Skip to content

Fix XNN PreLU use after free#18663

Open
GregoryComer wants to merge 1 commit intopytorch:mainfrom
GregoryComer:xnn-fix-prelu
Open

Fix XNN PreLU use after free#18663
GregoryComer wants to merge 1 commit intopytorch:mainfrom
GregoryComer:xnn-fix-prelu

Conversation

@GregoryComer
Copy link
Copy Markdown
Member

@GregoryComer GregoryComer commented Apr 2, 2026

Summary

Most XNNPACK parameter / constant data is packed and XNNPACK takes ownership of it. This means that we can free the buffer after load. However, PreLU doesn't pack and thus expects the buffer to stay alive. There is a reproable segfault when running PreLU on ET XNNPACK when running from a file (vs. in-memory buffer data). This PR fixes this by only freeing buffers for ops we know take ownership of the data. Practically speaking this should be a no-op for most cases (linear, conv, etc.) but plays it safe for other constant tensors.

Fixes #17559.

cc @digantdesai @cbilgin

@pytorch-bot
Copy link
Copy Markdown

pytorch-bot bot commented Apr 2, 2026

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/18663

Note: Links to docs will display an error until the docs builds have been completed.

✅ You can merge normally! (2 Unrelated Failures)

As of commit 1041db3 with merge base 15b268f (image):

FLAKY - The following job failed but was likely due to flakiness present on trunk:

BROKEN TRUNK - The following job failed but was present on the merge base:

👉 Rebase onto the `viable/strict` branch to avoid these failures

This comment was automatically generated by Dr. CI and updates every 15 minutes.

@meta-cla meta-cla bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Apr 2, 2026
@GregoryComer GregoryComer added module: xnnpack Issues related to xnnpack delegation and the code under backends/xnnpack/ release notes: xnnpack Changes to the XNNPack backend delegate and removed CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. labels Apr 2, 2026
@meta-cla meta-cla bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Apr 2, 2026
@GregoryComer GregoryComer marked this pull request as ready for review April 3, 2026 22:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. module: xnnpack Issues related to xnnpack delegation and the code under backends/xnnpack/ release notes: xnnpack Changes to the XNNPack backend delegate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ExecuTorch Runtime Segfault for aten::prelu With Constant In-Module Weight When Using run_decompositions({})

1 participant