netvsp: bounds-check RX buffer writes

[erfrimod]

GuestBuffers::write_at previously indexed into locked_pages without validating that offset + buf.len() fit within the locked page range. A misconfigured sub_allocation_size or an out-of-range RxId would panic.

• Offset and buf.len() validated against locked-page size up front, returning a typed RxBufferWriteOverflow error on overflow.
• The two callers (write_data and write_header) log tracelimited warnings.
• Added unit test.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds explicit bounds-checking for receive-buffer writes in netvsp to prevent panics from out-of-range offsets/lengths, returning a typed error and logging rate-limited warnings when writes would overflow.

Changes:

• Introduces RxBufferWriteOverflow + check_rx_write_bounds to validate offset + len safely.
• Updates GuestBuffers::write_at to return Result and validates against locked-page total size before writing.
• Adds a unit test covering check_rx_write_bounds edge cases.

[chris-oo]

LGTM other than question about what the guest should see

[chris-oo]

does something need to get reported to the guest, or it's expected we just drop it on the floor?

[erfrimod]

We wouldn't drop the packet, the Guest would see an packet with an empty buffer. Better than crashing.

In practice, this won't happen unless OpenHCL is misconfigured. This is defense in depth, caught by a fuzzer test that does not check capacity before calling write_packet.