UNIVERSITY of CALIFORNIA RIVERSIDE Detecting and Verifying
Total Page：16
File Type：pdf, Size：1020Kb
UNIVERSITY OF CALIFORNIA RIVERSIDE Detecting and Verifying Event-Driven Races in Mobile Apps A Dissertation submitted in partial satisfaction of the requirements for the degree of Doctor of Philosophy in Computer Science by Yongjian Hu December 2017 Dissertation Committee: Dr. Rajiv Gupta, Chairperson Dr. Iulian Neamtiu Dr. Heng Yin Dr. Zhijia Zhao Copyright by Yongjian Hu 2017 The Dissertation of Yongjian Hu is approved: Committee Chairperson University of California, Riverside Acknowledgments I am deeply indebeted to my advisor, Dr. Iulian Neamtiu, for his generous support and guidance during my Ph.D. journey. Without his help, this dissertation would not have been possible. I am grateful to Iulian for the time we spent together discussing various research ideas and the kindness that allows me do the research I'm interested in. I still miss the crazy time we spent working together prior to paper deadlines. His passion and enthusiasm will be a great model for me to work in the future career. Thanks, Dr. Neamtiu! I want to thank my committee chair, Dr. Rajiv Gupta, for his help and for teaching an excellent class on compiler optimization which simulated my interest in the programming analysis research. I also thank the other members of the committee, Dr. Heng Yin and Dr. Zhijia Zhao, for their support and constructive feedbacks. I am also thankful for my collaborators, Dr. Oriana Riva, Dr. Suman Nath from Microsoft Research, Dr. Patrick Mutchler, Dr. Gogul Balakrishnan from Google. The internship with them is a nice experience that helps me improve in research and coding. I would like to express my gratitude to all my labmates: Tanzirul Azim, Arash Alavi, Zhiyong Shan, Bo Zhou, Yan Wang, Changhui Lin, Amlan Kusum, Vineet Singh, Steve Su for helping me in many ways during my graduate study. I express my regards to the University staff members Ms. Amy Ricks, Ms. Vanda Yamaguchi, Ms. Amanda Wong and Ms. Madie Heersink for their administrative support. Finally, I would like to take this opportunity to thank my family for their uncon- ditional and endless support. My wife Yiqiu Yang always stood by my side and encourged me when I was stressed in the graduate study. Her love is the driving force of my efforts. iv My parents Donghai Hu and Huifang Zhang spent all they can to help me succeed, and this dissertation is a small tribute to their endeavors. v To my wife and my parents, who give me endless support. vi ABSTRACT OF THE DISSERTATION Detecting and Verifying Event-Driven Races in Mobile Apps by Yongjian Hu Doctor of Philosophy, Graduate Program in Computer Science University of California, Riverside, December 2017 Dr. Rajiv Gupta, Chairperson Concurrency bugs are notoriously difficult to find and fix. The situation is even worse on mobile platforms due to their asynchronous programming model. Android, the dominant mobile platform, has been plagued by concurrency errors ever since its inception. The majority of these errors are event-driven races, a new type of races caused by non- deterministic order of events that access the same memory with at least one write access. Prior research in this area consists of dynamic approaches to discover harmful event-driven races. However, due to their dynamic nature, these approaches suffer from coverage and false negative issues. Moreover, they produce false positives, cannot reproduce races, and cannot distinguish between benign and harmful races. In this dissertation, we present an effective approach to systematically detect, ver- ify and classify event-driven races for Android apps. The approach is composed of three sub-systems. First, a static event-driven race detector named SIERRA; this is the first static approach for race detection in Android and mobile systems in general. By employ- ing a novel action-sensitive pointer analysis, a static happens-before graph and symbolic vii execution based refinement, SIERRA finds true races with high accuracy and efficiency. On a benchmark suite used by prior work on dynamic race detection, SIERRA was able to discover a super set of those races reported by the dynamic detector (29.5 vs 4 true races per app) which demonstrates the advantage of a sound static approach. Second, a versa- tile yet lightweight record-and-replay tool named VALERA which uses a novel sensor and event-stream driven approach to record-and-replay. VALERA's low overhead (about 1% for either record or replay) and precise schedule replay allows it to reproduce event-driven races hence facilitate bug fixing. Finally, a race verification and classification approach named ERVA, which uses event dependency graphs, event flipping, and replay to filter out false positives; for true positives, ERVA can distinguish benign races from harmful races via state comparison. viii Contents List of Figures xii List of Tables xiv 1 Introduction 1 1.1 Motivation . .1 1.2 Challenges . .4 1.3 Dissertation Overivew . .7 1.4 Contributions . 10 1.5 Organization . 11 2 Background 13 2.1 Android Background . 13 2.1.1 Android App Construction . 14 2.1.2 Android Concurrency Model . 15 2.2 Event-Driven Races . 20 2.2.1 Examples . 20 2.2.2 Formal Definition . 24 3 Static Event-Driven Race Detection 29 3.1 Design Overview . 31 3.2 Harness Generation . 33 3.3 Event Call Graph and Pointer Analysis . 35 3.3.1 Action Sensitivity . 35 3.4 Happens-before Relationship . 36 3.4.1 Definitions . 37 3.4.2 Actions: Static Happens-before Graph Nodes . 37 3.4.3 Static Happens-before Rules . 38 3.4.4 Accesses and Races . 42 3.5 Symbolic Execution-based Refutation . 44 3.6 Evaluation . 46 3.6.1 Effectiveness . 48 ix 3.6.2 Efficiency . 49 3.6.3 Harmful Race Example . 50 3.6.4 Comparison with Dynamic Race Detection . 51 3.6.5 Discussion . 52 3.6.6 Results on the 174 App Dataset . 53 3.7 Summary . 54 4 Race Reproduction via Record and Replay 55 4.1 Motivation . 59 4.1.1 Accurate Timing and Low Overhead . 59 4.1.2 Schedule Replay . 61 4.1.3 Network and Sensors . 63 4.2 Design Overview . 63 4.3 API Interception and Replay . 66 4.3.1 Example: Intercepting the Location Services . 66 4.3.2 Automatic Interception through App Rewriting . 69 4.3.3 Interceptor Specification . 70 4.3.4 Intercepting Events and Eliminating Nondeterminism . 73 4.3.5 Intercepting Intents . 77 4.3.6 Recording and Replaying . 77 4.4 Fuzzy Replay . 79 4.4.1 Semantic Sensor Data Alteration . 79 4.4.2 Cross-app Testing . 82 4.5 Event Schedule Replay . 84 4.5.1 Recording the Event Schedule . 84 4.5.2 Replaying the Event Schedule . 87 4.6 Evaluation . 89 4.6.1 Evaluation of VALERA .......................... 89 4.6.2 Evaluation of Fuzzy Replay . 98 4.7 Summary . 105 5 Race Verification and Classification 106 5.1 Motivation Examples . 108 5.1.1 False Positive Type-1: Imprecise Android Component Model . 109 5.1.2 False Positive Type-2: Implicit Happens-before Relation . 109 5.1.3 Benign Race Type-1: Control Flow Protection . 112 5.1.4 Benign Race Type-2: No State Difference . 114 5.2 Design Overview . 116 5.2.1 Race Detection . 117 5.2.2 Input Capture and Replay . 118 5.2.3 Event Dependency Graph . 119 5.2.4 Event Flipping . 120 5.2.5 State Recording and Comparison . 121 5.2.6 Race Verification and Classification . 123 5.3 Evaluation . 124 x 5.3.1 Effectiveness . 125 5.3.2 Efficiency . 127 5.4 Summary . 129 6 Related Work 130 6.1 Race Detection . 130 6.1.1 Race Detection for Thread-based Programs . 130 6.1.2 Race Detection for Event-Driven Programs . 131 6.2 Race Classification . 132 6.3 Record and Replay . 133 7 Conclusions 136 7.1 Future Work . 137 Bibliography 139 xi List of Figures 1.1 Motivation example of an event-driven race. (a) A correct execution schedule. (b) An incorrect schedule caused by the alternated execution of onReceive and onStop........................................2 1.2 Overview of this dissertation . .7 2.1 Thread model of a typical Android app. 15 2.2 Event posting patterns in Android. 18 2.3 Intra-component race. 21 2.4 Source code of race bug in Tomdroid....................... 23 2.5 Event schedule of main thread in Tomdroid: normal execution (left) and race leading to crash (right). 24 3.1 Overview of SIERRA................................ 31 3.2 Harness example. 34 3.3 HB edges among Activity lifecycle callbacks (dashed red arrows) induced by CFG dominance in our harness model. Black edges represent control flow. 39 3.4 HB edges (dashed red arrows) induced by CFG dominance in our GUI model, e.g., onResume! onClick1, or onClick2! onClick3. Black edges represent control flow. 41 3.5 Adding intra-action transitive HB edges: (a) is the action order, while (b) and (c) are possible schedules. 43 3.6 Refutation helps eliminate this false positive in the OpenSudoku app. 44 4.1 Screenshots of correct execution (left) and divergent execution due to impre- cise timing (right). 57 4.2 Schedule of correct execution (left) and divergent execution due to imprecise schedule replay (right). 58 4.3 Overview of the VALERA runtime. 64 4.4 Location API example. 67 4.5 Overview of VALERA's automatic interception. ..