Skip to content

[SYCL][UB] Make Command::isHostTask() virtual instead of downcasting on MType - #23081

Merged
KornevNikita merged 1 commit into
intel:syclfrom
uditagarwal97:private/udit/command-ishosttask-virtual
Sep 2, 2026
Merged

[SYCL][UB] Make Command::isHostTask() virtual instead of downcasting on MType#23081
KornevNikita merged 1 commit into
intel:syclfrom
uditagarwal97:private/udit/command-ishosttask-virtual

Conversation

@uditagarwal97

Copy link
Copy Markdown
Contributor

Problem

Command::isHostTask() deduced the dynamic type of the command from its type tag and then downcast unconditionally:

bool Command::isHostTask() const {
  return (MType == CommandType::RUN_CG) /* host task has this type also */ &&
         ((static_cast<const ExecCGCommand *>(this))->getCG().getType() ==
          CGType::CodeplayHostTask);
}

static_cast to a derived type is undefined behaviour unless the object really is of that type; nothing in the type system enforces RUN_CG => ExecCGCommand, only convention. When the object is a plain Command subobject, getCG() reads MCommandGroup from beyond the end of the allocation.

AddressSanitizer report (ASan+UBSan build, SchedulerTest.DontEnqueueDepsIfOneOfThemIsBlocked):

ERROR: AddressSanitizer: global-buffer-overflow on address ...
READ of size 4 at ... thread T0
    #0 ... in getType sycl/source/detail/cg.hpp:104
    #1 ... in sycl::_V1::detail::Command::isHostTask() const
       sycl/source/detail/scheduler/commands.cpp:246
    #2 ... in isBlocking sycl/source/detail/scheduler/commands.hpp:178
    #3 ... in Scheduler::GraphProcessor::handleBlockingCmd(...)

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

…Type

isHostTask() static_cast'ed any RUN_CG command to ExecCGCommand and read its
command group. The cast relies on an invariant the type tag alone does not
express, and ASan flags it as an out-of-bounds read whenever the object is not
actually an ExecCGCommand. Ask the command instead of deducing its type.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The virtual dispatch preserves existing host-task behavior while safely handling other command subclasses.

Pull request overview

Replaces unsafe type-tag downcasting with virtual dispatch when identifying host-task commands.

Changes:

  • Adds a safe default Command::isHostTask() implementation.
  • Overrides host-task detection in ExecCGCommand.
  • Removes the undefined-behavior-prone downcast.
File summaries
File Description
sycl/source/detail/scheduler/commands.hpp Defines virtual host-task detection.
sycl/source/detail/scheduler/commands.cpp Removes unsafe downcasting logic.
Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
  • Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@uditagarwal97
uditagarwal97 marked this pull request as ready for review September 2, 2026 00:58
@uditagarwal97
uditagarwal97 requested a review from a team as a code owner September 2, 2026 00:58
@sys-ce-bb

Copy link
Copy Markdown
Contributor

@intel/llvm-gatekeepers please consider merging

@KornevNikita
KornevNikita merged commit e91f554 into intel:sycl Sep 2, 2026
31 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants