Fix container-overflow in split_with_sizes_copy_out_cuda#183777
Open
jeffdaily wants to merge 1 commit into
Open
Fix container-overflow in split_with_sizes_copy_out_cuda#183777jeffdaily wants to merge 1 commit into
jeffdaily wants to merge 1 commit into
Conversation
`block_idx_to_split_idx` was `reserve()`-d using a `num_blocks` count computed *before* `iters_per_chunk` was applied, then grown via `insert()` with the `iters_per_chunk`-scaled block count. This left `size() < capacity()`, so the trailing region inside the vector's allocated storage carried libstdc++'s ASAN container-overflow annotation. `pack_vecs` then memcpy'd `vec->data()` for `vec->size()` bytes — the access landed in the annotated region and ASAN flagged it. Compute the per-split block counts after `iters_per_chunk` is known, size the vector exactly to the total, and fill by index so `size() == capacity()` and no trailing annotation remains. Reproduced under an ASAN build of pytorch on ROCm; the bug is a real correctness latency masked by the standard libstdc++ allocator behavior on non-ASAN builds. Authored with Claude.
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/183777
Note: Links to docs will display an error until the docs builds have been completed. ❗ 1 Active SEVsThere are 1 currently active SEVs. If your PR is affected, please view them below: ❌ 1 Unclassified FailureAs of commit ca45f9c with merge base a1cc64b ( UNCLASSIFIED FAILURE - DrCI could not classify the following job because the workflow did not run on the merge base. The failure may be pre-existing on trunk or introduced by this PR:
This comment was automatically generated by Dr. CI and updates every 15 minutes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
block_idx_to_split_idxwasreserve()-d using anum_blockscount computed beforeiters_per_chunkwas applied, then grown viainsert()with theiters_per_chunk-scaled block count. This leftsize() < capacity(), so the trailing region inside the vector's allocated storage carried libstdc++'s ASAN container-overflow annotation.pack_vecsthen memcpy'dvec->data()forvec->size()bytes — the access landed in the annotated region and ASAN flagged it.Compute the per-split block counts after
iters_per_chunkis known, size the vector exactly to the total, and fill by index sosize() == capacity()and no trailing annotation remains.Reproduced under an ASAN build of pytorch on ROCm; the bug is a real correctness latency masked by the standard libstdc++ allocator behavior on non-ASAN builds.
Authored with Claude.