Automatic fault injection for driver robustness testing

Abstract

Robustness testing is a crucial stage in the device driver development cycle. To accelerate driver robustness testing, effective fault scenarios need to be generated and injected without requiring much time and human effort. In this paper, we present a practical approach to automatic runtime generation and injection of fault scenarios for driver robustness testing. We identify target functions that can fail from runtime execution traces, generate effective fault scenarios on these target functions using a bounded trace-based iterative strategy, and inject the generated fault scenarios at runtime to test driver robustness using a permutation-based injection mechanism. We have evaluated our approach on 12 Linux device drivers and found 28 severe bugs. All these bugs have been further validated via manual fault injection. The results demonstrate that our approach is useful and efficient in generating fault scenarios for driver robustness testing with little manual effort.

Path-sensitive and alias-aware typestate analysis for detecting OS bugs

“…Some approaches [20,44,60,71] use coverage-guided fuzzing to test infrequently-executed code, by automatically mutating and generating system calls according to code coverage. Some approaches [6,18,41,62] perform software fault injection to test error handling code, by deliberately corrupting the return values of kernel-interface calls. By using exact runtime information about OS execution, dynamic analysis can effectively reduce false positives in bug detection.…”

Fuzzing Error Handling Code in Device Drivers Based on Software Fault Injection

“…Some SFI-based approaches [14]- [16], [21], [50], [51] can test kernel-level device drivers. Mendona et al [21] propose a robustness-testing approach for Windows device drivers.…”

“…This approach injects random faults on the arguments of frequently called kernel interfaces in device drivers. ADFI [14] performs a bounded trace-based iterative generation strategy to relieve the problem of fault scenario explosion, and exploits a permutation-based replay mechanism to guarantee the fidelity of runtime fault injection. EH-Test [16] uses a pattern-based strategy to analyze driver code and extract possibly realistic injected faults, and uses single fault injection to cover error handling code in drivers.…”

An Automated Formal Process for Detecting Fault Injection Vulnerabilities in Binaries and Case Study on PRESENT

“…Several are only able to inject faults into intermediate representations, and not into executable binaries [29], [23], [30], thus being unable to simulate faults that appear only at the executable binary level. Others have different limitations, such as: specific hardware platforms [22], [31], specific source code languages [32], [9], [30], or requiring simulating drivers [33]. Despite these limitations, many include useful techniques or developments that could be incorporated into future development of a general fault injection tool for executable binaries.…”