From 1d50ffa1d6fa535df4f01a22a13212dfcfae0358 Mon Sep 17 00:00:00 2001 From: wang-yangsong Date: Wed, 15 May 2024 11:32:20 +0800 Subject: [PATCH 1/3] add ops fuzztest Signed-off-by: wang-yangsong --- test/fuzztest/BUILD.gn | 3 +- test/fuzztest/hdinnrtops_fuzzer/BUILD.gn | 50 ++++++ test/fuzztest/hdinnrtops_fuzzer/corpus/init | 16 ++ .../hdinnrtops_fuzzer/hdinnrtops_fuzzer.cpp | 145 ++++++++++++++++++ .../hdinnrtops_fuzzer/hdinnrtops_fuzzer.h | 21 +++ test/fuzztest/hdinnrtops_fuzzer/project.xml | 25 +++ 6 files changed, 259 insertions(+), 1 deletion(-) create mode 100644 test/fuzztest/hdinnrtops_fuzzer/BUILD.gn create mode 100644 test/fuzztest/hdinnrtops_fuzzer/corpus/init create mode 100644 test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.cpp create mode 100644 test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.h create mode 100644 test/fuzztest/hdinnrtops_fuzzer/project.xml diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn index 3835be8..3a5fd66 100644 --- a/test/fuzztest/BUILD.gn +++ b/test/fuzztest/BUILD.gn @@ -9,7 +9,7 @@ # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and -# limitations under the License. +# limitations under the License. import("//build/test.gni") group("fuzztest") { @@ -18,4 +18,5 @@ group("fuzztest") { deps += [ "hdinnrtdevice_fuzzer:HdiNnrtDeviceFuzzTest" ] deps += [ "hdinnrtpreparedmodel_fuzzer:HdiNnrtPreparedModelFuzzTest" ] + deps += [ "hdinnrtops_fuzzer:HdiNnrtOpsFuzzTest" ] } diff --git a/test/fuzztest/hdinnrtops_fuzzer/BUILD.gn b/test/fuzztest/hdinnrtops_fuzzer/BUILD.gn new file mode 100644 index 0000000..b57f437 --- /dev/null +++ b/test/fuzztest/hdinnrtops_fuzzer/BUILD.gn @@ -0,0 +1,50 @@ +# Copyright (C) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +module_output_path = "drivers_interface_nnrt/drivers_interface_nnrt" + +##############################fuzztest########################################## +ohos_fuzztest("HdiNnrtOpsFuzzTest") { + module_out_path = module_output_path + fuzz_config_file = "../hdinnrtops_fuzzer" + + include_dirs = [ + "//third_party/bounds_checking_function/include", + "../../../frameworks/native/neural_network_runtime", + "../../../interfaces/kits/c/neural_network_runtime", + ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + configs = [ "../../../config:coverage_flags" ] + sources = [ "hdinnrtops_fuzzer.cpp" ] + + external_deps = [ + "c_utils:utils", + "drivers_interface_nnrt:libnnrt_proxy_2.1", + "hdf_core:libhdi", + "hilog:libhilog", + "ipc:ipc_core", + "mindspore:mindir", + "neural_network_runtime:nnrt_target", + ] +} diff --git a/test/fuzztest/hdinnrtops_fuzzer/corpus/init b/test/fuzztest/hdinnrtops_fuzzer/corpus/init new file mode 100644 index 0000000..51f4e77 --- /dev/null +++ b/test/fuzztest/hdinnrtops_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (C) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.cpp b/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.cpp new file mode 100644 index 0000000..7c16dda --- /dev/null +++ b/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.cpp @@ -0,0 +1,145 @@ +/* + * Copyright (C) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include +#include "hdinnrtops_fuzzer.h" +#include "../data.h" +#include "../../../common/log.h" + +#include "neural_network_runtime_type.h" +#include "neural_network_runtime.h" + +namespace OHOS { +namespace NeuralNetworkRuntime { +constexpr size_t U32_AT_SIZE = 4; + +struct OHNNOperandTest { + OH_NN_DataType dataType; + OH_NN_TensorType type; + std::vector shape; + void *data {nullptr}; + int32_t length {0}; + OH_NN_Format format = OH_NN_FORMAT_NONE; + const OH_NN_QuantParam *quantParam = nullptr; +}; + +struct OHNNGraphArgs { + OH_NN_OperationType operationType; + std::vector operands; + std::vector paramIndices; + std::vector inputIndices; + std::vector outputIndices; + bool build = true; + bool specifyIO = true; + bool addOperation = true; +}; + +struct Model0 { + float value = 1; + OHNNOperandTest input = {OH_NN_FLOAT32, OH_NN_TENSOR, {1}, &value, sizeof(float)}; + OHNNOperandTest output = {OH_NN_FLOAT32, OH_NN_TENSOR, {1}, &value, sizeof(float)}; + OHNNGraphArgs graphArgs = {.operationType = OH_NN_OPS_ADD, + .operands = {input, output}, + .paramIndices = {}, + .inputIndices = {0}, + .outputIndices = {1}}; +}; + +OH_NN_UInt32Array TransformUInt32Array(const std::vector& vector) +{ + uint32_t* data = (vector.empty()) ? nullptr : const_cast(vector.data()); + return {data, vector.size()}; +} + +int SingleModelBuildEndStep(OH_NNModel *model, const OHNNGraphArgs &graphArgs) +{ + int ret = 0; + auto paramIndices = TransformUInt32Array(graphArgs.paramIndices); + auto inputIndices = TransformUInt32Array(graphArgs.inputIndices); + auto outputIndices = TransformUInt32Array(graphArgs.outputIndices); + + if (graphArgs.addOperation) { + ret = OH_NNModel_AddOperation(model, graphArgs.operationType, ¶mIndices, &inputIndices, + &outputIndices); + if (ret != OH_NN_SUCCESS) { + LOGE("[NNRtTest] OH_NNModel_AddOperation failed! ret=%{public}d\n", ret); + return ret; + } + } + + if (graphArgs.specifyIO) { + ret = OH_NNModel_SpecifyInputsAndOutputs(model, &inputIndices, &outputIndices); + if (ret != OH_NN_SUCCESS) { + LOGE("[NNRtTest] OH_NNModel_SpecifyInputsAndOutputs failed! ret=%{public}d\n", ret); + return ret; + } + } + + if (graphArgs.build) { + ret = OH_NNModel_Finish(model); + if (ret != OH_NN_SUCCESS) { + LOGE("[NNRtTest] OH_NNModel_Finish failed! ret=%d\n", ret); + return ret; + } + } + return ret; +} + +int buildModel0(uint32_t opsType) { + OH_NNModel *model = OH_NNModel_Construct(); + if (model == nullptr) { + return -1; + } + + Model0 model0; + OHNNGraphArgs graphArgs = model0.graphArgs; + graphArgs.operationType = static_cast(opsType); + + if (SingleModelBuildEndStep(model, graphArgs) != OH_NN_SUCCESS) { + OH_NNModel_Destroy(&model); + return -1; + } + OH_NNModel_Destroy(&model); + return 0; +} + +bool HdiNnrtOpsFuzzTest(const uint8_t* data, size_t size) +{ + Data dataFuzz(data, size); + uint32_t opsType = dataFuzz.GetData() + % (OH_NN_OPS_GATHER_ND - OH_NN_OPS_ADD + 1); + + buildModel0(opsType); + return true; +} +} // namespace NeuralNetworkRuntime +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + if (data == nullptr) { + LOGE("Pass data is nullptr."); + return 0; + } + + if (size < OHOS::NeuralNetworkRuntime::U32_AT_SIZE) { + LOGE("Pass size is too small."); + return 0; + } + + OHOS::NeuralNetworkRuntime::HdiNnrtOpsFuzzTest(data, size); + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.h b/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.h new file mode 100644 index 0000000..3739654 --- /dev/null +++ b/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (C) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef NNRT_FUZZ_HDI_OPS_H_ +#define NNRT_FUZZ_HDI_OPS_H_ + +#define FUZZ_PROJECT_NAME "hdinnrtops_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/hdinnrtops_fuzzer/project.xml b/test/fuzztest/hdinnrtops_fuzzer/project.xml new file mode 100644 index 0000000..43cb49b --- /dev/null +++ b/test/fuzztest/hdinnrtops_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 60 + + 4096 + + -- Gitee From 792bb8b3c1f8015bdce71651f173271ec9c26f2a Mon Sep 17 00:00:00 2001 From: wang-yangsong Date: Wed, 15 May 2024 13:47:28 +0800 Subject: [PATCH 2/3] fix dep Signed-off-by: wang-yangsong --- test/fuzztest/hdinnrtops_fuzzer/BUILD.gn | 1 - test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.cpp | 3 ++- test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.h | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/test/fuzztest/hdinnrtops_fuzzer/BUILD.gn b/test/fuzztest/hdinnrtops_fuzzer/BUILD.gn index b57f437..00bbceb 100644 --- a/test/fuzztest/hdinnrtops_fuzzer/BUILD.gn +++ b/test/fuzztest/hdinnrtops_fuzzer/BUILD.gn @@ -44,7 +44,6 @@ ohos_fuzztest("HdiNnrtOpsFuzzTest") { "hdf_core:libhdi", "hilog:libhilog", "ipc:ipc_core", - "mindspore:mindir", "neural_network_runtime:nnrt_target", ] } diff --git a/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.cpp b/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.cpp index 7c16dda..993503a 100644 --- a/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.cpp +++ b/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.cpp @@ -97,7 +97,8 @@ int SingleModelBuildEndStep(OH_NNModel *model, const OHNNGraphArgs &graphArgs) return ret; } -int buildModel0(uint32_t opsType) { +int buildModel0(uint32_t opsType) +{ OH_NNModel *model = OH_NNModel_Construct(); if (model == nullptr) { return -1; diff --git a/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.h b/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.h index 3739654..ee4ea1f 100644 --- a/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.h +++ b/test/fuzztest/hdinnrtops_fuzzer/hdinnrtops_fuzzer.h @@ -13,8 +13,8 @@ * limitations under the License. */ -#ifndef NNRT_FUZZ_HDI_OPS_H_ -#define NNRT_FUZZ_HDI_OPS_H_ +#ifndef NNRT_FUZZ_HDI_OPS_H +#define NNRT_FUZZ_HDI_OPS_H #define FUZZ_PROJECT_NAME "hdinnrtops_fuzzer" -- Gitee From eae57b7908deee34542d4aae851776107a233924 Mon Sep 17 00:00:00 2001 From: wang-yangsong Date: Wed, 15 May 2024 15:26:20 +0800 Subject: [PATCH 3/3] fix gn format Signed-off-by: wang-yangsong --- test/fuzztest/hdinnrtops_fuzzer/BUILD.gn | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/fuzztest/hdinnrtops_fuzzer/BUILD.gn b/test/fuzztest/hdinnrtops_fuzzer/BUILD.gn index 00bbceb..daf1abf 100644 --- a/test/fuzztest/hdinnrtops_fuzzer/BUILD.gn +++ b/test/fuzztest/hdinnrtops_fuzzer/BUILD.gn @@ -26,7 +26,7 @@ ohos_fuzztest("HdiNnrtOpsFuzzTest") { "//third_party/bounds_checking_function/include", "../../../frameworks/native/neural_network_runtime", "../../../interfaces/kits/c/neural_network_runtime", - ] + ] cflags = [ "-g", -- Gitee