1 /* 2 * Copyright (C) 2023 Huawei Device Co., Ltd. 3 * Licensed under the Apache License, Version 2.0 (the "License"); 4 * you may not use this file except in compliance with the License. 5 * You may obtain a copy of the License at 6 * 7 * http://www.apache.org/licenses/LICENSE-2.0 8 * 9 * Unless required by applicable law or agreed to in writing, software 10 * distributed under the License is distributed on an "AS IS" BASIS, 11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 * See the License for the specific language governing permissions and 13 * limitations under the License. 14 */ 15 16 #include <cstdio> 17 #include <stddef.h> 18 #include <stdint.h> 19 #include <iostream> 20 #include "mindspore_fuzzer.h" 21 #include "../data.h" 22 #include "include/c_api/context_c.h" 23 #include "include/c_api/model_c.h" 24 #include "../../utils/model_utils.h" 25 #include "context_c_fuzzer.h" 26 27 // add nnrt device info 28 void AddDeviceNNRT(OH_AI_ContextHandle context) { 29 size_t num = 0; 30 auto desc = OH_AI_GetAllNNRTDeviceDescs(&num); 31 if (desc == nullptr) { 32 return; 33 } 34 35 auto id = OH_AI_GetDeviceIdFromNNRTDeviceDesc(desc); 36 OH_AI_DeviceInfoHandle nnrtDeviceInfo = OH_AI_DeviceInfoCreate(OH_AI_DEVICETYPE_NNRT); 37 OH_AI_DeviceInfoSetDeviceId(nnrtDeviceInfo, id); 38 OH_AI_DestroyAllNNRTDeviceDescs(&desc); 39 40 OH_AI_DeviceInfoSetPerformanceMode(nnrtDeviceInfo, OH_AI_PERFORMANCE_MEDIUM); 41 OH_AI_DeviceInfoSetPriority(nnrtDeviceInfo, OH_AI_PRIORITY_MEDIUM); 42 43 OH_AI_ContextAddDeviceInfo(context, nnrtDeviceInfo); 44 } 45 46 bool MSPreparedModelFuzzTest(const uint8_t* data, size_t size) { 47 if (data == nullptr) { 48 return false; 49 } 50 51 OH_AI_ContextHandle context = OH_AI_ContextCreate(); 52 if (context == nullptr) { 53 printf("create context failed.\n"); 54 return false; 55 } 56 OH_AI_ContextSetThreadNum(context, 4); 57 58 OH_AI_DeviceInfoHandle cpuDeviceInfo = OH_AI_DeviceInfoCreate(OH_AI_DEVICETYPE_CPU); 59 if (cpuDeviceInfo == NULL) { 60 printf("OH_AI_DeviceInfoCreate failed.\n"); 61 OH_AI_ContextDestroy(&context); 62 return false; 63 } 64 OH_AI_ContextAddDeviceInfo(context, cpuDeviceInfo); 65 AddDeviceNNRT(context); 66 67 OH_AI_ModelHandle model = OH_AI_ModelCreate(); 68 if (model == nullptr) { 69 printf("create model failed.\n"); 70 return false; 71 } 72 73 OH_AI_ContextDestroy(&context); 74 OH_AI_ModelDestroy(&model); 75 return true; 76 } 77 78 bool MSContextFuzzTest_Null(const uint8_t* data, size_t size) { 79 OH_AI_ContextHandle context = nullptr; 80 81 OH_AI_ContextSetThreadNum(context, 4); 82 auto retThreadNum = OH_AI_ContextGetThreadNum(context); 83 if (retThreadNum != 0) { 84 printf("OH_AI_ContextGetThreadNum failed.\n"); 85 return false; 86 } 87 88 OH_AI_ContextSetThreadAffinityMode(context, 1); 89 auto ret = OH_AI_ContextGetThreadAffinityMode(context); 90 if (ret != 0) { 91 printf("OH_AI_ContextGetThreadAffinityMode failed.\n"); 92 return false; 93 } 94 95 OH_AI_ContextSetThreadAffinityCoreList(context, nullptr, 0); 96 auto retCoreList = OH_AI_ContextGetThreadAffinityCoreList(context, nullptr); 97 if (retCoreList != 0) { 98 printf("OH_AI_ContextGetThreadAffinityCoreList failed.\n"); 99 return false; 100 } 101 102 OH_AI_ContextSetEnableParallel(context, true); 103 auto retParallel = OH_AI_ContextGetEnableParallel(context); 104 if (retParallel != false) { 105 printf("OH_AI_ContextGetEnableParallel failed.\n"); 106 return false; 107 } 108 109 110 OH_AI_DeviceInfoHandle deviceInfo = OH_AI_DeviceInfoCreate(OH_AI_DEVICETYPE_CPU); 111 if (deviceInfo == nullptr) { 112 printf("OH_AI_DeviceInfoCreate cpu failed.\n"); 113 return false; 114 } 115 OH_AI_DeviceInfoDestroy(&deviceInfo); 116 117 deviceInfo = OH_AI_DeviceInfoCreate(OH_AI_DEVICETYPE_INVALID); 118 if (deviceInfo != nullptr) { 119 printf("OH_AI_DeviceInfoCreate failed.\n"); 120 return false; 121 } 122 OH_AI_ContextAddDeviceInfo(context, deviceInfo); 123 OH_AI_DeviceInfoSetProvider(deviceInfo, nullptr); 124 auto retProvider = OH_AI_DeviceInfoGetProvider(deviceInfo); 125 if (retProvider != nullptr) { 126 printf("OH_AI_DeviceInfoGetProvider failed.\n"); 127 return false; 128 } 129 130 OH_AI_DeviceInfoSetProviderDevice(deviceInfo, nullptr); 131 auto retProDevice = OH_AI_DeviceInfoGetProviderDevice(deviceInfo); 132 if (retProDevice != nullptr) { 133 printf("OH_AI_DeviceInfoGetProviderDevice failed.\n"); 134 return false; 135 } 136 auto deviceType = OH_AI_DeviceInfoGetDeviceType(deviceInfo); 137 if (deviceType != OH_AI_DEVICETYPE_INVALID) { 138 printf("OH_AI_DeviceInfoGetDeviceType failed.\n"); 139 return false; 140 } 141 142 OH_AI_DeviceInfoSetEnableFP16(deviceInfo, true); 143 auto retEnableFp16 = OH_AI_DeviceInfoGetEnableFP16(deviceInfo); 144 if (retEnableFp16 != false) { 145 printf("OH_AI_DeviceInfoGetEnableFP16 failed.\n"); 146 return false; 147 } 148 OH_AI_DeviceInfoSetFrequency(deviceInfo, 1); 149 auto retFrequency = OH_AI_DeviceInfoGetFrequency(deviceInfo); 150 if (retFrequency != -1) { 151 printf("OH_AI_DeviceInfoGetFrequency failed.\n"); 152 return false; 153 } 154 155 OH_AI_DeviceInfoSetDeviceId(deviceInfo, 1); 156 auto retDeviceId = OH_AI_DeviceInfoGetDeviceId(deviceInfo); 157 if (retDeviceId != 0) { 158 printf("OH_AI_DeviceInfoGetDeviceId failed.\n"); 159 return false; 160 } 161 OH_AI_DeviceInfoSetPerformanceMode(deviceInfo, OH_AI_PERFORMANCE_HIGH); 162 auto retPerMode = OH_AI_DeviceInfoGetPerformanceMode(deviceInfo); 163 if (retPerMode != OH_AI_PERFORMANCE_NONE) { 164 printf("OH_AI_DeviceInfoGetPerformanceMode failed.\n"); 165 return false; 166 } 167 OH_AI_DeviceInfoSetPriority(deviceInfo, OH_AI_PRIORITY_HIGH); 168 auto retPriority = OH_AI_DeviceInfoGetPriority(deviceInfo); 169 if (retPriority != OH_AI_PRIORITY_NONE) { 170 printf("OH_AI_DeviceInfoGetPriority failed.\n"); 171 return false; 172 } 173 auto retExt = OH_AI_DeviceInfoAddExtension(deviceInfo, nullptr, nullptr, 0); 174 if (retExt != OH_AI_STATUS_LITE_NULLPTR) { 175 printf("OH_AI_DeviceInfoAddExtension failed.\n"); 176 return false; 177 } 178 return true; 179 } 180 181 bool MSTensorFuzzTest_Null(const uint8_t* data, size_t size) { 182 OH_AI_TensorHandle tensor = OH_AI_TensorCreate(nullptr, OH_AI_DATATYPE_NUMBERTYPE_FLOAT32, nullptr, 0, nullptr, 0); 183 OH_AI_TensorDestroy(&tensor); 184 185 auto retClone = OH_AI_TensorClone(tensor); 186 if (retClone != nullptr) { 187 printf("OH_AI_TensorClone failed.\n"); 188 return false; 189 } 190 OH_AI_TensorSetName(tensor, nullptr); 191 auto retGetName = OH_AI_TensorGetName(tensor); 192 if (retGetName != nullptr) { 193 printf("OH_AI_TensorGetName failed.\n"); 194 return false; 195 } 196 OH_AI_TensorSetDataType(tensor, OH_AI_DATATYPE_NUMBERTYPE_INT64); 197 auto retGetDataType = OH_AI_TensorGetDataType(tensor); 198 if (retGetDataType != OH_AI_DATATYPE_UNKNOWN) { 199 printf("OH_AI_TensorGetDataType failed.\n"); 200 return false; 201 } 202 OH_AI_TensorSetShape(tensor, nullptr, 0); 203 auto retGetShape = OH_AI_TensorGetShape(tensor, nullptr); 204 if (retGetShape != nullptr) { 205 printf("OH_AI_TensorGetShape failed.\n"); 206 return false; 207 } 208 OH_AI_TensorSetFormat(tensor, OH_AI_FORMAT_KHWC); 209 auto retGetFormat = OH_AI_TensorGetFormat(tensor); 210 if (retGetFormat != OH_AI_FORMAT_NHWC) { 211 printf("OH_AI_TensorGetFormat failed.\n"); 212 return false; 213 } 214 OH_AI_TensorSetData(tensor, nullptr); 215 auto retSetUserData = OH_AI_TensorSetUserData(tensor, nullptr, 0); 216 if (retSetUserData != OH_AI_STATUS_LITE_NULLPTR) { 217 printf("OH_AI_TensorSetUserData failed.\n"); 218 return false; 219 } 220 auto retGetData = OH_AI_TensorGetData(tensor); 221 if (retGetData != nullptr) { 222 printf("OH_AI_TensorGetData failed.\n"); 223 return false; 224 } 225 auto retMutaData = OH_AI_TensorGetMutableData(tensor); 226 if (retMutaData != nullptr) { 227 printf("OH_AI_TensorGetMutableData failed.\n"); 228 return false; 229 } 230 auto retEleNum = OH_AI_TensorGetElementNum(tensor); 231 if (retEleNum != 0) { 232 printf("OH_AI_TensorGetElementNum failed.\n"); 233 return false; 234 } 235 auto retDataSize = OH_AI_TensorGetDataSize(tensor); 236 if (retDataSize != 0) { 237 printf("OH_AI_TensorGetDataSize failed.\n"); 238 return false; 239 } 240 return true; 241 } 242 243 bool MSModelFuzzTest_Null(const uint8_t* data, size_t size) { 244 OH_AI_ModelHandle model = OH_AI_ModelCreate(); 245 if (model == nullptr) { 246 printf("create model failed.\n"); 247 return false; 248 } 249 OH_AI_ModelDestroy(&model); 250 OH_AI_ModelSetWorkspace(model, nullptr, 0); 251 OH_AI_ModelCalcWorkspaceSize(model); 252 auto ret = OH_AI_ModelBuild(model, nullptr, 0, OH_AI_MODELTYPE_MINDIR, nullptr); 253 if (ret != OH_AI_STATUS_LITE_NULLPTR) { 254 printf("OH_AI_ModelBuild failed.\n"); 255 return false; 256 } 257 ret = OH_AI_ModelBuildFromFile(model, nullptr, OH_AI_MODELTYPE_MINDIR, nullptr); 258 if (ret != OH_AI_STATUS_LITE_NULLPTR) { 259 printf("OH_AI_ModelBuildFromFile failed.\n"); 260 return false; 261 } 262 ret = OH_AI_ModelResize(model, {0, nullptr}, nullptr, 0); 263 if (ret != OH_AI_STATUS_LITE_NULLPTR) { 264 printf("OH_AI_ModelResize failed.\n"); 265 return false; 266 } 267 OH_AI_TensorHandleArray outputs = {0, nullptr}; 268 ret = OH_AI_ModelPredict(model, {0, nullptr}, &outputs, nullptr, nullptr); 269 if (ret != OH_AI_STATUS_LITE_NULLPTR) { 270 printf("OH_AI_ModelPredict failed.\n"); 271 return false; 272 } 273 OH_AI_ModelRunStep(model, nullptr, nullptr); 274 OH_AI_ModelExportWeight(model, nullptr); 275 auto retInputs = OH_AI_ModelGetInputs(model); 276 if (retInputs.handle_list != nullptr) { 277 printf("OH_AI_ModelGetInputs failed.\n"); 278 return false; 279 } 280 auto retOutputs = OH_AI_ModelGetOutputs(model); 281 if (retOutputs.handle_list != nullptr) { 282 printf("OH_AI_ModelGetOutputs failed.\n"); 283 return false; 284 } 285 OH_AI_ModelGetInputByTensorName(model, nullptr); 286 OH_AI_ModelGetOutputByTensorName(model, nullptr); 287 auto trainCfg = OH_AI_TrainCfgCreate(); 288 if (trainCfg == nullptr) { 289 printf("OH_AI_TrainCfgCreate failed.\n"); 290 return false; 291 } 292 OH_AI_TrainCfgDestroy(&trainCfg); 293 auto retLossName = OH_AI_TrainCfgGetLossName(trainCfg, nullptr); 294 if (retLossName != nullptr) { 295 printf("OH_AI_TrainCfgGetLossName failed.\n"); 296 return false; 297 } 298 OH_AI_TrainCfgSetLossName(trainCfg, nullptr, 0); 299 auto retOptLevel = OH_AI_TrainCfgGetOptimizationLevel(trainCfg); 300 if (retOptLevel != OH_AI_KO0) { 301 printf("OH_AI_TrainCfgGetOptimizationLevel failed.\n"); 302 return false; 303 } 304 OH_AI_TrainCfgSetOptimizationLevel(trainCfg, OH_AI_KAUTO); 305 ret = OH_AI_TrainModelBuild(model, nullptr, 0, OH_AI_MODELTYPE_MINDIR, nullptr, trainCfg); 306 if (ret != OH_AI_STATUS_LITE_NULLPTR) { 307 printf("OH_AI_TrainModelBuild failed.\n"); 308 return false; 309 } 310 ret = OH_AI_TrainModelBuildFromFile(model, nullptr, OH_AI_MODELTYPE_MINDIR, nullptr, trainCfg); 311 if (ret != OH_AI_STATUS_LITE_NULLPTR) { 312 printf("OH_AI_TrainModelBuildFromFile failed.\n"); 313 return false; 314 } 315 ret = OH_AI_ModelSetLearningRate(model, 0.0f); 316 if (ret != OH_AI_STATUS_LITE_PARAM_INVALID) { 317 printf("OH_AI_ModelSetLearningRate failed.\n"); 318 return false; 319 } 320 OH_AI_ModelGetLearningRate(model); 321 ret = OH_AI_RunStep(model, nullptr, nullptr); 322 if (ret != OH_AI_STATUS_LITE_PARAM_INVALID) { 323 printf("OH_AI_RunStep failed.\n"); 324 return false; 325 } 326 auto retGetWeights = OH_AI_ModelGetWeights(model); 327 if (retGetWeights.handle_list != nullptr) { 328 printf("OH_AI_ModelGetWeights failed.\n"); 329 return false; 330 } 331 ret = OH_AI_ModelUpdateWeights(model, {0, nullptr}); 332 if (ret != OH_AI_STATUS_LITE_PARAM_INVALID) { 333 printf("OH_AI_ModelUpdateWeights failed.\n"); 334 return false; 335 } 336 auto retTrainMode = OH_AI_ModelGetTrainMode(model); 337 if (retTrainMode != false) { 338 printf("OH_AI_ModelGetTrainMode failed.\n"); 339 return false; 340 } 341 ret = OH_AI_ModelSetTrainMode(model, true); 342 if (ret != OH_AI_STATUS_LITE_PARAM_INVALID) { 343 printf("OH_AI_ModelSetTrainMode failed.\n"); 344 return false; 345 } 346 ret = OH_AI_ModelSetupVirtualBatch(model, 0, 0.0f, 0.0f); 347 if (ret != OH_AI_STATUS_LITE_PARAM_INVALID) { 348 printf("OH_AI_ModelSetupVirtualBatch failed.\n"); 349 return false; 350 } 351 ret = OH_AI_ExportModel(model, OH_AI_MODELTYPE_MINDIR, nullptr, OH_AI_UNKNOWN_QUANT_TYPE, true, nullptr, 0); 352 if (ret != OH_AI_STATUS_LITE_PARAM_INVALID) { 353 printf("OH_AI_ExportModel failed.\n"); 354 return false; 355 } 356 ret = OH_AI_ExportModelBuffer(model, OH_AI_MODELTYPE_MINDIR, nullptr, nullptr, OH_AI_FULL_QUANT, true, nullptr, 0); 357 if (ret != OH_AI_STATUS_LITE_PARAM_INVALID) { 358 printf("OH_AI_ExportModelBuffer failed.\n"); 359 return false; 360 } 361 ret = OH_AI_ExportWeightsCollaborateWithMicro(model, OH_AI_MODELTYPE_MINDIR, nullptr, true, true, nullptr, 0); 362 if (ret != OH_AI_STATUS_LITE_PARAM_INVALID) { 363 printf("OH_AI_ExportWeightsCollaborateWithMicro failed.\n"); 364 return false; 365 } 366 return true; 367 } 368 369 /* Fuzzer entry point */ 370 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) 371 { 372 if (data == nullptr) { 373 LOGE("Pass data is nullptr."); 374 return 0; 375 } 376 377 if (size < 4) { 378 LOGE("Pass size is too small."); 379 return 0; 380 } 381 382 MSPreparedModelFuzzTest(data, size); 383 MSModelFuzzTest_Null(data, size); 384 MSContextFuzzTest_Null(data, size); 385 MSTensorFuzzTest_Null(data, size); 386 return 0; 387 }