Data Races are Bad Race: two threads access memory without - PowerPoint PPT Presentation

C ONTEXT - SENSITIVE C ORRELATION A NALYSIS FOR D ETECTING R ACES Polyvios Pratikakis Jeff Foster Michael Hicks University of Maryland, College Park Context-sensitive Correlation Analysis for Detecting Races – p.1/ ??

Data Races are Bad Race: two threads access memory without synchronization and at least one is a write Races are bad: August 14th 2004, Northeastern Blackout 1985-1987, Therac-25 medical accelerator Programs with races are difficult to understand Context-sensitive Correlation Analysis for Detecting Races – p.2/ ??

A way to prevent races Shared locations ρ Locks ℓ Correlation ρ ⊲ ℓ : Lock ℓ is correlated with pointer ρ if-f ℓ is held while ρ is accessed Consistent correlation : A given pointer ρ is only correlated with one lock ℓ Assert that every shared location ρ is consistently correlated with a single lock ℓ Context-sensitive Correlation Analysis for Detecting Races – p.3/ ??

Contribution Inference of correlation between locks and pointers for C: Universal and Existential context sensitivity in correlation propagation Sound race detection using assertion of consistent correlation It works: we found races! Context-sensitive Correlation Analysis for Detecting Races – p.4/ ??

This presentation Correlation Inference Universal and Existential context sensitivity Linearity of locks Lock State (which locks are held at every program point?) Experimental Results Context-sensitive Correlation Analysis for Detecting Races – p.5/ ??

Type Based Analysis Annotate types with labels: pthread_mutex_t → pthread_mutex_t � ℓ � τ * → τ * � ρ � Create constraints among labels to capture data flow and correlation Dereferencing ρ while ℓ is held: ρ ⊲ ℓ Aliasing ρ to ρ ′ : ρ ≤ ρ ′ Aliasing ℓ to ℓ ′ : ℓ = ℓ ′ Solve constraints to close the relation ρ ⊲ ℓ Verify consistent correlation of every shared ρ with a single lock ℓ for all dereferences of ρ Context-sensitive Correlation Analysis for Detecting Races – p.6/ ??

Correlation pthread mutex t L1 = ...; int x; // &x: int* p) { void munge(pthread mutex t *l, int * pthread mutex lock(l); *p = 3; pthread mutex unlock(l); } ... munge(&L1, &x); Context-sensitive Correlation Analysis for Detecting Races – p.7/ ??

Correlation pthread mutex t � ℓ 1 � L1 = ...; int* � ρ x � int x; // &x: void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); ρ x ℓ 1 *p = 3; pthread mutex unlock(l); } ... ρ ℓ munge(&L1, &x); munge Context-sensitive Correlation Analysis for Detecting Races – p.8/ ??

Correlation pthread mutex t � ℓ 1 � L1 = ...; int* � ρ x � int x; // &x: void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); ρ x ℓ 1 *p = 3; pthread mutex unlock(l); } ... ρ ℓ munge(&L1, &x); munge Context-sensitive Correlation Analysis for Detecting Races – p.8/ ??

Correlation pthread mutex t � ℓ 1 � L1 = ...; int* � ρ x � int x; // &x: void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); ρ x ℓ 1 *p = 3; pthread mutex unlock(l); } ... ρ ℓ munge(&L1, &x); munge Context-sensitive Correlation Analysis for Detecting Races – p.8/ ??

Correlation pthread mutex t � ℓ 1 � L1 = ...; int* � ρ x � int x; // &x: void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); ρ x ℓ 1 *p = 3; pthread mutex unlock(l); } ... ρ ⊲ ℓ munge(&L1, &x); munge Context-sensitive Correlation Analysis for Detecting Races – p.8/ ??

Correlation pthread mutex t � ℓ 1 � L1 = ...; int* � ρ x � int x; // &x: void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); ρ x ⊲ ℓ 1 *p = 3; pthread mutex unlock(l); } ... ρ ⊲ ℓ munge(&L1, &x); munge Context-sensitive Correlation Analysis for Detecting Races – p.8/ ??

Context Sensitivity pthread mutex t � ℓ 1 � L1 = ..., � ℓ 2 � L2 = ...; int x, y, z; // � ρ x � , ρ y , � ρ z � � � void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); *p = 3; pthread mutex unlock(l); } ... ρ x ρ y ρ z ℓ 1 ℓ 2 munge(&L1, &x); ⊲ ρ munge(&L2, &y); ℓ munge(&L2, &z); munge Context-sensitive Correlation Analysis for Detecting Races – p.9/ ??

Context Sensitivity pthread mutex t � ℓ 1 � L1 = ..., � ℓ 2 � L2 = ...; int x, y, z; // � ρ x � , ρ y , � ρ z � � � void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); *p = 3; pthread mutex unlock(l); } ... ρ x ρ y ρ z ℓ 1 ℓ 2 munge(&L1, &x); ⊲ ρ munge(&L2, &y); ℓ munge(&L2, &z); munge Context-sensitive Correlation Analysis for Detecting Races – p.9/ ??

Context Sensitivity pthread mutex t � ℓ 1 � L1 = ..., � ℓ 2 � L2 = ...; int x, y, z; // � ρ x � , ρ y , � ρ z � � � void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); *p = 3; pthread mutex unlock(l); } ... ρ x ρ y ρ z ℓ 1 ℓ 2 munge(&L1, &x); ⊲ ρ munge(&L2, &y); ℓ munge(&L2, &z); munge Context-sensitive Correlation Analysis for Detecting Races – p.9/ ??

Context Sensitivity pthread mutex t � ℓ 1 � L1 = ..., � ℓ 2 � L2 = ...; int x, y, z; // � ρ x � , ρ y , � ρ z � � � void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); *p = 3; pthread mutex unlock(l); } ⊲ ⊲ ... ρ x ρ y ρ z ℓ 1 ℓ 2 munge(&L1, &x); ⊲ ρ munge(&L2, &y); ℓ munge(&L2, &z); munge Context-sensitive Correlation Analysis for Detecting Races – p.9/ ??

Context Sensitivity pthread mutex t � ℓ 1 � L1 = ..., � ℓ 2 � L2 = ...; int x, y, z; // � ρ x � , ρ y , � ρ z � � � void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); *p = 3; ( 1 ) 1 pthread mutex unlock(l); ( 1 } ... ρ x ρ y ρ z ℓ 1 ℓ 2 munge 1 (&L1, &x); ( 1 ( 1 ) 1 munge 2 (&L2, &y); ⊲ ρ ℓ munge 3 (&L2, &z); munge Context-sensitive Correlation Analysis for Detecting Races – p.9/ ??

Context Sensitivity pthread mutex t � ℓ 1 � L1 = ..., � ℓ 2 � L2 = ...; int x, y, z; // � ρ x � , ρ y , � ρ z � � � void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); *p = 3; pthread mutex unlock(l); } ⊲ ... ρ x ρ y ρ z ℓ 1 ℓ 2 munge 1 (&L1, &x); ( 1 ( 1 ) 1 munge 2 (&L2, &y); ⊲ ρ ℓ munge 3 (&L2, &z); munge Context-sensitive Correlation Analysis for Detecting Races – p.9/ ??

Context Sensitivity pthread mutex t � ℓ 1 � L1 = ..., � ℓ 2 � L2 = ...; int x, y, z; // � ρ x � , ρ y , � ρ z � � � void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); *p = 3; pthread mutex unlock(l); ( 2 ) 2 } ( 2 ... ρ x ρ y ρ z ℓ 1 ℓ 2 munge 1 (&L1, &x); ( 2 ( 2 ) 2 munge 2 (&L2, &y); ⊲ ρ ℓ munge 3 (&L2, &z); munge Context-sensitive Correlation Analysis for Detecting Races – p.9/ ??

Context Sensitivity pthread mutex t � ℓ 1 � L1 = ..., � ℓ 2 � L2 = ...; int x, y, z; // � ρ x � , ρ y , � ρ z � � � void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); *p = 3; pthread mutex unlock(l); } ⊲ ... ρ x ρ y ρ z ℓ 1 ℓ 2 munge 1 (&L1, &x); ( 2 ( 2 ) 2 munge 2 (&L2, &y); ⊲ ρ ℓ munge 3 (&L2, &z); munge Context-sensitive Correlation Analysis for Detecting Races – p.9/ ??

Context Sensitivity pthread mutex t � ℓ 1 � L1 = ..., � ℓ 2 � L2 = ...; int x, y, z; // � ρ x � , ρ y , � ρ z � � � void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); *p = 3; pthread mutex unlock(l); } ( 3 ) 3 ( 3 ... ρ x ρ y ρ z ℓ 1 ℓ 2 munge 1 (&L1, &x); ( 3 ( 3 ) 3 munge 2 (&L2, &y); ⊲ ρ ℓ munge 3 (&L2, &z); munge Context-sensitive Correlation Analysis for Detecting Races – p.9/ ??

Context Sensitivity pthread mutex t � ℓ 1 � L1 = ..., � ℓ 2 � L2 = ...; int x, y, z; // � ρ x � , ρ y , � ρ z � � � void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); *p = 3; pthread mutex unlock(l); } ... ρ x ρ y ρ z ℓ 1 ℓ 2 munge 1 (&L1, &x); ( 3 ( 3 ) 3 ⊲ munge 2 (&L2, &y); ⊲ ρ ℓ munge 3 (&L2, &z); munge Context-sensitive Correlation Analysis for Detecting Races – p.9/ ??

Context Sensitivity pthread mutex t � ℓ 1 � L1 = ..., � ℓ 2 � L2 = ...; int x, y, z; // � ρ x � , ρ y , � ρ z � � � void munge(pthread mutex t � ℓ � *l, int * � ρ � p) { pthread mutex lock(l); *p = 3; pthread mutex unlock(l); } ⊲ ⊲ ... ρ x ρ y ρ z ℓ 1 ℓ 2 munge 1 (&L1, &x); ⊲ munge 2 (&L2, &y); ⊲ ρ ℓ munge 3 (&L2, &z); munge Context-sensitive Correlation Analysis for Detecting Races – p.9/ ??