Newest papers

XRust: Detecting Logical Races in Rust Linux Drivers

Qingxiao Xu, Ze Sheng, Zhicheng Chen, Arjun Manikandan, Jeff Huang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27325 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

Rust はメモリのセキュリティを改善するために Linux でますます使用されていますが、その保証は論理的なレースを防ぐことはありません:個別に同期された操作は依然として、より高いレベルの変数を侵害する方法で相互作用する可能性があります。そのようなバグを検出するには、通常、手動で書かれた仕様や慎重に制御された実行環境が必要です。我々は、Linux Rust ドライバで論理的なレースを検出するためのテクニックである XRust を提示し、手動で指定された変数なしに論理的なレースを検出します。Logical Happens-Before (LHB) 分析を使用して、XRust は論理的な順序に適した共有状態のアクセスを識別し、

Machine translation (Meta M2M100); the English original follows.

Abstract

Rust is increasingly used in Linux to improve memory safety, but its guarantees do not prevent logical races: individually synchronized operations can still interleave in ways that violate higher-level invariants. Detecting such bugs typically requires manually written specifications and carefully controlled execution environments. We present XRust, a technique for detecting logical races in Linux Rust drivers without manually specified invariants. Using Logical Happens-Before (LHB) analysis, XRust identifies shared-state accesses relevant to logical ordering, automatically constructs operation-pair harnesses, and uses serial differential oracles to detect concurrent executions inconsistent with either serial order. XRust also uses lightweight userspace abstractions to execute driver code under reproducible schedules. Applied to Linux 7.3-rc2, XRust identifies 17 shared objects across 102 Rust files from ten drivers, constructs 1,654 executable harnesses, and discovers two previously unknown logical races. The rnull block-driver race has been confirmed by Linux maintainers, with a fix accepted into the Linux block subsystem tree.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Executable, Computer science, Operating system, Programming language, Rust (programming language), Block (permutation group theory)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange