Linux kernel (drivers/pci): When the kernel coalesces two adjacent host-bridge apertures it invalidates the absorbed

Impact

When the kernel coalesces two adjacent host-bridge apertures it invalidates the absorbed resource by zeroing its fields, but the validity test only looks at the end address - so a legitimate resource that happens to end at zero is silently discarded. A root-bus resource that is dropped is never registered, meaning the kernel no longer knows that range is spoken for and can hand it out again during later BAR assignment, on top of an aperture that is genuinely in use.

Who can reach it

Not attacker-triggered - it fires at enumeration time on any host bridge whose firmware or device tree describes contiguous apertures that get coalesced, and it is deterministic for a given platform rather than racy. There is no tenant or fabric path to it. It earns a place here because the consequence is in resource assignment: a bus range the kernel forgot about is a range it may reassign, and overlapping windows are how one device ends up decoding another's addresses. The reported instance is an ARM board, but the flawed check is in generic drivers/pci/probe.c and applies to any bridge that coalesces.

What to do

Boot a kernel where the invalid-resource check tests the full resource, not just .end. Interim: on affected kernels, compare the root bus resources the kernel prints at boot against what firmware advertises and treat a missing aperture as a reason not to place multi-tenant workloads on that platform.

References