virtio-devices: balloon: Cap inflate and deflate descriptor length

Drop inflate or deflate descriptors whose len exceeds the Linux
driver maximum of VIRTIO_BALLOON_ARRAY_PFNS_MAX PFN entries of 4
bytes each. Without the cap, a guest can submit a descriptor with
a huge len over a small backing and drive an unbounded warn loop
in the device thread.

Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>

virtio-devices/src/balloon.rs

@@ -59,6 +59,12 @@ const REPORTING_QUEUE_EVENT: u16 = EPOLL_HELPER_EVENT_LAST + 3;
 // Size of a PFN in the balloon interface.
 const VIRTIO_BALLOON_PFN_SHIFT: u64 = 12;
 
+// Upper bound on a single inflate or deflate descriptor length, in
+// bytes. Matches the Linux driver, which submits at most
+// VIRTIO_BALLOON_ARRAY_PFNS_MAX of 256 PFN entries of 4 bytes each per
+// descriptor.
+const VIRTIO_BALLOON_MAX_PFN_BYTES: u32 = 256 * 4;
+
 // Deflate balloon on OOM
 const VIRTIO_BALLOON_F_DEFLATE_ON_OOM: u64 = 2;
 // Enable an additional virtqueue to let the guest notify the host about free
@@ -282,6 +288,13 @@ impl BalloonEpollHandler {
                     );
                     continue;
                 }
+                if desc.len() > VIRTIO_BALLOON_MAX_PFN_BYTES {
+                    warn!(
+                        "Skipping descriptor with length {} exceeding cap {VIRTIO_BALLOON_MAX_PFN_BYTES}",
+                        desc.len()
+                    );
+                    continue;
+                }
 
                 let mut offset = 0u64;
                 while offset < desc.len() as u64 {