virtio-devices: vsock: Add bounds check on inline TX path

The TX path's inline-data branch didn't check the inline buffer length
against the guest-supplied pkt.len() field. The worker will later panic
when it tries to index the packet.

Add the missing check, mirroring the other TX branches.

Signed-off-by: Dylan Reid <dgreid@fb.com>

virtio-devices/src/vsock/packet.rs

@@ -175,6 +175,9 @@ impl VsockPacket {
         // For small packets, the data may be stored in the same descriptor as the header.
         if !head.has_next() {
             let buf_size: usize = head.len() as usize - VSOCK_PKT_HDR_SIZE;
+            if buf_size < pkt.len() as usize {
+                return Err(VsockError::BufDescTooSmall);
+            }
             let buf_ptr = get_host_address_range(
                 desc_chain.memory(),
                 head.addr()