CSV 889: Concurrent Software Verification Subodh Sharma Indian Institute of Technology Delhi Scalable Symbolic Execution: KLEE

Acknowledgement C. Cadar, D. Dunbar, D. Engler: KLEE, OSDI’08 Godefroid, Klarlund, Sen: DART, PLDI ‘05 Sen, Markov, Agha: CUTE, FSE’05

Three Concerns Path explosion Handling the environment Hard constraints

KLEE: Architecture Hybrid between OS for sym proc and interpreter Each Sym proc has a register file, stack, heap, program counter and path condition – register file, stack, heap are expressions here Sym process represented as a state in KLEE

KLEE Architecture LLVM bytecode K L E E SYMBOLIC ENVIRONMENT Constraint Solver (STP) x = 3 x = -2 x = 1234 x = 3 C code x  0 x  1234 LLVMLLVM

KLEE: Architecture Program is converted to LLVM bytecode KLEE interprets bytecode directly and maps to constraints – w/o approximation – bit level accuracy

KLEE: Architecture Before building sym expr, check if operands are concrete – if so, perform them natively! example: %dst = add i32 %src0, %src1

KLEE: Architecture Conditional branches: – boolean expr – change instruction pointer whether provably true or false along the current path – if both are feasible then clone states and accordingly change respective instruction pointers

KLEE: Architecture Potentially dangerous instructions – act as branches ex. division instruction generates a branch to check div-by- zero if error is generated then constraint falsified and alternated path is explored test case generated to trigger the error and terminates the state. Some dangerous operations: – ld/st – out of bound checks – pointer dereference – assertions, etc.

KLEE: Architecture Problem with ld/st – Modeling memory! – if flat byte array then solvers never return – every memory object as a separate solver array essentially segmented memory ignores all other locations not reference by the ld/st

KLEE: Architecture Problem with pointers – KLEE clones the state N times at pointer dereference – a pointer can have a large points-to set – in-bounds check for respective points-to object – This solution is expensive – Works for KLEE as their benchmarks had pointers with singleton points-to sets.

Compact State Representation Implements copy-on-write at the object level – rather than at the page level Heaps as immutable maps – therefore portions of heap can also be shared among states

Query Optimization Queries are NP-complete Expression re-writing: – x + 0 = x – x* 2^n = x<<n – 2*x – x = x

Query Optimization Constraint Simplification: – x True ∧ x = 5 propagate equality constraints Implied value concretization – x = 5 makes x concrete and written to memory – subsequent accesses returns cheap constants

Query Optimization Constraint Independence – Constraints do not overlap in terms of memory they refer Eg: i 0 Query: i = 20? – remove irrelevant subset of constraints

Query Optimization Counterexample Caching – Redundant queries are frequent – simple cache is effective – counterexample cache: maps set of constraints to counter-examples sentinels if there is no solution

Query Optimization Counterexample Caching Eg: {i < 10, i = 10} – no solution – If subset has no solution then larger set they appear in has also no solution Eg: {i < 10, j = 8} – If superset has a solution then so does the subset

Effectiveness of Optimizations

State Scheduling Random path selection – helps avoid starvation when loops creating fork- bombs Coverage-optimized search – heuristics to compute weight of each node min dist to the uncovered node – choose states with higher probability to explore uncovered code Round robin among the first two !

Environment Modeling If all arguments concrete, execute natively Otherwise, provide models on symbolic files int fd = open(“t.txt”, O_RDONLY);

Concolic Execution Works well on interprocedural bugs, use of library calls

Concolic Execution Falls back on concrete values when – Non linear arithmetic – pointers pointing to input values

Concolic execution with dynamic data Static alias analysis is required! -- since no way to know whether a->c is overwritten.

Nonlinear arithmetic