Skip to content

Conversation

@limou102
Copy link

In the hipEvent_t stream-wait operation using shared-memory (IPC) events, the calculation of

offset = ipc_shmem_->read_index

does not apply a modulo with IPC_SIGNALS_PER_EVENT (which is fixed at 32), causing subsequent access to

ipc_shmem_->signal[offset]

to go out of bounds.

&(ipc_evt_.ipc_shmem_->signal[offset]), 0, 1, 1, sizeof(uint32_t));

Looking at the initialization code, ipc_shmem_->signal[] is only initialized with IPC_SIGNALS_PER_EVENT = 32 elements:

ihipHostRegister(&ipc_evt_.ipc_shmem_->signal, sizeof(uint32_t) * IPC_SIGNALS_PER_EVENT, 0);

Therefore, when an IPC event’s stream-wait is invoked more than 32 times, it triggers an out-of-bounds access and results in an abnormal termination — which indeed matches what we encountered in practice.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants