1. Using SMGCPA for the Detection of Memory Safety Bugs in the Linux Kernel
Anton Vasilyev

2. Classification of memory errors
Read / Write
Overflow
Over-read
Dangling pointer
Null pointer dereference
Uninitialized variables
Memory management
Memory leak
Double free
Invalid free
Use after free

3. SMG terminology
Symbolic Memory Graphs — representation of memory state
Objects
Regions
Lists (SLS и DLS)
Symbolic values
Points-to edges
Has-value edges
Labeling functions

4. Operations on SMGs Data Reinterpretation Read Reinterpretation
Write Reinterpretation
Merging sequences of Objects to lists
Materialisation of Lists
Join of SMGs
Checking Equality and Inequality of values

5. Write Reinterpretation
void main() {
void *array;
long b = 2;
long c = 3;
array = calloc(1, 16);
memcpy(&array[4], &b, 4);
memcpy(&array[5], &c, 4); }

6. Write Reinterpretation
void main() {
void *array;
long b = 2;
long c = 3;
array = calloc(1, 16);
memcpy(&array[4], &b, 4);
memcpy(&array[5], &c, 4); }

7. Write Reinterpretation
void main() {
void *array;
long b = 2;
long c = 3;
array = calloc(1, 16);
memcpy(&array[4], &b, 4);
memcpy(&array[5], &c, 4); }

8. Write Reinterpretation
void main() {
void *array;
long b = 2;
long c = 3;
array = calloc(1, 16);
memcpy(&array[4], &b, 4);
memcpy(&array[5], &c, 4); }

9. Write Reinterpretation
void main() {
void *array;
long b = 2;
long c = 3;
array = calloc(1, 16);
memcpy(&array[4], &b, 4);
memcpy(&array[5], &c, 4); }

10. Write Reinterpretation
void main() {
void *array;
long b = 2;
long c = 3;
array = calloc(1, 16);
memcpy(&array[4], &b, 4);
memcpy(&array[5], &c, 4); }

11. Overflow int main() { 0: int *array;
1: array = malloc(5 * sizeof(int));
2: array[5] = 2;
free(array);
return 0; }

12. Overflow int main() { 0: int *array;
1: array = malloc(5 * sizeof(int));
2: array[5] = 2;
free(array);
return 0; }

13. Overflow int main() { 0: int *array;
1: array = malloc(5 * sizeof(int));
2: array[5] = 2;
free(array);
return 0; }
Error State

14. Double free int main() { 0: int *array, *bad;
1: array = malloc(5 * sizeof(int));
2: bad = array;
3: free(array);
4: free(bad);
return 0; }

15. Double free int main() { 0: int *array, *bad;
1: array = malloc(5 * sizeof(int));
2: bad = array;
3: free(array);
4: free(bad);
return 0; }

16. Double free int main() { 0: int *array, *bad;
1: array = malloc(5 * sizeof(int));
2: bad = array;
3: free(array);
4: free(bad);
return 0; }

17. Double free int main() { 0: int *array, *bad;
1: array = malloc(5 * sizeof(int));
2: bad = array;
3: free(array);
4: free(bad);
return 0; }

18. Double free int main() { 0: int *array, *bad;
1: array = malloc(5 * sizeof(int));
2: bad = array;
3: free(array);
4: free(bad);
return 0; }

19. Double free int main() { 0: int *array, *bad;
1: array = malloc(5 * sizeof(int));
2: bad = array;
3: free(array);
4: free(bad);
return 0; }
Error State

20. Merging Sequences of Objects

21. Join SMGs

22. Linux kernel problems
Can`t be checked as whole

23. Linux kernel problems Can`t be checked as whole
Require special environment

24. Linux kernel problems Can`t be checked as whole
Require special environment
Incomplete sources

25. Linux kernel problems Can`t be checked as whole
Require special environment
Incomplete sources
Incomplete variables initialization

26. Memory on demand Allows to have simple model of kernel internals
Doesn't report memory leak errors with marked memory
Allows dereference uninitialized pointers

27. Memory on demand struct Recursive { struct Recursive *p; };
void foo() {
struct Recursive *a;
struct Recursive *b;
a = ext_allocation();
b = a.p;
free(b.p); }
void main() {
foo();

28. Memory on demand struct Recursive { struct Recursive *p; };
void foo() {
struct Recursive *a;
struct Recursive *b;
a = ext_allocation();
b = a.p;
free(b.p); }
void main() {
foo();

29. Memory on demand struct Recursive { struct Recursive *p; };
void foo() {
struct Recursive *a;
struct Recursive *b;
a = ext_allocation();
b = a.p;
free(b.p); }
void main() {
foo();

30. Memory on demand struct Recursive { struct Recursive *p; };
void foo() {
struct Recursive *a;
struct Recursive *b;
a = ext_allocation();
b = a.p;
free(b.p); }
void main() {
foo();

31. Visualization issues

32. Visualization issues

33. Verification results True positive unsafe False positive unsafe 62 527
Environment
SMG
387
137

34. Verification results 11 patches to Linux kernel 7 patches are prepared
12 found errors were fixed

35. Kernel verification Unsafes Safes Unknows Reference level 580 1168
3101
SMG state copy modification
610
1184
3055

36. Further work Improve stop operator performance Symbolic part of SMG
Additional abstraction algorithm for arrays