virtio: validate indirect descriptor table size

[benhillis]

The indirect descriptor table length from the guest was not validated to be a non-zero multiple of the descriptor size (16 bytes). A misaligned length could cause the last partial descriptor to be read from adjacent memory. Add an explicit check.

[Copilot]

Pull request overview

This PR hardens virtio queue parsing by validating the guest-provided indirect descriptor table length before creating a subrange and iterating descriptors, preventing misaligned lengths from causing reads into adjacent memory.

Changes:

• Add a new QueueError::InvalidIndirectSize(u32) error for invalid indirect descriptor table lengths.
• Validate that indirect descriptor table length is non-zero and a multiple of spec::Descriptor size before mapping/reading it.

Comments suppressed due to low confidence (1)

vm/devices/virtio/virtio/src/queue.rs:286

• descriptor.length.get() is read into indirect_len, but the subsequent subrange() call re-reads descriptor.length.get() instead of using the validated local value. Reuse indirect_len for the subrange length to keep the logic consistent and avoid future edits accidentally bypassing the validation.

            let indirect_len = descriptor.length.get();
            if indirect_len == 0 || indirect_len as usize % size_of::<spec::Descriptor>() != 0 {
                return Err(QueueError::InvalidIndirectSize(indirect_len));
            }
            // TODO: should we really create a subrange for this, or is it
            // rare enough for the HCS case that we can just read it
            // directly?
            let indirect_queue = self.indirect_queue.insert(
                self.queue
                    .mem
                    .subrange(
                        descriptor.address.get(),
                        descriptor.length.get() as u64,
                        true,

[github-actions]

⚠️ Unsafe Code Detected

This PR modifies files containing unsafe Rust code. Extra scrutiny is required during review.

For more on why we check whole files, instead of just diffs, check out the Rustonomicon

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.