Catching Spatial Corruption Before It Spreads

CuSafe's spatial-safety question is precise: can a pointer-derived access be shown to remain inside the object it is meant to address? This chapter follows the answer through two gates. First, CuSafe checks that pointer arithmetic has not damaged the metadata needed to identify the buffer. Then it retrieves the buffer's exact bound and checks the requested range. That separation explains both why aligned-size tags are useful and why they are not sufficient by themselves.

The same mechanism also reveals the design's practical boundaries. A pointer can be temporarily formed outside a valid range without being dereferenced, so CuSafe does not treat every intermediate value as an immediate fatal error. And a compiler that inserts a check before every access would create avoidable work. The design therefore combines precise failure conditions with analysis that removes checks only when their safety implication is already established.

Alignment is lookup, not permission

An aligned-size tag gives CuSafe a compact way to organize pointer metadata. The tag represents an alignment class rather than the exact size requested by the program. When a pointer refers to some position within a buffer, the checker uses the tag to clear the relevant offset bits and reach the beginning of that buffer. The operation is a route to metadata: it identifies where the exact bound can be found.

That distinction matters because allocation sizes are not all powers of two. Suppose a program asks for a buffer whose requested size falls between two alignment boundaries. The pointer can carry the larger alignment class, but the larger class includes space that is not part of the actual object. If an access goes past the requested end but remains inside that rounded region, a checker that relied only on the aligned size would approve a real out-of-bounds access. CuSafe stores the precise bound in-band at the buffer's beginning so the final comparison uses the allocation's actual extent.

The resulting check is closer to a two-step address calculation than to a single comparison. The pointer supplies enough structure to locate the metadata anchor. The buffer supplies the exact boundary. A pointer to the middle of an allocation can still be checked because clearing the appropriate offset bits leads back to the same anchor. But that procedure is safe only while the pointer's protected metadata remains intact. The tag is both a lookup aid and a condition for trusting the lookup.

Consider a strided tensor kernel. One thread may read an element near the beginning of a buffer while another reads near the end, and the two addresses need not carry the same offset. CuSafe's design aims for both pointers to recover the same buffer-side bound rather than asking each thread to consult a separate description of its address. Once the common bound is retrieved, the checker can judge each requested range against the same object boundary. The tag therefore helps scale one object-level fact across many data offsets; it does not turn each offset into an independent allocation.

This design addresses a subtle failure in simple alignment-based schemes. The dangerous access is not always an enormous jump into obviously unrelated memory. It can be a small write into padding that the allocator introduced only to satisfy alignment.