Skip to content

llama : fix null pointer dereference by checking for rotation buffer in K-cache shifts#25636

Open
engeldlgado wants to merge 1 commit into
ggml-org:masterfrom
engeldlgado:fix-rope-shift-null-rot
Open

llama : fix null pointer dereference by checking for rotation buffer in K-cache shifts#25636
engeldlgado wants to merge 1 commit into
ggml-org:masterfrom
engeldlgado:fix-rope-shift-null-rot

Conversation

@engeldlgado

@engeldlgado engeldlgado commented Jul 13, 2026

Copy link
Copy Markdown

Overview

Upstream AUTO-ACTIVATES Hadamard rotation (attn_rot_k) when the K cache is quantized and the head size is divisible by 64... In these cases, rot is not null and DOES NOT crash (with Qwen head-128 it does not reproduce). The actual window:

  1. LLAMA_ATTN_ROT_DISABLE=1 (src/llama-kv-cache.cpp ~329) + quantized K + context shift -> crash.

  2. Models with head size NOT divisible by 64 (there are: 80, 96, 112) + quantized K + context shift -> same crash, without touching any environment.

Mechanics: build_input_k_rot returns nullptr when attn_rot_k is false (~1413)... build_rope_shift calls llama_mul_mat_hadamard(ctx, tmp, rot) unconditionally on the quantized branch (~1862/1869)... the helper does rot->ne[0] without checking (src/llama-impl.h ~61). The fix: skip rotation when no rotation is configured. With attn_rot_k active, nothing changes.

To reproduce the error, you can run these commands in main and it should crash as it did for me.

LLAMA_ATTN_ROT_DISABLE=1 ./build/bin/llama-server \
  -m Qwen3-0.6B-Q4_0.gguf -ngl 0 -ctk q8_0 -c 512 --context-shift \
  --port 8199 --host 127.0.0.1

curl -s http://127.0.0.1:8199/completion -H "Content-Type: application/json" \
  -d '{"prompt":"Write a very long story about a lighthouse keeper.","n_predict":700,"ignore_eos":true,"temperature":0}'

Without fix: dies upon reaching the "slot context shift" (~450 tokens). With fix: completes the 700.

Requirements

  • I have read and agree with the contributing guidelines
  • AI usage disclosure:
    Yes, I used assistance to reproduce the error, but the fix and implementation are mine. I had to fix it to implement llama.cpp in the ToshLLM app for Intel Macs.

@engeldlgado engeldlgado requested a review from ggerganov as a code owner July 13, 2026 19:44
@ggml-gh-bot

ggml-gh-bot Bot commented Jul 13, 2026

Copy link
Copy Markdown

Hi @engeldlgado, thanks for your contribution!

Per our contribution guidelines, the automated PR checker found the following issue(s) that need your attention:

  • PR Template not respected: Please respect the template when creating a new pull request. Make sure to fill out all required sections.

Please note that maintainers reserve the right to make final decisions on PRs. If you believe there is a mistake, please comment below.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant