From e7b12fe6fadb076fbb8baa7645ef04e8778b2259 Mon Sep 17 00:00:00 2001 From: Ke Bao Date: Tue, 26 May 2026 07:04:00 +0800 Subject: [PATCH] Fix stale forward_metadata leak in DP attn unpadded idle batch (#26313) --- python/sglang/srt/model_executor/model_runner.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/python/sglang/srt/model_executor/model_runner.py b/python/sglang/srt/model_executor/model_runner.py index 71b86ed5e..d8245c06f 100644 --- a/python/sglang/srt/model_executor/model_runner.py +++ b/python/sglang/srt/model_executor/model_runner.py @@ -3101,11 +3101,17 @@ class ModelRunner(ModelRunnerKVCacheMixin): def forward_idle( self, forward_batch: ForwardBatch, pp_proxy_tensors=None ) -> Union[LogitsProcessorOutput, PPProxyTensors]: - # In DP Attention, IDLE batches are padded (batch_size > 0) for MLP sync. - # in this case, we need to reinit the forward metadata, otherwise the stale - # metadata causes batch_size mismatch in attention kernel(e.g. DSA Indexer). + # In DP Attention, IDLE batches may be padded (batch_size > 0) for MLP + # sync. Reinit metadata for the padded case so attention kernels see + # the right batch_size (e.g. DSA Indexer). For the unpadded case + # (batch_size == 0) explicitly drop any stale forward_metadata left + # over from the previous forward — without this, attention layers + # called from the idle path can re-read a prior batch's req_pool + # indices and trigger SWA mapping use-after-free. if forward_batch.batch_size > 0: self.attn_backend.init_forward_metadata(forward_batch) + else: + self.attn_backend.forward_metadata = None kwargs = {} if self.support_pp: