Chronos: Finding Timeout Bugs in Practical Distributed Systems by Deep-Priority Fuzzing with Transient Delay

Yuanliang Chen, Fuchen Ma, Yuanhang Zhou, Ming Gu, Qing Liao, Yu Jiang. 2024. IEEE Symposium on Security and Privacy.

Read the paper · doi:10.1109/sp54263.2024.00109

What this paper does with SQLancer

SQLancer serves as a workload generator, not an oracle: it produces the SQL workload used to exercise MySQL-Cluster while Chronos injects delays around it. The artifact carries SQLancer source content, consistent with it being bundled for that purpose. The bugs reported are timeout bugs found by delay injection, not logic bugs found by a SQLancer oracle. Chronos automatically finds timeout bugs in distributed systems, where incorrect timeout handling can hang or crash a system. It injects fine-grained delays through general runtime delayed libraries, uses deep-priority guided fuzzing to reach bugs on deep paths, and applies transient delays so the test does not pay the wall-clock cost of really waiting. On ZooKeeper, MySQL-Cluster, HDFS and Go-Ethereum it found 27 timeout bugs, all repaired. Written by claude-opus-5 from the 1 place this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — yes (workload)

M1 states the MySQL-Cluster workload is generated by SQLancer, described as one of the widely used SQL generators for testing database systems. That is reuse to produce input for a different system rather than building on SQLancer, which is why the kind is recorded as workload.

For MySQL-Cluster, the workload is generated by SQLancer [57], one of the widely used SQL generators for testing database systems. M1 · 5 Implementation · page 8

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

Its artifact

SecTechTool/Chronos carries sqlancer source content match.

Repository is named after Chronos, the tool this paper says it built, and is about database testing.
# Chronos: An Automatical Testing Framework for Finding Timeout Bugs in Distributed Systems by Self-Adaptive Delay Model.
source

workload/mysql-cluster/sqlancer/src/sqlancer/Randomly.java is SQLancer's Randomly.java (8 of 8 identifiers match: StringGenerationStrategy, SOPHISTICATED, cachedLongs, cachedStrings, cachedDoubles).
private static StringGenerationStrategy stringGenerationStrategy = StringGenerationStrategy.SOPHISTICATED;
source

SQLancer publications it cites (1)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
57	M. Rigger and Z. Su, “Testing database engines via pivoted query synthesis.” in OSDI, vol. 20, 2020, pp. 667–682. 1953	sqlancer publication · PQS

Every place it refers to SQLancer (1)

1 sentence, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	For MySQL-Cluster, the workload is generated by SQLancer [57], one of the widely used SQL generators for testing database systems.	name reuse component	5 Implementation page 8

This page is rendered from _data/papers/paper_doi_10_1109_sp54263_2024_00109.json, extracted from supplied pdf. 17 pages, 81 references parsed.