Chenxiong Qian

Precise and Scalable Detection of Double-Fetch Bugs in OS Kernels

2018

During system call execution, it is common for operating system kernels to read userspace memory multiple times (multi-reads). A critical bug may exist if the fetched userspace memory is subject to change across these reads, …

R1-Fuzz: Specializing Language Models for Textual Fuzzing via Reinforcement Learning

2025 · arXiv (Cornell University)

Fuzzing is effective for vulnerability discovery but struggles with complex targets such as compilers, interpreters, and database engines, which accept textual input that must satisfy intricate syntactic and semantic constraints. Although language models (LMs) have …