L. Tan, C. Liu, Z. Li, X. Wang, Y. Zhou et al., Bug characteristics in open source software, Empirical Software Engineering, vol.19, issue.6, pp.1665-1705, 2014.

, Fuzzing

, Syzkaller: a kernel fuzzer

, Bugs found by syzkaller

J. Corina, A. Machiry, C. Salls, Y. Shoshitaishvili, S. Hao et al., DIFUZE: interface aware fuzzing for kernel drivers, Proceedings of the 24th International Conference on Computer and Communications Security (CCS, pp.2123-2138, 2017.

S. M. Talebi, H. Tavakoli, H. Zhang, Z. Zhang, A. A. Sani et al., Charm: facilitating dynamic analysis of device drivers of mobile systems, Proceedings of the 27th USENIX Security Symposium, pp.291-307, 2018.

D. R. Jeong, K. Kim, B. Shivakumar, B. Lee, and I. Shin, RAZZER: finding kernel race bugs through fuzzing, Proceedings of the 40th IEEE Symposium on Security and Privacy, pp.279-293, 2019.

S. Saha, J. Lozi, G. Thomas, J. L. Lawall, and G. Muller, Hector: detecting resource-release omission faults in error-handling code for systems software, Proceedings of the 43rd International Conference on Dependable Systems and Networks (DSN), pp.1-12, 2013.
URL : https://hal.archives-ouvertes.fr/hal-00918079

S. Saha, J. L. Lawall, and G. Muller, An approach to improving the structure of error-handling code in the Linux kernel, Proceedings of the 2011 International Conference on Languages, Compilers, and Tools for Embedded Systems (LCTES), pp.41-50, 2011.
URL : https://hal.archives-ouvertes.fr/hal-01286601

A. Kadav and M. M. Swift, Understanding modern device drivers, Proceedings of the 17th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), pp.87-98, 2012.

D. Song, F. Hetzelt, D. Das, C. Spensky, Y. Na et al., PeriScope: an effective probing and fuzzing framework for the hardware-OS boundary, Proceedings of the 26th Network and Distributed Systems Security Symposium (NDSS), pp.1-15, 2019.

H. A. Rosenberg and K. G. Shin, Software fault injection and its application in distributed systems, Proceedings of the 23rd International Symposium on Fault-Tolerant Computing (FTCS), pp.208-217, 1993.

, Linux fault injection capabilities infrastructure

K. Cong, L. Lei, Z. Yang, and F. Xie, Automatic fault injection for driver robustness testing, Proceedings of the 2015 International Symposium on Software Testing and Analysis (ISSTA), pp.361-372, 2015.

V. S. Shekar, B. Meshram, and M. Varshapriya, Device driver fault simulation using KEDR, International Journal of Advanced Research in Computer Engineering and Technology, pp.580-584, 2012.

J. Bai, Y. Wang, J. Yin, and S. Hu, Testing error handling code in device drivers using characteristic fault injection, Proceedings of 2016 USENIX Annual Technical Conference, pp.635-647, 2016.

, LLVM compiler infrastructure

, Commit 471b83bd8bbe: forbid enslaving team device to itself in the team driver

, Commit cbcc607e1842: fix double free in error path in the team driver

, Linux kernel coding style

M. Mendonca and N. Neves, Robustness testing of the Windows DDK, Proceedings of the 37th International Conference on Dependable Systems and Networks (DSN), pp.554-564, 2007.

, Clang: a LLVM-based compiler for C/C++

, The kernel address sanitizer

, The kernel memory leak detector

, Commit 5bce256f0b52: usb: xhci: Fix a potential null pointer dereference

J. Erickson, M. Musuvathi, S. Burckhardt, and K. Olynyk, Effective data-race detection for the kernel, Proceedings of the 9th International Symposium on Operating Systems Design and Implementation (OSDI), pp.151-162, 2010.

C. Miller, How smart is intelligent fuzzing or how stupid is dumb fuzzing?, 2007.

, American Fuzzy Lop (AFL)

M. Böhme, V. Pham, and A. Roychoudhury, Coverage-based greybox fuzzing as markov chain, IEEE Transactions on Software Engineering (TSE), vol.45, pp.489-506, 2017.

S. Gan, C. Zhang, X. Qin, X. Tu, K. Li et al., CollAFL: path sensitive fuzzing, Proceedings of the 39th IEEE Symposium on Security and Privacy, pp.679-696, 2018.

C. Lemieux, R. Padhye, K. Sen, and D. Song, Perffuzz: automatically generating pathological inputs, Proceedings of the 27th International Symposium on Software Testing and Analysis (ISSTA), pp.254-265, 2018.

P. Godefroid, H. Peleg, and R. Singh, Learn&Fuzz: machine learning for input fuzzing, Proceedings of the 32nd International Conference on Automated Software Engineering (ASE, pp.50-59, 2017.

J. Wang, B. Chen, L. Wei, and Y. Liu, Skyfire: data-driven seed generation for fuzzing, Proceedings of the 38th IEEE Symposium on Security and Privacy, pp.579-594, 2017.

S. Rawat, V. Jain, A. Kumar, L. Cojocar, C. Giuffrida et al., VUzzer: application-aware evolutionary fuzzing, Proceedings of the 24th Network and Distributed Systems Security Symposium (NDSS, pp.1-14, 2017.

M. Böhme, V. Pham, M. Nguyen, and A. Roychoudhury, Directed greybox fuzzing, Proceedings of the 24th International Conference on Computer and Communications Security (CCS, pp.2329-2344, 2017.

S. Pailoor, A. Aday, and S. Jana, MoonShine: optimizing OS fuzzer seed selection with trace distillation, Proceedings of the 27th USENIX Security Symposium, pp.729-743, 2018.

S. Schumilo, C. Aschermann, R. Gawlik, S. Schinzel, and T. Holz, kAFL: hardware-assisted feedback fuzzing for OS kernels, Proceedings of the 26th USENIX Security Symposium, pp.167-182, 2017.

M. Mendonça and N. Neves, Fuzzing Wi-Fi drivers to locate security vulnerabilities, Proceedings of the 7th European Dependable Computing Conference (EDCC), pp.110-119, 2008.

C. Fu, B. G. Ryder, A. Milanova, and D. Wonnacott, Testing of Java web services for robustness, Proceedings of the 2004 International Symposium on Software Testing and Analysis (ISSTA), pp.23-34, 2004.

P. Joshi, H. S. Gunawi, and K. Sen, PREFAIL: a programmable tool for multiple-failure injection, Proceedings of the 26th International Conference on Object Oriented Programming Systems Languages and Applications (OOPSLA), pp.171-188, 2011.

P. D. Marinescu and G. Candea, LFI: a practical and general librarylevel fault injector, Proceedings of the 39th International Conference on Dependable Systems and Networks, pp.379-388, 2009.

S. Ghosh and J. L. Kelly, Bytecode fault injection for Java software, Journal of Systems and Software (JSS), vol.81, issue.11, pp.2034-2043, 2008.

R. Banabic and G. Candea, Fast black-box testing of system recovery code, Proceedings of the 7th European Conference on Computer Systems (EuroSys), pp.281-294, 2012.

C. Giuffrida, A. Kuijsten, and A. S. Tanenbaum, EDFI: A dependable fault injection tool for dependability benchmarking experiments, Proceedings of the 19th Pacific Rim Symposium on Dependable Computing, pp.31-40, 2013.

P. Zhang and S. Elbaum, Amplifying tests to validate exception handling code: an extended study in the mobile application domain, ACM Transactions on Software Engineering and Methodology (TOSEM), vol.23, issue.4, p.32, 2014.

N. Kikuchi, T. Yoshimura, R. Sakuma, and K. Kono, Do injected faults cause real failures? a case study of Linux, Proceedings of the 25th International Symposium on Software Reliability Engineering Workshops, pp.174-179, 2014.

A. Lanzaro, R. Natella, S. Winter, D. Cotroneo, and N. Suri, An empirical study of injected versus actual interface errors, Proceedings of the 2014 International Symposium on Software Testing and Analysis (ISSTA), pp.397-408, 2014.

R. Natella, D. Cotroneo, J. A. Duraes, and H. S. Madeira, On fault representativeness of software fault injection, IEEE Transactions on Software Engineering (TSE), vol.39, issue.1, pp.80-96, 2013.

R. Natella, D. Cotroneo, J. Duraes, and H. Madeira, Representativeness analysis of injected software faults in complex software, Proceedings of the 40th International Conference on Dependable Systems and Networks (DSN), pp.437-446, 2010.

A. Johansson, N. Suri, and B. Murphy, On the impact of injection triggers for OS robustness evaluation, Proceedings of the 18th International Symposium on Software Reliability Engineering, pp.127-126, 2007.

, On the selection of error model(s) for OS robustness evaluation, Proceedings of the 37th International Conference on Dependable Systems and Networks (DSN), pp.502-511, 2007.

H. Liu, Y. Wang, J. Bai, and S. Hu, PF-Miner: a practical paired functions mining method for Android kernel in error paths, Journal of Systems and Software (JSS), vol.121, pp.234-246, 2016.

H. S. Gunawi, C. Rubio-gonzález, A. C. Arpaci-dusseau, R. H. Arpaci-dusseau, and B. Liblit, EIO: error handling is occasionally correct, Proceedings of the 6th International Conference on File and Storage Technologies (FAST), pp.207-222, 2008.

S. Thummalapenta and T. Xie, Mining exception-handling rules as sequence association rules, Proceedings of the 31st International Conference on Software Engineering, pp.496-506, 2009.

S. Jana, Y. J. Kang, S. Roth, and B. Ray, Automatically detecting error handling bugs using error specifications, Proceedings of the 25th USENIX Security Symposium, pp.345-362, 2016.