Fix TensorScatter CPU security issue

docs/OperatorKernels.md

@@ -507,7 +507,7 @@ The **OpSet Version** column uses the following notation:
 |||[7, 21]|**T** = tensor(float)|
 |Tanh|*in* input:**T**<br> *out* output:**T**|13+|**T** = tensor(double), tensor(float)|
 |||[6, 12]|**T** = tensor(double), tensor(float)|
-|TensorScatter|*in* past_cache:**T**<br> *in* update:**T**<br> *in* write_indices:**tensor(int64)**<br> *out* present_cache:**T**|24+|**T** = tensor(bfloat16), tensor(bool), tensor(double), tensor(float), tensor(float16), tensor(int16), tensor(int32), tensor(int64), tensor(int8), tensor(string), tensor(uint16), tensor(uint32), tensor(uint64), tensor(uint8)|
+|TensorScatter|*in* past_cache:**T**<br> *in* update:**T**<br> *in* write_indices:**tensor(int64)**<br> *out* present_cache:**T**|24+|**T** = tensor(bfloat16), tensor(bool), tensor(double), tensor(float), tensor(float16), tensor(int16), tensor(int32), tensor(int64), tensor(int8), tensor(uint16), tensor(uint32), tensor(uint64), tensor(uint8)|
 |TfIdfVectorizer|*in* X:**T**<br> *out* Y:**T1**|9+|**T** = tensor(int32), tensor(int64), tensor(string)<br/> **T1** = tensor(float)|
 |ThresholdedRelu|*in* X:**T**<br> *out* Y:**T**|22+|**T** = tensor(float)|
 |||[10, 21]|**T** = tensor(float)|

onnxruntime/core/providers/cpu/llm/tensorscatter.cc

@@ -16,7 +16,7 @@ ONNX_CPU_OPERATOR_KERNEL(
     24,
     KernelDefBuilder()
         .MayInplace(0, 0)
-        .TypeConstraint("T", DataTypeImpl::AllTensorTypes()),
+        .TypeConstraint("T", DataTypeImpl::AllFixedSizeTensorTypes()),
     TensorScatter);
 
 TensorScatter::TensorScatter(const OpKernelInfo& info) : OpKernel(info) {

onnxruntime/test/providers/cpu/llm/tensorscatter_op_test.cc

@@ -354,5 +354,32 @@ TEST(TensorScatterTest, Circular_NegativeWriteIndex) {
            {}, nullptr, &execution_providers);
 }
 
+// The CPU kernel only supports fixed-size element types (matching the CUDA
+// kernel's type constraint). Non-fixed-size element types such as string are
+// intentionally excluded because the kernel operates on raw memory buffers.
+// Loading a graph that binds a string tensor to TensorScatter must fail at
+// kernel resolution rather than at Compute time.
+TEST(TensorScatterTest, StringType_NotSupported) {
+  OpTester test("TensorScatter", 24);
+  test.AddAttribute<std::string>("mode", "linear");
+
+  test.AddInput<std::string>("past_cache", {1, 4, 1},
+                             {"alpha", "beta", "gamma", "delta"});
+  test.AddInput<std::string>("update", {1, 1, 1}, {"omega"});
+  test.AddInput<int64_t>("write_indices", {1}, {2});
+  test.AddOutput<std::string>("present_cache", {1, 4, 1},
+                              {"alpha", "beta", "omega", "delta"});
+
+  std::vector<std::unique_ptr<IExecutionProvider>> execution_providers;
+  execution_providers.push_back(DefaultCpuExecutionProvider());
+  // The graph resolver rejects the node when no kernel matches the string
+  // element type. The exact wording differs between the graph-partitioner
+  // path ("Could not find an implementation for ...") and the later kernel
+  // lookup path ("Failed to find kernel for ..."), so match on the op name
+  // which is present in both.
+  test.Run(OpTester::ExpectResult::kExpectFailure, "TensorScatter",
+           {}, nullptr, &execution_providers);
+}
+
 }  // namespace test
 }  // namespace onnxruntime