|SUCCESS| vhost: fix checksum offset check in Rx path

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/171667

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-19

# DPDK Patch Review

## Analysis

This patch corrects a boundary check in the vhost Rx path. The code writes a 2-byte checksum value at offset `off`, but the original check only verified space for 1 byte.

### Correctness Review

**Error: Off-by-one boundary check**

Line changed:
```c
if (rte_pktmbuf_data_len(m) >= off + 1)
```

The code writes `csum` (a `uint16_t`, 2 bytes) at offset `off`:
```c
*rte_pktmbuf_mtod_offset(m, uint16_t *, off) = csum;
```

The original check allows writing when only 1 byte of space exists beyond `off`. This is a classic off-by-one error that could write past the end of the mbuf data segment.

**Proposed fix is correct:**
```c
if (rte_pktmbuf_data_len(m) >= off + sizeof(uint16_t))
```

This ensures 2 bytes are available at the target offset before writing.

**Impact:** Without this fix, if `rte_pktmbuf_data_len(m) == off + 1`, the write would overflow the mbuf data buffer by 1 byte, corrupting adjacent memory. This is a buffer overflow vulnerability.

### Style Review

The fix follows DPDK style:
- Uses `sizeof(uint16_t)` rather than a magic constant `2`
- Maintains consistent formatting with surrounding code
- No forbidden tokens introduced

### Process Review

- Correctly tags stable for backport: `Cc: stable at dpdk.org`
- References the commit that introduced the bug: `Fixes: ca7036b4af3a`
- Subject line clearly describes the issue

**Note:** Release notes are not required for this fix - it corrects a bug in existing code without changing public API.

## Findings

### ERRORS

**Buffer overflow in checksum write**

The original boundary check `rte_pktmbuf_data_len(m) >= off + 1` only verifies space for 1 byte, but the subsequent write `*rte_pktmbuf_mtod_offset(m, uint16_t *, off) = csum` writes 2 bytes. When exactly 1 byte of space remains (`data_len == off + 1`), this writes past the end of the mbuf data segment, corrupting adjacent memory.

The fix correctly changes the check to `>= off + sizeof(uint16_t)` to ensure 2 bytes are available.

Review-Result: CLEAN