Skip to content

Commit 560aba9

Browse files
abeakkasfacebook-github-bot
authored andcommitted
Fix OOB write to S_data in batched linalg_svd (#18625)
Summary: S has 3 elements per batch (diagonal of 3x3), but was indexed with the same offset as U and Vh (9 elements per batch), causing out-of-bounds writes and corrupted singular values for batch_size > 1. Reviewed By: DrJessop Differential Revision: D99002350
1 parent fcccda3 commit 560aba9

1 file changed

Lines changed: 4 additions & 3 deletions

File tree

backends/cadence/generic/operators/op_linalg_svd.cpp

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -323,6 +323,7 @@ std::tuple<Tensor&, Tensor&, Tensor&> linalg_svd_out(
323323

324324
for (int i = 0; i < batch_size; i++) {
325325
int offset = i * 9;
326+
int s_offset = i * 3;
326327
Matrix3x3 A_mat = {{
327328
{A_data[offset + 0], A_data[offset + 1], A_data[offset + 2]},
328329
{A_data[offset + 3], A_data[offset + 4], A_data[offset + 5]},
@@ -342,9 +343,9 @@ std::tuple<Tensor&, Tensor&, Tensor&> linalg_svd_out(
342343
U_data[offset + 7] = U_mat.m[2][1];
343344
U_data[offset + 8] = U_mat.m[2][2];
344345

345-
S_data[offset + 0] = S_mat.m[0][0];
346-
S_data[offset + 1] = S_mat.m[1][1];
347-
S_data[offset + 2] = S_mat.m[2][2];
346+
S_data[s_offset + 0] = S_mat.m[0][0];
347+
S_data[s_offset + 1] = S_mat.m[1][1];
348+
S_data[s_offset + 2] = S_mat.m[2][2];
348349

349350
Vh_data[offset + 0] = Vh_mat.m[0][0];
350351
Vh_data[offset + 1] = Vh_mat.m[0][1];

0 commit comments

Comments
 (0)