TorchScript runs a module's __setstate__ during torch::jit::load(), before the
loaded module reaches CModelGraphValidator (which only walks the inlined forward
graph). A forbidden op hidden in __setstate__ is therefore invisible to the
validator and has already executed by the time validation would run.

Add fixtures and a self-contained repro that demonstrate the gap:
- generate_malicious_models.py: add SetStateFileReaderModel and a submodule
  variant (aten::from_file in __setstate__, benign forward); surface
  __setstate__ ops in the generator output.
- test/test_setstate_load_timing.py: torch-only, build-free repro proving
  load-time execution (benign print probe) and op-hiding (static inspection).
- test_pytorch_inference_evil_models.py: register the fixtures as regression
  guards for the forthcoming pre-load scan.

No fix yet; this only reproduces and documents the vulnerability.

Co-authored-by: Cursor <[email protected]>

Close the load-time execution gap: torch::jit::load runs a module's
__setstate__ during deserialization, before CModelGraphValidator (which walks
an already-loaded module's graph) can run. A forbidden op hidden in
__setstate__ therefore executes at load time and never appears in the forward
graph the validator inspects.

Add CModelGraphValidator::scanSerialisedCodeForForbiddenOps, which uses a
PyTorchStreamReader over the buffered archive bytes to textually scan the
serialised TorchScript code (code/**/*.py, including every submodule's
__setstate__) for the forbidden aten ops, WITHOUT loading the model. Main.cc
runs this scan before torch::jit::load and rejects via HANDLE_FATAL, so no
model code executes. Expose the buffered bytes via CBufferedIStreamAdapter::buffer().

This is a defense-in-depth textual check targeted at the curated forbidden set
(from_file, as_strided, save); the post-load allowlist validation is unchanged,
and seccomp remains the syscall backstop. Unit tests cover both setstate
fixtures, forward-graph attacks, a benign model (no false positive), and
malformed input; the binary integration test now expects the setstate models to
be rejected with the forbidden-operations message.

Co-authored-by: Cursor <[email protected]>

Match the #12621 reporter remediation by refusing archives that embed
__setstate__/__getstate__, and keep the forbidden-op pre-scan as defense
in depth. Allowlisted-op RCE gadgets in setstate are otherwise missed.

Co-authored-by: Cursor <[email protected]>

Custom state-hook rejection is enough for the load-time execution gap;
forward-graph ops remain covered by post-load validate().

Co-authored-by: Cursor <[email protected]>

…, #12242)

Fold the inductor::_reinterpret_tensor hardening (elastic/security#12242) into
the same PR as the __setstate__ load-time hook ban (elastic/security#12621), so
the two model-validation fixes land as one coherent change and supersede elastic#3079.

TorchInductor's _reinterpret_tensor takes an unchecked storage offset and yields
the same class of OOB heap read/write previously mitigated by forbidding
aten::as_strided; it was used to bypass that forbid.

- Add inductor::_reinterpret_tensor to FORBIDDEN_OPERATIONS so the post-load
  graph validator fail-fasts (authoritative, syntax-independent). An op hidden
  in __setstate__ is already refused pre-load by the custom-state-hook ban.
- Add forward-only OOB read/write fixtures + a post-load forbid unit test and
  evil-model integration entries.
- Reconcile the evil-model __setstate__ entries to expect the hook-ban message
  ("custom state hooks") rather than the removed op-scan message.

Co-authored-by: Cursor <[email protected]>

Co-authored-by: Cursor <[email protected]>

…st diagnostics

Co-authored-by: Cursor <[email protected]>