## Summary
A Linux kernel DMA bug in the Tegra GPC DMA driver can cause the DMA engine to hang when transfer lengths are not evenly divisible by the channel’s configured max burst size. This was observed to affect PL011 UART TX DMA transfers of arbitrary lengths, resulting in availability impact (DMA hang).
## Technical Details
The Tegra GPC DMA hardware requires the transfer length to be a multiple of the max burst size. When a client requests a transfer where len is not evenly divisible by the configured max burst size, the DMA “hangs with partial burst at the end.”
The fix adjusts burst sizing logic in drivers/dma/tegra186-gpc-dma.c within get_burst_size(struct tegra_dma_channel *tdc, ...):
- It reduces the burst size to the largest power-of-2 value that evenly divides the transfer length.
- Example from the advisory: a 40-byte transfer with a 16-byte max burst will use an 8-byte burst (40 / 8 = 5 complete bursts) instead of hanging.
This change is present in stable backports referencing commits 4651df83b6c796daead3447e8fd874322918ee4f, 6e37e9e230c7e848bd8e8cd4db15bb18bcf11ad1, and 735951baa311c66353405dcac39375dd66441db0.
## Affected
- Linux kernel component: dmaengine: tegra (Tegra GPC DMA)
- Source file: drivers/dma/tegra186-gpc-dma.c
- Observed trigger: PL011 UART driver TX DMA transfers of arbitrary lengths
## Impact
- Denial of service / availability loss: DMA can hang due to partial burst handling when len is not divisible by the configured max burst size.
- Example impact path: PL011 UART TX DMA transfers may become stuck.
## Mitigation
1. Patch immediately with the Tegra DMA burst-size fix from commit 4651df83b6c796daead3447e8fd874322918ee4f (and corresponding stable backports).
2. Validate that your kernel includes the updated burst calculation in get_burst_size() in drivers/dma/tegra186-gpc-dma.c.
3. If patching is delayed, avoid DMA transfers whose lengths are not compatible with the channel’s max burst sizing (as described: lengths must be multiples of max burst size to prevent hangs).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H