Krace: Data Race Fuzzing for Kernel File Systems

Abstract

Data races occur when two threads fail to use proper synchronization when accessing shared data. In kernel file systems, which are highly concurrent by design, data races are common mistakes and often wreak havoc on the users, causing inconsistent states or data losses. Prior fuzzing practices on file systems have been effective in uncovering hundreds of bugs, but they mostly focus on the sequential aspect of file system execution and do not comprehensively explore the concurrency dimension and hence, forgo the opportunity to catch data races.In this paper, we bring coverage-guided fuzzing to the concurrency dimension with three new constructs: 1) a new coverage tracking metric, alias coverage, specially designed to capture the exploration progress in the concurrency dimension; 2) an evolution algorithm for generating, mutating, and merging multithreaded syscall sequences as inputs for concurrency fuzzing; and 3) a comprehensive lockset and happens-before modeling for kernel synchronization primitives for precise data race detection. These components are integrated into KRACE, an end-to-end fuzzing framework that has discovered 23 data races in ext4, btrfs, and the VFS layer so far, and 9 are confirmed to be harmful.

Fuzzing: A Survey for Roadmap

“…Yet, due to the diverse usage of fuzzing, the execution states are not limited to code coverage. The states can be legality of executions for object-oriented programs [141], state machine for protocol implementations [3,11,55,61,64,69,154], alias coverage for concurrency implementations [194], neuron coverage for deep learning models [148], or execution logs for Android SmartTVs [1].…”

“…If code coverage is not available, an intuitive solution is to retain seeds based on execution outputs, such as the legality of execution results [141] or state machine of protocol implementations [154]. Because fuzzing can be utilized to detect defects of various applications, diferent types of itness are designed for speciic applications [1,82,148] or defects [194]. The following summarizes the diverse kinds of itness.…”

“…• Alias coverage for data race. The alias coverage is designed to detect data races in kernel ile systems [194]. A data race is a concurrent bug in which two threads access a shared memory location without proper synchronization.…”

“…Because the inputs for the kernels include ile system images or a sequence of syscalls, fuzzers can test kernels in a more light-weighted manner. That is, after the data dependency of syscalls are analyzed or inferred (ğ4.7), fuzzers generate sequences of syscalls to run on target kernels [53,77,95,142,183,194,196]. Then, fuzzers monitor whether sequences of syscalls incur system panics that indicate potential bugs in the target kernel.…”

“…By steering computing resources for fuzzing in diferent ways [22,23,37,40,65,188,202], researchers can discover vulnerabilities more efectively and eiciently. Until now, fuzzing has discovered thousands of bugs in real-world programs, such as bugs discovered in general applications [30], IoT (Internet of Things) devices [36], irmware [211], kernels [194], and database systems [212].…”