XRust finds hidden concurrency bugs in Linux Rust drivers
XRust: Detecting Logical Races in Rust Linux Drivers
Software Engineering
Summary
Rust helps ensure safe memory use in Linux code, but it doesn’t stop certain timing bugs where pieces of code wrongly overlap. The authors created XRust, a tool that automatically identifies and tests pairs of operations that could cause these timing issues without needing manual rules. XRust runs driver code under special schedules and spots when operations run in unsafe orders. This helped find two new timing bugs in real Linux Rust drivers, one of which has now been fixed.
What this means in practice
- •For linux kernel developers: Detect concurrency errors in Rust device drivers by automatically generating execution tests to expose logical races without manual specifications.
- •For rust embedded systems engineers: Test real-time operation sequences in Rust drivers for concurrency bugs with reproducible schedules to improve device stability.
Authors
Qingxiao Xu, Ze Sheng, Zhicheng Chen, Arjun Manikandan, Jeff Huang
Abstract
Rust is increasingly used in Linux to improve memory safety, but its guarantees do not prevent logical races: individually synchronized operations can still interleave in ways that violate higher-level invariants. Detecting such bugs typically requires manually written specifications and carefully controlled execution environments. We present XRust, a technique for detecting logical races in Linux Rust drivers without manually specified invariants. Using Logical Happens-Before (LHB) analysis, XRust identifies shared-state accesses relevant to logical ordering, automatically constructs operation-pair harnesses, and uses serial differential oracles to detect concurrent executions inconsistent with either serial order. XRust also uses lightweight userspace abstractions to execute driver code under reproducible schedules. Applied to Linux 7.3-rc2, XRust identifies 17 shared objects across 102 Rust files from ten drivers, constructs 1,654 executable harnesses, and discovers two previously unknown logical races. The rnull block-driver race has been confirmed by Linux maintainers, with a fix accepted into the Linux block subsystem tree.