Scalable Shape Analysis for Systems Code

  • Authors:

  • Hongseok Yang;Oukseh Lee;Josh Berdine;Cristiano Calcagno;Byron Cook;Dino Distefano;Peter O'Hearn

  • Affiliations:

  • Queen Mary, Univ. of London,;Hanyang University, Korea;Microsoft Research,;Imperial College,;Microsoft Research,;Queen Mary, Univ. of London,;Queen Mary, Univ. of London,

  • Venue:
  • CAV '08 Proceedings of the 20th international conference on Computer Aided Verification
  • Year:
  • 2008

Quantified Score

Hi-index 0.02

Visualization

Abstract

Pointer safety faults in device drivers are one of the leading causes of crashes in operating systems code. In principle, shape analysis tools can be used to prove the absence of this type of error. In practice, however, shape analysis is not used due to the unacceptable mixture of scalability and precision provided by existing tools. In this paper we report on a new join operation ${\sqcup\dagger}$ for the separation domain which aggressively abstracts information for scalability yet does not lead to false error reports. ${\sqcup\dagger}$ is a critical piece of a new shape analysis tool that provides an acceptable mixture of scalability and precision for industrial application. Experiments on whole Windows and Linux device drivers (firewire, pci-driver, cdrom, md, etc.) represent the first working application of shape analysis to verification of whole industrial programs.