From e9ec2c022e5f99740645cc020f3ff3fc2685c863 Mon Sep 17 00:00:00 2001 From: "Alexander F. Lent" Date: Thu, 25 Dec 2025 00:53:04 -0500 Subject: [PATCH] Fix CVE-2025-3730 for PyTorch 2.5.1 (rhbz#2360874) Signed-off-by: Alexander F. Lent --- ...26bfb8f2c343f5c614a6bbf685d91160f3af.patch | 96 +++++++++++++++++++ python-torch.spec | 4 + 2 files changed, 100 insertions(+) create mode 100644 01f226bfb8f2c343f5c614a6bbf685d91160f3af.patch diff --git a/01f226bfb8f2c343f5c614a6bbf685d91160f3af.patch b/01f226bfb8f2c343f5c614a6bbf685d91160f3af.patch new file mode 100644 index 0000000..4e18cf6 --- /dev/null +++ b/01f226bfb8f2c343f5c614a6bbf685d91160f3af.patch @@ -0,0 +1,96 @@ +From 01f226bfb8f2c343f5c614a6bbf685d91160f3af Mon Sep 17 00:00:00 2001 +From: zeshengzong +Date: Mon, 14 Apr 2025 07:24:30 +0000 +Subject: [PATCH] Add check for ctc_loss targets param (#150981) + +Fixes #150835 + +## Test Result + +```python +# cuda +>>> import torch +>>> import torch.nn.functional as F +>>> device = "cuda" # "cpu" is fine +>>> num_classes = 4 +>>> log_probs = torch.rand(0, 0, num_classes, device=device) +>>> targets = torch.tensor([], device=device, dtype=torch.long) +>>> input_lengths = torch.tensor([], device=device, dtype=torch.long) +>>> target_lengths = torch.tensor([], device=device, dtype=torch.long) +>>> result = F.ctc_loss(log_probs, targets, input_lengths, target_lengths, reduction='none') + +Traceback (most recent call last): + File "", line 1, in + File "/home/zong/code/pytorch/torch/nn/functional.py", line 3079, in ctc_loss + return torch.ctc_loss( + ^^^^^^^^^^^^^^^ +RuntimeError: log_probs tensor must not be empty + +# cpu +>>> device = "cpu" +>>> num_classes = 4 +>>> log_probs = torch.rand(0, 0, num_classes, device=device) +>>> targets = torch.tensor([], device=device, dtype=torch.long) +>>> input_lengths = torch.tensor([], device=device, dtype=torch.long) +>>> target_lengths = torch.tensor([], device=device, dtype=torch.long) +>>> result = F.ctc_loss(log_probs, targets, input_lengths, target_lengths, reduction='none') +Traceback (most recent call last): + File "", line 1, in + File "/home/zong/code/pytorch/torch/nn/functional.py", line 3079, in ctc_loss + return torch.ctc_loss( + ^^^^^^^^^^^^^^^ +RuntimeError: log_probs tensor must not be empty + +``` +Pull Request resolved: https://github.com/pytorch/pytorch/pull/150981 +Approved by: https://github.com/eqy +--- + aten/src/ATen/native/LossCTC.cpp | 1 + + aten/src/ATen/native/cuda/LossCTC.cu | 1 + + test/test_nn.py | 9 +++++++++ + 3 files changed, 11 insertions(+) + +diff --git a/aten/src/ATen/native/LossCTC.cpp b/aten/src/ATen/native/LossCTC.cpp +index 1513e756c71d7..46b9397a008c4 100644 +--- a/aten/src/ATen/native/LossCTC.cpp ++++ b/aten/src/ATen/native/LossCTC.cpp +@@ -126,6 +126,7 @@ std::tuple> ctc_loss_allocate_outpu + // the alphas from the user by only returning the loss. + template + std::tuple ctc_loss_cpu_template(const Tensor& log_probs, const Tensor& targets, IntArrayRef input_lengths, IntArrayRef target_lengths, int64_t BLANK) { ++ TORCH_CHECK(log_probs.numel() > 0, "log_probs tensor must not be empty"); + // log_probs: input_len x batch_size x num_labels + // targets [int64]: batch_size x target_length OR sum(target_lengths) + constexpr scalar_t neginf = -std::numeric_limits::infinity(); +diff --git a/aten/src/ATen/native/cuda/LossCTC.cu b/aten/src/ATen/native/cuda/LossCTC.cu +index e597b64c0c175..b5908cc0abcfc 100644 +--- a/aten/src/ATen/native/cuda/LossCTC.cu ++++ b/aten/src/ATen/native/cuda/LossCTC.cu +@@ -219,6 +219,7 @@ ctc_loss_log_alpha_gpu_kernel(scalar_t* __restrict__ log_alpha_data, + // backward. The dispatch function will only return the loss. + template + std::tuple ctc_loss_gpu_template(const Tensor& log_probs, const Tensor& targets, IntArrayRef input_lengths, IntArrayRef target_lengths, int64_t BLANK) { ++ TORCH_CHECK(log_probs.numel() > 0, "log_probs tensor must not be empty"); + // log_probs: input_len x batch_size x num_labels + // targets [int64]: batch_size x target_length OR sum(target_lengths) + CheckedFrom c = "ctc_loss_gpu"; +diff --git a/test/test_nn.py b/test/test_nn.py +index 32b0efd40aff1..3a2a89a92ba6c 100644 +--- a/test/test_nn.py ++++ b/test/test_nn.py +@@ -11532,6 +11532,15 @@ def test_ctc_loss_cudnn_tensor(self, device): + grad_cudnn, = torch.autograd.grad(loss_cudnn, log_probs, grad_out) + self.assertEqual(grad_cudnn, grad_native, atol=1e-4, rtol=0) + ++ @expectedFailureMPS ++ def test_ctc_loss_error(self, device): ++ log_probs = torch.rand(0, 0, 4, device=device) ++ targets = torch.tensor([], device=device, dtype=torch.long) ++ input_lengths = torch.tensor([], device=device, dtype=torch.long) ++ target_lengths = torch.tensor([], device=device, dtype=torch.long) ++ with self.assertRaisesRegex(RuntimeError, "log_probs tensor must not be empty"): ++ F.ctc_loss(log_probs, targets, input_lengths, target_lengths, reduction='none') ++ + @expectedFailureMPS # RuntimeError: LSTM with projections is not currently supported with MPS. + @dtypesIfCUDA(torch.half, torch.float, torch.double) + @dtypes(torch.float) diff --git a/python-torch.spec b/python-torch.spec index 86794c5..cde11e0 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -103,6 +103,10 @@ Patch101: 0001-cuda-hip-signatures.patch # https://github.com/pytorch/pytorch/issues/145608 Patch102: 0001-torch-paper-over-c-assert.patch +# Fix CVE-2025-3730 +# source: https://github.com/pytorch/pytorch/commit/01f226bfb8f2c343f5c614a6bbf685d91160f3af +Patch201: 01f226bfb8f2c343f5c614a6bbf685d91160f3af.patch + ExclusiveArch: x86_64 aarch64 %global toolchain gcc %global _lto_cflags %nil