Safe Memory-Leak Fixing for C Programs

Transcription

1 Safe Memory-Leak Fixing for C Programs Qing Gao, Yingfei Xiong, Yaqing Mi, Lu Zhang, Weikun Yang, Zhaoing Zhou, Bing Xie, Hong Mei Institute of Software, Peking Unversity

2 内存管理 安全攸关软件的开发必然涉及内存管理问题 软件工程经典问题, 数千篇论文 垃圾回收 广泛用于 Java, Go 等大量新语言 通过动态扫描内存发现需要回收的内存

3 垃圾回收 vs 安全攸关软件 大量系统资源无法通过垃圾回收管理 文件句柄 线程锁等 在安全攸关软件中, 内存对象常常也无法通过垃圾回收管理 实时嵌入式系统, 运行资源有限 大数据处理系统, 垃圾收集耗时过长 处理数据量达到 10G 时, 垃圾收集运行时间占程序运行总时间一半以上

4 内存泄露的例子 内存分配 内存释放 内存使用 泄露 泄露

5 内存泄露的例子 free(q); free(); free(q); free(); free(q);

6 修复内存泄露仍是难题 需要考虑多个条件 内存释放前必须已分配 内存释放时必须有能从栈上访问的路径 在任意路径上, 内存不能被释放两次 在任意路径上, 内存使用前不能被释放 漏掉任何一条都将导致致命错误 实践中, 常常出现发现内存泄露但不敢修改的情况

7 研究成果 : 自动内存修复技术 通过对 C 程序代码的分析, 自动查找内存泄露并修复 保证修复的绝对正确性 对于任意插入的 free 语句和任意执行路径 释放前分配 : 在执行到 free 之前所指的内存已经分配 无双重释放 : 在该路径上没有任何其他 free 语句释放同一块内存 无释放后使用 : 在该 free 之后所释放内存不能再被使用 能在较短时间内完成对大型程序的分析工作 论文已经被软件工程顶级会议 ICSE 15 接收

8 背景 : 数据流分析 标准编译技术 通过遍历控制流图, 给结点附上分析结果 保证分析的安全性 分析结果一定是真实结果的子集或超集 N1 f(m1) m1 m1 m1, m2 m2 m1, m2 m1, m2 m1, m2 m1, m2 m1, m2 u(m1, m2) m1, m2 m1

9 技术路线和创新 反复使用数据流分析 过程间分析 前向数据流分析 后向数据流分析 前后向数据流分析 确定插入 free 的过程 检查释放前分配 检查释放后使用 检查双重释放 处理各种复杂情况 循环 全局变量 多重分配 空指针判断等问题 在一定程度上, 用数据流分析的效率达到了路径敏感分析的效果

10 Defining a safe fix A fix consists of two comonents A location to insert a free invocation The exression to be used in the free invocation 10

11 An Examle malloc free use

12 An Examle

13 An Examle 1 1: no allocation, no exression to use in free()

14 An Examle 2 2: double free, use after free

15 An Examle ,4,8: double free

16 An Examle 5 5: use after free

17 An Examle 6 7 6,7: safe fix locations

18 An Examle 6 7 6,7: both have ointers to the allocated memory object

19 An Examle is earlier than 7

20 An Examle Fix statement at line 6: free(); is earlier than 7

21 A safe fix The fix is after an allocation There is no double free There is no use after free There is an exression that always oints to the allocation

22 A safe fix The fix is after an allocation There is no double free There is no use after free There is an exression that always oints to the allocation

23 Memory-related elements malloc Must allocation free May free use May use Points-to Grah

24 Intra-rocedural analysis Data-flow analysis int * = (int*)malloc(sizeof(int)); *=1 free() b=0

25 Intra-rocedural analysis Data-flow analysis malloc use free

26 Intra-rocedural analysis Data-flow analysis 4 stes free malloc use

27 Intra-rocedural analysis Data-flow analysis 4 stes free malloc use Blue: safe location Red: unsafe location

28 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free Blue: safe location Red: unsafe location

29 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free The fix is after an allocation Blue: safe location Red: unsafe location

30 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free The fix is after an allocation Blue: safe location Red: unsafe location

31 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free The fix is after an allocation Blue: safe location Red: unsafe location

32 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free The fix is after an allocation Blue: safe location Red: unsafe location

33 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free The fix is after an allocation Blue: safe location Red: unsafe location

34 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free The fix is after an allocation Blue: safe location Red: unsafe location

35 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free The fix is after an allocation Blue: safe location Red: unsafe location

36 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free There is no double free (forward) Blue: safe location Red: unsafe location

37 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free There is no double free (forward) Blue: safe location Red: unsafe location

38 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free There is no double free (forward) Blue: safe location Red: unsafe location

39 Intra-rocedural analysis 1. Forward malloc use free unsafe locations: Malloc unreachable After existing free The fix is after an allocation There is no double free (forward) Blue: safe location Red: unsafe location

40 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use Blue: safe location Red: unsafe location

41 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use There is no double free (backward) Blue: safe location Red: unsafe location

42 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use There is no double free (backward) Blue: safe location Red: unsafe location

43 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use There is no double free (backward) Blue: safe location Red: unsafe location

44 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use There is no double free (backward) Blue: safe location Red: unsafe location

45 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use There is no double free (backward) Blue: safe location Red: unsafe location

46 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use There is no use after free Blue: safe location Red: unsafe location

47 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use There is no use after free Blue: safe location Red: unsafe location

48 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use There is no use after free Blue: safe location Red: unsafe location

49 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use There is no use after free Blue: safe location Red: unsafe location

50 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use There is no use after free Blue: safe location Red: unsafe location

51 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing use There is no use after free Blue: safe location Red: unsafe location

52 Intra-rocedural analysis 2. Backward malloc use free unsafe locations: Before existing free Before existing free There is no use after free There is no double free (backward) Blue: safe location Red: unsafe location

53 Intra-rocedural analysis Now we have: Safe free locations free Next: Safe exressions The fix is after an allocation There is no double free There is no use after free malloc use Blue: safe location Red: unsafe location

54 Intra-rocedural analysis 3. Forward Determine safe exression free malloc use Reaching-Definition Analysis Points-to Grah Blue: safe location Red: unsafe location

55 Intra-rocedural analysis 3. Forward Determine safe exression free malloc use Reaching-Definition Analysis Points-to Grah Blue: safe location Red: unsafe location

56 Intra-rocedural analysis Now we have: Safe free locations Safe exressions Next: Insertion free The fix is after an allocation There is no double free There is no use after free There is an exression malloc use Blue: safe location Red: unsafe location

57 Intra-rocedural analysis 4. Forward Determine early free oints free malloc use Greedy algorithm Blue: safe location Red: unsafe location

58 Intra-rocedural analysis 4. Forward Determine early free oints free malloc use Greedy algorithm Blue: safe location Red: unsafe location

59 Intra-rocedural analysis 4. Forward Determine early free oints free malloc use Greedy algorithm Blue: safe location Red: unsafe location

60 Intra-rocedural analysis 4. Forward Determine early free oints free malloc use Greedy algorithm Blue: safe location Red: unsafe location

61 Intra-rocedural analysis 4. Forward Determine early free oints free malloc use Greedy algorithm Blue: safe location Red: unsafe location

62 Intra-rocedural analysis 4. Forward Determine early free oints free malloc use Greedy algorithm Blue: safe location Red: unsafe location

63 Intra-rocedural analysis 4. Forward Determine early free oints free malloc use free(); Greedy algorithm Blue: safe location Red: unsafe location

64 Intra-rocedural analysis 4. Forward Determine early free oints free malloc use free(); Greedy algorithm Blue: safe location Red: unsafe location

65 Intra-rocedural analysis 4. Forward Determine early free oints free malloc use free(); Greedy algorithm Blue: safe location Red: unsafe location

66 Intra-rocedural analysis malloc use free free(); Blue: safe location Red: unsafe location

67 More Comlicated Cases

68 Inter-rocedure Malloc, free, use elements are method calls Solution: Build summary for each method

69 Inter-rocedure Build summaries for each function Summarize the allocation, use, free, escae information Iteratively udate the callers Analyze Intra-rocedurally

70 Building summaries Method tye for each memory chunk Allocation(A) Free(F) Use(U) Escae (E) UE F E

71 Inter-rocedure Scan each statement Consult the summary

72 Intra-rocedural analysis int * = (int*)malloc(sizeof(int)); h() g() b=0

73 Intra-rocedural analysis malloc use free

74 Multile Allocations Multile allocations are used as one allocation Solution: set-based edge condition on CFG edges, instead of blue-red binary m1 m2 use

75 Multile Allocations b==0 = (int*)malloc(sizeof(int)); = (int*)malloc(sizeof(int)); *=1 75

76 Multile Allocations b==0 = (int*)malloc(sizeof(int)); = (int*)malloc(sizeof(int)); *=1 76

77 Multile Allocations malloc use

78 Multile Allocations malloc use

79 Multile Allocations malloc use is not a must-reference for malloc

80 Multile Allocations b==0 = (int*)malloc(sizeof(int)); = (int*)malloc(sizeof(int)); *=1 80

81 Multile Allocations {} {} {} m1 {} {} use(m1,m2) {} m2

82 Multile Allocations {} {} {} m1 {} {} use(m1,m2) {} m2

83 Multile Allocations {} {} m1 m2 {m1} {m2} use(m1,m2) {m1,m2} {}

84 Multile Allocations {} {} m1 m2 {m1} {m2} use(m1,m2) {m1,m2} {}

85 Multile Allocations {}-{m1,m2} {}-{m1,m2} m1 m2 {m1}-{m1,m2} {m2}-{m1,m2} use(m1,m2) {m1,m2} {}-{m1,m2}

86 Multile Allocations {} {} {} m1 {} {} use(m1,m2) {m1,m2} m2

87 Multile Allocations {} {} {} m1 {} {} use(m1,m2) {m1,m2} m2 m1 m2

88 Multile Allocations {} {} m1 m2 {} {} use(m1,m2) {m1,m2} is a suerset of what oints to m1 m2 {}

89 Multile Allocations {} {} m1 {} {} use(m1,m2) free(); {} m2

90 Multile Allocations m1 m2 use(m1,m2) free();

91 Loos In loos, unsafe locations are roagated all around Solution: Extract the loo

92 Hea Structure References for hea structure Solution: based on oints-to grah next

93 Global Variables Global variables escae from every function Solution: based on call grah main f1 f6 f2 f3 use(g) U A f4 g = malloc() f5

94 Global Variables Global variables escae from every function Solution: based on call grah main f1 f6 f2 f3 use(g) U A f4 g = malloc() f5

95 Global Variables Global variables escae from every function Solution: based on call grah main f1 f6 f2 f3 use(g) U A f4 g = malloc() f5

96 Global Variables Global variables escae from every function Solution: based on call grah main f1 f6 A f2 f3 U use(g) A f4 g = malloc() f5

97 Global Variables Global variables escae from every function Solution: based on call grah main f1 f6 A f2 f3 U use(g) A f4 g = malloc() f5

98 Global Variables Global variables escae from every function Solution: based on call grah main f1 f6 A f2 f3 U use(g) A f4 g = malloc() f5

99 Global Variables Global variables escae from every function Solution: based on call grah main f1 f6 A f2 f3 U use(g) A f4 g = malloc() f5

100 Imlementation Imlemented on LLVM Pointer analysis: DSA Oen-source tool available htt://sei.ku.edu.cn/~gaoqing11/leakfix

101 Exerimental results Benchmark: SPEC2000

102 Existing memory-leak detectors

103 Fixing results

104 Time consumtion

105 Leaks failed to fix Flow-insensitive ointer analysis

106 Leaks failed to fix Leak attern in gcc

107 Summary Safe fix definition Intra-rocedure analysis Inter-rocedure analysis Multile allocation Loo Hea structure Global variable Evaluation

108 Thank you!