Using redundancies to find errors

This paper explores the idea that redundant operations, like type errors, commonly flag correctness errors. We experimentally test this idea by writing and applying four redundancy checkers to the Linux operating system, finding many errors. We then use these errors to demonstrate that redundancies, even when harmless, strongly correlate with the presence of traditional hard errors (e.g., null pointer dereferences, unreleased locks). Finally we show that how flagging redundant operations gives a way to make specifications "fail stop" by detecting dangerous omissions.

[1]  Leon J. Osterweil,et al.  Dave—a validation error detection and documentation system for fortran programs , 1976, Softw. Pract. Exp..

[2]  Leon J. Osterweil,et al.  Data Flow Analysis in Software Reliability , 1976, CSUR.

[3]  Etienne Morel,et al.  Global optimization by suppression of partial redundancies , 1979, CACM.

[4]  J. C. Huang,et al.  Detection of Data Flow Anomaly Through Program Instrumentation , 1979, IEEE Transactions on Software Engineering.

[5]  Robert E. Tarjan,et al.  Variations on the Common Subexpression Problem , 1980, J. ACM.

[6]  Neil D. Jones,et al.  Program flow analysis - theory and applications , 1981, Prentice Hall software series.

[7]  Ira R. Forman An algebra for data flow anomaly detection , 1984, ICSE '84.

[8]  Alfred V. Aho,et al.  Compilers: Principles, Techniques, and Tools , 1986, Addison-Wesley series in computer science / World student series edition.

[9]  Fun Ting Chan,et al.  AIDA–A dynamic data flow anomaly detection system for pascal programs , 1987, Softw. Pract. Exp..

[10]  Bernhard Steffen,et al.  Lazy code motion , 1992, PLDI '92.

[11]  Nicholas Sterling,et al.  WARLOCK - A Static Data Race Analysis Tool , 1993, USENIX Winter.

[12]  Yang Meng Tan,et al.  LCLint: a tool for using specifications to check code , 1994, SIGSOFT '94.

[13]  LCLint: A Tool for Using Specifications to Check Code , 1994, SIGSOFT FSE.

[14]  Bernhard Steffen,et al.  Partial dead code elimination , 1994, PLDI '94.

[15]  Michael Burrows,et al.  Eraser: a dynamic data race detector for multi-threaded programs , 1997, TOCS.

[16]  David A. Wagner,et al.  A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities , 2000, NDSS.

[17]  David S. Munro,et al.  In: Software-Practice and Experience , 2000 .

[18]  William R. Bush,et al.  A static analyzer for finding dynamic programming errors , 2000, Softw. Pract. Exp..

[19]  Alexander Aiken,et al.  Detecting races in Relay Ladder Logic programs , 1998, International Journal on Software Tools for Technology Transfer.

[20]  Robert DeLine,et al.  Enforcing high-level protocols in low-level software , 2001, PLDI '01.

[21]  Junfeng Yang,et al.  An empirical study of operating systems errors , 2001, SOSP.

[22]  Sriram K. Rajamani,et al.  Automatically validating temporal safety properties of interfaces , 2001, SPIN '01.

[23]  Dawson R. Engler,et al.  Bugs as deviant behavior: a general approach to inferring errors in systems code , 2001, SOSP.

[24]  Greg Nelson,et al.  Extended static checking for Java , 2002, PLDI '02.

[25]  Dawson R. Engler,et al.  A system and language for building system-specific, static analyses , 2002, PLDI '02.

[26]  Dawson R. Engler,et al.  Using programmer-written compiler extensions to catch security holes , 2002, Proceedings 2002 IEEE Symposium on Security and Privacy.

[27]  Dawson R. Engler,et al.  RacerX: effective, static detection of race conditions and deadlocks , 2003, SOSP '03.