virtio: validate descriptor index from avail ring

[benhillis]

The descriptor index read from the guest's available ring was used directly without checking it against queue_size. A malicious or buggy guest could supply an out-of-range index, leading to out-of-bounds access in the descriptor table.

Add an InvalidDescriptorIndex error variant to QueueError and validate the index in SplitQueueGetWork::get_available_descriptor_index().

[benhillis]

replaces #2780

[Copilot]

Pull request overview

This PR hardens the virtio split-queue path against malicious/buggy guests by validating that descriptor indices read from the avail ring are within queue_size, preventing out-of-bounds access to the descriptor table.

Changes:

• Add QueueError::InvalidDescriptorIndex(u16) to represent out-of-range avail-ring indices.
• Validate avail-ring descriptor indices in SplitQueueGetWork::get_available_descriptor_index() and return the new error on invalid input.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
vm/devices/virtio/virtio/src/queue/split.rs	Adds bounds-checking for descriptor indices read from the guest avail ring before using them.
vm/devices/virtio/virtio/src/queue.rs	Extends QueueError with an explicit error variant for invalid descriptor indices.