virtio: unbounded memory allocation issue

ISSUE DESCRIPTION

A guest can submit virtio requests without bothering to wait for completion and is therefore not bound by virtqueue size. (This requires reusing vring descriptors in more than one request, which is incorrect but possible.) Processing a request allocates a VirtQueueElement and therefore causes unbounded memory allocation controlled by the guest.

IMPACT

A malicious guest administrator can cause unbounded memory allocation in QEMU, which can cause an Out-of-Memory condition in the domain running qemu.
Thus, a malicious guest administrator can cause a denial of service affecting the whole host.

VULNERABLE SYSTEMS

ARM systems are not vulnerable.
PV domains are not vulnerable.
Only HVM domains where virtio-net devices are provided to the guest are vulnerable. Note that NO such devices are provided by default, so the default configuration is not vulnerable.
HVM domains run with QEMU stub domains are not vulnerable.
(Note that all virtio subsystems are affected; but only virtio-net is a supported configuration. See docs/misc/qemu-xen-security.)