Testing race conditions with memory access tracing and stack-based delay injection
Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.
A Google Project Zero researcher published MAccConc (Memory Access Concurrency), tooling for exploring possible interleavings of multithreaded test cases in the Linux kernel, available on GitHub. The tools use KCOV with ASAN outline-mode instrumentation to record per-access memory traces, enabling automatic testing of all A-B-A interleavings plus terminal and GUI explorers for manual analysis. The work targets confirming race condition candidates, building reliable regression tests, and enabling concurrency fuzzing, drawing on ideas from SKI and Ned Williamson's sockfuzzer.
- Tools automatically exercise all A-B-A interleavings of multithreaded kernel test cases.
- Uses KCOV and ASAN outline instrumentation to capture memory access traces.
- Aims to confirm race condition candidates and produce reliable regression tests.
- Builds on SKI's approach and ideas from sockfuzzer's custom scheduler.
- Kernel-side tracing could enable bare-metal testing and future fuzzing integrations.
From the original article
14 min read at projectzero.googleMany security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: Confirming bug candidates that have been discovered manually or through static analysis.
By Jann Horn · projectzero.google
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.