LTL Model Checking of LLVM Bitcode with Symbolic Data

Bauch, Petr; Havel, Vojtěch; Barnat, Jǐŕı

doi:10.1007/978-3-319-14896-0_5

Cited by 7 publications

(2 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, in symbolic execution [12,56,81], aliased variables can be mapped into a single symbol with this alias analysis, to merge many constraints among these variables, which can simplify constraint solving with no or small precision loss. In model checking [11,53], aliased variables in a program can be mapped into a single variable in the model, to reduce the state space of the checked model, which can mitigate state explosion problem. In API-rule checking [84], alias information can help to detect hard-to-find API misuses (e.g., caused by improper or wrong uses of arguments) involving complex alias relationships.…”

Section: Discussionmentioning

confidence: 99%

Path-sensitive and alias-aware typestate analysis for detecting OS bugs

Bai

Sui

et al. 2022

Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems

View full text Add to dashboard Cite

Operating system (OS) is the cornerstone for modern computer systems. It manages devices and provides fundamental service for user-level applications. Thus, detecting bugs in OSes is important to improve reliability and security of computer systems. Static typestate analysis is a common technique for detecting different types of bugs, but it is often inaccurate or unscalable for large-size OS code, due to imprecision of identifying alias relationships as well as high costs of typestate tracking and path-feasibility validation.In this paper, we present PATA, a novel path-sensitive and aliasaware typestate analysis framework to detect OS bugs. To improve the precision of identifying alias relationships in OS code, PATA performs a path-based alias analysis based on control-flow paths and access paths. With these alias relationships, PATA reduces the costs of typestate tracking and path-feasibility validation, to boost the efficiency of path-sensitive typestate analysis for bug detection. We have evaluated PATA on the Linux kernel and three popular IoT OSes (Zephyr, RIOT and TencentOS-tiny) to detect three common types of bugs (null-pointer dereferences, uninitializedvariable accesses and memory leaks). PATA finds 574 real bugs with a false positive rate of 28%. 206 of these bugs have been confirmed by the developers of the four OSes. We also compare PATA to seven state-of-the-art static approaches (Cppcheck, Coccinelle, Smatch, CSA, Infer, Saber and SVF). PATA finds many real bugs missed by them, with a lower false positive rate. CCS CONCEPTS• Software and its engineering → Software defect analysis; • Security and privacy → Operating systems security.

show abstract

Section: Discussionmentioning

confidence: 99%

Path-sensitive and alias-aware typestate analysis for detecting OS bugs

Bai

Sui

et al. 2022

Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems

View full text Add to dashboard Cite

show abstract

“…In a more recent trend, approaches to software model checking are emerging for the general class of LTL properties, and in particular general liveness properties [5,[22][23][24]. In this paper, we introduce an approach to LTL software model checking which is based on fairness modulo theory, an extension of reachability modulo theory as introduced by Lal and Qadeer [42].…”

Section: Introductionmentioning

confidence: 99%

Fairness Modulo Theory: A New Approach to LTL Software Model Checking

Dietsch

Heizmann

Langenfeld

et al. 2015

Computer Aided Verification

View full text Add to dashboard Cite

The construction of a proof for unsatisfiability is less costly than the construction of a ranking function. We present a new approach to LTL software model checking (i.e., to statically analyze a program and verify a temporal property from the full class of LTL including general liveness properties) which aims at exploiting this fact. The idea is to select finite prefixes of a path and check these for infeasibility before considering the full infinite path. We have implemented a tool which demonstrates the practical potential of the approach. In particular, the tool can verify several benchmark programs for a liveness property just with finite prefixes (and thus without the construction of a single ranking function).

show abstract