You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[BUG] Fused MoE auxiliary loss accepts shapes that overflow int offsets #3568
The fused MoE auxiliary loss kernels calculate flattened positions as row * num_cols using a 32-bit int. The forward, graph-safe forward, and backward launchers accept shapes for which num_rows * num_cols exceeds INT_MAX. Those positions can overflow before the kernels use them to access memory.
Steps to reproduce
Inspect the index calculation and launchers in fused_moe_aux_loss.cu. For num_rows = 8_388_609 and num_cols = 256, the product is 2_147_483_904, which exceeds INT_MAX.
I found this through source inspection and have not run the oversized kernel, since an overflowing offset may access memory outside the tensor.
Expected behavior
Reject the shape before launching any of the three kernels, with an error explaining the 32-bit offset limit.
Environment
Source commit: 21a066d257afeaf8039325f58df9a62587517976. Runtime reproduction has not been run.
Activity