ANDROID: KVM: arm64: Check for host provided order in refill_hyp_pool()

The order is a host provided value which we have to validate first
before we can use.

Bug: 396116895
Bug: 277989609
Bug: 357781595
Change-Id: I0a8b46db382c9bdb4fec76633d9d8c3abfdde568
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>

arch/arm64/kvm/hyp/nvhe/mm.c

@@ -598,10 +598,14 @@ phys_addr_t __pkvm_private_range_pa(void *va)
 int refill_hyp_pool(struct hyp_pool *pool, struct kvm_hyp_memcache *host_mc)
 {
 	unsigned long order;
+	u64 nr_pages;
 	void *p;
 
 	while (host_mc->nr_pages) {
 		order = FIELD_GET(~PAGE_MASK, host_mc->head);
+		if (check_shl_overflow(1UL, order, &nr_pages))
+			return -EINVAL;
+
 		p = admit_host_page(host_mc, order);
 		if (!p)
 			return -EINVAL;