GraphicsFuzz. Secure and Robust Graphics Rendering. Hugues Evrard Paul Thomson

Transcription

1 GraphicsFuzz Secure and Robust Graphics Rendering Hugues Evrard Paul Thomson

2

3

4

5

6 Problem: defective drivers

7 We are here to help! How: automatic generation of minimal difference test cases

8 The context original shader graphics driver shader compiler GPU image

9 Challenge 1: is there a bug? (oracle problem) original shader graphics driver shader compiler Crash 1. Compiler crash

10 Challenge 1: is there a bug? (oracle problem) original shader graphics driver shader compiler GPU?? image?? 1. Compiler crash 2. Miscompilation: much harder to detect bad image security issues

11 Challenge 2: where is the bug? original shader graphics driver shader compiler GPU bad image WebGL OpenGL IR GPU asm

12 Challenge 3: is the bug important? random shader high-value shader graphics driver shader compiler Randomly searching may be ineffective We start searching from high-value shaders Prioritizes issues that are likely to affect end-users

13 Our approach

14 Generate bug-inducing shader original shader image graphics driver (shader compiler) GPU

15 Generate bug-inducing shader original shader image semantics preserving transformations graphics driver (shader compiler) GPU variant image image shader x = y + 0 ; z = x * 1 ;

16 Generate bug-inducing shader original shader image semantics preserving transformations graphics driver (shader compiler) GPU image variant image image shader

17 Generate bug-inducing shader original shader image semantics preserving transformations graphics driver (shader compiler) GPU comparison image variant image image shader

18 Generate bug-inducing shader original shader image semantics preserving transformations graphics driver (shader compiler) GPU diff/crash image variant image image shader

19 Generate bug-inducing shader original shader image semantics preserving transformations graphics driver (shader compiler) GPU comparison image variant image image shader metamorphic testing

20 Transformations

21 Semantics-preserving transformations prelude: opaque expression [host] vec2 opaq = { 0.0, 1.0 }; [device] kernel main (, opaq) { ( opaq.x < opaq.y ) opaq_true ( opaq.x > opaq.y ) opaq_false opaq.x opaq_0 opaq.y opaq_1 } Opaque value unknown at shader compilation time

22 Semantics-preserving transformations prelude: opaque expression dead code injection int orig_y; if (opaq_false) { float donor_x; } // code from donor shader orig_y = donor_x; Donor code variables are either: declared at start of block (donor_x) replaced by existing variable with same type (orig_y)

23 Semantics-preserving transformations prelude: opaque expression dead code injection dead jump injection if (opaq_false) { } jump; Complicate the control flow graph jump: break / continue / return / discard (special case of dead code injection)

24 Semantics-preserving transformations prelude: opaque expression dead code injection dead jump injection live code injection // original code // donor code to be executed // original code Add donor code at random position: rename variables to avoid name clashes declare variables remove: break / continue / return / discard

25 Semantics-preserving transformations prelude: opaque expression dead code injection dead jump injection live code injection expression mutation (opaq_true? [original expression] : [random expression] ) Random expression via traditional fuzzing For numeric expressions: [original expression] + opaq_0; For boolean expressions: ( [original expression] opaq_false);

26 Semantics-preserving transformations prelude: opaque expression dead code injection dead jump injection live code injection expression mutation vectorization float a, c; vec2 b; b.x = a + b.y + c; Pack variables into a merged variable: vec4 abc; // abc == { a, b.x, b.y, c } abc.yz.x = abc.x + abc.yz.y + abc.w;

27 Semantics-preserving transformations prelude: opaque expression dead code injection dead jump injection live code injection expression mutation vectorization control flow wrapping if (opaq_true) { [original code] } for (int tmp = opaq_0; tmp < opaq_1; tmp++) { [original code] } do { [original code] } while (opaq_false);

28 Semantics-preserving transformations prelude: opaque expression dead code injection dead jump injection live code injection expression mutation vectorization control flow wrapping if (opaq_true) { [original code] } for (int tmp = opaq_0; tmp < opaq_1; tmp++) { [original code] } do { [original code] } while (opaq_false); Transformations can be applied recursively!

29 Reduction

30 void main(void) { vec2 uv = (gl_fragcoord.xy / resolution.xy) * ; uv.x *= resolution.x / resolution.y; if(_glf_dead(_glf_false(false, (injectionswitch.x > injectionswitch.y)))) return; vec3 finalcolor = RenderScene(uv); if(_glf_dead(_glf_identity(false, (false) false))) { vec3 donor_replacementp = _GLF_FUZZED(faceforward(((++ finalcolor) - faceforward(vec3(4.8, , - 3.4), vec3( , -9.0, ), finalcolor)), vec3( , , ), (finalcolor).yzx)); float donor_replacementtw = _GLF_FUZZED(sign(dot((EPS / vec3(53.44, 6.0, )), fract(finalcolor)))); float donor_replacementstrength = _GLF_FUZZED(38.04); float donor_replacementprev = _GLF_FUZZED(clamp((+ distance(time, )), (-- finalcolor.g), (mouse / EPS)[1])); if(_glf_dead(_glf_false(false, (injectionswitch.x > injectionswitch.y)))) return; float donor_replacementaccum = _GLF_FUZZED(distance(vec2( , ), (- vec4( , 69.29, , )).wz)); if(_glf_dead(_glf_identity(false, (false? _GLF_FUZZED(( < shadowtype)) : false)))) return; for( int i = 0; i < 16; ++ i ) { float mag = dot(donor_replacementp, donor_replacementp); donor_replacementp = abs(donor_replacementp) / mag + vec3(-.5, * sin(time * ), * cos(time * 0.3)); float w = exp(- float(i) / 7.);

31 $ diff recipient_reduced_final.frag variant_27_reduced_final.frag 6a7,8 > uniform vec2 injectionswitch; > 168a171,174 > if(injectionswitch.x > injectionswitch.y) > { > return vec3(1.0); > } 194a201,204 > if(injectionswitch.x > injectionswitch.y) > { > return; > }

32 Reduce to a minimal difference test case original shader image graphics driver (shader compiler) GPU diff/crash Bug-induc. shader image while (diff/crash) { random_remove_transformation() }

33 Minimal difference test case original shader image same semantics small syntax diff graphics driver (shader compiler) GPU diff/crash Bug-induc. shader image isolates the bug

34 Bug gallery

35 GraphicsFuzz: bug gallery AMD if(injswitch.x > injswitch.y) { if(injswitch.x > injswitch.y) { return; } int f = 1; } [..] if(injswitch.x > injswitch.y) { return; }

36 GraphicsFuzz: bug gallery AMD Apple for(int c = 0; c < 1; c++) { if(j == 0) { return vec4(0.8, 0.5, 0.5, 1.0); } } return vec4(0.8 * injswitch.y, 0.7, 0.4, 1.0);

37 GraphicsFuzz: bug gallery AMD Apple ARM if(injswitch.x > injswitch.y) { for(int i = 0; i < 1; i ++) { k = 0.0; } }

38 GraphicsFuzz: bug gallery AMD Apple ARM Imagination if(injswitch.x > injswitch.y) { for(int i = 0; i < 10; i ++) { continue; } } [..] if(injswitch.x > injswitch.y) { if((p.z > 60.)) { break; } }

39 GraphicsFuzz: bug gallery AMD Apple ARM Imagination Intel [..] vec2 uvs = [..]; vec4 uvs_vec = vec4(0.0, uvs, 0.0); /* Replace uvs with uvs_vec.yz after */

40 GraphicsFuzz: bug gallery AMD Apple ARM Imagination Intel Nvidia vec3 hsbtorgb(float h, float s, float b) { return b * ((false? (--s) : 1.0 ) - s) + (b - (false? (--s) : b * (1.0 - s) )) * clamp(abs(abs((false? (--s) : 6.0 ) * [..]; }

41 GraphicsFuzz: bug gallery AMD Apple ARM Imagination Intel Nvidia Qualcomm /* Multiple instances of the following, where v is a literal value */ if(injswitch.x > injswitch.y) return v;

42 Security bugs

43 Security bugs AMD: bluescreen Apple: iphone rendering garbage Imagination: garbage rendering on Nexus Player Intel: bluescreen Nvidia: Ubuntu freeze Qualcomm: HTC One M7 restart via WebGL

44 Blog post series by Alastair on Medium :

45 Team gallery Multicore Programming Group Alastair Donaldson Group Leader Paul Thomson PostDoc Andrei Lascu PhD student Hugues Evrard PostDoc

46 Conclusion

47 Conclusion Our approach: Automatically finds bugs Produces a minimal difference test case C1: Is there a bug? Detect differences metamorphic testing semantics-preserving transformations C2: Where is the bug? Minimal difference test cases Help to pinpoint bug location C3: Is the bug important/relevant? Start from high-value shaders Prioritizes bugs that are close to being found in practice by developers Generic approach beyond GLSL: HLSL, SPIR-V, Metal, Can be used to amplify existing test suite

48 Future work More transformations Extend to other shader languages Focus search on security bugs Coverage-based fuzzing Fuzz for performance issues