Merge remote-tracking branch 'upstream/master' into gpu_l0_enable_onednn

Author: jkasprza

src/core/shape_inference/include/space_to_batch_shape_inference.hpp

@@ -70,7 +70,8 @@ std::vector<TRShape> shape_infer(const SpaceToBatch* op,
             for (auto idx = spatial_dim_offset; idx < data_rank_size; ++idx) {
                 NODE_VALIDATION_CHECK(op, (*blocks)[idx] > 0, "block_shape values must be greater than 0");
 
-                const auto padded_dim = data_shape[idx] + static_cast<TVal>((*pads_begin)[idx] + (*pads_end)[idx]);
+                const auto padded_dim =
+                    data_shape[idx] + static_cast<TVal>((*pads_begin)[idx]) + static_cast<TVal>((*pads_end)[idx]);
                 const auto divisor = static_cast<TVal>((*blocks)[idx]);
 
                 if (static_cast<int64_t>(padded_dim.get_max_length()) == dim::inf_bound) {

src/core/src/op/space_to_batch.cpp

@@ -6,10 +6,12 @@
 
 #include <cmath>
 #include <cstddef>
+#include <limits>
 #include <memory>
 #include <numeric>
 
 #include "itt.hpp"
+#include "openvino/core/memory_util.hpp"
 #include "openvino/core/shape.hpp"
 #include "openvino/op/util/attr_types.hpp"
 #include "openvino/op/util/precision_sensitive_attribute.hpp"
@@ -100,10 +102,29 @@ bool evaluate(TensorVector& outputs, const TensorVector& inputs) {
 
     Shape padded_shape(data_shape.size());
     for (size_t i = 0; i < data_shape.size(); ++i) {
-        padded_shape[i] = data_shape[i] + pads_begin_vec[i] + pads_end_vec[i];
+        OPENVINO_ASSERT(pads_begin_vec[i] >= 0,
+                        "SpaceToBatch: pads_begin[",
+                        i,
+                        "] must be non-negative, got ",
+                        pads_begin_vec[i]);
+        OPENVINO_ASSERT(pads_end_vec[i] >= 0,
+                        "SpaceToBatch: pads_end[",
+                        i,
+                        "] must be non-negative, got ",
+                        pads_end_vec[i]);
+        const auto pb = static_cast<size_t>(pads_begin_vec[i]);
+        const auto pe = static_cast<size_t>(pads_end_vec[i]);
+        OPENVINO_ASSERT(data_shape[i] <= std::numeric_limits<size_t>::max() - pb &&
+                            data_shape[i] + pb <= std::numeric_limits<size_t>::max() - pe,
+                        "SpaceToBatch: padded dimension ",
+                        i,
+                        " overflows");
+        padded_shape[i] = data_shape[i] + pb + pe;
     }
 
-    std::vector<char> padded_data(shape_size(padded_shape) * elem_size);
+    const auto padded_byte_size = ov::util::get_memory_size_safe(data.get_element_type(), padded_shape);
+    OPENVINO_ASSERT(padded_byte_size.has_value(), "SpaceToBatch: padded shape size overflows");
+    std::vector<char> padded_data(*padded_byte_size);
     reference::pad(static_cast<const char*>(data.data()),
                    pad_value,
                    padded_data.data(),
@@ -122,8 +143,8 @@ bool evaluate(TensorVector& outputs, const TensorVector& inputs) {
     std::iota(plain_axes_order.begin(), plain_axes_order.end(), 0);
 
     std::vector<char> flat_data(padded_data.begin(), padded_data.end());
-    std::vector<char> dispersed_data(shape_size(data_shape) * elem_size);
-    std::vector<char> post_transpose_data(shape_size(data_shape) * elem_size);
+    std::vector<char> dispersed_data(*padded_byte_size);
+    std::vector<char> post_transpose_data(*padded_byte_size);
 
     for (int64_t block_idx = block_values_size - 1; block_idx >= 0; --block_idx) {
         int64_t sq_shape_idx = block_values_size - 1;

src/frontends/paddle/src/op/partial_ops.hpp

@@ -12,6 +12,7 @@ namespace op {
 
 NamedOutputs partial_ops(const NodeContext& node, const std::string type) {
     auto x = node.get_ng_inputs("X");
+    PADDLE_OP_CHECK(node, x.size() == 2, "partial_ops requires exactly 2 inputs in X.");
     const auto start_index = node.get_attribute<int>("start_index");
     const auto length = node.get_attribute<int>("length");
     PADDLE_OP_CHECK(node, x[0].get_partial_shape().rank().get_length() == 2, "partial ops only support 2-D Tensor");

src/frontends/paddle/tests/read_paddle_model_test.cpp

@@ -307,3 +307,18 @@ TEST(Paddle_Reader_Tests, ImportBasicModelToCoreWstring) {
     ASSERT_TRUE(res.valid) << res.message;
 }
 #endif
+
+TEST(Paddle_Reader_Tests, LoadModelWithPartialOpsInsufficientInputs) {
+    auto model =
+        FrontEndTestUtils::make_model_path(std::string(TEST_PADDLE_MODELS_DIRNAME) + "partial_sum_oob/partial_sum_oob" +
+                                           std::string(TEST_PADDLE_MODEL_EXT));
+
+    ov::Core core;
+    try {
+        core.read_model(model);
+        FAIL() << "Expected load to fail due to insufficient X inputs for partial_sum";
+    } catch (const std::exception& ex) {
+        const std::string msg = ex.what();
+        ASSERT_NE(msg.find("partial_ops requires exactly 2 inputs in X."), std::string::npos) << msg;
+    }
+}

src/frontends/paddle/tests/test_models/gen_scripts/generate_partial_sum.py

@@ -5,11 +5,48 @@
 # partial_sum paddle model generator
 #
 import numpy as np
+import os
 from save_model import saveModel
 import paddle
 import sys
 
 
+def _get_framework_pb2():
+    try:
+        from paddle.fluid.proto import framework_pb2
+        return framework_pb2
+    except Exception:
+        pass
+    try:
+        from paddle.base.proto import framework_pb2
+        return framework_pb2
+    except Exception:
+        from paddle.framework.proto import framework_pb2
+        return framework_pb2
+
+
+def _corrupt_partial_sum_inputs(model_path: str):
+    framework_pb2 = _get_framework_pb2()
+    prog = framework_pb2.ProgramDesc()
+    with open(model_path, "rb") as f:
+        prog.ParseFromString(f.read())
+
+    modified = False
+    for block in prog.blocks:
+        for op in block.ops:
+            if op.type == "partial_sum":
+                for inp in op.inputs:
+                    if inp.parameter == "X" and len(inp.arguments) > 1:
+                        del inp.arguments[1:]
+                        modified = True
+
+    if not modified:
+        raise RuntimeError("Failed to modify partial_sum X inputs in model")
+
+    with open(model_path, "wb") as f:
+        f.write(prog.SerializeToString())
+
+
 def partial_sum(name: str, x, y, start_index=0, length=-1):
     paddle.enable_static()
 
@@ -64,5 +101,12 @@ def main():
     y = np.random.randint(-10, 10, [8, 10]).astype(dtype)
     partial_sum("partial_sum_3", x, y, start_index=1, length=5)
 
+    dtype = 'float32'
+    x = np.random.randn(4, 8).astype(dtype)
+    y = np.random.randn(4, 8).astype(dtype)
+    partial_sum("partial_sum_oob", x, y, start_index=0, length=4)
+    model_path = os.path.join(sys.argv[1], "partial_sum_oob", "partial_sum_oob.pdmodel")
+    _corrupt_partial_sum_inputs(model_path)
+
 if __name__ == "__main__":
     main()

src/frontends/pytorch/src/utils.cpp

@@ -680,7 +680,7 @@ std::deque<Output<Node>> get_list_as_outputs(const Output<Node>& start, bool uns
         } else if (op_type == "aten::add") {
             // Insert at beginning because we're walking backward through the chain.
             // Elements from RHS list come before any elements appended after this add operation.
-            auto&& rhs_list = get_list_as_outputs(fw_node->get_input_source_output(1));
+            auto&& rhs_list = get_list_as_outputs(fw_node->get_input_source_output(1), unsqueeze_for_concat);
             res.insert(res.begin(), rhs_list.begin(), rhs_list.end());
         } else {
             break;

src/plugins/intel_cpu/src/nodes/psroi_pooling.cpp

@@ -85,6 +85,7 @@ PSROIPooling::PSROIPooling(const std::shared_ptr<ov::Node>& op, const GraphConte
     const auto defPsroi = ov::as_type_ptr<const ov::op::v1::DeformablePSROIPooling>(op);
 
     noTrans = op->get_input_size() == 2;
+    inBatchNum = op->get_input_shape(0)[0];
     CPU_NODE_ASSERT(op->get_input_shape(0).size() == 4,
                     "has first input with incorrect rank: " + std::to_string(op->get_input_shape(0).size()));
     CPU_NODE_ASSERT(op->get_input_shape(1).size() == 2,
@@ -619,6 +620,7 @@ void PSROIPooling::executeSpecified() {
     cpu_parallel->parallel_for(realRois, [&](int currentRoi) {
         const float* bottomRois = bottomRoisBeginning + currentRoi * 5;
         auto roiBatchInd = static_cast<int>(bottomRois[0]);
+        OPENVINO_ASSERT(roiBatchInd <= inBatchNum, "required batch index > batch amount");
         if (getAlgorithm() == Algorithm::PSROIPoolingAverage) {
             executeAverage(srcData, dstData, bottomRois, currentRoi, roiBatchInd, *srcDesc, *dstDesc);
         } else if (getAlgorithm() == Algorithm::PSROIPoolingBilinear) {

src/plugins/intel_cpu/src/nodes/psroi_pooling.h

@@ -48,6 +48,8 @@ class PSROIPooling : public Node {
     int nh = 0;
     int nw = 0;
 
+    int inBatchNum = 0;
+
     // for Deformable PSROIPolling
     bool noTrans;
     int partSize = 1;

src/plugins/intel_cpu/src/nodes/roi_pooling.cpp

@@ -377,6 +377,7 @@ size_t RoiPoolingKey::hash() const {
     seed = hash_combine(seed, refParams.mb);
     seed = hash_combine(seed, refParams.c);
     seed = hash_combine(seed, refParams.nb_c);
+    seed = hash_combine(seed, refParams.b_num);
     seed = hash_combine(seed, refParams.c_block);
     seed = hash_combine(seed, refParams.nb_c_blocking);
     seed = hash_combine(seed, refParams.ih);
@@ -546,9 +547,12 @@ void ROIPooling::prepareParams() {
     const auto& inDims = getParentEdgeAt(0)->getMemory().getStaticDims();
     const auto& outDims = getChildEdgeAt(0)->getMemory().getStaticDims();
 
+    const auto& featureShape = getParentEdgeAt(0)->getMemory().getStaticDims();
+
     refParams.mb = outDims[0];
     refParams.c = rnd_up(inDims[1], refParams.c_block);
     refParams.nb_c = refParams.c / refParams.c_block;
+    refParams.b_num = featureShape[0];
     refParams.ih = inDims[2];
     refParams.iw = inDims[3];
     refParams.oh = outDims[2];
@@ -619,6 +623,9 @@ class ROIPooling::ROIPoolingJitExecutor : public ROIPooling::ROIPoolingExecutor
             if (roi_batch_ind == -1) {
                 break;
             }
+            OPENVINO_ASSERT(0 <= roi_batch_ind && roi_batch_ind <= jpp.b_num,
+                            "takes incorrect roi_ind, max roi_ind = ",
+                            jpp.b_num);
         }
 
         cpuParallel->parallel_for4d(MB, cb_work, jpp.oh, jpp.ow, [&](int n, int cbb, int oh, int ow) {
@@ -636,6 +643,9 @@ class ROIPooling::ROIPoolingJitExecutor : public ROIPooling::ROIPoolingExecutor
                 const auto* src_roi_ptr = &src_roi[roi_off];
 
                 auto roi_batch_ind = static_cast<int>(src_roi_ptr[0]);
+                OPENVINO_ASSERT(0 <= roi_batch_ind && roi_batch_ind <= jpp.b_num,
+                                "takes incorrect roi_ind, max roi_ind = ",
+                                jpp.b_num);
 
                 if (jpp.alg == Algorithm::ROIPoolingMax) {
                     auto roi_start_w = static_cast<int>(round(src_roi_ptr[1] * jpp.spatial_scale));
@@ -758,6 +768,9 @@ class ROIPooling::ROIPoolingRefExecutor : public ROIPooling::ROIPoolingExecutor
             if (roi_batch_ind == -1) {
                 break;
             }
+            OPENVINO_ASSERT(0 <= roi_batch_ind && roi_batch_ind <= jpp.b_num,
+                            "takes incorrect roi_ind, max roi_ind = ",
+                            jpp.b_num);
         }
 
         cpuParallel->parallel_for4d(MB, cb_work, jpp.oh, jpp.ow, [&](int n, int cbb, int oh, int ow) {
@@ -780,6 +793,9 @@ class ROIPooling::ROIPoolingRefExecutor : public ROIPooling::ROIPoolingExecutor
                 const auto* src_roi_ptr = &src_roi[roi_off];
 
                 auto roi_batch_ind = static_cast<int>(src_roi_ptr[0]);
+                OPENVINO_ASSERT(0 <= roi_batch_ind && roi_batch_ind <= jpp.b_num,
+                                "takes incorrect roi_ind, max roi_ind = ",
+                                jpp.b_num);
 
                 if (jpp.alg == Algorithm::ROIPoolingMax) {
                     auto roi_start_w = static_cast<int>(round(src_roi_ptr[1] * jpp.spatial_scale));

src/plugins/intel_cpu/src/nodes/roi_pooling.h

@@ -27,6 +27,8 @@ struct jit_roi_pooling_params {
 
     int c_block, nb_c, nb_c_blocking;
 
+    int b_num;
+
     double spatial_scale;
     int pooled_h;
     int pooled_w;