Maybe unsound in Vring::_flags

[lwz23]

Hello, thank you for your contribution in this project, I am scanning the unsoundness problem in rust project.
I notice the following code:

pub struct Vring<T> {
	mem: *const u8,
	_marker: PhantomData<*const T>,
}

impl<T> Vring<T> {
	pub fn new(mem: *const u8) -> Self {
		Vring {
			mem,
			_marker: PhantomData,
		}
	}

	pub fn _flags(&self) -> u16 {
		unsafe {
			#[allow(clippy::cast_ptr_alignment)]
			*(self.mem as *const u16)
		}
	}

	pub fn index(&self) -> u16 {
		unsafe {
			#[allow(clippy::cast_ptr_alignment)]
			*(self.mem.offset(2) as *const u16)
		}
	}
............................

Considering that pub mod virtqueue, and new is also a pub function. I assume that users can directly call this function. This potential situation could result in *(self.mem as *const u16) being dereference a null pointer, and directly dereferencing it might trigger undefined behavior (UB). For safety reasons, I felt it necessary to report this issue. If you have performed checks elsewhere that ensure this is safe, please don’t take offense at my raising this issue.
I suggest Several possible fixes:

1. If there is no external usage for Vring or new, they should not marked as pub, at least its new should not marked as pub
2. new method should add additional check for null pointer.
3. mark new method as unsafe and proper doc to let users know that they should provide valid Pointers.

[mkroening]

That's true. This also applies to #643. The logic also looks overflowy to me. We should make them unsafe or rework them to be sound.