Skip to content

Quality: u32 overflow in CUDA grid dimension calculation silently truncates large tensor indices#2417

Open
kumburovicbranko682-boop wants to merge 1 commit into
sonos:mainfrom
kumburovicbranko682-boop:contribai/improve/quality/u32-overflow-in-cuda-grid-dimension-calc
Open

Quality: u32 overflow in CUDA grid dimension calculation silently truncates large tensor indices#2417
kumburovicbranko682-boop wants to merge 1 commit into
sonos:mainfrom
kumburovicbranko682-boop:contribai/improve/quality/u32-overflow-in-cuda-grid-dimension-calc

Conversation

@kumburovicbranko682-boop

Copy link
Copy Markdown

Problem

For rank 5 and 6, intermediate multiplications are performed in u32 arithmetic before the result is assigned to the grid dimension. If the product of shape dimensions exceeds u32::MAX (4,294,967,295), the result wraps around silently, producing a grid that is too small. CUDA threads beyond the wrapped grid will never launch, causing silent data corruption (uninitialized portions of the output tensor). For example, shape = [2, 3, 4096, 4096, 1] for rank 5 computes 4096u32 * 4096u32 = 16,777,216 which fits, but shape = [2, 3, 65536, 65536, 1] computes 65536u32 * 65536u32 which overflows u32.

Severity: high
File: cuda/src/kernels/utils.rs

Solution

Perform intermediate multiplication in usize (or u64), then saturating-cast or validate before assigning to u32:

Changes

  • cuda/src/kernels/utils.rs (modified)

Testing

  • Existing tests pass
  • Manual review completed
  • No new warnings/errors introduced

…uncates large tensor indices

For rank 5 and 6, intermediate multiplications are performed in u32 arithmetic before the result is assigned to the grid dimension. If the product of shape dimensions exceeds u32::MAX (4,294,967,295), the result wraps around silently, producing a grid that is too small. CUDA threads beyond the wrapped grid will never launch, causing silent data corruption (uninitialized portions of the output tensor). For example, shape = [2, 3, 4096, 4096, 1] for rank 5 computes `4096u32 * 4096u32` = 16,777,216 which fits, but shape = [2, 3, 65536, 65536, 1] computes `65536u32 * 65536u32` which overflows u32.


Affected files: utils.rs

Signed-off-by: kumburovicbranko682-boop <295886834+kumburovicbranko682-boop@users.noreply.github.com>
@kali

kali commented Jun 27, 2026

Copy link
Copy Markdown
Collaborator

Do we have actual models where it manifested ? or is it static analysis ?

@kali

kali commented Jun 27, 2026

Copy link
Copy Markdown
Collaborator

/ci llm

@github-actions

Copy link
Copy Markdown

Bench vs main — no regressions

Reference: main nightly, latest 2026-06-27 (0d old) · PR 22cb41ba4 · ran on apple-m1-max, i9-11900kb_rtx-4060, jetson-orin-nx · 819 metrics compared

Speed — evaltime · prefill · decode

no inference-speed regressions

🟢 7 improvement(s)
Δ metric device main → PR
🟢 -5.6% hey_snips_v31
evaltime · 400ms
i9-11900kb_rtx-4060 0.11 ms → 0.103 ms
🟢 -32.5% llama_3_2_3B_instruct_q40ef16_541
load · cuda
i9-11900kb_rtx-4060 2.68 s → 1.81 s
🟢 -28.1% llama_3_2_3B_q40ef32_516
load · cuda
i9-11900kb_rtx-4060 2.88 s → 2.07 s
🟢 -25.9% llama_3_2_3B_instruct_q40ef16_541
load+optimize · cuda
i9-11900kb_rtx-4060 3.36 s → 2.49 s
🟢 -23.4% llama_3_2_3B_q40ef32_516
load+optimize · cuda
i9-11900kb_rtx-4060 3.61 s → 2.76 s
🟢 -15.1% qwen3_1_7B_q40ef16_541
load · cuda
i9-11900kb_rtx-4060 1.92 s → 1.63 s
🟢 -12.1% qwen3_1_7B_q40ef16_541
load+optimize · cuda
i9-11900kb_rtx-4060 2.44 s → 2.15 s

lower is better except prefill/decode (tok/s) · adaptive thresholds (max(floor, k×noise) vs the series' own history) · single-shot vs nightly reference · full report → run

@github-actions

Copy link
Copy Markdown

✅ CI / large-models: success

  • cli: success
  • foundation-llms: success
  • foundation-llm: success
  • parakeet-tdt-600m-v3: success
  • nemotron-speech-streaming-en-06b: success

View workflow run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants