Skip to content

[UR] Coverity fixes - #22699

Open
bratpiorka wants to merge 10 commits into
intel:syclfrom
bratpiorka:rrudnick_coverity2
Open

[UR] Coverity fixes#22699
bratpiorka wants to merge 10 commits into
intel:syclfrom
bratpiorka:rrudnick_coverity2

Conversation

@bratpiorka

@bratpiorka bratpiorka commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

fixes for Coverity issues: 3482570, 3491402, 3491404, 3491405, 3643292, 3643293, 3643294, 3643295, 3644020, 3644025, 3644034, 3644037, 3644040

@bratpiorka
bratpiorka force-pushed the rrudnick_coverity2 branch 2 times, most recently from 099bdeb to 5a27119 Compare July 27, 2026 10:15
@bratpiorka bratpiorka changed the title [WIP] coverity fixes [UR] Coverity fixes Jul 27, 2026
@bratpiorka
bratpiorka force-pushed the rrudnick_coverity2 branch from 5a27119 to bc2adf7 Compare July 27, 2026 10:40
@bratpiorka
bratpiorka marked this pull request as ready for review July 27, 2026 10:44
@bratpiorka
bratpiorka requested review from a team as code owners July 27, 2026 10:44
@bratpiorka
bratpiorka requested a review from mmichel11 July 27, 2026 10:44
@bratpiorka
bratpiorka force-pushed the rrudnick_coverity2 branch from bc2adf7 to dcbf84e Compare July 28, 2026 07:45
Result = EnqueueUSMSetZero(hQueue, (void *)ShadowAddr, size,
numEventsInWaitList, phEventWaitList, &Event);
if (Result != UR_RESULT_SUCCESS) {
releaseEvent(Event);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Event is in an undefined state here if Result is not success.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok I will mark MSAN CIDs as false positives in Coverity

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

... but I'n not sure about this. Looking at https://github.com/intel/llvm/blob/sycl/unified-runtime/source/adapters/opencl/usm.cpp#L344 the event ptr is filled with data and in https://github.com/intel/llvm/blob/sycl/unified-runtime/source/adapters/opencl/usm.cpp#L365 the function returns without releasing the event pointer, so there could be an actual memory leak in this scenario

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's an adapter issue. Out events shouldn't be allocated if the call fails.

Comment on lines +100 to +104
if (Result != UR_RESULT_SUCCESS || Type == DeviceType::CPU) {
[[maybe_unused]] auto ReleaseResult =
getContext()->urDdiTable.Context.pfnRelease(ShadowContext);
assert(ReleaseResult == UR_RESULT_SUCCESS);
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

did this just leak on the cpu type before?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, CPU shadow context Destroy() function does not release this context. For GPU type it is done in ShadowMemoryGPU::Destroy()

Comment on lines +32 to +42
try {
cl_int Res =
cl_ext::getExtFuncFromContext<decltype(clReleaseCommandBufferKHR)>(
CLContext,
cast(ur::cl::getAdapter())->fnCache.clReleaseCommandBufferKHRCache,
cl_ext::ReleaseCommandBufferName, &clReleaseCommandBufferKHR);
assert(Res == CL_SUCCESS);
(void)Res;
} catch (...) {
assert(false && "Failed to look up clReleaseCommandBufferKHR");
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be cleaner to have it already stored somewhere.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done - I stored create and release in ur_exp_command_buffer_handle_t_

Comment on lines +46 to +49
{
std::lock_guard lock{Platform->SubDevicesLock};
Platform->SubDevices.erase(CLDevice);
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

was the previous comment incorrect?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Coverity claims that there could be a race condition here if another thread concurrently performs a lookup or insertion

Comment on lines +575 to +583
if (!SetKernelArgMemPointerPtr) {
UR_RETURN_ON_FAILURE(
cl_ext::getExtFuncFromContext<clSetKernelArgMemPointerINTEL_fn>(
Queue->Context->CLContext,
cast(ur::cl::getAdapter())
->fnCache.clSetKernelArgMemPointerINTELCache,
cl_ext::SetKernelArgMemPointerName,
&SetKernelArgMemPointerPtr));
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd rather keep this function pointer in the context or something.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that L0 adapters store it in the platform structure.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok I used Kernel->clSetKernelArgMemPointerINTEL

Comment on lines +575 to +583
if (!SetKernelArgMemPointerPtr) {
UR_RETURN_ON_FAILURE(
cl_ext::getExtFuncFromContext<clSetKernelArgMemPointerINTEL_fn>(
Queue->Context->CLContext,
cast(ur::cl::getAdapter())
->fnCache.clSetKernelArgMemPointerINTELCache,
cl_ext::SetKernelArgMemPointerName,
&SetKernelArgMemPointerPtr));
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that L0 adapters store it in the platform structure.

Comment thread unified-runtime/source/loader/layers/sanitizer/msan/msan_ddi.cpp Outdated
@bratpiorka
bratpiorka force-pushed the rrudnick_coverity2 branch from dcbf84e to 33d3916 Compare July 30, 2026 16:49
Release the context when shadow setup fails. CPU shadow memory is a singleton and does not retain per-device contexts, so release those after setup as well.
@bratpiorka
bratpiorka force-pushed the rrudnick_coverity2 branch from 33d3916 to 1b8cfd5 Compare July 31, 2026 07:24

@mmichel11 mmichel11 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Command buffer changes LGTM

@bratpiorka

Copy link
Copy Markdown
Contributor Author

native CPU failure is unrelated: #22850

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants