Re: [PATCH v5] PCI: Fix BAR resize for devices on a root bus

[Liz Fong-Jones <lizf@honeycomb.io>]

On Sashiko (Gemini 3.1 pro preview) wrote:
> Finding 1: Optional Resource Assignment Failure
> Severity: High
>
> Location: drivers/pci/setup-bus.c, lines 2429-2433
>
> Issue: The stricter validation incorrectly treats optional resources
> (ROM BARs) as required. If pci_bus_assign_resources() succeeds for
> the target BAR but leaves an optional resource unassigned, the
> function aborts with -ENOSPC, breaking valid BAR resizes.

This is a known, deliberate tradeoff, not an oversight -- it's
disclosed directly in the v5 commit message:

  "Unlike the bridged path, this treats failure to place any released
  resource -- including optional ones, e.g. an unclaimed expansion
  ROM -- as fatal, rather than checking only required resources.
  That's the more conservative choice: on a root bus everything
  released here tends to share one window, and failing loudly seemed
  better than leaving something silently unassigned."

Concretely, for the bug this patch fixes it doesn't apply at all: the
device's ROM shares a different resource window than the released
BARs (confirmed against the actual hardware log -- only BAR0 and BAR2
are ever released, no ROM), so it's never in the "saved" list this
check walks. The scenario in the finding is theoretical for other
root-bus devices whose optional resources do share the same window
as the target BAR, not something this bug's hardware or reported
failure exercises.

Marking this a false positive rather than a code defect. Finding 2
("Preexisting") is correctly scoped and not disputed.