|SUCCESS| net/virtio: fix checksum offset check in Rx path

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/171666

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-19

# DPDK Patch Review

## Patch Overview
The patch fixes a checksum offset bounds check in the virtio Rx path. The condition checks whether there's enough room to write a 2-byte checksum value, but was incorrectly checking for `off + 1` instead of `off + sizeof(uint16_t)`.

---

## ERRORS

### 1. Off-by-one buffer bounds check (Correctness Bug)

**File:** `drivers/net/virtio/virtio_rxtx.c:958` and `drivers/net/virtio/virtio_rxtx_packed.h:188`

**Issue:** The original code checks `if (rte_pktmbuf_data_len(m) >= off + 1)` before writing a `uint16_t` at offset `off`. This is an off-by-one error.

**Why it matters:** 
- `off + 1` checks if there's room for 1 byte beyond `off`, but `uint16_t` is 2 bytes
- The check passes when `data_len == off + 1`, allowing a 1-byte out-of-bounds write
- This can corrupt adjacent mbuf metadata or cause a segmentation fault

**Original code:**
```c
off = hdr->csum_offset + hdr->csum_start;
if (rte_pktmbuf_data_len(m) >= off + 1)  /* BUG: needs off + 2 */
	*rte_pktmbuf_mtod_offset(m, uint16_t *, off) = csum;
```

**Fixed code (from patch):**
```c
off = hdr->csum_offset + hdr->csum_start;
if (rte_pktmbuf_data_len(m) >= off + sizeof(uint16_t))
	*rte_pktmbuf_mtod_offset(m, uint16_t *, off) = csum;
```

**Verification:** The patch correctly changes both occurrences. `sizeof(uint16_t)` evaluates to 2, ensuring sufficient space for the 2-byte write.

---

## WARNINGS

None.

---

## INFO

None.

---

## Review Summary

The patch correctly fixes a buffer bounds checking bug. Both changed lines are properly updated with the same fix. The approach using `sizeof(uint16_t)` is clearer and more maintainable than a hardcoded `+ 2`.

The `Fixes:` tags reference the commits that introduced the bug, and `Cc: stable at dpdk.org` is correctly included for backporting to LTS releases.

Review-Result: CLEAN