Parametric Abstract Domains for Shape Analysis

Transcription

1 Parametri Abstrat Domains for Shape Analysis Xavier RIVAL (INRIA & Éole Normale Supérieure) Joint work with Bor-Yuh Evan CHANG (University of Maryland U University of Colorado) and George NECULA (University of California at Berkeley)

2 Purpose of Shape Analysis Infer preise information about memory layout: pointers dynami, unbounded data-strutures e.g., lists, queues, staks, trees omplex omposite strutures: e.g., in devie drivers Wide range of appliations: proving memory safety absene of memory leaks, null/dangling pointer dereferene proving the preservation of shapes e.g., no yle is introdued in what should be a tree establishing stronger properties e.g., orretness of a sorting algorithm allow other analyses to support manipulation of omplex strutures Parametri Abstrat Domains for Shape Analysis p.2/48

3 A Basi Example Closing a list of File Desriptors: Properties of interest: assume(l points to a list) = l; while( NULL){ } lose( FD); = next; 1. memory safety: e.g., = next; should not rash no null pointer dereferene (easy on this program) no segmentation fault 2. preservation of the shape i.e., l should still point to a list 3. funtional orretness i.e., at the end, all FDs are losed Parametri Abstrat Domains for Shape Analysis p.3/48

4 Our Proposal user-supplied inputs parametri analyzer struture desriptions list, tree,... parametri abstrat domain unfolding widening C ode analysis engine fixpoint omputation Stati analysis by abstrat interpretation: sound automati Based on an over-approximation of sets of stores Parametri Abstrat Domains for Shape Analysis p.4/48

5 Main Diffiulties Express the adequate properties: points-to relations, aliasing, et data-strutures need be summarized fragments of strutures Infer these properties, using abstrat interpretation tehniques: analysis of elementary statements hoie of a widening operator, to enfore termination Make the abstrat domain expressive Parametri Abstrat Domains for Shape Analysis p.5/48

6 Outline An Abstrat Domain for Shapes Unfolding Edges: Loal Conretization Abstration of Segments Infering Shape Invariants Relations among Shape Properties Need for a Redution Operator Conlusion Parametri Abstrat Domains for Shape Analysis p.6/48

7 Abstration of Shapes Abstrat value: a graph representation symboli nodes (, β, γ...) represent integer values e.g., addresses, data... edges stand for onstraints about memory regions a graph an be written as a separation logi formula i.e., onstraints about a separating onjuntion of regions ( ) Simplest kind of edges: points-to edges β, means at address plus offset f, we read β graph representation: f β denotes stores like: to to addr[β] other kinds of edges to be defined later... Parametri Abstrat Domains for Shape Analysis p.7/48

8 Conretization for Graphs (1) One graph stands for a set of onrete stores: e.g., f g β γ stands for stores like: to addr[] to addr[β] to addr[β] = to addr[γ] Relations to state: node to addresses variables to addresses Parametri Abstrat Domains for Shape Analysis p.8/48

9 Conretization for Graphs (2) environment: address mapping: stores: rules, suh as: points-to edge: E : Var nodes to_addr[.] : nodes Æ σ : Æ Æ γ(@f β) = {[to_addr[] +f to_addr[β]]} to addr[] to separating onjuntion: γ(s 0 S 1 ) = {σ 0 σ 1 σ 0 γ(s 0 ) σ 1 γ(s 1 )} where "glues" two separate stores together S 0 S 1 γ γ γ(s 0 ) γ(s 1 ) Parametri Abstrat Domains for Shape Analysis p.9/48

10 Summarization of Regions We have to deal with unbounded strutures Lists: typedef typedef PList{ void data; typedef PList next; }PList; How to abstrat regions pointed to by a PList? Some onrete values: the null pointer pointer to ells of addresses to_addr[ i ] in the store below: to addr[ 0 ] to addr[ 1 ] to addr[ NULL Parametri Abstrat Domains for Shape Analysis p.10/48

11 Indutive Definitions and Summarization Summarization: prediate a memory region satisfied indutive definition at the address represented by (onretization on the next slide...) graph representation: List indutive definition (or heker):.list() := = 0 emp Why also all these definitions hekers? β β.list() programmers often write funtions like hek_doubly_linked_list suh ode an be (almost) diretly used (aveat: separation) rough intuition: it heks that the memory region satisfies the property Parametri Abstrat Domains for Shape Analysis p.11/48

12 Semantis of Indutive Definitions Cheker edges are indexed with the indution depth the onretization of is the join of i the onretizations of all (i Æ) Example for lists: at rank 0, at rank 1, list list 0 1 abstrats the empty store where is 0 abstrats stores of the form: NULL at rank 2,... list 2 to addr[] abstrats stores of NULL Parametri Abstrat Domains for Shape Analysis p.12/48

13 Parameterization of the Abstration Indutive definitions to use: supplied by the user depending on software to analyze A numerial abstration is hosen: = 0, 0; pointer equalities / disequalities; the File Desriptor pointed to by FD is open / losed Parametri Abstrat Domains for Shape Analysis p.13/48

14 Outline An Abstrat Domain for Shapes Unfolding Edges: Loal Conretization Abstration of Segments Infering Shape Invariants Relations among Shape Properties Need for a Redution Operator Conlusion Parametri Abstrat Domains for Shape Analysis p.14/48

15 An Example Bak to the list example... assume(l points to a list) = l; while( NULL){ = next; } First steps of the analysis: assume statement: asserts an initial state l list β the assignment = l; remaps environment edges (not shown) l, list loop: requires omputation of a least fix-point (a few slides later...) first iteration: analyze the body, start with 0 assignment = next;: l, list no next edge from in analysis is stuk; need to deal with full heker edges Parametri Abstrat Domains for Shape Analysis p.15/48

16 Cheker Edge Unfolding Unfolding an indutive: simply open the definition! edge unfolding: returns one symboli disjunt per rule rule unfolding: removes former heker edge reates fresh nodes for unboxed fields adds reursive heker edges aounts for side onditions Case of lists: 0 = 0 next data β list Soundness of the unfolding: γ(s ) {γ(s 0 ) S unfold S 0 } follows from the definition of hekers Parametri Abstrat Domains for Shape Analysis p.16/48

17 Analysis of an Assignment Before the assignment = next;: 0 l, list Result of the unfolding: two rules to onsider empty list does not need be onsidered ontradition with num. invariant 0 non-empty list ase: next l, data β list Result of the assignment: next l data β list note: analyzing the assignment in itself is trivial (frame rule) Parametri Abstrat Domains for Shape Analysis p.17/48

18 Outline An Abstrat Domain for Shapes Unfolding Edges: Loal Conretization Abstration of Segments Infering Shape Invariants Relations among Shape Properties Need for a Redution Operator Conlusion Parametri Abstrat Domains for Shape Analysis p.18/48

19 Need for Folding (1) First iterates in the loop: at iteration 0 (before entering the loop): 0 l, list at iteration 1: next 0 1 l data β 1 list at iteration 2: next l data next data β 1 β 2 list We are still not folding anything! how to abstrat the region between l and? Parametri Abstrat Domains for Shape Analysis p.19/48

20 Notion of Segment After two iterations: l to addr[] NULL properties to abstrat: l points to a list; points to a list; atually, points to a sub-list of l Summarization of a segment a struture with a hole position of the ursor store above abstrated by: l β list list list Parametri Abstrat Domains for Shape Analysis p.20/48

21 Formalization Segment edge β roughly means: if we add a memory region starting at address β, satisfying indutive, region starting at address satisfies indutive Conretization: defined by indution as well! o For instane, in the ase of lists: at rank 0, list list abstrats the empty region; states that = β at rank n + 1, list 0 n+1 β list β abstrats stores of to addr[β] Parametri Abstrat Domains for Shape Analysis p.21/48

22 Bak to the Example Bak to the initial example: Best invariants: assume(l points to a list) = l; 1while( NULL){ 2 = next; 3 } 4 at 1: l, list at 2: l β list list list and β 0 at 3: l β list list list and β at 4: l β list list list How to infer these invariants? and β = 0 Parametri Abstrat Domains for Shape Analysis p.22/48

23 Outline An Abstrat Domain for Shapes Unfolding Edges: Loal Conretization Abstration of Segments Infering Shape Invariants Relations among Shape Properties Need for a Redution Operator Conlusion Parametri Abstrat Domains for Shape Analysis p.23/48

24 Need for Folding (2) First iterates in the loop: at iteration 0 (before entering the loop): 0 l, list at iteration 1: next 0 1 l data β 1 list at iteration 2: next l data next data β 1 β 2 list How to infer the loop invariant? How to inrodue a segment edge? This is the purpose of widening! Parametri Abstrat Domains for Shape Analysis p.24/48

25 Widening Algorithm Widening should ahieve two things: soundness, i.e. ompute a ommon over-approximation enfore termination Separation: If i {0, 1}, s {lft, rgh}, γ(s i,s ) γ(s s), then: s, γ(s 0,s S 1,s ) γ(s lft S rgh ) we an hoose S lft S rgh as our widening: 0 S 1 2 0,lft S 1,lft Ψ Ψ Ψ γ 0 S γ 1 γ 2 0 S 1 β 0 S β 1 β 0,rgh S 1,rgh 2 join algorithm: split both graphs into regions, thanks to maintain a node-to-node mapping relation Ψ (address mapping) find a ommon abstration for well-hosen pairs of regions Parametri Abstrat Domains for Shape Analysis p.25/48

26 Segment Edges Introdution Rule: if S lft Ψ Ψ β 0 S β 1 β 0 β rgh 1 then S lft S rgh = γ 0 γ 1 Ψ (, β 0 ) γ 0 Ψ (, β 1 ) γ 1 Appliation to list traversal, at the end of iteration 1: before iteration 0: 0 l, list end of iteration 0: join, before iteration 1: next β 0 β 1 l data β 2 list γ 0 γ 1 list list list l { Ψ(0, β 0 ) = γ 0 Ψ( 0, β 1 ) = γ 1 Parametri Abstrat Domains for Shape Analysis p.26/48

27 Segment Edges Extension Rule: if 0 S 1 lft Ψ Ψ β 0 S β 1 β 0 β rgh 1 then S lft S rgh = γ 0 γ 1 Ψ ( 0, β 0 ) γ 0 Ψ ( 1, β 1 ) γ 1 Appliation to list traversal, at the end of iteration 1: previous invariant before iteration 1: end of iteration 1: 0 1 list list list l β 0 β 1 β 2 list list l next data β 3 list join, before iteration 1: γ 0 γ 1 list list list l { Ψ(0, β 0 ) = γ 0 Ψ( 1, β 2 ) = γ 1 Parametri Abstrat Domains for Shape Analysis p.27/48

28 Comparison Operator Algorithm struture: quite similar to join... based on separation and loal rules: use of a ounterpart for Ψ A set of strutural rules suh as: segment splitting: full heker folding: Corretness: γ(s 0 ) γ(s 1 ) = γ(s 0 S ) γ(s 1 S ) S = S β β unfold S 0 S S 0 } = S S 0 S 1 = γ(s 0 ) γ(s 1 ) Parametri Abstrat Domains for Shape Analysis p.28/48

29 Widening Properties Soundness: ensured by onstrution { γ(s 0 ) γ(s 0 S 1 ) γ(s 1 ) γ(s 0 S 1 ) Termination: The following sequene is ultimately stable S 0 S n+1 = S n F (n ) abstration at loop entrane where F interprets the loop body in the abstrat level Parametri Abstrat Domains for Shape Analysis p.29/48

30 Outline An Abstrat Domain for Shapes Unfolding Edges: Loal Conretization Abstration of Segments Infering Shape Invariants Relations among Shape Properties Need for a Redution Operator Conlusion Parametri Abstrat Domains for Shape Analysis p.30/48

31 Beyond Lists and Trees: Bak Pointers Trees: quite similar to lists... tree unfolds into two disjunts 0 = 0 l r β 0 tree β 1 tree What about new issue: bak pointers x NULL x next NULL = x next prev = x indutive definition: needs a parameter, to hek pointer relations Parametri Abstrat Domains for Shape Analysis p.31/48

32 Indutive Definitions with Parameters Indutive heker: dll(β) unfolds into two disjunts = 0 β prev 0 next γ dll() note that: parameter β speifies where the bak-edge is pointing to parameter for next unfold is itself head of the list: parameter is NULL.dll(β) := = 0 emp β γ.dll() Conretization: defined as usual, by indutive unfolding Parametri Abstrat Domains for Shape Analysis p.32/48

33 Unfolding Segments Bakwards Issue with unfolding: bakward traversal of doubly-linked lists does not math the built-in indution sheme example: assume(l points to a dll) = l; 0 dll(δ1 ) l, while( NULL && ondition) = next; 0 1 dll(δ 0 ) dll(δ 1 ) dll(δ 1 ) l if( 0 && prev 0) = prev prev; In fat, two separate issues need be solved: how to unfold a segment? (semanti point of view) disover automatially when the analysis needs it Parametri Abstrat Domains for Shape Analysis p.33/48

34 Segment Splitting Segment edges: defined by indution over lengths of all hains unfolding: requires deomposing the segments Splitting lemma: i+j desribes the same set of stores as: i j Bakward unfolding algorithm: treat the ase of the segment of length 0 separately assert equalities of nodes, parameters... for a segment of length j + 1, split it into a segment of length j; a segment of length 1, whih is trivial to unfold Parametri Abstrat Domains for Shape Analysis p.34/48

35 Bakward Unfolding of Segments We fous on the non empty segment ase: 1. Segment splitting: 2. Unfolding of the 1-segment: β 1 prev 0 i+1 1 l dll(β 0 ) dll(β 1 ) i dll(β l 0 ) dll(β 2 ) dll(β 2 ) dll(β 1 ) β 2 prev β 1 prev i dll(β l 0 ) dll(β 2 ) next dll( 2 ) dll(β 1 ) 3. Unfolding of the 0-segment, and reduing equalities ( 1 = 3, 2 = β 1 ): β 1 prev 0 l i dll(β 0 ) dll(β 2 ) β 2 prev prev β 1 next 1 4. Assignment = prev an be analyzed Parametri Abstrat Domains for Shape Analysis p.35/48

36 Forward Segment Unfolding Forward unfolding of segments works similarly disjuntion for the empty segment, splitting, unfolding of a 1-segment Useful in the following ase: assume(l points to a dll) = l; while( NULL && ondition) = next; if( l && ondition) = prev; Results in: prev β 0 0 γ 1 next l dll( 0) dll(β 1 ) Parametri Abstrat Domains for Shape Analysis p.36/48

37 When to Perform Bakward Unfolding An abstration: 0 3 dll(null) dll( 2 ) dll( 2 ) l to expose prev: unfold the full heker but then, how to unfold prev prev or prev next? A onrete element: to addr[ 0 ] to addr[ 1 ] to addr[ 2 ] to addr[ all 0 all 1 all 2 all 3 is in heker all number 3 prev points into all number 2 i.e., 3-1 to expose prev prev unfold previous all (end of the segment) Inferene of field levels using a typing system Parametri Abstrat Domains for Shape Analysis p.37/48

38 Benhmarks EXtensible Indutive Shape Analyzer ( Analyzes standard algorithms on lists, doubly-linked lists, fixed level skip-lists binary trees... A few seleted test ases: Benhmark Time (se) Disjunts Iterations doubly-linked list insertion searh tree with bak pointers insert and bak to root sull driver (without strings) 900 lines Parametri Abstrat Domains for Shape Analysis p.38/48

39 Outline An Abstrat Domain for Shapes Unfolding Edges: Loal Conretization Abstration of Segments Infering Shape Invariants Relations among Shape Properties Need for a Redution Operator Conlusion Parametri Abstrat Domains for Shape Analysis p.39/48

40 Uniqueness of Abstration There is NO unique abstration in general: existene of distint ways to express a same property may ause the analysis to fail Forward vs bakward doubly-linked list hekers: prev next FWD dll(β) unfold = 0 BWD dll(β) unfold = 0 β BWD dll() 0 β γ prev FWD dll() 0 Then the following two segments have the same onretization: next γ 0 1 FWD dll(β 0 ) FWD dll(β 1 ) β 0 β 1 BWD dll( 0 ) BWD dll( 1 ) they represent stores suh as: to addr[β 0 ] to addr[ to addr[β to addr[ 1 ] Parametri Abstrat Domains for Shape Analysis p.40/48

41 Forward and Bakward Indutive Definitions In ertain ases, unfolding of segments fixes the problem: For instane, to unover prev: 2 prev 0 1 FWD dll(β 0 ) FWD dll( 2 ) unfold FWD dll(β 0 ) FWD dll( 3 ) prev prev next prev β BWD dll( 1 ) BWD dll( 0 ) unfold β BWD dll( 0 ) BWD dll( 2 ) prev next prev However, folding definetely fails: Our widening annot fold β BWD dll( 0 ) BWD dll( 2 ) FWD dll( 1 ) Though, it abstrats the same stores as 0 FWD dll(β0 ) Parametri Abstrat Domains for Shape Analysis p.41/48

42 What Needs to be Done? Automatially derive inlusions suh as: β 0 β 1 BWD dll( 0 ) BWD dll( 1 ) 0 1 FWD dll(β 0 ) FWD dll(β 1 ) we do not want to rely on user-written assumptions we ould build a deision proedure but, we an also use our abstrat domain here! Infer when suh a redution should be used How to set up an abstrat interpretation of hekers? an operational semantis for indutive definitions is needed Parametri Abstrat Domains for Shape Analysis p.42/48

43 An Alternate Conretization for Indutive Defs. Deomposing our onretization for graphs: abstrat graphs β 0 β 1 BWD dll( 0 ) BWD dll( 1 ) operational semantis γ oper set of onrete graphs (only p.t. edges) prev prev β 0 0 β 1 1 next next γ γ map address mapping set of onrete stores (addresses mapped) to addr[β 0 ] to addr[ 0 ] to addr[β 1 ] to addr[ Main property: γ = γ map γ oper Operational semantis: defined as an lfp abstrat interpretation of it an be performed Parametri Abstrat Domains for Shape Analysis p.43/48

44 Indutive Definitions as Transition Systems Computing the semantis of S = β 0 onfigurations: BWD dll( 0 ) BWD dll( 1 ) P, (β 0, 0 ), (β 1, 1 ) initial states (empty segments): I init = 0 β 0 (β 0, β 0 ), ( 0, 0 ) transitions (indutive ase): β 1 P β 0 β 1 (β 0, 0 ), (β 1, 1 ) = 0 1 β P 0 β 1 prev next (β 0, 0 ), ( 1, 2 ) Program generating γ oper (S ): I = I init ; while(true); I = {P nxt P I P = Pnxt} The transition system is systematially derived from the indutive Parametri Abstrat Domains for Shape Analysis p.44/48

45 Abstrat Interpretation of An Indutive Def. Abstrat interpretation: abstration: sets of stores, abstrated with our domain, with only FWD_dll as a parameter omputation: abstrat interpretation of the transition system First abstrat iterates: at rank 0: I init 0 β0 (β 0, β 0 ), ( 0, 0 ) at the end of iter 1: β 0 prev next (β 0, 0 ), ( 0, 1 ) 0 1 widening: introdues the segment edge 0 = β (β0 FWD dll(β 0 ) FWD dll(β 1, ) 0 ), (β 1, 1 ) Parametri Abstrat Domains for Shape Analysis p.45/48

46 Abstrat Interpretation of An Indutive Def. End of the analysis: next iterate: transition adds a pair of edges: 0 = β FWD dll(β 0 ) FWD dll(β 1 ) β 1 next prev (β 0, 0 ), (β 1, 2 ) widening: the above is stable! 0 2 FWD dll(β 0 ) FWD dll( 1 ) (β 0, 0 ), (β 1, 2 ) β γ oper ( 0 β 1 BWD dll( 1 ) BWD dll( 0 ) ) γ oper ( A similar approah works in other ases of onversions: weakening strutures: FD list list 0 1 FWD dll(β 0 ) FWD dll(β 1 ) ) turning segments into full hekers, with additional parameters Parametri Abstrat Domains for Shape Analysis p.46/48

47 Outline An Abstrat Domain for Shapes Unfolding Edges: Loal Conretization Abstration of Segments Infering Shape Invariants Relations among Shape Properties Need for a Redution Operator Conlusion Parametri Abstrat Domains for Shape Analysis p.47/48

48 Towards Shape Analysis Abstrat Domains Our main ontributions: a parametri shape analysis domain strutures to hek are not built-in a numerial abstration an also be hosen good support for loal onretization (unfolding) a widening operator powerful abstration: usable even to analyze its parameterization Long term goal: make a parametri shape analysis domain available for other analyses Many theoretial and pratial issues yet to solve: redution arrays... Parametri Abstrat Domains for Shape Analysis p.48/48