.png){kind=icon}
.png){kind=icon}
Return
DFTracker: detecting double-fetch bugs by multi-taint parallel tracking
.png){kind=icon}
PRE
AI
DOI：10.1007/s11704-016-6383-8.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
A race condition is a common trigger for con-currency bugs. As a special case, a race condition can also occur across the kernel and user space causing a doublefetch bug, which is a field that has received little research attention. In our work, we first analyzed real-world doublefetch bug cases and extracted two specific patterns for doublefetch bugs. Based on these patterns, we proposed an approach of multi-taint parallel tracking to detect double-fetch bugs. We also implemented a prototype called DFTracker (doublefetch bug tracker), and we evaluated it with our test suite. Our experiments demonstrated that it could effectively find all the double-fetch bugs in the test suite including eight real-world cases with no false negatives and minor false positives. In addition, we tested it on Linux kernel and found a new double-fetch bug. The execution overhead is approximately 2x for single-file cases and approximately 9x for the whole kernel test, which is acceptable. To the best of the authors' knowledge, this work is the first to introduce multi-taint parallel tracking to double-fetch bug detection-an innovative method that is specific to double-fetch bug features-and has better path coverage as well as lower runtime overhead than the widely used dynamic approaches.
Keywords:
multi-taint parallel tracking
double fetch
race condition between kernel and user
time of check to time of use
real-world case analysis
Clang Static Analyzer
AI Summary
Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.
Journal
IF:
4.6
Papers:
1.6K
Citations:
2.8K