Re: [BUG] erofs: LZMA stream state NULL deref after failed dict grow

[Gao Xiang]

Hi,

On Wed, Sep 02, 2026 at 10:04:41AM +0800, Qingyu Zhang wrote:
> Hello,
> 
> z_erofs_load_lzma_config() can leave strm->state == NULL while still
> publishing z_erofs_lzma_max_dictsize. The next mount of the same
> image skips realloc and decompress NULL-derefs.
> 
> Type: null-pointer dereference
> 
> * Summary
> 
>        for (strm = head; strm; strm = strm->next) {
>                if (strm->state)
>                        xz_dec_microlzma_end(strm->state);
>                strm->state = xz_dec_microlzma_alloc(..., dict_size);
>                if (!strm->state)
>                        err = -ENOMEM;
>        }
>        ...
>        z_erofs_lzma_max_dictsize = dict_size;  /* even if err */
> 
> On alloc failure the old state is already gone. The next mount sees
> max_dictsize >= dict_size and returns 0 without retrying. Then:
> 
>        xz_dec_microlzma_reset(strm->state, ...);  /* state is NULL */
> 

Actually there were similar reports:
https://sashiko.dev/#/patchset/20260714114729.3760594-1-michael.bommarito%40gmail.com
https://lore.kernel.org/r/20260830104109.60639-1-nikhilgurudasani314@xxxxxxxxx

I will reply Nikhil's patch soon.

Thanks,
Gao Xiang