A Gentle Introduction to Program Analysis

Transcription

1 A Gentle Introduction to Program Analysis Işıl Dillig University of Texas, Austin January 21, 2014 Programming Languages Mentoring Workshop 1 / 24

2 What is Program Analysis? Very broad topic, but generally speaking, automated analysis of program behavior 2 / 24

3 What is Program Analysis? Very broad topic, but generally speaking, automated analysis of program behavior Program analysis is about developing algorithms and tools that can analyze other programs 2 / 24

4 What is Program Analysis? Very broad topic, but generally speaking, automated analysis of program behavior Program analysis is about developing algorithms and tools that can analyze other programs prog.c Query Program Analysis Tool 2 / 24

5 Applications of Program Analysis Bug finding. e.g., expose as many assertion failures as possible 3 / 24

6 Applications of Program Analysis Bug finding. e.g., expose as many assertion failures as possible Security. e.g., does an app leak private user data? 3 / 24

7 Applications of Program Analysis Bug finding. e.g., expose as many assertion failures as possible Security. e.g., does an app leak private user data? Verification. e.g., does the program always behave according to its specification? 3 / 24

8 Applications of Program Analysis Bug finding. e.g., expose as many assertion failures as possible Security. e.g., does an app leak private user data? Verification. e.g., does the program always behave according to its specification? Compiler optimizations. e.g., which variables should be kept in registers for fastest memory access? 3 / 24

9 Applications of Program Analysis Bug finding. e.g., expose as many assertion failures as possible Security. e.g., does an app leak private user data? Verification. e.g., does the program always behave according to its specification? Compiler optimizations. e.g., which variables should be kept in registers for fastest memory access? Automatic parallelization. e.g., is it safe to execute different loop iterations on parallel? 3 / 24

10 Dynamic vs. Static Program Analysis Two flavors of program analysis: 4 / 24

11 Dynamic vs. Static Program Analysis Two flavors of program analysis: Dynamic analysis: Analyzes program while it is running 4 / 24

12 Dynamic vs. Static Program Analysis Two flavors of program analysis: Dynamic analysis: Analyzes program while it is running Static analysis: Analyzes source code of the program 4 / 24

13 Dynamic vs. Static Program Analysis Two flavors of program analysis: Dynamic analysis: Analyzes program while it is running Static analysis: Analyzes source code of the program Static + reasons about all executions - less precise Dynamic + more precise - results limited to observed executions 4 / 24

14 Static Analysis Typical static analysis question: Given source code of program P and desired property Q, does P exhibit Q in all possible executions? 5 / 24

15 Static Analysis Typical static analysis question: Given source code of program P and desired property Q, does P exhibit Q in all possible executions? But this question is undecidable! 5 / 24

16 Static Analysis Typical static analysis question: Given source code of program P and desired property Q, does P exhibit Q in all possible executions? But this question is undecidable! This means static analyses are either: 5 / 24

17 Static Analysis Typical static analysis question: Given source code of program P and desired property Q, does P exhibit Q in all possible executions? But this question is undecidable! This means static analyses are either: Unsound: May say program is safe even though it is unsafe 5 / 24

18 Static Analysis Typical static analysis question: Given source code of program P and desired property Q, does P exhibit Q in all possible executions? But this question is undecidable! This means static analyses are either: Unsound: May say program is safe even though it is unsafe Sound, but incomplete: May say program is unsafe even though it is safe 5 / 24

19 Static Analysis Typical static analysis question: Given source code of program P and desired property Q, does P exhibit Q in all possible executions? But this question is undecidable! This means static analyses are either: Unsound: May say program is safe even though it is unsafe Sound, but incomplete: May say program is unsafe even though it is safe Non-terminating: Always gives correct answer when it terminates, but may run forever 5 / 24

20 Static Analysis Typical static analysis question: Given source code of program P and desired property Q, does P exhibit Q in all possible executions? But this question is undecidable! This means static analyses are either: Unsound: May say program is safe even though it is unsafe Sound, but incomplete: May say program is unsafe even though it is safe Non-terminating: Always gives correct answer when it terminates, but may run forever Many static analysis techniques are sound but incomplete. 5 / 24

21 How to design sound static analyses? Key idea: Overapproximate (i.e., abstract) program behavior 6 / 24

22 How to design sound static analyses? Key idea: Overapproximate (i.e., abstract) program behavior 6 / 24

23 How to design sound static analyses? Key idea: Overapproximate (i.e., abstract) program behavior 6 / 24

24 How to design sound static analyses? Key idea: Overapproximate (i.e., abstract) program behavior Bad states outside over-approximation Program safe 7 / 24

25 How to design sound static analyses? Key idea: Overapproximate (i.e., abstract) program behavior Bad states outside over-approximation Program safe Bad states inside over-approximation, but outside P false alarm 7 / 24

26 How to design sound static analyses? Key idea: Overapproximate (i.e., abstract) program behavior Bad states outside over-approximation Program safe Bad states inside over-approximation, but outside P false alarm Goal: Construct abstractions that are precise enough (i.e., few false alarms) and that scale to real programs 7 / 24

27 Examples of Abstractions 8 / 24

28 Examples of Abstractions There is no one size fits all abstraction What information is useful depends on what you want to prove about the program! 8 / 24

29 Examples of Abstractions There is no one size fits all abstraction What information is useful depends on what you want to prove about the program! Application No division-by-zero errors Useful abstraction zero vs. non-zero 8 / 24

30 Examples of Abstractions There is no one size fits all abstraction What information is useful depends on what you want to prove about the program! Application Useful abstraction No division-by-zero errors zero vs. non-zero Data structure verification list, tree, graph,... 8 / 24

31 Examples of Abstractions There is no one size fits all abstraction What information is useful depends on what you want to prove about the program! Application Useful abstraction No division-by-zero errors zero vs. non-zero Data structure verification list, tree, graph,... No out-of-bounds array accesses ranges of integer variables 8 / 24

32 How to Create Sound Abstractions? 9 / 24

33 How to Create Sound Abstractions? Useful theory for understanding how to design sound static analyses is abstract interpretation 9 / 24

34 How to Create Sound Abstractions? Useful theory for understanding how to design sound static analyses is abstract interpretation Seminal 77 paper by Patrick & Radhia Cousot 9 / 24

35 How to Create Sound Abstractions? Useful theory for understanding how to design sound static analyses is abstract interpretation Seminal 77 paper by Patrick & Radhia Cousot Not a specific analysis, but rather a framework for designing sound-by-construction static analyses 9 / 24

36 How to Create Sound Abstractions? Useful theory for understanding how to design sound static analyses is abstract interpretation Seminal 77 paper by Patrick & Radhia Cousot Not a specific analysis, but rather a framework for designing sound-by-construction static analyses Let s look at an example: A static analysis that tracks the sign of each integer variable (e.g., positive, non-negative, zero etc.) 9 / 24

37 First Step: Design An Abstract Domain An abstract domain is just a set of abstract values we want to track in our analysis 10 / 24

38 First Step: Design An Abstract Domain An abstract domain is just a set of abstract values we want to track in our analysis For our example, let s fix the following abstract domain: pos: {x x Z x > 0} zero: {0} neg: {x x Z x < 0} non-neg: {x x Z x 0} 10 / 24

39 First Step: Design An Abstract Domain An abstract domain is just a set of abstract values we want to track in our analysis For our example, let s fix the following abstract domain: pos: {x x Z x > 0} zero: {0} neg: {x x Z x < 0} non-neg: {x x Z x 0} In addition, every abstract domain contains: 10 / 24

40 First Step: Design An Abstract Domain An abstract domain is just a set of abstract values we want to track in our analysis For our example, let s fix the following abstract domain: pos: {x x Z x > 0} zero: {0} neg: {x x Z x < 0} non-neg: {x x Z x 0} In addition, every abstract domain contains: (top): Don t know, represents any value 10 / 24

41 First Step: Design An Abstract Domain An abstract domain is just a set of abstract values we want to track in our analysis For our example, let s fix the following abstract domain: pos: {x x Z x > 0} zero: {0} neg: {x x Z x < 0} non-neg: {x x Z x 0} In addition, every abstract domain contains: (top): Don t know, represents any value (bottom): Represents empty-set 10 / 24

42 Second step: Abstraction and concretization functions Abstraction function (α) maps sets of concrete elements to the most precise value in the abstract domain 11 / 24

43 Second step: Abstraction and concretization functions Abstraction function (α) maps sets of concrete elements to the most precise value in the abstract domain α({2, 10, 0}) = 11 / 24

44 Second step: Abstraction and concretization functions Abstraction function (α) maps sets of concrete elements to the most precise value in the abstract domain α({2, 10, 0}) = non-neg 11 / 24

45 Second step: Abstraction and concretization functions Abstraction function (α) maps sets of concrete elements to the most precise value in the abstract domain α({2, 10, 0}) = non-neg α({3, 99}) = 11 / 24

46 Second step: Abstraction and concretization functions Abstraction function (α) maps sets of concrete elements to the most precise value in the abstract domain α({2, 10, 0}) = non-neg α({3, 99}) = pos 11 / 24

47 Second step: Abstraction and concretization functions Abstraction function (α) maps sets of concrete elements to the most precise value in the abstract domain α({2, 10, 0}) = non-neg α({3, 99}) = pos α({ 3, 2}) = 11 / 24

48 Second step: Abstraction and concretization functions Abstraction function (α) maps sets of concrete elements to the most precise value in the abstract domain α({2, 10, 0}) = non-neg α({3, 99}) = pos α({ 3, 2}) = 11 / 24

49 Second step: Abstraction and concretization functions Abstraction function (α) maps sets of concrete elements to the most precise value in the abstract domain α({2, 10, 0}) = non-neg α({3, 99}) = pos α({ 3, 2}) = Concretization function (γ) maps each abstract value to sets of concrete elements 11 / 24

50 Second step: Abstraction and concretization functions Abstraction function (α) maps sets of concrete elements to the most precise value in the abstract domain α({2, 10, 0}) = non-neg α({3, 99}) = pos α({ 3, 2}) = Concretization function (γ) maps each abstract value to sets of concrete elements γ(pos) = {x x Z x > 0} 11 / 24

51 Lattices and Abstract Domains Concretization function defines partial order on abstract values: 12 / 24

52 Lattices and Abstract Domains Concretization function defines partial order on abstract values: A 1 A 2 iff γ(a 1 ) γ(a 2 ) 12 / 24

53 Lattices and Abstract Domains Concretization function defines partial order on abstract values: A 1 A 2 iff γ(a 1 ) γ(a 2 ) Furthermore, in an abstract domain, every pair of elements has a lub and glb mathematical lattice non-neg neg pos zero 12 / 24

54 Lattices and Abstract Domains Concretization function defines partial order on abstract values: A 1 A 2 iff γ(a 1 ) γ(a 2 ) Furthermore, in an abstract domain, every pair of elements has a lub and glb mathematical lattice non-neg neg pos zero Least upper bound of two elements is called their join useful for reasoning about control flow in programs 12 / 24

55 Almost-Inverses Important property of the abstraction and concretization function is that they are almost inverses: 13 / 24

56 Almost-Inverses Important property of the abstraction and concretization function is that they are almost inverses: A C 13 / 24

57 Almost-Inverses Important property of the abstraction and concretization function is that they are almost inverses: A C C' C A 13 / 24

58 Almost-Inverses Important property of the abstraction and concretization function is that they are almost inverses: A C C' C A This is called a Galois insertion and captures the soundness of the abstraction 13 / 24

59 Step 3: Abstract Semantics Given abstract domain, α, γ, need to define abstract transformers (i.e., semantics) for each statement 14 / 24

60 Step 3: Abstract Semantics Given abstract domain, α, γ, need to define abstract transformers (i.e., semantics) for each statement Describes how statements affect our abstraction 14 / 24

61 Step 3: Abstract Semantics Given abstract domain, α, γ, need to define abstract transformers (i.e., semantics) for each statement Describes how statements affect our abstraction Abstract counter-part of operational semantics rules 14 / 24

62 Step 3: Abstract Semantics Given abstract domain, α, γ, need to define abstract transformers (i.e., semantics) for each statement Describes how statements affect our abstraction Abstract counter-part of operational semantics rules Operational Semantics S: Var Concrete value x = y op z S': Var Concrete value 14 / 24

63 Step 3: Abstract Semantics Given abstract domain, α, γ, need to define abstract transformers (i.e., semantics) for each statement Describes how statements affect our abstraction Abstract counter-part of operational semantics rules Operational Semantics Abstract Semantics S: Var Concrete value A: Var Abstract value x = y op z x = y op z S': Var Concrete value A': Var Abstract value 14 / 24

64 Back to Our Example For our sign analysis, we can define abstract transformer for x = y + z as follows: pos neg zero non-neg pos pos pos pos neg neg neg zero pos neg zero non-neg non-neg pos non-neg non-neg 15 / 24

65 Back to Our Example For our sign analysis, we can define abstract transformer for x = y + z as follows: pos neg zero non-neg pos pos pos pos neg neg neg zero pos neg zero non-neg non-neg pos non-neg non-neg To ensure soundness of static analysis, must prove that abstract semantics faithfully models concrete semantics 15 / 24

66 Putting It All Together P Abstract domain Abstract semantics Fixed-point engine 16 / 24

67 Putting It All Together P Abstract domain Abstract semantics Fixed-point engine 16 / 24

68 Fixed-point Computations Fixed-point computation: Repeated symbolic execution of the program using abstract semantics until our approximation of the program reaches an equilibrium 17 / 24

69 Fixed-point Computations Fixed-point computation: Repeated symbolic execution of the program using abstract semantics until our approximation of the program reaches an equilibrium Least fixed-point: Start with underapproximation and grow the approximation until it stops growing 17 / 24

70 Fixed-point Computations Fixed-point computation: Repeated symbolic execution of the program using abstract semantics until our approximation of the program reaches an equilibrium Least fixed-point: Start with underapproximation and grow the approximation until it stops growing Assuming correctness of your abstract semantics, the least fixed point is an overapproximation of the program! 17 / 24

71 Performing Least Fixed Point Computation Represent program as a control-flow graph x =0 y =1 loop head y <= n exit block branch z =0 z!=0 x = x+1 x = x+y loop end y = y+1 18 / 24

72 Performing Least Fixed Point Computation Represent program as a control-flow graph Want to compute abstract values at every program point x =0 y =1 loop head y <= n exit block branch z =0 z!=0 x = x+1 x = x+y loop end y = y+1 18 / 24

73 Performing Least Fixed Point Computation Represent program as a control-flow graph Want to compute abstract values at every program point Initialize all abstract states to exit block x =0 y =1 loop head y <= n branch z =0 z!=0 x = x+1 x = x+y loop end y = y+1 18 / 24

74 Performing Least Fixed Point Computation Represent program as a control-flow graph Want to compute abstract values at every program point x =0 y =1 loop head Initialize all abstract states to Repeat until no abstract state changes at any program point: exit block y <= n branch z =0 z!=0 x = x+1 x = x+y loop end y = y+1 18 / 24

75 Performing Least Fixed Point Computation Represent program as a control-flow graph Want to compute abstract values at every program point x =0 y =1 loop head Initialize all abstract states to Repeat until no abstract state changes at any program point: exit block y <= n branch z =0 z!=0 Compute abstract state on entry to a basic block B by taking the join of B s predecessors x = x+1 x = x+y loop end y = y+1 18 / 24

76 Performing Least Fixed Point Computation Represent program as a control-flow graph Want to compute abstract values at every program point x =0 y =1 loop head Initialize all abstract states to Repeat until no abstract state changes at any program point: exit block y <= n branch z =0 z!=0 Compute abstract state on entry to a basic block B by taking the join of B s predecessors Symbolically execute each basic block using abstract semantics x = x+1 x = x+y loop end y = y+1 18 / 24

77 An Example x =0 y =1 x = 0; y =0; while(y <= n) { if (z == 0) { x = x+1; } else { x = x + y; } y = y+1 } loop head y <= n exit block branch z =0 z!=0 x = x+1 x = x+y loop end y = y+1 19 / 24

78 An Example x =0 y =1 x = 0; y =0; while(y <= n) { if (z == 0) { x = x+1; } else { x = x + y; } y = y+1 } Is x always non-negative inside the loop? loop head y <= n exit block branch z =0 z!=0 x = x+1 x = x+y loop end y = y+1 19 / 24

79 Fixed-Point Computation x =0 y =1 loop head y <= n exit block branch z =0 z!=0 x = x+1 x = x+y loop end y = y+1 20 / 24

80 Fixed-Point Computation x =0 y =1 loop head y <= n exit block branch z =0 z!=0 x = x+1 x = x+y loop end y = y+1 20 / 24

81 Fixed-Point Computation x = Z, y = x =0 y =1 loop head y <= n exit block branch z =0 z!=0 x = x+1 x = x+y loop end y = y+1 20 / 24

82 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 loop head y <= n exit block branch z =0 z!=0 x = x+1 x = x+y loop end y = y+1 20 / 24

83 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 x = Z, y = P loop head y <= n exit block branch z =0 z!=0 x = x+1 x = x+y loop end y = y+1 20 / 24

84 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 x = Z, y = P loop head y <= n x = Z, y = P exit block branch x = Z, y = P z =0 z!=0 x = Z, y = P x = x+1 x = x+y x = Z, y = P loop end y = y+1 20 / 24

85 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 x = Z, y = P loop head y <= n x = Z, y = P exit block branch x = Z, y = P z =0 z!=0 x = Z, y = P x = P, y = P x = x+1 x = x+y x = Z, y = P loop end y = y+1 20 / 24

86 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 x = Z, y = P loop head y <= n x = Z, y = P exit block branch x = Z, y = P z =0 z!=0 x = Z, y = P x = P, y = P x = x+1 x = x+y x = Z, y = P x = P, y = P loop end y = y+1 20 / 24

87 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 x = Z, y = P loop head y <= n x = Z, y = P exit block branch x = Z, y = P z =0 z!=0 x = Z, y = P x = P, y = P x = x+1 x = x+y x = Z, y = P x = P, y = P x = P, y = P loop end y = y+1 20 / 24

88 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 x = Z, y = P loop head y <= n x = P, y = P x = Z, y = P exit block branch x = Z, y = P z =0 z!=0 x = Z, y = P x = P, y = P x = x+1 x = x+y x = Z, y = P x = P, y = P x = P, y = P x = P, y = P loop end y = y+1 20 / 24

89 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 x = NN, y = P loop head y <= n x = P, y = P x = Z, y = P exit block branch x = Z, y = P z =0 z!=0 x = Z, y = P x = P, y = P x = x+1 x = x+y x = Z, y = P x = P, y = P x = P, y = P x = P, y = P loop end y = y+1 20 / 24

90 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 x = NN, y = P loop head y <= n x = P, y = P x = NN, y = P exit block branch x = NN, y = P z =0 z!=0 x = NN, y = P x = P, y = P x = x+1 x = x+y x = NN, y = P x = P, y = P x = P, y = P x = P, y = P loop end y = y+1 20 / 24

91 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 x = NN, y = P loop head y <= n x = P, y = P x = NN, y = P exit block branch x = NN, y = P z =0 z!=0 x = NN, y = P x = P, y = P x = x+1 x = x+y x = NN, y = P x = P, y = P x = P, y = P x = P, y = P loop end y = y+1 20 / 24

92 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 x = NN, y = P loop head y <= n x = P, y = P x = NN, y = P exit block branch x = NN, y = P z =0 z!=0 x = NN, y = P x = P, y = P x = x+1 x = x+y x = NN, y = P x = P, y = P x = P, y = P x = P, y = P loop end y = y+1 20 / 24

93 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 x = NN, y = P loop head y <= n x = P, y = P x = NN, y = P exit block branch x = NN, y = P z =0 z!=0 x = NN, y = P x = P, y = P x = x+1 x = x+y x = NN, y = P x = P, y = P x = P, y = P x = P, y = P loop end y = y+1 20 / 24

94 Fixed-Point Computation x = Z, y = x = Z, y = P x =0 y =1 Fixed point! x = NN, y = P loop head y <= n x = P, y = P x = NN, y = P exit block branch x = NN, y = P z =0 z!=0 x = NN, y = P x = P, y = P x = x+1 x = x+y x = NN, y = P x = P, y = P x = P, y = P x = P, y = P loop end y = y+1 20 / 24

95 Termination of Fixed Point Computation In this example, we quickly reached least fixed point but does this computation always terminate? 21 / 24

96 Termination of Fixed Point Computation In this example, we quickly reached least fixed point but does this computation always terminate? Yes, assuming abstract domain forms complete lattice 21 / 24

97 Termination of Fixed Point Computation In this example, we quickly reached least fixed point but does this computation always terminate? Yes, assuming abstract domain forms complete lattice This means every subset of elements (including infinite subsets) have a LUB 21 / 24

98 Termination of Fixed Point Computation In this example, we quickly reached least fixed point but does this computation always terminate? Yes, assuming abstract domain forms complete lattice This means every subset of elements (including infinite subsets) have a LUB Unfortunately, many interesting domains do not have this property, so we need widening operators for convergence. 21 / 24

99 Lessons To Take Away Considered only one static analysis approach, but illustrates two key ideas underlying program analysis: 22 / 24

100 Lessons To Take Away Considered only one static analysis approach, but illustrates two key ideas underlying program analysis: Abstraction: Only reason about certain properties of interest 22 / 24

101 Lessons To Take Away Considered only one static analysis approach, but illustrates two key ideas underlying program analysis: Abstraction: Only reason about certain properties of interest Fixed-point computation: Allows us to obtain sound overapproximation of the program 22 / 24

102 Lessons To Take Away Considered only one static analysis approach, but illustrates two key ideas underlying program analysis: Abstraction: Only reason about certain properties of interest Fixed-point computation: Allows us to obtain sound overapproximation of the program But many static analyses also differ in several ways: 22 / 24

103 Lessons To Take Away Considered only one static analysis approach, but illustrates two key ideas underlying program analysis: Abstraction: Only reason about certain properties of interest Fixed-point computation: Allows us to obtain sound overapproximation of the program But many static analyses also differ in several ways: Flow (in)sensitivity: Some analyses only compute facts for the whole program, not for every program point 22 / 24

104 Lessons To Take Away Considered only one static analysis approach, but illustrates two key ideas underlying program analysis: Abstraction: Only reason about certain properties of interest Fixed-point computation: Allows us to obtain sound overapproximation of the program But many static analyses also differ in several ways: Flow (in)sensitivity: Some analyses only compute facts for the whole program, not for every program point Path sensitivity: More precise analyses compute different facts for different program paths 22 / 24

105 Lessons To Take Away Considered only one static analysis approach, but illustrates two key ideas underlying program analysis: Abstraction: Only reason about certain properties of interest Fixed-point computation: Allows us to obtain sound overapproximation of the program But many static analyses also differ in several ways: Flow (in)sensitivity: Some analyses only compute facts for the whole program, not for every program point Path sensitivity: More precise analyses compute different facts for different program paths Analysis direction: Forwards vs. backwards 22 / 24

106 Challenges and Open Problems Many open problems in program analysis 23 / 24

107 Challenges and Open Problems Many open problems in program analysis Precise and scalable heap reasoning 23 / 24

108 Challenges and Open Problems Many open problems in program analysis Precise and scalable heap reasoning Concurrency 23 / 24

109 Challenges and Open Problems Many open problems in program analysis Precise and scalable heap reasoning Concurrency Dealing with open programs 23 / 24

110 Challenges and Open Problems Many open problems in program analysis Precise and scalable heap reasoning Concurrency Dealing with open programs Modular program analysis 23 / 24

111 Challenges and Open Problems Many open problems in program analysis Precise and scalable heap reasoning Concurrency Dealing with open programs Modular program analysis / 24

112 Challenges and Open Problems Many open problems in program analysis Precise and scalable heap reasoning Concurrency Dealing with open programs Modular program analysis... Exciting area with lots of interesting topics to work on! 23 / 24

113 Considering PhD or Postdoc? If you are interested in program analysis or verification, consider applying to UT Austin! 24 / 24