Episodic Loops: Finitary Event Structures and Operational Semantics for C11 Programs with Retries

2026-09-28

AI Summary

This study addresses the state-space explosion and verification challenges arising from instruction reordering in the retry loops of lock-free algorithms. We propose a semantic abstraction termed "scenario loops" alongside a synchronization point mechanism. Grounded in the C11 memory model and SMRD symbolic event structures, we prove that infinite loops can be equivalently reduced to finite representations under specific conditions, thereby overcoming traditional verification bottlenecks. This theoretical framework is formally verified using Isabelle/HOL. Our approach enables automated verification with linear time complexity and successfully identifies and fixes a Use-After-Free vulnerability in the Linux kernel's RCU implementation.

Abstract

Lock-free synchronisation algorithms are often implemented with fallible operations, such as compare-and-swap (CAS), wrapped in unbounded retry loops. Verifying such algorithms requires considering arbitrarily many failing iterations, yielding large state spaces, compounded by the interleavings of concurrent threads. Prior work discarded failing iterations, arguing that they leave no trace in the post-loop state. Compilers and hardware reorder instructions, and load-store reorderings may cross the boundaries of failing iterations, introducing subtle concurrency bugs. We demonstrate one such bug, making use-after-free possible in a previously verified variant of Read-Copy-Update - a synchronisation primitive widely adopted in the Linux Kernel - and we provide and verify a fix. We find that practical retries in lock-free algorithms adhere to a common pattern. We introduce episodic loops, a semantic characterisation of unbounded retry loops which is syntactically recognisable in many practical cases, and synchronisation points, operations that bound both instruction reordering and state space within episodic loops. We show that SMRD - a symbolic event structure semantics for C11 programs which allows for load-store reordering - admits a finite representation in programs where unbounded loops are episodic. We further introduce a finitary operational semantics that allows safety properties to be verified in finitely many steps. For the use-after-free bug we demonstrate, verification takes a single pass over the program, linear in the program size. We provide a reference implementation of SMRD reproducing the bug and verifying the fix, and mechanise the operational semantics together with the minimal bug and its fix in Isabelle/HOL.

Problem

• lock-free algorithms
• unbounded retry loops
• instruction reordering
• concurrency bugs
• state space explosion

Innovation

• Episodic Loops
• Finitary Operational Semantics
• C11 Memory Model
• Lock-free Algorithms
• Load-Store Reordering