Skip to content

Conversation

@zhanmyz
Copy link
Contributor

@zhanmyz zhanmyz commented Dec 2, 2025

Details:

  • Updated create_data to use the actual data size calculated from the original element type and shape for u16/i16 types, ensuring memcpy only reads the valid memory region.

Description of the issue

  • The create_data function used the layout's buffer size for memcpy, which is incorrect for u16/i16 types as they are converted to f32 in the layout. This caused bufSize (4 bytes/elem) to be larger than the actual source data (2 bytes/elem), leading to a buffer overread and SEH exception 0xc0000005.

The code and line that caused this issue (if it is not changed directly)

std::memcpy(&buf[0], &data[0], bufSize);

Reproduction step and snapshot

  • Test command
timeout 600 valgrind --tool=memcheck --leak-check=full --show-leak-kinds=all --track-origins=yes --verbose --error-exitcode=1 --log-file=valgrind_i16_test.log ./bin/intel64/Debug/ov_gpu_func_tests '--gtest_filter=*ConstantResultSubgraphTest.Inference/SubgraphType=SEVERAL_COMPONENT_IS=[1,3,10,10]_IT=i16_Device=GPU' > valgrind_console.txt
  • Output
==630497== Invalid read of size 8
==630497==    by 0x485293F: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==630497==    by 0x190A8A20: ov::intel_gpu::create_data(...) (constant.cpp:128)
...
==630497==  Address 0xed432e8 is 16 bytes after a block of size 600 alloc'd

Checklist

  • [v] Is it a proper fix? (not a workaround)
  • [v] Did you include test case for this fix, if necessary?
  • [v] Did you review existing test that can be extended to cover this scenario? Which test did you review?

Tickets:

@zhanmyz zhanmyz requested review from a team as code owners December 2, 2025 10:09
@github-actions github-actions bot added the category: GPU OpenVINO GPU plugin label Dec 2, 2025
@zhanmyz zhanmyz force-pushed the cvs-172561-fix-seh-issue branch from 4a870cd to dfeb3b4 Compare December 4, 2025 02:57
@wilson-seok
Copy link
Contributor

@zhanmyz Can you extend current test case or create new one to compare values after create_data()? I think previous test case doesn't check value equality.

 ### Details:
  - Updated `create_data` to use the actual data size calculated from the original element type and shape for `u16`/`i16` types, ensuring `memcpy` only reads the valid memory region.

 ### Tickets:
  - *CVS-172561*

Signed-off-by: zhanmyz <[email protected]>
@zhanmyz zhanmyz force-pushed the cvs-172561-fix-seh-issue branch from dfeb3b4 to ebd5308 Compare December 4, 2025 08:39
@zhanmyz zhanmyz requested review from a team as code owners December 4, 2025 08:39
@github-actions github-actions bot added the category: IE Tests OpenVINO Test: plugins and common label Dec 4, 2025
@zhanmyz
Copy link
Contributor Author

zhanmyz commented Dec 4, 2025

@zhanmyz Can you extend current test case or create new one to compare values after create_data()? I think previous test case doesn't check value equality.

Sure, I create new one test case to perform an element-wise comparison between the original input data and the data after create_data()

Copy link
Contributor

@wilson-seok wilson-seok left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@p-durandin p-durandin added this to the 2026.0 milestone Dec 4, 2025
@p-durandin p-durandin added this pull request to the merge queue Dec 4, 2025
Merged via the queue into openvinotoolkit:master with commit f1b4528 Dec 4, 2025
205 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

category: GPU OpenVINO GPU plugin category: IE Tests OpenVINO Test: plugins and common

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants