tensorflow: A Check Fail can be triggerred in GRUBlockCell

Click to expand!

Issue Type

Bug

Source

binary

Tensorflow Version

tf 2.9 and 2.12.0-dev20221018

Custom Code

OS Platform and Distribution

Linux Ubuntu 20.04

Mobile device

No response

Python version

3.8

Bazel version

No response

GCC/Compiler version

No response

CUDA/cuDNN version

CUDA 11.5

GPU model and memory

No response

Current Behaviour?

A check fail can be triggerred in GRUBlockCell, which can lead to a crash.

Standalone code to reproduce the issue

import tensorflow as tf
import numpy as np
print(tf.__version__)
for _ in range(20):
    try:
            x = tf.random.uniform([1, 0, 1], dtype=tf.float32)
            h_prev = tf.random.uniform([1, 1, 1], dtype=tf.float32)
            w_ru = tf.random.uniform([1, 2, 1, 1, 1, 1], dtype=tf.float32)
            w_c = tf.random.uniform([1, 1, 1], dtype=tf.float32)
            b_ru = tf.random.uniform([2], dtype=tf.float32)
            b_c = tf.random.uniform([1], dtype=tf.float32)
            res = tf.raw_ops.GRUBlockCell(
                x=x,
                h_prev=h_prev,
                w_ru=w_ru,
                w_c=w_c,
                b_ru=b_ru,
                b_c=b_c,
            )
    except:
        pass

Relevant log output

F tensorflow/core/framework/tensor_shape.cc:45] Check failed: NDIMS == dims() (2 vs. 3)Asking for tensor of 2 dimensions from a tensor of 3 dimensions
Aborted (core dumped)

About this issue

Original URL
State: closed
Created 2 years ago
Comments: 20 (4 by maintainers)

Most upvoted comments

While these are internal APIs, the check failure could lead to denial of service. In the past this used to be considered a vulnerability, but since the impact is bounded and preventable, now the policy is for these to be files as issues and resolved whenever someone from community wants to pick them up (they’re very good first issues). Please don’t auto-close these!

mihaimaruseac on Dec 9, 2022

The error you’re encountering is likely due to the shape of the inputs to the GRUBlockCell operation. According to the TensorFlow documentation, the inputs x, h_prev, w_ru, w_c, b_ru, and b_c should have specific shapes based on the dimensions of the input and the parameters being passed to the GRU cell.

In the code you posted, it appears that the shapes of the inputs are not correctly specified. For example, the shape of x is [1, 0, 1], which is not valid.

I would suggest reviewing the documentation and ensuring that the shapes of the inputs match the expected dimensions. You can also check that the shapes of the variables match the dimensions of your input data.

saurabhmj11 on Feb 6, 2023

You’ll probably need to add your own, since each one of them checks one condition

mihaimaruseac on Dec 13, 2022

https://github.com/tensorflow/tensorflow/blob/de8c87d351456d5f0d6fcf6b6d3c7d5e63c2b701/tensorflow/core/kernels/rnn/gru_ops.cc#L32-L35

OP_REQUIRES_OK has a similar semantic, if the status is no Ok the macro finishes execution of the kernel and returns the invalid Status back to the user.

mihaimaruseac on Dec 12, 2022

Sure. Please look in tensor_shape.cc: https://github.com/tensorflow/tensorflow/blob/4abf9e92de46ee91df5d2fe3e23ab529b115e52f/tensorflow/core/framework/tensor_shape.cc#L44-L47

The issue is the CHECK_EQ line, that fails whenever the condition is false. You need to trace where the call comes from. Parent is https://github.com/tensorflow/tensorflow/blob/4abf9e92de46ee91df5d2fe3e23ab529b115e52f/tensorflow/core/framework/tensor_shape.h#L653-L657

However, this parent is still too deep inside. You need to find a function for the GRUBlockCell kernel that returns a Status and which in the end will trigger this check failure. Then, in the function, compare the tensor elements and return an invalid status.

mihaimaruseac on Dec 11, 2022