fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
pool from num_possible_cpus() or lzma_streams, then
z_erofs_load_lzma_config() preallocates one image-supplied dictionary per
stream, accepting dictionaries up to 8 MiB. On high-CPU systems, a small
EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until
the erofs module is unloaded.
Impact: an attacker-supplied EROFS image mounted by the system can pin up
to 8 MiB times the LZMA stream count of kernel vmalloc memory.
Cap the LZMA stream pool at 16 streams. That keeps the worst-case
preallocated dictionary pool at 128 MiB while preserving the existing
per-image dictionary limit.
Fixes: 622ceaddb764 ("erofs: lzma compression support")
Cc: [email protected]
Assisted-by: Codex:gpt-5-5-xhigh
Signed-off-by: Michael Bommarito <[email protected]>
---
fs/erofs/decompressor_lzma.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/fs/erofs/decompressor_lzma.c b/fs/erofs/decompressor_lzma.c
index f6692d0f2f04d..7bda4b73c2e41 100644
--- a/fs/erofs/decompressor_lzma.c
+++ b/fs/erofs/decompressor_lzma.c
@@ -8,6 +8,13 @@ struct z_erofs_lzma {
u8 bounce[PAGE_SIZE];
};
+/*
+ * One MicroLZMA decoder can pin an 8 MiB dictionary. Bound the
+ * module-global stream pool so an image cannot multiply that by large CPU
+ * counts.
+ */
+#define Z_EROFS_LZMA_MAX_STREAMS 16
+
/* considering the LZMA performance, no need to use a lockless list for now */
static DEFINE_SPINLOCK(z_erofs_lzma_lock);
static unsigned int z_erofs_lzma_max_dictsize;
@@ -52,6 +59,8 @@ static int __init z_erofs_lzma_init(void)
/* by default, use # of possible CPUs instead */
if (!z_erofs_lzma_nstrms)
z_erofs_lzma_nstrms = num_possible_cpus();
+ z_erofs_lzma_nstrms = min_t(unsigned int, z_erofs_lzma_nstrms,
+ Z_EROFS_LZMA_MAX_STREAMS);
for (i = 0; i < z_erofs_lzma_nstrms; ++i) {
struct z_erofs_lzma *strm = kzalloc_obj(*strm);
--
2.53.0
