This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
net: microchip: vcap: expose helpers in vcap api and update debugfs
Add new helpers to the vcap client api in preparation for L3 routing
functionality, rename PREROUTING to PREROUTING_L0, and fix a latent
undefined-behavior bug in the debugfs action-field printer.
> diff --git a/drivers/net/ethernet/microchip/vcap/vcap_api.c
> b/drivers/net/ethernet/microchip/vcap/vcap_api.c
> index 30700648672fc..0905e4f192a02 100644
> --- a/drivers/net/ethernet/microchip/vcap/vcap_api.c
> +++ b/drivers/net/ethernet/microchip/vcap/vcap_api.c
[ ... ]
> @@ -3547,6 +3560,18 @@ int vcap_rule_mod_action_u32(struct vcap_rule *rule,
> }
> EXPORT_SYMBOL_GPL(vcap_rule_mod_action_u32);
>
> +/* Modify a bit action with value in the rule */
> +int vcap_rule_mod_action_bit(struct vcap_rule *rule,
> + enum vcap_action_field action,
> + enum vcap_bit val)
> +{
> + struct vcap_client_actionfield_data data;
> +
> + vcap_rule_set_action_bitsize(&data.u1, val);
> + return vcap_rule_mod_action(rule, action, VCAP_FIELD_BIT, &data);
[Severity: Medium]
Could this copy uninitialized stack memory to the heap?
The data union is allocated on the stack but not initialized. The call to
vcap_rule_set_action_bitsize() only initializes the first byte (data.u1).
When data is passed to vcap_rule_mod_action(), it performs a memcpy() of the
entire 16-byte union:
vcap_rule_mod_action() {
...
memcpy(&field->data, data, sizeof(field->data));
...
}
This appears to copy 15 bytes of uninitialized kernel stack memory into the
heap-allocated field->data, which might trigger KMSAN uninit-value warnings.
While a similar pattern exists in the pre-existing vcap_rule_mod_action_u32()
function, should the new data union be zero-initialized here?
> +}
> +EXPORT_SYMBOL_GPL(vcap_rule_mod_action_bit);
> +
> /* Drop keys in a keylist and any keys that are not supported by the keyset
> */
> int vcap_filter_rule_keys(struct vcap_rule *rule,
> enum vcap_key_field keylist[], int length,
