Re: [PATCH] dma-contiguous: fix truncation of numa_cma / cma_pernuma sizes >= 2G

[Feng Tang]

On Fri, Aug 21, 2026 at 10:42:52PM +0000, Alexander Graf wrote:
> numa_cma=0:4G reserves nothing at all. dma_numa_cma_reserve() copies the
> requested size into a local int before handing it to
> cma_declare_contiguous_nid(), so 0x100000000 truncates to zero and the
> loop skips the node silently. Both parameters are documented in
> kernel-parameters.txt as nn[MG], so that is the syntax the documentation
> invites.
> 
> Which bits survive decides what a request turns into: 4G, 8G and 16G
> reserve nothing, 2G, 3G and 6G sign-extend into a size the allocator
> rejects with a warning, and 5G quietly reserves 1G.
> 
> It reaches further than those parameters. On a CMA_SIZE_PERNUMA kernel
> with no per-node parameter, dma_numa_cma_reserve() takes the per-node
> size from the default area, so a plain cma=4G on a multi-node machine
> feeds that size through the same local and loses every per-node area.
> 
> numa_cma_size[] and pernuma_size_bytes are both phys_addr_t, so use it
> for the local too, and give early_numa_cma() separate variables for the
> node id and the size while in there.
> 
> Fixes: d5cae2261b86 ("dma-contiguous: simplify numa cma area handling")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Kiro:claude-opus-5
> Signed-off-by: Alexander Graf <graf@xxxxxxxxxx>
> ---
>  kernel/dma/contiguous.c | 16 +++++++++-------
>  1 file changed, 9 insertions(+), 7 deletions(-)
> 
> diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c
> index f754079a287d..66093460584e 100644
> --- a/kernel/dma/contiguous.c
> +++ b/kernel/dma/contiguous.c
> @@ -140,21 +140,22 @@ static bool numa_cma_configured __initdata;
>  static int __init early_numa_cma(char *p)
>  {
>  	int nid, count = 0;
> -	unsigned long tmp;
> +	unsigned long node;
> +	phys_addr_t size;
>  	char *s = p;
>  
>  	while (*s) {
> -		if (sscanf(s, "%lu%n", &tmp, &count) != 1)
> +		if (sscanf(s, "%lu%n", &node, &count) != 1)
>  			break;
>  
>  		if (s[count] == ':') {
> -			if (tmp >= MAX_NUMNODES)
> +			if (node >= MAX_NUMNODES)
>  				break;
> -			nid = array_index_nospec(tmp, MAX_NUMNODES);
> +			nid = array_index_nospec(node, MAX_NUMNODES);
>  
>  			s += count + 1;
> -			tmp = memparse(s, &s);
> -			numa_cma_size[nid] = tmp;
> +			size = memparse(s, &s);
> +			numa_cma_size[nid] = size;
>  
>  			if (*s == ',')
>  				s++;
> @@ -207,9 +208,10 @@ static void __init dma_numa_cma_reserve(void)
>  		pernuma_size_bytes = cma_get_size(dma_contiguous_default_area);
>  
>  	for_each_node(nid) {
> -		int size, ret;
> +		phys_addr_t size;
>  		char name[CMA_MAX_NAME];
>  		struct cma **cma;
> +		int ret;

Looks good to me, and thanks for the fix!

Reviewed-by: Feng Tang <feng.tang@xxxxxxxxxxxxxxxxx>