Detecting Deadlock, Double-Free and Other Abuses in a Million Lines of Linux Kernel Source

Abstract

The formal analysis described here detects two so far undetected real deadlock situations per thousand C source files or million lines of code in the open source Linux operating system kernel, and three undetected accesses to freed memory, at a few seconds per file. That is notable because the code has been continuously under scrutiny from thousands of developers' pairs of eyes. In distinction to model-checking techniques, which also use symbolic logic, the analysis uses a "3-phase" compositional Hoare-style programming logic combined with abstract interpretation. The result is a customisable post-hoc semantic analysis of C code that is capable of several different analyses at once.

Assurance Process for Large Open Source Code Bases

“…For instance, the MOPS static analyzer has been used to check security properties of a Linux distribution [23]. A recent software solution aimed at the verification of large-scale software systems is based on an approach called symbolic approximation [6]- [8]. Symbolic approximation mitigates the state space explosion problem of model checking techniques, by defining an approximate logical semantics of C programs.…”

Approximate verification in an open source world

“…We also use a permanent database in which to maintain and share information derived from the analysis. The system of judgments is described further in references such as [5,6,9,10].…”

“…As explained in the published material [5][6][7][8][9]11,24,12], a characteristic of GNU C (as opposed to ANSI C [1,20]) leads to choice of a more complicated state description than just a simple predicate, even for the abstract state. Definition 1 A (basic) state description consists of a predicate p and a term t. The predicate describes the extent or domain of the states being described.…”

“…), and the logic for those is certainly always defined by the user who sets up the analysis. A full description will be found in the references [9,10] and others, but for completeness a quick sketch is given here.…”