Skip to content

[ET-VK] Fix embedding_q4gsw out-of-bounds access with dynamic shapes#18584

Merged
SS-JIA merged 1 commit intomainfrom
gh/SS-JIA/513/orig
Mar 30, 2026
Merged

[ET-VK] Fix embedding_q4gsw out-of-bounds access with dynamic shapes#18584
SS-JIA merged 1 commit intomainfrom
gh/SS-JIA/513/orig

Conversation

@pytorchbot
Copy link
Copy Markdown
Collaborator

This PR was created by the merge bot to help merge the original PR into the main branch.
ghstack PR number: #18558 by @SS-JIA
^ Please use this as the source of truth for the PR details, comments, and reviews
ghstack PR base: https://github.com/pytorch/executorch/tree/gh/SS-JIA/513/base
ghstack PR head: https://github.com/pytorch/executorch/tree/gh/SS-JIA/513/head
Merge bot PR base: https://github.com/pytorch/executorch/tree/main
Merge bot PR head: https://github.com/pytorch/executorch/tree/gh/SS-JIA/513/orig
Differential Revision: D98642319
@diff-train-skip-merge

The embedding_q4gsw shader used push constants for num_indices,
out_height, and embed_dim that were captured at graph build time and
never updated when input tensors were dynamically resized. This caused
out-of-bounds GPU memory reads when the actual input was smaller than
the initial allocation, resulting in VK_ERROR_DEVICE_LOST on Mali GPUs.

The fix derives all shape-dependent values (embed_dim, out_height,
num_indices) from the output tensor's sizes UBO, which is automatically
updated on resize. Only truly constant values (group_size,
is_linear_weight) remain as push constants.

Root cause: With a 7-token input on a graph built for 256 tokens, the
local workgroup rounding created an extra thread (y=7) that passed the
stale bounds check (7 >= 256 == false) and read past the 7-element
indices buffer.

Differential Revision: [D98642319](https://our.internmc.facebook.com/intern/diff/D98642319/)

ghstack-source-id: 359350851
Pull Request resolved: #18558
@pytorchbot pytorchbot requested a review from SS-JIA as a code owner March 30, 2026 16:43
@pytorch-bot
Copy link
Copy Markdown

pytorch-bot Bot commented Mar 30, 2026

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/18584

Note: Links to docs will display an error until the docs builds have been completed.

⏳ No Failures, 137 Pending

As of commit 8b709dd with merge base 24751f1 (image):
💚 Looks good so far! There are no failures yet. 💚

This comment was automatically generated by Dr. CI and updates every 15 minutes.

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Mar 30, 2026
@github-actions
Copy link
Copy Markdown

This PR needs a release notes: label

If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.

To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"

For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.

@SS-JIA SS-JIA merged commit d7cc5d7 into main Mar 30, 2026
158 of 162 checks passed
@SS-JIA SS-JIA deleted the gh/SS-JIA/513/orig branch March 30, 2026 16:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants