Skip to content

Conversation

wseaton
Copy link
Contributor

@wseaton wseaton commented May 30, 2025

In #18454 we moved off of the std library regex library in an attempt to prevent catastrophic backtracking.

The replacement regex library also supports a timeout flag, this PR adds a global timeout (making use of the new flag) for complex tool parsers as an extra layer of protection against malicious input.

wseaton added 2 commits May 30, 2025 09:26
Copy link

👋 Hi! Thank you for contributing to the vLLM project.

💬 Join our developer Slack at https://slack.vllm.ai to discuss your PR in #pr-reviews, coordinate on features in #feat- channels, or join special interest groups in #sig- channels.

Just a reminder: PRs would not trigger full CI run by default. Instead, it would only run fastcheck CI which starts running only a small and essential subset of CI tests to quickly catch errors. You can run other CI tests on top of those by going to your fastcheck build on Buildkite UI (linked in the PR checks section) and unblock them. If you do not have permission to unblock, ping simon-mo or khluu to add you in our Buildkite org.

Once the PR is approved and ready to go, your PR reviewer(s) can run CI to test the changes comprehensively before merging.

To run CI, PR reviewers can either: Add ready label to the PR or enable auto-merge.

🚀

Copy link
Member

@russellb russellb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

great idea! just one minor suggestion

wseaton added 2 commits May 30, 2025 09:42
Signed-off-by: Will Eaton <[email protected]>
Signed-off-by: Will Eaton <[email protected]>
Copy link
Member

@njhill njhill left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @wseaton this should be very useful to protect prod servers against problematic cases.

vllm/envs.py Outdated
VLLM_NIXL_SIDE_CHANNEL_PORT: int = 5557
VLLM_ALL2ALL_BACKEND: str = "naive"
VLLM_MAX_TOKENS_PER_EXPERT_FP4_MOE: int = 163840
VLLM_TOOL_PARSE_REGEX_TIMEOUT: int = 5
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should include the units (assuming secs?) somewhere.. probably in the env var name but if not in the comments.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Especially given that it's overridable, I feel like the default should be shorter (e.g. 1 or 2 seconds?) since time spent in this is going to block concurrent requests too.

if not (self.TOOL_CALL_REGEX.match(model_output)):

try:
if not (self.TOOL_CALL_REGEX.match(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: superfluous parentheses (though there were already there before this change)

Comment on lines +72 to +73
logger.warning(
"Regex timeout occurred when matching tool call pattern.")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

May be good to include the problematic input in this log, at least if debug is enabled? (if debug isn't enabled we might want to avoid logging user data).

Comment on lines 68 to 70
return ExtractedToolCallInformation(tools_called=False,
tool_calls=[],
content=model_output)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: maybe have a bool variable which is set in both the non-match and timeout cases to avoid duplicate return statements?

@wseaton
Copy link
Contributor Author

wseaton commented May 30, 2025

@njhill thanks for the careful review, I think I've addressed everything!

Copy link
Member

@njhill njhill left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @wseaton!

Copy link
Member

@russellb russellb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!

@russellb russellb enabled auto-merge (squash) May 30, 2025 18:33
@github-actions github-actions bot added the ready ONLY add when PR is ready to merge/full CI is needed label May 30, 2025
@russellb russellb merged commit 1dab4d5 into vllm-project:main May 30, 2025
73 checks passed
amitm02 pushed a commit to amitm02/vllm that referenced this pull request Jun 1, 2025
amitm02 pushed a commit to amitm02/vllm that referenced this pull request Jun 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

frontend ready ONLY add when PR is ready to merge/full CI is needed tool-calling

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants