DFTracker: detecting double-fetch bugs by multi-taint parallel tracking

Pengfei Wang

doi:10.1007/s11704-016-6383-8

DFTracker: detecting double-fetch bugs by multi-taint parallel tracking

2019-04-11

9

PRE

AI

DOI：10.1007/s11704-016-6383-8

原文链接

原文求助

摘要

En 中文

A race condition is a common trigger for con-currency bugs. As a special case, a race condition can also occur across the kernel and user space causing a doublefetch bug, which is a field that has received little research attention. In our work, we first analyzed real-world doublefetch bug cases and extracted two specific patterns for doublefetch bugs. Based on these patterns, we proposed an approach of multi-taint parallel tracking to detect double-fetch bugs. We also implemented a prototype called DFTracker (doublefetch bug tracker), and we evaluated it with our test suite. Our experiments demonstrated that it could effectively find all the double-fetch bugs in the test suite including eight real-world cases with no false negatives and minor false positives. In addition, we tested it on Linux kernel and found a new double-fetch bug. The execution overhead is approximately 2x for single-file cases and approximately 9x for the whole kernel test, which is acceptable. To the best of the authors' knowledge, this work is the first to introduce multi-taint parallel tracking to double-fetch bug detection-an innovative method that is specific to double-fetch bug features-and has better path coverage as well as lower runtime overhead than the widely used dynamic approaches.

Keyword:

multi-taint parallel tracking

double fetch

race condition between kernel and user

time of check to time of use

real-world case analysis

Clang Static Analyzer

DFTracker: detecting double-fetch bugs by multi-taint parallel tracking

摘要

AI总结

期刊

机构