drivers: validate device-supplied completion ids (virtio used-ring, NVMe cid)

Two OOB accesses driven by a malicious or buggy device backend (relevant for
untrusted/soft hypervisor backends; kernel memory corruption in a unikernel):

1. virtio used-ring (drivers/virtio-vring.cc): the used-element _id is written
   by the device and was used directly to index _cookie[] (allocated with _num
   entries): 'cookie = _cookie[elem._id]; _cookie[elem._id] = nullptr;'. A
   backend returning _id >= _num causes an OOB read of a bogus cookie pointer
   (later dereferenced/freed) plus an OOB NULL write past the array. Reject
   elem._id >= _num.

2. NVMe completion (drivers/nvme-queue.cc): the completion-queue-entry cid is
   device-supplied and indexed _pending_bios[cid/_qsize][cid%_qsize] where the
   row dimension is only max_pending_levels (4). A controller returning a cid
   with cid/_qsize >= 4 indexes _pending_bios[] out of bounds; the following
   assert(pending_bio) is compiled out in release builds, so it was not a real
   guard. Validate cid_to_row(cid) < max_pending_levels and that the slot is
   non-null (skip duplicate/spurious completions) before use.

Verified: boot + virtio-blk I/O (tst-vblk) still pass.

Author: gburd

drivers/nvme-queue.cc

@@ -342,10 +342,23 @@ void io_queue_pair::req_done()
                 }
             }
             //
-            // Read cid and release it
+            // Read cid and release it.  cqe.cid is device-supplied; a malicious
+            // or buggy controller can return a cid whose row (cid / _qsize)
+            // exceeds max_pending_levels, which would index _pending_bios[] out
+            // of bounds.  Validate before use (assert() is compiled out in
+            // release builds, so it is not a real guard here).
             u16 cid = cqe.cid;
+            if (cid_to_row(cid) >= max_pending_levels) {
+                // Bogus completion id from the device; the CQ head was already
+                // advanced above, so just skip this entry.
+                continue;
+            }
             auto pending_bio = _pending_bios[cid_to_row(cid)][cid_to_col(cid)].exchange(nullptr);
-            assert(pending_bio);
+            if (!pending_bio) {
+                // No bio outstanding for this cid (duplicate / spurious
+                // completion); ignore rather than dereference a null.
+                continue;
+            }
             //
             // Save for future re-use or free PRP list saved under bio_private if any
             if (pending_bio->bio_private) {

drivers/virtio-vring.cc

@@ -271,6 +271,13 @@ namespace virtio {
             elem = _used->_used_elements[used_ptr];
             *len = elem._len;
 
+            // elem._id is written by the device/backend; a malicious or buggy
+            // backend can return an id outside [0, _num), which would index
+            // _cookie[] out of bounds (OOB read of a bogus cookie pointer that
+            // is then dereferenced/freed, plus an OOB NULL write).  Reject it.
+            if (elem._id >= _num) {
+                return nullptr;
+            }
             cookie = _cookie[elem._id];
             _cookie[elem._id] = nullptr; //maybe use this array for the full size hdrs?