[PATCH] erofs: cap LZMA stream pool size

fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
pool from num_possible_cpus() or lzma_streams, then
z_erofs_load_lzma_config() preallocates one image-supplied dictionary per
stream, accepting dictionaries up to 8 MiB.  On high-CPU systems, a small
EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until
the erofs module is unloaded.

Impact: an attacker-supplied EROFS image mounted by the system can pin up
to 8 MiB times the LZMA stream count of kernel vmalloc memory.

Cap the LZMA stream pool at 16 streams.  That keeps the worst-case
preallocated dictionary pool at 128 MiB while preserving the existing
per-image dictionary limit.

Fixes: 622ceaddb764 ("erofs: lzma compression support")
Cc: [email protected]
Assisted-by: Codex:gpt-5-5-xhigh
Signed-off-by: Michael Bommarito <[email protected]>
---
 fs/erofs/decompressor_lzma.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/erofs/decompressor_lzma.c b/fs/erofs/decompressor_lzma.c
index f6692d0f2f04d..7bda4b73c2e41 100644
--- a/fs/erofs/decompressor_lzma.c
+++ b/fs/erofs/decompressor_lzma.c
@@ -8,6 +8,13 @@ struct z_erofs_lzma {
 	u8 bounce[PAGE_SIZE];
 };
 
+/*
+ * One MicroLZMA decoder can pin an 8 MiB dictionary. Bound the
+ * module-global stream pool so an image cannot multiply that by large CPU
+ * counts.
+ */
+#define Z_EROFS_LZMA_MAX_STREAMS	16
+
 /* considering the LZMA performance, no need to use a lockless list for now */
 static DEFINE_SPINLOCK(z_erofs_lzma_lock);
 static unsigned int z_erofs_lzma_max_dictsize;
@@ -52,6 +59,8 @@ static int __init z_erofs_lzma_init(void)
 	/* by default, use # of possible CPUs instead */
 	if (!z_erofs_lzma_nstrms)
 		z_erofs_lzma_nstrms = num_possible_cpus();
+	z_erofs_lzma_nstrms = min_t(unsigned int, z_erofs_lzma_nstrms,
+				    Z_EROFS_LZMA_MAX_STREAMS);
 
 	for (i = 0; i < z_erofs_lzma_nstrms; ++i) {
 		struct z_erofs_lzma *strm = kzalloc_obj(*strm);
-- 
2.53.0