$ the-wire · showcase
Executorch closes a security hole and two silent-alias bugs
By RepoJournal · Filed · About PyTorch · Composed from the cited sources · methodology
15 people shipped this
JakeStevens
@JakeStevens
2 cited
Hosi121
@Hosi121
1 cited
Marko Radosavljevic
@amd-maradosa
1 cited
Elena Zhelezina
@wwwind
1 cited
Tomasz Szulist
@tszulist-hbn
sxxaysq
@sxxaysq
drisspg
@drisspg
mergennachin
@mergennachin
tushar00jain
@tushar00jain
fegin
@fegin
Animesh Jain
@anijain2305
francesco-bertolotti
@francesco-bertolotti
Aditya Venkataraman
@aditvenk
peterdsharpe
@peterdsharpe
Nicholas022400701
@Nicholas022400701
Executorch's Arm backend ships a CWE-22 fix while the reinplace and memory planners stop corrupting returned tensors, and PyTorch's CPU col2im and ROCm builds get targeted repairs.
Arm backend: Fix Metis bug in backend.py, CWE-22 (#23485) pytorch/executorch
The Arm backend's backend.py path handling is patched for a CWE-22 path traversal reported by Metis, which matters to anyone running ExecuTorch with the Arm delegate on untrusted model or file paths.
Fix reinplace liveness for returned tensors pytorch/executorch
The reinplace pass left graph outputs out of reverse liveness analysis, so a model returning both an original tensor and the result of index_put could have index_put rewritten to the in-place index_put_ and silently mutate the original output. Output nodes are now treated as readers, and regression tests cover returned originals, nested outputs, immutable inputs, and view-copy behavior.
Preserve in-place result aliases and lifetimes during memory planning pytorch/executorch
With run_reinplace_pass=True, an in-place result could stay live after the memory planner considered its storage dead, and the next allocation would overwrite it, which is what produced non-repeatable Whisper static-prefill logits and KV caches. SpecPropPass now propagates in-place result aliases before downstream outputs and getitems capture their spec.
Improve CPU Col2im speed and reduce output storage (#198123) pytorch/pytorch
CPU Fold computed the valid width range per value inside the row loop and ran channels on one thread; the new code hoists the bounds check out of the loop and processes separate output planes in parallel, cutting redundant output storage for contiguous cases.
[ROCm] Build AsyncMM.hip only for gfx942/gfx950 (#200054) pytorch/pytorch
AsyncMM.hip was being compiled for every arch in PYTORCH_ROCM_ARCH, and its ck_tile headers do not compile for gfx900, gfx906, gfx90c, gfx1010, gfx1011 or gfx1012, breaking multi-arch builds. It now builds only for gfx942 and gfx950, and Vulkan workloads gained a fused SwiGLU kernel that drops 56 dispatches per token on Qwen3-0.6B once models are re-exported.
Action items
