View
51
Download
0
Category
Tags:
Preview:
DESCRIPTION
Counterexample Generation for Separation-Logic-Based Proofs. Arlen Cox Samin Ishtiaq Josh Berdine Christoph Wintersteiger. SLA YER. Abstraction-based Static Analyzer Uses Separation Logic Proves Memory Safety of Heap Manipulating Programs Shape Analysis Abstraction-based Static Analyzer - PowerPoint PPT Presentation
Citation preview
Counterexample Generation for Separation-Logic-Based ProofsArlen CoxSamin IshtiaqJosh BerdineChristoph Wintersteiger
2
SLAYER
Abstraction-based Static Analyzer• Uses Separation Logic• Proves Memory Safety of Heap Manipulating Programs
Shape Analysis
Abstraction-based Static Analyzer• Abstract Counterexamples• Failure to prove does not imply that a bug has been found• Even if the bug is real, the counterexample is still abstract
3
SLAYER Results
UNSAFE? SAFE
UNSAFE UNSAFE? SAFE
4
Concrete Counterexamples• If unsafe, return a set of inputs causing failure– Program inputs– Nondeterministic assignments
• Established Techniques– Symbolic Execution (Sage, KLEE)– Bounded Model Checking (CBMC)
5
Symbolic Execution
l := 0
l := *(l+next)return
t := alloc(2)*(t+next) := ll := t
6
Symbolic Execution
l := 0
l := *(l+next)return
t := alloc(2)*(t+next) := ll := t
7
Symbolic Execution
l := 0
l := *(l+next)return
t := alloc(2)*(t+next) := ll := t
8
Symbolic Execution
l := 0
l := *(l+next)return
t := alloc(2)*(t+next) := ll := t
9
Symbolic Execution• Heuristics guide the search• Whole paths are checked before checking
other paths• No guarantees any particular bug will be
found
10
Bounded Model Checking
l := 0
l := *(l+next)return
t := alloc(2)*(t+next) := ll := t
11
Bounded Model Checking
l := 0
12
Bounded Model Checking
l := 0
t := alloc(2)*(t+next) := ll := t
13
Bounded Model Checking
l := 0
l := *(l+next)
t := alloc(2)*(t+next) := ll := t
t := alloc(2)*(t+next) := ll := t
14
Bounded Model Checking
l := 0
l := *(l+next)
t := alloc(2)*(t+next) := ll := t
t := alloc(2)*(t+next) := ll := t
t := alloc(2)*(t+next) := ll := t
l := *(l+next)
l := *(l+next)
return
15
Bounded Model Checking• Complete search up to some depth• Searching all branches may be time consuming• Depth of search may be insufficient• Use failed separation logic proof to prune
branches
16
BMC on Abstract Counterexample• Perform BMC on abstract
counterexample, unrolling loops• Prune any states that are not on
a path to error• Use state constraints to restrict
search(would work for symbolic execution as well)
Abstract State S (constraints)
Abstract State S’ (constraints)
ProgramStatements
ProgramStatements
17
Abstract Counterexample𝑒𝑚𝑝
∃𝑘 . 𝑙𝑠𝑘(𝑙 ,0)∃𝑘 . 𝑙𝑠𝑘(𝑙 ,0)
𝐸𝑅𝑅𝑂𝑅
t := alloc(2)*(t+next) := ll := t
l := *(l+next)
l := 0
18
Abstract Counterexample𝑒𝑚𝑝
∃𝑘 . 𝑙𝑠𝑘(𝑙 ,0)∃𝑘 . 𝑙𝑠𝑘(𝑙 ,0)
𝐸𝑅𝑅𝑂𝑅
t := alloc(2)*(t+next) := ll := t
l := *(l+next)
l := 0
19
Practicalities• Use Z3 to perform BMC• Z3 doesn’t understand separation logic– Weaken formulas to first order
• A different way of encoding BMC– Make Z3 do all of the work– No iteration: give Z3 a single problem
20
Prune and Weakenemp
true
ERROR
t := alloc(2)*(t+next) := ll := t
l := *(l+next)
l := 0First-order
sub-formula
21
BMC Safety Violations• Satisfiable– Array/Structure out of bounds– Access unallocated memory/NULL– Double free– Free of incorrect memory
• Unsatisfiable– No violation within bounds
• Heap size• Unrolling limit
22
Precise Word-Level Memory Model
0
Heap
Alloc
Size 0 0 0 0 0 0 0 0 0
0 1 2 3 4 5 6 7 8 9
23
Precise Word-Level Memory Model
0
Heap
Alloc
Size 0
x
3
x
0
x
0 0 0 0 0 0
alloc(3)0 1 2 3 4 5 6 7 8 9
24
Precise Word-Level Memory Model
0
Heap
Alloc
Size 0
x
3
x
0
17
x
0 0 0 0 0 0
*4 = 170 1 2 3 4 5 6 7 8 9
25
Precise Word-Level Memory Model
0
Heap
Alloc
Size 0 0 0
17
0 0 0 0 0 0
free(2)0 1 2 3 4 5 6 7 8 9
26
Encoding – High Level
𝑖𝑛𝑖𝑡∧ ∀ 𝑡 .𝑡>0∧𝑡<𝑛→𝑡𝑟 (𝑡 ) Assert initial state Transition from state at time to state at time
Use UFBV logic: Quantified bit-vectorswith uninterpreted functions
27
Initial state
- Optional- Optional
28
Transition
29
Encode• Step whole basic block– Eliminates quantifiers based on structure of
program• Use state in encoder– Maximize structure sharing– Reduce quantifiers and uninterpreted functions
30
Encode – Threading State
InitializeState
EncodeStmt
To Error
EncodeStmt
To Error
EncodeStmt
To Error
Store StateTo Successor
…
31
Encode - alloc
32
Encode - store
33
Process Summary
C ProgramSeparation
Logic Analysis
BMC Encoder Z3
SAFEUNSAFE +
COUNTEREXAMPLE
UNSAFE?SMT-LIB
AbstractTransitionSystem
UNSAT
SAT
SLAYER
34
Performance• Equivalent to SLAYER on sample problems• Problems like example < 0.5s• Scalability unknown• Not competitive with Sage or KLEE– Z3 could match or beat Sage or KLEE, though.
35
Z3 Pain Relief• is way slower than (2x)• Eliminate : use last modified index to eliminate these (2x)• Use the new SAT solver (10x)• Use MBQI (sat/unsat vs unknown)• Don’t use Array Theory (sat/unsat vs unknown)• Init doesn’t matter much (±10%)• Eliminate : create explicit conjunction. (30x on small
problems)
36
QUESTIONS?
©2011 Microsoft Corporation. All rights reserved.
38
Array theory?• Array theory is not current– We use quantifiers with uninterpreted functions:
– We don’t want too many quantifiers• Since we’re quantifying over time, keep track of when
updates last occurred.
39
Encoding a basic block (statements updating )
Recommended