Skip to content

Fix null pointer dereference in MethodMeta::uses_backend() - #22405

Open
bharqav wants to merge 2 commits into
pytorch:mainfrom
bharqav:fix/method-meta-uses-backend-null-deref
Open

Fix null pointer dereference in MethodMeta::uses_backend()#22405
bharqav wants to merge 2 commits into
pytorch:mainfrom
bharqav:fix/method-meta-uses-backend-null-deref

Conversation

@bharqav

@bharqav bharqav commented Sep 1, 2026

Copy link
Copy Markdown

Fixes #22404

Summary

MethodMeta::uses_backend() dereferenced ExecutionPlan::delegates() without a null check. Per schema/program.fbs, delegates has no default and can be legitimately unset. num_backends(), six lines below in the same file, already guards this exact condition — this PR applies the same guard to uses_backend().

See #22404 for the full root-cause writeup, reproduction, and crash output.

Test plan

Added MethodMetaTest.UsesBackendOnUnsetDelegatesReturnsFalse to runtime/executor/test/method_meta_test.cpp, constructing a minimal, self-contained, schema-valid Program (via flatbuffers::FlatBufferBuilder + BufferDataLoader) where delegates is left unset, then asserting uses_backend() returns false instead of crashing.

Verified locally (Clang, Debug, -fsanitize=address,undefined):

  • Without the fix: the new test crashes with an ASan/UBSan SIGSEGV on flatbuffers::Vector::size() inside uses_backend().
  • With the fix: the new test passes, and the full method_meta_test suite (7/7 tests) passes with no regressions.
  • Also ran the neighboring program_test, method_test, and memory_manager_test suites via ctest — all passing, no side effects from this change.

Commands used:

cmake --build build-test --target method_meta_test
.\build-test\runtime\executor\test\method_meta_test.exe
ctest --test-dir build-test -R "method_meta_test|memory_manager_test|program_test|method_test" --output-on-failure

MethodMeta::uses_backend() dereferenced ExecutionPlan::delegates()
without a null check. Per schema/program.fbs, delegates has no
default and can be legitimately unset. num_backends(), six lines
below, already guards this exact condition — apply the same guard
to uses_backend().

Fixes pytorch#22404
Copilot AI lite review requested due to automatic review settings September 1, 2026 10:45
@pytorch-bot

pytorch-bot Bot commented Sep 1, 2026

Copy link
Copy Markdown

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/22405

Note: Links to docs will display an error until the docs builds have been completed.

⚠️ 20 Awaiting Approval

As of commit be0f8d1 with merge base 5428092 (image):

AWAITING APPROVAL - The following workflows need approval before CI can run:

This comment was automatically generated by Dr. CI and updates every 15 minutes.

@meta-cla

meta-cla Bot commented Sep 1, 2026

Copy link
Copy Markdown

Hi @bharqav!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!

@linux-foundation-easycla

linux-foundation-easycla Bot commented Sep 1, 2026

Copy link
Copy Markdown

CLA Signed
The committers listed above are authorized under a signed CLA.

  • ✅ login: bharqav / name: bharqav (83da422)

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens MethodMeta::uses_backend() against schema-valid programs where ExecutionPlan.delegates is unset, preventing a null-pointer dereference in the runtime. It also adds a regression test that constructs a minimal FlatBuffer Program with delegates == nullptr and verifies uses_backend() returns false rather than crashing.

Changes:

  • Add a null check in MethodMeta::uses_backend() for ExecutionPlan::delegates() == nullptr.
  • Add a new MethodMetaTest that loads a schema-valid FlatBuffer program with unset delegates and asserts uses_backend() returns false.
  • Initialize the runtime in the test fixture setup to avoid PAL timer issues when logging is triggered during tests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File Description
runtime/executor/method_meta.cpp Adds a null guard for delegates in MethodMeta::uses_backend() to prevent a crash on unset delegates.
runtime/executor/test/method_meta_test.cpp Adds a regression test that loads a minimal FlatBuffer program with delegates left unset and validates uses_backend() behavior; adds runtime initialization for tests.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread runtime/executor/method_meta.cpp
Comment thread runtime/executor/test/method_meta_test.cpp Outdated
Comment on lines +15 to +20
#include <executorch/extension/data_loader/buffer_data_loader.h>
#include <executorch/extension/data_loader/file_data_loader.h>
#include <executorch/runtime/core/exec_aten/exec_aten.h>
#include <executorch/runtime/executor/program.h>
#include <executorch/runtime/platform/runtime.h>
#include <executorch/schema/program_generated.h>

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed, added //executorch/extension/data_loader:buffer_data_loader and //executorch/schema:program to the method_meta_test deps in targets.bzl.

Comment on lines +286 to +289
TEST_F(MethodMetaTest, UsesBackendOnUnsetDelegatesReturnsFalse) {
// Construct a minimal schema-valid FlatBuffer program where delegates is
// unset (nullptr).
flatbuffers::FlatBufferBuilder fbb;

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

right, method_meta_test was disabled behind TODO(T191569140). Re-enabled it in CMakeLists.txt with the required extension_data_loader/program_schema libs.

@bharqav

bharqav commented Sep 1, 2026

Copy link
Copy Markdown
Author

@pytorchbot label "release notes: runtime"

@pytorch-bot pytorch-bot Bot added the release notes: runtime Changes related to the core runtime which loads the program methods, initializes delegates, and runs label Sep 1, 2026
…re Buck deps, enable method_meta_test in CMake

- uses_backend(): skip delegate entries with null delegate or null id,
  same class of issue as the original delegates==nullptr fix
- test: use Program::kMinHeadBytes instead of hardcoded 64
- targets.bzl: add buffer_data_loader and schema:program deps needed
  by the new test
- CMakeLists.txt: re-enable method_meta_test (was disabled behind
  TODO(T191569140)) and add the missing ModuleAddWithDevice.pte
  generation step, so the regression test is actually buildable and
  runnable from a clean checkout
Copilot AI review requested due to automatic review settings September 1, 2026 11:04
@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Sep 1, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

@JakeStevens
JakeStevens self-requested a review September 1, 2026 13:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. release notes: runtime Changes related to the core runtime which loads the program methods, initializes delegates, and runs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

MethodMeta::uses_backend() crashes (null pointer deref) on non-delegated programs

3 participants