Chasing Elusive Memory Bugs in GPU Programs

TL;DR

This paper introduces SCuBA, a compile-time analysis tool that detects elusive, input-dependent memory out-of-bounds bugs in GPU programs by analyzing semantic relations and logical partitioning, outperforming existing runtime tools.

Contribution

SCuBA is the first compile-time technique to identify input-dependent and intra-allocation OOBs in GPU programs using semantic relation analysis and SAT solving.

Findings

SCuBA detects all tested elusive OOBs with no false alarms.

Compared to NVIDIA's Compute Sanitizer, SCuBA misses none of 45 bugs.

SCuBA outperforms runtime tools in detecting complex memory bugs.

Abstract

Memory safety bugs, such as out-of-bound accesses (OOB) in GPU programs, can compromise the security and reliability of GPU-accelerated software. We report the existence of input-dependent OOBs in the wild that manifest only under specific inputs. All existing tools to detect OOBs in GPU programs rely on runtime techniques that require an OOB to manifest for detection. Thus, input-dependent OOBs elude them. We also discover intra-allocation OOBs that arise in the presence of logical partitioning of a memory allocation into multiple data structures. Existing techniques are oblivious to the possibility of such OOBs. We make a key observation that the presence (or absence) of semantic relations among program variables, which determines the size of allocations (CPU code) and those calculating offsets into memory allocations (GPU code), helps identify the absence (or presence) of OOBs. We build SCuBA, a first-of-its-kind compile-time technique that analyzes CPU and GPU code to capture such semantic relations (if present). It uses a SAT solver to check if an OOB access is possible under any input, given the captured relations expressed as constraints. It further analyzes GPU code to track logical partitioning of memory allocations for detecting intra-allocation OOB. Compared to NVIDIA's Compute Sanitizer that misses 45 elusive memory bugs across 20 programs, SCuBA misses none with no false alarms.