Abstract:Fuzzing is popular for bug detection and vulnerability discovery nowadays.To adopt fuzzing for concurrency problems like data races, several recent concurrency fuzzing approaches consider concurrency information of program execution, and explore thread interleavings by affecting thread scheduling at runtime.However, these approaches are still limited in data-race detection.On the one hand, they fail to consider the execution contexts of thread interleavings, which can miss real data races in specific runtime contexts.On the other hand, they perform random thread-interleaving exploration, which frequently repeats already covered thread interleavings and misses many infrequent thread interleavings.In this paper, we develop a novel concurrency fuzzing framework named CONZZER, to effectively explore thread interleavings and detect hard-to-find data races.The core of CONZZER is a context-sensitive and directional concurrency fuzzing approach for thread-interleaving exploration, with two new techniques.First, to ensure context sensitivity, we propose a new concurrencycoverage metric, concurrent call pair, to describe thread interleavings with runtime calling contexts.Second, to directionally explore thread interleavings, we propose an adjacency-directed mutation to generate new possible thread interleavings with already covered thread interleavings and then use a breakpointcontrol method to attempt to actually cover them at runtime.With these two techniques, this concurrency fuzzing approach can effectively cover infrequent thread interleavings with concrete context information, to help discover hard-to-find data races.We have evaluated CONZZER on 8 user-level applications and 4 kernel-level filesystems, and found 95 real data races.We identify 75 of these data races to be harmful and send them to related developers, and 44 have been confirmed.We also compare CONZZER to existing fuzzing tools, and CONZZER continuously explores more thread interleavings and finds many real data races missed by these tools.

Modeling and Discovering Data Race with Concurrent Code Property Graphs.

Racetracker:Effective And Efficient Detection Of Data Races

Data Race Detection by Understanding Synchronization Relationships of Thread Segments

Static Data Race Detection for X10 Parallel Programs

Context-Sensitive Data Race Detection for Concurrent Programs

Towards Concurrency Race Debugging

Survey on Multithreaded Data Race Detection Techniques

Racechecker: Efficient Identification Of Harmful Data Races

Scalable Data Race Detection for Lock-Intensive Programs with Pending Period Representation.

Jbench: a Dataset of Data Races for Concurrency Testing

Data Race Detection Tool for Interrupt-Driven Embedded System

A context-sensitive approach to data race detection

HardRace: A Dynamic Data Race Monitor for Production Use

Efficient Data Race Detection for Interrupt-Driven Programs Via Path Feasibility Analysis

Detecting harmful data races through parallel verification

Racez: A Lightweight And Non-Invasive Race Detection Tool For Production Applications

Context-Sensitive and Directional Concurrency Fuzzing for Data-Race Detection

Detecting Data Races in Interrupt-Driven Programs based on Static Analysis and Dynamic Simulation

A Dynamic Predictive Race Detector for C/C++ Programs

HIPPODROME: Data Race Repair using Static Analysis Summaries

Optimistic Prediction of Synchronization-Reversal Data Races