Google Project Zero releases MAccConc for Linux race condition testing

A researcher from Google Project Zero has released MAccConc (Memory Access Concurrency), a set of tools to explore thread interleavings in the Linux kernel. The suite includes an automated tool for A-B-A interleaving tests, a terminal UI, and a GUI for manual exploration. It leverages KASAN outline instrumentation and KCOV to trace memory accesses, aiming to improve bug confirmation, regression testing, and automated fuzzing.

Technical approach of MAccConc

• Uses KASAN outline instrumentation (via asan-instrumentation-with-call-threshold=0) to generate helper function calls on memory accesses.
• Employs KCOV to record memory access information due to its simpler in-memory representation compared to ftrace.
• Implements count-augmented stack traces to provide stable identifiers for memory accesses across different execution runs.
• Disables certain compiler optimizations (using asan-opt-same-temp) to ensure a callback is received for every single memory access.
• Provides three interfaces: an automated A-B-A interleaving tester, a TUI, and a GUI.

Why it matters

The tool aims to make race condition discovery more reliable for kernel developers and can be integrated into fuzzing workflows to find complex concurrency bugs.