Upload poc/harness_execute_fuzzer.cpp with huggingface_hub

poc/harness_execute_fuzzer.cpp

@@ -0,0 +1,174 @@
+// libFuzzer harness for Program::load_method() + Method::execute().
+// Registers a fake kernel (for every op name that might appear) that ALWAYS
+// calls context.fail(), to deterministically exercise the KernelCall failure
+// logging path in Method::execute_instruction() - specifically testing
+// whether op->overload()->c_str() is dereferenced unconditionally when
+// overload is null (optional per schema).
+//
+// Also registers a fake backend (matching common backend id strings) whose
+// init()/execute() are minimal, to exercise BackendDelegate::Init() and
+// GetProcessedData() paths without requiring a real backend implementation.
+#include <cstddef>
+#include <cstdint>
+#include <vector>
+
+#include <executorch/extension/data_loader/buffer_data_loader.h>
+#include <executorch/runtime/backend/interface.h>
+#include <executorch/runtime/executor/method.h>
+#include <executorch/runtime/executor/program.h>
+#include <executorch/runtime/core/memory_allocator.h>
+#include <executorch/runtime/core/hierarchical_allocator.h>
+#include <executorch/runtime/executor/memory_manager.h>
+#include <executorch/runtime/kernel/operator_registry.h>
+#include <executorch/runtime/kernel/kernel_runtime_context.h>
+#include <executorch/runtime/platform/runtime.h>
+
+using executorch::extension::BufferDataLoader;
+using executorch::runtime::Program;
+using executorch::runtime::Method;
+using executorch::runtime::MemoryAllocator;
+using executorch::runtime::HierarchicalAllocator;
+using executorch::runtime::MemoryManager;
+using executorch::runtime::Span;
+using executorch::runtime::EValue;
+using executorch::runtime::Error;
+using executorch::runtime::Result;
+using executorch::runtime::KernelRuntimeContext;
+using executorch::runtime::Kernel;
+using executorch::runtime::register_kernels;
+using executorch::runtime::BackendInterface;
+using executorch::runtime::Backend;
+using executorch::runtime::register_backend;
+using executorch::runtime::DelegateHandle;
+using executorch::runtime::FreeableBuffer;
+using executorch::runtime::ArrayRef;
+using executorch::runtime::CompileSpec;
+using executorch::runtime::BackendInitContext;
+using executorch::runtime::BackendExecutionContext;
+
+// A kernel that always fails - forces Method::execute_instruction()'s
+// KernelCall failure-logging path (which dereferences op->overload()) on
+// EVERY KernelCall instruction, regardless of which operator is named.
+void always_fail_kernel(KernelRuntimeContext& context, Span<EValue*> /*args*/) {
+  context.fail(Error::Internal);
+}
+
+// A minimal backend that succeeds trivially, to exercise
+// BackendDelegate::Init()/GetProcessedData() without needing a real backend.
+class FuzzTestBackend final : public BackendInterface {
+ public:
+  bool is_available() const override {
+    return true;
+  }
+  Result<DelegateHandle*> init(
+      BackendInitContext& /*context*/,
+      FreeableBuffer* /*processed*/,
+      ArrayRef<CompileSpec> /*compile_specs*/) const override {
+    return static_cast<DelegateHandle*>(nullptr);
+  }
+  Error execute(
+      BackendExecutionContext& /*context*/,
+      DelegateHandle* /*handle*/,
+      Span<EValue*> /*args*/) const override {
+    return Error::Ok;
+  }
+};
+
+static bool g_initialized = false;
+static FuzzTestBackend* g_backend = nullptr;
+
+extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t* data, std::size_t size) {
+  if (!g_initialized) {
+    executorch::runtime::runtime_init();
+
+    // Register a wildcard-ish set of fallback kernels for common op names
+    // seen in the seed corpus, all pointing to always_fail_kernel. We can't
+    // truly wildcard-match in this registry, so register kernels for the
+    // most common ops that appear in the existing .pte seed corpus.
+    static const Kernel kernels[] = {
+        Kernel("aten::add.out", always_fail_kernel),
+        Kernel("aten::add.Tensor_out", always_fail_kernel),
+        Kernel("aten::mul.out", always_fail_kernel),
+        Kernel("aten::mul.Tensor_out", always_fail_kernel),
+        Kernel("aten::sub.out", always_fail_kernel),
+        Kernel("aten::relu.out", always_fail_kernel),
+        Kernel("aten::linear.out", always_fail_kernel),
+        Kernel("aten::cat.out", always_fail_kernel),
+        Kernel("aten::view_copy.out", always_fail_kernel),
+        Kernel("aten::index.Tensor_out", always_fail_kernel),
+        Kernel("aten::_softmax.out", always_fail_kernel),
+        Kernel("aten::convolution.out", always_fail_kernel),
+        Kernel("aten::permute_copy.out", always_fail_kernel),
+        Kernel("aten::_to_copy.out", always_fail_kernel),
+        // No-overload variants: matches Operator entries whose `overload`
+        // field is null/absent, which is the specific condition needed to
+        // test whether Method::execute_instruction()'s KernelCall failure
+        // path dereferences op->overload() unconditionally.
+        Kernel("aten::add", always_fail_kernel),
+        Kernel("aten::mul", always_fail_kernel),
+        Kernel("aten::sub", always_fail_kernel),
+        Kernel("aten::relu", always_fail_kernel),
+        Kernel("aten::linear", always_fail_kernel),
+        Kernel("aten::cat", always_fail_kernel),
+        Kernel("test_op", always_fail_kernel),
+        Kernel("test_op_no_overload", always_fail_kernel),
+    };
+    register_kernels({kernels, sizeof(kernels) / sizeof(kernels[0])});
+
+    static FuzzTestBackend backend_instance;
+    g_backend = &backend_instance;
+    static const char* backend_names[] = {
+        "XnnpackBackend", "CoreMLBackend", "QnnBackend",
+        "VulkanBackend", "MPSBackend", "TCE0", "TCE1"};
+    for (const char* name : backend_names) {
+      register_backend(Backend{name, g_backend});
+    }
+
+    g_initialized = true;
+  }
+
+  constexpr std::size_t kMaxInput = 8U * 1024U * 1024U;
+  if (data == nullptr || size == 0 || size > kMaxInput) {
+    return 0;
+  }
+
+  BufferDataLoader loader(data, size);
+  auto program = Program::load(&loader, Program::Verification::InternalConsistency);
+  if (!program.ok()) {
+    return 0;
+  }
+
+  static std::vector<uint8_t> method_pool(512 * 1024);
+  static std::vector<uint8_t> planned_pool(256 * 1024);
+  MemoryAllocator method_allocator(method_pool.size(), method_pool.data());
+  static Span<uint8_t> planned_span(planned_pool.data(), planned_pool.size());
+  HierarchicalAllocator planned_memory({&planned_span, 1});
+  MemoryManager mm(&method_allocator, &planned_memory, nullptr);
+
+  auto& p = program.get();
+  auto n = p.num_methods();
+  for (size_t i = 0; i < n; ++i) {
+    auto name = p.get_method_name(i);
+    if (!name.ok()) continue;
+    auto method = p.load_method(name.get(), &mm);
+    if (!method.ok()) {
+#ifdef ET_FUZZ_DEBUG
+      fprintf(stderr, "[dbg] load_method failed: 0x%x\n",
+              static_cast<unsigned int>(method.error()));
+#endif
+      continue;
+    }
+    // Attempt to set trivial inputs where possible, then execute. We don't
+    // try hard to satisfy every possible input shape - we're hunting for
+    // crashes during initialization and the KernelCall failure path, not
+    // testing correct numerical execution.
+    auto& m = method.get();
+    auto exec_err = m.execute();
+#ifdef ET_FUZZ_DEBUG
+    fprintf(stderr, "[dbg] execute() returned: 0x%x\n",
+            static_cast<unsigned int>(exec_err));
+#endif
+    (void)exec_err;
+  }
+  return 0;
+}