Understanding and Genera-ng High Quality Patches for Concurrency Bugs. Haopeng Liu, Yuxi Chen and Shan Lu

Transcription

1 1 Understanding and Genera-ng High Quality Patches for Concurrency Bugs Haopeng Liu, Yuxi Chen and Shan Lu

2 2 What are concurrency bugs Synchroniza-on mistakes in mul--threaded programs

3 3 What are concurrency bugs Synchroniza-on mistakes in mul--threaded programs //child thread if( ){ unlock(f->mut); return; } //parent thread f->mut = NULL;

4 4 What are concurrency bugs Synchroniza-on mistakes in mul--threaded programs //child thread if( ){ unlock(f->mut); return; } //parent thread f->mut = NULL;

5 5 What are concurrency bugs Synchroniza-on mistakes in mul--threaded programs //child thread if( ){ unlock(f->mut); return; } //parent thread f->mut = NULL;

6 6 Concurrency bugs need to be fixed Prevalence Widely exist in mul--threaded programs Seriousness Cause real world disasters Difficulty Time-consuming to fix [LuASPLOS 08] Patches are the most error-prone [YinFSE 11] 2X -mes more oxen to be buggy than memory/seman-c bugs

7 7 Concurrency bug automated fixing Observa-on: Program is correct in most -ming interleavings. Solu-on: Only need to remove some bad -ming. add lock-related synchroniza-on FSE 14]. [AFix PLDI 11] [CFix OSDI 12] [Grail

8 8 An automated fixing example //child thread if( ){ unlock(f->mut); + lock(l); + signal(con); + unlock(l); return; } + lock(l); + signal(con); + unlock(l); //parent thread + lock(l) + while( ){ + wait(con, L); + } + unlock (L) f->mut = NULL; Overall: 9 new synchroniza-ons 1 new while loop Reality is even worse!

9 9 The manual patch //child thread if( ){ unlock(f->mut); return; } //parent thread + thread_join( ); f->mut = NULL; Overall: New sycn.: 1 VS. 9 New while loop: 0 VS. 1 Simpler patch à Easier to read and maintain Can we automa7cally generate such simple patches?

10 10 Manual patch study 77 real-world concurrency bugs The limita-on of exis-ng techniques Guidance to design new tools HFix Contribu-ons Bug Reports AFix[1] Bug Reports CFix[2] Bug Reports Grail[3] Bug Reports [1] Guoliang Jin etc. AFix. In PLDI 11 [2] Guoliang Jin etc. CFix. In OSDI 12 [3] Peng Liu etc. Grail. In FSE 14 Bug Reports HFix

11 11 Outline Mo-va-on Manual patch study HFix Evalua-on Conclusion

12 12 Research Ques-ons Q1: Do manual patches mostly use lockrelated synchroniza-ons? Q2: Do manual patches mostly disable buggy -ming by adding synchroniza-on ops?

13 13 Manual patch study methodology [1] App. Source Descrip7on #. Bugs Apache Web Server 13 Mozilla Browser Suite 41 Lu ASPLOS 08 MySQL Database Server 12 OpenOffice Office Suite 5 Misc Recent papers[2-4] 6 Total 77 Study developer patches & on-line discussion [1] Threads to validity are listed in paper. [2] Guoliang Jin etc. AFix. In PLDI 11 [3] Guoliang Jin etc. CFix. In OSDI 12 [4] Wei Zhang etc. ConSeq. In ASPLOS 11

14 14 Q1: How many patches use lock? Use Sync. primi7ves? Yes None

15 15 Q1: How many patches use lock? Use Sync. primi7ves? Synchroniza7on primi7ves Yes None Lock/Con. Var Create/Join Misc. AV patches OV patches

16 16 Q1: How many patches use lock? Use Sync. primi7ves? Synchroniza7on primi7ves Yes None Lock/Con. Var Create/Join Misc. AV patches OV patches

17 17 Q1: How many patches use lock? Use Sync. primi7ves? Synchroniza7on primi7ves Yes None Lock/Con. Var Create/Join Misc. AV patches OV patches

18 18 Q1: How many patches use lock? Use Sync. primi7ves? Synchroniza7on primi7ves Yes None Lock/Con. Var Create/Join Misc. AV patches OV patches Thread pc P C Thread r R

19 19 Q1: How many patches use lock? Use Sync. primi7ves? Synchroniza7on primi7ves Yes None Lock/Con. Var Create/Join Misc. AV patches OV patches Thread pc P C Thread r R

20 20 Q1: How many patches use lock? Use Sync. primi7ves? Synchroniza7on primi7ves Yes None Lock/Con. Var Create/Join Misc. AV patches OV patches Thread pc P C Thread r R Thread A A Thread B B

21 21 Q1: How many patches use lock? Use Sync. primi7ves? Synchroniza7on primi7ves Yes None Lock/Con. Var Create/Join Misc. AV patches OV patches Thread pc P C Thread r R Thread A A Thread B B

22 22 Q1 implica-on Use non-lock synchroniza-on to fix OV. Synchroniza7on primi7ves Lock/Con. Var Create/Join Misc. AV patches OV patches

23 23 Q1 implica-on Use non-lock synchroniza-on to fix OV. Synchroniza7on primi7ves Lock/Con. Var Create/Join Misc.! AV patches OV patches

24 24 Q2: What are developers fix strategy? Disable Tolerate

25 25 Q2: What are developers fix strategy? Disable (Adds)[1-3] Tolerate [1] Guoliang Jin etc. AFix. In PLDI 11 [2] Guoliang Jin etc. CFix. In OSDI 12 [3] Peng Liu etc. Grail.In FSE 14

26 26 Q2: What are developers fix strategy? Disable (Adds) Disable (Data priv.)[1] Tolerate [1] Jeff Huang etc.execu-on Priva-za-on of Scheduler-Oblivious Concurrent Programs. In OOPSLA 11

27 27 Q2: What are developers fix strategy? Disable (Adds) Disable (Data priv.) Disable (Moves) Tolerate

28 28 Q2: What are developers fix strategy? Disable (Adds) Disable (Data priv.) Disable (Moves) Disable (Bypass) Tolerate

29 29 Q2 implica-on Add-Sync widely applies, but oxen not best Need to automate: Move synchroniza-on Bypass Tolerate! Disable (Adds) Disable (Data priv.) Disable (Moves) Disable (Bypass) Tolerate Different bugs are suitable different strategies

30 30 Outline Mo-va-on Manual patch studying HFix HFixJoin HFixmove Evalua-on Conclusion

31 31 HFix overview HFix HFixJoin Sta-c analysis Code transform Thd pc Thd r P R C Thd A A Thd B B Sta-c analysis HFixMove Code transform Goal: Fix bugs with simple patches Do not introduce new bugs

32 32 HFixjoin Intui-on Which kind of bugs can be fixed by HFixjoin? ThreadA ThreadB A S create B

33 33 HFixjoin Intui-on Which kind of bugs can be fixed by HFixjoin? ThreadA ThreadB A S create B

34 34 HFixjoin Step1: Suitability checking Goal: do not introduce new bugs. Step2: Insert join synchroniza-on Goal: fix the bug

35 35 Suitability checking (sta-c analysis) Is ThreadA a joinable child thread of ThreadB? Only one ThreadB? Is ThreadA already joined? Will there be deadlock/severe performance slow-down? ThreadA ThreadB A S create B

36 36 Suitability checking (sta-c analysis) Is ThreadA a joinable child thread of ThreadB? Only one ThreadB? Is ThreadA already joined? Will there be deadlock/severe performance slow-down? //parent thread + thread_join( ); fp = NULL; signal(condv); //child thread fputs(fp, ); wait(condv);

37 37 Insert join synchroniza-on Insert join before opera-on B Patch Example //child thread if( ){ unlock(f->mut); return; } //parent thread pthread_create(&tid, )... f->mut = NULL;

38 38 Insert join synchroniza-on Insert join before opera-on B Patch Example //child thread if( ){ unlock(f->mut); return; } //parent thread pthread_create(&tid, ) tmp = tid;... pthread_join(tmp); f->mut = NULL;

39 39 HFixmove Intui-on What kind of bugs can be fixed by HFixmove? ThreadA ThreadB S create A B (a) Move create fixes OV bug move-up A or move-down S

40 40 HFixmove Intui-on What kind of bugs can be fixed by HFixmove? ThreadA ThreadB A* ThreadA ThreadB S create B A S join B (a) Move create fixes OV bug move-up A or move-down S (b) Move join fixes OV bug move-up S or move-down B

41 41 HFixmove Intui-on What kind of bugs can be fixed by HFixmove? ThreadA ThreadB ThreadA ThreadB Threadpc Threadr Threadpc Threadr A* S create B A S join B* p c S unlock r S lock p c r (a) Move create fixes OV bug move-up A or move-down S (b) Move join fixes OV bug move-up S or move-down B (c) Move unlock fixes AV bug move-up c or move-down S (d) Move lock fixes AV bug move-up S or move-down p

42 42 Step1: iden-fy two opera-ons to move ThreadA ThreadB ThreadA ThreadB Threadpc Threadr Threadpc Threadr A* S create B A S join B* p C* r S lock P* c r S unlock (a) Move create fixes OV bug move-up A or move-down S (b) Move join fixes OV bug move-up S or move-down B (c) Move unlock fixes AV bug move-up c or move-down S (d) Move lock fixes AV bug move-up S or move-down p

43 43 Step1: iden-fy two opera-ons to move ThreadA ThreadB ThreadA ThreadB Threadpc Threadr Threadpc Threadr A* S create B A S join B* p C* r S lock P* c r S unlock (a) Move create fixes OV bug move-up A or move-down S (b) Move join fixes OV bug move-up S or move-down B (c) Move unlock fixes AV bug move-up c or move-down S (d) Move lock fixes AV bug move-up S or move-down p X Y Y X

44 44 Step 2: decide the moving des-na-on X* Goal # of execu-ons of X == # of execu-ons of X*

45 45 Strawman solu-on doesn t work # of execu-ons of X # of execu-ons of X* 1 0 Y Naïve sol X* Y X Originally, X executes once. AXer moving, X* does not execute.

46 46 Strawman solu-on doesn t work # of execu-ons of X # of execu-ons of X* 1 N Naïve sol X Y X* Y Originally, X executes once. AXer moving, X* executes more than once.

47 * X and Y are inside the same func-on; neither is in loop 47 HFixmove demonstra-on Guarantee: X* will execute exactly once before Y. X Y

48 * X and Y are inside the same func-on; neither is in loop 48 HFixmove demonstra-on Guarantee: X* will execute exactly once before Y. Y X

49 * X and Y are inside the same func-on; neither is in loop 49 HFixmove demonstra-on Guarantee: X* will execute exactly once before Y. Y X

50 * X and Y are inside the same func-on; neither is in loop 50 HFixmove demonstra-on Guarantee: X* will execute exactly once before Y. X* Y Our solu-on X* X* X X* Y

51 * X and Y are inside the same func-on; neither is in loop 51 HFixmove demonstra-on Guarantee: X* will execute exactly once before Y. X* Y Our solu-on X* X* X X* Y X Y

52 * X and Y are inside the same func-on; neither is in loop 52 HFixmove demonstra-on Guarantee: X* will execute exactly once before Y. X* Y Our solu-on X* X* X X* Y X* X Y Our solu-on X* Y

53 53 Step 3: suitability checking Does move change local def-use rela-onship? + gx = m; s_create( ); m = 0; gx = m;

54 54 Step 3: suitability checking Does move change local def-use rela-onship? + gx = m; s_create( ); m = 0; gx = m;

55 55 Step 3: suitability checking Does move change local def-use rela-onship? + gx = m; s_create( ); m = 0; gx = m;

56 56 Step 3: suitability checking Does move change local def-use rela-onship? + gx = m; s_create( ); m = 0; Might move introduce deadlocks?

57 57 HFixmove patch example //child thread assert(h->band); //parent thread + h->band = bdnew(h); pthread_create( )... - h->band = bdnew(h);

58 58 Outline Mo-va-on Manual patch studying HFix Evalua-on Methodology Results Conclusion

59 59 Methodology Benchmark Suite 13 bugs set up by Cfix [OSDI 12] All the AV bugs in ASPLOS 08 suite that are fixed through moving synchroniza-on by developers.

60 60 Results for OV bugs App. HFix VS. Manual FFT HTTrack Mozilla PBZIP2 Transmission X264 ZSNES - - join join create join create

61 61 Results for OV bugs App. Strategy HFix #.Sync Strategy CFix #.Sync FFT join 1 signal/wait 5 HTTrack - - signal/wait 3 Mozilla - - signal/wait 2 PBZIP2 Transmission X264 join create join signal/wait signal/wait signal/wait ZSNES create 0 signal/wait 3

62 62 Results for AV bugs App. Apache Mozilla1 Mozilla2 MySQL1 MySQL2 MySQL3 HFix lock lock unlock unlock unlock

63 63 Outline Mo-va-on Manual patch studying HFix Evalua-on Conclusion

64 64 Conclusion Manual patch study: Add join for OV (HFix) Move exis-ng sync. (HFix) Bypass & tolerate (Future work) HFix A useful complement. Generate much simple patches.! Disable (Adds) Disable (Data priv.) Disable (Moves) Disable (Bypass) Tolerate

65 65 Thank you! Q&A