net: fix buffer overflow in af_xdp_umem_create()

s->pool has n_descs elements so maximum i should be
n_descs - 1. Fix the upper bound.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: cb039ef ("net: add initial support for AF_XDP network backend")
Cc: [email protected]
Reviewed-by: Ilya Maximets <[email protected]>
Signed-off-by: Anastasia Belova <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
(cherry picked from commit 110d0fa2d4d1f754242f6775baec43776a9adb35)
Signed-off-by: Michael Tokarev <[email protected]>

Author: naya451

net/af-xdp.c

@@ -323,7 +323,7 @@ static int af_xdp_umem_create(AFXDPState *s, int sock_fd, Error **errp)
 
     s->pool = g_new(uint64_t, n_descs);
     /* Fill the pool in the opposite order, because it's a LIFO queue. */
-    for (i = n_descs; i >= 0; i--) {
+    for (i = n_descs - 1; i >= 0; i--) {
         s->pool[i] = i * XSK_UMEM__DEFAULT_FRAME_SIZE;
     }
     s->n_pool = n_descs;