STANSE: Bug-finding Framework for C Programs

TL;DR

STANSE is an extensible static analysis framework for C programs that efficiently detects various bugs, including deadlocks and unreachable code, demonstrated on the Linux kernel with successful bug discovery.

Contribution

It introduces a modular, scalable framework capable of integrating multiple bug-finding algorithms with minimal effort, suitable for large software like the Linux kernel.

Findings

Found dozens of previously undiscovered bugs in the Linux kernel

Successfully processed large-scale C projects

Implemented four diverse bug detection algorithms

Abstract

STANSE is a free (available under the GPLv2 license) modular framework for finding bugs in C programs using static analysis. Its two main design goals are 1) ability to process large software projects like the Linux kernel and 2) extensibility with new bug-finding techniques with a minimal effort. Currently there are four bug-finding algorithms implemented within STANSE: AutomatonChecker checks properties described in an automata-based formalism, ThreadChecker detects deadlocks among multiple threads, LockChecker finds locking errors based on statistics, and ReachabilityChecker looks for unreachable code. STANSE has been tested on the Linux kernel, where it has found dozens of previously undiscovered bugs.