Skip to content

permute_nd reads out of bounds for tensors of rank > 8 #26

Description

@CanReader

cuda/kernels.cu:604:

struct PermuteNDParams { int out_strides[8]; int in_strides[8]; int perm[8]; int ndim; };
...
params.ndim = ndim;                       // full rank, uncapped
for (int i = 0; i < ndim && i < 8; i++)   // copy capped at 8

The kernel then loops for (d = 0; d < params.ndim; d++), so a rank 9 tensor reads
out_strides[8], which in that struct layout is in_strides[0], and computes a
garbage source index. No error, just a wrong result or a delayed illegal access.

Nothing on the Rust side (kernels::permute_nd) caps the rank either.

Return a non zero status when ndim > 8 and assert it in kernels::permute_nd so
it comes back as Error::Cuda.

Metadata

Metadata

Assignees

No one assigned

    Labels

    P1Crashes or silent divergencearea:cudabugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions