Fix null pointer dereference in MethodMeta::uses_backend() - #22405
Fix null pointer dereference in MethodMeta::uses_backend()#22405bharqav wants to merge 2 commits into
Conversation
MethodMeta::uses_backend() dereferenced ExecutionPlan::delegates() without a null check. Per schema/program.fbs, delegates has no default and can be legitimately unset. num_backends(), six lines below, already guards this exact condition — apply the same guard to uses_backend(). Fixes pytorch#22404
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/22405
Note: Links to docs will display an error until the docs builds have been completed.
|
|
Hi @bharqav! Thank you for your pull request and welcome to our community. Action RequiredIn order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you. ProcessIn order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA. Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks! |
|
|
There was a problem hiding this comment.
Pull request overview
This PR hardens MethodMeta::uses_backend() against schema-valid programs where ExecutionPlan.delegates is unset, preventing a null-pointer dereference in the runtime. It also adds a regression test that constructs a minimal FlatBuffer Program with delegates == nullptr and verifies uses_backend() returns false rather than crashing.
Changes:
- Add a null check in
MethodMeta::uses_backend()forExecutionPlan::delegates() == nullptr. - Add a new
MethodMetaTestthat loads a schema-valid FlatBuffer program with unsetdelegatesand assertsuses_backend()returnsfalse. - Initialize the runtime in the test fixture setup to avoid PAL timer issues when logging is triggered during tests.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| runtime/executor/method_meta.cpp | Adds a null guard for delegates in MethodMeta::uses_backend() to prevent a crash on unset delegates. |
| runtime/executor/test/method_meta_test.cpp | Adds a regression test that loads a minimal FlatBuffer program with delegates left unset and validates uses_backend() behavior; adds runtime initialization for tests. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| #include <executorch/extension/data_loader/buffer_data_loader.h> | ||
| #include <executorch/extension/data_loader/file_data_loader.h> | ||
| #include <executorch/runtime/core/exec_aten/exec_aten.h> | ||
| #include <executorch/runtime/executor/program.h> | ||
| #include <executorch/runtime/platform/runtime.h> | ||
| #include <executorch/schema/program_generated.h> |
There was a problem hiding this comment.
Fixed, added //executorch/extension/data_loader:buffer_data_loader and //executorch/schema:program to the method_meta_test deps in targets.bzl.
| TEST_F(MethodMetaTest, UsesBackendOnUnsetDelegatesReturnsFalse) { | ||
| // Construct a minimal schema-valid FlatBuffer program where delegates is | ||
| // unset (nullptr). | ||
| flatbuffers::FlatBufferBuilder fbb; |
There was a problem hiding this comment.
right, method_meta_test was disabled behind TODO(T191569140). Re-enabled it in CMakeLists.txt with the required extension_data_loader/program_schema libs.
|
@pytorchbot label "release notes: runtime" |
…re Buck deps, enable method_meta_test in CMake - uses_backend(): skip delegate entries with null delegate or null id, same class of issue as the original delegates==nullptr fix - test: use Program::kMinHeadBytes instead of hardcoded 64 - targets.bzl: add buffer_data_loader and schema:program deps needed by the new test - CMakeLists.txt: re-enable method_meta_test (was disabled behind TODO(T191569140)) and add the missing ModuleAddWithDevice.pte generation step, so the regression test is actually buildable and runnable from a clean checkout
Fixes #22404
Summary
MethodMeta::uses_backend()dereferencedExecutionPlan::delegates()without a null check. Perschema/program.fbs,delegateshas no default and can be legitimately unset.num_backends(), six lines below in the same file, already guards this exact condition — this PR applies the same guard touses_backend().See #22404 for the full root-cause writeup, reproduction, and crash output.
Test plan
Added
MethodMetaTest.UsesBackendOnUnsetDelegatesReturnsFalsetoruntime/executor/test/method_meta_test.cpp, constructing a minimal, self-contained, schema-validProgram(viaflatbuffers::FlatBufferBuilder+BufferDataLoader) wheredelegatesis left unset, then assertinguses_backend()returnsfalseinstead of crashing.Verified locally (Clang, Debug,
-fsanitize=address,undefined):flatbuffers::Vector::size()insideuses_backend().method_meta_testsuite (7/7 tests) passes with no regressions.program_test,method_test, andmemory_manager_testsuites viactest— all passing, no side effects from this change.Commands used: