virtio: unchecked descriptor address+length arithmetic panics on 64-bit wrap in checked builds

Summary

When building the guest-memory page list for a descriptor, virtio computes addr + len and addr + len - 1 without checked arithmetic. A descriptor with an address near the top of the 64-bit space overflows these expressions; with overflow-checks enabled ([profile.dev]) this panics, and panic = "abort" aborts the VM process. In release the value wraps to an empty page list and the request correctly fails with S_IOERR, so release is unaffected.

Root cause

vm/devices/virtio/virtio/src/regions.rs:98 (let last_gpn = (addr + len - 1) / PAGE_SIZE;) and :137 (prev_end = Some(addr + len);) add the guest-controlled addr and len unchecked.

Reproduction

Found by virtio-villain test T0008 (virtio-blk): a writable descriptor with addr = 0xffffffffffffff00, len = 512. Panics/aborts in a checked build.

Impact

The offending VM aborts in checked/debug builds. Release builds handle it as a clean S_IOERR. Same hardening class as the virtio-blk LBA bounds-checking issue.

Suggested fix

Use checked_add/checked_sub when computing GPA ranges in regions.rs, treating overflow as an invalid descriptor (fail the request) rather than panicking or wrapping.

Start in vm/devices/virtio/virtio/src/regions.rs at lines 98 and 137, where guest-controlled address and length arithmetic is performed. Use the virtio-villain T0008 reproduction as the first check, then verify that overflow is treated as an invalid descriptor and the request fails with S_IOERR without a panic or abort.