Static Analysis Basics II Trent Jaeger Systems and Internet - - PowerPoint PPT Presentation
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Static Analysis Basics II Trent Jaeger Systems and Internet
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA
1
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
2
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
3
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
4
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
5
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
6
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
7
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
8
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
9
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
10
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
11
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
12
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
13
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
14
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
15
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
16
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
17
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
18
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
19
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
20
A System and Language for Building System-Specific, Static Analyses
Seth Hallem, Benjamin Chelf, Yichen Xie, and Dawson Engler Stanford University
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
21
– Allow users of our system to write the analyses
– Metal - the language for writing analyses – xgcc - the engine for executing analyses
– Metal must be easy to use and flexible
Linux, OpenBSD and still counting
– xgcc must execute Metal extensions efficiently – xgcc must not restrict Metal extensions too much
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
22
bugs in real systems as possible
– The number of rules that apply to all programs is very small; violations of these generic rules are hard to find.
these rules will find lots of bugs
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
23
int contrived (int *p, int *w, int x) { int *q; if (x) { kfree (w); q = p; p = 0; } if (!x) return *w; // safe return *q; // deref after free } int contrived_caller (int *w, int x, int *p) { kfree (p); contrived (p, w, x); return *w; // deref after free } 1 2 3
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
24
Metal compiler (mcc) xgcc Source base (e.g. Linux) gcc Emitter Emit directory source code
AST for each file
binary representation emitted binaries Metal extension free.m dynamic library (free.so) deref-after-free, double-free errors
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
25
contrived_caller (w, x, p) kfree (p); // don’t follow call contrived (p, w, x); return from contrived; return *w; contrived (p, w, x) int *q; if (x) kfree (w); q = p; p = 0; if (!x) return *w; return *q; exit from contrived_caller exit from contrived
{ } {p is freed}
1
{p is freed} {p is freed} {p is freed} {p is freed} {p is freed} {p is freed} {p is freed} {p is freed} {p is freed}
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
26
contrived_caller (w, x, p) kfree (p); // don’t follow call contrived (p, w, x); return from contrived; return *w; contrived (p, w, x) int *q; if (x) kfree (w); q = p; p = 0; if (!x) return *w; return *q; exit from contrived_caller exit from contrived
{ } {p is freed} {p is freed} {p is freed} {p is freed} {q and w are freed} {q and w are freed}
3
{w is freed} {w is freed} {w is freed} { }
2
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
27
contrived_caller (w, x, p) kfree (p); // don’t follow call contrived (p, w, x); return from contrived; return *w; contrived (p, w, x) int *q; if (x) kfree (w); q = p; p = 0; if (!x) return *w; return *q; exit from contrived_caller exit from contrived
{ } {p is freed} {p is freed} {p is freed} {p is freed} {q and w are freed} {q and w are freed}
3
{w is freed} {w is freed} {w is freed} { }
2
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
28
Metal extensions
– SMs have patterns, states, transitions, and actions
– SMs are a familiar concept to programmers – Patterns specify interesting source constructs in the source language
– Actions are escapes to arbitrary C code that execute whenever a transition executes – Main restriction is determinism
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
29
Example: the free checker
v.unk v.freed v.stop kfree(v); kfree(v); *v _
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
30
– Global: “interrupts are disabled” – Variable-specific: “pointer p is freed”
sm free-check { state decl any_pointer v; start: { kfree (v) } ==> v.freed; v.freed: { *v } ==> v.stop, { err (“dereferenced %s after free!”, mc_identifier (v)); } | { kfree (v) } ==> v.stop, { err (“double free of %s!”, mc_identifier (v)); } ; }
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
31
sm free-check { state decl any_pointer v; start: { kfree (v) } ==> v.freed; v.freed:{ *v } ==> v.stop, { err (“dereferenced %s after free!”, mc_identifier (v)); } | { kfree (v) } ==> v.stop, { err (“double free of %s!”, mc_identifier (v)); } ; }
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
32
state
– Report errors, extend analysis (e.g., statistical)
sm free-check { state decl any_pointer v; start: { kfree (v) } ==> v.freed; v.freed: { *v } ==> v.stop, { err (“dereferenced %s after free!”, mc_identifier (v)); } | { kfree (v) } ==> v.stop, { err (“double free of %s!”, mc_identifier (v)); } ; }
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
33
– Depth-first-search + caching – Cache at the block level
– On cache hit, abort the current path, backtrack
– Summarize the effects of analyzing large portions
– Use summaries whenever possible
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
34
contrived (p, w, x) int *q; if (x) kfree (w); q = p; p = 0; if (!x) return *w; return *q; exit from contrived
v: pfreed v: pfreed
Graph Reachability”; Reps, Horowitz, Sagiv 1995
2
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
35
contrived (p, w, x) int *q; if (x) kfree (w); q = p; p = 0; if (!x) return *w; return *q; exit from contrived v: pfreed v: pfreed v: pfreed v: pfreed
v: pfreed v: qfreed v: wfreed ?
2
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
36
contrived (p, w, x) int *q; if (x) kfree (w); q = p; p = 0; if (!x) return *w; return *q; exit from contrived v: pfreed v: pfreed v: pfreed v: pfreed
v: pfreed v: qfreed v: wfreed v: wunk
2
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
37
contrived (p, w, x) int *q; if (x) kfree (w); q = p; p = 0; if (!x) return *w; return *q; exit from contrived v: pfreed v: pfreed v: pfreed v: pfreed v: pfreed v: qfreed v: wfreed v: wunk v: qfreed v: qfreed v: wfreed v: wfreed
v: qfreed v: wfreed v: qunk v: wfreed
2
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
38
contrived (p, w, x) int *q; if (x) kfree (w); q = p; p = 0; if (!x) return *w; return *q; exit from contrived
v: wunk v: wfreed v: wfreed v: wfreed
2
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
39
contrived_caller (w, x, p) kfree (p); // don’t follow call contrived (p, w, x); return from contrived; return *w; contrived (p, w, x) int *q; if (x) kfree (w); q = p; p = 0; if (!x) return *w; return *q; exit from contrived_caller exit from contrived
{} {‘p’ is freed} {‘p’ is freed} {‘p’ is freed} {‘p’ is freed} {‘p’ is freed} {‘q’ and ‘w’ are freed} {‘p’ is freed} {‘p’ and ‘w’ are freed} {‘q’ and ‘w’ are freed} {‘p’ and ‘w’ are freed} {} {‘p’ and ‘w’ are freed} {‘p’ is freed} {‘p’ is freed}
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
40
– initially we do not know any facts
edges
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
41
int f (int x, int z) { int a, b, p, q, y; p = x; q = 5; a = x; b = 5; if (z == (p + q)) { y = a + b; if (z != y) { . . . } . . . } }
Know nothing. Track y = a + b. ?? Track q = 5. Track b = 5. Track a = x. Track p = x. Track z = p + q.
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
42
int f (int x, int z) { int a, b, p, q, y; p = x; q = 5; a = x; b = 5; if (z == (p + q)) { y = a + b; if (z != y) { . . . } . . . } }
{q, 5} {b, 5} {z, p + q} ?? {y, a + b} {a, x} {p, x}
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
43
– Tracks all value flow through direct assignment flow sensitively – Ignores indirect value flow
– Tracks structure fields, pointer arithmetic
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
44
– No conservative alias analysis – Do not handle recursion soundly
– Goal is to find as many bugs as possible – For many properties conservative assumptions cause an explosion of false positives
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
45
– Rank most likely, easiest-to-diagnose errors first – Statistical ranking: use statistical test of significance to rank rules we check
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
46
– Flexible: over 50 checkers – Easy-to-use: Metal provides abstraction, sugar
– Effective: 1000+ real bugs, still finding more – What makes our tool effective?
analysis is helpful
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
47
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
48