fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
pool from num_possible_cpus() or the lzma_streams module parameter, then
z_erofs_load_lzma_config() preallocates one image-supplied dictionary per
stream, accepting dictionaries up to 8 MiB. On high-CPU systems, a small
EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until
the erofs module is unloaded.
Impact: an attacker-supplied EROFS image mounted by the system can pin up
to 8 MiB times the LZMA stream count of kernel vmalloc memory.
Bound the LZMA stream pool by a new CONFIG_EROFS_FS_ZIP_LZMA_MAX_STREAMS
option, default 16. The default keeps the worst-case preallocated
dictionary pool at 128 MiB while preserving the existing per-image
dictionary limit; memory-constrained systems can lower it and large
servers can raise it.
Fixes: 622ceaddb764 ("erofs: lzma compression support")
Cc: [email protected]
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <[email protected]>
---
v2: bound the pool with a Kconfig option
(CONFIG_EROFS_FS_ZIP_LZMA_MAX_STREAMS, default 16) instead of a
hardcoded 16, per Gao Xiang's review, so memory-constrained and
server deployments can size it. Kept the EROFS_FS_ZIP_ prefix of
the sibling options.
v1:
https://lore.kernel.org/linux-erofs/[email protected]/
fs/erofs/Kconfig | 20 ++++++++++++++++++++
fs/erofs/decompressor_lzma.c | 7 +++++++
2 files changed, 27 insertions(+)
diff --git a/fs/erofs/Kconfig b/fs/erofs/Kconfig
index 4789b1077d8ce..3e4731dd03e7c 100644
--- a/fs/erofs/Kconfig
+++ b/fs/erofs/Kconfig
@@ -131,6 +131,26 @@ config EROFS_FS_ZIP_LZMA
Say N if you want to disable LZMA compression support.
+config EROFS_FS_ZIP_LZMA_MAX_STREAMS
+ int "EROFS LZMA maximum decompression stream pool size"
+ depends on EROFS_FS_ZIP_LZMA
+ range 1 1024
+ default 16
+ help
+ EROFS preallocates a pool of MicroLZMA decoder streams, one per
+ possible CPU by default, or as set by the lzma_streams module
+ parameter. Each stream can hold a dictionary of up to 8 MiB taken
+ from the mounted image, so on systems with a large number of CPUs a
+ single small image can pin a large amount of vmalloc memory until the
+ erofs module is unloaded.
+
+ This bounds the number of preallocated streams. The worst-case
+ preallocated dictionary memory is 8 MiB times this value. Lower it on
+ memory-constrained or embedded systems; raise it on large servers that
+ decompress many EROFS images in parallel.
+
+ If unsure, keep the default of 16.
+
config EROFS_FS_ZIP_DEFLATE
bool "EROFS DEFLATE compressed data support"
depends on EROFS_FS_ZIP
diff --git a/fs/erofs/decompressor_lzma.c b/fs/erofs/decompressor_lzma.c
index f6692d0f2f04d..882684c663f47 100644
--- a/fs/erofs/decompressor_lzma.c
+++ b/fs/erofs/decompressor_lzma.c
@@ -52,6 +52,13 @@ static int __init z_erofs_lzma_init(void)
/* by default, use # of possible CPUs instead */
if (!z_erofs_lzma_nstrms)
z_erofs_lzma_nstrms = num_possible_cpus();
+ /*
+ * Each stream can pin an 8 MiB image-supplied dictionary, so bound the
+ * module-global pool to keep the worst-case preallocation in check on
+ * systems with many CPUs (or a large lzma_streams request).
+ */
+ z_erofs_lzma_nstrms = min_t(unsigned int, z_erofs_lzma_nstrms,
+ CONFIG_EROFS_FS_ZIP_LZMA_MAX_STREAMS);
for (i = 0; i < z_erofs_lzma_nstrms; ++i) {
struct z_erofs_lzma *strm = kzalloc_obj(*strm);
--
2.53.0
