mitiskuma commented on code in PR #18871:
URL: https://github.com/apache/tvm/pull/18871#discussion_r2885078210
##########
web/src/webgpu.ts:
##########
@@ -727,17 +812,37 @@ export class WebGPUContext {
}
});
- compute.setBindGroup(0, this.device.createBindGroup({
- layout: bindGroupLayout,
- entries: bindGroupEntries
- }));
+ // Bind group cache: build key from pipeline identity + buffer ptrs +
uniform key
+ let bgCacheKey = pipelineId;
+ for (let i = 0; i < bufferArgIndices.length; ++i) {
+ bgCacheKey += ":" + args[bufferArgIndices[i]];
+ }
+ bgCacheKey += ":" + uniformKey;
Review Comment:
This is largely theoretical nonsense. TVM shader names are generated by the
compiler and don't contain colons. Even if they did, an attacker would need to
control shader names at compile time, which means they already have full code
execution. This isn't a real security issue it's a cache key collision edge
case that can't happen in practice with TVM-generated code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
