Newest papers

XRust: Detecting Logical Races in Rust Linux Drivers

Qingxiao Xu, Ze Sheng, Zhicheng Chen, Arjun Manikandan, Jeff Huang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27325 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

Rust se utiliza cada vez más en Linux para mejorar la seguridad de la memoria, pero sus garantías no impiden las carreras lógicas: las operaciones sincronizadas individualmente todavía pueden interlevarse de maneras que violen los invariantes de nivel superior. Detectar tales errores generalmente requiere especificaciones escritas manualmente y entornos de ejecución cuidadosamente controlados. Presentamos XRust, una técnica para detectar carreras lógicas en los controladores de Linux Rust sin invariantes especificados manualmente. Usando el análisis de Logical Happens-Before (LHB), XRust identifica los accesos compartidos de estado relevantes para el ordenamiento lógico, construye automáticamente los problemas de pareja de operaciones y utiliza oráculos diferenciales seriales para detectar las ejecuciones coincidentes inconsist

Machine translation (Meta M2M100); the English original follows.

Abstract

Rust is increasingly used in Linux to improve memory safety, but its guarantees do not prevent logical races: individually synchronized operations can still interleave in ways that violate higher-level invariants. Detecting such bugs typically requires manually written specifications and carefully controlled execution environments. We present XRust, a technique for detecting logical races in Linux Rust drivers without manually specified invariants. Using Logical Happens-Before (LHB) analysis, XRust identifies shared-state accesses relevant to logical ordering, automatically constructs operation-pair harnesses, and uses serial differential oracles to detect concurrent executions inconsistent with either serial order. XRust also uses lightweight userspace abstractions to execute driver code under reproducible schedules. Applied to Linux 7.3-rc2, XRust identifies 17 shared objects across 102 Rust files from ten drivers, constructs 1,654 executable harnesses, and discovers two previously unknown logical races. The rnull block-driver race has been confirmed by Linux maintainers, with a fix accepted into the Linux block subsystem tree.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Executable, Computer science, Operating system, Programming language, Rust (programming language), Block (permutation group theory)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange