fix: 9 confirmed defects from an adversarial bug hunt (ADR-0138)#37
Merged
Conversation
A verified sweep (5 finders -> 15 candidates -> 9 confirmed after independent source verification) across the filter family, GPU dispatch lifecycle, interop ABI, and patch stack. Two fire on DEFAULT configs. must-fix: - denoise: stat_buffer (binding 5) statically referenced by the shader but bound only inside if(want_meta); on the DEFAULT meta=0 path it was left unbound -> invalid Vulkan usage (validation error / UB / device-lost on strict drivers; tolerated on the dev-box NVIDIA driver, masking it). Now always allocated + bound every dispatch (mirroring mv/conf); zero-fill/readback still gated on meta. - denoise: uninitialized FFVkExecContext *exec read on an early-RET fail path. should-fix: - mc: s_part[128] OOB on subgroupSize<8 -> size to BLOCK_DIM*BLOCK_DIM, lockstep. - interop pel_blob_pack: uint32 total_size overflow -> heap overflow -> uint64 + reject > UINT32_MAX with PEL_ERR_RANGE. - denoise MC consumer: cells = grid_cols*grid_rows signed overflow -> uint64 + cap. - interop pel_blob_find_section: missing R5 8-byte alignment check -> PEL_ERR_ABI. - mc: av_realloc on a libc-calloc'd blob (cross-allocator UB) -> libc realloc. - analyze coalesce_roi: dropped ROI by raster position, not score -> sort by banding strength, keep top max. Interop conformance fixture extended. No wire-ABI change. meson fast 11/11; full n8.1.1 patch-stack build clean; GPU smokes pass incl. denoise meta=0. Regenerates patches 0002/0003/0007. ADR: docs/adr/0138-bug-hunt-remediation.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes 9 confirmed defects found by an adversarially-verified bug hunt (5 dimension-finders → 15 candidates → independent source verification → 9 confirmed). ADR-0138.
Two must-fix (fire on default configs)
denoiseunbound descriptor at defaultmeta=0—stat_buffer(binding 5) is statically referenced by the SPIR-V but was bound only insideif(want_meta); on the default path a used storage descriptor was left unbound → invalid Vulkan (validation error / UB / device-lost on strict drivers; the dev-box NVIDIA driver tolerated it, masking the bug). Now always allocated + bound (mirroring mv/conf 6/7); zero-fill/readback stay gated onwant_meta.denoiseuninitializedexecread on an early-fail path →= NULL.Six should-fix (hardenings)
mcs_part[128]OOB onsubgroupSize<8BLOCK_DIM*BLOCK_DIM(lockstep.comp)pel_blob_packuint32 size overflow → heap overflow>UINT32_MAX(PEL_ERR_RANGE)pel_blob_find_sectionmissing R5 alignment(off&7)(PEL_ERR_ABI)denoiseMC-consumergc*grsigned overflow (untrusted)PEL_DENOISE_MAX_CELLScapmcav_reallocon libc-calloc'd blob (cross-allocator UB)reallocanalyzecoalesce_roidrops ROI by raster pos, not scoremaxValidation
Interop conformance fixture extended (
test_misaligned_offset→PEL_ERR_ABI,test_pack_size_overflow→PEL_ERR_RANGE).meson test --suite=fast11/11; full n8.1.1 patch-stack apply +make ffmpegclean; GPU smokes on vk:0 all pass — incl. denoise at defaultmeta=0(the must-fix path), mc, analyze-roi, denoise meta=1, denoise mc=1.Interop fixes are defensive parser hardenings — no wire-ABI change (append-only safe; vmafx picks them up on its next
interop.csync). Regenerates patches 0002/0003/0007.🤖 Generated with Claude Code