[test] sanitizer test

.github/lsan-suppressions.txt

@@ -0,0 +1,6 @@
+
+# Intel GPU OpenCL driver initialization allocations.
+leak:libigdrcl.so
+
+# Intel OpenCL adapter queue/event/context leaks reported at process exit.
+leak:libur_adapter_opencl.so

.github/tsan-suppressions.txt

@@ -0,0 +1,22 @@
+# Prebuilt Intel CPU OpenCL runtime: worker mutex publication and JIT memset
+# versus allocation. Reproduced with a pure C++ queue.memset(...).wait().
+# The exact libc++ mutex symbol is bundled in libintelocl; TSan cannot restrict
+# a symbol match to that module, so this also excludes other libc++ mutex::lock calls.
+race:^std::__1::mutex::lock()$
+race:^Intel::OpenCL::Utils::clAllocateFromHeap(
+
+# Prebuilt SYCL runtime: host-task completion versus event/queue destruction.
+# Reproduced in pure C++ even with queue.wait() before destruction. Internal
+# atomic shared_ptr synchronization is not visible to TSan in these binaries.
+race:^sycl::_V1::detail::Scheduler::NotifyHostTaskCompletion(
+race:^sycl::_V1::detail::event_impl::cleanupDependencyEvents(
+race:^sycl::_V1::detail::Command::~Command(
+
+# Native-only reproduction: copy a host-task event, wait, then release the queue
+# and event copies. The native event destructor frees a shared_ptr control block
+# whose preceding reference-count decrement was in instrumented application code.
+race:^sycl::_V1::detail::event_impl::~event_impl(
+
+# Keep these symbol-scoped: never suppress all of libsycl, the OpenCL adapter,
+# free, memset, pthread calls, or the Rust/C++ shim. Revalidate on toolkit updates
+# and remove entries when TSan-instrumented native runtimes are available.

.github/workflows/basic.yml

@@ -86,6 +86,69 @@ jobs:
         name: documentation
         path: target/doc
 
+  hardening:
+    if: github.event_name != 'schedule'
+    runs-on: ["oneapi-rs", "Linux"]
+
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+    - name: Setup oneAPI
+      uses: ./.github/actions/setup-oneapi
+
+    - name: Install nightly toolchain
+      run: rustup toolchain install nightly --profile minimal
+
+    - name: Build and test with hardening flags
+      env:
+        RUSTFLAGS: -Zemit-stack-sizes -Zcf-protection=full
+        CARGO_TARGET_DIR: target/hardened
+      run: |
+        cargo +nightly test --workspace --verbose
+        cargo +nightly build --workspace --release --verbose
+
+  sanitizers:
+    name: Sanitizer (${{ matrix.sanitizer }})
+    if: github.event_name != 'schedule'
+    runs-on: ["oneapi-rs", "Linux"]
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address, leak, thread]
+    env:
+      CARGO_TARGET_DIR: target/sanitizer-${{ matrix.sanitizer }}
+
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+    - name: Setup oneAPI
+      uses: ./.github/actions/setup-oneapi
+
+    - name: Install nightly toolchain
+      run: rustup toolchain install nightly --profile minimal
+
+    - name: Install standard library sources for ThreadSanitizer
+      if: matrix.sanitizer == 'thread'
+      run: rustup component add rust-src --toolchain nightly
+
+    - name: Run tests with sanitizers
+      env:
+        # Test only CPU to avoid issues with GPU drivers and sanitizers
+        ONEAPI_DEVICE_SELECTOR: opencl:cpu
+        # Leave leak detection to the dedicated leak sanitizer job.
+        ASAN_OPTIONS: detect_leaks=0
+        LSAN_OPTIONS: suppressions=${{ github.workspace }}/.github/lsan-suppressions.txt
+        TSAN_OPTIONS: suppressions=${{ github.workspace }}/.github/tsan-suppressions.txt
+        RUSTFLAGS: -Zsanitizer=${{ matrix.sanitizer }}
+      run: |
+        if [ "${{ matrix.sanitizer }}" = thread ]; then
+          # Instrument the C++ host shim, not SYCL device code.
+          export CXX=icpx
+          export CXXFLAGS="-Xarch_host -fsanitize=thread"
+        fi
+        cargo +nightly test ${{ matrix.sanitizer == 'thread' && '-Zbuild-std' || '' }} \
+          --workspace --lib --tests --target x86_64-unknown-linux-gnu --verbose
+
   trivy:
     name: Trivy scan
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -24,6 +24,8 @@ can be found at: <https://docs.rs/sycl_rs/>
 
 - Initial Rust API for discovering SYCL platforms and devices.
 - Queues, events, contexts, USM allocations, and host/device memory operations.
+- Dropping a `UsmBox` waits for the copies and fills that use it, so its
+  memory is not freed while a device may still use it.
 - Runtime kernel bundle compilation and one-, two-, and three-dimensional
   kernel launch support.
 - Derive support for typed kernel argument lists.

sycl/sycl-rs/src/lib.rs

@@ -90,9 +90,10 @@
 //! ```
 //!
 //! # Safety model
-//! - USM allocations are represented by a zero-cost [`UsmBox`](crate::usmbox::UsmBox) type managed
-//!   through RAII.
+//! - USM allocations are represented by a [`UsmBox`](crate::usmbox::UsmBox) type managed through
+//!   RAII.
 //!   - Note: `UsmBox` arrays do not rely on accessors, unlike SYCL buffers.
+//!   - Dropping a `UsmBox` waits for the copies and fills that use it to complete.
 //! - `UsmBox`es are zero-initialized by default.
 //! - `UsmBox`es can only store types that implement [`bytemuck::Pod`].
 //! - Kernel launch is inherently unsafe. In particular, the caller must ensure that every argument

sycl/sycl-rs/src/queue.rs

@@ -140,7 +140,10 @@ impl Queue {
                 ptr: (*e).clone().0,
             })
             .collect::<Vec<_>>();
-        unsafe { ffi::memset(&mut self.0, ptr, value, num_bytes, dep_events) }.map(Into::into)
+        let event: Event =
+            unsafe { ffi::memset(&mut self.0, ptr, value, num_bytes, dep_events) }?.into();
+        array.add_pending(&event);
+        Ok(event)
     }
 
     /// Submits a barrier to the queue.
@@ -228,16 +231,19 @@ impl Queue {
             .collect::<Vec<_>>();
 
         let num_bytes = src.get_len() * size_of::<T>();
-        unsafe {
+        let event: Event = unsafe {
             ffi::memcpy(
                 &mut self.0,
                 dst.get_byte_ptr(),
                 src.get_byte_ptr(),
                 num_bytes,
                 dep_events,
             )
-        }
-        .map(Into::into)
+        }?
+        .into();
+        src.add_pending(&event);
+        dst.add_pending(&event);
+        Ok(event)
     }
 }