|SUCCESS| [v2] net/bnxt: add response bounds checks for TruFlow messages

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/171199

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-13

# DPDK Patch Review

## ERRORS

**None**

## WARNINGS

**None**

## INFO

### 1. Correctness validation

The patch adds bounds checking to prevent stack over-reads when copying firmware response data into caller buffers. All three changes follow the same pattern:

1. Verify caller-supplied size against fixed response buffer size (`sizeof(resp.data)`)
2. Return `-EINVAL` if the size exceeds the buffer
3. Use the caller's size directly in the final `memcpy()` (in `tf_msg_get_global_cfg()` and `tf_msg_get_if_tbl_entry()`)

The checks are placed early in each function, before any session retrieval or firmware communication, which is the correct location for input validation.

### 2. Consistency across functions

The patch correctly applies the same validation pattern to all three affected functions:
- `tf_msg_get_tbl_entry()`: adds size check, already used `size` parameter in memcpy
- `tf_msg_get_global_cfg()`: adds size check, changed memcpy to use `params->config_sz_in_bytes` instead of `resp_size`
- `tf_msg_get_if_tbl_entry()`: adds size check, changed memcpy to use `params->data_sz_in_bytes` instead of `req.size`

The commit message correctly explains that the memcpy changes avoid "any possible mismatch between the two" (meaning between the caller's size and a re-derived field).

### 3. Return value choice

Using `-EINVAL` for input validation failures is appropriate and consistent with DPDK error handling conventions.

---

Review-Result: CLEAN