Newest papers

XRust: Detecting Logical Races in Rust Linux Drivers

Qingxiao Xu, Ze Sheng, Zhicheng Chen, Arjun Manikandan, Jeff Huang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27325 · cited by 0 works (OpenAlex) · open-access PDF

Chinese

Rust 越来越多地用于提高内存安全性,但它的保证不会阻止逻辑比赛:单独同步操作仍然可以以违反高级别变异的方式进行交叉。 检测此类错误通常需要手写规格和精心控制的执行环境。 我们介绍 XRust,一种用于在 Linux Rust 驱动程序中检测逻辑比赛的技术,而无需手动指定变异。 使用 Logical Happens-Before (LHB) 分析,XRust 会识别与逻辑排序相关的共享状态访问,自动构建操作对的骚扰,并使用序列差异性口号来检测与任何序列命令不一致的同时执行。 XRust 还使用轻量级用户空间抽象来执行可重的驱动程序代码。 应用于 Linux 7.3-r

Machine translation (Meta M2M100); the English original follows.

Abstract

Rust is increasingly used in Linux to improve memory safety, but its guarantees do not prevent logical races: individually synchronized operations can still interleave in ways that violate higher-level invariants. Detecting such bugs typically requires manually written specifications and carefully controlled execution environments. We present XRust, a technique for detecting logical races in Linux Rust drivers without manually specified invariants. Using Logical Happens-Before (LHB) analysis, XRust identifies shared-state accesses relevant to logical ordering, automatically constructs operation-pair harnesses, and uses serial differential oracles to detect concurrent executions inconsistent with either serial order. XRust also uses lightweight userspace abstractions to execute driver code under reproducible schedules. Applied to Linux 7.3-rc2, XRust identifies 17 shared objects across 102 Rust files from ten drivers, constructs 1,654 executable harnesses, and discovers two previously unknown logical races. The rnull block-driver race has been confirmed by Linux maintainers, with a fix accepted into the Linux block subsystem tree.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Executable, Computer science, Operating system, Programming language, Rust (programming language), Block (permutation group theory)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange