Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix potential out-of-bound access #1751

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Conversation

mark14wu
Copy link

This PR fixes a bug in _scaled_int8_mm_kernel allowing unmasked tl.load() calls when K was even, but not necessarily a multiple of BLOCK_K, causing out-of-bounds reads. The fix changes the check to K % BLOCK_K == 0, ensuring unmasked loads occur only when the last block is fully valid.

Copy link

pytorch-bot bot commented Feb 21, 2025

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/ao/1751

Note: Links to docs will display an error until the docs builds have been completed.

⏳ No Failures, 1 Pending

As of commit 46fc72b with merge base 1c76736 (image):
💚 Looks good so far! There are no failures yet. 💚

This comment was automatically generated by Dr. CI and updates every 15 minutes.

@facebook-github-bot facebook-github-bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Feb 21, 2025
@mark14wu
Copy link
Author

cc @Jokeren

@Jokeren
Copy link
Contributor

Jokeren commented Feb 21, 2025

@mark14wu A clearer fix can be done using @triton.heuristics

@supriyar supriyar requested review from drisspg, gau-nernst and vkuzo and removed request for drisspg February 21, 2025 15:09
@gau-nernst
Copy link
Collaborator

Thank you for the interest! Didn't know there are people looking at this code 😄.

I copied this code from PyTorch Inductor though. Does that mean Inductor is susceptible to this bug too? (or inductor allocates padded tensors so it's not an issue?)

Like @Jokeren said, @triton.heuristic sounds like a good idea. We would want to keep a tl.constexpr there so that we don't do if for every iteration.

Another question. It seems like we might do out-of-bound reads for M and N dims too?

@Jokeren
Copy link
Contributor

Jokeren commented Feb 22, 2025

I copied this code from PyTorch Inductor though. Does that mean Inductor is susceptible to this bug too?

Yes indeed, but our tool, a triton sanitizer, cannot work for pytorch inductor at this moment. Hao may want to explore this direction when he starts intern at meta this summer.

It seems like we might do out-of-bound reads for M and N dims too?

M and N dims are safe because we have protections with rm%M and rn%N.

@mark14wu please go ahead refactor the code with triton.heuristic

@drisspg
Copy link
Contributor

drisspg commented Feb 22, 2025

There are ways to turn inductor code into triton only repos

@gau-nernst gau-nernst added the topic: bug fix Use this tag for PRs that fix bugs label Feb 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. topic: bug fix Use this tag for PRs that fix bugs
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants