PyTorch memory and injection findings, llama.cpp packaging and SYCL work

Security reports against PyTorch and llama.cpp led the day, covering prompt injection and several out-of-bounds reads on CPU and batch paths. llama.cpp also saw packaging and Intel GPU graph work, while Ollama deferred a Qualcomm NPU request upstream.

Prompt injection via filenames in PyTorch AI PR review

A report on pytorch/pytorch describes a prompt-injection risk in PyTorch's AI PR-review hook. Untrusted filenames can enter additionalContext and influence the review model. Teams using automated PR review should treat filename content as an untrusted input boundary.

OOB reads in batch_norm_update_stats

An issue against PyTorch states that batch_norm_update_stats accesses past undersized running-stat tensors. The missing bounds check produces out-of-bounds reads on the CPU path. Callers that supply smaller running statistics than expected can hit memory safety failures.

SemVer Docker tags for llama.cpp releases

Maintainers of ggml-org/llama.cpp are discussing how release commits can receive SemVer-tagged Docker images on GHCR. Builds currently lean on daily cron images without reliable version tags. Proper tags would give downstream users stable, reproducible container references.

SYCL graph record and replay in llama.cpp

A pull request adds SYCL graph record and replay support to llama.cpp. Discussion includes early Intel GPU benchmarks and tuning questions. The change aims to improve execution efficiency on Intel GPU backends used for local inference.

M-RoPE batch.pos buffer overread and fix

A report on llama.cpp notes that M-RoPE embedding batches read batch.pos past the documented n_tokens array. A follow-up change addresses an AddressSanitizer-detected heap-buffer-overflow when auto-generating M-RoPE positions. Correct position buffer sizing is required to keep the batch path memory-safe.

Unchecked offsets in inductor::_reinterpret_tensor

A pytorch/pytorch bug report states that inductor::_reinterpret_tensor builds out-of-bounds views from unchecked offsets. View access can then trigger CPU heap-buffer-overflow. The issue affects the TorchInductor path used for optimized CPU kernels.

Qualcomm IQ-9075 support deferred to llama.cpp

A request on ollama/ollama asks for Qualcomm IQ-9075 NPU/GPU support. The reply indicates enablement must land in llama.cpp first. Ollama cannot expose that hardware until the upstream backend lands the necessary support.