An Alarm Classification Using Shovel

'_prologue_' is an imaginary function that initialize argc, argv

Solid arrow means call edge

Dotted arrow means return edge

Green arrow means branch (pair of call & return)
(For details, see II-A.'Backbone-Branch Decomposition' section of our paper)

Alarm #1

+ Taint Source : blkparse.c:2115 (read_data)
+ Sink (Allocation) : blkparse.c:605 (handle_notify)

path 1

(User Feedback)

Path should NOT have an incoming edge to 'handle_notify', because tainted data cannot flow through the node

UNSAT (False Alarm)

Alarm #2

+ Taint Source : blkparse.c:2115 (read_data)
+ Sink (Allocation) : blkparse.c:2344 (ms_prime)

path 1

(User Feedback)

Path should NOT have an incoming edge to 'ms_prime', because tainted data cannot flow through the node

UNSAT (False Alarm)

Alarm #3

+ Taint Source : blkparse.c:2115 (read_data)
+ Sink (Allocation) : blkparse.c:2197 (read_events)

path 1

(User Feedback)

Path should NOT have an incoming edge to 'read_events', because tainted data cannot flow through the node

UNSAT (False Alarm)