the fuzzer. The offset of this
+  // section is provided by the first four bytes of the fuzzer.
+  Stub.parseSectionContents(
+      llvm::ArrayRef<uint8_t>(Data + sizeof(uint64_t), Size - sizeof(uint64_t)),
+      *reinterpret_cast<const uint64_t *>(Data));
+
+  // Now extract all the indirect CFs and run normal cross-analysis, like the
+  // cfi-verify tool does.
+  for (uint64_t Address : Stub.getIndirectInstructions()) {
+    Stub.getInstructionOrDie(Address);
+    GraphResult Graph = GraphBuilder::buildFlowGraph(Stub, Address);
+
+    Stub.validateCFIProtection(Graph);
+  }
+
+  return 0;
+}

llvm/tools/llvm-cfi-verify/lib/FileAnalysis.h

 #include <unordered_map>
 
 namespace llvm {
 namespace cfi_verify {
 
 struct GraphResult;
 
 extern bool IgnoreDWARFFlag;
+extern bool QuietFlag;
 
 enum class CFIProtectionStatus {
   // This instruction is protected by CFI.
   PROTECTED,
   // The instruction is not an indirect control flow instruction, and thus
   // shouldn't be protected.
   FAIL_NOT_INDIRECT_CF,
   // There is a path to the instruction that was unexpected.

llvm/tools/llvm-cfi-verify/lib/FileAnalysis.cpp

 
 using Instr = llvm::cfi_verify::FileAnalysis::Instr;
 using LLVMSymbolizer = llvm::symbolize::LLVMSymbolizer;
 
 namespace llvm {
 namespace cfi_verify {
 
 bool IgnoreDWARFFlag;
+bool QuietFlag;
 
 static cl::opt<bool, true> IgnoreDWARFArg(
     "ignore-dwarf",
     cl::desc(
         "Ignore all DWARF data. This relaxes the requirements for all "
         "statically linked libraries to have been compiled with '-g', but "
         "will result in false positives for 'CFI unprotected' instructions."),
     cl::location(IgnoreDWARFFlag), cl::init(false));
 
+static cl::opt<bool, true>
+    QuietArg("q",
+             cl::desc("Same as '--quiet'. Silence all errors when parsing the "
+                      "object file. Does not silence "
+                      "result output."),
+             cl::location(QuietFlag), cl::init(false));
+
+static cl::alias QuietLong("quiet", cl::desc("Alias for -q."),
+                           cl::aliasopt(QuietArg));
+
 StringRef stringCFIProtectionStatus(CFIProtectionStatus Status) {
   switch (Status) {
   case CFIProtectionStatus::PROTECTED:
     return "PROTECTED";
   case CFIProtectionStatus::FAIL_NOT_INDIRECT_CF:
     return "FAIL_NOT_INDIRECT_CF";
   case CFIProtectionStatus::FAIL_ORPHANS:
     return "FAIL_ORPHANS";
FileAnalysis::getDirectControlFlowXRefs(const Instr &InstrMeta) const {
 
   const auto &TargetRefsKV = StaticBranchTargetings.find(InstrMeta.VMAddress);
   if (TargetRefsKV == StaticBranchTargetings.end())
     return CFCrossReferences;
 
   for (uint64_t SourceInstrAddress : TargetRefsKV->second) {
     const auto &SourceInstrKV = Instructions.find(SourceInstrAddress);
     if (SourceInstrKV == Instructions.end()) {
+      if (!QuietFlag) {
         errs() << "Failed to find source instruction at address "
                << format_hex(SourceInstrAddress, 2)
                << " for the cross-reference to instruction at address "
                << format_hex(InstrMeta.VMAddress, 2) << ".\n";
+      }
       continue;
     }
 
     CFCrossReferences.insert(&SourceInstrKV->second);
   }
 
   return CFCrossReferences;
 }
if (InstrDesc.isReturn())
       continue;
 
     // Check if this instruction exists in the range of the DWARF metadata.
     if (!IgnoreDWARFFlag) {
       auto LineInfo =
           Symbolizer->symbolizeCode(Object->getFileName(), VMAddress);
       if (!LineInfo) {
         handleAllErrors(LineInfo.takeError(), [](const ErrorInfoBase &E) {
+          if (!QuietFlag)
             errs() << "Symbolizer failed to get line: " << E.message() << "\n";
         });
         continue;
       }
 
       if (LineInfo->FileName == "<invalid>")
         continue;
     }
 
     IndirectInstructions.insert(VMAddress);
   }
 }
 
 void FileAnalysis::addInstruction(const Instr &Instruction) {
   const auto &KV =
       Instructions.insert(std::make_pair(Instruction.VMAddress, Instruction));
   if (!KV.second) {
+    if (!QuietFlag) {
       errs() << "Failed to add instruction at address "
              << format_hex(Instruction.VMAddress, 2)
              << ": Instruction at this address already exists.\n";
+    }
     exit(EXIT_FAILURE);
   }
 }
 
 Error FileAnalysis::parseSymbolTable() {
   // Functions that will trap on CFI violations.
   SmallSet<StringRef, 4> TrapOnFailFunctions;
   TrapOnFailFunctions.insert("__cfi_slowpath");

llvm/tools/llvm-cfi-verify/lib/GraphBuilder.cpp

void GraphBuilder::buildFlowsToUndefined(const FileAnalysis &Analysis,
   const Instr *NextMetaPtr;
 
   // Find out the next instruction in the block and add it to the new
   // node.
   if (BranchNode.Target && !BranchNode.Fallthrough) {
     // We know the target of the branch, find the fallthrough.
     NextMetaPtr = Analysis.getNextInstructionSequential(BranchInstrMeta);
     if (!NextMetaPtr) {
+      if (!QuietFlag) {
         errs() << "Failed to get next instruction from "
                << format_hex(BranchNode.Address, 2) << ".\n";
+      }
       return;
     }
 
     NextAddress = NextMetaPtr->VMAddress;
     BranchNode.Fallthrough =
         NextMetaPtr->VMAddress; // Add the new node to the branch head.
   } else if (BranchNode.Fallthrough && !BranchNode.Target) {
     // We already know the fallthrough, evaluate the target.
     uint64_t Target;
     if (!Analysis.getMCInstrAnalysis()->evaluateBranch(
             BranchInstrMeta.Instruction, BranchInstrMeta.VMAddress,
             BranchInstrMeta.InstructionSize, Target)) {
-      errs() << "Failed to get branch target for conditional branch at address "
-             << format_hex(BranchInstrMeta.VMAddress, 2) << ".\n";
+      if (!QuietFlag) {
+        errs()
+            << "Failed to get branch target for conditional branch at address "
+      }
       return;
     }
 
     // Resolve the meta pointer for the target of this branch.
     NextMetaPtr = Analysis.getInstruction(Target);
     if (!NextMetaPtr) {
+      if (!QuietFlag) {
         errs() << "Failed to find instruction at address "
                << format_hex(Target, 2) << ".\n";
+      }
       return;
     }
 
     NextAddress = Target;
     BranchNode.Target =
         NextMetaPtr->VMAddress; // Add the new node to the branch head.
   } else {
+    if (!QuietFlag) {
       errs() << "ControlBranchNode supplied to buildFlowsToUndefined should "
                 "provide Target xor Fallthrough.\n";
+    }
     return;
   }
 
   uint64_t CurrentAddress = NextAddress;
   const Instr *CurrentMetaPtr = NextMetaPtr;
 
   // Now the branch head has been set properly, complete the rest of the block.
   for (uint64_t i = 1; i < SearchLengthForUndef; ++i) {
void GraphBuilder::buildFlowGraphImpl(const FileAnalysis &Analysis,
 
   // If this flow is already explored, stop here.
   if (Result.IntermediateNodes.count(Address))
     return;
 
   // Get the metadata for the node instruction.
   const auto &InstrMetaPtr = Analysis.getInstruction(Address);
   if (!InstrMetaPtr) {
+    if (!QuietFlag) {
       errs() << "Failed to build flow graph for instruction at address "
              << format_hex(Address, 2) << ".\n";
+    }
     Result.OrphanedNodes.push_back(Address);
     return;
   }
   const auto &ChildMeta = *InstrMetaPtr;
 
   OpenedNodes.insert(Address);
   std::set<const Instr *> CFCrossRefs =
       Analysis.getDirectControlFlowXRefs(ChildMeta);
for (const auto *ParentMetaPtr : CFCrossRefs) {
     }
 
     // Evaluate the branch target to ascertain whether this XRef is the result
     // of a fallthrough or the target of a branch.
     uint64_t BranchTarget;
     if (!Analysis.getMCInstrAnalysis()->evaluateBranch(
             ParentMeta.Instruction, ParentMeta.VMAddress,
             ParentMeta.InstructionSize, BranchTarget)) {
+      if (!QuietFlag) {
         errs() << "Failed to evaluate branch target for instruction at address "
                << format_hex(ParentMeta.VMAddress, 2) << ".\n";
+      }
       Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
       Result.OrphanedNodes.push_back(ParentMeta.VMAddress);
       continue;
     }
 
     // Allow unconditional branches to be part of the upwards traversal.
     if (ParentDesc.isUnconditionalBranch()) {
       // Ensures that the unconditional branch is actually an XRef to the child.
       if (BranchTarget != Address) {
+        if (!QuietFlag) {
           errs() << "Control flow to " << format_hex(Address, 2)
                  << ", but target resolution of "
                  << format_hex(ParentMeta.VMAddress, 2)
                  << " is not this address?\n";
+        }
         Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
         Result.OrphanedNodes.push_back(ParentMeta.VMAddress);
         continue;
       }
 
       buildFlowGraphImpl(Analysis, OpenedNodes, Result, ParentMeta.VMAddress,
                          Depth + 1);
       Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
       HasValidCrossRef = true;
       continue;
     }
 
     // Ensure that any unknown CFs are caught.
     if (!ParentDesc.isConditionalBranch()) {
+      if (!QuietFlag) {
         errs() << "Unknown control flow encountered when building graph at "
                << format_hex(Address, 2) << "\n.";
+      }
       Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
       Result.OrphanedNodes.push_back(ParentMeta.VMAddress);
       continue;
     }
 
     // Only direct conditional branches should be present at this point. Setup
     // a conditional branch node and build flows to the ud2.
     ConditionalBranchNode BranchNode;