WAFFLE: Exposing Memory Ordering Bugs Efficiently with Active Delay Injection
Bogdan Alexandru Stoica, Shan Lu, Madanlal Musuvathi, Suman Nath
摘要
Concurrency bugs are difficult to detect, reproduce, and diagnose, as they manifest under rare timing conditions. Recently, active delay injection has proven efficient for exposing one such type of bug -thread-safety violations -with low overhead, high coverage, and minimal code analysis. However, how to efficiently apply active delay injection to broader classes of concurrency bugs is still an open question.
We aim to answer this question by focusing on MemOrder bugs -a type of concurrency bug caused by incorrect timing between a memory access to a particular object and the object's initialization or deallocation. We first show experimentally that the current state-of-the-art delay injection technique leads to high overhead and low detection coverage since MemOrder bugs exhibit particular characteristics that cause high delay density and interference. Based on these insights, we propose Waffle -a delay injection tool that tailors key design points to better match the nature of MemOrder bugs. Evaluating our tool on 11 popular opensource multi-threaded C# applications shows that Waffle can expose more bugs with less overhead than state-of-theart techniques.
问问这篇 Paper
智能体会读完全文。
Lune 把这篇 Paper 索引到了每一个公式,引用它的顶会 Paper 也一样。你提问,回答直接引用原文。
引用它的顶会 Paper4
- OZZ: Identifying Kernel Out-of-Order Concurrency Bugs with In-Vivo Memory Access ReorderingDae R. Jeong, Yewon Choi, Byoungyoung Lee, Insik Shin 等SOSP 2024 · 被引用 4 次
- Paralegal: Practical Static Analysis for Privacy BugsJustus Adam, Carolyn Zech, Livia Zhu, Sreshtaa Rajesh 等OSDI 2025 · 被引用 2 次
- Themis: Detecting Distributed Concurrency Bugs through RPC-Driven Race-Directed Test Generation and FuzzingHongchen Cao, Jingzhu He, Ting Dai, Guoliang JinNSDI 2026 · 被引用 1 次
- State-Aware Fuzzing of JavaScript Engines with LLM-Guided InstrumentationWai Kin Wong, Dongwei Xiao, Anthony Cheuk Tung Lai, Ping Fan Ke 等SOSP 2026
它引用的顶会 Paper5
- Razzer: Finding Kernel Race Bugs through FuzzingDae R. Jeong, Kyungtae Kim, Basavesh Shivakumar, Byoungyoung Lee 等S&P 2019 · 被引用 202 次
- SoK: Sanitizing for SecurityDokyung Song, Julian Lettner, Prabhu Rajasekaran, Yeoul Na 等S&P 2019 · 被引用 196 次
- Preventing Use-After-Free Attacks with Fast Forward AllocationBrian Wickman, Hong Hu, Insu Yun, Daehee Jang 等USENIX Security 2021 · 被引用 53 次
- Snowboard: Finding Kernel Concurrency Bugs through Systematic Inter-thread Communication AnalysisSishuai Gong, Deniz Altinbüken, Pedro Fonseca, Petros ManiatisSOSP 2021 · 被引用 26 次
- UAFSan: an object-identifier-based dynamic approach for detecting use-after-free vulnerabilitiesBinfa Gui, Wei Song, Jeff HuangISSTA 2021 · 被引用 9 次
相关 Paper
- Reorder Pointer Flow in Sound Concurrency Bug PredictionYuqi Guo, Shihao Zhu, Yan Cai, Liang He 等ICSE 2024 · 被引用 1 次
- Efficiently detecting concurrency bugs in persistent memory programsZhangyu Chen, Yu Hua, Yongle Zhang, Luochangqi DingASPLOS 2022 · 被引用 11 次
- Controlled Concurrency Testing via Periodical SchedulingCheng Wen, Mengda He, Bohao Wu, Zhiwu Xu 等ICSE 2022 · 被引用 25 次
- Fast, flexible, and comprehensive bug detection for persistent memory programsBang Di, Jiawen Liu, Hao Chen, Dong LiASPLOS 2021 · 被引用 37 次
- Soundness of Predictive Concurrency AnalysesShuyang Liu, Doug Lea, Jens PalsbergOOPSLA 2025
