virtio-devices: copy VSock header from guest

VsockPacket::hdr holds a raw pointer to the address of the VSock packet
header, which is in guest memory. It opens the door to double-fetch
(or TOCTOU) race conditions. Therefore, VSockPacket::hdr content can't
be trusted since it can be arbitrarily changed by the guest, at any
time.

To mitigate this, we can copy the header content to an array in VMM's
memory that the guest can't modify.

Signed-off-by: Thomas Leroy <thomas.leroy.mp@gmail.com>

virtio-devices/src/vsock/device.rs

@@ -130,7 +130,16 @@ where
             ) {
                 Ok(mut pkt) => {
                     if self.backend.write().unwrap().recv_pkt(&mut pkt).is_ok() {
-                        pkt.hdr().len() as u32 + pkt.len()
+                        match pkt.commit_hdr(&*self.mem.memory()) {
+                            Ok(()) => pkt.hdr().len() as u32 + pkt.len(),
+                            Err(err) => {
+                                warn!(
+                                    "vsock: Error writing packet header to guest memory: \
+                                     {err:?}. Discarding the package."
+                                );
+                                0
+                            }
+                        }
                     } else {
                         // We are using a consuming iterator over the virtio buffers, so, if we can't
                         // fill in this buffer, we'll need to undo the last iterator step.