double free or corruption (out) on running Llava on x86_64

[vijay-myelin]

🐛 Describe the bug

I followed the steps given on https://github.com/pytorch/executorch/tree/main/examples/models/llava

On running the test util using the given command:
python -m executorch.examples.models.llava.test.test_pte llava.pte

I get the following output:

[program.cpp:133] InternalConsistency verification requested but not available
Special tokens have been added in the vocabulary, make sure the associated word embeddings are fine-tuned or trained.
/home/zotac-gpu4070/anaconda3/envs/executorch/lib/python3.10/site-packages/transformers/models/llava/configuration_llava.py:100: FutureWarning: The vocab_size argument is deprecated and will be removed in v4.42, since it can be inferred from the text_config. Passing this argument has no effect
warnings.warn(
Loading checkpoint shards: 100%|█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 3/3 [00:12<00:00, 4.14s/it]
tensor([[[ 1.7103e+00, 1.1975e-01, -5.0003e-01, ..., 3.2804e-01,
3.2825e-01, 3.2811e-01],
[-9.3900e+00, -6.0762e+00, -1.8538e+00, ..., -5.5654e-01,
-5.3087e-01, -5.2726e-01],
[-6.1942e+00, -8.5092e+00, 8.3540e+00, ..., 2.6817e-02,
8.2106e-02, 5.0859e-02],
...,
[-4.7401e+00, -5.3710e+00, 1.1362e+01, ..., 6.9305e-02,
7.8270e-02, 1.1493e-01],
[-4.8304e+00, -6.4160e+00, 5.3271e+00, ..., -2.6459e-02,
-2.7240e-02, -1.8948e-03],
[-4.8723e+00, -2.3724e+00, 4.4928e+00, ..., -1.9003e-01,
-1.7132e-01, -1.4267e-01]]])
double free or corruption (out)
Aborted (core dumped)

Similarly on running the llava_main executable, I get:

I 00:00:00.000431 executorch:cpuinfo_utils.cpp:62] Reading file /sys/devices/soc0/image_version
I 00:00:00.000461 executorch:cpuinfo_utils.cpp:78] Failed to open midr file /sys/devices/soc0/image_version
I 00:00:00.000468 executorch:cpuinfo_utils.cpp:91] Reading file /sys/devices/system/cpu/cpu0/regs/identification/midr_el1
I 00:00:00.000471 executorch:cpuinfo_utils.cpp:100] Failed to open midr file /sys/devices/system/cpu/cpu0/regs/identification/midr_el1
I 00:00:00.000472 executorch:cpuinfo_utils.cpp:116] CPU info and manual query on # of cpus dont match.
I 00:00:00.000473 executorch:main.cpp:71] Resetting threadpool with num threads = 0
I 00:00:00.000510 executorch:multimodal_runner.h:49] Creating Multimodal LLM runner: model_path=llava.pte, tokenizer_path=tokenizer.bin
I 00:00:00.013546 executorch:main.cpp:92] image size(0): 3, size(1): 224, size(2): 336
I 00:00:48.593597 executorch:text_prefiller.cpp:56] Prefill token result numel(): 1122240
double free or corruption (out)
Aborted (core dumped)

Versions

Collecting environment information...
PyTorch version: 2.5.0.dev20240716+cpu
Is debug build: False
CUDA used to build PyTorch: Could not collect
ROCM used to build PyTorch: N/A

OS: Ubuntu 22.04.4 LTS (x86_64)
GCC version: (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0
Clang version: Could not collect
CMake version: version 3.29.5
Libc version: glibc-2.35

Python version: 3.10.0 (default, Mar 3 2022, 09:58:08) [GCC 7.5.0] (64-bit runtime)
Python platform: Linux-6.8.0-40-generic-x86_64-with-glibc2.35
Is CUDA available: False
CUDA runtime version: Could not collect
CUDA_MODULE_LOADING set to: N/A
GPU models and configuration: GPU 0: NVIDIA GeForce RTX 4070
Nvidia driver version: 560.28.03
cuDNN version: Could not collect
HIP runtime version: N/A
MIOpen runtime version: N/A
Is XNNPACK available: True

CPU:
Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Address sizes: 46 bits physical, 48 bits virtual
Byte Order: Little Endian
CPU(s): 24
On-line CPU(s) list: 0-23
Vendor ID: GenuineIntel
Model name: 13th Gen Intel(R) Core(TM) i7-13700
CPU family: 6
Model: 183
Thread(s) per core: 2
Core(s) per socket: 16
Socket(s): 1
Stepping: 1
CPU max MHz: 5200.0000
CPU min MHz: 800.0000
BogoMIPS: 4224.00
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdseed adx smap clflushopt clwb intel_pt sha_ni xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk avx_vnni dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req hfi vnmi umip pku ospke waitpkg gfni vaes vpclmulqdq tme rdpid movdiri movdir64b fsrm md_clear serialize pconfig arch_lbr ibt flush_l1d arch_capabilities
Virtualization: VT-x
L1d cache: 640 KiB (16 instances)
L1i cache: 768 KiB (16 instances)
L2 cache: 24 MiB (10 instances)
L3 cache: 30 MiB (1 instance)
NUMA node(s): 1
NUMA node0 CPU(s): 0-23
Vulnerability Gather data sampling: Not affected
Vulnerability Itlb multihit: Not affected
Vulnerability L1tf: Not affected
Vulnerability Mds: Not affected
Vulnerability Meltdown: Not affected
Vulnerability Mmio stale data: Not affected
Vulnerability Reg file data sampling: Mitigation; Clear Register File
Vulnerability Retbleed: Not affected
Vulnerability Spec rstack overflow: Not affected
Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl
Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2: Mitigation; Enhanced / Automatic IBRS; IBPB conditional; RSB filling; PBRSB-eIBRS SW sequence; BHI BHI_DIS_S
Vulnerability Srbds: Not affected
Vulnerability Tsx async abort: Not affected

Versions of relevant libraries:
[pip3] executorch==0.4.0a0+b66d62a
[pip3] mypy-extensions==1.0.0
[pip3] numpy==1.21.3
[pip3] optree==0.11.0
[pip3] torch==2.5.0.dev20240716+cpu
[pip3] torchao==0.4.0
[pip3] torchaudio==2.4.0.dev20240716+cpu
[pip3] torchsr==1.0.4
[pip3] torchvision==0.20.0.dev20240716+cpu
[conda] executorch 0.4.0a0+b66d62a pypi_0 pypi
[conda] numpy 1.21.3 pypi_0 pypi
[conda] torch 2.5.0.dev20240716+cpu pypi_0 pypi
[conda] torchao 0.4.0 pypi_0 pypi
[conda] torchaudio 2.4.0.dev20240716+cpu pypi_0 pypi
[conda] torchsr 1.0.4 pypi_0 pypi
[conda] torchvision 0.20.0.dev20240716+cpu pypi_0 pypi

cc @mergennachin @iseeyuan @lucylq @helunwencser @tarun292 @kimishpatel @jackzhxng @cccclai @dvorjackz

[jackzhxng]

cc @larryliu0820

[sternezsl]

I encountered the same proble on aarch64, and I add a guard

if  (last_col <0) {
  continue;
}

around https://github.com/pytorch/executorch/blame/ec27667fcdc8cebf9d6244632ba8f394dd5a85ad/extension/llm/custom_ops/op_sdpa.cpp#L492, it works now. The last_col here could be less than -1, so there is a risk of memory corruption. @kimishpatel

[kimishpatel]

I encountered the same proble on aarch64, and I add a guard

if  (last_col <0) {
  continue;
}

around ec27667/extension/llm/custom_ops/op_sdpa.cpp#L492 (blame), it works now. The last_col here could be less than -1, so there is a risk of memory corruption. @kimishpatel

Interesting. Can you submit a PR with explanation. I can see why m + row + start < n might be possible but I need to do more thorough evaluation.

[spalatinate]

@kimishpatel @sternezsl I have encountered the same issue. However, I am not sure how to solve the issue. What I have tried is to add the code snippet above to line 492:

            int64_t last_col = m + (row + start_pos) - n;    
            
             if (last_col < 0) {
             continue;
             }

            accum_t* row_ptr = qk_data + row * kvBlockSize;

Unfortunately, I am getting the error: UpdaSegmentation fault (core dumped).

[kimishpatel]

Ok let me take a look at this

[spalatinate]

@kimishpatel Do you habe an update? And many thanks in advance!

[kimishpatel]

I wish there was a reminder here. I will take a look at this on Monday

[spalatinate]

@kimishpatel Ping ;)