Understanding and Genera-ng High Quality Patches for Concurrency - - PowerPoint PPT Presentation

1

Understanding and Genera-ng High Quality Patches for Concurrency Bugs

Haopeng Liu, Yuxi Chen and Shan Lu

2

What are concurrency bugs

• Synchroniza-on mistakes in mul--threaded

programs

3

What are concurrency bugs

• Synchroniza-on mistakes in mul--threaded

programs

//child thread if(…){ unlock(f->mut); return; } //parent thread f->mut = NULL;

4

What are concurrency bugs

• Synchroniza-on mistakes in mul--threaded

programs

//child thread if(…){ unlock(f->mut); return; } //parent thread f->mut = NULL;

5

What are concurrency bugs

• Synchroniza-on mistakes in mul--threaded

programs

//child thread if(…){ unlock(f->mut); return; } //parent thread f->mut = NULL;

6

Concurrency bugs need to be fixed

• Prevalence

– Widely exist in mul--threaded programs

• Seriousness

– Cause real world disasters

• Difficulty

– Time-consuming to fix [LuASPLOS’08] – Patches are the most error-prone [YinFSE’11]

• 2X -mes more oXen to be buggy than memory/seman-c bugs

7

Concurrency bug automated fixing

• Observa-on:

– Program is correct in most -ming interleavings.

• Solu-on:

– Only need to remove some bad -ming.

• add lock-related synchroniza-on [AFix PLDI’11] [CFix OSDI’12] [Grail

FSE’14].

8

An automated fixing example

//child thread if(…){ unlock(f->mut); + lock(L); + signal(con); + unlock(L); return; } + lock(L); + signal(con); + unlock(L);

//parent thread + lock(L) + while(…){ + wait(con, L); + } + unlock (L) f->mut = NULL;

• Overall:

– 9 new synchroniza-ons – 1 new while loop

Reality is even worse!

9

The manual patch

//child thread if(…){ unlock(f->mut); return; } //parent thread + thread_join(…); f->mut = NULL;

Simpler patch à Easier to read and maintain

• Overall:

– New sycn.: 1 VS. 9 – New while loop: 0 VS. 1

Can we automa7cally generate such simple patches?

10

• Manual patch study

– 77 real-world concurrency bugs – The limita-on of exis-ng techniques – Guidance to design new tools

• HFix

Contribu-ons

[1] Guoliang Jin etc. AFix. In PLDI’11 [2] Guoliang Jin etc. CFix. In OSDI’12 [3] Peng Liu etc. Grail. In FSE’14

Bug Reports Bug Reports Bug Reports Bug Reports Bug Reports

AFix[1] CFix[2] Grail[3] … HFix

11

Outline

• Mo-va-on
• Manual patch study
• HFix
• Evalua-on
• Conclusion

12

Research Ques-ons

• Q1: Do manual patches mostly use lock-

related synchroniza-ons?

• Q2: Do manual patches mostly disable buggy
• ming by adding synchroniza-on ops?

13

Manual patch study methodology[1]

• Study developer patches & on-line discussion

[1] Threads to validity are listed in paper. [2] Guoliang Jin etc. AFix. In PLDI’11 [3] Guoliang Jin etc. CFix. In OSDI’12 [4] Wei Zhang etc. ConSeq. In ASPLOS’11

App. Source Descrip7on #. Bugs Apache Lu ASPLOS’08 Web Server 13 Mozilla Browser Suite 41 MySQL Database Server 12 OpenOffice Office Suite 5 Misc Recent papers[2-4] 6 Total 77

14

Q1: How many patches use lock?

Use Sync. primi7ves?

Yes None

15

Q1: How many patches use lock?

Use Sync. primi7ves?

Yes None AV patches OV patches

Synchroniza7on primi7ves

Lock/Con. Var Create/Join Misc.

16

Q1: How many patches use lock?

Use Sync. primi7ves?

Yes None AV patches OV patches

Synchroniza7on primi7ves

Lock/Con. Var Create/Join Misc.

17

Q1: How many patches use lock?

Use Sync. primi7ves?

Yes None AV patches OV patches

Synchroniza7on primi7ves

Lock/Con. Var Create/Join Misc.

18

Q1: How many patches use lock?

P R

Threadpc Threadr

C

Use Sync. primi7ves?

Yes None AV patches OV patches

Synchroniza7on primi7ves

Lock/Con. Var Create/Join Misc.

19

Q1: How many patches use lock?

P R

Threadpc Threadr

C

Use Sync. primi7ves?

Yes None AV patches OV patches

Synchroniza7on primi7ves

Lock/Con. Var Create/Join Misc.

20

Q1: How many patches use lock?

A B

ThreadA ThreadB

P R

Threadpc Threadr

C

Use Sync. primi7ves?

Yes None AV patches OV patches

Synchroniza7on primi7ves

Lock/Con. Var Create/Join Misc.

21

Q1: How many patches use lock?

A B

ThreadA ThreadB

P R

Threadpc Threadr

C

Use Sync. primi7ves?

Yes None AV patches OV patches

Synchroniza7on primi7ves

Lock/Con. Var Create/Join Misc.

22

Q1 implica-on

• Use non-lock synchroniza-on to fix OV.

AV patches OV patches

Synchroniza7on primi7ves

Lock/Con. Var Create/Join Misc.

23

Q1 implica-on

• Use non-lock synchroniza-on to fix OV.

AV patches OV patches

Synchroniza7on primi7ves

Lock/Con. Var Create/Join Misc.

24

Q2: What are developers’ fix strategy?

Disable Tolerate

25

Q2: What are developers’ fix strategy?

Disable (Adds)[1-3] Tolerate

[1] Guoliang Jin etc. AFix. In PLDI’11 [2] Guoliang Jin etc. CFix. In OSDI’12 [3] Peng Liu etc. Grail.In FSE’14

26

Q2: What are developers’ fix strategy?

Disable (Adds) Disable (Data priv.)[1] Tolerate

[1] Jeff Huang etc.Execu-on Priva-za-on of Scheduler-Oblivious Concurrent Programs. In OOPSLA’11

27

Q2: What are developers’ fix strategy?

Disable (Adds) Disable (Data priv.) Disable (Moves) Tolerate

28

Q2: What are developers’ fix strategy?

Disable (Adds) Disable (Data priv.) Disable (Moves) Disable (Bypass) Tolerate

29

Q2 implica-on

• Add-Sync widely applies, but oXen not best
• Need to automate:

– Move synchroniza-on – Bypass – Tolerate

• Different bugs are suitable different strategies

Disable (Adds) Disable (Data priv.) Disable (Moves) Disable (Bypass) Tolerate

30

Outline

• Mo-va-on
• Manual patch studying
• HFix

– HFixJoin – HFixmove

• Evalua-on
• Conclusion

31

HFix overview

A B

ThdA ThdB

P R

Thdpc Thdr

C

• Goal:

– Fix bugs with simple patches – Do not introduce new bugs

Code transform Sta-c analysis Code transform Sta-c analysis

HFixJoin HFixMove

HFix

32

HFixjoin Intui-on

• Which kind of bugs can be fixed by HFixjoin?

A

ThreadA ThreadB

B Scre

create

33

HFixjoin Intui-on

• Which kind of bugs can be fixed by HFixjoin?

A

ThreadA ThreadB

B Scre

create

34

HFixjoin

• Step1: Suitability checking

– Goal: do not introduce new bugs.

• Step2: Insert join synchroniza-on

– Goal: fix the bug

35

Suitability checking (sta-c analysis)

• Is ThreadA a joinable child thread of ThreadB?
• Only one ThreadB?
• Is ThreadA already joined?
• Will there be deadlock/severe performance

slow-down?

A

ThreadA ThreadB

B Scre

create

36

Suitability checking (sta-c analysis)

• Is ThreadA a joinable child thread of ThreadB?
• Only one ThreadB?
• Is ThreadA already joined?
• Will there be deadlock/severe performance

slow-down?

//parent thread + thread_join(…); fp = NULL; signal(condV); //child thread fputs(fp,…); wait(condV);

37

• Insert join before opera-on B
• Patch Example

Insert join synchroniza-on

//child thread if(…){ unlock(f->mut); return; } //parent thread pthread_create(&tid,…) ... f->mut = NULL;

38

• Insert join before opera-on B
• Patch Example

Insert join synchroniza-on

//child thread if(…){ unlock(f->mut); return; } //parent thread pthread_create(&tid,…) ... f->mut = NULL; tmp = tid; pthread_join(tmp);

39

A

HFixmove Intui-on

• What kind of bugs can be fixed by HFixmove?

ThreadA ThreadB

B Scre

create

(a) Movecreate fixes OV bug move-up A or move-down S

40

A*

HFixmove Intui-on

• What kind of bugs can be fixed by HFixmove?

ThreadA ThreadB

B Scre

create

(a) Movecreate fixes OV bug move-up A or move-down S

A

ThreadA ThreadB

B Sjoin

join

(b) Movejoin fixes OV bug move-up S or move-down B

41

A*

HFixmove Intui-on

• What kind of bugs can be fixed by HFixmove?

ThreadA ThreadB

B Scre

create

(a) Movecreate fixes OV bug move-up A or move-down S

A

ThreadA ThreadB

Sjoin

join

(b) Movejoin fixes OV bug move-up S or move-down B

p

Threadpc Threadr

r c Sunlock

ck

(c) Moveunlock fixes AV bug move-up c or move-down S

p

Threadpc Threadr

r c Slock

ck

(d) Movelock fixes AV bug move-up S or move-down p

B*

42

Step1: iden-fy two opera-ons to move

(a) Movecreate fixes OV bug move-up A or move-down S (b) Movejoin fixes OV bug move-up S or move-down B (c) Moveunlock fixes AV bug move-up c or move-down S (d) Movelock fixes AV bug move-up S or move-down p

ThreadA ThreadB

B Scre

create

A

ThreadA ThreadB

Sjoin

join

p

Threadpc Threadr

r Sunlock

ck

Threadpc Threadr

r c Slock

ck

B* C* P* A*

43

Step1: iden-fy two opera-ons to move

X X Y Y

(a) Movecreate fixes OV bug move-up A or move-down S (b) Movejoin fixes OV bug move-up S or move-down B (c) Moveunlock fixes AV bug move-up c or move-down S (d) Movelock fixes AV bug move-up S or move-down p

ThreadA ThreadB

B Scre

create

A

ThreadA ThreadB

Sjoin

join

p

Threadpc Threadr

r Sunlock

ck

Threadpc Threadr

r c Slock

ck

B* C* P* A*

44

Step 2: decide the moving des-na-on X*

• Goal

# of execu-ons of X == # of execu-ons of X*

45

X* Y Naïve sol

Strawman solu-on doesn’t work

# of execu-ons of X ≠ # of execu-ons of X* 1≠0

Y X AXer moving, X* does not execute. Originally, X executes once.

46

Strawman solu-on doesn’t work

Y X X* Y Naïve sol Originally, X executes once. AXer moving, X* executes more than once.

# of execu-ons of X ≠ # of execu-ons of X* 1≠𝑂

47

HFixmove demonstra-on

Y X

* X and Y are inside the same func-on; neither is in loop

• Guarantee: X* will execute exactly once before Y.

48

HFixmove demonstra-on

Y X Y X

* X and Y are inside the same func-on; neither is in loop

• Guarantee: X* will execute exactly once before Y.

49

HFixmove demonstra-on

Y X Y X

* X and Y are inside the same func-on; neither is in loop

• Guarantee: X* will execute exactly once before Y.

50

HFixmove demonstra-on

Y X Y X Our solu-on Y X* X* X* X*

* X and Y are inside the same func-on; neither is in loop

• Guarantee: X* will execute exactly once before Y.

51

HFixmove demonstra-on

Y X Y X Y X Our solu-on Y X* X* X* X*

* X and Y are inside the same func-on; neither is in loop

• Guarantee: X* will execute exactly once before Y.

52

HFixmove demonstra-on

Y X Y X Y X Y X Our solu-on Y X* X* Our solu-on Y X* X* X* X*

* X and Y are inside the same func-on; neither is in loop

• Guarantee: X* will execute exactly once before Y.

53

• Does move change local def-use rela-onship?

Step 3: suitability checking

+ gX = m; s_create(…); m = 0; gX = m;

54

• Does move change local def-use rela-onship?

Step 3: suitability checking

+ gX = m; s_create(…); m = 0; gX = m;

55

• Does move change local def-use rela-onship?

Step 3: suitability checking

+ gX = m; s_create(…); m = 0; gX = m;

56

• Does move change local def-use rela-onship?
• Might move introduce deadlocks?

Step 3: suitability checking

+ gX = m; s_create(…); m = 0;

57

HFixmove patch example

//child thread assert(h->band); //parent thread pthread_create(…) ... + h->band = bdNew(h);

• h->band = bdNew(h);

58

Outline

• Mo-va-on
• Manual patch studying
• HFix
• Evalua-on

– Methodology – Results

• Conclusion

59

Methodology

• Benchmark Suite

– 13 bugs set up by Cfix [OSDI’12] – All the AV bugs in ASPLOS’08 suite that are fixed through moving synchroniza-on by developers.

60

Results for OV bugs

App. FFT HTTrack Mozilla PBZIP2 Transmission X264 ZSNES HFix VS. Manual

• join

join create join create

✗ ✓ ✓ ✓ ✓ ✓

✗ ✗

61

Results for OV bugs

App. FFT HTTrack Mozilla PBZIP2 Transmission X264 ZSNES HFix Strategy #.Sync 1

• 1

CFix Strategy #.Sync 5 3 2 5 2 7 3 join join create join create signal/wait signal/wait signal/wait signal/wait signal/wait signal/wait signal/wait

62

App. Apache Mozilla1 Mozilla2 MySQL1 MySQL2 MySQL3

Results for AV bugs

HFix lock lock unlock unlock unlock

✗

63

Outline

• Mo-va-on
• Manual patch studying
• HFix
• Evalua-on
• Conclusion

64

Conclusion

• Manual patch study:

– Add join for OV (HFix) – Move exis-ng sync. (HFix) – Bypass & tolerate (Future work)

• HFix

– A useful complement. – Generate much simple patches.

Disable (Adds) Disable (Data priv.) Disable (Moves) Disable (Bypass) Tolerate

65

Thank you! Q&A