pytorch / pytorch/audio

Pointer arithmetic bug in `first_matrix__bitonic_topk_kernel` causes shared memory out-of-bounds write

Open
#4,181 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
2.9k
Forks
799
Avg merge
58m
Merged PRs (30d)
3

Description

🐛 Describe the bug

Bug

There is a pointer arithmetic bug in src/libtorchaudio/cuctc/src/ctc_prefix_decoder_kernel_v2.cu (line 298) that causes out-of-bounds shared memory writes.
The bug is latent on most GPU architectures but produces incorrect results or crashes on NVIDIA H100 due to stricter shared memory bounds checking.

Location

float* block_topk_key =
    reinterpret_cast<float*>(smem_buf_bytes + smem_result_byte_offset);
int* block_topk_value =
    reinterpret_cast<int*>(block_topk_key + sizeof(float) * beam);  // ← BUG

impact

  • A10 / A100: The out-of-bounds write silently lands on physically present but unallocated shared memory regions. Tests pass, but results may be subtly incorrect.
  • H100: Stricter shared memory bounds checking causes data corruption, leading to incorrect CTC decoding results or kernel failures.

Root Cause

block_topk_key is a float*. Pointer arithmetic operates in units of the pointed-to type, not bytes. Adding sizeof(float) * beam to a float* advances by sizeof(float) × sizeof(float) × beam = 16 × beam bytes, instead of the intended sizeof(float) × beam = 4 × beam bytes.

Solution

int* block_topk_value =
    reinterpret_cast<int*>(block_topk_key + beam);
Versions

main

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at line 298 of src/libtorchaudio/cuctc/src/ctc_prefix_decoder_kernel_v2.cu and inspect the shared-memory pointer arithmetic in first_matrix__bitonic_topk_kernel. Verify the corrected offset against the allocated buffer and validate that CTC decoding no longer produces corruption or kernel failures on H100.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
backend, performance
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.