On Thu, Jul 09, 2026 at 10:30:36PM -0400, Michael Bommarito wrote:
> fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
> pool from num_possible_cpus() or lzma_streams, then
> z_erofs_load_lzma_config() preallocates one image-supplied dictionary per
> stream, accepting dictionaries up to 8 MiB. On high-CPU systems, a small
> EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until
> the erofs module is unloaded.
>
> Impact: an attacker-supplied EROFS image mounted by the system can pin up
> to 8 MiB times the LZMA stream count of kernel vmalloc memory.
>
> Cap the LZMA stream pool at 16 streams. That keeps the worst-case
> preallocated dictionary pool at 128 MiB while preserving the existing
> per-image dictionary limit.
>
> Fixes: 622ceaddb764 ("erofs: lzma compression support")
> Cc: [email protected]
> Assisted-by: Codex:gpt-5-5-xhigh
> Signed-off-by: Michael Bommarito <[email protected]>
I guess we can make the maximum LZMA configurable
instead by using a Kconfig?
like CONFIG_EROFS_FS_LZMA_MAX_STREAMS, since I assume there is
the different setting between the embedded systems and servers.
Thanks,
Gao Xiang
