MLEE: Effective Detection of Memory Leaks on Early-Exit Paths in OS Kernels
summary
A static detector called MLEE analyzes compiled RVM IR of Linux 5.0, identifies conditional early-exit branches, cross-checks allocations versus deallocations, and flags missed frees. Implemented as rrvm2 on RVM 8.0, it scans the whole kernel in ~30 minutes, reports 126 suspicious early-exit branches and yields 120 new memory leaks (103 branches confirmed and fixed), mostly in drivers; the tool reduces coverage gaps of dynamic detectors but admits false positives and negatives.
AI-written summary · about
chapters (6)
- 0:00MLEE: Effective Detection of Memory Leaks on Early-Exit Paths in OS Kernels
- 2:11However, detecting leaks in OS kernels is still challenging The Linux kernel memory leak detector is a dynamic detection tool Cannot cover kernel code that is not executed at runtime
- 5:27MLEE: detecting memory leaks on early-exit paths Idea * Inconsistent presences of memory deallocations on different early-exit paths
- 7:35Challenge 1: how to identify early-exit paths? Problem: the diverse semantics and usage scenarios of early-cocit paths in OS kernels make it difficult to precisely identify early-exit paths
- 8:46Challenge 2: how to analyze memory deallocations? Problem: a missed memory deallocation may be not needed on a specific early-exit path
- 13:51Summary Memory leaks in critical system software can cause serious system issues To detect memory leaks in OS kernels, we develop and implement MLEE ✓ MLEE focuses on memory leaks on early-exit paths, which are often
related talks
27mInstalling and Using the Linux-Kernel Memory Model (LKMM)
55mUsing the Valgrind Framework to Build a Persistent Memory Error Detector
18mEnhancing Static Analysis for Practical Bug Detection: An LLM-Integrated Approach
31mMemory Leaks in JavaScript
17mEnding the Plague of Memory Leaks
15mSound and partially-complete static analysis of data-races in GPU programs
18mPreview: Verification (Correctness & Debugging)
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions