Fix allocation-size-too-big crash in prepare_input_tensors #8233
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/8233
Note: Links to docs will display an error until the docs builds have been completed. ❗ 1 Active SEVsThere are 1 currently active SEVs. If your PR is affected, please view them below: ❌ 1 New Failure, 2 PendingAs of commit f71670a with merge base e7fd150 ( NEW FAILURE - The following job has failed:
This comment was automatically generated by Dr. CI and updates every 15 minutes. |
facebook-github-bot
added
the
CLA Signed
|
This pull request was exported from Phabricator. Differential Revision: D68876117 |
dbort
added
module: extension
dbort
commented
Feb 5, 2025
| @@ -40,10 +62,29 @@ Result<BufferCleanup> prepare_input_tensors(Method& method) { | |||
| } | |||
| Result<TensorInfo> tensor_meta = method_meta.input_tensor_meta(i); | |||
| if (!tensor_meta.ok()) { | |||
| BufferCleanup cleanup({inputs, num_allocated}); | |||
There was a problem hiding this comment.
This PR also fixes this buffer leak
larryliu0820
reviewed
Feb 5, 2025
larryliu0820
reviewed
Feb 5, 2025
|
I was thinking that testing would require adding PTE files with a large number of inputs and large allocations, but I could use an existing PTE and just reduce the limits. I'll look into it. |
) Summary: (Adapted from an LLM-suggested fix for a fuzzer-discovered crash) The crash is an allocation-size-too-big error that occurs when the `prepare_input_tensors` function attempts to allocate an excessively large amount of memory for the `inputs` array. This crash is caused by the function's inability to handle large numbers of inputs, resulting in an attempt to allocate a huge amount of memory that exceeds the system's limits. The root cause of the crash is the lack of bounds checking on the `num_inputs` variable, which allows the function to attempt to allocate an arbitrarily large amount of memory. This is exacerbated by the fact that the function allocates memory for each input tensor separately, without checking the total size of all tensors before allocating memory for the `inputs` array. The patch fixes the crash by adding bounds checking on the `num_inputs` variable and calculating the total size of all tensors before allocating memory for the `inputs` array. Differential Revision: D68876117
dbort
force-pushed
the
export-D68876117
branch
from
5b572b5 to
f71670a
Compare
|
This pull request was exported from Phabricator. Differential Revision: D68876117 |
|
Added tests, thanks for pushing me to do so :) So many of these fuzzer fixes aren't unit-testable without corrupt PTE files, but this fix is. |
larryliu0820
approved these changes
Feb 5, 2025
This was referenced Feb 11, 2025
This was referenced Feb 24, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary:
(Adapted from an LLM-suggested fix for a fuzzer-discovered crash)
The crash is an allocation-size-too-big error that occurs when the
prepare_input_tensorsfunction attempts to allocate an excessively large amount of memory for theinputsarray. This crash is caused by the function's inability to handle large numbers of inputs, resulting in an attempt to allocate a huge amount of memory that exceeds the system's limits.The root cause of the crash is the lack of bounds checking on the
num_inputsvariable, which allows the function to attempt to allocate an arbitrarily large amount of memory. This is exacerbated by the fact that the function allocates memory for each input tensor separately, without checking the total size of all tensors before allocating memory for theinputsarray.The patch fixes the crash by adding bounds checking on the
num_inputsvariable and calculating the total size of all tensors before allocating memory for theinputsarray.Differential Revision: D68876117