Skip to content

Commit aefb645

Browse files
committed
Fix incorrect usage of L0 API leading to memory corruptions
1 parent 2a43585 commit aefb645

File tree

1 file changed

+24
-22
lines changed

1 file changed

+24
-22
lines changed

unified-runtime/source/adapters/level_zero/image_common.cpp

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -883,28 +883,30 @@ ur_result_t bindlessImagesHandleCopyFlags(
883883
return UR_RESULT_SUCCESS;
884884
};
885885
case UR_EXP_IMAGE_COPY_FLAG_HOST_TO_HOST: {
886-
// Copy between pitched USM regions
887-
uint32_t DstRowPitch = pDstImageDesc->rowPitch;
888-
uint32_t SrcRowPitch = pSrcImageDesc->rowPitch;
889-
ze_copy_region_t ZeDstRegion = {(uint32_t)pCopyRegion->dstOffset.x,
890-
(uint32_t)pCopyRegion->dstOffset.y,
891-
(uint32_t)pCopyRegion->dstOffset.z,
892-
DstRowPitch,
893-
(uint32_t)pCopyRegion->copyExtent.height,
894-
(uint32_t)pCopyRegion->copyExtent.depth};
895-
ze_copy_region_t ZeSrcRegion = {(uint32_t)pCopyRegion->srcOffset.x,
896-
(uint32_t)pCopyRegion->srcOffset.y,
897-
(uint32_t)pCopyRegion->srcOffset.z,
898-
SrcRowPitch,
899-
(uint32_t)pCopyRegion->copyExtent.height,
900-
(uint32_t)pCopyRegion->copyExtent.depth};
901-
uint32_t DstSlicePitch = DstRowPitch * pDstImageDesc->height;
902-
uint32_t SrcSlicePitch = SrcRowPitch * pSrcImageDesc->height;
903-
ZE2UR_CALL(zeCommandListAppendMemoryCopyRegion,
904-
(ZeCommandList, pDst, &ZeDstRegion, DstRowPitch, DstSlicePitch,
905-
pSrc, &ZeSrcRegion, SrcRowPitch, SrcSlicePitch, zeSignalEvent,
906-
numWaitEvents, phWaitEvents));
907-
return UR_RESULT_SUCCESS;
886+
// Copy between (possibly) pitched USM regions
887+
uint32_t DstRowPitch =
888+
std::max(pDstImageDesc->rowPitch, pCopyRegion->copyExtent.width);
889+
uint32_t SrcRowPitch =
890+
std::max(pSrcImageDesc->rowPitch, pCopyRegion->copyExtent.width);
891+
ze_copy_region_t ZeDstRegion = {(uint32_t)pCopyRegion->dstOffset.x,
892+
(uint32_t)pCopyRegion->dstOffset.y,
893+
(uint32_t)pCopyRegion->dstOffset.z,
894+
(uint32_t)pCopyRegion->copyExtent.width,
895+
(uint32_t)pCopyRegion->copyExtent.height,
896+
(uint32_t)pCopyRegion->copyExtent.depth};
897+
ze_copy_region_t ZeSrcRegion = {(uint32_t)pCopyRegion->srcOffset.x,
898+
(uint32_t)pCopyRegion->srcOffset.y,
899+
(uint32_t)pCopyRegion->srcOffset.z,
900+
(uint32_t)pCopyRegion->copyExtent.width,
901+
(uint32_t)pCopyRegion->copyExtent.height,
902+
(uint32_t)pCopyRegion->copyExtent.depth};
903+
uint32_t DstSlicePitch = DstRowPitch * pDstImageDesc->height;
904+
uint32_t SrcSlicePitch = SrcRowPitch * pSrcImageDesc->height;
905+
ZE2UR_CALL(zeCommandListAppendMemoryCopyRegion,
906+
(ZeCommandList, pDst, &ZeDstRegion, DstRowPitch, DstSlicePitch,
907+
pSrc, &ZeSrcRegion, SrcRowPitch, SrcSlicePitch, zeSignalEvent,
908+
numWaitEvents, phWaitEvents));
909+
return UR_RESULT_SUCCESS;
908910
};
909911
default:
910912
UR_LOG(ERR, "ur_queue_immediate_in_order_t::bindlessImagesImageCopyExp: "

0 commit comments

Comments
 (0)