Re: [PATCH] erofs: cap LZMA stream pool size

[Gao Xiang <xiang@kernel.org>]

On Thu, Jul 09, 2026 at 10:30:36PM -0400, Michael Bommarito wrote:
> fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
> pool from num_possible_cpus() or lzma_streams, then
> z_erofs_load_lzma_config() preallocates one image-supplied dictionary per
> stream, accepting dictionaries up to 8 MiB.  On high-CPU systems, a small
> EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until
> the erofs module is unloaded.
> 
> Impact: an attacker-supplied EROFS image mounted by the system can pin up
> to 8 MiB times the LZMA stream count of kernel vmalloc memory.
> 
> Cap the LZMA stream pool at 16 streams.  That keeps the worst-case
> preallocated dictionary pool at 128 MiB while preserving the existing
> per-image dictionary limit.
> 
> Fixes: 622ceaddb764 ("erofs: lzma compression support")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5-5-xhigh
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>

I guess we can make the maximum LZMA configurable
instead by using a Kconfig?

like CONFIG_EROFS_FS_LZMA_MAX_STREAMS, since I assume there is 
the different setting between the embedded systems and servers.

Thanks,
Gao Xiang