ConMem Detecting Severe Concurrency Bugs Through an Effect-Oriented Approach.pdf

ConMem: Detecting Severe Concurrency Bugs through an Effect-Oriented Approach Wei Zhang Chong Sun Shan Lu Computer Sciences Department, University of Wisconsin– Madison {wzh,chong,shanlu}@ Abstract Multicore technology is making concurrent programs increasingly pervasive. Unfortunately, it is difficult to deliver reliable concurrent programs, because of the huge and non-deterministic interleaving space. In reality, without the resources to thoroughly check the in- terleaving space, critical concurrency bugs can slip into production runs and cause failures in the field. Approaches to making the best use of the limited resources and exposing severe concurrency bugs before software release would be desirable. Unlike previous work that focuses on bugs caused by specific interleavings (e.g., races and atomicity-violations), this paper tar- gets concurrency bugs that result in one type of severe effects: pro- gram crashes. Our study of the error-propagation process of real- world concurrency bugs reveals a common pattern (50% in our non-deadlock concurrency bug set) that is highly correlated with program crashes. We call this pattern concurrency-memory bugs: buggy interleavings directly cause memory bugs (NULL-pointer- dereference, dangling-pointer, buffer-overflow, uninitialized-read) on shared memory objects. Guided by this study, we built ConMem to monitor program ex- ecution, analyze memory accesses and synchronizations, and pred- icatively detect these common and severe concurrency-memory bugs. We also built a validator ConMem-v to automatically prune false positives by enforcing potential bug-triggering interleavings. We evaluated ConMem using 7 open-source programs with 9 real-world severe concurrency bugs. ConMem detects more tested bugs (8 out of 9 bugs) than a lock-set-based race detector and an unserializable-interleaving detector that detect 4 and 5 bugs respec- tively, with a false positive rate about one tenth of the compared tools. ConMem-v further prunes o