[PATCH v2] erofs: cap LZMA stream pool size

[PATCH v2] erofs: cap LZMA stream pool size

[Michael Bommarito]

fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
pool from num_possible_cpus() or the lzma_streams module parameter, then
z_erofs_load_lzma_config() preallocates one image-supplied dictionary per
stream, accepting dictionaries up to 8 MiB.  On high-CPU systems, a small
EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until
the erofs module is unloaded.

Impact: an attacker-supplied EROFS image mounted by the system can pin up
to 8 MiB times the LZMA stream count of kernel vmalloc memory.

Bound the LZMA stream pool by a new CONFIG_EROFS_FS_ZIP_LZMA_MAX_STREAMS
option, default 16.  The default keeps the worst-case preallocated
dictionary pool at 128 MiB while preserving the existing per-image
dictionary limit; memory-constrained systems can lower it and large
servers can raise it.

Fixes: 622ceaddb764 ("erofs: lzma compression support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
v2: bound the pool with a Kconfig option
    (CONFIG_EROFS_FS_ZIP_LZMA_MAX_STREAMS, default 16) instead of a
    hardcoded 16, per Gao Xiang's review, so memory-constrained and
    server deployments can size it.  Kept the EROFS_FS_ZIP_ prefix of
    the sibling options.
v1: https://lore.kernel.org/linux-erofs/20260710023036.3745254-1-michael.bommarito@gmail.com/

 fs/erofs/Kconfig             | 20 ++++++++++++++++++++
 fs/erofs/decompressor_lzma.c |  7 +++++++
 2 files changed, 27 insertions(+)

diff --git a/fs/erofs/Kconfig b/fs/erofs/Kconfig
index 4789b1077d8ce..3e4731dd03e7c 100644
--- a/fs/erofs/Kconfig
+++ b/fs/erofs/Kconfig
@@ -131,6 +131,26 @@ config EROFS_FS_ZIP_LZMA
 
 	  Say N if you want to disable LZMA compression support.
 
+config EROFS_FS_ZIP_LZMA_MAX_STREAMS
+	int "EROFS LZMA maximum decompression stream pool size"
+	depends on EROFS_FS_ZIP_LZMA
+	range 1 1024
+	default 16
+	help
+	  EROFS preallocates a pool of MicroLZMA decoder streams, one per
+	  possible CPU by default, or as set by the lzma_streams module
+	  parameter.  Each stream can hold a dictionary of up to 8 MiB taken
+	  from the mounted image, so on systems with a large number of CPUs a
+	  single small image can pin a large amount of vmalloc memory until the
+	  erofs module is unloaded.
+
+	  This bounds the number of preallocated streams.  The worst-case
+	  preallocated dictionary memory is 8 MiB times this value.  Lower it on
+	  memory-constrained or embedded systems; raise it on large servers that
+	  decompress many EROFS images in parallel.
+
+	  If unsure, keep the default of 16.
+
 config EROFS_FS_ZIP_DEFLATE
 	bool "EROFS DEFLATE compressed data support"
 	depends on EROFS_FS_ZIP
diff --git a/fs/erofs/decompressor_lzma.c b/fs/erofs/decompressor_lzma.c
index f6692d0f2f04d..882684c663f47 100644
--- a/fs/erofs/decompressor_lzma.c
+++ b/fs/erofs/decompressor_lzma.c
@@ -52,6 +52,13 @@ static int __init z_erofs_lzma_init(void)
 	/* by default, use # of possible CPUs instead */
 	if (!z_erofs_lzma_nstrms)
 		z_erofs_lzma_nstrms = num_possible_cpus();
+	/*
+	 * Each stream can pin an 8 MiB image-supplied dictionary, so bound the
+	 * module-global pool to keep the worst-case preallocation in check on
+	 * systems with many CPUs (or a large lzma_streams request).
+	 */
+	z_erofs_lzma_nstrms = min_t(unsigned int, z_erofs_lzma_nstrms,
+				    CONFIG_EROFS_FS_ZIP_LZMA_MAX_STREAMS);
 
 	for (i = 0; i < z_erofs_lzma_nstrms; ++i) {
 		struct z_erofs_lzma *strm = kzalloc_obj(*strm);
-- 
2.53.0

Re: [PATCH v2] erofs: cap LZMA stream pool size

[Gao Xiang]

Hi Michael,

On 2026/7/11 22:34, Michael Bommarito wrote:
> fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
> pool from num_possible_cpus() or the lzma_streams module parameter, then
> z_erofs_load_lzma_config() preallocates one image-supplied dictionary per
> stream, accepting dictionaries up to 8 MiB.  On high-CPU systems, a small
> EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until
> the erofs module is unloaded.
> 
> Impact: an attacker-supplied EROFS image mounted by the system can pin up
> to 8 MiB times the LZMA stream count of kernel vmalloc memory.
> 
> Bound the LZMA stream pool by a new CONFIG_EROFS_FS_ZIP_LZMA_MAX_STREAMS
> option, default 16.  The default keeps the worst-case preallocated
> dictionary pool at 128 MiB while preserving the existing per-image
> dictionary limit; memory-constrained systems can lower it and large
> servers can raise it.
> 
> Fixes: 622ceaddb764 ("erofs: lzma compression support")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
> ---
> v2: bound the pool with a Kconfig option
>      (CONFIG_EROFS_FS_ZIP_LZMA_MAX_STREAMS, default 16) instead of a
>      hardcoded 16, per Gao Xiang's review, so memory-constrained and
>      server deployments can size it.  Kept the EROFS_FS_ZIP_ prefix of
>      the sibling options.
> v1: https://lore.kernel.org/linux-erofs/20260710023036.3745254-1-michael.bommarito@gmail.com/
> 
>   fs/erofs/Kconfig             | 20 ++++++++++++++++++++
>   fs/erofs/decompressor_lzma.c |  7 +++++++
>   2 files changed, 27 insertions(+)
> 
> diff --git a/fs/erofs/Kconfig b/fs/erofs/Kconfig
> index 4789b1077d8ce..3e4731dd03e7c 100644
> --- a/fs/erofs/Kconfig
> +++ b/fs/erofs/Kconfig
> @@ -131,6 +131,26 @@ config EROFS_FS_ZIP_LZMA
>   
>   	  Say N if you want to disable LZMA compression support.
>   
> +config EROFS_FS_ZIP_LZMA_MAX_STREAMS
> +	int "EROFS LZMA maximum decompression stream pool size"
> +	depends on EROFS_FS_ZIP_LZMA
> +	range 1 1024
> +	default 16
> +	help
> +	  EROFS preallocates a pool of MicroLZMA decoder streams, one per
> +	  possible CPU by default, or as set by the lzma_streams module
> +	  parameter.  Each stream can hold a dictionary of up to 8 MiB taken
> +	  from the mounted image, so on systems with a large number of CPUs a
> +	  single small image can pin a large amount of vmalloc memory until the
> +	  erofs module is unloaded.
> +
> +	  This bounds the number of preallocated streams.  The worst-case
> +	  preallocated dictionary memory is 8 MiB times this value.  Lower it on
> +	  memory-constrained or embedded systems; raise it on large servers that
> +	  decompress many EROFS images in parallel.
> +
> +	  If unsure, keep the default of 16.
> +

Currently z_erofs_lzma_nstrms is exposed as a module parameter
too, I hope if users specify a non-zero "lzma_streams", it won't
be limited to this setting.

So after a second thought, I hope "EROFS_FS_ZIP_LZMA_MAX_STREAMS"
may be called "EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS"?

And I wonder if the description can be simplified and closer to
the end users rather than the internal details.

>   config EROFS_FS_ZIP_DEFLATE
>   	bool "EROFS DEFLATE compressed data support"
>   	depends on EROFS_FS_ZIP
> diff --git a/fs/erofs/decompressor_lzma.c b/fs/erofs/decompressor_lzma.c
> index f6692d0f2f04d..882684c663f47 100644
> --- a/fs/erofs/decompressor_lzma.c
> +++ b/fs/erofs/decompressor_lzma.c
> @@ -52,6 +52,13 @@ static int __init z_erofs_lzma_init(void)
>   	/* by default, use # of possible CPUs instead */
>   	if (!z_erofs_lzma_nstrms)
>   		z_erofs_lzma_nstrms = num_possible_cpus();
> +	/*
> +	 * Each stream can pin an 8 MiB image-supplied dictionary, so bound the
> +	 * module-global pool to keep the worst-case preallocation in check on
> +	 * systems with many CPUs (or a large lzma_streams request).
> +	 */

The comment here is unneeded I think since developers can just
check the description of "EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS"
I guess.

Thanks,
Gao Xiang

> +	z_erofs_lzma_nstrms = min_t(unsigned int, z_erofs_lzma_nstrms,
> +				    CONFIG_EROFS_FS_ZIP_LZMA_MAX_STREAMS);
>   
>   	for (i = 0; i < z_erofs_lzma_nstrms; ++i) {
>   		struct z_erofs_lzma *strm = kzalloc_obj(*strm);