Abstract

The ability to detect and pinpoint memory-related bugs in production runs is important because in-house testing may miss bugs. This paper presents HeapMon, a heap memory bug-detection scheme that has a very low performance overhead, is automatic, and is easy to deploy. HeapMon relies on two new techniques. First, it decouples application execution from bug monitoring, which executes as a helper thread on a separate core in a chip multiprocessor system. Second, it associates a filter bit with each cached word to safely and significantly reduce bug checking frequency—by 95 % on average. We test the effectiveness of these techniques using existing and injected memory bugs in SPECt2000 applications and show that HeapMon effectively detects and identifies most forms of heap memory bugs. Our results also indicate that the HeapMon performance overhead is only 5%, on average—orders of magnitude less than existing tools. Its overhead is also modest: 3.1 % of the cache size and a 32-KB victim cache for on-chip filter bits and 6.2 % of the allocated heap memory size for state bits, which are maintained by the helper thread as a software data structure.

Citations

478	Eraser: A Dynamic Data Race Detector for Multi-Threaded Programs - Savage, Burrows, et al. - 1997
286	CCured: Type-safe retrofitting of legacy code - Necula, McPeak, et al. - 2002
286	Tempest and Typhoon: User-level shared memory - Reinhart, Larus, et al. - 1994
247	Tracking down software bugs using automatic anomaly detection - Hangal, Lam - 2002
195	Efficient detection of all pointer and array access errors - Austin, Breach, et al. - 1994
195	RacerX: effective, static detection of race conditions and deadlocks - Engler, Ashcraft - 2003
181	A system and language for building system-specific, static analyses - Hallem, Chelf, et al. - 2002
155	Efficient and Precise Datarace Detection for Multithreaded Object-Oriented Programs - Choi, Lee, et al. - 2002
147	D.L.: CMC: A pragmatic approach to model checking real code - Musuvathi, Park, et al.
138	Tolerating memory latency through software-controlled pre-execution in simultaneous multithreading processors - LUK
133	Speculative Data-Driven Multithreading - Roth, Sohi - 2001
82	Mondrian memory protection - Witchel, Cates, et al. - 2002
60	iWatcher: Efficient Architectural Support for Software Debugging - Zhou, Qin, et al. - 2004
59	SafeMem: Exploiting ECC-Memory for Detecting Memory Leaks and Memory Corruption During Production Runs - Qin, Lu, et al. - 2005
58	Assisted execution - Dubois, Song - 1998
57	Using a user-level memory thread for correlation prefetching - Solihin, Lee, et al. - 2002
55	Enhancing Software Reliability withSpeculative Threads - Oplinger, Lam - 2002
53	Low-Cost, Concurrent Checking of Pointer and Array - Patil, Fischer - 1997
47	AccMon: Automatically Detecting Memoryrelated Bugs via Program Counter-Based Invariants - Zhou, Lin, et al. - 2004
40	The CM-5 Connection Machine: A Scalable Supercomputer - Hillis, Tucker - 1993
11	Evaluation of Mechanisms for Fine-Grained Parallel - Spertus, Goldstein, et al. - 1993
9	Low-overhead interactive debugging via dynamic instrumentation with dise - Corliss, Lewis, et al. - 2005
2	Automatic Verification of the SCI Cache Coherence - Stern, Dill - 1995
1	Intel Thread Checker; see http:// www.intel.com/cd/software/products/asmo-na/eng/threading - Corporation
1	Reps, ‘‘Debugging via Run-Time Type - Loginov, Yong, et al. - 2001
1	Efficient Run-time Monitoring Using Shadow - Patil, Fischer - 1995
1	Rational software; see http://www-306. ibm.com/software/rational - Corporation
1	SecurityFocus Newsletter No. 172, 2002; see http:// www.pantek.com/library/linux/lists/securityfocus.com/sf-news/ msg00002.html - Boletta
1	Microsoft IIS HTR Chunked Encoding Heap Overflow Allows Arbitrary Code’’; see http:// securityresponse.symantec.com/avcenter/security/Content - Corporation
1	Computer Emergency Readiness Team, ‘‘Buffer Overflow in Microsoft Internet Explorer,’’ Technical Cyber Security Alert TA04-315A; see http://www.us-cert.gov/cas - States
1	Computer Emergency Readiness Team, ‘‘ ‘Code Red’ Worm Exploiting Buffer Overflow - States
1	Standard Performance Evaluation Corporation; see http://www.spec.org - Benchmarks
1	Received June 21, 2005; accepted for publication July 25, 2005; Internet publication February 28 - SESC - 2006