[PATCH 2/2] mmc: core: saturate erase timeout instead of overflowing

[Michael Haener]

With MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME, secure erase/trim requests
are no longer limited by max_discard, so mmc_mmc_erase_timeout() can be
called with a qty of several thousand erase groups. The timeout is then
computed as erase_timeout * sec_erase_mult * qty in 32-bit arithmetic.

With 512KiB erase groups the block layer limits a request to about 4096
groups, so the product overflows once ERASE_TIMEOUT_MULT * SEC_ERASE_MULT
exceeds about 3496. The wrapped value can be much shorter than the real
erase time, making the busy polling give up early with -ETIMEDOUT. No
card in the quirk list is known to reach that limit today.

Use check_mul_overflow() and saturate at UINT_MAX.

Signed-off-by: Michael Haener <michael.haener@xxxxxxxxxxx>
---
 drivers/mmc/core/core.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 677e445dc48c..9730633dfa81 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -24,6 +24,7 @@
 #include <linux/random.h>
 #include <linux/slab.h>
 #include <linux/of.h>
+#include <linux/overflow.h>
 
 #include <linux/mmc/card.h>
 #include <linux/mmc/host.h>
@@ -1568,13 +1569,21 @@ static unsigned int mmc_mmc_erase_timeout(struct mmc_card *card,
 
 	/* Multiplier for secure operations */
 	if (arg & MMC_SECURE_ARGS) {
-		if (arg == MMC_SECURE_ERASE_ARG)
-			erase_timeout *= card->ext_csd.sec_erase_mult;
-		else
-			erase_timeout *= card->ext_csd.sec_trim_mult;
+		unsigned int mult = arg == MMC_SECURE_ERASE_ARG ?
+				    card->ext_csd.sec_erase_mult :
+				    card->ext_csd.sec_trim_mult;
+
+		if (check_mul_overflow(erase_timeout, mult, &erase_timeout))
+			erase_timeout = UINT_MAX;
 	}
 
-	erase_timeout *= qty;
+	/*
+	 * With MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME, qty is no longer bound
+	 * by max_busy_timeout, so the product can exceed 32 bits. Saturate
+	 * instead of wrapping to a too short timeout.
+	 */
+	if (check_mul_overflow(erase_timeout, qty, &erase_timeout))
+		erase_timeout = UINT_MAX;
 
 	/*
 	 * Ensure at least a 1 second timeout for SPI as per
-- 
2.56.0