|SUCCESS| [v2] net/bnxt/tf_core: fix TCAM alloc-set key copy

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/171724

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-20

# DPDK Patch Review

## Summary
This patch fixes a critical bug in `tfc_msg_tcam_alloc_set()` where `memcpy()` is called with the address of pointer variables instead of the data they point to, and with incorrect byte counts.

## ERRORS

**Error 1: Out-of-bounds memory access**

The original code uses `key_size * sizeof(uint32_t)` for the copy length, but `key_size` is already a byte count (confirmed by the fix using `key_size` directly). This causes each `memcpy()` to copy 4x the intended amount:

```c
/* BAD - original code (from context) */
memcpy(&data[0], &key, key_size * sizeof(uint32_t));      /* 4x too much */
memcpy(&data[key_size], &mask, key_size * sizeof(uint32_t));  /* 4x too much */
memcpy(&data[key_size * 2], &remap, remap_size * sizeof(uint32_t)); /* 4x too much */
```

The patch description states the request reserves only `2 * key_size + remap_size` bytes, so the original copies write well past the allocated buffer, corrupting memory.

**Severity**: Error - buffer overflow with predictable memory corruption.

---

**Error 2: Copying pointer addresses instead of pointed-to data**

The original code uses `&key`, `&mask`, and `&remap` as the source addresses. These are the addresses of the local pointer variables themselves, not the buffers they point to. The hardware receives 8 bytes (on 64-bit) or 4 bytes (on 32-bit) of stack pointer addresses instead of the actual key/mask/remap data.

```c
/* BAD - copies pointer address, not data */
memcpy(&data[0], &key, ...);

/* GOOD - patch correctly copies from the buffer */
memcpy(&data[0], key, key_size);
```

**Severity**: Error - logic error causing complete functional failure (wrong data sent to hardware).

---

## Code Style and Formatting

No style issues identified. The fix follows DPDK conventions.

---

## Process and Documentation

- **Fixes tag**: Present and correct (`Fixes: 80317ff6adfd`)
- **Cc: stable at dpdk.org**: Present (appropriate for a data corruption bug)
- **Commit message**: Clearly describes the bug and fix
- **Release notes**: Not updated, but per guidelines, driver bug fixes in stable branches do not require release notes

---

## Final Assessment

The patch correctly fixes two critical bugs:
1. Copying from wrong addresses (pointer variables instead of pointed-to data)
2. Copying 4x the intended length, causing buffer overflow

Both bugs are correctness errors that would cause functional failure and memory corruption. The fix is minimal, correct, and appropriate for backporting to stable.

Review-Result: CLEAN