SysConDB: Verified and Reproducible System-Level Concurrency Bugs Dataset

# System-Level Concurrency Bug Reproduction & Localization In this project, we provide a systematic approach to reproduce and localize concurrency bugs in system-level software. The project includes: - Detailed reproduction steps - PIN tool for monitoring system calls - Analysis of available information - Code references for affected components ## Repository Structure ``` . ├── bugs/ │ ├── bugzilla/ # Red Hat Bugzilla bug reproductions (27 bugs) │ ├── debian/ # Debian BTS bug reproductions (15+ bugs) │ ├── gnu/ │ └── gnu-savannah/ ├── components/ # Source archives of affected software ├── misc/ │ ├── pintool.cpp │ └── REPORT.md ``` Each bug entry follows: ``` bugs/<source>/<bug-id>/ ├── README.md ├── Dockerfile ├── repro.sh ├── trace.sh └── pintool.cpp ``` Redhat Bugzilla SN Bug ID Target Pair System Call File Buggy Loc. 1, 2 155758, 155760 mkdir -m 400 foo rm -rf foo; ln -s bar foo mkdir(83); chmod(90) mkdir.c main; 161:189 3 438076 mv bar foo cat foo unlink(87); rename(82) copy.c copy_internal: 1295; 1426 4, 5 1141368, 1166570 mv a b mv b a lstat(6); unlink(87) copy.c copy_internal: 1807; 1887 6 1182024 pxz foo ls -l foo.xz openat(257); chmod(90) pxz.c main: 300, 442 7 1211300 rm -rf foo cd foo; mv bar/ bar.bak; ln -s ../qux bar newfstatat(262); openat(257) fts.c fts_build; 306, 309 8, 9 155742, 155744 bzip2 -d foo.txt.bz2 rm foo.txt; ln bar.txt foo.txt openat(257); chmod(90) bzip2.c fopen_output_safely; 1043, applySavedMetaInfoTo...; 1137 10, 11, 12 155745, 155746, 157696 gzip -d foo.gz rm foo; ln -s bar foo openat(257); chmod(90) gzip.c create_outfile: 879; copy_stat: 1627 13 680798 logrotate -f config.conf cat /var/log/testapp/app.log openat(257); fchmod(91) logrotate.c createOutputFile: 192; 198 14 847339 logrotate -f config.conf cat /var/log/testapp/app.log openat(257); fchmod(91) logrotate.c createOutputFile: 192; 198 15, 16 1532284, 1532285 chown -R -L user:user foo ln -s -f bar foo/baz/qux stat(4); fchownat(260) chown-core.c 84; 98 17, 18 680789, 680790 logrotate -f config.conf ln -sf target /path/to/log openat(257); fchmod(91)/fchown logrotate.c createOutputFile: 192; 198 19, 20 157498, 157499 wget /url/to/foo ln -sf bar foo openat(257); write(1) 21 45647 logrotate -f config.conf logrotate -f config.conf openat(257); rename(82) logrotate.c prerotateSingleLog: 950 22 680787 logrotate -f config.conf cat /var/log/testapp/app.log logrotate.c 23, 24 2232278, 2232514 find f -ignore_readdir_race -type d rmdir f/dir newfstatat(262); openat(257) fts.c, openat-safer.c fts_stat: 1819; openat_safer: 45 25 884685 luserdel -r username rm -rf foo/sub; ln -s bar foo/sub lstat(6); openat(257) apputil.c lu_homedir_remove: 383; 357 26, 27 2222604, 2223893 curl -c foo /url/to/foo rm -f foo; ln -s bar foo stat(4); openat(257) 28 711642 bash touch file{1..10000}.txt keyboard interrupt - - - 29 517321 logrotate -f logrotate.conf anacron -s -d - - - GNU SN Bug ID Target Pair System Call File Buggy Loc. 1 18499 ln foo bar; mv a b mv b a lstat(6); unlink(87) copy.c copy_internal; 1807, 1887 2 23539 tail -F foo mv bar foo inotify_add_watch(254); read(0) tail.c 1208; 1222 3 25342 ln -f src dest cat dest linkat(265); unlinkat(87) ln.c 305; 330 4 13352 cp -pPR foo bar seq 4 | cp -pPR foo bar mkdir; write copy.c 2156; 2158 5 45371 rm -rf --preserve-root=all --one-file-system dfoo bindfs --no-allow-other dbar dfoo stat(4); unlinkat(263) fts.c, remove.c 310 (fts.c); 370 (remove.c) 6, 7, 8 32772, 11108, 18280 chmod -R u=u /tmp/a mv /tmp/a/b/c noc; ln -s bar /tmp/a/b/c fchmodat(268); openat(257) chmod.c main: 273; 373 9, 10 11100, 11074 cp source dest rm dest stat(6); openat(257) copy.c, open_safer.c copy_internal: 1661; open_safer: 45 11 25680 cp -afl a b seq 2 | cp -afl a b lstat(6); linkat(265) copy.c 1789; 1795 12, 13 45930(s), 26349(s) find f -ignore_readdir_race -type d rmdir f/dir newfstatat(262); openat(257) fts.c, openat-safer.c fts_stat: 1819; openat_safer: 45 14 33096 ln foo bar touch bar lstat(6); linkat(265) ln.c do_link: 196; 328 15, 16 29961, 30907 mv -n foo bar chmod 000 bar lstat(6); rename(82) copy.c copy_internal: 1921; 2329 17 61105 cp -n foo bar chmod 777 bar openat(257); copy_file_range(326) copy.c copy_internal: 1443; 1585 18 12947 install -m 0600 foo bar cat bar openat(257); chmod(90) install.c install_file_in_file: 740; 807 19 47380 install -c -m 0755 foo bar chmod 000 bar openat(257); write(1) copy.c copy_internal: 1120; 1294 20 22057(s) updatedb --output=/path/to/db locate -d /path/to/db unlink(87); rename(82) updatedb.sh 21 10679 mv --backup=t bar foo cat foo rename(82); rename(82) copy.c copy_internal: 1512; 1713 22 51793 env timeout --verbose --kill-after=.1 --signal=INT .1 env --ignore-signal sleep 10 no need - - - 23 34713 mv a /t/ae mv b/* a - - - 24 21460 tail --follow=foo cat foo - - - (s) means collected from GNU Savannah* Debian SN Bug ID Target Pair System Call File Buggy Loc. 1 775306 pxz foo ls -l foo.xz openat(257); chmod(90) pxz.c main: 300, 443 2 304556 mkdir -m 400 foo ls -l foo.xz mkdir(83); chmod(90) mkdir.c main; 162, 190 3 841371 install -o myuser -m 0777 foo bar ln -s bar victim openat(257); lchown(94)/chmod(90) install.c install_file_in_file; 690; 484/486 4 303300 bzip2 -d foo.txt.bz2 rm foo; ln bar foo openat(257); chmod(90) bzip2.c fopen_output_safely; 1043, applySavedMetaInfoToOutputFile; 1137 5 56386 bzip2 foo rm foo.bz2; ln bar foo.bz2 openat(257); chmod(90) bzip2.c compress; 998, copyDatePermissionsAndOwner; 837 6 303927 gzip foo; gzip -d foo.gz rm -f foo; ln bar.txt foo openat(257); chmod(90) gzip.c create_outfile: 930; copy_stat: 1728 7 548439 tail -F foo mv bar foo inotify_add_watch(254); read(0) tail.c 1208; 1222 8 283702 seq 3 | bash -i no need openat(257); write(1) histfile.c 9 461585 updatedb --output=/path/to/db locate -d /path/to/db unlink(87); rename(82) updatedb.sh 10 357140 ln -sf foo bar rm -f bar symlink(88); unlink(87) ln.c do_link: 287; 310 11 500395 wget -nc /url/to/file wget -nc /url/to/file; wget -nc /url/to/file stat(4); openat(257) utils.c, http.c main 12 836503 wget -r -nH -A '*.jpg' /url/to/malicious.php cat malicious.php openat(257); unlink(87) http.c, recur.c 2927; 436 13 67782 find dfoo -ls rm -f dfoo/bar getdents64(217); newfstatat(262) 14 308622 wget -P /path/to/dir /url/to/file ln -sf target_file newfstatat(262); openat(257) http.c utils.c: 567; http.c: 2582 15 388608 logrotate -f config.conf cat /var/log/testapp/app.log openat(257); fchmod(90) logrotate.c createOutputFile: 192; 198 16 400198 logrotate -f config.conf ls -la /var/log/testapp/app.log openat(257); fchown(93) logrotate.c createOutputFile: 192; 203 17 639302 logrotate -f config.conf cat /var/log/testapp/app.log openat(257); fchmod(90) logrotate.c createOutputFile: 192; 198 18 321927 unzip -o target.zip -d output ln target /exploit/output/secret.txt close(3); chmod(90) unix.c close_outfile: 1249; 1268 19 624219 - - - ## References - [Red Hat Bugzilla](https://bugzilla.redhat.com) - [Debian Bug Tracker](https://bugs.debian.org) - [GNU Savannah](https://savannah.gnu.org/bugs) - [Intel PIN](https://www.intel.com/content/www/us/en/developer/articles/tool/pin-a-dynamic-binary-instrumentation-tool.html)