From: Kees Cook <keescook@chromium.org>
To: Matthew Wilcox <mawilcox@microsoft.com>
Cc: Kees Cook <keescook@chromium.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Rasmus Villemoes <linux@rasmusvillemoes.dk>,
Matthew Wilcox <willy@infradead.org>,
LKML <linux-kernel@vger.kernel.org>,
Linux-MM <linux-mm@kvack.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>
Subject: [PATCH v3 13/16] treewide: Use array_size() for kmalloc()-family, leftovers
Date: Thu, 31 May 2018 17:42:30 -0700 [thread overview]
Message-ID: <20180601004233.37822-14-keescook@chromium.org> (raw)
In-Reply-To: <20180601004233.37822-1-keescook@chromium.org>
Several odd cases where multiple expressions remain as array_size()
arguments:
Unchecked addition:
+1 is very very common:
new = kmalloc(array_size((valid_extensions + 1), EDID_LENGTH),
plenty of others:
ptr = kmalloc(array_size(obj->package.count + ACPI_VIDEO_FIRST_LEVEL,
sizeof(*br->levels)), GFP_KERNEL);
Single-byte values:
array_size(sizeof(char *), E1)
array_size(E1, sizeof(char *))
other glitches, e.g. should use array3_size():
ptr = kzalloc(array_size(sizeof(void *), (NUM_CT_SUMS * CHN_NUM)),
GFP_KERNEL);
However, things are now improved by capturing these expressions within
array_size() and can be examined in future passes.
Generated with the following Coccinelle script:
// Any remaining multi-factor products, first at least 3-factor products...
@@
identifier alloc =~ "kmalloc|kzalloc|kvmalloc|kvzalloc";
expression GFP, E1, E2, E3;
@@
- alloc(E1 * E2 * E3, GFP)
+ alloc(array3_size(E1, E2, E3), GFP)
// ... and then all remaining 2 factors products.
@@
identifier alloc =~ "kmalloc|kzalloc|kvmalloc|kvzalloc";
expression GFP, E1, E2;
@@
- alloc(E1 * E2, GFP)
+ alloc(array_size(E1, E2), GFP)
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/arm/mach-omap2/hsmmc.c | 3 +-
arch/arm64/kernel/armv8_deprecated.c | 4 +--
arch/arm64/mm/context.c | 2 +-
arch/ia64/kernel/mca_drv.c | 3 +-
arch/ia64/mm/tlb.c | 4 +--
arch/ia64/sn/pci/pcibr/pcibr_provider.c | 3 +-
arch/mips/alchemy/common/clock.c | 2 +-
arch/mips/alchemy/common/platform.c | 2 +-
arch/mips/bmips/dma.c | 2 +-
arch/powerpc/kernel/vdso.c | 4 +--
arch/powerpc/mm/numa.c | 2 +-
arch/powerpc/net/bpf_jit_comp.c | 2 +-
arch/powerpc/net/bpf_jit_comp64.c | 2 +-
arch/powerpc/oprofile/cell/spu_profiler.c | 4 +--
arch/powerpc/platforms/4xx/msi.c | 3 +-
arch/powerpc/sysdev/mpic.c | 2 +-
arch/powerpc/sysdev/xive/native.c | 2 +-
arch/s390/hypfs/hypfs_diag0c.c | 3 +-
arch/s390/kernel/vdso.c | 4 +--
arch/sparc/kernel/sys_sparc_64.c | 5 +--
arch/um/drivers/vector_kern.c | 12 +++----
arch/unicore32/kernel/pm.c | 4 +--
arch/x86/events/amd/iommu.c | 3 +-
arch/x86/events/intel/uncore.c | 2 +-
arch/x86/kernel/cpu/mcheck/mce_amd.c | 2 +-
arch/x86/kernel/hpet.c | 2 +-
arch/x86/kvm/svm.c | 3 +-
arch/x86/kvm/x86.c | 2 +-
arch/x86/net/bpf_jit_comp.c | 2 +-
arch/x86/pci/xen.c | 2 +-
crypto/tcrypt.c | 2 +-
crypto/testmgr.c | 3 +-
drivers/acpi/acpi_video.c | 4 +--
drivers/acpi/processor_perflib.c | 2 +-
drivers/acpi/processor_throttling.c | 2 +-
drivers/acpi/sysfs.c | 6 ++--
drivers/android/binder_alloc.c | 3 +-
drivers/atm/he.c | 2 +-
drivers/atm/iphase.c | 2 +-
drivers/atm/solos-pci.c | 3 +-
drivers/block/DAC960.c | 4 +--
drivers/block/amiflop.c | 2 +-
drivers/block/null_blk.c | 7 ++--
drivers/block/rsxx/core.c | 3 +-
drivers/block/rsxx/dma.c | 2 +-
drivers/block/xen-blkback/xenbus.c | 3 +-
drivers/block/xen-blkfront.c | 9 +++--
drivers/block/z2ram.c | 4 +--
drivers/char/agp/amd-k7-agp.c | 3 +-
drivers/char/agp/ati-agp.c | 3 +-
drivers/char/agp/compat_ioctl.c | 6 ++--
drivers/char/agp/sworks-agp.c | 2 +-
drivers/char/agp/uninorth-agp.c | 3 +-
drivers/char/ipmi/ipmi_ssif.c | 3 +-
drivers/clk/st/clkgen-pll.c | 2 +-
drivers/clk/sunxi/clk-usb.c | 3 +-
drivers/clk/tegra/clk.c | 4 +--
drivers/clk/ti/apll.c | 3 +-
drivers/clk/ti/divider.c | 5 +--
drivers/clk/ti/dpll.c | 3 +-
drivers/clocksource/sh_cmt.c | 2 +-
drivers/clocksource/sh_mtu2.c | 2 +-
drivers/clocksource/sh_tmu.c | 2 +-
drivers/cpufreq/acpi-cpufreq.c | 4 +--
drivers/cpufreq/bmips-cpufreq.c | 3 +-
drivers/cpufreq/cppc_cpufreq.c | 3 +-
drivers/cpufreq/ia64-acpi-cpufreq.c | 5 ++-
drivers/cpufreq/longhaul.c | 4 +--
drivers/cpufreq/pxa3xx-cpufreq.c | 2 +-
drivers/cpufreq/sfi-cpufreq.c | 4 +--
drivers/cpufreq/spear-cpufreq.c | 3 +-
drivers/crypto/amcc/crypto4xx_core.c | 4 +--
drivers/crypto/caam/ctrl.c | 4 +--
drivers/crypto/inside-secure/safexcel_hash.c | 2 +-
drivers/crypto/marvell/hash.c | 2 +-
drivers/crypto/qat/qat_common/qat_uclo.c | 4 +--
drivers/crypto/stm32/stm32-hash.c | 2 +-
drivers/dma/coh901318.c | 2 +-
drivers/dma/pl330.c | 4 +--
drivers/dma/sh/shdma-base.c | 4 +--
drivers/edac/amd64_edac.c | 3 +-
drivers/edac/i7core_edac.c | 2 +-
drivers/extcon/extcon.c | 16 ++++-----
drivers/firmware/efi/runtime-map.c | 3 +-
.../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c | 6 ++--
.../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c | 6 ++--
drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c | 3 +-
drivers/gpu/drm/amd/amdgpu/atom.c | 4 +--
drivers/gpu/drm/amd/amdgpu/ci_dpm.c | 4 +--
drivers/gpu/drm/amd/amdgpu/kv_dpm.c | 4 +--
drivers/gpu/drm/amd/amdgpu/si_dpm.c | 4 +--
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 4 +--
.../drm/amd/display/dc/dce/dce_clock_source.c | 4 +--
.../amd/display/modules/color/color_gamma.c | 36 ++++++++++---------
.../gpu/drm/amd/display/modules/stats/stats.c | 4 +--
drivers/gpu/drm/ast/ast_main.c | 3 +-
drivers/gpu/drm/drm_edid.c | 3 +-
drivers/gpu/drm/gma500/mid_bios.c | 2 +-
drivers/gpu/drm/i915/selftests/intel_uncore.c | 2 +-
drivers/gpu/drm/nouveau/nvif/mmu.c | 9 +++--
drivers/gpu/drm/nouveau/nvif/object.c | 3 +-
drivers/gpu/drm/nouveau/nvif/vmm.c | 3 +-
.../gpu/drm/nouveau/nvkm/engine/fifo/gk104.c | 2 +-
.../gpu/drm/nouveau/nvkm/engine/gr/ctxnv40.c | 2 +-
.../gpu/drm/nouveau/nvkm/engine/gr/ctxnv50.c | 2 +-
drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 2 +-
drivers/gpu/drm/qxl/qxl_kms.c | 2 +-
drivers/gpu/drm/radeon/atom.c | 4 +--
drivers/gpu/drm/radeon/ci_dpm.c | 4 +--
drivers/gpu/drm/radeon/kv_dpm.c | 4 +--
drivers/gpu/drm/radeon/ni_dpm.c | 4 +--
drivers/gpu/drm/radeon/r600_dpm.c | 3 +-
drivers/gpu/drm/radeon/radeon_atombios.c | 16 ++++-----
drivers/gpu/drm/radeon/rs780_dpm.c | 4 +--
drivers/gpu/drm/radeon/rv6xx_dpm.c | 4 +--
drivers/gpu/drm/radeon/rv770_dpm.c | 4 +--
drivers/gpu/drm/radeon/si_dpm.c | 4 +--
drivers/gpu/drm/radeon/sumo_dpm.c | 4 +--
drivers/gpu/drm/radeon/trinity_dpm.c | 4 +--
drivers/gpu/drm/savage/savage_bci.c | 4 +--
drivers/gpu/drm/selftests/test-drm_mm.c | 4 +--
drivers/gpu/drm/tinydrm/repaper.c | 2 +-
drivers/gpu/drm/vc4/vc4_plane.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 3 +-
drivers/hid/hid-core.c | 4 +--
drivers/hid/hid-picolcd_fb.c | 3 +-
drivers/hv/hv_util.c | 2 +-
drivers/hv/ring_buffer.c | 2 +-
drivers/hwmon/acpi_power_meter.c | 6 ++--
drivers/hwmon/ibmpex.c | 2 +-
drivers/i2c/i2c-stub.c | 4 +--
drivers/ide/hpt366.c | 3 +-
drivers/ide/ide-ioctls.c | 2 +-
drivers/ide/ide-probe.c | 2 +-
drivers/iio/imu/adis_buffer.c | 3 +-
drivers/iio/inkern.c | 2 +-
drivers/infiniband/core/cache.c | 4 +--
drivers/infiniband/core/cma.c | 2 +-
drivers/infiniband/core/device.c | 3 +-
drivers/infiniband/hw/cxgb4/device.c | 4 +--
drivers/infiniband/hw/cxgb4/id_table.c | 4 +--
drivers/infiniband/hw/cxgb4/qp.c | 8 ++---
drivers/infiniband/hw/mlx4/main.c | 3 +-
drivers/infiniband/hw/mlx4/qp.c | 2 +-
drivers/infiniband/hw/mlx5/srq.c | 3 +-
drivers/infiniband/hw/mthca/mthca_allocator.c | 2 +-
drivers/infiniband/hw/mthca/mthca_cmd.c | 3 +-
drivers/infiniband/hw/mthca/mthca_memfree.c | 3 +-
drivers/infiniband/hw/mthca/mthca_mr.c | 2 +-
drivers/infiniband/hw/mthca/mthca_qp.c | 2 +-
drivers/infiniband/hw/mthca/mthca_srq.c | 2 +-
drivers/infiniband/hw/nes/nes_hw.c | 4 +--
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 15 ++++----
drivers/infiniband/hw/qedr/verbs.c | 4 +--
drivers/infiniband/hw/qib/qib_iba6120.c | 8 ++---
drivers/infiniband/hw/qib/qib_iba7220.c | 8 ++---
drivers/infiniband/hw/qib/qib_iba7322.c | 12 +++----
drivers/infiniband/hw/qib/qib_init.c | 4 +--
drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c | 4 +--
drivers/infiniband/ulp/iser/iser_initiator.c | 4 +--
drivers/infiniband/ulp/srp/ib_srp.c | 6 ++--
drivers/iommu/omap-iommu.c | 3 +-
drivers/irqchip/irq-alpine-msi.c | 2 +-
drivers/irqchip/irq-gic-v2m.c | 2 +-
drivers/irqchip/irq-gic-v3-its.c | 6 ++--
drivers/irqchip/irq-partition-percpu.c | 2 +-
drivers/isdn/capi/capidrv.c | 3 +-
drivers/isdn/gigaset/capi.c | 6 ++--
drivers/isdn/gigaset/i4l.c | 3 +-
drivers/isdn/hisax/fsm.c | 3 +-
drivers/isdn/i4l/isdn_common.c | 3 +-
drivers/isdn/mISDN/fsm.c | 4 +--
drivers/lightnvm/pblk-init.c | 8 ++---
drivers/md/bcache/super.c | 5 ++-
drivers/md/dm-crypt.c | 4 +--
drivers/md/dm-integrity.c | 12 ++++---
drivers/md/dm-stats.c | 3 +-
drivers/md/dm-verity-target.c | 4 +--
drivers/md/md-cluster.c | 5 ++-
drivers/md/md-multipath.c | 2 +-
drivers/md/raid0.c | 7 ++--
drivers/md/raid1.c | 9 +++--
drivers/md/raid10.c | 10 ++----
drivers/md/raid5.c | 6 ++--
drivers/media/pci/bt8xx/bttv-risc.c | 2 +-
drivers/media/pci/ivtv/ivtv-yuv.c | 3 +-
drivers/media/pci/saa7164/saa7164-fw.c | 2 +-
drivers/media/pci/zoran/zoran_card.c | 2 +-
drivers/media/pci/zoran/zoran_driver.c | 2 +-
drivers/media/platform/vivid/vivid-core.c | 4 +--
drivers/media/spi/cxd2880-spi.c | 2 +-
drivers/media/usb/cx231xx/cx231xx-audio.c | 3 +-
drivers/media/usb/go7007/go7007-fw.c | 2 +-
drivers/media/usb/gspca/t613.c | 2 +-
drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 +-
drivers/media/usb/stk1160/stk1160-core.c | 4 +--
drivers/media/usb/usbvision/usbvision-video.c | 3 +-
drivers/media/usb/uvc/uvc_video.c | 2 +-
drivers/media/v4l2-core/videobuf-dma-sg.c | 3 +-
drivers/memstick/core/ms_block.c | 3 +-
drivers/message/fusion/mptlan.c | 5 +--
drivers/mfd/cros_ec_dev.c | 6 ++--
drivers/mfd/mfd-core.c | 3 +-
drivers/misc/eeprom/idt_89hpesx.c | 3 +-
drivers/misc/genwqe/card_ddcb.c | 8 ++---
drivers/misc/sgi-xp/xpnet.c | 4 +--
drivers/misc/sram.c | 2 +-
drivers/mtd/chips/cfi_cmdset_0001.c | 7 ++--
drivers/mtd/chips/cfi_cmdset_0002.c | 4 +--
drivers/mtd/chips/cfi_cmdset_0020.c | 4 +--
drivers/mtd/ftl.c | 12 +++----
drivers/mtd/inftlmount.c | 6 ++--
drivers/mtd/lpddr/lpddr_cmds.c | 4 +--
drivers/mtd/maps/physmap_of_core.c | 2 +-
drivers/mtd/maps/vmu-flash.c | 8 ++---
drivers/mtd/mtdswap.c | 2 +-
drivers/mtd/nand/onenand/onenand_base.c | 4 +--
drivers/mtd/nftlmount.c | 6 ++--
drivers/mtd/sm_ftl.c | 11 +++---
drivers/mtd/ssfdc.c | 4 +--
drivers/mtd/tests/pagetest.c | 2 +-
drivers/mtd/ubi/eba.c | 4 +--
drivers/mtd/ubi/wl.c | 3 +-
drivers/net/bonding/bond_main.c | 3 +-
drivers/net/can/grcan.c | 5 +--
.../ethernet/atheros/atl1c/atl1c_ethtool.c | 4 +--
.../ethernet/atheros/atl1e/atl1e_ethtool.c | 4 +--
drivers/net/ethernet/atheros/atlx/atl2.c | 4 +--
drivers/net/ethernet/broadcom/bcm63xx_enet.c | 4 +--
.../net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 4 +--
drivers/net/ethernet/broadcom/cnic.c | 7 ++--
drivers/net/ethernet/brocade/bna/bnad.c | 2 +-
.../ethernet/cavium/thunder/nicvf_queues.c | 4 +--
.../net/ethernet/chelsio/cxgb4/cxgb4_main.c | 4 +--
drivers/net/ethernet/freescale/ucc_geth.c | 6 ++--
drivers/net/ethernet/hisilicon/hns/hns_enet.c | 2 +-
drivers/net/ethernet/ibm/ibmveth.c | 3 +-
.../net/ethernet/intel/e1000/e1000_ethtool.c | 4 +--
drivers/net/ethernet/intel/e1000e/ethtool.c | 2 +-
drivers/net/ethernet/intel/e1000e/netdev.c | 3 +-
drivers/net/ethernet/intel/igb/igb_ethtool.c | 6 ++--
drivers/net/ethernet/intel/igb/igb_main.c | 6 ++--
.../net/ethernet/intel/ixgb/ixgb_ethtool.c | 4 +--
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 +-
drivers/net/ethernet/jme.c | 8 ++---
drivers/net/ethernet/mellanox/mlx4/alloc.c | 4 +--
drivers/net/ethernet/mellanox/mlx4/cmd.c | 17 +++++----
drivers/net/ethernet/mellanox/mlx4/eq.c | 2 +-
.../ethernet/mellanox/mlx4/resource_tracker.c | 21 +++++------
.../ethernet/mellanox/mlx5/core/fpga/conn.c | 8 ++---
.../ethernet/mellanox/mlx5/core/fpga/ipsec.c | 2 +-
.../ethernet/mellanox/mlx5/core/lib/clock.c | 4 +--
drivers/net/ethernet/micrel/ksz884x.c | 2 +-
drivers/net/ethernet/moxa/moxart_ether.c | 4 +--
.../net/ethernet/neterion/vxge/vxge-main.c | 4 +--
drivers/net/ethernet/nvidia/forcedeth.c | 6 ++--
drivers/net/ethernet/qlogic/qed/qed_debug.c | 6 ++--
drivers/net/ethernet/qlogic/qed/qed_dev.c | 12 +++----
.../net/ethernet/qlogic/qed/qed_init_ops.c | 3 +-
drivers/net/ethernet/qlogic/qed/qed_l2.c | 2 +-
drivers/net/ethernet/qlogic/qed/qed_mcp.c | 3 +-
drivers/net/ethernet/qlogic/qlge/qlge_main.c | 3 +-
drivers/net/usb/asix_common.c | 4 +--
drivers/net/usb/ax88179_178a.c | 2 +-
drivers/net/usb/usbnet.c | 2 +-
drivers/net/virtio_net.c | 6 ++--
drivers/net/wan/fsl_ucc_hdlc.c | 4 +--
drivers/net/wireless/ath/ath10k/htt_rx.c | 2 +-
drivers/net/wireless/ath/ath5k/phy.c | 4 +--
drivers/net/wireless/ath/ath9k/ar9003_paprd.c | 2 +-
drivers/net/wireless/ath/carl9170/main.c | 4 +--
.../broadcom/brcm80211/brcmfmac/msgbuf.c | 4 +--
.../broadcom/brcm80211/brcmsmac/phy/phy_n.c | 3 +-
drivers/net/wireless/intel/iwlegacy/common.c | 8 ++---
drivers/net/wireless/intersil/p54/eeprom.c | 4 +--
.../net/wireless/intersil/prism54/oid_mgt.c | 3 +-
drivers/net/wireless/marvell/mwifiex/sdio.c | 8 ++---
drivers/net/wireless/mediatek/mt7601u/init.c | 4 +--
.../net/wireless/quantenna/qtnfmac/commands.c | 2 +-
.../net/wireless/ralink/rt2x00/rt2x00debug.c | 7 ++--
drivers/net/wireless/realtek/rtlwifi/efuse.c | 4 +--
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 2 +-
drivers/net/wireless/st/cw1200/queue.c | 4 +--
drivers/net/wireless/st/cw1200/scan.c | 5 ++-
drivers/net/wireless/ti/wlcore/spi.c | 3 +-
drivers/nvmem/sunxi_sid.c | 2 +-
drivers/of/platform.c | 3 +-
drivers/opp/ti-opp-supply.c | 4 +--
drivers/pci/msi.c | 3 +-
drivers/pinctrl/bcm/pinctrl-bcm2835.c | 4 +--
drivers/pinctrl/pinctrl-lantiq.c | 3 +-
drivers/pinctrl/vt8500/pinctrl-wmt.c | 2 +-
drivers/platform/x86/alienware-wmi.c | 6 ++--
drivers/platform/x86/panasonic-laptop.c | 3 +-
drivers/rapidio/rio-scan.c | 5 ++-
drivers/s390/block/dasd_eer.c | 2 +-
drivers/s390/block/dcssblk.c | 5 ++-
drivers/s390/char/vmur.c | 2 +-
drivers/s390/char/zcore.c | 3 +-
drivers/s390/crypto/pkey_api.c | 2 +-
drivers/s390/net/qeth_core_main.c | 18 +++++-----
drivers/scsi/aacraid/linit.c | 3 +-
drivers/scsi/aic7xxx/aic79xx_core.c | 3 +-
drivers/scsi/aic94xx/aic94xx_hwi.c | 9 ++---
drivers/scsi/aic94xx/aic94xx_init.c | 2 +-
drivers/scsi/be2iscsi/be_main.c | 31 +++++++---------
drivers/scsi/bfa/bfad_bsg.c | 4 +--
drivers/scsi/csiostor/csio_wr.c | 6 ++--
drivers/scsi/dpt_i2o.c | 2 +-
drivers/scsi/esas2r/esas2r_init.c | 4 +--
drivers/scsi/hpsa.c | 23 ++++++------
drivers/scsi/ipr.c | 4 +--
drivers/scsi/libiscsi.c | 3 +-
drivers/scsi/libsas/sas_expander.c | 3 +-
drivers/scsi/lpfc/lpfc_sli.c | 5 ++-
drivers/scsi/lpfc/lpfc_vport.c | 2 +-
drivers/scsi/mac53c94.c | 4 +--
drivers/scsi/megaraid/megaraid_mm.c | 8 ++---
drivers/scsi/pm8001/pm8001_ctl.c | 2 +-
drivers/scsi/qedi/qedi_main.c | 3 +-
drivers/scsi/qla2xxx/qla_init.c | 8 ++---
drivers/scsi/qla2xxx/qla_isr.c | 4 +--
drivers/scsi/qla2xxx/qla_os.c | 12 +++----
drivers/scsi/qla2xxx/qla_target.c | 4 +--
drivers/scsi/smartpqi/smartpqi_init.c | 4 +--
drivers/sh/intc/core.c | 10 +++---
drivers/sh/maple/maple.c | 2 +-
drivers/soc/fsl/qbman/qman_test_stash.c | 2 +-
drivers/staging/lustre/lustre/lov/lov_io.c | 5 ++-
.../staging/lustre/lustre/lov/lov_object.c | 4 +--
.../staging/lustre/lustre/ptlrpc/sec_bulk.c | 5 ++-
.../pci/atomisp2/css2400/sh_css_firmware.c | 5 ++-
drivers/staging/rtl8192u/r8192U_core.c | 2 +-
.../staging/rtl8723bs/os_dep/ioctl_linux.c | 2 +-
drivers/staging/rtlwifi/efuse.c | 4 +--
drivers/staging/rts5208/ms.c | 2 +-
drivers/target/target_core_user.c | 4 +--
.../int340x_thermal/acpi_thermal_rel.c | 4 +--
drivers/thermal/of-thermal.c | 6 ++--
drivers/tty/hvc/hvc_iucv.c | 2 +-
drivers/tty/isicom.c | 2 +-
drivers/tty/serial/serial_core.c | 3 +-
drivers/tty/vt/selection.c | 3 +-
drivers/usb/core/message.c | 3 +-
drivers/usb/gadget/udc/fsl_udc_core.c | 3 +-
drivers/usb/host/ehci-sched.c | 4 +--
drivers/usb/host/imx21-hcd.c | 4 +--
drivers/usb/host/isp1362-hcd.c | 2 +-
drivers/usb/host/xhci-mem.c | 8 ++---
drivers/usb/misc/ldusb.c | 6 ++--
drivers/usb/mon/mon_bin.c | 3 +-
drivers/usb/storage/alauda.c | 3 +-
drivers/usb/storage/ene_ub6250.c | 12 ++++---
drivers/usb/storage/isd200.c | 2 +-
drivers/usb/storage/sddr55.c | 2 +-
drivers/usb/wusbcore/wa-rpipe.c | 2 +-
drivers/uwb/est.c | 2 +-
drivers/uwb/i1480/dfu/usb.c | 2 +-
drivers/video/console/sticore.c | 2 +-
drivers/video/fbdev/core/bitblit.c | 5 +--
drivers/video/fbdev/core/fbcon.c | 3 +-
drivers/video/fbdev/core/fbcon_ccw.c | 8 +++--
drivers/video/fbdev/core/fbcon_cw.c | 8 +++--
drivers/video/fbdev/core/fbcon_ud.c | 5 +--
drivers/video/fbdev/core/fbmem.c | 9 ++---
drivers/video/fbdev/core/fbmon.c | 4 +--
drivers/video/fbdev/i810/i810_main.c | 4 +--
drivers/video/fbdev/intelfb/intelfbdrv.c | 2 +-
drivers/video/fbdev/matrox/g450_pll.c | 3 +-
drivers/video/fbdev/mb862xx/mb862xxfb_accel.c | 2 +-
drivers/video/fbdev/nvidia/nvidia.c | 5 +--
drivers/video/fbdev/riva/fbdev.c | 5 +--
drivers/video/fbdev/uvesafb.c | 7 ++--
drivers/video/of_display_timing.c | 4 +--
drivers/virt/vboxguest/vboxguest_core.c | 3 +-
drivers/xen/xen-pciback/pciback_ops.c | 2 +-
fs/afs/cmservice.c | 3 +-
fs/btrfs/check-integrity.c | 5 ++-
fs/ceph/mds_client.c | 4 +--
fs/cifs/smb2pdu.c | 2 +-
fs/cifs/transport.c | 4 +--
fs/ext4/extents.c | 8 ++---
fs/ext4/resize.c | 6 ++--
fs/fuse/dev.c | 6 ++--
fs/gfs2/dir.c | 2 +-
fs/gfs2/rgrp.c | 2 +-
fs/hpfs/dnode.c | 2 +-
fs/hpfs/map.c | 2 +-
fs/jffs2/wbuf.c | 3 +-
fs/jfs/jfs_dtree.c | 14 ++++----
fs/jfs/jfs_unicode.c | 2 +-
fs/nfsd/export.c | 4 +--
fs/ocfs2/journal.c | 2 +-
fs/ocfs2/sysfile.c | 4 +--
fs/overlayfs/namei.c | 2 +-
fs/proc/proc_sysctl.c | 2 +-
fs/proc/task_mmu.c | 2 +-
fs/reiserfs/inode.c | 3 +-
fs/reiserfs/journal.c | 8 ++---
fs/select.c | 2 +-
fs/ubifs/lpt.c | 7 ++--
fs/ubifs/tnc.c | 2 +-
fs/ubifs/tnc_commit.c | 3 +-
fs/udf/super.c | 4 +--
fs/ufs/super.c | 2 +-
kernel/bpf/lpm_trie.c | 2 +-
kernel/bpf/verifier.c | 3 +-
kernel/cgroup/cpuset.c | 2 +-
kernel/debug/kdb/kdb_main.c | 9 ++---
kernel/events/uprobes.c | 3 +-
kernel/fail_function.c | 2 +-
kernel/locking/locktorture.c | 10 +++---
kernel/relay.c | 3 +-
kernel/sysctl.c | 2 +-
kernel/trace/trace.c | 5 +--
lib/argv_split.c | 2 +-
lib/reed_solomon/reed_solomon.c | 9 +++--
lib/test_string.c | 6 ++--
lib/test_user_copy.c | 2 +-
mm/slab.c | 3 +-
mm/slub.c | 12 +++----
mm/swapfile.c | 2 +-
net/9p/protocol.c | 5 ++-
net/can/bcm.c | 6 ++--
net/ceph/osdmap.c | 2 +-
net/core/ethtool.c | 2 +-
net/ipv4/fib_frontend.c | 2 +-
net/mac80211/util.c | 4 +--
net/netfilter/xt_dccp.c | 2 +-
net/netlink/genetlink.c | 8 ++---
net/rds/ib.c | 2 +-
net/sched/sch_fq_codel.c | 7 ++--
net/smc/smc_wr.c | 5 ++-
net/sunrpc/auth_gss/auth_gss.c | 4 +--
net/sunrpc/auth_gss/gss_krb5_crypto.c | 2 +-
net/sunrpc/auth_gss/gss_rpc_upcall.c | 3 +-
net/sunrpc/cache.c | 2 +-
net/tipc/netlink_compat.c | 4 +--
security/keys/trusted.c | 2 +-
sound/core/pcm_native.c | 4 +--
sound/firewire/dice/dice-transaction.c | 4 +--
sound/pci/cs46xx/cs46xx_lib.c | 6 ++--
sound/pci/ctxfi/ctatc.c | 2 +-
sound/pci/ctxfi/ctdaio.c | 3 +-
sound/pci/ctxfi/ctmixer.c | 5 +--
sound/pci/ctxfi/ctsrc.c | 2 +-
sound/pci/emu10k1/emufx.c | 6 ++--
sound/pci/hda/hda_codec.c | 3 +-
sound/soc/codecs/wm8904.c | 4 +--
sound/soc/codecs/wm8958-dsp2.c | 16 ++++-----
sound/soc/codecs/wm_adsp.c | 2 +-
sound/soc/soc-core.c | 5 ++-
sound/soc/soc-dapm.c | 5 ++-
sound/soc/soc-topology.c | 2 +-
sound/usb/format.c | 3 +-
sound/usb/line6/capture.c | 4 +--
sound/usb/line6/pcm.c | 4 +--
sound/usb/line6/playback.c | 4 +--
sound/usb/mixer.c | 3 +-
sound/usb/usx2y/usbusx2yaudio.c | 3 +-
460 files changed, 1015 insertions(+), 925 deletions(-)
diff --git a/arch/arm/mach-omap2/hsmmc.c b/arch/arm/mach-omap2/hsmmc.c
index b064066d431c..34d7b3a50ab7 100644
--- a/arch/arm/mach-omap2/hsmmc.c
+++ b/arch/arm/mach-omap2/hsmmc.c
@@ -35,7 +35,8 @@ static int __init omap_hsmmc_pdata_init(struct omap2_hsmmc_info *c,
{
char *hc_name;
- hc_name = kzalloc(sizeof(char) * (HSMMC_NAME_LEN + 1), GFP_KERNEL);
+ hc_name = kzalloc(array_size(sizeof(char), (HSMMC_NAME_LEN + 1)),
+ GFP_KERNEL);
if (!hc_name) {
kfree(hc_name);
return -ENOMEM;
diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index 6e47fc3ab549..869f98e0c114 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -235,8 +235,8 @@ static void __init register_insn_emulation_sysctl(void)
struct insn_emulation *insn;
struct ctl_table *insns_sysctl, *sysctl;
- insns_sysctl = kzalloc(sizeof(*sysctl) * (nr_insn_emulated + 1),
- GFP_KERNEL);
+ insns_sysctl = kzalloc(array_size(sizeof(*sysctl), (nr_insn_emulated + 1)),
+ GFP_KERNEL);
raw_spin_lock_irqsave(&insn_emulation_lock, flags);
list_for_each_entry(insn, &insn_emulation, node) {
diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
index 301417ae2ba8..aa98ad0a70e2 100644
--- a/arch/arm64/mm/context.c
+++ b/arch/arm64/mm/context.c
@@ -263,7 +263,7 @@ static int asids_init(void)
*/
WARN_ON(NUM_USER_ASIDS - 1 <= num_possible_cpus());
atomic64_set(&asid_generation, ASID_FIRST_VERSION);
- asid_map = kzalloc(BITS_TO_LONGS(NUM_USER_ASIDS) * sizeof(*asid_map),
+ asid_map = kzalloc(array_size(BITS_TO_LONGS(NUM_USER_ASIDS), sizeof(*asid_map)),
GFP_KERNEL);
if (!asid_map)
panic("Failed to allocate bitmap for %lu ASIDs\n",
diff --git a/arch/ia64/kernel/mca_drv.c b/arch/ia64/kernel/mca_drv.c
index 94f8bf777afa..820857c09048 100644
--- a/arch/ia64/kernel/mca_drv.c
+++ b/arch/ia64/kernel/mca_drv.c
@@ -350,7 +350,8 @@ init_record_index_pools(void)
/* - 3 - */
slidx_pool.max_idx = (rec_max_size/sect_min_size) * 2 + 1;
slidx_pool.buffer =
- kmalloc(slidx_pool.max_idx * sizeof(slidx_list_t), GFP_KERNEL);
+ kmalloc(array_size(slidx_pool.max_idx, sizeof(slidx_list_t)),
+ GFP_KERNEL);
return slidx_pool.buffer ? 0 : -ENOMEM;
}
diff --git a/arch/ia64/mm/tlb.c b/arch/ia64/mm/tlb.c
index 46ecc5d948aa..b39c9f62b7ac 100644
--- a/arch/ia64/mm/tlb.c
+++ b/arch/ia64/mm/tlb.c
@@ -430,8 +430,8 @@ int ia64_itr_entry(u64 target_mask, u64 va, u64 pte, u64 log_size)
int cpu = smp_processor_id();
if (!ia64_idtrs[cpu]) {
- ia64_idtrs[cpu] = kmalloc(2 * IA64_TR_ALLOC_MAX *
- sizeof (struct ia64_tr_entry), GFP_KERNEL);
+ ia64_idtrs[cpu] = kmalloc(array3_size(2, IA64_TR_ALLOC_MAX, sizeof(struct ia64_tr_entry)),
+ GFP_KERNEL);
if (!ia64_idtrs[cpu])
return -ENOMEM;
}
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_provider.c b/arch/ia64/sn/pci/pcibr/pcibr_provider.c
index 8dbbef4a4f47..49a7b23f5fc9 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_provider.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_provider.c
@@ -184,7 +184,8 @@ pcibr_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *cont
/* Setup the PMU ATE map */
soft->pbi_int_ate_resource.lowest_free_index = 0;
soft->pbi_int_ate_resource.ate =
- kzalloc(soft->pbi_int_ate_size * sizeof(u64), GFP_KERNEL);
+ kzalloc(array_size(soft->pbi_int_ate_size, sizeof(u64)),
+ GFP_KERNEL);
if (!soft->pbi_int_ate_resource.ate) {
kfree(soft);
diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
index 6b6f6851df92..de5237f930c4 100644
--- a/arch/mips/alchemy/common/clock.c
+++ b/arch/mips/alchemy/common/clock.c
@@ -985,7 +985,7 @@ static int __init alchemy_clk_setup_imux(int ctype)
return -ENODEV;
}
- a = kzalloc((sizeof(*a)) * 6, GFP_KERNEL);
+ a = kzalloc(array_size((sizeof(*a)), 6), GFP_KERNEL);
if (!a)
return -ENOMEM;
diff --git a/arch/mips/alchemy/common/platform.c b/arch/mips/alchemy/common/platform.c
index cb2c316a2165..c83ed99c7d96 100644
--- a/arch/mips/alchemy/common/platform.c
+++ b/arch/mips/alchemy/common/platform.c
@@ -115,7 +115,7 @@ static void __init alchemy_setup_uarts(int ctype)
uartclk = clk_get_rate(clk);
clk_put(clk);
- ports = kzalloc(s * (c + 1), GFP_KERNEL);
+ ports = kzalloc(array_size(s, (c + 1)), GFP_KERNEL);
if (!ports) {
printk(KERN_INFO "Alchemy: no memory for UART data\n");
return;
diff --git a/arch/mips/bmips/dma.c b/arch/mips/bmips/dma.c
index 04790f4e1805..52f630b9b289 100644
--- a/arch/mips/bmips/dma.c
+++ b/arch/mips/bmips/dma.c
@@ -94,7 +94,7 @@ static int __init bmips_init_dma_ranges(void)
goto out_bad;
/* add a dummy (zero) entry at the end as a sentinel */
- bmips_dma_ranges = kzalloc(sizeof(struct bmips_dma_range) * (len + 1),
+ bmips_dma_ranges = kzalloc(array_size(sizeof(struct bmips_dma_range), (len + 1)),
GFP_KERNEL);
if (!bmips_dma_ranges)
goto out_bad;
diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index b44ec104a5a1..3d5dfa77c824 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -791,7 +791,7 @@ static int __init vdso_init(void)
#ifdef CONFIG_VDSO32
/* Make sure pages are in the correct state */
- vdso32_pagelist = kzalloc(sizeof(struct page *) * (vdso32_pages + 2),
+ vdso32_pagelist = kzalloc(array_size(sizeof(struct page *), (vdso32_pages + 2)),
GFP_KERNEL);
BUG_ON(vdso32_pagelist == NULL);
for (i = 0; i < vdso32_pages; i++) {
@@ -805,7 +805,7 @@ static int __init vdso_init(void)
#endif
#ifdef CONFIG_PPC64
- vdso64_pagelist = kzalloc(sizeof(struct page *) * (vdso64_pages + 2),
+ vdso64_pagelist = kzalloc(array_size(sizeof(struct page *), (vdso64_pages + 2)),
GFP_KERNEL);
BUG_ON(vdso64_pagelist == NULL);
for (i = 0; i < vdso64_pages; i++) {
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 57a5029b4521..fcd62435e0d1 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1316,7 +1316,7 @@ int numa_update_cpu_topology(bool cpus_locked)
if (!weight)
return 0;
- updates = kzalloc(weight * (sizeof(*updates)), GFP_KERNEL);
+ updates = kzalloc(array_size(weight, (sizeof(*updates))), GFP_KERNEL);
if (!updates)
return 0;
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index a9636d8cba15..df5cb33130ea 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -566,7 +566,7 @@ void bpf_jit_compile(struct bpf_prog *fp)
if (!bpf_jit_enable)
return;
- addrs = kzalloc((flen+1) * sizeof(*addrs), GFP_KERNEL);
+ addrs = kzalloc(array_size((flen + 1), sizeof(*addrs)), GFP_KERNEL);
if (addrs == NULL)
return;
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 0ef3d9580e98..356ffc113bf8 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -999,7 +999,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
}
flen = fp->len;
- addrs = kzalloc((flen+1) * sizeof(*addrs), GFP_KERNEL);
+ addrs = kzalloc(array_size((flen + 1), sizeof(*addrs)), GFP_KERNEL);
if (addrs == NULL) {
fp = org_fp;
goto out;
diff --git a/arch/powerpc/oprofile/cell/spu_profiler.c b/arch/powerpc/oprofile/cell/spu_profiler.c
index 5182f2936af2..872527c79282 100644
--- a/arch/powerpc/oprofile/cell/spu_profiler.c
+++ b/arch/powerpc/oprofile/cell/spu_profiler.c
@@ -210,8 +210,8 @@ int start_spu_profiling_cycles(unsigned int cycles_reset)
timer.function = profile_spus;
/* Allocate arrays for collecting SPU PC samples */
- samples = kzalloc(SPUS_PER_NODE *
- TRACE_ARRAY_SIZE * sizeof(u32), GFP_KERNEL);
+ samples = kzalloc(array3_size(SPUS_PER_NODE, TRACE_ARRAY_SIZE, sizeof(u32)),
+ GFP_KERNEL);
if (!samples)
return -ENOMEM;
diff --git a/arch/powerpc/platforms/4xx/msi.c b/arch/powerpc/platforms/4xx/msi.c
index 96aaae678928..0cc7a90a67c7 100644
--- a/arch/powerpc/platforms/4xx/msi.c
+++ b/arch/powerpc/platforms/4xx/msi.c
@@ -89,7 +89,8 @@ static int ppc4xx_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
if (type == PCI_CAP_ID_MSIX)
pr_debug("ppc4xx msi: MSI-X untested, trying anyway.\n");
- msi_data->msi_virqs = kmalloc((msi_irqs) * sizeof(int), GFP_KERNEL);
+ msi_data->msi_virqs = kmalloc(array_size((msi_irqs), sizeof(int)),
+ GFP_KERNEL);
if (!msi_data->msi_virqs)
return -ENOMEM;
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 0e9920e6ab9b..dac268bd2db6 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -1641,7 +1641,7 @@ void __init mpic_init(struct mpic *mpic)
#ifdef CONFIG_PM
/* allocate memory to save mpic state */
- mpic->save_data = kmalloc(mpic->num_sources * sizeof(*mpic->save_data),
+ mpic->save_data = kmalloc(array_size(mpic->num_sources, sizeof(*mpic->save_data)),
GFP_KERNEL);
BUG_ON(mpic->save_data == NULL);
#endif
diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
index b48454be5b98..8ee92bfcf9ea 100644
--- a/arch/powerpc/sysdev/xive/native.c
+++ b/arch/powerpc/sysdev/xive/native.c
@@ -489,7 +489,7 @@ static bool xive_parse_provisioning(struct device_node *np)
if (rc == 0)
return true;
- xive_provision_chips = kzalloc(4 * xive_provision_chip_count,
+ xive_provision_chips = kzalloc(array_size(4, xive_provision_chip_count),
GFP_KERNEL);
if (WARN_ON(!xive_provision_chips))
return false;
diff --git a/arch/s390/hypfs/hypfs_diag0c.c b/arch/s390/hypfs/hypfs_diag0c.c
index dce87f1bec94..4d02d768811d 100644
--- a/arch/s390/hypfs/hypfs_diag0c.c
+++ b/arch/s390/hypfs/hypfs_diag0c.c
@@ -49,7 +49,8 @@ static void *diag0c_store(unsigned int *count)
get_online_cpus();
cpu_count = num_online_cpus();
- cpu_vec = kmalloc(sizeof(*cpu_vec) * num_possible_cpus(), GFP_KERNEL);
+ cpu_vec = kmalloc(array_size(sizeof(*cpu_vec), num_possible_cpus()),
+ GFP_KERNEL);
if (!cpu_vec)
goto fail_put_online_cpus;
/* Note: Diag 0c needs 8 byte alignment and real storage */
diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
index f3a1c7c6824e..430670401eac 100644
--- a/arch/s390/kernel/vdso.c
+++ b/arch/s390/kernel/vdso.c
@@ -285,7 +285,7 @@ static int __init vdso_init(void)
+ PAGE_SIZE - 1) >> PAGE_SHIFT) + 1;
/* Make sure pages are in the correct state */
- vdso32_pagelist = kzalloc(sizeof(struct page *) * (vdso32_pages + 1),
+ vdso32_pagelist = kzalloc(array_size(sizeof(struct page *), (vdso32_pages + 1)),
GFP_KERNEL);
BUG_ON(vdso32_pagelist == NULL);
for (i = 0; i < vdso32_pages - 1; i++) {
@@ -303,7 +303,7 @@ static int __init vdso_init(void)
+ PAGE_SIZE - 1) >> PAGE_SHIFT) + 1;
/* Make sure pages are in the correct state */
- vdso64_pagelist = kzalloc(sizeof(struct page *) * (vdso64_pages + 1),
+ vdso64_pagelist = kzalloc(array_size(sizeof(struct page *), (vdso64_pages + 1)),
GFP_KERNEL);
BUG_ON(vdso64_pagelist == NULL);
for (i = 0; i < vdso64_pages - 1; i++) {
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index 9ef8de63f28b..241442c731a7 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -571,7 +571,8 @@ SYSCALL_DEFINE5(utrap_install, utrap_entry_t, type,
}
if (!current_thread_info()->utraps) {
current_thread_info()->utraps =
- kzalloc((UT_TRAP_INSTRUCTION_31+1)*sizeof(long), GFP_KERNEL);
+ kzalloc(array_size((UT_TRAP_INSTRUCTION_31 + 1), sizeof(long)),
+ GFP_KERNEL);
if (!current_thread_info()->utraps)
return -ENOMEM;
current_thread_info()->utraps[0] = 1;
@@ -581,7 +582,7 @@ SYSCALL_DEFINE5(utrap_install, utrap_entry_t, type,
unsigned long *p = current_thread_info()->utraps;
current_thread_info()->utraps =
- kmalloc((UT_TRAP_INSTRUCTION_31+1)*sizeof(long),
+ kmalloc(array_size((UT_TRAP_INSTRUCTION_31 + 1), sizeof(long)),
GFP_KERNEL);
if (!current_thread_info()->utraps) {
current_thread_info()->utraps = p;
diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
index 02168fe25105..8d4abf6b7043 100644
--- a/arch/um/drivers/vector_kern.c
+++ b/arch/um/drivers/vector_kern.c
@@ -527,15 +527,11 @@ static struct vector_queue *create_queue(
result->max_iov_frags = num_extra_frags;
for (i = 0; i < max_size; i++) {
if (vp->header_size > 0)
- iov = kmalloc(
- sizeof(struct iovec) * (3 + num_extra_frags),
- GFP_KERNEL
- );
+ iov = kmalloc(array_size(sizeof(struct iovec), (3 + num_extra_frags)),
+ GFP_KERNEL);
else
- iov = kmalloc(
- sizeof(struct iovec) * (2 + num_extra_frags),
- GFP_KERNEL
- );
+ iov = kmalloc(array_size(sizeof(struct iovec), (2 + num_extra_frags)),
+ GFP_KERNEL);
if (iov == NULL)
goto out_fail;
mmsg_vector->msg_hdr.msg_iov = iov;
diff --git a/arch/unicore32/kernel/pm.c b/arch/unicore32/kernel/pm.c
index 784bc2db3b28..e7be768c9875 100644
--- a/arch/unicore32/kernel/pm.c
+++ b/arch/unicore32/kernel/pm.c
@@ -109,8 +109,8 @@ static int __init puv3_pm_init(void)
return -EINVAL;
}
- sleep_save = kmalloc(puv3_cpu_pm_fns->save_count
- * sizeof(unsigned long), GFP_KERNEL);
+ sleep_save = kmalloc(array_size(puv3_cpu_pm_fns->save_count, sizeof(unsigned long)),
+ GFP_KERNEL);
if (!sleep_save) {
printk(KERN_ERR "failed to alloc memory for pm save\n");
return -ENOMEM;
diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c
index 38b5d41b0c37..7f5346239593 100644
--- a/arch/x86/events/amd/iommu.c
+++ b/arch/x86/events/amd/iommu.c
@@ -387,7 +387,8 @@ static __init int _init_events_attrs(void)
while (amd_iommu_v2_event_descs[i].attr.attr.name)
i++;
- attrs = kzalloc(sizeof(struct attribute **) * (i + 1), GFP_KERNEL);
+ attrs = kzalloc(array_size(sizeof(struct attribute **), (i + 1)),
+ GFP_KERNEL);
if (!attrs)
return -ENOMEM;
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index a7956fc7ca1d..8a8c70312cdc 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -810,7 +810,7 @@ static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
size_t size;
int i, j;
- pmus = kzalloc(sizeof(*pmus) * type->num_boxes, GFP_KERNEL);
+ pmus = kzalloc(array_size(sizeof(*pmus), type->num_boxes), GFP_KERNEL);
if (!pmus)
return -ENOMEM;
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index f7666eef4a87..b003b9a9ff88 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -1386,7 +1386,7 @@ int mce_threshold_create_device(unsigned int cpu)
if (bp)
return 0;
- bp = kzalloc(sizeof(struct threshold_bank *) * mca_cfg.banks,
+ bp = kzalloc(array_size(sizeof(struct threshold_bank *), mca_cfg.banks),
GFP_KERNEL);
if (!bp)
return -ENOMEM;
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 29345edb485a..2289a9319a57 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -967,7 +967,7 @@ int __init hpet_enable(void)
#endif
cfg = hpet_readl(HPET_CFG);
- hpet_boot_cfg = kmalloc((last + 2) * sizeof(*hpet_boot_cfg),
+ hpet_boot_cfg = kmalloc(array_size((last + 2), sizeof(*hpet_boot_cfg)),
GFP_KERNEL);
if (hpet_boot_cfg)
*hpet_boot_cfg = cfg;
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 1fc05e428aba..27e6fb051792 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -995,7 +995,8 @@ static int svm_cpu_init(int cpu)
if (svm_sev_enabled()) {
r = -ENOMEM;
- sd->sev_vmcbs = kmalloc((max_sev_asid + 1) * sizeof(void *), GFP_KERNEL);
+ sd->sev_vmcbs = kmalloc(array_size((max_sev_asid + 1), sizeof(void *)),
+ GFP_KERNEL);
if (!sd->sev_vmcbs)
goto err_1;
}
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 3b706eb0bde9..be133bc82a41 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -8608,7 +8608,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
} else
static_key_slow_inc(&kvm_no_apic_vcpu);
- vcpu->arch.mce_banks = kzalloc(KVM_MAX_MCE_BANKS * sizeof(u64) * 4,
+ vcpu->arch.mce_banks = kzalloc(array3_size(KVM_MAX_MCE_BANKS, sizeof(u64), 4),
GFP_KERNEL);
if (!vcpu->arch.mce_banks) {
r = -ENOMEM;
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 263c8453815e..e0523123adbc 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1212,7 +1212,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
extra_pass = true;
goto skip_init_addrs;
}
- addrs = kmalloc(prog->len * sizeof(*addrs), GFP_KERNEL);
+ addrs = kmalloc(array_size(prog->len, sizeof(*addrs)), GFP_KERNEL);
if (!addrs) {
prog = orig_prog;
goto out_addrs;
diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
index 9542a746dc50..70eef70f00e6 100644
--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
@@ -168,7 +168,7 @@ static int xen_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
if (type == PCI_CAP_ID_MSI && nvec > 1)
return 1;
- v = kzalloc(sizeof(int) * max(1, nvec), GFP_KERNEL);
+ v = kzalloc(array_size(sizeof(int), max(1, nvec)), GFP_KERNEL);
if (!v)
return -ENOMEM;
diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
index 51fe7c8744ae..52bcfe7a9dc5 100644
--- a/crypto/tcrypt.c
+++ b/crypto/tcrypt.c
@@ -547,7 +547,7 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs,
if (testmgr_alloc_buf(xoutbuf))
goto out_nooutbuf;
- sg = kmalloc(sizeof(*sg) * 9 * 2, GFP_KERNEL);
+ sg = kmalloc(array3_size(sizeof(*sg), 9, 2), GFP_KERNEL);
if (!sg)
goto out_nosg;
sgout = &sg[9];
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index af4a01c5037b..a7a9baf8a227 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -605,7 +605,8 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
goto out_nooutbuf;
/* avoid "the frame size is larger than 1024 bytes" compiler warning */
- sg = kmalloc(sizeof(*sg) * 8 * (diff_dst ? 4 : 2), GFP_KERNEL);
+ sg = kmalloc(array3_size(sizeof(*sg), 8, (diff_dst ? 4 : 2)),
+ GFP_KERNEL);
if (!sg)
goto out_nosg;
sgout = &sg[16];
diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index 2f2e737be0f8..4435e7f34ac6 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -832,8 +832,8 @@ int acpi_video_get_levels(struct acpi_device *device,
* in order to account for buggy BIOS which don't export the first two
* special levels (see below)
*/
- br->levels = kmalloc((obj->package.count + ACPI_VIDEO_FIRST_LEVEL) *
- sizeof(*br->levels), GFP_KERNEL);
+ br->levels = kmalloc(array_size((obj->package.count + ACPI_VIDEO_FIRST_LEVEL), sizeof(*br->levels)),
+ GFP_KERNEL);
if (!br->levels) {
result = -ENOMEM;
goto out_free;
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index a651ab3490d8..59051c6b11e9 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -343,7 +343,7 @@ static int acpi_processor_get_performance_states(struct acpi_processor *pr)
pr->performance->state_count = pss->package.count;
pr->performance->states =
- kmalloc(sizeof(struct acpi_processor_px) * pss->package.count,
+ kmalloc(array_size(sizeof(struct acpi_processor_px), pss->package.count),
GFP_KERNEL);
if (!pr->performance->states) {
result = -ENOMEM;
diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
index 7f9aff4b8d62..40720a67eba9 100644
--- a/drivers/acpi/processor_throttling.c
+++ b/drivers/acpi/processor_throttling.c
@@ -534,7 +534,7 @@ static int acpi_processor_get_throttling_states(struct acpi_processor *pr)
pr->throttling.state_count = tss->package.count;
pr->throttling.states_tss =
- kmalloc(sizeof(struct acpi_processor_tx_tss) * tss->package.count,
+ kmalloc(array_size(sizeof(struct acpi_processor_tx_tss), tss->package.count),
GFP_KERNEL);
if (!pr->throttling.states_tss) {
result = -ENOMEM;
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 4fc59c3bc673..63851d391278 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -857,12 +857,12 @@ void acpi_irq_stats_init(void)
num_gpes = acpi_current_gpe_count;
num_counters = num_gpes + ACPI_NUM_FIXED_EVENTS + NUM_COUNTERS_EXTRA;
- all_attrs = kzalloc(sizeof(struct attribute *) * (num_counters + 1),
+ all_attrs = kzalloc(array_size(sizeof(struct attribute *), (num_counters + 1)),
GFP_KERNEL);
if (all_attrs == NULL)
return;
- all_counters = kzalloc(sizeof(struct event_counter) * (num_counters),
+ all_counters = kzalloc(array_size(sizeof(struct event_counter), (num_counters)),
GFP_KERNEL);
if (all_counters == NULL)
goto fail;
@@ -871,7 +871,7 @@ void acpi_irq_stats_init(void)
if (ACPI_FAILURE(status))
goto fail;
- counter_attrs = kzalloc(sizeof(struct kobj_attribute) * (num_counters),
+ counter_attrs = kzalloc(array_size(sizeof(struct kobj_attribute), (num_counters)),
GFP_KERNEL);
if (counter_attrs == NULL)
goto fail;
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 5a426c877dfb..3dbb1bcbe555 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -692,8 +692,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
}
}
#endif
- alloc->pages = kzalloc(sizeof(alloc->pages[0]) *
- ((vma->vm_end - vma->vm_start) / PAGE_SIZE),
+ alloc->pages = kzalloc(array_size(sizeof(alloc->pages[0]), ((vma->vm_end - vma->vm_start) / PAGE_SIZE)),
GFP_KERNEL);
if (alloc->pages == NULL) {
ret = -ENOMEM;
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 29f102dcfec4..c8d12ab7a57b 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -656,7 +656,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev)
unsigned long long rate_cps;
int mult, buf, buf_limit = 4;
- rategrid = kmalloc( sizeof(unsigned) * 16 * 16, GFP_KERNEL);
+ rategrid = kmalloc(array3_size(sizeof(unsigned), 16, 16), GFP_KERNEL);
if (!rategrid)
return -ENOMEM;
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index be076606d30e..fa14b364e206 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -1618,7 +1618,7 @@ static int rx_init(struct atm_dev *dev)
skb_queue_head_init(&iadev->rx_dma_q);
iadev->rx_free_desc_qhead = NULL;
- iadev->rx_open = kzalloc(4 * iadev->num_vc, GFP_KERNEL);
+ iadev->rx_open = kzalloc(array_size(4, iadev->num_vc), GFP_KERNEL);
if (!iadev->rx_open) {
printk(KERN_ERR DEV_LABEL "itf %d couldn't get free page\n",
dev->number);
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 0df1a1c80b00..ccfca3af5f86 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1291,7 +1291,8 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
card->using_dma = 1;
if (1) { /* All known FPGA versions so far */
card->dma_alignment = 3;
- card->dma_bounce = kmalloc(card->nr_ports * BUF_SIZE, GFP_KERNEL);
+ card->dma_bounce = kmalloc(array_size(card->nr_ports, BUF_SIZE),
+ GFP_KERNEL);
if (!card->dma_bounce) {
dev_warn(&card->dev->dev, "Failed to allocate DMA bounce buffers\n");
err = -ENOMEM;
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index f781eff7d23e..92f4b6d846dd 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -5724,8 +5724,8 @@ static bool DAC960_CheckStatusBuffer(DAC960_Controller_T *Controller,
Controller->CombinedStatusBufferLength = NewStatusBufferLength;
return true;
}
- NewStatusBuffer = kmalloc(2 * Controller->CombinedStatusBufferLength,
- GFP_ATOMIC);
+ NewStatusBuffer = kmalloc(array_size(2, Controller->CombinedStatusBufferLength),
+ GFP_ATOMIC);
if (NewStatusBuffer == NULL)
{
DAC960_Warning("Unable to expand Combined Status Buffer - Truncating\n",
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index 3aaf6af3ec23..4b55783d76ae 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -1727,7 +1727,7 @@ static int __init fd_probe_drives(void)
}
drives++;
- if ((unit[drive].trackbuf = kmalloc(FLOPPY_MAX_SECTORS * 512, GFP_KERNEL)) == NULL) {
+ if ((unit[drive].trackbuf = kmalloc(array_size(FLOPPY_MAX_SECTORS, 512), GFP_KERNEL)) == NULL) {
printk("no mem for ");
unit[drive].type = &drive_types[num_dr_types - 1]; /* FD_NODRIVE */
drives--;
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index df02a9211ae3..bd285a55d765 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -1573,7 +1573,8 @@ static int setup_commands(struct nullb_queue *nq)
struct nullb_cmd *cmd;
int i, tag_size;
- nq->cmds = kzalloc(nq->queue_depth * sizeof(*cmd), GFP_KERNEL);
+ nq->cmds = kzalloc(array_size(nq->queue_depth, sizeof(*cmd)),
+ GFP_KERNEL);
if (!nq->cmds)
return -ENOMEM;
@@ -1597,8 +1598,8 @@ static int setup_commands(struct nullb_queue *nq)
static int setup_queues(struct nullb *nullb)
{
- nullb->queues = kzalloc(nullb->dev->submit_queues *
- sizeof(struct nullb_queue), GFP_KERNEL);
+ nullb->queues = kzalloc(array_size(nullb->dev->submit_queues, sizeof(struct nullb_queue)),
+ GFP_KERNEL);
if (!nullb->queues)
return -ENOMEM;
diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
index 34997df132e2..2b0e5277fb46 100644
--- a/drivers/block/rsxx/core.c
+++ b/drivers/block/rsxx/core.c
@@ -873,7 +873,8 @@ static int rsxx_pci_probe(struct pci_dev *dev,
dev_info(CARD_TO_DEV(card),
"Failed reading the number of DMA targets\n");
- card->ctrl = kzalloc(card->n_targets * sizeof(*card->ctrl), GFP_KERNEL);
+ card->ctrl = kzalloc(array_size(card->n_targets, sizeof(*card->ctrl)),
+ GFP_KERNEL);
if (!card->ctrl) {
st = -ENOMEM;
goto failed_dma_setup;
diff --git a/drivers/block/rsxx/dma.c b/drivers/block/rsxx/dma.c
index beaccf197a5a..42e914fdd4de 100644
--- a/drivers/block/rsxx/dma.c
+++ b/drivers/block/rsxx/dma.c
@@ -1038,7 +1038,7 @@ int rsxx_eeh_save_issued_dmas(struct rsxx_cardinfo *card)
struct rsxx_dma *dma;
struct list_head *issued_dmas;
- issued_dmas = kzalloc(sizeof(*issued_dmas) * card->n_targets,
+ issued_dmas = kzalloc(array_size(sizeof(*issued_dmas), card->n_targets),
GFP_KERNEL);
if (!issued_dmas)
return -ENOMEM;
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 21c1be1eb226..e2af6ad48c88 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -139,7 +139,8 @@ static int xen_blkif_alloc_rings(struct xen_blkif *blkif)
{
unsigned int r;
- blkif->rings = kzalloc(blkif->nr_rings * sizeof(struct xen_blkif_ring), GFP_KERNEL);
+ blkif->rings = kzalloc(array_size(blkif->nr_rings, sizeof(struct xen_blkif_ring)),
+ GFP_KERNEL);
if (!blkif->rings)
return -ENOMEM;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index c6469b956520..e955f092534d 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1907,7 +1907,8 @@ static int negotiate_mq(struct blkfront_info *info)
if (!info->nr_rings)
info->nr_rings = 1;
- info->rinfo = kzalloc(sizeof(struct blkfront_ring_info) * info->nr_rings, GFP_KERNEL);
+ info->rinfo = kzalloc(array_size(sizeof(struct blkfront_ring_info), info->nr_rings),
+ GFP_KERNEL);
if (!info->rinfo) {
xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
return -ENOMEM;
@@ -2222,10 +2223,8 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo)
rinfo->shadow[i].sg = kzalloc(array_size(psegs, sizeof(rinfo->shadow[i].sg[0])),
GFP_NOIO);
if (info->max_indirect_segments)
- rinfo->shadow[i].indirect_grants = kzalloc(
- sizeof(rinfo->shadow[i].indirect_grants[0]) *
- INDIRECT_GREFS(grants),
- GFP_NOIO);
+ rinfo->shadow[i].indirect_grants = kzalloc(array_size(sizeof(rinfo->shadow[i].indirect_grants[0]), INDIRECT_GREFS(grants)),
+ GFP_NOIO);
if ((rinfo->shadow[i].grants_used == NULL) ||
(rinfo->shadow[i].sg == NULL) ||
(info->max_indirect_segments &&
diff --git a/drivers/block/z2ram.c b/drivers/block/z2ram.c
index 8f9130ab5887..f7dc10f80c74 100644
--- a/drivers/block/z2ram.c
+++ b/drivers/block/z2ram.c
@@ -197,8 +197,8 @@ static int z2_open(struct block_device *bdev, fmode_t mode)
vaddr = (unsigned long)z_remap_nocache_nonser(paddr, size);
#endif
z2ram_map =
- kmalloc((size/Z2RAM_CHUNKSIZE)*sizeof(z2ram_map[0]),
- GFP_KERNEL);
+ kmalloc(array_size((size / Z2RAM_CHUNKSIZE), sizeof(z2ram_map[0])),
+ GFP_KERNEL);
if ( z2ram_map == NULL )
{
printk( KERN_ERR DEVICE_NAME
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index b450544dcaf0..a5fc089d47ca 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -85,7 +85,8 @@ static int amd_create_gatt_pages(int nr_tables)
int retval = 0;
int i;
- tables = kzalloc((nr_tables + 1) * sizeof(struct amd_page_map *),GFP_KERNEL);
+ tables = kzalloc(array_size((nr_tables + 1), sizeof(struct amd_page_map *)),
+ GFP_KERNEL);
if (tables == NULL)
return -ENOMEM;
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index 88b4cbee4dac..38427afc096b 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -108,7 +108,8 @@ static int ati_create_gatt_pages(int nr_tables)
int retval = 0;
int i;
- tables = kzalloc((nr_tables + 1) * sizeof(struct ati_page_map *),GFP_KERNEL);
+ tables = kzalloc(array_size((nr_tables + 1), sizeof(struct ati_page_map *)),
+ GFP_KERNEL);
if (tables == NULL)
return -ENOMEM;
diff --git a/drivers/char/agp/compat_ioctl.c b/drivers/char/agp/compat_ioctl.c
index 2053f70ef66b..05223a10f41d 100644
--- a/drivers/char/agp/compat_ioctl.c
+++ b/drivers/char/agp/compat_ioctl.c
@@ -98,11 +98,13 @@ static int compat_agpioc_reserve_wrap(struct agp_file_private *priv, void __user
if (ureserve.seg_count >= 16384)
return -EINVAL;
- usegment = kmalloc(sizeof(*usegment) * ureserve.seg_count, GFP_KERNEL);
+ usegment = kmalloc(array_size(sizeof(*usegment), ureserve.seg_count),
+ GFP_KERNEL);
if (!usegment)
return -ENOMEM;
- ksegment = kmalloc(sizeof(*ksegment) * kreserve.seg_count, GFP_KERNEL);
+ ksegment = kmalloc(array_size(sizeof(*ksegment), kreserve.seg_count),
+ GFP_KERNEL);
if (!ksegment) {
kfree(usegment);
return -ENOMEM;
diff --git a/drivers/char/agp/sworks-agp.c b/drivers/char/agp/sworks-agp.c
index 4dbdd3bc9bb8..1eac07936a93 100644
--- a/drivers/char/agp/sworks-agp.c
+++ b/drivers/char/agp/sworks-agp.c
@@ -96,7 +96,7 @@ static int serverworks_create_gatt_pages(int nr_tables)
int retval = 0;
int i;
- tables = kzalloc((nr_tables + 1) * sizeof(struct serverworks_page_map *),
+ tables = kzalloc(array_size((nr_tables + 1), sizeof(struct serverworks_page_map *)),
GFP_KERNEL);
if (tables == NULL)
return -ENOMEM;
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index c381c8e396fc..f6511937a77d 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -402,7 +402,8 @@ static int uninorth_create_gatt_table(struct agp_bridge_data *bridge)
if (table == NULL)
return -ENOMEM;
- uninorth_priv.pages_arr = kmalloc((1 << page_order) * sizeof(struct page*), GFP_KERNEL);
+ uninorth_priv.pages_arr = kmalloc(array_size((1 << page_order), sizeof(struct page *)),
+ GFP_KERNEL);
if (uninorth_priv.pages_arr == NULL)
goto enomem;
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index 35a82f4bfd78..0d1932f5a5a5 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -1874,7 +1874,8 @@ static unsigned short *ssif_address_list(void)
list_for_each_entry(info, &ssif_infos, link)
count++;
- address_list = kzalloc(sizeof(*address_list) * (count + 1), GFP_KERNEL);
+ address_list = kzalloc(array_size(sizeof(*address_list), (count + 1)),
+ GFP_KERNEL);
if (!address_list)
return NULL;
diff --git a/drivers/clk/st/clkgen-pll.c b/drivers/clk/st/clkgen-pll.c
index 25bda48a5d35..78d366344882 100644
--- a/drivers/clk/st/clkgen-pll.c
+++ b/drivers/clk/st/clkgen-pll.c
@@ -738,7 +738,7 @@ static void __init clkgen_c32_pll_setup(struct device_node *np,
return;
clk_data->clk_num = num_odfs;
- clk_data->clks = kzalloc(clk_data->clk_num * sizeof(struct clk *),
+ clk_data->clks = kzalloc(array_size(clk_data->clk_num, sizeof(struct clk *)),
GFP_KERNEL);
if (!clk_data->clks)
diff --git a/drivers/clk/sunxi/clk-usb.c b/drivers/clk/sunxi/clk-usb.c
index fe0c3d169377..513d16c2e4c5 100644
--- a/drivers/clk/sunxi/clk-usb.c
+++ b/drivers/clk/sunxi/clk-usb.c
@@ -122,7 +122,8 @@ static void __init sunxi_usb_clk_setup(struct device_node *node,
if (!clk_data)
return;
- clk_data->clks = kzalloc((qty+1) * sizeof(struct clk *), GFP_KERNEL);
+ clk_data->clks = kzalloc(array_size((qty + 1), sizeof(struct clk *)),
+ GFP_KERNEL);
if (!clk_data->clks) {
kfree(clk_data);
return;
diff --git a/drivers/clk/tegra/clk.c b/drivers/clk/tegra/clk.c
index 2115110745c5..0502647ff921 100644
--- a/drivers/clk/tegra/clk.c
+++ b/drivers/clk/tegra/clk.c
@@ -216,8 +216,8 @@ struct clk ** __init tegra_clk_init(void __iomem *regs, int num, int banks)
if (WARN_ON(banks > ARRAY_SIZE(periph_regs)))
return NULL;
- periph_clk_enb_refcnt = kzalloc(32 * banks *
- sizeof(*periph_clk_enb_refcnt), GFP_KERNEL);
+ periph_clk_enb_refcnt = kzalloc(array3_size(32, banks, sizeof(*periph_clk_enb_refcnt)),
+ GFP_KERNEL);
if (!periph_clk_enb_refcnt)
return NULL;
diff --git a/drivers/clk/ti/apll.c b/drivers/clk/ti/apll.c
index 9498e9363b57..999e90a1e9aa 100644
--- a/drivers/clk/ti/apll.c
+++ b/drivers/clk/ti/apll.c
@@ -206,7 +206,8 @@ static void __init of_dra7_apll_setup(struct device_node *node)
goto cleanup;
}
- parent_names = kzalloc(sizeof(char *) * init->num_parents, GFP_KERNEL);
+ parent_names = kzalloc(array_size(sizeof(char *), init->num_parents),
+ GFP_KERNEL);
if (!parent_names)
goto cleanup;
diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index aaa277dd6d99..e06cc4074595 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -366,7 +366,7 @@ int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div,
num_dividers = i;
- tmp = kzalloc(sizeof(*tmp) * (valid_div + 1), GFP_KERNEL);
+ tmp = kzalloc(array_size(sizeof(*tmp), (valid_div + 1)), GFP_KERNEL);
if (!tmp)
return -ENOMEM;
@@ -496,7 +496,8 @@ __init ti_clk_get_div_table(struct device_node *node)
return ERR_PTR(-EINVAL);
}
- table = kzalloc(sizeof(*table) * (valid_div + 1), GFP_KERNEL);
+ table = kzalloc(array_size(sizeof(*table), (valid_div + 1)),
+ GFP_KERNEL);
if (!table)
return ERR_PTR(-ENOMEM);
diff --git a/drivers/clk/ti/dpll.c b/drivers/clk/ti/dpll.c
index 7d33ca9042cb..357b136525d4 100644
--- a/drivers/clk/ti/dpll.c
+++ b/drivers/clk/ti/dpll.c
@@ -309,7 +309,8 @@ static void __init of_ti_dpll_setup(struct device_node *node,
goto cleanup;
}
- parent_names = kzalloc(sizeof(char *) * init->num_parents, GFP_KERNEL);
+ parent_names = kzalloc(array_size(sizeof(char *), init->num_parents),
+ GFP_KERNEL);
if (!parent_names)
goto cleanup;
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 70b3cf8e23d0..6a015d2e3a72 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -1000,7 +1000,7 @@ static int sh_cmt_setup(struct sh_cmt_device *cmt, struct platform_device *pdev)
/* Allocate and setup the channels. */
cmt->num_channels = hweight8(cmt->hw_channels);
- cmt->channels = kzalloc(cmt->num_channels * sizeof(*cmt->channels),
+ cmt->channels = kzalloc(array_size(cmt->num_channels, sizeof(*cmt->channels)),
GFP_KERNEL);
if (cmt->channels == NULL) {
ret = -ENOMEM;
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index 53aa7e92a7d7..06229dd18d82 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -418,7 +418,7 @@ static int sh_mtu2_setup(struct sh_mtu2_device *mtu,
/* Allocate and setup the channels. */
mtu->num_channels = 3;
- mtu->channels = kzalloc(sizeof(*mtu->channels) * mtu->num_channels,
+ mtu->channels = kzalloc(array_size(sizeof(*mtu->channels), mtu->num_channels),
GFP_KERNEL);
if (mtu->channels == NULL) {
ret = -ENOMEM;
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 31d881621e41..cf3039867d3f 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -569,7 +569,7 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev)
}
/* Allocate and setup the channels. */
- tmu->channels = kzalloc(sizeof(*tmu->channels) * tmu->num_channels,
+ tmu->channels = kzalloc(array_size(sizeof(*tmu->channels), tmu->num_channels),
GFP_KERNEL);
if (tmu->channels == NULL) {
ret = -ENOMEM;
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index 9449657d72f0..f9cb7947f417 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -759,8 +759,8 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
goto err_unreg;
}
- freq_table = kzalloc(sizeof(*freq_table) *
- (perf->state_count+1), GFP_KERNEL);
+ freq_table = kzalloc(array_size(sizeof(*freq_table), (perf->state_count + 1)),
+ GFP_KERNEL);
if (!freq_table) {
result = -ENOMEM;
goto err_unreg;
diff --git a/drivers/cpufreq/bmips-cpufreq.c b/drivers/cpufreq/bmips-cpufreq.c
index 1653151b77df..c626c7e35c79 100644
--- a/drivers/cpufreq/bmips-cpufreq.c
+++ b/drivers/cpufreq/bmips-cpufreq.c
@@ -71,7 +71,8 @@ bmips_cpufreq_get_freq_table(const struct cpufreq_policy *policy)
cpu_freq = htp_freq_to_cpu_freq(priv->clk_mult);
- table = kmalloc((priv->max_freqs + 1) * sizeof(*table), GFP_KERNEL);
+ table = kmalloc(array_size((priv->max_freqs + 1), sizeof(*table)),
+ GFP_KERNEL);
if (!table)
return ERR_PTR(-ENOMEM);
diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
index b15115a48775..4596e17faf6b 100644
--- a/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -257,7 +257,8 @@ static int __init cppc_cpufreq_init(void)
if (acpi_disabled)
return -ENODEV;
- all_cpu_data = kzalloc(sizeof(void *) * num_possible_cpus(), GFP_KERNEL);
+ all_cpu_data = kzalloc(array_size(sizeof(void *), num_possible_cpus()),
+ GFP_KERNEL);
if (!all_cpu_data)
return -ENOMEM;
diff --git a/drivers/cpufreq/ia64-acpi-cpufreq.c b/drivers/cpufreq/ia64-acpi-cpufreq.c
index 7974a2fdb760..82c7b6cf1b1b 100644
--- a/drivers/cpufreq/ia64-acpi-cpufreq.c
+++ b/drivers/cpufreq/ia64-acpi-cpufreq.c
@@ -241,9 +241,8 @@ acpi_cpufreq_cpu_init (
}
/* alloc freq_table */
- freq_table = kzalloc(sizeof(*freq_table) *
- (data->acpi_data.state_count + 1),
- GFP_KERNEL);
+ freq_table = kzalloc(array_size(sizeof(*freq_table), (data->acpi_data.state_count + 1)),
+ GFP_KERNEL);
if (!freq_table) {
result = -ENOMEM;
goto err_unreg;
diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
index 61a4c5b08219..5baffe147876 100644
--- a/drivers/cpufreq/longhaul.c
+++ b/drivers/cpufreq/longhaul.c
@@ -474,8 +474,8 @@ static int longhaul_get_ranges(void)
return -EINVAL;
}
- longhaul_table = kzalloc((numscales + 1) * sizeof(*longhaul_table),
- GFP_KERNEL);
+ longhaul_table = kzalloc(array_size((numscales + 1), sizeof(*longhaul_table)),
+ GFP_KERNEL);
if (!longhaul_table)
return -ENOMEM;
diff --git a/drivers/cpufreq/pxa3xx-cpufreq.c b/drivers/cpufreq/pxa3xx-cpufreq.c
index 7acc7fa4536d..3c5ececd350a 100644
--- a/drivers/cpufreq/pxa3xx-cpufreq.c
+++ b/drivers/cpufreq/pxa3xx-cpufreq.c
@@ -93,7 +93,7 @@ static int setup_freqs_table(struct cpufreq_policy *policy,
struct cpufreq_frequency_table *table;
int i;
- table = kzalloc((num + 1) * sizeof(*table), GFP_KERNEL);
+ table = kzalloc(array_size((num + 1), sizeof(*table)), GFP_KERNEL);
if (table == NULL)
return -ENOMEM;
diff --git a/drivers/cpufreq/sfi-cpufreq.c b/drivers/cpufreq/sfi-cpufreq.c
index 9767afe05da2..08a51615a2c5 100644
--- a/drivers/cpufreq/sfi-cpufreq.c
+++ b/drivers/cpufreq/sfi-cpufreq.c
@@ -95,8 +95,8 @@ static int __init sfi_cpufreq_init(void)
if (ret)
return ret;
- freq_table = kzalloc(sizeof(*freq_table) *
- (num_freq_table_entries + 1), GFP_KERNEL);
+ freq_table = kzalloc(array_size(sizeof(*freq_table), (num_freq_table_entries + 1)),
+ GFP_KERNEL);
if (!freq_table) {
ret = -ENOMEM;
goto err_free_array;
diff --git a/drivers/cpufreq/spear-cpufreq.c b/drivers/cpufreq/spear-cpufreq.c
index 195f27f9c1cb..b6023a74fa51 100644
--- a/drivers/cpufreq/spear-cpufreq.c
+++ b/drivers/cpufreq/spear-cpufreq.c
@@ -195,7 +195,8 @@ static int spear_cpufreq_probe(struct platform_device *pdev)
cnt = prop->length / sizeof(u32);
val = prop->value;
- freq_tbl = kzalloc(sizeof(*freq_tbl) * (cnt + 1), GFP_KERNEL);
+ freq_tbl = kzalloc(array_size(sizeof(*freq_tbl), (cnt + 1)),
+ GFP_KERNEL);
if (!freq_tbl) {
ret = -ENOMEM;
goto out_put_node;
diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index db1ce09759a5..b45f4755d1c3 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -140,11 +140,11 @@ static void crypto4xx_hw_init(struct crypto4xx_device *dev)
int crypto4xx_alloc_sa(struct crypto4xx_ctx *ctx, u32 size)
{
- ctx->sa_in = kzalloc(size * 4, GFP_ATOMIC);
+ ctx->sa_in = kzalloc(array_size(size, 4), GFP_ATOMIC);
if (ctx->sa_in == NULL)
return -ENOMEM;
- ctx->sa_out = kzalloc(size * 4, GFP_ATOMIC);
+ ctx->sa_out = kzalloc(array_size(size, 4), GFP_ATOMIC);
if (ctx->sa_out == NULL) {
kfree(ctx->sa_in);
ctx->sa_in = NULL;
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index e4cc636e1104..b6531f55d3f4 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -201,7 +201,7 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask,
int ret = 0, sh_idx;
ctrl = (struct caam_ctrl __iomem *)ctrlpriv->ctrl;
- desc = kmalloc(CAAM_CMD_SZ * 7, GFP_KERNEL);
+ desc = kmalloc(array_size(CAAM_CMD_SZ, 7), GFP_KERNEL);
if (!desc)
return -ENOMEM;
@@ -266,7 +266,7 @@ static int deinstantiate_rng(struct device *ctrldev, int state_handle_mask)
u32 *desc, status;
int sh_idx, ret = 0;
- desc = kmalloc(CAAM_CMD_SZ * 3, GFP_KERNEL);
+ desc = kmalloc(array_size(CAAM_CMD_SZ, 3), GFP_KERNEL);
if (!desc)
return -ENOMEM;
diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
index 317b9e480312..0e6eaef50b71 100644
--- a/drivers/crypto/inside-secure/safexcel_hash.c
+++ b/drivers/crypto/inside-secure/safexcel_hash.c
@@ -935,7 +935,7 @@ static int safexcel_hmac_setkey(const char *alg, const u8 *key,
crypto_ahash_clear_flags(tfm, ~0);
blocksize = crypto_tfm_alg_blocksize(crypto_ahash_tfm(tfm));
- ipad = kzalloc(2 * blocksize, GFP_KERNEL);
+ ipad = kzalloc(array_size(2, blocksize), GFP_KERNEL);
if (!ipad) {
ret = -ENOMEM;
goto free_request;
diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
index e61b08566093..1878e574d142 100644
--- a/drivers/crypto/marvell/hash.c
+++ b/drivers/crypto/marvell/hash.c
@@ -1198,7 +1198,7 @@ static int mv_cesa_ahmac_setkey(const char *hash_alg_name,
blocksize = crypto_tfm_alg_blocksize(crypto_ahash_tfm(tfm));
- ipad = kzalloc(2 * blocksize, GFP_KERNEL);
+ ipad = kzalloc(array_size(2, blocksize), GFP_KERNEL);
if (!ipad) {
ret = -ENOMEM;
goto free_req;
diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c
index 98d22c2096e3..775052106420 100644
--- a/drivers/crypto/qat/qat_common/qat_uclo.c
+++ b/drivers/crypto/qat/qat_common/qat_uclo.c
@@ -1162,8 +1162,8 @@ static int qat_uclo_map_suof(struct icp_qat_fw_loader_handle *handle,
suof_handle->img_table.num_simgs = suof_ptr->num_chunks - 1;
if (suof_handle->img_table.num_simgs != 0) {
- suof_img_hdr = kzalloc(suof_handle->img_table.num_simgs *
- sizeof(img_header), GFP_KERNEL);
+ suof_img_hdr = kzalloc(array_size(suof_handle->img_table.num_simgs, sizeof(img_header)),
+ GFP_KERNEL);
if (!suof_img_hdr)
return -ENOMEM;
suof_handle->img_table.simg_hdr = suof_img_hdr;
diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c
index 981e45692695..e3d8c40b126d 100644
--- a/drivers/crypto/stm32/stm32-hash.c
+++ b/drivers/crypto/stm32/stm32-hash.c
@@ -970,7 +970,7 @@ static int stm32_hash_export(struct ahash_request *req, void *out)
while (!(stm32_hash_read(hdev, HASH_SR) & HASH_SR_DATA_INPUT_READY))
cpu_relax();
- rctx->hw_context = kmalloc(sizeof(u32) * (3 + HASH_CSR_REGISTER_NUMBER),
+ rctx->hw_context = kmalloc(array_size(sizeof(u32), (3 + HASH_CSR_REGISTER_NUMBER)),
GFP_KERNEL);
preg = rctx->hw_context;
diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c
index da74fd74636b..8d25ce0fa65c 100644
--- a/drivers/dma/coh901318.c
+++ b/drivers/dma/coh901318.c
@@ -1345,7 +1345,7 @@ static ssize_t coh901318_debugfs_read(struct file *file, char __user *buf,
int ret;
int i;
- dev_buf = kmalloc(4*1024, GFP_KERNEL);
+ dev_buf = kmalloc(array_size(4, 1024), GFP_KERNEL);
if (dev_buf == NULL)
return -ENOMEM;
tmp = dev_buf;
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 96238a30e804..93b547f7829e 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -1763,8 +1763,8 @@ static int dmac_alloc_threads(struct pl330_dmac *pl330)
int i;
/* Allocate 1 Manager and 'chans' Channel threads */
- pl330->channels = kzalloc((1 + chans) * sizeof(*thrd),
- GFP_KERNEL);
+ pl330->channels = kzalloc(array_size((1 + chans), sizeof(*thrd)),
+ GFP_KERNEL);
if (!pl330->channels)
return -ENOMEM;
diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
index 12fa48e380cf..2ced781731e1 100644
--- a/drivers/dma/sh/shdma-base.c
+++ b/drivers/dma/sh/shdma-base.c
@@ -1045,8 +1045,8 @@ EXPORT_SYMBOL(shdma_cleanup);
static int __init shdma_enter(void)
{
- shdma_slave_used = kzalloc(DIV_ROUND_UP(slave_num, BITS_PER_LONG) *
- sizeof(long), GFP_KERNEL);
+ shdma_slave_used = kzalloc(array_size(DIV_ROUND_UP(slave_num, BITS_PER_LONG), sizeof(long)),
+ GFP_KERNEL);
if (!shdma_slave_used)
return -ENOMEM;
return 0;
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 329cb96f886f..5f87a26356fb 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -3451,7 +3451,8 @@ static int __init amd64_edac_init(void)
opstate_init();
err = -ENOMEM;
- ecc_stngs = kzalloc(amd_nb_num() * sizeof(ecc_stngs[0]), GFP_KERNEL);
+ ecc_stngs = kzalloc(array_size(amd_nb_num(), sizeof(ecc_stngs[0])),
+ GFP_KERNEL);
if (!ecc_stngs)
goto err_free;
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index 8c5540160a23..cbf0c0a650b7 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -461,7 +461,7 @@ static struct i7core_dev *alloc_i7core_dev(u8 socket,
if (!i7core_dev)
return NULL;
- i7core_dev->pdev = kzalloc(sizeof(*i7core_dev->pdev) * table->n_devs,
+ i7core_dev->pdev = kzalloc(array_size(sizeof(*i7core_dev->pdev), table->n_devs),
GFP_KERNEL);
if (!i7core_dev->pdev) {
kfree(i7core_dev);
diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
index 498b2d29d52f..929c20b81175 100644
--- a/drivers/extcon/extcon.c
+++ b/drivers/extcon/extcon.c
@@ -1126,8 +1126,8 @@ int extcon_dev_register(struct extcon_dev *edev)
char *str;
struct extcon_cable *cable;
- edev->cables = kzalloc(sizeof(struct extcon_cable) *
- edev->max_supported, GFP_KERNEL);
+ edev->cables = kzalloc(array_size(sizeof(struct extcon_cable), edev->max_supported),
+ GFP_KERNEL);
if (!edev->cables) {
ret = -ENOMEM;
goto err_sysfs_alloc;
@@ -1136,7 +1136,7 @@ int extcon_dev_register(struct extcon_dev *edev)
cable = &edev->cables[index];
snprintf(buf, 10, "cable.%d", index);
- str = kzalloc(sizeof(char) * (strlen(buf) + 1),
+ str = kzalloc(array_size(sizeof(char), (strlen(buf) + 1)),
GFP_KERNEL);
if (!str) {
for (index--; index >= 0; index--) {
@@ -1177,8 +1177,8 @@ int extcon_dev_register(struct extcon_dev *edev)
for (index = 0; edev->mutually_exclusive[index]; index++)
;
- edev->attrs_muex = kzalloc(sizeof(struct attribute *) *
- (index + 1), GFP_KERNEL);
+ edev->attrs_muex = kzalloc(array_size(sizeof(struct attribute *), (index + 1)),
+ GFP_KERNEL);
if (!edev->attrs_muex) {
ret = -ENOMEM;
goto err_muex;
@@ -1194,7 +1194,7 @@ int extcon_dev_register(struct extcon_dev *edev)
for (index = 0; edev->mutually_exclusive[index]; index++) {
sprintf(buf, "0x%x", edev->mutually_exclusive[index]);
- name = kzalloc(sizeof(char) * (strlen(buf) + 1),
+ name = kzalloc(array_size(sizeof(char), (strlen(buf) + 1)),
GFP_KERNEL);
if (!name) {
for (index--; index >= 0; index--) {
@@ -1220,8 +1220,8 @@ int extcon_dev_register(struct extcon_dev *edev)
if (edev->max_supported) {
edev->extcon_dev_type.groups =
- kzalloc(sizeof(struct attribute_group *) *
- (edev->max_supported + 2), GFP_KERNEL);
+ kzalloc(array_size(sizeof(struct attribute_group *), (edev->max_supported + 2)),
+ GFP_KERNEL);
if (!edev->extcon_dev_type.groups) {
ret = -ENOMEM;
goto err_alloc_groups;
diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c
index f377609ff141..a95007d24d00 100644
--- a/drivers/firmware/efi/runtime-map.c
+++ b/drivers/firmware/efi/runtime-map.c
@@ -166,7 +166,8 @@ int __init efi_runtime_map_init(struct kobject *efi_kobj)
if (!efi_enabled(EFI_MEMMAP))
return 0;
- map_entries = kzalloc(efi.memmap.nr_map * sizeof(entry), GFP_KERNEL);
+ map_entries = kzalloc(array_size(efi.memmap.nr_map, sizeof(entry)),
+ GFP_KERNEL);
if (!map_entries) {
ret = -ENOMEM;
goto out;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
index ea54e53172b9..e690cb43cffe 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
@@ -417,7 +417,8 @@ static int kgd_hqd_dump(struct kgd_dev *kgd,
(*dump)[i++][1] = RREG32(addr); \
} while (0)
- *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL);
+ *dump = kmalloc(array3_size(HQD_N_REGS, 2, sizeof(uint32_t)),
+ GFP_KERNEL);
if (*dump == NULL)
return -ENOMEM;
@@ -514,7 +515,8 @@ static int kgd_hqd_sdma_dump(struct kgd_dev *kgd,
#undef HQD_N_REGS
#define HQD_N_REGS (19+4)
- *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL);
+ *dump = kmalloc(array3_size(HQD_N_REGS, 2, sizeof(uint32_t)),
+ GFP_KERNEL);
if (*dump == NULL)
return -ENOMEM;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c
index 89264c9a5e9f..a9e878f55df2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c
@@ -405,7 +405,8 @@ static int kgd_hqd_dump(struct kgd_dev *kgd,
(*dump)[i++][1] = RREG32(addr); \
} while (0)
- *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL);
+ *dump = kmalloc(array3_size(HQD_N_REGS, 2, sizeof(uint32_t)),
+ GFP_KERNEL);
if (*dump == NULL)
return -ENOMEM;
@@ -501,7 +502,8 @@ static int kgd_hqd_sdma_dump(struct kgd_dev *kgd,
#undef HQD_N_REGS
#define HQD_N_REGS (19+4+2+3+7)
- *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL);
+ *dump = kmalloc(array3_size(HQD_N_REGS, 2, sizeof(uint32_t)),
+ GFP_KERNEL);
if (*dump == NULL)
return -ENOMEM;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
index e997ebbe43ea..1271aea3899c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
@@ -432,8 +432,7 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
ATOM_PPLIB_PhaseSheddingLimits_Record *entry;
adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries =
- kzalloc(psl->ucNumEntries *
- sizeof(struct amdgpu_phase_shedding_limits_entry),
+ kzalloc(array_size(psl->ucNumEntries, sizeof(struct amdgpu_phase_shedding_limits_entry)),
GFP_KERNEL);
if (!adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries) {
amdgpu_free_extended_power_table(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
index 69500a8b4e2d..5e30b23cc5c7 100644
--- a/drivers/gpu/drm/amd/amdgpu/atom.c
+++ b/drivers/gpu/drm/amd/amdgpu/atom.c
@@ -1221,7 +1221,7 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index,
ectx.abort = false;
ectx.last_jump = 0;
if (ws)
- ectx.ws = kzalloc(4 * ws, GFP_KERNEL);
+ ectx.ws = kzalloc(array_size(4, ws), GFP_KERNEL);
else
ectx.ws = NULL;
@@ -1282,7 +1282,7 @@ static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 };
static void atom_index_iio(struct atom_context *ctx, int base)
{
- ctx->iio = kzalloc(2 * 256, GFP_KERNEL);
+ ctx->iio = kzalloc(array_size(2, 256), GFP_KERNEL);
if (!ctx->iio)
return;
while (CU8(base) == ATOM_IIO_START) {
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index 0c1e6ae61ff2..e839b1e1d4e6 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -5679,8 +5679,8 @@ static int ci_parse_power_table(struct amdgpu_device *adev)
(mode_info->atom_context->bios + data_offset +
le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
- adev->pm.dpm.ps = kzalloc(sizeof(struct amdgpu_ps) *
- state_array->ucNumEntries, GFP_KERNEL);
+ adev->pm.dpm.ps = kzalloc(array_size(sizeof(struct amdgpu_ps), state_array->ucNumEntries),
+ GFP_KERNEL);
if (!adev->pm.dpm.ps)
return -ENOMEM;
power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index 26ba984ab2b7..75a33e3421d7 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -2727,8 +2727,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev)
(mode_info->atom_context->bios + data_offset +
le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
- adev->pm.dpm.ps = kzalloc(sizeof(struct amdgpu_ps) *
- state_array->ucNumEntries, GFP_KERNEL);
+ adev->pm.dpm.ps = kzalloc(array_size(sizeof(struct amdgpu_ps), state_array->ucNumEntries),
+ GFP_KERNEL);
if (!adev->pm.dpm.ps)
return -ENOMEM;
power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index 6e12d8f28859..f568915b5165 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -7242,8 +7242,8 @@ static int si_parse_power_table(struct amdgpu_device *adev)
(mode_info->atom_context->bios + data_offset +
le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
- adev->pm.dpm.ps = kzalloc(sizeof(struct amdgpu_ps) *
- state_array->ucNumEntries, GFP_KERNEL);
+ adev->pm.dpm.ps = kzalloc(array_size(sizeof(struct amdgpu_ps), state_array->ucNumEntries),
+ GFP_KERNEL);
if (!adev->pm.dpm.ps)
return -ENOMEM;
power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 59808a39ecf4..36a20c34b653 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1296,7 +1296,7 @@ static int kfd_ioctl_map_memory_to_gpu(struct file *filep,
return -EINVAL;
}
- devices_arr = kmalloc(args->n_devices * sizeof(*devices_arr),
+ devices_arr = kmalloc(array_size(args->n_devices, sizeof(*devices_arr)),
GFP_KERNEL);
if (!devices_arr)
return -ENOMEM;
@@ -1405,7 +1405,7 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep,
return -EINVAL;
}
- devices_arr = kmalloc(args->n_devices * sizeof(*devices_arr),
+ devices_arr = kmalloc(array_size(args->n_devices, sizeof(*devices_arr)),
GFP_KERNEL);
if (!devices_arr)
return -ENOMEM;
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
index 0aa2cda60890..cf71674f9e7d 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
@@ -1076,13 +1076,13 @@ static void get_ss_info_from_atombios(
if (*ss_entries_num == 0)
return;
- ss_info = kzalloc(sizeof(struct spread_spectrum_info) * (*ss_entries_num),
+ ss_info = kzalloc(array_size(sizeof(struct spread_spectrum_info), (*ss_entries_num)),
GFP_KERNEL);
ss_info_cur = ss_info;
if (ss_info == NULL)
return;
- ss_data = kzalloc(sizeof(struct spread_spectrum_data) * (*ss_entries_num),
+ ss_data = kzalloc(array_size(sizeof(struct spread_spectrum_data), (*ss_entries_num)),
GFP_KERNEL);
if (ss_data == NULL)
goto out_free_info;
diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
index e7e374f56864..123665a02759 100644
--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
@@ -1093,19 +1093,20 @@ bool mod_color_calculate_regamma_params(struct dc_transfer_func *output_tf,
output_tf->type = TF_TYPE_DISTRIBUTED_POINTS;
- rgb_user = kzalloc(sizeof(*rgb_user) * (ramp->num_entries + _EXTRA_POINTS),
+ rgb_user = kzalloc(array_size(sizeof(*rgb_user), (ramp->num_entries + _EXTRA_POINTS)),
GFP_KERNEL);
if (!rgb_user)
goto rgb_user_alloc_fail;
- rgb_regamma = kzalloc(sizeof(*rgb_regamma) * (MAX_HW_POINTS + _EXTRA_POINTS),
- GFP_KERNEL);
+ rgb_regamma = kzalloc(array_size(sizeof(*rgb_regamma), (MAX_HW_POINTS + _EXTRA_POINTS)),
+ GFP_KERNEL);
if (!rgb_regamma)
goto rgb_regamma_alloc_fail;
- axix_x = kzalloc(sizeof(*axix_x) * (ramp->num_entries + 3),
+ axix_x = kzalloc(array_size(sizeof(*axix_x), (ramp->num_entries + 3)),
GFP_KERNEL);
if (!axix_x)
goto axix_x_alloc_fail;
- coeff = kzalloc(sizeof(*coeff) * (MAX_HW_POINTS + _EXTRA_POINTS), GFP_KERNEL);
+ coeff = kzalloc(array_size(sizeof(*coeff), (MAX_HW_POINTS + _EXTRA_POINTS)),
+ GFP_KERNEL);
if (!coeff)
goto coeff_alloc_fail;
@@ -1192,19 +1193,20 @@ bool mod_color_calculate_degamma_params(struct dc_transfer_func *input_tf,
input_tf->type = TF_TYPE_DISTRIBUTED_POINTS;
- rgb_user = kzalloc(sizeof(*rgb_user) * (ramp->num_entries + _EXTRA_POINTS),
+ rgb_user = kzalloc(array_size(sizeof(*rgb_user), (ramp->num_entries + _EXTRA_POINTS)),
GFP_KERNEL);
if (!rgb_user)
goto rgb_user_alloc_fail;
- curve = kzalloc(sizeof(*curve) * (MAX_HW_POINTS + _EXTRA_POINTS),
+ curve = kzalloc(array_size(sizeof(*curve), (MAX_HW_POINTS + _EXTRA_POINTS)),
GFP_KERNEL);
if (!curve)
goto curve_alloc_fail;
- axix_x = kzalloc(sizeof(*axix_x) * (ramp->num_entries + _EXTRA_POINTS),
+ axix_x = kzalloc(array_size(sizeof(*axix_x), (ramp->num_entries + _EXTRA_POINTS)),
GFP_KERNEL);
if (!axix_x)
goto axix_x_alloc_fail;
- coeff = kzalloc(sizeof(*coeff) * (MAX_HW_POINTS + _EXTRA_POINTS), GFP_KERNEL);
+ coeff = kzalloc(array_size(sizeof(*coeff), (MAX_HW_POINTS + _EXTRA_POINTS)),
+ GFP_KERNEL);
if (!coeff)
goto coeff_alloc_fail;
@@ -1281,8 +1283,8 @@ bool mod_color_calculate_curve(enum dc_transfer_func_predefined trans,
}
ret = true;
} else if (trans == TRANSFER_FUNCTION_PQ) {
- rgb_regamma = kzalloc(sizeof(*rgb_regamma) * (MAX_HW_POINTS +
- _EXTRA_POINTS), GFP_KERNEL);
+ rgb_regamma = kzalloc(array_size(sizeof(*rgb_regamma), (MAX_HW_POINTS + _EXTRA_POINTS)),
+ GFP_KERNEL);
if (!rgb_regamma)
goto rgb_regamma_alloc_fail;
points->end_exponent = 7;
@@ -1305,8 +1307,8 @@ bool mod_color_calculate_curve(enum dc_transfer_func_predefined trans,
kfree(rgb_regamma);
} else if (trans == TRANSFER_FUNCTION_SRGB ||
trans == TRANSFER_FUNCTION_BT709) {
- rgb_regamma = kzalloc(sizeof(*rgb_regamma) * (MAX_HW_POINTS +
- _EXTRA_POINTS), GFP_KERNEL);
+ rgb_regamma = kzalloc(array_size(sizeof(*rgb_regamma), (MAX_HW_POINTS + _EXTRA_POINTS)),
+ GFP_KERNEL);
if (!rgb_regamma)
goto rgb_regamma_alloc_fail;
points->end_exponent = 0;
@@ -1348,8 +1350,8 @@ bool mod_color_calculate_degamma_curve(enum dc_transfer_func_predefined trans,
}
ret = true;
} else if (trans == TRANSFER_FUNCTION_PQ) {
- rgb_degamma = kzalloc(sizeof(*rgb_degamma) * (MAX_HW_POINTS +
- _EXTRA_POINTS), GFP_KERNEL);
+ rgb_degamma = kzalloc(array_size(sizeof(*rgb_degamma), (MAX_HW_POINTS + _EXTRA_POINTS)),
+ GFP_KERNEL);
if (!rgb_degamma)
goto rgb_degamma_alloc_fail;
@@ -1367,8 +1369,8 @@ bool mod_color_calculate_degamma_curve(enum dc_transfer_func_predefined trans,
kfree(rgb_degamma);
} else if (trans == TRANSFER_FUNCTION_SRGB ||
trans == TRANSFER_FUNCTION_BT709) {
- rgb_degamma = kzalloc(sizeof(*rgb_degamma) * (MAX_HW_POINTS +
- _EXTRA_POINTS), GFP_KERNEL);
+ rgb_degamma = kzalloc(array_size(sizeof(*rgb_degamma), (MAX_HW_POINTS + _EXTRA_POINTS)),
+ GFP_KERNEL);
if (!rgb_degamma)
goto rgb_degamma_alloc_fail;
diff --git a/drivers/gpu/drm/amd/display/modules/stats/stats.c b/drivers/gpu/drm/amd/display/modules/stats/stats.c
index 041f87b73d5f..39e04e2fca9e 100644
--- a/drivers/gpu/drm/amd/display/modules/stats/stats.c
+++ b/drivers/gpu/drm/amd/display/modules/stats/stats.c
@@ -125,8 +125,8 @@ struct mod_stats *mod_stats_create(struct dc *dc)
core_stats->entries = reg_data;
}
- core_stats->time = kzalloc(sizeof(struct stats_time_cache) * core_stats->entries,
- GFP_KERNEL);
+ core_stats->time = kzalloc(array_size(sizeof(struct stats_time_cache), core_stats->entries),
+ GFP_KERNEL);
if (core_stats->time == NULL)
goto fail_construct;
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index dac355812adc..c4b79513242c 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -235,7 +235,8 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post)
ast->tx_chip_type = AST_TX_SIL164;
break;
case 0x08:
- ast->dp501_fw_addr = kzalloc(32*1024, GFP_KERNEL);
+ ast->dp501_fw_addr = kzalloc(array_size(32, 1024),
+ GFP_KERNEL);
if (ast->dp501_fw_addr) {
/* backup firmware */
if (ast_backup_fw(dev, ast->dp501_fw_addr, 32*1024)) {
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 39f1db4acda4..7a5f5ba45ffb 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1633,7 +1633,8 @@ struct edid *drm_do_get_edid(struct drm_connector *connector,
edid[EDID_LENGTH-1] += edid[0x7e] - valid_extensions;
edid[0x7e] = valid_extensions;
- new = kmalloc((valid_extensions + 1) * EDID_LENGTH, GFP_KERNEL);
+ new = kmalloc(array_size((valid_extensions + 1), EDID_LENGTH),
+ GFP_KERNEL);
if (!new)
goto out;
diff --git a/drivers/gpu/drm/gma500/mid_bios.c b/drivers/gpu/drm/gma500/mid_bios.c
index 7171b7475f58..b5c1bec74f02 100644
--- a/drivers/gpu/drm/gma500/mid_bios.c
+++ b/drivers/gpu/drm/gma500/mid_bios.c
@@ -239,7 +239,7 @@ static int mid_get_vbt_data_r10(struct drm_psb_private *dev_priv, u32 addr)
if (read_vbt_r10(addr, &vbt))
return -1;
- gct = kmalloc(sizeof(*gct) * vbt.panel_count, GFP_KERNEL);
+ gct = kmalloc(array_size(sizeof(*gct), vbt.panel_count), GFP_KERNEL);
if (!gct)
return -ENOMEM;
diff --git a/drivers/gpu/drm/i915/selftests/intel_uncore.c b/drivers/gpu/drm/i915/selftests/intel_uncore.c
index f76f2597df5c..5a0fafdb15e0 100644
--- a/drivers/gpu/drm/i915/selftests/intel_uncore.c
+++ b/drivers/gpu/drm/i915/selftests/intel_uncore.c
@@ -137,7 +137,7 @@ static int intel_uncore_check_forcewake_domains(struct drm_i915_private *dev_pri
if (!IS_ENABLED(CONFIG_DRM_I915_SELFTEST_BROKEN))
return 0;
- valid = kzalloc(BITS_TO_LONGS(FW_RANGE) * sizeof(*valid),
+ valid = kzalloc(array_size(BITS_TO_LONGS(FW_RANGE), sizeof(*valid)),
GFP_KERNEL);
if (!valid)
return -ENOMEM;
diff --git a/drivers/gpu/drm/nouveau/nvif/mmu.c b/drivers/gpu/drm/nouveau/nvif/mmu.c
index 15d0dcbf7ab4..232dbced31f0 100644
--- a/drivers/gpu/drm/nouveau/nvif/mmu.c
+++ b/drivers/gpu/drm/nouveau/nvif/mmu.c
@@ -54,12 +54,15 @@ nvif_mmu_init(struct nvif_object *parent, s32 oclass, struct nvif_mmu *mmu)
mmu->type_nr = args.type_nr;
mmu->kind_nr = args.kind_nr;
- mmu->heap = kmalloc(sizeof(*mmu->heap) * mmu->heap_nr, GFP_KERNEL);
- mmu->type = kmalloc(sizeof(*mmu->type) * mmu->type_nr, GFP_KERNEL);
+ mmu->heap = kmalloc(array_size(sizeof(*mmu->heap), mmu->heap_nr),
+ GFP_KERNEL);
+ mmu->type = kmalloc(array_size(sizeof(*mmu->type), mmu->type_nr),
+ GFP_KERNEL);
if (ret = -ENOMEM, !mmu->heap || !mmu->type)
goto done;
- mmu->kind = kmalloc(sizeof(*mmu->kind) * mmu->kind_nr, GFP_KERNEL);
+ mmu->kind = kmalloc(array_size(sizeof(*mmu->kind), mmu->kind_nr),
+ GFP_KERNEL);
if (!mmu->kind && mmu->kind_nr)
goto done;
diff --git a/drivers/gpu/drm/nouveau/nvif/object.c b/drivers/gpu/drm/nouveau/nvif/object.c
index 40adfe9b334b..c744342cc21f 100644
--- a/drivers/gpu/drm/nouveau/nvif/object.c
+++ b/drivers/gpu/drm/nouveau/nvif/object.c
@@ -83,7 +83,8 @@ nvif_object_sclass_get(struct nvif_object *object, struct nvif_sclass **psclass)
return ret;
}
- *psclass = kzalloc(sizeof(**psclass) * args->sclass.count, GFP_KERNEL);
+ *psclass = kzalloc(array_size(sizeof(**psclass), args->sclass.count),
+ GFP_KERNEL);
if (*psclass) {
for (i = 0; i < args->sclass.count; i++) {
(*psclass)[i].oclass = args->sclass.oclass[i].oclass;
diff --git a/drivers/gpu/drm/nouveau/nvif/vmm.c b/drivers/gpu/drm/nouveau/nvif/vmm.c
index 31cdb2d2e1ff..aa5f205c856d 100644
--- a/drivers/gpu/drm/nouveau/nvif/vmm.c
+++ b/drivers/gpu/drm/nouveau/nvif/vmm.c
@@ -138,7 +138,8 @@ nvif_vmm_init(struct nvif_mmu *mmu, s32 oclass, u64 addr, u64 size,
vmm->limit = args->size;
vmm->page_nr = args->page_nr;
- vmm->page = kmalloc(sizeof(*vmm->page) * vmm->page_nr, GFP_KERNEL);
+ vmm->page = kmalloc(array_size(sizeof(*vmm->page), vmm->page_nr),
+ GFP_KERNEL);
if (!vmm->page) {
ret = -ENOMEM;
goto done;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
index 84bd703dd897..11f2eb3a55a0 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
@@ -782,7 +782,7 @@ gk104_fifo_oneinit(struct nvkm_fifo *base)
nvkm_debug(subdev, "%d PBDMA(s)\n", fifo->pbdma_nr);
/* Read PBDMA->runlist(s) mapping from HW. */
- if (!(map = kzalloc(sizeof(*map) * fifo->pbdma_nr, GFP_KERNEL)))
+ if (!(map = kzalloc(array_size(sizeof(*map), fifo->pbdma_nr), GFP_KERNEL)))
return -ENOMEM;
for (i = 0; i < fifo->pbdma_nr; i++)
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv40.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv40.c
index 80a6b017af64..20aabddeebcc 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv40.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv40.c
@@ -670,7 +670,7 @@ nv40_grctx_fill(struct nvkm_device *device, struct nvkm_gpuobj *mem)
int
nv40_grctx_init(struct nvkm_device *device, u32 *size)
{
- u32 *ctxprog = kmalloc(256 * 4, GFP_KERNEL), i;
+ u32 *ctxprog = kmalloc(array_size(256, 4), GFP_KERNEL), i;
struct nvkm_grctx ctx = {
.device = device,
.mode = NVKM_GRCTX_PROG,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv50.c
index c8bb9191f9a2..bbbe3bfcdade 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxnv50.c
@@ -265,7 +265,7 @@ nv50_grctx_fill(struct nvkm_device *device, struct nvkm_gpuobj *mem)
int
nv50_grctx_init(struct nvkm_device *device, u32 *size)
{
- u32 *ctxprog = kmalloc(512 * 4, GFP_KERNEL), i;
+ u32 *ctxprog = kmalloc(array_size(512, 4), GFP_KERNEL), i;
struct nvkm_grctx ctx = {
.device = device,
.mode = NVKM_GRCTX_PROG,
diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
index c6ad066c9ccf..70b6498808b1 100644
--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
@@ -937,7 +937,7 @@ int tiler_map_show(struct seq_file *s, void *arg)
w_adj = omap_dmm->container_width / xdiv;
map = kmalloc(array_size(h_adj, sizeof(*map)), GFP_KERNEL);
- global_map = kmalloc((w_adj + 1) * h_adj, GFP_KERNEL);
+ global_map = kmalloc(array_size((w_adj + 1), h_adj), GFP_KERNEL);
if (!map || !global_map)
goto error;
diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c
index c5716a0ca3b8..d6551eeda91c 100644
--- a/drivers/gpu/drm/qxl/qxl_kms.c
+++ b/drivers/gpu/drm/qxl/qxl_kms.c
@@ -200,7 +200,7 @@ int qxl_device_init(struct qxl_device *qdev,
(~(uint64_t)0) >> (qdev->slot_id_bits + qdev->slot_gen_bits);
qdev->mem_slots =
- kmalloc(qdev->n_mem_slots * sizeof(struct qxl_memslot),
+ kmalloc(array_size(qdev->n_mem_slots, sizeof(struct qxl_memslot)),
GFP_KERNEL);
idr_init(&qdev->release_idr);
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 6a2e091aa7b6..a88a40d595fd 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -1176,7 +1176,7 @@ static int atom_execute_table_locked(struct atom_context *ctx, int index, uint32
ectx.abort = false;
ectx.last_jump = 0;
if (ws)
- ectx.ws = kzalloc(4 * ws, GFP_KERNEL);
+ ectx.ws = kzalloc(array_size(4, ws), GFP_KERNEL);
else
ectx.ws = NULL;
@@ -1246,7 +1246,7 @@ static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 };
static void atom_index_iio(struct atom_context *ctx, int base)
{
- ctx->iio = kzalloc(2 * 256, GFP_KERNEL);
+ ctx->iio = kzalloc(array_size(2, 256), GFP_KERNEL);
if (!ctx->iio)
return;
while (CU8(base) == ATOM_IIO_START) {
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index bdefba5d7287..d315cebb9a6c 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -5568,8 +5568,8 @@ static int ci_parse_power_table(struct radeon_device *rdev)
(mode_info->atom_context->bios + data_offset +
le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
- rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
- state_array->ucNumEntries, GFP_KERNEL);
+ rdev->pm.dpm.ps = kzalloc(array_size(sizeof(struct radeon_ps), state_array->ucNumEntries),
+ GFP_KERNEL);
if (!rdev->pm.dpm.ps)
return -ENOMEM;
power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index ae1529b0ef6f..41fd562df59a 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2660,8 +2660,8 @@ static int kv_parse_power_table(struct radeon_device *rdev)
(mode_info->atom_context->bios + data_offset +
le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
- rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
- state_array->ucNumEntries, GFP_KERNEL);
+ rdev->pm.dpm.ps = kzalloc(array_size(sizeof(struct radeon_ps), state_array->ucNumEntries),
+ GFP_KERNEL);
if (!rdev->pm.dpm.ps)
return -ENOMEM;
power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 021ca86432b0..550d6326c0a3 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -3998,8 +3998,8 @@ static int ni_parse_power_table(struct radeon_device *rdev)
return -EINVAL;
power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
- rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
- power_info->pplib.ucNumStates, GFP_KERNEL);
+ rdev->pm.dpm.ps = kzalloc(array_size(sizeof(struct radeon_ps), power_info->pplib.ucNumStates),
+ GFP_KERNEL);
if (!rdev->pm.dpm.ps)
return -ENOMEM;
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index 31d1b4710844..6abfe2411b0d 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -991,8 +991,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
ATOM_PPLIB_PhaseSheddingLimits_Record *entry;
rdev->pm.dpm.dyn_state.phase_shedding_limits_table.entries =
- kzalloc(psl->ucNumEntries *
- sizeof(struct radeon_phase_shedding_limits_entry),
+ kzalloc(array_size(psl->ucNumEntries, sizeof(struct radeon_phase_shedding_limits_entry)),
GFP_KERNEL);
if (!rdev->pm.dpm.dyn_state.phase_shedding_limits_table.entries) {
r600_free_extended_power_table(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 49693891ac9f..d52580198750 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2589,8 +2589,8 @@ static int radeon_atombios_parse_power_table_4_5(struct radeon_device *rdev)
radeon_atombios_add_pplib_thermal_controller(rdev, &power_info->pplib.sThermalController);
if (power_info->pplib.ucNumStates == 0)
return state_index;
- rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) *
- power_info->pplib.ucNumStates, GFP_KERNEL);
+ rdev->pm.power_state = kzalloc(array_size(sizeof(struct radeon_power_state), power_info->pplib.ucNumStates),
+ GFP_KERNEL);
if (!rdev->pm.power_state)
return state_index;
/* first mode is usually default, followed by low to high */
@@ -2605,9 +2605,7 @@ static int radeon_atombios_parse_power_table_4_5(struct radeon_device *rdev)
le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset) +
(power_state->v1.ucNonClockStateIndex *
power_info->pplib.ucNonClockSize));
- rdev->pm.power_state[i].clock_info = kzalloc(sizeof(struct radeon_pm_clock_info) *
- ((power_info->pplib.ucStateEntrySize - 1) ?
- (power_info->pplib.ucStateEntrySize - 1) : 1),
+ rdev->pm.power_state[i].clock_info = kzalloc(array_size(sizeof(struct radeon_pm_clock_info), ((power_info->pplib.ucStateEntrySize - 1) ? (power_info->pplib.ucStateEntrySize - 1) : 1)),
GFP_KERNEL);
if (!rdev->pm.power_state[i].clock_info)
return state_index;
@@ -2690,8 +2688,8 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
if (state_array->ucNumEntries == 0)
return state_index;
- rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) *
- state_array->ucNumEntries, GFP_KERNEL);
+ rdev->pm.power_state = kzalloc(array_size(sizeof(struct radeon_power_state), state_array->ucNumEntries),
+ GFP_KERNEL);
if (!rdev->pm.power_state)
return state_index;
power_state_offset = (u8 *)state_array->states;
@@ -2701,9 +2699,7 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
non_clock_array_index = power_state->v2.nonClockInfoIndex;
non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
&non_clock_info_array->nonClockInfo[non_clock_array_index];
- rdev->pm.power_state[i].clock_info = kzalloc(sizeof(struct radeon_pm_clock_info) *
- (power_state->v2.ucNumDPMLevels ?
- power_state->v2.ucNumDPMLevels : 1),
+ rdev->pm.power_state[i].clock_info = kzalloc(array_size(sizeof(struct radeon_pm_clock_info), (power_state->v2.ucNumDPMLevels ? power_state->v2.ucNumDPMLevels : 1)),
GFP_KERNEL);
if (!rdev->pm.power_state[i].clock_info)
return state_index;
diff --git a/drivers/gpu/drm/radeon/rs780_dpm.c b/drivers/gpu/drm/radeon/rs780_dpm.c
index b5e4e09a8996..63db68c55f46 100644
--- a/drivers/gpu/drm/radeon/rs780_dpm.c
+++ b/drivers/gpu/drm/radeon/rs780_dpm.c
@@ -804,8 +804,8 @@ static int rs780_parse_power_table(struct radeon_device *rdev)
return -EINVAL;
power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
- rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
- power_info->pplib.ucNumStates, GFP_KERNEL);
+ rdev->pm.dpm.ps = kzalloc(array_size(sizeof(struct radeon_ps), power_info->pplib.ucNumStates),
+ GFP_KERNEL);
if (!rdev->pm.dpm.ps)
return -ENOMEM;
diff --git a/drivers/gpu/drm/radeon/rv6xx_dpm.c b/drivers/gpu/drm/radeon/rv6xx_dpm.c
index d91aa3944593..4bc50fbe28f8 100644
--- a/drivers/gpu/drm/radeon/rv6xx_dpm.c
+++ b/drivers/gpu/drm/radeon/rv6xx_dpm.c
@@ -1888,8 +1888,8 @@ static int rv6xx_parse_power_table(struct radeon_device *rdev)
return -EINVAL;
power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
- rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
- power_info->pplib.ucNumStates, GFP_KERNEL);
+ rdev->pm.dpm.ps = kzalloc(array_size(sizeof(struct radeon_ps), power_info->pplib.ucNumStates),
+ GFP_KERNEL);
if (!rdev->pm.dpm.ps)
return -ENOMEM;
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index cb2a7ec4e217..4180cef575af 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2282,8 +2282,8 @@ int rv7xx_parse_power_table(struct radeon_device *rdev)
return -EINVAL;
power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
- rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
- power_info->pplib.ucNumStates, GFP_KERNEL);
+ rdev->pm.dpm.ps = kzalloc(array_size(sizeof(struct radeon_ps), power_info->pplib.ucNumStates),
+ GFP_KERNEL);
if (!rdev->pm.dpm.ps)
return -ENOMEM;
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 0e2a43220a23..14eb59ff6441 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -6832,8 +6832,8 @@ static int si_parse_power_table(struct radeon_device *rdev)
(mode_info->atom_context->bios + data_offset +
le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
- rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
- state_array->ucNumEntries, GFP_KERNEL);
+ rdev->pm.dpm.ps = kzalloc(array_size(sizeof(struct radeon_ps), state_array->ucNumEntries),
+ GFP_KERNEL);
if (!rdev->pm.dpm.ps)
return -ENOMEM;
power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
index fd4804829e46..e23d25f67f20 100644
--- a/drivers/gpu/drm/radeon/sumo_dpm.c
+++ b/drivers/gpu/drm/radeon/sumo_dpm.c
@@ -1482,8 +1482,8 @@ static int sumo_parse_power_table(struct radeon_device *rdev)
(mode_info->atom_context->bios + data_offset +
le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
- rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
- state_array->ucNumEntries, GFP_KERNEL);
+ rdev->pm.dpm.ps = kzalloc(array_size(sizeof(struct radeon_ps), state_array->ucNumEntries),
+ GFP_KERNEL);
if (!rdev->pm.dpm.ps)
return -ENOMEM;
power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 2ef7c4e5e495..3e9bc85392cf 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1757,8 +1757,8 @@ static int trinity_parse_power_table(struct radeon_device *rdev)
(mode_info->atom_context->bios + data_offset +
le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
- rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
- state_array->ucNumEntries, GFP_KERNEL);
+ rdev->pm.dpm.ps = kzalloc(array_size(sizeof(struct radeon_ps), state_array->ucNumEntries),
+ GFP_KERNEL);
if (!rdev->pm.dpm.ps)
return -ENOMEM;
power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/savage/savage_bci.c b/drivers/gpu/drm/savage/savage_bci.c
index 2a5b8466d806..fd7e2eb84008 100644
--- a/drivers/gpu/drm/savage/savage_bci.c
+++ b/drivers/gpu/drm/savage/savage_bci.c
@@ -298,8 +298,8 @@ static int savage_dma_init(drm_savage_private_t * dev_priv)
dev_priv->nr_dma_pages = dev_priv->cmd_dma->size /
(SAVAGE_DMA_PAGE_SIZE * 4);
- dev_priv->dma_pages = kmalloc(sizeof(drm_savage_dma_page_t) *
- dev_priv->nr_dma_pages, GFP_KERNEL);
+ dev_priv->dma_pages = kmalloc(array_size(sizeof(drm_savage_dma_page_t), dev_priv->nr_dma_pages),
+ GFP_KERNEL);
if (dev_priv->dma_pages == NULL)
return -ENOMEM;
diff --git a/drivers/gpu/drm/selftests/test-drm_mm.c b/drivers/gpu/drm/selftests/test-drm_mm.c
index 7cc935d7b7aa..12701321ce77 100644
--- a/drivers/gpu/drm/selftests/test-drm_mm.c
+++ b/drivers/gpu/drm/selftests/test-drm_mm.c
@@ -1631,7 +1631,7 @@ static int igt_topdown(void *ignored)
if (!nodes)
goto err;
- bitmap = kzalloc(count / BITS_PER_LONG * sizeof(unsigned long),
+ bitmap = kzalloc(array_size(count / BITS_PER_LONG, sizeof(unsigned long)),
GFP_KERNEL);
if (!bitmap)
goto err_nodes;
@@ -1745,7 +1745,7 @@ static int igt_bottomup(void *ignored)
if (!nodes)
goto err;
- bitmap = kzalloc(count / BITS_PER_LONG * sizeof(unsigned long),
+ bitmap = kzalloc(array_size(count / BITS_PER_LONG, sizeof(unsigned long)),
GFP_KERNEL);
if (!bitmap)
goto err_nodes;
diff --git a/drivers/gpu/drm/tinydrm/repaper.c b/drivers/gpu/drm/tinydrm/repaper.c
index 75740630c410..ac719fc27cec 100644
--- a/drivers/gpu/drm/tinydrm/repaper.c
+++ b/drivers/gpu/drm/tinydrm/repaper.c
@@ -554,7 +554,7 @@ static int repaper_fb_dirty(struct drm_framebuffer *fb,
DRM_DEBUG("Flushing [FB:%d] st=%ums\n", fb->base.id,
epd->factored_stage_time);
- buf = kmalloc(fb->width * fb->height, GFP_KERNEL);
+ buf = kmalloc(array_size(fb->width, fb->height), GFP_KERNEL);
if (!buf) {
ret = -ENOMEM;
goto out_unlock;
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index ce39390be389..ad0fe5526f9f 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -208,7 +208,7 @@ static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val)
{
if (vc4_state->dlist_count == vc4_state->dlist_size) {
u32 new_size = max(4u, vc4_state->dlist_count * 2);
- u32 *new_dlist = kmalloc(new_size * 4, GFP_KERNEL);
+ u32 *new_dlist = kmalloc(array_size(new_size, 4), GFP_KERNEL);
if (!new_dlist)
return;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index b236c48bf265..fd62883105b4 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -811,7 +811,8 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
srf->sizes[0].height == 64 &&
srf->format == SVGA3D_A8R8G8B8) {
- srf->snooper.image = kzalloc(64 * 64 * 4, GFP_KERNEL);
+ srf->snooper.image = kzalloc(array3_size(64, 64, 4),
+ GFP_KERNEL);
if (!srf->snooper.image) {
DRM_ERROR("Failed to allocate cursor_image\n");
ret = -ENOMEM;
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f82dc60d432e..82c52d4db552 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -131,8 +131,8 @@ static int open_collection(struct hid_parser *parser, unsigned type)
}
if (parser->device->maxcollection == parser->device->collection_size) {
- collection = kmalloc(sizeof(struct hid_collection) *
- parser->device->collection_size * 2, GFP_KERNEL);
+ collection = kmalloc(array3_size(sizeof(struct hid_collection), parser->device->collection_size, 2),
+ GFP_KERNEL);
if (collection == NULL) {
hid_err(parser->device, "failed to reallocate collection array\n");
return -ENOMEM;
diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
index 7f965e231433..c3fd50d8ae6e 100644
--- a/drivers/hid/hid-picolcd_fb.c
+++ b/drivers/hid/hid-picolcd_fb.c
@@ -394,7 +394,8 @@ static int picolcd_set_par(struct fb_info *info)
return -EINVAL;
o_fb = fbdata->bitmap;
- tmp_fb = kmalloc(PICOLCDFB_SIZE*info->var.bits_per_pixel, GFP_KERNEL);
+ tmp_fb = kmalloc(array_size(PICOLCDFB_SIZE, info->var.bits_per_pixel),
+ GFP_KERNEL);
if (!tmp_fb)
return -ENOMEM;
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index 14dce25c104f..3676eb44da0f 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -401,7 +401,7 @@ static int util_probe(struct hv_device *dev,
(struct hv_util_service *)dev_id->driver_data;
int ret;
- srv->recv_buffer = kmalloc(PAGE_SIZE * 4, GFP_KERNEL);
+ srv->recv_buffer = kmalloc(array_size(PAGE_SIZE, 4), GFP_KERNEL);
if (!srv->recv_buffer)
return -ENOMEM;
srv->channel = dev->channel;
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 8699bb969e7e..e8dcc2f2e2f5 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -202,7 +202,7 @@ int hv_ringbuffer_init(struct hv_ring_buffer_info *ring_info,
* First page holds struct hv_ring_buffer, do wraparound mapping for
* the rest.
*/
- pages_wraparound = kzalloc(sizeof(struct page *) * (page_cnt * 2 - 1),
+ pages_wraparound = kzalloc(array_size(sizeof(struct page *), (page_cnt * 2 - 1)),
GFP_KERNEL);
if (!pages_wraparound)
return -ENOMEM;
diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
index 14a94d90c028..b4aefddce879 100644
--- a/drivers/hwmon/acpi_power_meter.c
+++ b/drivers/hwmon/acpi_power_meter.c
@@ -575,8 +575,8 @@ static int read_domain_devices(struct acpi_power_meter_resource *resource)
if (!pss->package.count)
goto end;
- resource->domain_devices = kzalloc(sizeof(struct acpi_device *) *
- pss->package.count, GFP_KERNEL);
+ resource->domain_devices = kzalloc(array_size(sizeof(struct acpi_device *), pss->package.count),
+ GFP_KERNEL);
if (!resource->domain_devices) {
res = -ENOMEM;
goto end;
@@ -796,7 +796,7 @@ static int read_capabilities(struct acpi_power_meter_resource *resource)
goto error;
}
- *str = kzalloc(sizeof(u8) * (element->string.length + 1),
+ *str = kzalloc(array_size(sizeof(u8), (element->string.length + 1)),
GFP_KERNEL);
if (!*str) {
res = -ENOMEM;
diff --git a/drivers/hwmon/ibmpex.c b/drivers/hwmon/ibmpex.c
index 21b9c72f16bd..cd88f6f52444 100644
--- a/drivers/hwmon/ibmpex.c
+++ b/drivers/hwmon/ibmpex.c
@@ -387,7 +387,7 @@ static int ibmpex_find_sensors(struct ibmpex_bmc_data *data)
return -ENOENT;
data->num_sensors = err;
- data->sensors = kzalloc(data->num_sensors * sizeof(*data->sensors),
+ data->sensors = kzalloc(array_size(data->num_sensors, sizeof(*data->sensors)),
GFP_KERNEL);
if (!data->sensors)
return -ENOMEM;
diff --git a/drivers/i2c/i2c-stub.c b/drivers/i2c/i2c-stub.c
index 4a9ad91c5ba3..371910ff378d 100644
--- a/drivers/i2c/i2c-stub.c
+++ b/drivers/i2c/i2c-stub.c
@@ -338,8 +338,8 @@ static int __init i2c_stub_allocate_banks(int i)
chip->bank_mask >>= 1;
}
- chip->bank_words = kzalloc(chip->bank_mask * chip->bank_size *
- sizeof(u16), GFP_KERNEL);
+ chip->bank_words = kzalloc(array3_size(chip->bank_mask, chip->bank_size, sizeof(u16)),
+ GFP_KERNEL);
if (!chip->bank_words)
return -ENOMEM;
diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
index 4b5dc0162e67..eca23ccf9df2 100644
--- a/drivers/ide/hpt366.c
+++ b/drivers/ide/hpt366.c
@@ -1455,7 +1455,8 @@ static int hpt366_init_one(struct pci_dev *dev, const struct pci_device_id *id)
if (info == &hpt36x || info == &hpt374)
dev2 = pci_get_slot(dev->bus, dev->devfn + 1);
- dyn_info = kzalloc(sizeof(*dyn_info) * (dev2 ? 2 : 1), GFP_KERNEL);
+ dyn_info = kzalloc(array_size(sizeof(*dyn_info), (dev2 ? 2 : 1)),
+ GFP_KERNEL);
if (dyn_info == NULL) {
printk(KERN_ERR "%s %s: out of memory!\n",
d.name, pci_name(dev));
diff --git a/drivers/ide/ide-ioctls.c b/drivers/ide/ide-ioctls.c
index 3661abb16a5f..b6b5af433d6d 100644
--- a/drivers/ide/ide-ioctls.c
+++ b/drivers/ide/ide-ioctls.c
@@ -67,7 +67,7 @@ static int ide_get_identity_ioctl(ide_drive_t *drive, unsigned int cmd,
}
/* ata_id_to_hd_driveid() relies on 'id' to be fully allocated. */
- id = kmalloc(ATA_ID_WORDS * 2, GFP_KERNEL);
+ id = kmalloc(array_size(ATA_ID_WORDS, 2), GFP_KERNEL);
if (id == NULL) {
rc = -ENOMEM;
goto out;
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 2019e66eada7..c3f8c67a73a4 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -989,7 +989,7 @@ static int hwif_init(ide_hwif_t *hwif)
if (!hwif->sg_max_nents)
hwif->sg_max_nents = PRD_ENTRIES;
- hwif->sg_table = kmalloc(sizeof(struct scatterlist)*hwif->sg_max_nents,
+ hwif->sg_table = kmalloc(array_size(sizeof(struct scatterlist), hwif->sg_max_nents),
GFP_KERNEL);
if (!hwif->sg_table) {
printk(KERN_ERR "%s: unable to allocate SG table.\n", hwif->name);
diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c
index 36607d52fee0..f3f0650f3b74 100644
--- a/drivers/iio/imu/adis_buffer.c
+++ b/drivers/iio/imu/adis_buffer.c
@@ -38,7 +38,8 @@ int adis_update_scan_mode(struct iio_dev *indio_dev,
if (!adis->xfer)
return -ENOMEM;
- adis->buffer = kzalloc(indio_dev->scan_bytes * 2, GFP_KERNEL);
+ adis->buffer = kzalloc(array_size(indio_dev->scan_bytes, 2),
+ GFP_KERNEL);
if (!adis->buffer)
return -ENOMEM;
diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index ec98790e2a28..5c3d7eeb8dc7 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -436,7 +436,7 @@ struct iio_channel *iio_channel_get_all(struct device *dev)
}
/* NULL terminated array to save passing size */
- chans = kzalloc(sizeof(*chans)*(nummaps + 1), GFP_KERNEL);
+ chans = kzalloc(array_size(sizeof(*chans), (nummaps + 1)), GFP_KERNEL);
if (chans == NULL) {
ret = -ENOMEM;
goto error_ret;
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index e804c8586820..9beb2dbc8cf1 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -1248,8 +1248,8 @@ int ib_cache_setup_one(struct ib_device *device)
rwlock_init(&device->cache.lock);
device->cache.ports =
- kzalloc(sizeof(*device->cache.ports) *
- (rdma_end_port(device) - rdma_start_port(device) + 1), GFP_KERNEL);
+ kzalloc(array_size(sizeof(*device->cache.ports), (rdma_end_port(device) - rdma_start_port(device) + 1)),
+ GFP_KERNEL);
if (!device->cache.ports)
return -ENOMEM;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index a693fcd4c513..cc6acc84fe66 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1828,7 +1828,7 @@ static struct rdma_id_private *cma_new_conn_id(struct rdma_cm_id *listen_id,
rt = &id->route;
rt->num_paths = ib_event->param.req_rcvd.alternate_path ? 2 : 1;
- rt->path_rec = kmalloc(sizeof *rt->path_rec * rt->num_paths,
+ rt->path_rec = kmalloc(array_size(sizeof *rt->path_rec, rt->num_paths),
GFP_KERNEL);
if (!rt->path_rec)
goto err;
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index ea9fbcfb21bd..8fc80c3480a7 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -336,8 +336,7 @@ static int read_port_immutable(struct ib_device *device)
* Therefore port_immutable is declared as a 1 based array with
* potential empty slots at the beginning.
*/
- device->port_immutable = kzalloc(sizeof(*device->port_immutable)
- * (end_port + 1),
+ device->port_immutable = kzalloc(array_size(sizeof(*device->port_immutable), (end_port + 1)),
GFP_KERNEL);
if (!device->port_immutable)
return -ENOMEM;
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index ee3eca86b19e..55d9ea0951b1 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -859,8 +859,8 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
rdev->status_page->cq_size = rdev->lldi.vr->cq.size;
if (c4iw_wr_log) {
- rdev->wr_log = kzalloc((1 << c4iw_wr_log_size_order) *
- sizeof(*rdev->wr_log), GFP_KERNEL);
+ rdev->wr_log = kzalloc(array_size((1 << c4iw_wr_log_size_order), sizeof(*rdev->wr_log)),
+ GFP_KERNEL);
if (rdev->wr_log) {
rdev->wr_log_size = 1 << c4iw_wr_log_size_order;
atomic_set(&rdev->wr_log_idx, 0);
diff --git a/drivers/infiniband/hw/cxgb4/id_table.c b/drivers/infiniband/hw/cxgb4/id_table.c
index 5c2cfdea06ad..f937deb905a5 100644
--- a/drivers/infiniband/hw/cxgb4/id_table.c
+++ b/drivers/infiniband/hw/cxgb4/id_table.c
@@ -92,8 +92,8 @@ int c4iw_id_table_alloc(struct c4iw_id_table *alloc, u32 start, u32 num,
alloc->last = 0;
alloc->max = num;
spin_lock_init(&alloc->lock);
- alloc->table = kmalloc(BITS_TO_LONGS(num) * sizeof(long),
- GFP_KERNEL);
+ alloc->table = kmalloc(array_size(BITS_TO_LONGS(num), sizeof(long)),
+ GFP_KERNEL);
if (!alloc->table)
return -ENOMEM;
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index ae167b686608..bb5a02c3010c 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -216,15 +216,15 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
}
if (!user) {
- wq->sq.sw_sq = kzalloc(wq->sq.size * sizeof *wq->sq.sw_sq,
- GFP_KERNEL);
+ wq->sq.sw_sq = kzalloc(array_size(wq->sq.size, sizeof *wq->sq.sw_sq),
+ GFP_KERNEL);
if (!wq->sq.sw_sq) {
ret = -ENOMEM;
goto free_rq_qid;
}
- wq->rq.sw_rq = kzalloc(wq->rq.size * sizeof *wq->rq.sw_rq,
- GFP_KERNEL);
+ wq->rq.sw_rq = kzalloc(array_size(wq->rq.size, sizeof *wq->rq.sw_rq),
+ GFP_KERNEL);
if (!wq->rq.sw_rq) {
ret = -ENOMEM;
goto free_sw_sq;
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index d449e1472d53..cc8f975c6c84 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -2909,8 +2909,7 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
goto err_counter;
ibdev->ib_uc_qpns_bitmap =
- kmalloc(BITS_TO_LONGS(ibdev->steer_qpn_count) *
- sizeof(long),
+ kmalloc(array_size(BITS_TO_LONGS(ibdev->steer_qpn_count), sizeof(long)),
GFP_KERNEL);
if (!ibdev->ib_uc_qpns_bitmap)
goto err_steer_qp_release;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 199648adac74..249c3a8800a8 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -573,7 +573,7 @@ static int alloc_proxy_bufs(struct ib_device *dev, struct mlx4_ib_qp *qp)
int i;
qp->sqp_proxy_rcv =
- kmalloc(sizeof (struct mlx4_ib_buf) * qp->rq.wqe_cnt,
+ kmalloc(array_size(sizeof(struct mlx4_ib_buf), qp->rq.wqe_cnt),
GFP_KERNEL);
if (!qp->sqp_proxy_rcv)
return -ENOMEM;
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index 0148b8f559a4..1738ff09bb3f 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -189,7 +189,8 @@ static int create_srq_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_srq *srq,
}
mlx5_ib_dbg(dev, "srq->buf.page_shift = %d\n", srq->buf.page_shift);
- in->pas = kvzalloc(sizeof(*in->pas) * srq->buf.npages, GFP_KERNEL);
+ in->pas = kvzalloc(array_size(sizeof(*in->pas), srq->buf.npages),
+ GFP_KERNEL);
if (!in->pas) {
err = -ENOMEM;
goto err_buf;
diff --git a/drivers/infiniband/hw/mthca/mthca_allocator.c b/drivers/infiniband/hw/mthca/mthca_allocator.c
index dfa35adf5b91..2ff4a4eb2eb4 100644
--- a/drivers/infiniband/hw/mthca/mthca_allocator.c
+++ b/drivers/infiniband/hw/mthca/mthca_allocator.c
@@ -90,7 +90,7 @@ int mthca_alloc_init(struct mthca_alloc *alloc, u32 num, u32 mask,
alloc->max = num;
alloc->mask = mask;
spin_lock_init(&alloc->lock);
- alloc->table = kmalloc(BITS_TO_LONGS(num) * sizeof (long),
+ alloc->table = kmalloc(array_size(BITS_TO_LONGS(num), sizeof(long)),
GFP_KERNEL);
if (!alloc->table)
return -ENOMEM;
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 419a2a20c047..a2519dbf6465 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -565,8 +565,7 @@ int mthca_cmd_use_events(struct mthca_dev *dev)
{
int i;
- dev->cmd.context = kmalloc(dev->cmd.max_cmds *
- sizeof (struct mthca_cmd_context),
+ dev->cmd.context = kmalloc(array_size(dev->cmd.max_cmds, sizeof(struct mthca_cmd_context)),
GFP_KERNEL);
if (!dev->cmd.context)
return -ENOMEM;
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 7a31be3c3e73..e4acaba9c53a 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -712,8 +712,7 @@ int mthca_init_db_tab(struct mthca_dev *dev)
dev->db_tab->max_group1 = 0;
dev->db_tab->min_group2 = dev->db_tab->npages - 1;
- dev->db_tab->page = kmalloc(dev->db_tab->npages *
- sizeof *dev->db_tab->page,
+ dev->db_tab->page = kmalloc(array_size(dev->db_tab->npages, sizeof *dev->db_tab->page),
GFP_KERNEL);
if (!dev->db_tab->page) {
kfree(dev->db_tab);
diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index 88d3a53966e1..6c907f2756fc 100644
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -144,7 +144,7 @@ static int mthca_buddy_init(struct mthca_buddy *buddy, int max_order)
buddy->max_order = max_order;
spin_lock_init(&buddy->lock);
- buddy->bits = kzalloc((buddy->max_order + 1) * sizeof (long *),
+ buddy->bits = kzalloc(array_size((buddy->max_order + 1), sizeof(long *)),
GFP_KERNEL);
buddy->num_free = kcalloc((buddy->max_order + 1), sizeof *buddy->num_free,
GFP_KERNEL);
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index d21960cd9a49..c89f5766124b 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -1054,7 +1054,7 @@ static int mthca_alloc_wqe_buf(struct mthca_dev *dev,
size = PAGE_ALIGN(qp->send_wqe_offset +
(qp->sq.max << qp->sq.wqe_shift));
- qp->wrid = kmalloc((qp->rq.max + qp->sq.max) * sizeof (u64),
+ qp->wrid = kmalloc(array_size((qp->rq.max + qp->sq.max), sizeof(u64)),
GFP_KERNEL);
if (!qp->wrid)
goto err_out;
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index d22f970480c0..18c97813c8f3 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -155,7 +155,7 @@ static int mthca_alloc_srq_buf(struct mthca_dev *dev, struct mthca_pd *pd,
if (pd->ibpd.uobject)
return 0;
- srq->wrid = kmalloc(srq->max * sizeof (u64), GFP_KERNEL);
+ srq->wrid = kmalloc(array_size(srq->max, sizeof(u64)), GFP_KERNEL);
if (!srq->wrid)
return -ENOMEM;
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index 18a7de1c3923..71dd65806ac7 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -1001,8 +1001,8 @@ int nes_init_cqp(struct nes_device *nesdev)
}
/* Allocate a twice the number of CQP requests as the SQ size */
- nesdev->nes_cqp_requests = kzalloc(sizeof(struct nes_cqp_request) *
- 2 * NES_CQP_SQ_SIZE, GFP_KERNEL);
+ nesdev->nes_cqp_requests = kzalloc(array3_size(sizeof(struct nes_cqp_request), 2, NES_CQP_SQ_SIZE),
+ GFP_KERNEL);
if (!nesdev->nes_cqp_requests) {
pci_free_consistent(nesdev->pcidev, nesdev->cqp_mem_size, nesdev->cqp.sq_vbase,
nesdev->cqp.sq_pbase);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 784ed6b09a46..1aea9f3f7a9f 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -843,8 +843,8 @@ static int ocrdma_build_pbl_tbl(struct ocrdma_dev *dev, struct ocrdma_hw_mr *mr)
void *va;
dma_addr_t pa;
- mr->pbl_table = kzalloc(sizeof(struct ocrdma_pbl) *
- mr->num_pbls, GFP_KERNEL);
+ mr->pbl_table = kzalloc(array_size(sizeof(struct ocrdma_pbl), mr->num_pbls),
+ GFP_KERNEL);
if (!mr->pbl_table)
return -ENOMEM;
@@ -1323,12 +1323,12 @@ static void ocrdma_set_qp_db(struct ocrdma_dev *dev, struct ocrdma_qp *qp,
static int ocrdma_alloc_wr_id_tbl(struct ocrdma_qp *qp)
{
qp->wqe_wr_id_tbl =
- kzalloc(sizeof(*(qp->wqe_wr_id_tbl)) * qp->sq.max_cnt,
+ kzalloc(array_size(sizeof(*(qp->wqe_wr_id_tbl)), qp->sq.max_cnt),
GFP_KERNEL);
if (qp->wqe_wr_id_tbl == NULL)
return -ENOMEM;
qp->rqe_wr_id_tbl =
- kzalloc(sizeof(u64) * qp->rq.max_cnt, GFP_KERNEL);
+ kzalloc(array_size(sizeof(u64), qp->rq.max_cnt), GFP_KERNEL);
if (qp->rqe_wr_id_tbl == NULL)
return -ENOMEM;
@@ -1865,15 +1865,16 @@ struct ib_srq *ocrdma_create_srq(struct ib_pd *ibpd,
if (udata == NULL) {
status = -ENOMEM;
- srq->rqe_wr_id_tbl = kzalloc(sizeof(u64) * srq->rq.max_cnt,
- GFP_KERNEL);
+ srq->rqe_wr_id_tbl = kzalloc(array_size(sizeof(u64), srq->rq.max_cnt),
+ GFP_KERNEL);
if (srq->rqe_wr_id_tbl == NULL)
goto arm_err;
srq->bit_fields_len = (srq->rq.max_cnt / 32) +
(srq->rq.max_cnt % 32 ? 1 : 0);
srq->idx_bit_fields =
- kmalloc(srq->bit_fields_len * sizeof(u32), GFP_KERNEL);
+ kmalloc(array_size(srq->bit_fields_len, sizeof(u32)),
+ GFP_KERNEL);
if (srq->idx_bit_fields == NULL)
goto arm_err;
memset(srq->idx_bit_fields, 0xff,
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 7d3763b2e01c..3543de8dbb1b 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -1616,7 +1616,7 @@ static int qedr_create_kernel_qp(struct qedr_dev *dev,
qp->sq.max_wr = min_t(u32, attrs->cap.max_send_wr * dev->wq_multiplier,
dev->attr.max_sqe);
- qp->wqe_wr_id = kzalloc(qp->sq.max_wr * sizeof(*qp->wqe_wr_id),
+ qp->wqe_wr_id = kzalloc(array_size(qp->sq.max_wr, sizeof(*qp->wqe_wr_id)),
GFP_KERNEL);
if (!qp->wqe_wr_id) {
DP_ERR(dev, "create qp: failed SQ shadow memory allocation\n");
@@ -1634,7 +1634,7 @@ static int qedr_create_kernel_qp(struct qedr_dev *dev,
qp->rq.max_wr = (u16) max_t(u32, attrs->cap.max_recv_wr, 1);
/* Allocate driver internal RQ array */
- qp->rqe_wr_id = kzalloc(qp->rq.max_wr * sizeof(*qp->rqe_wr_id),
+ qp->rqe_wr_id = kzalloc(array_size(qp->rq.max_wr, sizeof(*qp->rqe_wr_id)),
GFP_KERNEL);
if (!qp->rqe_wr_id) {
DP_ERR(dev,
diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
index 8a15e5c7dd91..dcaf5d5b23ca 100644
--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
@@ -2496,15 +2496,15 @@ static void init_6120_cntrnames(struct qib_devdata *dd)
dd->cspec->cntrnamelen = sizeof(cntr6120names) - 1;
else
dd->cspec->cntrnamelen = 1 + s - cntr6120names;
- dd->cspec->cntrs = kmalloc(dd->cspec->ncntrs
- * sizeof(u64), GFP_KERNEL);
+ dd->cspec->cntrs = kmalloc(array_size(dd->cspec->ncntrs, sizeof(u64)),
+ GFP_KERNEL);
for (i = 0, s = (char *)portcntr6120names; s; i++)
s = strchr(s + 1, '\n');
dd->cspec->nportcntrs = i - 1;
dd->cspec->portcntrnamelen = sizeof(portcntr6120names) - 1;
- dd->cspec->portcntrs = kmalloc(dd->cspec->nportcntrs
- * sizeof(u64), GFP_KERNEL);
+ dd->cspec->portcntrs = kmalloc(array_size(dd->cspec->nportcntrs, sizeof(u64)),
+ GFP_KERNEL);
}
static u32 qib_read_6120cntrs(struct qib_devdata *dd, loff_t pos, char **namep,
diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
index bdff2326731e..3b4439bc460b 100644
--- a/drivers/infiniband/hw/qib/qib_iba7220.c
+++ b/drivers/infiniband/hw/qib/qib_iba7220.c
@@ -3147,15 +3147,15 @@ static void init_7220_cntrnames(struct qib_devdata *dd)
dd->cspec->cntrnamelen = sizeof(cntr7220names) - 1;
else
dd->cspec->cntrnamelen = 1 + s - cntr7220names;
- dd->cspec->cntrs = kmalloc(dd->cspec->ncntrs
- * sizeof(u64), GFP_KERNEL);
+ dd->cspec->cntrs = kmalloc(array_size(dd->cspec->ncntrs, sizeof(u64)),
+ GFP_KERNEL);
for (i = 0, s = (char *)portcntr7220names; s; i++)
s = strchr(s + 1, '\n');
dd->cspec->nportcntrs = i - 1;
dd->cspec->portcntrnamelen = sizeof(portcntr7220names) - 1;
- dd->cspec->portcntrs = kmalloc(dd->cspec->nportcntrs
- * sizeof(u64), GFP_KERNEL);
+ dd->cspec->portcntrs = kmalloc(array_size(dd->cspec->nportcntrs, sizeof(u64)),
+ GFP_KERNEL);
}
static u32 qib_read_7220cntrs(struct qib_devdata *dd, loff_t pos, char **namep,
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 57583362bf3e..01eb34949c6e 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -3648,8 +3648,8 @@ static int qib_do_7322_reset(struct qib_devdata *dd)
if (msix_entries) {
/* can be up to 512 bytes, too big for stack */
- msix_vecsave = kmalloc(2 * dd->cspec->num_msix_entries *
- sizeof(u64), GFP_KERNEL);
+ msix_vecsave = kmalloc(array3_size(2, dd->cspec->num_msix_entries, sizeof(u64)),
+ GFP_KERNEL);
}
/*
@@ -5009,16 +5009,16 @@ static void init_7322_cntrnames(struct qib_devdata *dd)
dd->cspec->cntrnamelen = sizeof(cntr7322names) - 1;
else
dd->cspec->cntrnamelen = 1 + s - cntr7322names;
- dd->cspec->cntrs = kmalloc(dd->cspec->ncntrs
- * sizeof(u64), GFP_KERNEL);
+ dd->cspec->cntrs = kmalloc(array_size(dd->cspec->ncntrs, sizeof(u64)),
+ GFP_KERNEL);
for (i = 0, s = (char *)portcntr7322names; s; i++)
s = strchr(s + 1, '\n');
dd->cspec->nportcntrs = i - 1;
dd->cspec->portcntrnamelen = sizeof(portcntr7322names) - 1;
for (i = 0; i < dd->num_pports; ++i) {
- dd->pport[i].cpspec->portcntrs = kmalloc(dd->cspec->nportcntrs
- * sizeof(u64), GFP_KERNEL);
+ dd->pport[i].cpspec->portcntrs = kmalloc(array_size(dd->cspec->nportcntrs, sizeof(u64)),
+ GFP_KERNEL);
}
}
diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c
index 6c68f8a97018..aef7258fc768 100644
--- a/drivers/infiniband/hw/qib/qib_init.c
+++ b/drivers/infiniband/hw/qib/qib_init.c
@@ -1130,8 +1130,8 @@ struct qib_devdata *qib_alloc_devdata(struct pci_dev *pdev, size_t extra)
if (!qib_cpulist_count) {
u32 count = num_online_cpus();
- qib_cpulist = kzalloc(BITS_TO_LONGS(count) *
- sizeof(long), GFP_KERNEL);
+ qib_cpulist = kzalloc(array_size(BITS_TO_LONGS(count), sizeof(long)),
+ GFP_KERNEL);
if (qib_cpulist)
qib_cpulist_count = count;
}
diff --git a/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c b/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c
index 912d8ef04352..81f6d578cfe3 100644
--- a/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c
+++ b/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c
@@ -543,8 +543,8 @@ alloc_res_chunk_list(struct usnic_vnic *vnic,
/* Do Nothing */
}
- res_chunk_list = kzalloc(sizeof(*res_chunk_list)*(res_lst_sz+1),
- GFP_ATOMIC);
+ res_chunk_list = kzalloc(array_size(sizeof(*res_chunk_list), (res_lst_sz + 1)),
+ GFP_ATOMIC);
if (!res_chunk_list)
return ERR_PTR(-ENOMEM);
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index df49c4eb67f7..bab3bc3ff40f 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -258,8 +258,8 @@ int iser_alloc_rx_descriptors(struct iser_conn *iser_conn,
goto alloc_login_buf_fail;
iser_conn->num_rx_descs = session->cmds_max;
- iser_conn->rx_descs = kmalloc(iser_conn->num_rx_descs *
- sizeof(struct iser_rx_desc), GFP_KERNEL);
+ iser_conn->rx_descs = kmalloc(array_size(iser_conn->num_rx_descs, sizeof(struct iser_rx_desc)),
+ GFP_KERNEL);
if (!iser_conn->rx_descs)
goto rx_desc_alloc_fail;
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index c35d2cd37d70..da6b4fa10700 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1035,7 +1035,7 @@ static int srp_alloc_req_data(struct srp_rdma_ch *ch)
for (i = 0; i < target->req_ring_size; ++i) {
req = &ch->req_ring[i];
- mr_list = kmalloc(target->mr_per_cmd * sizeof(void *),
+ mr_list = kmalloc(array_size(target->mr_per_cmd, sizeof(void *)),
GFP_KERNEL);
if (!mr_list)
goto out;
@@ -1043,8 +1043,8 @@ static int srp_alloc_req_data(struct srp_rdma_ch *ch)
req->fr_list = mr_list;
} else {
req->fmr_list = mr_list;
- req->map_page = kmalloc(srp_dev->max_pages_per_mr *
- sizeof(void *), GFP_KERNEL);
+ req->map_page = kmalloc(array_size(srp_dev->max_pages_per_mr, sizeof(void *)),
+ GFP_KERNEL);
if (!req->map_page)
goto out;
}
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index c33b7b104e72..4aad0dc2f25e 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1455,7 +1455,8 @@ static int omap_iommu_add_device(struct device *dev)
if (num_iommus < 0)
return 0;
- arch_data = kzalloc((num_iommus + 1) * sizeof(*arch_data), GFP_KERNEL);
+ arch_data = kzalloc(array_size((num_iommus + 1), sizeof(*arch_data)),
+ GFP_KERNEL);
if (!arch_data)
return -ENOMEM;
diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
index 63d980995d17..f24b3d547dca 100644
--- a/drivers/irqchip/irq-alpine-msi.c
+++ b/drivers/irqchip/irq-alpine-msi.c
@@ -268,7 +268,7 @@ static int alpine_msix_init(struct device_node *node,
goto err_priv;
}
- priv->msi_map = kzalloc(sizeof(*priv->msi_map) * BITS_TO_LONGS(priv->num_spis),
+ priv->msi_map = kzalloc(array_size(sizeof(*priv->msi_map), BITS_TO_LONGS(priv->num_spis)),
GFP_KERNEL);
if (!priv->msi_map) {
ret = -ENOMEM;
diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
index 1ff38aff9f29..6fb94d7bf75c 100644
--- a/drivers/irqchip/irq-gic-v2m.c
+++ b/drivers/irqchip/irq-gic-v2m.c
@@ -361,7 +361,7 @@ static int __init gicv2m_init_one(struct fwnode_handle *fwnode,
break;
}
- v2m->bm = kzalloc(sizeof(long) * BITS_TO_LONGS(v2m->nr_spis),
+ v2m->bm = kzalloc(array_size(sizeof(long), BITS_TO_LONGS(v2m->nr_spis)),
GFP_KERNEL);
if (!v2m->bm) {
ret = -ENOMEM;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index d1a9972c4f58..4d526504e56a 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1239,7 +1239,7 @@ static int its_vlpi_map(struct irq_data *d, struct its_cmd_info *info)
if (!its_dev->event_map.vm) {
struct its_vlpi_map *maps;
- maps = kzalloc(sizeof(*maps) * its_dev->event_map.nr_lpis,
+ maps = kzalloc(array_size(sizeof(*maps), its_dev->event_map.nr_lpis),
GFP_KERNEL);
if (!maps) {
ret = -ENOMEM;
@@ -1437,7 +1437,7 @@ static int __init its_lpi_init(u32 id_bits)
{
lpi_chunks = its_lpi_to_chunk(1UL << id_bits);
- lpi_bitmap = kzalloc(BITS_TO_LONGS(lpi_chunks) * sizeof(long),
+ lpi_bitmap = kzalloc(array_size(BITS_TO_LONGS(lpi_chunks), sizeof(long)),
GFP_KERNEL);
if (!lpi_bitmap) {
lpi_chunks = 0;
@@ -1471,7 +1471,7 @@ static unsigned long *its_lpi_alloc_chunks(int nr_irqs, int *base, int *nr_ids)
if (!nr_chunks)
goto out;
- bitmap = kzalloc(BITS_TO_LONGS(nr_chunks * IRQS_PER_CHUNK) * sizeof (long),
+ bitmap = kzalloc(array_size(BITS_TO_LONGS(nr_chunks * IRQS_PER_CHUNK), sizeof(long)),
GFP_ATOMIC);
if (!bitmap)
goto out;
diff --git a/drivers/irqchip/irq-partition-percpu.c b/drivers/irqchip/irq-partition-percpu.c
index ccd72c2cbc23..b6fd0027b300 100644
--- a/drivers/irqchip/irq-partition-percpu.c
+++ b/drivers/irqchip/irq-partition-percpu.c
@@ -229,7 +229,7 @@ struct partition_desc *partition_create_desc(struct fwnode_handle *fwnode,
goto out;
desc->domain = d;
- desc->bitmap = kzalloc(sizeof(long) * BITS_TO_LONGS(nr_parts),
+ desc->bitmap = kzalloc(array_size(sizeof(long), BITS_TO_LONGS(nr_parts)),
GFP_KERNEL);
if (WARN_ON(!desc->bitmap))
goto out;
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index 49fef08858c5..0d137d918e21 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -2268,7 +2268,8 @@ static int capidrv_addcontr(u16 contr, struct capi_profile *profp)
strcpy(card->name, id);
card->contrnr = contr;
card->nbchan = profp->nbchannel;
- card->bchans = kmalloc(sizeof(capidrv_bchan) * card->nbchan, GFP_ATOMIC);
+ card->bchans = kmalloc(array_size(sizeof(capidrv_bchan), card->nbchan),
+ GFP_ATOMIC);
if (!card->bchans) {
printk(KERN_WARNING
"capidrv: (%s) Could not allocate bchan-structs.\n", id);
diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index ccec7778cad2..1b954e0072d4 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -252,7 +252,7 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
return;
if (l > 64)
l = 64; /* arbitrary limit */
- dbgline = kmalloc(3 * l, GFP_ATOMIC);
+ dbgline = kmalloc(array_size(3, l), GFP_ATOMIC);
if (!dbgline)
return;
for (i = 0; i < l; i++) {
@@ -272,7 +272,7 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
return;
if (l > 64)
l = 64; /* arbitrary limit */
- dbgline = kmalloc(3 * l, GFP_ATOMIC);
+ dbgline = kmalloc(array_size(3, l), GFP_ATOMIC);
if (!dbgline)
return;
data += CAPIMSG_LEN(data);
@@ -1370,7 +1370,7 @@ static void do_connect_req(struct gigaset_capi_ctr *iif,
cmsg->adr.adrPLCI |= (bcs->channel + 1) << 8;
/* build command table */
- commands = kzalloc(AT_NUM * (sizeof *commands), GFP_KERNEL);
+ commands = kzalloc(array_size(AT_NUM, (sizeof *commands)), GFP_KERNEL);
if (!commands)
goto oom;
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index 2d75329007f1..b7345c68c4a6 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -243,7 +243,8 @@ static int command_from_LL(isdn_ctrl *cntrl)
dev_kfree_skb(bcs->rx_skb);
gigaset_new_rx_skb(bcs);
- commands = kzalloc(AT_NUM * (sizeof *commands), GFP_ATOMIC);
+ commands = kzalloc(array_size(AT_NUM, (sizeof *commands)),
+ GFP_ATOMIC);
if (!commands) {
gigaset_free_channel(bcs);
dev_err(cs->dev, "ISDN_CMD_DIAL: out of memory\n");
diff --git a/drivers/isdn/hisax/fsm.c b/drivers/isdn/hisax/fsm.c
index 3e020ec0f65e..5ed317482f3f 100644
--- a/drivers/isdn/hisax/fsm.c
+++ b/drivers/isdn/hisax/fsm.c
@@ -27,7 +27,8 @@ FsmNew(struct Fsm *fsm, struct FsmNode *fnlist, int fncount)
int i;
fsm->jumpmatrix =
- kzalloc(sizeof(FSMFNPTR) * fsm->state_count * fsm->event_count, GFP_KERNEL);
+ kzalloc(array3_size(sizeof(FSMFNPTR), fsm->state_count, fsm->event_count),
+ GFP_KERNEL);
if (!fsm->jumpmatrix)
return -ENOMEM;
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index b628da5e2d2e..fd136ec9028c 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -2103,7 +2103,8 @@ isdn_add_channels(isdn_driver_t *d, int drvidx, int n, int adding)
if ((adding) && (d->rcv_waitq))
kfree(d->rcv_waitq);
- d->rcv_waitq = kmalloc(sizeof(wait_queue_head_t) * 2 * m, GFP_ATOMIC);
+ d->rcv_waitq = kmalloc(array3_size(sizeof(wait_queue_head_t), 2, m),
+ GFP_ATOMIC);
if (!d->rcv_waitq) {
printk(KERN_WARNING "register_isdn: Could not alloc rcv_waitq\n");
if (!adding) {
diff --git a/drivers/isdn/mISDN/fsm.c b/drivers/isdn/mISDN/fsm.c
index cabcb906e0b5..0cf9ec54eca4 100644
--- a/drivers/isdn/mISDN/fsm.c
+++ b/drivers/isdn/mISDN/fsm.c
@@ -32,8 +32,8 @@ mISDN_FsmNew(struct Fsm *fsm,
{
int i;
- fsm->jumpmatrix = kzalloc(sizeof(FSMFNPTR) * fsm->state_count *
- fsm->event_count, GFP_KERNEL);
+ fsm->jumpmatrix = kzalloc(array3_size(sizeof(FSMFNPTR), fsm->state_count, fsm->event_count),
+ GFP_KERNEL);
if (fsm->jumpmatrix == NULL)
return -ENOMEM;
diff --git a/drivers/lightnvm/pblk-init.c b/drivers/lightnvm/pblk-init.c
index 91a5bc2556a3..ae92984028d8 100644
--- a/drivers/lightnvm/pblk-init.c
+++ b/drivers/lightnvm/pblk-init.c
@@ -366,8 +366,8 @@ static int pblk_core_init(struct pblk *pblk)
return -EINVAL;
}
- pblk->pad_dist = kzalloc((pblk->min_write_pgs - 1) * sizeof(atomic64_t),
- GFP_KERNEL);
+ pblk->pad_dist = kzalloc(array_size((pblk->min_write_pgs - 1), sizeof(atomic64_t)),
+ GFP_KERNEL);
if (!pblk->pad_dist)
return -ENOMEM;
@@ -814,8 +814,8 @@ static int pblk_alloc_line_meta(struct pblk *pblk, struct pblk_line *line)
return -ENOMEM;
}
- line->chks = kmalloc(lm->blk_per_line * sizeof(struct nvm_chk_meta),
- GFP_KERNEL);
+ line->chks = kmalloc(array_size(lm->blk_per_line, sizeof(struct nvm_chk_meta)),
+ GFP_KERNEL);
if (!line->chks) {
kfree(line->erase_bitmap);
kfree(line->blk_bitmap);
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 3dea06b41d43..6572df9cecf0 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1690,7 +1690,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
iter_size = (sb->bucket_size / sb->block_size + 1) *
sizeof(struct btree_iter_set);
- if (!(c->devices = kzalloc(c->nr_uuids * sizeof(void *), GFP_KERNEL)) ||
+ if (!(c->devices = kzalloc(array_size(c->nr_uuids, sizeof(void *)), GFP_KERNEL)) ||
!(c->bio_meta = mempool_create_kmalloc_pool(2,
sizeof(struct bbio) + sizeof(struct bio_vec) *
bucket_pages(c))) ||
@@ -2018,8 +2018,7 @@ static int cache_alloc(struct cache *ca)
!init_heap(&ca->heap, free << 3, GFP_KERNEL) ||
!(ca->buckets = vzalloc(sizeof(struct bucket) *
ca->sb.nbuckets)) ||
- !(ca->prio_buckets = kzalloc(sizeof(uint64_t) * prio_buckets(ca) *
- 2, GFP_KERNEL)) ||
+ !(ca->prio_buckets = kzalloc(array3_size(sizeof(uint64_t), prio_buckets(ca), 2), GFP_KERNEL)) ||
!(ca->disk_buckets = alloc_bucket_pages(GFP_KERNEL, ca)))
return -ENOMEM;
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 44ff473dab3e..cb24b2cd8169 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1878,8 +1878,8 @@ static int crypt_alloc_tfms_skcipher(struct crypt_config *cc, char *ciphermode)
unsigned i;
int err;
- cc->cipher_tfm.tfms = kzalloc(cc->tfms_count *
- sizeof(struct crypto_skcipher *), GFP_KERNEL);
+ cc->cipher_tfm.tfms = kzalloc(array_size(cc->tfms_count, sizeof(struct crypto_skcipher *)),
+ GFP_KERNEL);
if (!cc->cipher_tfm.tfms)
return -ENOMEM;
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 9c354be188d4..71ba1b1f8844 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -2448,7 +2448,8 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int
struct scatterlist **sl;
unsigned i;
- sl = kvmalloc(ic->journal_sections * sizeof(struct scatterlist *), GFP_KERNEL | __GFP_ZERO);
+ sl = kvmalloc(array_size(ic->journal_sections, sizeof(struct scatterlist *)),
+ GFP_KERNEL | __GFP_ZERO);
if (!sl)
return NULL;
@@ -2644,7 +2645,8 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
goto bad;
}
- sg = kvmalloc((ic->journal_pages + 1) * sizeof(struct scatterlist), GFP_KERNEL);
+ sg = kvmalloc(array_size((ic->journal_pages + 1), sizeof(struct scatterlist)),
+ GFP_KERNEL);
if (!sg) {
*error = "Unable to allocate sg list";
r = -ENOMEM;
@@ -2710,7 +2712,8 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
r = -ENOMEM;
goto bad;
}
- ic->sk_requests = kvmalloc(ic->journal_sections * sizeof(struct skcipher_request *), GFP_KERNEL | __GFP_ZERO);
+ ic->sk_requests = kvmalloc(array_size(ic->journal_sections, sizeof(struct skcipher_request *)),
+ GFP_KERNEL | __GFP_ZERO);
if (!ic->sk_requests) {
*error = "Unable to allocate sk requests";
r = -ENOMEM;
@@ -2744,7 +2747,8 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
r = -ENOMEM;
goto bad;
}
- section_req->iv = kmalloc(ivsize * 2, GFP_KERNEL);
+ section_req->iv = kmalloc(array_size(ivsize, 2),
+ GFP_KERNEL);
if (!section_req->iv) {
skcipher_request_free(section_req);
*error = "Unable to allocate iv";
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
index 56059fb56e2d..7e596d510539 100644
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -915,7 +915,8 @@ static int parse_histogram(const char *h, unsigned *n_histogram_entries,
if (*q == ',')
(*n_histogram_entries)++;
- *histogram_boundaries = kmalloc(*n_histogram_entries * sizeof(unsigned long long), GFP_KERNEL);
+ *histogram_boundaries = kmalloc(array_size(*n_histogram_entries, sizeof(unsigned long long)),
+ GFP_KERNEL);
if (!*histogram_boundaries)
return -ENOMEM;
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index fc893f636a98..a3c93bf054c6 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -797,8 +797,8 @@ static int verity_alloc_most_once(struct dm_verity *v)
return -E2BIG;
}
- v->validated_blocks = kvzalloc(BITS_TO_LONGS(v->data_blocks) *
- sizeof(unsigned long), GFP_KERNEL);
+ v->validated_blocks = kvzalloc(array_size(BITS_TO_LONGS(v->data_blocks), sizeof(unsigned long)),
+ GFP_KERNEL);
if (!v->validated_blocks) {
ti->error = "failed to allocate bitset for check_at_most_once";
return -ENOMEM;
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 79bfbc840385..c65cc9986656 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -1380,9 +1380,8 @@ static int lock_all_bitmaps(struct mddev *mddev)
char str[64];
struct md_cluster_info *cinfo = mddev->cluster_info;
- cinfo->other_bitmap_lockres = kzalloc((mddev->bitmap_info.nodes - 1) *
- sizeof(struct dlm_lock_resource *),
- GFP_KERNEL);
+ cinfo->other_bitmap_lockres = kzalloc(array_size((mddev->bitmap_info.nodes - 1), sizeof(struct dlm_lock_resource *)),
+ GFP_KERNEL);
if (!cinfo->other_bitmap_lockres) {
pr_err("md: can't alloc mem for other bitmap locks\n");
return 0;
diff --git a/drivers/md/md-multipath.c b/drivers/md/md-multipath.c
index 0a7e99d62c69..7836a23f92d8 100644
--- a/drivers/md/md-multipath.c
+++ b/drivers/md/md-multipath.c
@@ -398,7 +398,7 @@ static int multipath_run (struct mddev *mddev)
if (!conf)
goto out;
- conf->multipaths = kzalloc(sizeof(struct multipath_info)*mddev->raid_disks,
+ conf->multipaths = kzalloc(array_size(sizeof(struct multipath_info), mddev->raid_disks),
GFP_KERNEL);
if (!conf->multipaths)
goto out_free_conf;
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 584c10347267..a99f1e35a0a6 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -159,12 +159,11 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
}
err = -ENOMEM;
- conf->strip_zone = kzalloc(sizeof(struct strip_zone)*
- conf->nr_strip_zones, GFP_KERNEL);
+ conf->strip_zone = kzalloc(array_size(sizeof(struct strip_zone), conf->nr_strip_zones),
+ GFP_KERNEL);
if (!conf->strip_zone)
goto abort;
- conf->devlist = kzalloc(sizeof(struct md_rdev*)*
- conf->nr_strip_zones*mddev->raid_disks,
+ conf->devlist = kzalloc(array3_size(sizeof(struct md_rdev *), conf->nr_strip_zones, mddev->raid_disks),
GFP_KERNEL);
if (!conf->devlist)
goto abort;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index e9e3308cb0a7..13f74e2c9ef8 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -126,7 +126,7 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
if (!r1_bio)
return NULL;
- rps = kmalloc(sizeof(struct resync_pages) * pi->raid_disks,
+ rps = kmalloc(array_size(sizeof(struct resync_pages), pi->raid_disks),
gfp_flags);
if (!rps)
goto out_free_r1bio;
@@ -2939,9 +2939,8 @@ static struct r1conf *setup_conf(struct mddev *mddev)
if (!conf->barrier)
goto abort;
- conf->mirrors = kzalloc(sizeof(struct raid1_info)
- * mddev->raid_disks * 2,
- GFP_KERNEL);
+ conf->mirrors = kzalloc(array3_size(sizeof(struct raid1_info), mddev->raid_disks, 2),
+ GFP_KERNEL);
if (!conf->mirrors)
goto abort;
@@ -3243,7 +3242,7 @@ static int raid1_reshape(struct mddev *mddev)
kfree(newpoolinfo);
return -ENOMEM;
}
- newmirrors = kzalloc(sizeof(struct raid1_info) * raid_disks * 2,
+ newmirrors = kzalloc(array3_size(sizeof(struct raid1_info), raid_disks, 2),
GFP_KERNEL);
if (!newmirrors) {
kfree(newpoolinfo);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 2a7bd1000cb5..7bd1077d5986 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3688,8 +3688,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
goto out;
/* FIXME calc properly */
- conf->mirrors = kzalloc(sizeof(struct raid10_info)*(mddev->raid_disks +
- max(0,-mddev->delta_disks)),
+ conf->mirrors = kzalloc(array_size(sizeof(struct raid10_info), (mddev->raid_disks + max(0, -mddev->delta_disks))),
GFP_KERNEL);
if (!conf->mirrors)
goto out;
@@ -4130,11 +4129,8 @@ static int raid10_check_reshape(struct mddev *mddev)
conf->mirrors_new = NULL;
if (mddev->delta_disks > 0) {
/* allocate new 'mirrors' list */
- conf->mirrors_new = kzalloc(
- sizeof(struct raid10_info)
- *(mddev->raid_disks +
- mddev->delta_disks),
- GFP_KERNEL);
+ conf->mirrors_new = kzalloc(array_size(sizeof(struct raid10_info), (mddev->raid_disks + mddev->delta_disks)),
+ GFP_KERNEL);
if (!conf->mirrors_new)
return -ENOMEM;
}
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index c08d83dcf1e2..7d0c5c6bcce5 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -6659,9 +6659,9 @@ static int alloc_thread_groups(struct r5conf *conf, int cnt,
}
*group_cnt = num_possible_nodes();
size = sizeof(struct r5worker) * cnt;
- workers = kzalloc(size * *group_cnt, GFP_NOIO);
- *worker_groups = kzalloc(sizeof(struct r5worker_group) *
- *group_cnt, GFP_NOIO);
+ workers = kzalloc(array_size(size, *group_cnt), GFP_NOIO);
+ *worker_groups = kzalloc(array_size(sizeof(struct r5worker_group), *group_cnt),
+ GFP_NOIO);
if (!*worker_groups || !workers) {
kfree(workers);
kfree(*worker_groups);
diff --git a/drivers/media/pci/bt8xx/bttv-risc.c b/drivers/media/pci/bt8xx/bttv-risc.c
index 3859dde98be2..3185c4ae2269 100644
--- a/drivers/media/pci/bt8xx/bttv-risc.c
+++ b/drivers/media/pci/bt8xx/bttv-risc.c
@@ -255,7 +255,7 @@ bttv_risc_overlay(struct bttv *btv, struct btcx_riscmem *risc,
u32 addr;
/* skip list for window clipping */
- if (NULL == (skips = kmalloc(sizeof(*skips) * ov->nclips,GFP_KERNEL)))
+ if (NULL == (skips = kmalloc(array_size(sizeof(*skips), ov->nclips), GFP_KERNEL)))
return -ENOMEM;
/* estimate risc mem: worst case is (1.5*clip+1) * lines instructions
diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c
index 44936d6d7c39..3a03251068b4 100644
--- a/drivers/media/pci/ivtv/ivtv-yuv.c
+++ b/drivers/media/pci/ivtv/ivtv-yuv.c
@@ -935,7 +935,8 @@ static void ivtv_yuv_init(struct ivtv *itv)
}
/* We need a buffer for blanking when Y plane is offset - non-fatal if we can't get one */
- yi->blanking_ptr = kzalloc(720 * 16, GFP_KERNEL|__GFP_NOWARN);
+ yi->blanking_ptr = kzalloc(array_size(720, 16),
+ GFP_KERNEL | __GFP_NOWARN);
if (yi->blanking_ptr) {
yi->blanking_dmaptr = pci_map_single(itv->pdev, yi->blanking_ptr, 720*16, PCI_DMA_TODEVICE);
} else {
diff --git a/drivers/media/pci/saa7164/saa7164-fw.c b/drivers/media/pci/saa7164/saa7164-fw.c
index ef4906406ebf..5d6b62cd39bd 100644
--- a/drivers/media/pci/saa7164/saa7164-fw.c
+++ b/drivers/media/pci/saa7164/saa7164-fw.c
@@ -89,7 +89,7 @@ static int saa7164_downloadimage(struct saa7164_dev *dev, u8 *src, u32 srcsize,
goto out;
}
- srcbuf = kzalloc(4 * 1048576, GFP_KERNEL);
+ srcbuf = kzalloc(array_size(4, 1048576), GFP_KERNEL);
if (NULL == srcbuf) {
ret = -ENOMEM;
goto out;
diff --git a/drivers/media/pci/zoran/zoran_card.c b/drivers/media/pci/zoran/zoran_card.c
index a6b9ebd20263..4efe363f96cf 100644
--- a/drivers/media/pci/zoran/zoran_card.c
+++ b/drivers/media/pci/zoran/zoran_card.c
@@ -1028,7 +1028,7 @@ static int zr36057_init (struct zoran *zr)
/* allocate memory *before* doing anything to the hardware
* in case allocation fails */
- zr->stat_com = kzalloc(BUZ_NUM_STAT_COM * 4, GFP_KERNEL);
+ zr->stat_com = kzalloc(array_size(BUZ_NUM_STAT_COM, 4), GFP_KERNEL);
zr->video_dev = video_device_alloc();
if (!zr->stat_com || !zr->video_dev) {
dprintk(1,
diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
index 14f9c0e26a1c..1296dafb7c4d 100644
--- a/drivers/media/pci/zoran/zoran_driver.c
+++ b/drivers/media/pci/zoran/zoran_driver.c
@@ -941,7 +941,7 @@ static int zoran_open(struct file *file)
/* used to be BUZ_MAX_WIDTH/HEIGHT, but that gives overflows
* on norm-change! */
fh->overlay_mask =
- kmalloc(((768 + 31) / 32) * 576 * 4, GFP_KERNEL);
+ kmalloc(array3_size(((768 + 31) / 32), 576, 4), GFP_KERNEL);
if (!fh->overlay_mask) {
dprintk(1,
KERN_ERR
diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
index 82ec216f2ad8..9042f17de0bc 100644
--- a/drivers/media/platform/vivid/vivid-core.c
+++ b/drivers/media/platform/vivid/vivid-core.c
@@ -859,8 +859,8 @@ static int vivid_create_instance(struct platform_device *pdev, int inst)
/* create a string array containing the names of all the preset timings */
while (v4l2_dv_timings_presets[dev->query_dv_timings_size].bt.width)
dev->query_dv_timings_size++;
- dev->query_dv_timings_qmenu = kmalloc(dev->query_dv_timings_size *
- (sizeof(void *) + 32), GFP_KERNEL);
+ dev->query_dv_timings_qmenu = kmalloc(array_size(dev->query_dv_timings_size, (sizeof(void *) + 32)),
+ GFP_KERNEL);
if (dev->query_dv_timings_qmenu == NULL)
goto free_dev;
for (i = 0; i < dev->query_dv_timings_size; i++) {
diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c
index 4df3bd312f48..a86889992dc7 100644
--- a/drivers/media/spi/cxd2880-spi.c
+++ b/drivers/media/spi/cxd2880-spi.c
@@ -398,7 +398,7 @@ static int cxd2880_start_feed(struct dvb_demux_feed *feed)
if (dvb_spi->feed_count == 0) {
dvb_spi->ts_buf =
- kmalloc(MAX_TRANS_PKT * 188,
+ kmalloc(array_size(MAX_TRANS_PKT, 188),
GFP_KERNEL | GFP_DMA);
if (!dvb_spi->ts_buf) {
pr_err("ts buffer allocate failed\n");
diff --git a/drivers/media/usb/cx231xx/cx231xx-audio.c b/drivers/media/usb/cx231xx/cx231xx-audio.c
index d96236d786d1..651f5381f3b3 100644
--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -710,7 +710,8 @@ static int cx231xx_audio_init(struct cx231xx *dev)
dev_info(dev->dev,
"audio EndPoint Addr 0x%x, Alternate settings: %i\n",
adev->end_point_addr, adev->num_alt);
- adev->alt_max_pkt_size = kmalloc(32 * adev->num_alt, GFP_KERNEL);
+ adev->alt_max_pkt_size = kmalloc(array_size(32, adev->num_alt),
+ GFP_KERNEL);
if (!adev->alt_max_pkt_size) {
err = -ENOMEM;
goto err_free_card;
diff --git a/drivers/media/usb/go7007/go7007-fw.c b/drivers/media/usb/go7007/go7007-fw.c
index 60bf5f0644d1..8ff27ee28703 100644
--- a/drivers/media/usb/go7007/go7007-fw.c
+++ b/drivers/media/usb/go7007/go7007-fw.c
@@ -1576,7 +1576,7 @@ int go7007_construct_fw_image(struct go7007 *go, u8 **fw, int *fwlen)
GO7007_FW_NAME);
return -1;
}
- code = kzalloc(codespace * 2, GFP_KERNEL);
+ code = kzalloc(array_size(codespace, 2), GFP_KERNEL);
if (code == NULL)
goto fw_failed;
diff --git a/drivers/media/usb/gspca/t613.c b/drivers/media/usb/gspca/t613.c
index 0ae557cd15ef..36b87e714de4 100644
--- a/drivers/media/usb/gspca/t613.c
+++ b/drivers/media/usb/gspca/t613.c
@@ -363,7 +363,7 @@ static void reg_w_ixbuf(struct gspca_dev *gspca_dev,
if (len * 2 <= USB_BUF_SZ) {
p = tmpbuf = gspca_dev->usb_buf;
} else {
- p = tmpbuf = kmalloc(len * 2, GFP_KERNEL);
+ p = tmpbuf = kmalloc(array_size(len, 2), GFP_KERNEL);
if (!tmpbuf) {
pr_err("Out of memory\n");
return;
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
index e0353161ccd6..72dde82f3ade 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
@@ -2413,7 +2413,7 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
hdw->control_cnt = CTRLDEF_COUNT;
hdw->control_cnt += MPEGDEF_COUNT;
- hdw->controls = kzalloc(sizeof(struct pvr2_ctrl) * hdw->control_cnt,
+ hdw->controls = kzalloc(array_size(sizeof(struct pvr2_ctrl), hdw->control_cnt),
GFP_KERNEL);
if (!hdw->controls) goto fail;
hdw->hdw_desc = hdw_desc;
diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c
index bea8bbbb84fb..93a0daaaf03f 100644
--- a/drivers/media/usb/stk1160/stk1160-core.c
+++ b/drivers/media/usb/stk1160/stk1160-core.c
@@ -288,8 +288,8 @@ static int stk1160_probe(struct usb_interface *interface,
return -ENODEV;
/* Alloc an array for all possible max_pkt_size */
- alt_max_pkt_size = kmalloc(sizeof(alt_max_pkt_size[0]) *
- interface->num_altsetting, GFP_KERNEL);
+ alt_max_pkt_size = kmalloc(array_size(sizeof(alt_max_pkt_size[0]), interface->num_altsetting),
+ GFP_KERNEL);
if (alt_max_pkt_size == NULL)
return -ENOMEM;
diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
index 0f5954a1fea2..fd54491c1c0c 100644
--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -1492,7 +1492,8 @@ static int usbvision_probe(struct usb_interface *intf,
usbvision->num_alt = uif->num_altsetting;
PDEBUG(DBG_PROBE, "Alternate settings: %i", usbvision->num_alt);
- usbvision->alt_max_pkt_size = kmalloc(32 * usbvision->num_alt, GFP_KERNEL);
+ usbvision->alt_max_pkt_size = kmalloc(array_size(32, usbvision->num_alt),
+ GFP_KERNEL);
if (!usbvision->alt_max_pkt_size) {
ret = -ENOMEM;
goto err_pkt;
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index aa0082fe5833..22dbc3067e33 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -501,7 +501,7 @@ static int uvc_video_clock_init(struct uvc_streaming *stream)
spin_lock_init(&clock->lock);
clock->size = 32;
- clock->samples = kmalloc(clock->size * sizeof(*clock->samples),
+ clock->samples = kmalloc(array_size(clock->size, sizeof(*clock->samples)),
GFP_KERNEL);
if (clock->samples == NULL)
return -ENOMEM;
diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
index 7770034aae28..631fe7aa2784 100644
--- a/drivers/media/v4l2-core/videobuf-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
@@ -175,7 +175,8 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
dma->offset = data & ~PAGE_MASK;
dma->size = size;
dma->nr_pages = last-first+1;
- dma->pages = kmalloc(dma->nr_pages * sizeof(struct page *), GFP_KERNEL);
+ dma->pages = kmalloc(array_size(dma->nr_pages, sizeof(struct page *)),
+ GFP_KERNEL);
if (NULL == dma->pages)
return -ENOMEM;
diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index a3db881094e1..be04ccd7cd84 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -1342,7 +1342,8 @@ static int msb_ftl_initialize(struct msb_data *msb)
msb->used_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL);
msb->erased_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL);
msb->lba_to_pba_table =
- kmalloc(msb->logical_block_count * sizeof(u16), GFP_KERNEL);
+ kmalloc(array_size(msb->logical_block_count, sizeof(u16)),
+ GFP_KERNEL);
if (!msb->used_blocks_bitmap || !msb->lba_to_pba_table ||
!msb->erased_blocks_bitmap) {
diff --git a/drivers/message/fusion/mptlan.c b/drivers/message/fusion/mptlan.c
index 55dd71bbdc2a..a2b1766e52fb 100644
--- a/drivers/message/fusion/mptlan.c
+++ b/drivers/message/fusion/mptlan.c
@@ -394,7 +394,8 @@ mpt_lan_open(struct net_device *dev)
"a moment.\n");
}
- priv->mpt_txfidx = kmalloc(priv->tx_max_out * sizeof(int), GFP_KERNEL);
+ priv->mpt_txfidx = kmalloc(array_size(priv->tx_max_out, sizeof(int)),
+ GFP_KERNEL);
if (priv->mpt_txfidx == NULL)
goto out;
priv->mpt_txfidx_tail = -1;
@@ -408,7 +409,7 @@ mpt_lan_open(struct net_device *dev)
dlprintk((KERN_INFO MYNAM "@lo: Finished initializing SendCtl\n"));
- priv->mpt_rxfidx = kmalloc(priv->max_buckets_out * sizeof(int),
+ priv->mpt_rxfidx = kmalloc(array_size(priv->max_buckets_out, sizeof(int)),
GFP_KERNEL);
if (priv->mpt_rxfidx == NULL)
goto out_SendCtl;
diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c
index eafd06f62a3a..8fdb6d491ecc 100644
--- a/drivers/mfd/cros_ec_dev.c
+++ b/drivers/mfd/cros_ec_dev.c
@@ -306,13 +306,13 @@ static void cros_ec_sensors_register(struct cros_ec_dev *ec)
resp = (struct ec_response_motion_sense *)msg->data;
sensor_num = resp->dump.sensor_count;
/* Allocate 1 extra sensors in FIFO are needed */
- sensor_cells = kzalloc(sizeof(struct mfd_cell) * (sensor_num + 1),
+ sensor_cells = kzalloc(array_size(sizeof(struct mfd_cell), (sensor_num + 1)),
GFP_KERNEL);
if (sensor_cells == NULL)
goto error;
- sensor_platforms = kzalloc(sizeof(struct cros_ec_sensor_platform) *
- (sensor_num + 1), GFP_KERNEL);
+ sensor_platforms = kzalloc(array_size(sizeof(struct cros_ec_sensor_platform), (sensor_num + 1)),
+ GFP_KERNEL);
if (sensor_platforms == NULL)
goto error_platforms;
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index c57e407020f1..1af9c406b192 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -158,7 +158,8 @@ static int mfd_add_device(struct device *parent, int id,
if (!pdev)
goto fail_alloc;
- res = kzalloc(sizeof(*res) * cell->num_resources, GFP_KERNEL);
+ res = kzalloc(array_size(sizeof(*res), cell->num_resources),
+ GFP_KERNEL);
if (!res)
goto fail_device;
diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c
index 34a5a41578d7..967f522a22a8 100644
--- a/drivers/misc/eeprom/idt_89hpesx.c
+++ b/drivers/misc/eeprom/idt_89hpesx.c
@@ -964,7 +964,8 @@ static ssize_t idt_dbgfs_csr_write(struct file *filep, const char __user *ubuf,
if (colon_ch != NULL) {
csraddr_len = colon_ch - buf;
csraddr_str =
- kmalloc(sizeof(char)*(csraddr_len + 1), GFP_KERNEL);
+ kmalloc(array_size(sizeof(char), (csraddr_len + 1)),
+ GFP_KERNEL);
if (csraddr_str == NULL) {
ret = -ENOMEM;
goto free_buf;
diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
index b7f8d35c17a9..f9c05dd7b7dc 100644
--- a/drivers/misc/genwqe/card_ddcb.c
+++ b/drivers/misc/genwqe/card_ddcb.c
@@ -1048,15 +1048,15 @@ static int setup_ddcb_queue(struct genwqe_dev *cd, struct ddcb_queue *queue)
"[%s] **err: could not allocate DDCB **\n", __func__);
return -ENOMEM;
}
- queue->ddcb_req = kzalloc(sizeof(struct ddcb_requ *) *
- queue->ddcb_max, GFP_KERNEL);
+ queue->ddcb_req = kzalloc(array_size(sizeof(struct ddcb_requ *), queue->ddcb_max),
+ GFP_KERNEL);
if (!queue->ddcb_req) {
rc = -ENOMEM;
goto free_ddcbs;
}
- queue->ddcb_waitqs = kzalloc(sizeof(wait_queue_head_t) *
- queue->ddcb_max, GFP_KERNEL);
+ queue->ddcb_waitqs = kzalloc(array_size(sizeof(wait_queue_head_t), queue->ddcb_max),
+ GFP_KERNEL);
if (!queue->ddcb_waitqs) {
rc = -ENOMEM;
goto free_requs;
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index 0c26eaf5f62b..1f4595132820 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -520,8 +520,8 @@ xpnet_init(void)
dev_info(xpnet, "registering network device %s\n", XPNET_DEVICE_NAME);
- xpnet_broadcast_partitions = kzalloc(BITS_TO_LONGS(xp_max_npartitions) *
- sizeof(long), GFP_KERNEL);
+ xpnet_broadcast_partitions = kzalloc(array_size(BITS_TO_LONGS(xp_max_npartitions), sizeof(long)),
+ GFP_KERNEL);
if (xpnet_broadcast_partitions == NULL)
return -ENOMEM;
diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
index fc0415771c00..a9d217c9afcc 100644
--- a/drivers/misc/sram.c
+++ b/drivers/misc/sram.c
@@ -185,7 +185,7 @@ static int sram_reserve_regions(struct sram_dev *sram, struct resource *res)
* after the reserved blocks from the dt are processed.
*/
nblocks = (np) ? of_get_available_child_count(np) + 1 : 1;
- rblocks = kzalloc((nblocks) * sizeof(*rblocks), GFP_KERNEL);
+ rblocks = kzalloc(array_size((nblocks), sizeof(*rblocks)), GFP_KERNEL);
if (!rblocks)
return -ENOMEM;
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index f5695be14499..cb1f2b1bfbac 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -608,8 +608,8 @@ static struct mtd_info *cfi_intelext_setup(struct mtd_info *mtd)
mtd->size = devsize * cfi->numchips;
mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips;
- mtd->eraseregions = kzalloc(sizeof(struct mtd_erase_region_info)
- * mtd->numeraseregions, GFP_KERNEL);
+ mtd->eraseregions = kzalloc(array_size(sizeof(struct mtd_erase_region_info), mtd->numeraseregions),
+ GFP_KERNEL);
if (!mtd->eraseregions)
goto setup_err;
@@ -758,7 +758,8 @@ static int cfi_intelext_partition_fixup(struct mtd_info *mtd,
newcfi = kmalloc(sizeof(struct cfi_private) + numvirtchips * sizeof(struct flchip), GFP_KERNEL);
if (!newcfi)
return -ENOMEM;
- shared = kmalloc(sizeof(struct flchip_shared) * cfi->numchips, GFP_KERNEL);
+ shared = kmalloc(array_size(sizeof(struct flchip_shared), cfi->numchips),
+ GFP_KERNEL);
if (!shared) {
kfree(newcfi);
return -ENOMEM;
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 8f23b305bf83..f4c250e692af 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -692,8 +692,8 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd)
mtd->size = devsize * cfi->numchips;
mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips;
- mtd->eraseregions = kmalloc(sizeof(struct mtd_erase_region_info)
- * mtd->numeraseregions, GFP_KERNEL);
+ mtd->eraseregions = kmalloc(array_size(sizeof(struct mtd_erase_region_info), mtd->numeraseregions),
+ GFP_KERNEL);
if (!mtd->eraseregions)
goto setup_err;
diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
index 7b7658a05036..9375f7aa4135 100644
--- a/drivers/mtd/chips/cfi_cmdset_0020.c
+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
@@ -184,8 +184,8 @@ static struct mtd_info *cfi_staa_setup(struct map_info *map)
mtd->size = devsize * cfi->numchips;
mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips;
- mtd->eraseregions = kmalloc(sizeof(struct mtd_erase_region_info)
- * mtd->numeraseregions, GFP_KERNEL);
+ mtd->eraseregions = kmalloc(array_size(sizeof(struct mtd_erase_region_info), mtd->numeraseregions),
+ GFP_KERNEL);
if (!mtd->eraseregions) {
kfree(cfi->cmdset_priv);
kfree(mtd);
diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
index ef6ad2551d57..75d0acf73395 100644
--- a/drivers/mtd/ftl.c
+++ b/drivers/mtd/ftl.c
@@ -201,15 +201,15 @@ static int build_maps(partition_t *part)
/* Set up erase unit maps */
part->DataUnits = le16_to_cpu(part->header.NumEraseUnits) -
part->header.NumTransferUnits;
- part->EUNInfo = kmalloc(part->DataUnits * sizeof(struct eun_info_t),
- GFP_KERNEL);
+ part->EUNInfo = kmalloc(array_size(part->DataUnits, sizeof(struct eun_info_t)),
+ GFP_KERNEL);
if (!part->EUNInfo)
goto out;
for (i = 0; i < part->DataUnits; i++)
part->EUNInfo[i].Offset = 0xffffffff;
part->XferInfo =
- kmalloc(part->header.NumTransferUnits * sizeof(struct xfer_info_t),
- GFP_KERNEL);
+ kmalloc(array_size(part->header.NumTransferUnits, sizeof(struct xfer_info_t)),
+ GFP_KERNEL);
if (!part->XferInfo)
goto out_EUNInfo;
@@ -269,8 +269,8 @@ static int build_maps(partition_t *part)
memset(part->VirtualBlockMap, 0xff, blocks * sizeof(uint32_t));
part->BlocksPerUnit = (1 << header.EraseUnitSize) >> header.BlockSize;
- part->bam_cache = kmalloc(part->BlocksPerUnit * sizeof(uint32_t),
- GFP_KERNEL);
+ part->bam_cache = kmalloc(array_size(part->BlocksPerUnit, sizeof(uint32_t)),
+ GFP_KERNEL);
if (!part->bam_cache)
goto out_VirtualBlockMap;
diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
index aab4f68bd36f..c5b8e5c54ac6 100644
--- a/drivers/mtd/inftlmount.c
+++ b/drivers/mtd/inftlmount.c
@@ -270,7 +270,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
inftl->nb_blocks = ip->lastUnit + 1;
/* Memory alloc */
- inftl->PUtable = kmalloc(inftl->nb_blocks * sizeof(u16), GFP_KERNEL);
+ inftl->PUtable = kmalloc(array_size(inftl->nb_blocks, sizeof(u16)),
+ GFP_KERNEL);
if (!inftl->PUtable) {
printk(KERN_WARNING "INFTL: allocation of PUtable "
"failed (%zd bytes)\n",
@@ -278,7 +279,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
return -ENOMEM;
}
- inftl->VUtable = kmalloc(inftl->nb_blocks * sizeof(u16), GFP_KERNEL);
+ inftl->VUtable = kmalloc(array_size(inftl->nb_blocks, sizeof(u16)),
+ GFP_KERNEL);
if (!inftl->VUtable) {
kfree(inftl->PUtable);
printk(KERN_WARNING "INFTL: allocation of VUtable "
diff --git a/drivers/mtd/lpddr/lpddr_cmds.c b/drivers/mtd/lpddr/lpddr_cmds.c
index 5c5ba3c7c79d..fc11a0c6b20f 100644
--- a/drivers/mtd/lpddr/lpddr_cmds.c
+++ b/drivers/mtd/lpddr/lpddr_cmds.c
@@ -78,8 +78,8 @@ struct mtd_info *lpddr_cmdset(struct map_info *map)
mtd->erasesize = 1 << lpddr->qinfo->UniformBlockSizeShift;
mtd->writesize = 1 << lpddr->qinfo->BufSizeShift;
- shared = kmalloc(sizeof(struct flchip_shared) * lpddr->numchips,
- GFP_KERNEL);
+ shared = kmalloc(array_size(sizeof(struct flchip_shared), lpddr->numchips),
+ GFP_KERNEL);
if (!shared) {
kfree(lpddr);
kfree(mtd);
diff --git a/drivers/mtd/maps/physmap_of_core.c b/drivers/mtd/maps/physmap_of_core.c
index 8f859b488a98..a064ff24dc83 100644
--- a/drivers/mtd/maps/physmap_of_core.c
+++ b/drivers/mtd/maps/physmap_of_core.c
@@ -124,7 +124,7 @@ static const char * const *of_get_probes(struct device_node *dp)
if (count < 0)
return part_probe_types_def;
- res = kzalloc((count + 1) * sizeof(*res), GFP_KERNEL);
+ res = kzalloc(array_size((count + 1), sizeof(*res)), GFP_KERNEL);
if (!res)
return NULL;
diff --git a/drivers/mtd/maps/vmu-flash.c b/drivers/mtd/maps/vmu-flash.c
index 6b223cfe92b7..45a7fb236905 100644
--- a/drivers/mtd/maps/vmu-flash.c
+++ b/drivers/mtd/maps/vmu-flash.c
@@ -629,15 +629,15 @@ static int vmu_connect(struct maple_device *mdev)
* Not sure there are actually any multi-partition devices in the
* real world, but the hardware supports them, so, so will we
*/
- card->parts = kmalloc(sizeof(struct vmupart) * card->partitions,
- GFP_KERNEL);
+ card->parts = kmalloc(array_size(sizeof(struct vmupart), card->partitions),
+ GFP_KERNEL);
if (!card->parts) {
error = -ENOMEM;
goto fail_partitions;
}
- card->mtd = kmalloc(sizeof(struct mtd_info) * card->partitions,
- GFP_KERNEL);
+ card->mtd = kmalloc(array_size(sizeof(struct mtd_info), card->partitions),
+ GFP_KERNEL);
if (!card->mtd) {
error = -ENOMEM;
goto fail_mtd_info;
diff --git a/drivers/mtd/mtdswap.c b/drivers/mtd/mtdswap.c
index 7161f8a17f62..239668f07916 100644
--- a/drivers/mtd/mtdswap.c
+++ b/drivers/mtd/mtdswap.c
@@ -1340,7 +1340,7 @@ static int mtdswap_init(struct mtdswap_dev *d, unsigned int eblocks,
if (!d->page_buf)
goto page_buf_fail;
- d->oob_buf = kmalloc(2 * mtd->oobavail, GFP_KERNEL);
+ d->oob_buf = kmalloc(array_size(2, mtd->oobavail), GFP_KERNEL);
if (!d->oob_buf)
goto oob_buf_fail;
diff --git a/drivers/mtd/nand/onenand/onenand_base.c b/drivers/mtd/nand/onenand/onenand_base.c
index b7105192cb12..153a8a280878 100644
--- a/drivers/mtd/nand/onenand/onenand_base.c
+++ b/drivers/mtd/nand/onenand/onenand_base.c
@@ -3721,8 +3721,8 @@ static int onenand_probe(struct mtd_info *mtd)
this->dies = ONENAND_IS_DDP(this) ? 2 : 1;
/* Maximum possible erase regions */
mtd->numeraseregions = this->dies << 1;
- mtd->eraseregions = kzalloc(sizeof(struct mtd_erase_region_info)
- * (this->dies << 1), GFP_KERNEL);
+ mtd->eraseregions = kzalloc(array_size(sizeof(struct mtd_erase_region_info), (this->dies << 1)),
+ GFP_KERNEL);
if (!mtd->eraseregions)
return -ENOMEM;
}
diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
index a6fbfa4e5799..37e8fcdc268c 100644
--- a/drivers/mtd/nftlmount.c
+++ b/drivers/mtd/nftlmount.c
@@ -199,13 +199,15 @@ device is already correct.
nftl->lastEUN = nftl->nb_blocks - 1;
/* memory alloc */
- nftl->EUNtable = kmalloc(nftl->nb_blocks * sizeof(u16), GFP_KERNEL);
+ nftl->EUNtable = kmalloc(array_size(nftl->nb_blocks, sizeof(u16)),
+ GFP_KERNEL);
if (!nftl->EUNtable) {
printk(KERN_NOTICE "NFTL: allocation of EUNtable failed\n");
return -ENOMEM;
}
- nftl->ReplUnitTable = kmalloc(nftl->nb_blocks * sizeof(u16), GFP_KERNEL);
+ nftl->ReplUnitTable = kmalloc(array_size(nftl->nb_blocks, sizeof(u16)),
+ GFP_KERNEL);
if (!nftl->ReplUnitTable) {
kfree(nftl->EUNtable);
printk(KERN_NOTICE "NFTL: allocation of ReplUnitTable failed\n");
diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
index 79636349df96..389057bdd5e8 100644
--- a/drivers/mtd/sm_ftl.c
+++ b/drivers/mtd/sm_ftl.c
@@ -82,8 +82,8 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
/* Create array of pointers to the attributes */
- attributes = kzalloc(sizeof(struct attribute *) * (NUM_ATTRIBUTES + 1),
- GFP_KERNEL);
+ attributes = kzalloc(array_size(sizeof(struct attribute *), (NUM_ATTRIBUTES + 1)),
+ GFP_KERNEL);
if (!attributes)
goto error3;
attributes[0] = &vendor_attribute->dev_attr.attr;
@@ -750,7 +750,8 @@ static int sm_init_zone(struct sm_ftl *ftl, int zone_num)
dbg("initializing zone %d", zone_num);
/* Allocate memory for FTL table */
- zone->lba_to_phys_table = kmalloc(ftl->max_lba * 2, GFP_KERNEL);
+ zone->lba_to_phys_table = kmalloc(array_size(ftl->max_lba, 2),
+ GFP_KERNEL);
if (!zone->lba_to_phys_table)
return -ENOMEM;
@@ -1137,8 +1138,8 @@ static void sm_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
goto error2;
/* Allocate zone array, it will be initialized on demand */
- ftl->zones = kzalloc(sizeof(struct ftl_zone) * ftl->zone_count,
- GFP_KERNEL);
+ ftl->zones = kzalloc(array_size(sizeof(struct ftl_zone), ftl->zone_count),
+ GFP_KERNEL);
if (!ftl->zones)
goto error3;
diff --git a/drivers/mtd/ssfdc.c b/drivers/mtd/ssfdc.c
index 95f0bf95f095..aa363182e012 100644
--- a/drivers/mtd/ssfdc.c
+++ b/drivers/mtd/ssfdc.c
@@ -332,8 +332,8 @@ static void ssfdcr_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
(long)ssfdc->sectors;
/* Allocate logical block map */
- ssfdc->logic_block_map = kmalloc(sizeof(ssfdc->logic_block_map[0]) *
- ssfdc->map_len, GFP_KERNEL);
+ ssfdc->logic_block_map = kmalloc(array_size(sizeof(ssfdc->logic_block_map[0]), ssfdc->map_len),
+ GFP_KERNEL);
if (!ssfdc->logic_block_map)
goto out_err;
memset(ssfdc->logic_block_map, 0xff, sizeof(ssfdc->logic_block_map[0]) *
diff --git a/drivers/mtd/tests/pagetest.c b/drivers/mtd/tests/pagetest.c
index bc303cac9f43..71c34bfdfc68 100644
--- a/drivers/mtd/tests/pagetest.c
+++ b/drivers/mtd/tests/pagetest.c
@@ -127,7 +127,7 @@ static int crosstest(void)
unsigned char *pp1, *pp2, *pp3, *pp4;
pr_info("crosstest\n");
- pp1 = kzalloc(pgsize * 4, GFP_KERNEL);
+ pp1 = kzalloc(array_size(pgsize, 4), GFP_KERNEL);
if (!pp1)
return -ENOMEM;
pp2 = pp1 + pgsize;
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index 5d09fde485e5..763c8e0fbd28 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -1443,14 +1443,14 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
if (!vol)
continue;
- scan_eba[i] = kmalloc(vol->reserved_pebs * sizeof(**scan_eba),
+ scan_eba[i] = kmalloc(array_size(vol->reserved_pebs, sizeof(**scan_eba)),
GFP_KERNEL);
if (!scan_eba[i]) {
ret = -ENOMEM;
goto out_free;
}
- fm_eba[i] = kmalloc(vol->reserved_pebs * sizeof(**fm_eba),
+ fm_eba[i] = kmalloc(array_size(vol->reserved_pebs, sizeof(**fm_eba)),
GFP_KERNEL);
if (!fm_eba[i]) {
ret = -ENOMEM;
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 2052a647220e..12f9f9254e3f 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -1594,7 +1594,8 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
sprintf(ubi->bgt_name, UBI_BGT_NAME_PATTERN, ubi->ubi_num);
err = -ENOMEM;
- ubi->lookuptbl = kzalloc(ubi->peb_count * sizeof(void *), GFP_KERNEL);
+ ubi->lookuptbl = kzalloc(array_size(ubi->peb_count, sizeof(void *)),
+ GFP_KERNEL);
if (!ubi->lookuptbl)
return err;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 718e4914e3a0..deb0230a1f0a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2390,7 +2390,8 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,
struct list_head *iter;
if (start_dev == end_dev) {
- tags = kzalloc(sizeof(*tags) * (level + 1), GFP_ATOMIC);
+ tags = kzalloc(array_size(sizeof(*tags), (level + 1)),
+ GFP_ATOMIC);
if (!tags)
return ERR_PTR(-ENOMEM);
tags[level].vlan_proto = VLAN_N_VID;
diff --git a/drivers/net/can/grcan.c b/drivers/net/can/grcan.c
index 2d3046afa80d..65656aa8758f 100644
--- a/drivers/net/can/grcan.c
+++ b/drivers/net/can/grcan.c
@@ -1057,7 +1057,7 @@ static int grcan_open(struct net_device *dev)
return err;
}
- priv->echo_skb = kzalloc(dma->tx.size * sizeof(*priv->echo_skb),
+ priv->echo_skb = kzalloc(array_size(dma->tx.size, sizeof(*priv->echo_skb)),
GFP_KERNEL);
if (!priv->echo_skb) {
err = -ENOMEM;
@@ -1066,7 +1066,8 @@ static int grcan_open(struct net_device *dev)
priv->can.echo_skb_max = dma->tx.size;
priv->can.echo_skb = priv->echo_skb;
- priv->txdlc = kzalloc(dma->tx.size * sizeof(*priv->txdlc), GFP_KERNEL);
+ priv->txdlc = kzalloc(array_size(dma->tx.size, sizeof(*priv->txdlc)),
+ GFP_KERNEL);
if (!priv->txdlc) {
err = -ENOMEM;
goto exit_free_echo_skb;
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c b/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
index cfe86a20c899..fc0b0680d498 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
@@ -209,8 +209,8 @@ static int atl1c_get_eeprom(struct net_device *netdev,
first_dword = eeprom->offset >> 2;
last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
- eeprom_buff = kmalloc(sizeof(u32) *
- (last_dword - first_dword + 1), GFP_KERNEL);
+ eeprom_buff = kmalloc(array_size(sizeof(u32), (last_dword - first_dword + 1)),
+ GFP_KERNEL);
if (eeprom_buff == NULL)
return -ENOMEM;
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c b/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
index cb489e7e8374..c56e89304b0e 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
@@ -236,8 +236,8 @@ static int atl1e_get_eeprom(struct net_device *netdev,
first_dword = eeprom->offset >> 2;
last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
- eeprom_buff = kmalloc(sizeof(u32) *
- (last_dword - first_dword + 1), GFP_KERNEL);
+ eeprom_buff = kmalloc(array_size(sizeof(u32), (last_dword - first_dword + 1)),
+ GFP_KERNEL);
if (eeprom_buff == NULL)
return -ENOMEM;
diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
index db4bcc51023a..d714a93bb31d 100644
--- a/drivers/net/ethernet/atheros/atlx/atl2.c
+++ b/drivers/net/ethernet/atheros/atlx/atl2.c
@@ -1941,8 +1941,8 @@ static int atl2_get_eeprom(struct net_device *netdev,
first_dword = eeprom->offset >> 2;
last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
- eeprom_buff = kmalloc(sizeof(u32) * (last_dword - first_dword + 1),
- GFP_KERNEL);
+ eeprom_buff = kmalloc(array_size(sizeof(u32), (last_dword - first_dword + 1)),
+ GFP_KERNEL);
if (!eeprom_buff)
return -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
index 14a59e51db67..338e2c891b0c 100644
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -2150,7 +2150,7 @@ static int bcm_enetsw_open(struct net_device *dev)
priv->tx_desc_alloc_size = size;
priv->tx_desc_cpu = p;
- priv->tx_skb = kzalloc(sizeof(struct sk_buff *) * priv->tx_ring_size,
+ priv->tx_skb = kzalloc(array_size(sizeof(struct sk_buff *), priv->tx_ring_size),
GFP_KERNEL);
if (!priv->tx_skb) {
dev_err(kdev, "cannot allocate rx skb queue\n");
@@ -2164,7 +2164,7 @@ static int bcm_enetsw_open(struct net_device *dev)
spin_lock_init(&priv->tx_lock);
/* init & fill rx ring with skbs */
- priv->rx_skb = kzalloc(sizeof(struct sk_buff *) * priv->rx_ring_size,
+ priv->rx_skb = kzalloc(array_size(sizeof(struct sk_buff *), priv->rx_ring_size),
GFP_KERNEL);
if (!priv->rx_skb) {
dev_err(kdev, "cannot allocate rx skb queue\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 5d1d54478ef2..1ba2eba7795c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1253,8 +1253,8 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param,
num_vfs_param, iov->nr_virtfn);
/* allocate the vf array */
- bp->vfdb->vfs = kzalloc(sizeof(struct bnx2x_virtf) *
- BNX2X_NR_VIRTFN(bp), GFP_KERNEL);
+ bp->vfdb->vfs = kzalloc(array_size(sizeof(struct bnx2x_virtf), BNX2X_NR_VIRTFN(bp)),
+ GFP_KERNEL);
if (!bp->vfdb->vfs) {
BNX2X_ERR("failed to allocate vf array\n");
err = -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index f23611362756..2fb2b30383f2 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -660,7 +660,8 @@ static int cnic_init_id_tbl(struct cnic_id_tbl *id_tbl, u32 size, u32 start_id,
id_tbl->max = size;
id_tbl->next = next;
spin_lock_init(&id_tbl->lock);
- id_tbl->table = kzalloc(DIV_ROUND_UP(size, 32) * 4, GFP_KERNEL);
+ id_tbl->table = kzalloc(array_size(DIV_ROUND_UP(size, 32), 4),
+ GFP_KERNEL);
if (!id_tbl->table)
return -ENOMEM;
@@ -1260,8 +1261,8 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
if (!cp->iscsi_tbl)
goto error;
- cp->ctx_tbl = kzalloc(sizeof(struct cnic_context) *
- cp->max_cid_space, GFP_KERNEL);
+ cp->ctx_tbl = kzalloc(array_size(sizeof(struct cnic_context), cp->max_cid_space),
+ GFP_KERNEL);
if (!cp->ctx_tbl)
goto error;
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index 30685a7e27ff..198cca6c7ee2 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -3182,7 +3182,7 @@ bnad_set_rx_mcast_fltr(struct bnad *bnad)
if (mc_count > bna_attr(&bnad->bna)->num_mcmac)
goto mode_allmulti;
- mac_list = kzalloc((mc_count + 1) * ETH_ALEN, GFP_ATOMIC);
+ mac_list = kzalloc(array_size((mc_count + 1), ETH_ALEN), GFP_ATOMIC);
if (mac_list == NULL)
goto mode_allmulti;
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index d42704d07484..871826b2a143 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -292,8 +292,8 @@ static int nicvf_init_rbdr(struct nicvf *nic, struct rbdr *rbdr,
rbdr->is_xdp = true;
}
rbdr->pgcnt = roundup_pow_of_two(rbdr->pgcnt);
- rbdr->pgcache = kzalloc(sizeof(*rbdr->pgcache) *
- rbdr->pgcnt, GFP_KERNEL);
+ rbdr->pgcache = kzalloc(array_size(sizeof(*rbdr->pgcache), rbdr->pgcnt),
+ GFP_KERNEL);
if (!rbdr->pgcache)
return -ENOMEM;
rbdr->pgidx = 0;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 24d2865b8806..480d0a472bed 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -708,7 +708,7 @@ int cxgb4_write_rss(const struct port_info *pi, const u16 *queues)
const struct sge_eth_rxq *rxq;
rxq = &adapter->sge.ethrxq[pi->first_qset];
- rss = kmalloc(pi->rss_size * sizeof(u16), GFP_KERNEL);
+ rss = kmalloc(array_size(pi->rss_size, sizeof(u16)), GFP_KERNEL);
if (!rss)
return -ENOMEM;
@@ -4948,7 +4948,7 @@ static int enable_msix(struct adapter *adap)
max_ingq += (MAX_OFLD_QSETS * adap->num_uld);
if (is_offload(adap))
max_ingq += (MAX_OFLD_QSETS * adap->num_ofld_uld);
- entries = kmalloc(sizeof(*entries) * (max_ingq + 1),
+ entries = kmalloc(array_size(sizeof(*entries), (max_ingq + 1)),
GFP_KERNEL);
if (!entries)
return -ENOMEM;
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index a96b838cffce..787487a64409 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -2253,8 +2253,7 @@ static int ucc_geth_alloc_tx(struct ucc_geth_private *ugeth)
/* Init Tx bds */
for (j = 0; j < ug_info->numQueuesTx; j++) {
/* Setup the skbuff rings */
- ugeth->tx_skbuff[j] = kmalloc(sizeof(struct sk_buff *) *
- ugeth->ug_info->bdRingLenTx[j],
+ ugeth->tx_skbuff[j] = kmalloc(array_size(sizeof(struct sk_buff *), ugeth->ug_info->bdRingLenTx[j]),
GFP_KERNEL);
if (ugeth->tx_skbuff[j] == NULL) {
@@ -2326,8 +2325,7 @@ static int ucc_geth_alloc_rx(struct ucc_geth_private *ugeth)
/* Init Rx bds */
for (j = 0; j < ug_info->numQueuesRx; j++) {
/* Setup the skbuff rings */
- ugeth->rx_skbuff[j] = kmalloc(sizeof(struct sk_buff *) *
- ugeth->ug_info->bdRingLenRx[j],
+ ugeth->rx_skbuff[j] = kmalloc(array_size(sizeof(struct sk_buff *), ugeth->ug_info->bdRingLenRx[j]),
GFP_KERNEL);
if (ugeth->rx_skbuff[j] == NULL) {
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 1ccb6443d2ed..f676cab05cf9 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -2197,7 +2197,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv)
return -EINVAL;
}
- priv->ring_data = kzalloc(h->q_num * sizeof(*priv->ring_data) * 2,
+ priv->ring_data = kzalloc(array3_size(h->q_num, sizeof(*priv->ring_data), 2),
GFP_KERNEL);
if (!priv->ring_data)
return -ENOMEM;
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index c1b51edaaf62..2e30b088acb1 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -171,7 +171,8 @@ static int ibmveth_alloc_buffer_pool(struct ibmveth_buff_pool *pool)
{
int i;
- pool->free_map = kmalloc(sizeof(u16) * pool->size, GFP_KERNEL);
+ pool->free_map = kmalloc(array_size(sizeof(u16), pool->size),
+ GFP_KERNEL);
if (!pool->free_map)
return -1;
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index 3e80ca170dd7..2414180c49e9 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -456,8 +456,8 @@ static int e1000_get_eeprom(struct net_device *netdev,
first_word = eeprom->offset >> 1;
last_word = (eeprom->offset + eeprom->len - 1) >> 1;
- eeprom_buff = kmalloc(sizeof(u16) *
- (last_word - first_word + 1), GFP_KERNEL);
+ eeprom_buff = kmalloc(array_size(sizeof(u16), (last_word - first_word + 1)),
+ GFP_KERNEL);
if (!eeprom_buff)
return -ENOMEM;
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index 64dc0c11147f..1ba1cd9a7a59 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -528,7 +528,7 @@ static int e1000_get_eeprom(struct net_device *netdev,
first_word = eeprom->offset >> 1;
last_word = (eeprom->offset + eeprom->len - 1) >> 1;
- eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
+ eeprom_buff = kmalloc(array_size(sizeof(u16), (last_word - first_word + 1)),
GFP_KERNEL);
if (!eeprom_buff)
return -ENOMEM;
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index ec4a9759a6f2..11791980e815 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3331,7 +3331,8 @@ static int e1000e_write_mc_addr_list(struct net_device *netdev)
return 0;
}
- mta_list = kzalloc(netdev_mc_count(netdev) * ETH_ALEN, GFP_ATOMIC);
+ mta_list = kzalloc(array_size(netdev_mc_count(netdev), ETH_ALEN),
+ GFP_ATOMIC);
if (!mta_list)
return -ENOMEM;
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index e77ba0d5866d..7c96a34c1460 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -757,8 +757,8 @@ static int igb_get_eeprom(struct net_device *netdev,
first_word = eeprom->offset >> 1;
last_word = (eeprom->offset + eeprom->len - 1) >> 1;
- eeprom_buff = kmalloc(sizeof(u16) *
- (last_word - first_word + 1), GFP_KERNEL);
+ eeprom_buff = kmalloc(array_size(sizeof(u16), (last_word - first_word + 1)),
+ GFP_KERNEL);
if (!eeprom_buff)
return -ENOMEM;
@@ -3203,7 +3203,7 @@ static int igb_get_module_eeprom(struct net_device *netdev,
first_word = ee->offset >> 1;
last_word = (ee->offset + ee->len - 1) >> 1;
- dataword = kmalloc(sizeof(u16) * (last_word - first_word + 1),
+ dataword = kmalloc(array_size(sizeof(u16), (last_word - first_word + 1)),
GFP_KERNEL);
if (!dataword)
return -ENOMEM;
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index cce7ada89255..c5471a95702b 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3533,8 +3533,8 @@ static int igb_sw_init(struct igb_adapter *adapter)
/* Assume MSI-X interrupts, will be checked during IRQ allocation */
adapter->flags |= IGB_FLAG_HAS_MSIX;
- adapter->mac_table = kzalloc(sizeof(struct igb_mac_addr) *
- hw->mac.rar_entry_count, GFP_ATOMIC);
+ adapter->mac_table = kzalloc(array_size(sizeof(struct igb_mac_addr), hw->mac.rar_entry_count),
+ GFP_ATOMIC);
if (!adapter->mac_table)
return -ENOMEM;
@@ -4518,7 +4518,7 @@ static int igb_write_mc_addr_list(struct net_device *netdev)
return 0;
}
- mta_list = kzalloc(netdev_mc_count(netdev) * 6, GFP_ATOMIC);
+ mta_list = kzalloc(array_size(netdev_mc_count(netdev), 6), GFP_ATOMIC);
if (!mta_list)
return -ENOMEM;
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c b/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
index d10a0d242dda..d432c70dc77d 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
@@ -400,8 +400,8 @@ ixgb_get_eeprom(struct net_device *netdev,
first_word = eeprom->offset >> 1;
last_word = (eeprom->offset + eeprom->len - 1) >> 1;
- eeprom_buff = kmalloc(sizeof(__le16) *
- (last_word - first_word + 1), GFP_KERNEL);
+ eeprom_buff = kmalloc(array_size(sizeof(__le16), (last_word - first_word + 1)),
+ GFP_KERNEL);
if (!eeprom_buff)
return -ENOMEM;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index afadba99f7b8..4786e236cb90 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6136,8 +6136,7 @@ static int ixgbe_sw_init(struct ixgbe_adapter *adapter,
for (i = 1; i < IXGBE_MAX_LINK_HANDLE; i++)
adapter->jump_tables[i] = NULL;
- adapter->mac_table = kzalloc(sizeof(struct ixgbe_mac_addr) *
- hw->mac.num_rar_entries,
+ adapter->mac_table = kzalloc(array_size(sizeof(struct ixgbe_mac_addr), hw->mac.num_rar_entries),
GFP_ATOMIC);
if (!adapter->mac_table)
return -ENOMEM;
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 8a165842fa85..2b12e4bf2087 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -589,8 +589,8 @@ jme_setup_tx_resources(struct jme_adapter *jme)
atomic_set(&txring->next_to_clean, 0);
atomic_set(&txring->nr_free, jme->tx_ring_size);
- txring->bufinf = kzalloc(sizeof(struct jme_buffer_info) *
- jme->tx_ring_size, GFP_ATOMIC);
+ txring->bufinf = kzalloc(array_size(sizeof(struct jme_buffer_info), jme->tx_ring_size),
+ GFP_ATOMIC);
if (unlikely(!(txring->bufinf)))
goto err_free_txring;
@@ -838,8 +838,8 @@ jme_setup_rx_resources(struct jme_adapter *jme)
rxring->next_to_use = 0;
atomic_set(&rxring->next_to_clean, 0);
- rxring->bufinf = kzalloc(sizeof(struct jme_buffer_info) *
- jme->rx_ring_size, GFP_ATOMIC);
+ rxring->bufinf = kzalloc(array_size(sizeof(struct jme_buffer_info), jme->rx_ring_size),
+ GFP_ATOMIC);
if (unlikely(!(rxring->bufinf)))
goto err_free_rxring;
diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
index 6dabd983e7e0..37a3d1d24700 100644
--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
+++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
@@ -185,8 +185,8 @@ int mlx4_bitmap_init(struct mlx4_bitmap *bitmap, u32 num, u32 mask,
bitmap->avail = num - reserved_top - reserved_bot;
bitmap->effective_len = bitmap->avail;
spin_lock_init(&bitmap->lock);
- bitmap->table = kzalloc(BITS_TO_LONGS(bitmap->max) *
- sizeof(long), GFP_KERNEL);
+ bitmap->table = kzalloc(array_size(BITS_TO_LONGS(bitmap->max), sizeof(long)),
+ GFP_KERNEL);
if (!bitmap->table)
return -ENOMEM;
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index 6a9086dc1e92..3c0156c1c236 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2377,20 +2377,20 @@ int mlx4_multi_func_init(struct mlx4_dev *dev)
struct mlx4_vf_admin_state *vf_admin;
priv->mfunc.master.slave_state =
- kzalloc(dev->num_slaves *
- sizeof(struct mlx4_slave_state), GFP_KERNEL);
+ kzalloc(array_size(dev->num_slaves, sizeof(struct mlx4_slave_state)),
+ GFP_KERNEL);
if (!priv->mfunc.master.slave_state)
goto err_comm;
priv->mfunc.master.vf_admin =
- kzalloc(dev->num_slaves *
- sizeof(struct mlx4_vf_admin_state), GFP_KERNEL);
+ kzalloc(array_size(dev->num_slaves, sizeof(struct mlx4_vf_admin_state)),
+ GFP_KERNEL);
if (!priv->mfunc.master.vf_admin)
goto err_comm_admin;
priv->mfunc.master.vf_oper =
- kzalloc(dev->num_slaves *
- sizeof(struct mlx4_vf_oper_state), GFP_KERNEL);
+ kzalloc(array_size(dev->num_slaves, sizeof(struct mlx4_vf_oper_state)),
+ GFP_KERNEL);
if (!priv->mfunc.master.vf_oper)
goto err_comm_oper;
@@ -2636,9 +2636,8 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
int i;
int err = 0;
- priv->cmd.context = kmalloc(priv->cmd.max_cmds *
- sizeof(struct mlx4_cmd_context),
- GFP_KERNEL);
+ priv->cmd.context = kmalloc(array_size(priv->cmd.max_cmds, sizeof(struct mlx4_cmd_context)),
+ GFP_KERNEL);
if (!priv->cmd.context)
return -ENOMEM;
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 6f57c052053e..a956094e0706 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1211,7 +1211,7 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
}
priv->eq_table.irq_names =
- kmalloc(MLX4_IRQNAME_SIZE * (dev->caps.num_comp_vectors + 1),
+ kmalloc(array_size(MLX4_IRQNAME_SIZE, (dev->caps.num_comp_vectors + 1)),
GFP_KERNEL);
if (!priv->eq_table.irq_names) {
err = -ENOMEM;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 29e50f787349..5bd7975ff870 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -487,7 +487,7 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
int max_vfs_guarantee_counter = get_max_gauranteed_vfs_counter(dev);
priv->mfunc.master.res_tracker.slave_list =
- kzalloc(dev->num_slaves * sizeof(struct slave_list),
+ kzalloc(array_size(dev->num_slaves, sizeof(struct slave_list)),
GFP_KERNEL);
if (!priv->mfunc.master.res_tracker.slave_list)
return -ENOMEM;
@@ -507,19 +507,16 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
for (i = 0; i < MLX4_NUM_OF_RESOURCE_TYPE; i++) {
struct resource_allocator *res_alloc =
&priv->mfunc.master.res_tracker.res_alloc[i];
- res_alloc->quota = kmalloc((dev->persist->num_vfs + 1) *
- sizeof(int), GFP_KERNEL);
- res_alloc->guaranteed = kmalloc((dev->persist->num_vfs + 1) *
- sizeof(int), GFP_KERNEL);
+ res_alloc->quota = kmalloc(array_size((dev->persist->num_vfs + 1), sizeof(int)),
+ GFP_KERNEL);
+ res_alloc->guaranteed = kmalloc(array_size((dev->persist->num_vfs + 1), sizeof(int)),
+ GFP_KERNEL);
if (i == RES_MAC || i == RES_VLAN)
- res_alloc->allocated = kzalloc(MLX4_MAX_PORTS *
- (dev->persist->num_vfs
- + 1) *
- sizeof(int), GFP_KERNEL);
+ res_alloc->allocated = kzalloc(array3_size(MLX4_MAX_PORTS, (dev->persist->num_vfs + 1), sizeof(int)),
+ GFP_KERNEL);
else
- res_alloc->allocated = kzalloc((dev->persist->
- num_vfs + 1) *
- sizeof(int), GFP_KERNEL);
+ res_alloc->allocated = kzalloc(array_size((dev->persist->num_vfs + 1), sizeof(int)),
+ GFP_KERNEL);
/* Reduce the sink counter */
if (i == RES_COUNTER)
res_alloc->res_free = dev->caps.max_counters - 1;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
index de7fe087d6fe..195718dd133e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
@@ -549,15 +549,15 @@ static int mlx5_fpga_conn_create_qp(struct mlx5_fpga_conn *conn,
if (err)
goto out;
- conn->qp.rq.bufs = kvzalloc(sizeof(conn->qp.rq.bufs[0]) *
- conn->qp.rq.size, GFP_KERNEL);
+ conn->qp.rq.bufs = kvzalloc(array_size(sizeof(conn->qp.rq.bufs[0]), conn->qp.rq.size),
+ GFP_KERNEL);
if (!conn->qp.rq.bufs) {
err = -ENOMEM;
goto err_wq;
}
- conn->qp.sq.bufs = kvzalloc(sizeof(conn->qp.sq.bufs[0]) *
- conn->qp.sq.size, GFP_KERNEL);
+ conn->qp.sq.bufs = kvzalloc(array_size(sizeof(conn->qp.sq.bufs[0]), conn->qp.sq.size),
+ GFP_KERNEL);
if (!conn->qp.sq.bufs) {
err = -ENOMEM;
goto err_rq_bufs;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
index 0f5da499a223..3e53cd7834fa 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
@@ -386,7 +386,7 @@ int mlx5_fpga_ipsec_counters_read(struct mlx5_core_dev *mdev, u64 *counters,
count = mlx5_fpga_ipsec_counters_count(mdev);
- data = kzalloc(sizeof(*data) * count * 2, GFP_KERNEL);
+ data = kzalloc(array3_size(sizeof(*data), count, 2), GFP_KERNEL);
if (!data) {
ret = -ENOMEM;
goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index 857035583ccd..e4688b35ca55 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -394,8 +394,8 @@ static int mlx5_init_pin_config(struct mlx5_clock *clock)
int i;
clock->ptp_info.pin_config =
- kzalloc(sizeof(*clock->ptp_info.pin_config) *
- clock->ptp_info.n_pins, GFP_KERNEL);
+ kzalloc(array_size(sizeof(*clock->ptp_info.pin_config), clock->ptp_info.n_pins),
+ GFP_KERNEL);
if (!clock->ptp_info.pin_config)
return -ENOMEM;
clock->ptp_info.enable = mlx5_ptp_enable;
diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
index 52207508744c..ed029b96eac3 100644
--- a/drivers/net/ethernet/micrel/ksz884x.c
+++ b/drivers/net/ethernet/micrel/ksz884x.c
@@ -4372,7 +4372,7 @@ static void ksz_update_timer(struct ksz_timer_info *info)
*/
static int ksz_alloc_soft_desc(struct ksz_desc_info *desc_info, int transmit)
{
- desc_info->ring = kzalloc(sizeof(struct ksz_desc) * desc_info->alloc,
+ desc_info->ring = kzalloc(array_size(sizeof(struct ksz_desc), desc_info->alloc),
GFP_KERNEL);
if (!desc_info->ring)
return 1;
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 2e4effa9fe45..61199e478248 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -507,14 +507,14 @@ static int moxart_mac_probe(struct platform_device *pdev)
goto init_fail;
}
- priv->tx_buf_base = kmalloc(priv->tx_buf_size * TX_DESC_NUM,
+ priv->tx_buf_base = kmalloc(array_size(priv->tx_buf_size, TX_DESC_NUM),
GFP_ATOMIC);
if (!priv->tx_buf_base) {
ret = -ENOMEM;
goto init_fail;
}
- priv->rx_buf_base = kmalloc(priv->rx_buf_size * RX_DESC_NUM,
+ priv->rx_buf_base = kmalloc(array_size(priv->rx_buf_size, RX_DESC_NUM),
GFP_ATOMIC);
if (!priv->rx_buf_base) {
ret = -ENOMEM;
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c
index b2299f2b2155..e51040939b3b 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c
@@ -3429,8 +3429,8 @@ static int vxge_device_register(struct __vxge_hw_device *hldev,
vxge_initialize_ethtool_ops(ndev);
/* Allocate memory for vpath */
- vdev->vpaths = kzalloc((sizeof(struct vxge_vpath)) *
- no_of_vpath, GFP_KERNEL);
+ vdev->vpaths = kzalloc(array_size((sizeof(struct vxge_vpath)), no_of_vpath),
+ GFP_KERNEL);
if (!vdev->vpaths) {
vxge_debug_init(VXGE_ERR,
"%s: vpath memory allocation failed",
diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
index 66c665d0b926..d2ceb214174d 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -4630,8 +4630,10 @@ static int nv_set_ringparam(struct net_device *dev, struct ethtool_ringparam* ri
ring->tx_pending),
&ring_addr, GFP_ATOMIC);
}
- rx_skbuff = kmalloc(sizeof(struct nv_skb_map) * ring->rx_pending, GFP_KERNEL);
- tx_skbuff = kmalloc(sizeof(struct nv_skb_map) * ring->tx_pending, GFP_KERNEL);
+ rx_skbuff = kmalloc(array_size(sizeof(struct nv_skb_map), ring->rx_pending),
+ GFP_KERNEL);
+ tx_skbuff = kmalloc(array_size(sizeof(struct nv_skb_map), ring->tx_pending),
+ GFP_KERNEL);
if (!rxtx_ring || !rx_skbuff || !tx_skbuff) {
/* fall back to old rings */
if (!nv_optimized(np)) {
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index 4926c5532fba..a3c6b98f75e4 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -6558,7 +6558,8 @@ static enum dbg_status qed_mcp_trace_alloc_meta(struct qed_hwfn *p_hwfn,
/* Read no. of modules and allocate memory for their pointers */
meta->modules_num = qed_read_byte_from_buf(meta_buf_bytes, &offset);
- meta->modules = kzalloc(meta->modules_num * sizeof(char *), GFP_KERNEL);
+ meta->modules = kzalloc(array_size(meta->modules_num, sizeof(char *)),
+ GFP_KERNEL);
if (!meta->modules)
return DBG_STATUS_VIRT_MEM_ALLOC_FAILED;
@@ -6586,8 +6587,7 @@ static enum dbg_status qed_mcp_trace_alloc_meta(struct qed_hwfn *p_hwfn,
/* Read number of formats and allocate memory for all formats */
meta->formats_num = qed_read_dword_from_buf(meta_buf_bytes, &offset);
- meta->formats = kzalloc(meta->formats_num *
- sizeof(struct mcp_trace_format),
+ meta->formats = kzalloc(array_size(meta->formats_num, sizeof(struct mcp_trace_format)),
GFP_KERNEL);
if (!meta->formats)
return DBG_STATUS_VIRT_MEM_ALLOC_FAILED;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index d2ad5e92c74f..c9f804bf8ef3 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -814,26 +814,22 @@ static int qed_alloc_qm_data(struct qed_hwfn *p_hwfn)
if (rc)
goto alloc_err;
- qm_info->qm_pq_params = kzalloc(sizeof(*qm_info->qm_pq_params) *
- qed_init_qm_get_num_pqs(p_hwfn),
+ qm_info->qm_pq_params = kzalloc(array_size(sizeof(*qm_info->qm_pq_params), qed_init_qm_get_num_pqs(p_hwfn)),
GFP_KERNEL);
if (!qm_info->qm_pq_params)
goto alloc_err;
- qm_info->qm_vport_params = kzalloc(sizeof(*qm_info->qm_vport_params) *
- qed_init_qm_get_num_vports(p_hwfn),
+ qm_info->qm_vport_params = kzalloc(array_size(sizeof(*qm_info->qm_vport_params), qed_init_qm_get_num_vports(p_hwfn)),
GFP_KERNEL);
if (!qm_info->qm_vport_params)
goto alloc_err;
- qm_info->qm_port_params = kzalloc(sizeof(*qm_info->qm_port_params) *
- p_hwfn->cdev->num_ports_in_engine,
+ qm_info->qm_port_params = kzalloc(array_size(sizeof(*qm_info->qm_port_params), p_hwfn->cdev->num_ports_in_engine),
GFP_KERNEL);
if (!qm_info->qm_port_params)
goto alloc_err;
- qm_info->wfq_data = kzalloc(sizeof(*qm_info->wfq_data) *
- qed_init_qm_get_num_vports(p_hwfn),
+ qm_info->wfq_data = kzalloc(array_size(sizeof(*qm_info->wfq_data), qed_init_qm_get_num_vports(p_hwfn)),
GFP_KERNEL);
if (!qm_info->wfq_data)
goto alloc_err;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_init_ops.c b/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
index 06b1fad88360..3dc5f70656be 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
@@ -498,7 +498,8 @@ int qed_init_run(struct qed_hwfn *p_hwfn,
num_init_ops = cdev->fw_data->init_ops_size;
init_ops = cdev->fw_data->init_ops;
- p_hwfn->unzip_buf = kzalloc(MAX_ZIPPED_SIZE * 4, GFP_ATOMIC);
+ p_hwfn->unzip_buf = kzalloc(array_size(MAX_ZIPPED_SIZE, 4),
+ GFP_ATOMIC);
if (!p_hwfn->unzip_buf)
return -ENOMEM;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index e874504e8b28..9fcf8fd81f66 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -98,7 +98,7 @@ int qed_l2_alloc(struct qed_hwfn *p_hwfn)
p_l2_info->queues = max_t(u8, rx, tx);
}
- pp_qids = kzalloc(sizeof(unsigned long *) * p_l2_info->queues,
+ pp_qids = kzalloc(array_size(sizeof(unsigned long *), p_l2_info->queues),
GFP_KERNEL);
if (!pp_qids)
return -ENOMEM;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index ec0d425766a7..41d650dff539 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -2497,8 +2497,7 @@ int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
goto err0;
}
- nvm_info->image_att = kmalloc(nvm_info->num_images *
- sizeof(struct bist_nvm_image_att),
+ nvm_info->image_att = kmalloc(array_size(nvm_info->num_images, sizeof(struct bist_nvm_image_att)),
GFP_KERNEL);
if (!nvm_info->image_att) {
rc = -ENOMEM;
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 8293c2028002..4fc20aa7114e 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -2810,7 +2810,8 @@ static int ql_alloc_tx_resources(struct ql_adapter *qdev,
goto pci_alloc_err;
tx_ring->q =
- kmalloc(tx_ring->wq_len * sizeof(struct tx_ring_desc), GFP_KERNEL);
+ kmalloc(array_size(tx_ring->wq_len, sizeof(struct tx_ring_desc)),
+ GFP_KERNEL);
if (tx_ring->q == NULL)
goto err;
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index f4d7362eb325..d19e868afe25 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -640,7 +640,7 @@ int asix_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
first_word = eeprom->offset >> 1;
last_word = (eeprom->offset + eeprom->len - 1) >> 1;
- eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
+ eeprom_buff = kmalloc(array_size(sizeof(u16), (last_word - first_word + 1)),
GFP_KERNEL);
if (!eeprom_buff)
return -ENOMEM;
@@ -680,7 +680,7 @@ int asix_set_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
first_word = eeprom->offset >> 1;
last_word = (eeprom->offset + eeprom->len - 1) >> 1;
- eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
+ eeprom_buff = kmalloc(array_size(sizeof(u16), (last_word - first_word + 1)),
GFP_KERNEL);
if (!eeprom_buff)
return -ENOMEM;
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index a6ef75907ae9..c09c93153de7 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -599,7 +599,7 @@ ax88179_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
first_word = eeprom->offset >> 1;
last_word = (eeprom->offset + eeprom->len - 1) >> 1;
- eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
+ eeprom_buff = kmalloc(array_size(sizeof(u16), (last_word - first_word + 1)),
GFP_KERNEL);
if (!eeprom_buff)
return -ENOMEM;
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index d9eea8cfe6cb..9e0530468102 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1323,7 +1323,7 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb)
return 0;
/* reserve one for zero packet */
- urb->sg = kmalloc((num_sgs + 1) * sizeof(struct scatterlist),
+ urb->sg = kmalloc(array_size((num_sgs + 1), sizeof(struct scatterlist)),
GFP_ATOMIC);
if (!urb->sg)
return -ENOMEM;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index fb627b35ae1b..d9fb409a2bcd 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2559,10 +2559,12 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
vi->ctrl = kzalloc(sizeof(*vi->ctrl), GFP_KERNEL);
if (!vi->ctrl)
goto err_ctrl;
- vi->sq = kzalloc(sizeof(*vi->sq) * vi->max_queue_pairs, GFP_KERNEL);
+ vi->sq = kzalloc(array_size(sizeof(*vi->sq), vi->max_queue_pairs),
+ GFP_KERNEL);
if (!vi->sq)
goto err_sq;
- vi->rq = kzalloc(sizeof(*vi->rq) * vi->max_queue_pairs, GFP_KERNEL);
+ vi->rq = kzalloc(array_size(sizeof(*vi->rq), vi->max_queue_pairs),
+ GFP_KERNEL);
if (!vi->rq)
goto err_rq;
diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 33df76405b86..0bbf1c6b7828 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -198,12 +198,12 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
goto free_tx_bd;
}
- priv->rx_skbuff = kzalloc(priv->rx_ring_size * sizeof(*priv->rx_skbuff),
+ priv->rx_skbuff = kzalloc(array_size(priv->rx_ring_size, sizeof(*priv->rx_skbuff)),
GFP_KERNEL);
if (!priv->rx_skbuff)
goto free_ucc_pram;
- priv->tx_skbuff = kzalloc(priv->tx_ring_size * sizeof(*priv->tx_skbuff),
+ priv->tx_skbuff = kzalloc(array_size(priv->tx_ring_size, sizeof(*priv->tx_skbuff)),
GFP_KERNEL);
if (!priv->tx_skbuff)
goto free_rx_skbuff;
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 5e02e26158f6..3fc68f060fe9 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -581,7 +581,7 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
}
htt->rx_ring.netbufs_ring =
- kzalloc(htt->rx_ring.size * sizeof(struct sk_buff *),
+ kzalloc(array_size(htt->rx_ring.size, sizeof(struct sk_buff *)),
GFP_KERNEL);
if (!htt->rx_ring.netbufs_ring)
goto err_netbuf;
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 641b13a279e1..3e7e4ae829ee 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -890,8 +890,8 @@ ath5k_hw_rfregs_init(struct ath5k_hw *ah,
* ah->ah_rf_banks based on ah->ah_rf_banks_size
* we set above */
if (ah->ah_rf_banks == NULL) {
- ah->ah_rf_banks = kmalloc(sizeof(u32) * ah->ah_rf_banks_size,
- GFP_KERNEL);
+ ah->ah_rf_banks = kmalloc(array_size(sizeof(u32), ah->ah_rf_banks_size),
+ GFP_KERNEL);
if (ah->ah_rf_banks == NULL) {
ATH5K_ERR(ah, "out of memory\n");
return -ENOMEM;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 6343cc91953e..1dcd5cc57abd 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -925,7 +925,7 @@ int ar9003_paprd_create_curve(struct ath_hw *ah,
memset(caldata->pa_table[chain], 0, sizeof(caldata->pa_table[chain]));
- buf = kmalloc(2 * 48 * sizeof(u32), GFP_KERNEL);
+ buf = kmalloc(array3_size(2, 48, sizeof(u32)), GFP_KERNEL);
if (!buf)
return -ENOMEM;
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 04cfdd6bef55..f4a00dc294d9 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1989,8 +1989,8 @@ int carl9170_register(struct ar9170 *ar)
if (WARN_ON(ar->mem_bitmap))
return -EINVAL;
- ar->mem_bitmap = kzalloc(roundup(ar->fw.mem_blocks, BITS_PER_LONG) *
- sizeof(unsigned long), GFP_KERNEL);
+ ar->mem_bitmap = kzalloc(array_size(roundup(ar->fw.mem_blocks, BITS_PER_LONG), sizeof(unsigned long)),
+ GFP_KERNEL);
if (!ar->mem_bitmap)
return -ENOMEM;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index 49d37ad96958..57063218f7f4 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -1486,8 +1486,8 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
(struct brcmf_commonring **)if_msgbuf->commonrings;
msgbuf->flowrings = (struct brcmf_commonring **)if_msgbuf->flowrings;
msgbuf->max_flowrings = if_msgbuf->max_flowrings;
- msgbuf->flowring_dma_handle = kzalloc(msgbuf->max_flowrings *
- sizeof(*msgbuf->flowring_dma_handle), GFP_KERNEL);
+ msgbuf->flowring_dma_handle = kzalloc(array_size(msgbuf->max_flowrings, sizeof(*msgbuf->flowring_dma_handle)),
+ GFP_KERNEL);
if (!msgbuf->flowring_dma_handle)
goto fail;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
index 88eb34244caa..fc2cc7cecdd2 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
@@ -24665,7 +24665,8 @@ wlc_phy_a1_nphy(struct brcms_phy *pi, u8 core, u32 winsz, u32 start,
sz = end - start + 1;
- buf = kmalloc(2 * sizeof(u32) * NPHY_PAPD_EPS_TBL_SIZE, GFP_ATOMIC);
+ buf = kmalloc(array3_size(2, sizeof(u32), NPHY_PAPD_EPS_TBL_SIZE),
+ GFP_ATOMIC);
if (NULL == buf)
return;
diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
index a5d5748f5d30..093fac4694e8 100644
--- a/drivers/net/wireless/intel/iwlegacy/common.c
+++ b/drivers/net/wireless/intel/iwlegacy/common.c
@@ -922,7 +922,7 @@ il_init_channel_map(struct il_priv *il)
D_EEPROM("Parsing data for %d channels.\n", il->channel_count);
il->channel_info =
- kzalloc(sizeof(struct il_channel_info) * il->channel_count,
+ kzalloc(array_size(sizeof(struct il_channel_info), il->channel_count),
GFP_KERNEL);
if (!il->channel_info) {
IL_ERR("Could not allocate channel_info\n");
@@ -3457,7 +3457,7 @@ il_init_geos(struct il_priv *il)
}
channels =
- kzalloc(sizeof(struct ieee80211_channel) * il->channel_count,
+ kzalloc(array_size(sizeof(struct ieee80211_channel), il->channel_count),
GFP_KERNEL);
if (!channels)
return -ENOMEM;
@@ -4656,8 +4656,8 @@ il_alloc_txq_mem(struct il_priv *il)
{
if (!il->txq)
il->txq =
- kzalloc(sizeof(struct il_tx_queue) *
- il->cfg->num_of_queues, GFP_KERNEL);
+ kzalloc(array_size(sizeof(struct il_tx_queue), il->cfg->num_of_queues),
+ GFP_KERNEL);
if (!il->txq) {
IL_ERR("Not enough memory for txq\n");
return -ENOMEM;
diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wireless/intersil/p54/eeprom.c
index b792fe1eda66..aa4d83e0b0b4 100644
--- a/drivers/net/wireless/intersil/p54/eeprom.c
+++ b/drivers/net/wireless/intersil/p54/eeprom.c
@@ -161,8 +161,8 @@ static int p54_generate_band(struct ieee80211_hw *dev,
if (!tmp)
goto err_out;
- tmp->channels = kzalloc(sizeof(struct ieee80211_channel) *
- list->band_channel_num[band], GFP_KERNEL);
+ tmp->channels = kzalloc(array_size(sizeof(struct ieee80211_channel), list->band_channel_num[band]),
+ GFP_KERNEL);
if (!tmp->channels)
goto err_out;
diff --git a/drivers/net/wireless/intersil/prism54/oid_mgt.c b/drivers/net/wireless/intersil/prism54/oid_mgt.c
index 6528ed5b9b1d..9b26131745b0 100644
--- a/drivers/net/wireless/intersil/prism54/oid_mgt.c
+++ b/drivers/net/wireless/intersil/prism54/oid_mgt.c
@@ -244,8 +244,7 @@ mgt_init(islpci_private *priv)
/* Alloc the cache */
for (i = 0; i < OID_NUM_LAST; i++) {
if (isl_oid[i].flags & OID_FLAG_CACHED) {
- priv->mib[i] = kzalloc(isl_oid[i].size *
- (isl_oid[i].range + 1),
+ priv->mib[i] = kzalloc(array_size(isl_oid[i].size, (isl_oid[i].range + 1)),
GFP_KERNEL);
if (!priv->mib[i])
return -ENOMEM;
diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
index a82880132af4..a69c8018e549 100644
--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
+++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
@@ -2094,15 +2094,15 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
return -ENOMEM;
/* Allocate skb pointer buffers */
- card->mpa_rx.skb_arr = kzalloc((sizeof(void *)) *
- card->mp_agg_pkt_limit, GFP_KERNEL);
+ card->mpa_rx.skb_arr = kzalloc(array_size((sizeof(void *)), card->mp_agg_pkt_limit),
+ GFP_KERNEL);
if (!card->mpa_rx.skb_arr) {
kfree(card->mp_regs);
return -ENOMEM;
}
- card->mpa_rx.len_arr = kzalloc(sizeof(*card->mpa_rx.len_arr) *
- card->mp_agg_pkt_limit, GFP_KERNEL);
+ card->mpa_rx.len_arr = kzalloc(array_size(sizeof(*card->mpa_rx.len_arr), card->mp_agg_pkt_limit),
+ GFP_KERNEL);
if (!card->mpa_rx.len_arr) {
kfree(card->mp_regs);
kfree(card->mpa_rx.skb_arr);
diff --git a/drivers/net/wireless/mediatek/mt7601u/init.c b/drivers/net/wireless/mediatek/mt7601u/init.c
index d3b611aaf061..1b1014e9afcd 100644
--- a/drivers/net/wireless/mediatek/mt7601u/init.c
+++ b/drivers/net/wireless/mediatek/mt7601u/init.c
@@ -182,7 +182,7 @@ static int mt7601u_init_wcid_mem(struct mt7601u_dev *dev)
u32 *vals;
int i, ret;
- vals = kmalloc(sizeof(*vals) * N_WCIDS * 2, GFP_KERNEL);
+ vals = kmalloc(array3_size(sizeof(*vals), N_WCIDS, 2), GFP_KERNEL);
if (!vals)
return -ENOMEM;
@@ -211,7 +211,7 @@ static int mt7601u_init_wcid_attr_mem(struct mt7601u_dev *dev)
u32 *vals;
int i, ret;
- vals = kmalloc(sizeof(*vals) * N_WCIDS * 2, GFP_KERNEL);
+ vals = kmalloc(array3_size(sizeof(*vals), N_WCIDS, 2), GFP_KERNEL);
if (!vals)
return -ENOMEM;
diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c
index deca0060eb27..4cb71b3d9f3e 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c
@@ -1193,7 +1193,7 @@ static int qtnf_parse_variable_mac_info(struct qtnf_wmac *mac,
return -EINVAL;
}
- limits = kzalloc(sizeof(*limits) * rec->n_limits,
+ limits = kzalloc(array_size(sizeof(*limits), rec->n_limits),
GFP_KERNEL);
if (!limits)
return -ENOMEM;
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
index 0eee479583b8..645436c5d515 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
@@ -397,7 +397,8 @@ static ssize_t rt2x00debug_read_crypto_stats(struct file *file,
if (*offset)
return 0;
- data = kzalloc((1 + CIPHER_MAX) * MAX_LINE_LENGTH, GFP_KERNEL);
+ data = kzalloc(array_size((1 + CIPHER_MAX), MAX_LINE_LENGTH),
+ GFP_KERNEL);
if (!data)
return -ENOMEM;
@@ -597,7 +598,7 @@ static struct dentry *rt2x00debug_create_file_driver(const char *name,
{
char *data;
- data = kzalloc(3 * MAX_LINE_LENGTH, GFP_KERNEL);
+ data = kzalloc(array_size(3, MAX_LINE_LENGTH), GFP_KERNEL);
if (!data)
return NULL;
@@ -619,7 +620,7 @@ static struct dentry *rt2x00debug_create_file_chipset(const char *name,
const struct rt2x00debug *debug = intf->debug;
char *data;
- data = kzalloc(9 * MAX_LINE_LENGTH, GFP_KERNEL);
+ data = kzalloc(array_size(9, MAX_LINE_LENGTH), GFP_KERNEL);
if (!data)
return NULL;
diff --git a/drivers/net/wireless/realtek/rtlwifi/efuse.c b/drivers/net/wireless/realtek/rtlwifi/efuse.c
index fd13d4ef53b8..6d8d58589e06 100644
--- a/drivers/net/wireless/realtek/rtlwifi/efuse.c
+++ b/drivers/net/wireless/realtek/rtlwifi/efuse.c
@@ -258,8 +258,8 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
}
/* allocate memory for efuse_tbl and efuse_word */
- efuse_tbl = kzalloc(rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE] *
- sizeof(u8), GFP_ATOMIC);
+ efuse_tbl = kzalloc(array_size(rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE], sizeof(u8)),
+ GFP_ATOMIC);
if (!efuse_tbl)
return;
efuse_word = kcalloc(EFUSE_MAX_WORD_UNIT, sizeof(u16 *), GFP_ATOMIC);
diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
index c21fca750fd4..daa5f8573f37 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -1194,7 +1194,7 @@ static int rsi_send_auto_rate_request(struct rsi_common *common,
return -ENOMEM;
}
- selected_rates = kzalloc(2 * RSI_TBL_SZ, GFP_KERNEL);
+ selected_rates = kzalloc(array_size(2, RSI_TBL_SZ), GFP_KERNEL);
if (!selected_rates) {
rsi_dbg(ERR_ZONE, "%s: Failed in allocation of mem\n",
__func__);
diff --git a/drivers/net/wireless/st/cw1200/queue.c b/drivers/net/wireless/st/cw1200/queue.c
index 8b8453fac571..5a0da3d63721 100644
--- a/drivers/net/wireless/st/cw1200/queue.c
+++ b/drivers/net/wireless/st/cw1200/queue.c
@@ -186,8 +186,8 @@ int cw1200_queue_init(struct cw1200_queue *queue,
if (!queue->pool)
return -ENOMEM;
- queue->link_map_cache = kzalloc(sizeof(int) * stats->map_capacity,
- GFP_KERNEL);
+ queue->link_map_cache = kzalloc(array_size(sizeof(int), stats->map_capacity),
+ GFP_KERNEL);
if (!queue->link_map_cache) {
kfree(queue->pool);
queue->pool = NULL;
diff --git a/drivers/net/wireless/st/cw1200/scan.c b/drivers/net/wireless/st/cw1200/scan.c
index cc2ce60f4f09..1474b0280665 100644
--- a/drivers/net/wireless/st/cw1200/scan.c
+++ b/drivers/net/wireless/st/cw1200/scan.c
@@ -230,9 +230,8 @@ void cw1200_scan_work(struct work_struct *work)
scan.type = WSM_SCAN_TYPE_BACKGROUND;
scan.flags = WSM_SCAN_FLAG_FORCE_BACKGROUND;
}
- scan.ch = kzalloc(
- sizeof(struct wsm_scan_ch) * (it - priv->scan.curr),
- GFP_KERNEL);
+ scan.ch = kzalloc(array_size(sizeof(struct wsm_scan_ch), (it - priv->scan.curr)),
+ GFP_KERNEL);
if (!scan.ch) {
priv->scan.status = -ENOMEM;
goto fail;
diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index 62ce54a949e9..a811388d8979 100644
--- a/drivers/net/wireless/ti/wlcore/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -321,7 +321,8 @@ static int __wl12xx_spi_raw_write(struct device *child, int addr,
int i;
/* SPI write buffers - 2 for each chunk */
- t = kzalloc(sizeof(*t) * 2 * WSPI_MAX_NUM_OF_CHUNKS, GFP_KERNEL);
+ t = kzalloc(array3_size(sizeof(*t), 2, WSPI_MAX_NUM_OF_CHUNKS),
+ GFP_KERNEL);
if (!t)
return -ENOMEM;
diff --git a/drivers/nvmem/sunxi_sid.c b/drivers/nvmem/sunxi_sid.c
index 26bb637afe92..a796c5582f3f 100644
--- a/drivers/nvmem/sunxi_sid.c
+++ b/drivers/nvmem/sunxi_sid.c
@@ -185,7 +185,7 @@ static int sunxi_sid_probe(struct platform_device *pdev)
if (IS_ERR(nvmem))
return PTR_ERR(nvmem);
- randomness = kzalloc(sizeof(u8) * (size), GFP_KERNEL);
+ randomness = kzalloc(array_size(sizeof(u8), (size)), GFP_KERNEL);
if (!randomness) {
ret = -EINVAL;
goto err_unreg_nvmem;
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index c00d81dfac0b..ae23aa217dd1 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -124,7 +124,8 @@ struct platform_device *of_device_alloc(struct device_node *np,
/* Populate the resource table */
if (num_irq || num_reg) {
- res = kzalloc(sizeof(*res) * (num_irq + num_reg), GFP_KERNEL);
+ res = kzalloc(array_size(sizeof(*res), (num_irq + num_reg)),
+ GFP_KERNEL);
if (!res) {
platform_device_put(dev);
return NULL;
diff --git a/drivers/opp/ti-opp-supply.c b/drivers/opp/ti-opp-supply.c
index 370eff3acd8a..1f4c5a308701 100644
--- a/drivers/opp/ti-opp-supply.c
+++ b/drivers/opp/ti-opp-supply.c
@@ -122,8 +122,8 @@ static int _store_optimized_voltages(struct device *dev,
goto out;
}
- table = kzalloc(sizeof(*data->vdd_table) *
- data->num_vdd_table, GFP_KERNEL);
+ table = kzalloc(array_size(sizeof(*data->vdd_table), data->num_vdd_table),
+ GFP_KERNEL);
if (!table) {
ret = -ENOMEM;
goto out;
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 82d241f5bf3b..8512c7c11ef1 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -474,7 +474,8 @@ static int populate_msi_sysfs(struct pci_dev *pdev)
return 0;
/* Dynamically create the MSI attributes for the PCI device */
- msi_attrs = kzalloc(sizeof(void *) * (num_msi + 1), GFP_KERNEL);
+ msi_attrs = kzalloc(array_size(sizeof(void *), (num_msi + 1)),
+ GFP_KERNEL);
if (!msi_attrs)
return -ENOMEM;
for_each_pci_msi_entry(entry, pdev) {
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index 785c366fd6d6..3974f48a3bd5 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -775,8 +775,8 @@ static int bcm2835_pctl_dt_node_to_map(struct pinctrl_dev *pctldev,
maps_per_pin++;
if (num_pulls)
maps_per_pin++;
- cur_map = maps = kzalloc(num_pins * maps_per_pin * sizeof(*maps),
- GFP_KERNEL);
+ cur_map = maps = kzalloc(array3_size(num_pins, maps_per_pin, sizeof(*maps)),
+ GFP_KERNEL);
if (!maps)
return -ENOMEM;
diff --git a/drivers/pinctrl/pinctrl-lantiq.c b/drivers/pinctrl/pinctrl-lantiq.c
index 41dc39c7a7b1..81632af3a86a 100644
--- a/drivers/pinctrl/pinctrl-lantiq.c
+++ b/drivers/pinctrl/pinctrl-lantiq.c
@@ -158,7 +158,8 @@ static int ltq_pinctrl_dt_node_to_map(struct pinctrl_dev *pctldev,
for_each_child_of_node(np_config, np)
max_maps += ltq_pinctrl_dt_subnode_size(np);
- *map = kzalloc(max_maps * sizeof(struct pinctrl_map) * 2, GFP_KERNEL);
+ *map = kzalloc(array3_size(max_maps, sizeof(struct pinctrl_map), 2),
+ GFP_KERNEL);
if (!*map)
return -ENOMEM;
tmp = *map;
diff --git a/drivers/pinctrl/vt8500/pinctrl-wmt.c b/drivers/pinctrl/vt8500/pinctrl-wmt.c
index d73956bdc211..291d29734c52 100644
--- a/drivers/pinctrl/vt8500/pinctrl-wmt.c
+++ b/drivers/pinctrl/vt8500/pinctrl-wmt.c
@@ -352,7 +352,7 @@ static int wmt_pctl_dt_node_to_map(struct pinctrl_dev *pctldev,
if (num_pulls)
maps_per_pin++;
- cur_map = maps = kzalloc(num_pins * maps_per_pin * sizeof(*maps),
+ cur_map = maps = kzalloc(array3_size(num_pins, maps_per_pin, sizeof(*maps)),
GFP_KERNEL);
if (!maps)
return -ENOMEM;
diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
index 9d7dbd925065..4c3d24ddbdd9 100644
--- a/drivers/platform/x86/alienware-wmi.c
+++ b/drivers/platform/x86/alienware-wmi.c
@@ -458,19 +458,19 @@ static int alienware_zone_init(struct platform_device *dev)
* - zone_data num_zones is for the distinct zones
*/
zone_dev_attrs =
- kzalloc(sizeof(struct device_attribute) * (quirks->num_zones + 1),
+ kzalloc(array_size(sizeof(struct device_attribute), (quirks->num_zones + 1)),
GFP_KERNEL);
if (!zone_dev_attrs)
return -ENOMEM;
zone_attrs =
- kzalloc(sizeof(struct attribute *) * (quirks->num_zones + 2),
+ kzalloc(array_size(sizeof(struct attribute *), (quirks->num_zones + 2)),
GFP_KERNEL);
if (!zone_attrs)
return -ENOMEM;
zone_data =
- kzalloc(sizeof(struct platform_zone) * (quirks->num_zones),
+ kzalloc(array_size(sizeof(struct platform_zone), (quirks->num_zones)),
GFP_KERNEL);
if (!zone_data)
return -ENOMEM;
diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
index 5c39b3211709..9d103996582d 100644
--- a/drivers/platform/x86/panasonic-laptop.c
+++ b/drivers/platform/x86/panasonic-laptop.c
@@ -571,7 +571,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
return -ENOMEM;
}
- pcc->sinf = kzalloc(sizeof(u32) * (num_sifr + 1), GFP_KERNEL);
+ pcc->sinf = kzalloc(array_size(sizeof(u32), (num_sifr + 1)),
+ GFP_KERNEL);
if (!pcc->sinf) {
result = -ENOMEM;
goto out_hotkey;
diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c
index 161b927d9de1..7582badc41a1 100644
--- a/drivers/rapidio/rio-scan.c
+++ b/drivers/rapidio/rio-scan.c
@@ -425,9 +425,8 @@ static struct rio_dev *rio_setup_device(struct rio_net *net,
rswitch = rdev->rswitch;
rswitch->port_ok = 0;
spin_lock_init(&rswitch->lock);
- rswitch->route_table = kzalloc(sizeof(u8)*
- RIO_MAX_ROUTE_ENTRIES(port->sys_size),
- GFP_KERNEL);
+ rswitch->route_table = kzalloc(array_size(sizeof(u8), RIO_MAX_ROUTE_ENTRIES(port->sys_size)),
+ GFP_KERNEL);
if (!rswitch->route_table)
goto cleanup;
/* Initialize switch route table */
diff --git a/drivers/s390/block/dasd_eer.c b/drivers/s390/block/dasd_eer.c
index fb2c3599d95c..f9a22546c347 100644
--- a/drivers/s390/block/dasd_eer.c
+++ b/drivers/s390/block/dasd_eer.c
@@ -561,7 +561,7 @@ static int dasd_eer_open(struct inode *inp, struct file *filp)
return -EINVAL;
}
eerb->buffersize = eerb->buffer_page_count * PAGE_SIZE;
- eerb->buffer = kmalloc(eerb->buffer_page_count * sizeof(char *),
+ eerb->buffer = kmalloc(array_size(eerb->buffer_page_count, sizeof(char *)),
GFP_KERNEL);
if (!eerb->buffer) {
kfree(eerb);
diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index 0a312e450207..be861315be77 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -231,9 +231,8 @@ dcssblk_is_continuous(struct dcssblk_dev_info *dev_info)
if (dev_info->num_of_segments <= 1)
return 0;
- sort_list = kzalloc(
- sizeof(struct segment_info) * dev_info->num_of_segments,
- GFP_KERNEL);
+ sort_list = kzalloc(array_size(sizeof(struct segment_info), dev_info->num_of_segments),
+ GFP_KERNEL);
if (sort_list == NULL)
return -ENOMEM;
i = 0;
diff --git a/drivers/s390/char/vmur.c b/drivers/s390/char/vmur.c
index 52aa89424318..c594dc9efab8 100644
--- a/drivers/s390/char/vmur.c
+++ b/drivers/s390/char/vmur.c
@@ -242,7 +242,7 @@ static struct ccw1 *alloc_chan_prog(const char __user *ubuf, int rec_count,
* That means we allocate room for CCWs to cover count/reclen
* records plus a NOP.
*/
- cpa = kzalloc((rec_count + 1) * sizeof(struct ccw1),
+ cpa = kzalloc(array_size((rec_count + 1), sizeof(struct ccw1)),
GFP_KERNEL | GFP_DMA);
if (!cpa)
return ERR_PTR(-ENOMEM);
diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
index 4369662cfff5..68689ee669d6 100644
--- a/drivers/s390/char/zcore.c
+++ b/drivers/s390/char/zcore.c
@@ -152,7 +152,8 @@ static int zcore_memmap_open(struct inode *inode, struct file *filp)
char *buf;
int i = 0;
- buf = kzalloc(memblock.memory.cnt * CHUNK_INFO_SIZE, GFP_KERNEL);
+ buf = kzalloc(array_size(memblock.memory.cnt, CHUNK_INFO_SIZE),
+ GFP_KERNEL);
if (!buf) {
return -ENOMEM;
}
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index 2dfe566c208a..3ec3cb27885a 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -121,7 +121,7 @@ static int alloc_and_prep_cprbmem(size_t paramblen,
* allocate consecutive memory for request CPRB, request param
* block, reply CPRB and reply param block
*/
- cprbmem = kzalloc(2 * cprbplusparamblen, GFP_KERNEL);
+ cprbmem = kzalloc(array_size(2, cprbplusparamblen), GFP_KERNEL);
if (!cprbmem)
return -ENOMEM;
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index a04dafbe3bf2..079655c43188 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -374,9 +374,8 @@ static int qeth_alloc_cq(struct qeth_card *card)
}
card->qdio.no_in_queues = 2;
card->qdio.out_bufstates =
- kzalloc(card->qdio.no_out_queues *
- QDIO_MAX_BUFFERS_PER_Q *
- sizeof(struct qdio_outbuf_state), GFP_KERNEL);
+ kzalloc(array3_size(card->qdio.no_out_queues, QDIO_MAX_BUFFERS_PER_Q, sizeof(struct qdio_outbuf_state)),
+ GFP_KERNEL);
outbuf_states = card->qdio.out_bufstates;
if (outbuf_states == NULL) {
rc = -1;
@@ -2538,8 +2537,8 @@ static int qeth_alloc_qdio_buffers(struct qeth_card *card)
/* outbound */
card->qdio.out_qs =
- kzalloc(card->qdio.no_out_queues *
- sizeof(struct qeth_qdio_out_q *), GFP_KERNEL);
+ kzalloc(array_size(card->qdio.no_out_queues, sizeof(struct qeth_qdio_out_q *)),
+ GFP_KERNEL);
if (!card->qdio.out_qs)
goto out_freepool;
for (i = 0; i < card->qdio.no_out_queues; ++i) {
@@ -4976,8 +4975,7 @@ static int qeth_qdio_establish(struct qeth_card *card)
qeth_create_qib_param_field(card, qib_param_field);
qeth_create_qib_param_field_blkt(card, qib_param_field);
- in_sbal_ptrs = kzalloc(card->qdio.no_in_queues *
- QDIO_MAX_BUFFERS_PER_Q * sizeof(void *),
+ in_sbal_ptrs = kzalloc(array3_size(card->qdio.no_in_queues, QDIO_MAX_BUFFERS_PER_Q, sizeof(void *)),
GFP_KERNEL);
if (!in_sbal_ptrs) {
rc = -ENOMEM;
@@ -4988,7 +4986,7 @@ static int qeth_qdio_establish(struct qeth_card *card)
virt_to_phys(card->qdio.in_q->bufs[i].buffer);
}
- queue_start_poll = kzalloc(sizeof(void *) * card->qdio.no_in_queues,
+ queue_start_poll = kzalloc(array_size(sizeof(void *), card->qdio.no_in_queues),
GFP_KERNEL);
if (!queue_start_poll) {
rc = -ENOMEM;
@@ -5000,8 +4998,8 @@ static int qeth_qdio_establish(struct qeth_card *card)
qeth_qdio_establish_cq(card, in_sbal_ptrs, queue_start_poll);
out_sbal_ptrs =
- kzalloc(card->qdio.no_out_queues * QDIO_MAX_BUFFERS_PER_Q *
- sizeof(void *), GFP_KERNEL);
+ kzalloc(array3_size(card->qdio.no_out_queues, QDIO_MAX_BUFFERS_PER_Q, sizeof(void *)),
+ GFP_KERNEL);
if (!out_sbal_ptrs) {
rc = -ENOMEM;
goto out_free_queue_start_poll;
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index f24fb942065d..ce1409e2eb94 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1681,7 +1681,8 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
if (aac_reset_devices || reset_devices)
aac->init_reset = true;
- aac->fibs = kzalloc(sizeof(struct fib) * (shost->can_queue + AAC_NUM_MGT_FIB), GFP_KERNEL);
+ aac->fibs = kzalloc(array_size(sizeof(struct fib), (shost->can_queue + AAC_NUM_MGT_FIB)),
+ GFP_KERNEL);
if (!aac->fibs)
goto out_free_host;
spin_lock_init(&aac->fib_lock);
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 034f4eebb160..52584ccc41a5 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -7063,7 +7063,8 @@ ahd_init(struct ahd_softc *ahd)
AHD_ASSERT_MODES(ahd, AHD_MODE_SCSI_MSK, AHD_MODE_SCSI_MSK);
ahd->stack_size = ahd_probe_stack_size(ahd);
- ahd->saved_stack = kmalloc(ahd->stack_size * sizeof(uint16_t), GFP_ATOMIC);
+ ahd->saved_stack = kmalloc(array_size(ahd->stack_size, sizeof(uint16_t)),
+ GFP_ATOMIC);
if (ahd->saved_stack == NULL)
return (ENOMEM);
diff --git a/drivers/scsi/aic94xx/aic94xx_hwi.c b/drivers/scsi/aic94xx/aic94xx_hwi.c
index 2dbc8330d7d3..a63338f3eb7e 100644
--- a/drivers/scsi/aic94xx/aic94xx_hwi.c
+++ b/drivers/scsi/aic94xx/aic94xx_hwi.c
@@ -220,8 +220,8 @@ static int asd_init_scbs(struct asd_ha_struct *asd_ha)
/* allocate the index array and bitmap */
asd_ha->seq.tc_index_bitmap_bits = asd_ha->hw_prof.max_scbs;
- asd_ha->seq.tc_index_array = kzalloc(asd_ha->seq.tc_index_bitmap_bits*
- sizeof(void *), GFP_KERNEL);
+ asd_ha->seq.tc_index_array = kzalloc(array_size(asd_ha->seq.tc_index_bitmap_bits, sizeof(void *)),
+ GFP_KERNEL);
if (!asd_ha->seq.tc_index_array)
return -ENOMEM;
@@ -291,7 +291,8 @@ static int asd_alloc_edbs(struct asd_ha_struct *asd_ha, gfp_t gfp_flags)
struct asd_seq_data *seq = &asd_ha->seq;
int i;
- seq->edb_arr = kmalloc(seq->num_edbs*sizeof(*seq->edb_arr), gfp_flags);
+ seq->edb_arr = kmalloc(array_size(seq->num_edbs, sizeof(*seq->edb_arr)),
+ gfp_flags);
if (!seq->edb_arr)
return -ENOMEM;
@@ -323,7 +324,7 @@ static int asd_alloc_escbs(struct asd_ha_struct *asd_ha,
struct asd_ascb *escb;
int i, escbs;
- seq->escb_arr = kmalloc(seq->num_escbs*sizeof(*seq->escb_arr),
+ seq->escb_arr = kmalloc(array_size(seq->num_escbs, sizeof(*seq->escb_arr)),
gfp_flags);
if (!seq->escb_arr)
return -ENOMEM;
diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index 6c838865ac5a..c926944663ad 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -350,7 +350,7 @@ static ssize_t asd_store_update_bios(struct device *dev,
int flash_command = FLASH_CMD_NONE;
int err = 0;
- cmd_ptr = kzalloc(count*2, GFP_KERNEL);
+ cmd_ptr = kzalloc(array_size(count, 2), GFP_KERNEL);
if (!cmd_ptr) {
err = FAIL_OUT_MEMORY;
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index ac7fbc7a9465..34d3cf37cdfc 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -2467,8 +2467,7 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
/* Allocate memory for wrb_context */
phwi_ctrlr = phba->phwi_ctrlr;
- phwi_ctrlr->wrb_context = kzalloc(sizeof(struct hwi_wrb_context) *
- phba->params.cxns_per_ctrl,
+ phwi_ctrlr->wrb_context = kzalloc(array_size(sizeof(struct hwi_wrb_context), phba->params.cxns_per_ctrl),
GFP_KERNEL);
if (!phwi_ctrlr->wrb_context) {
kfree(phba->phwi_ctrlr);
@@ -2620,8 +2619,7 @@ static int beiscsi_init_wrb_handle(struct beiscsi_hba *phba)
/* Allocate memory for WRBQ */
phwi_ctxt = phwi_ctrlr->phwi_ctxt;
- phwi_ctxt->be_wrbq = kzalloc(sizeof(struct be_queue_info) *
- phba->params.cxns_per_ctrl,
+ phwi_ctxt->be_wrbq = kzalloc(array_size(sizeof(struct be_queue_info), phba->params.cxns_per_ctrl),
GFP_KERNEL);
if (!phwi_ctxt->be_wrbq) {
beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
@@ -2632,16 +2630,16 @@ static int beiscsi_init_wrb_handle(struct beiscsi_hba *phba)
for (index = 0; index < phba->params.cxns_per_ctrl; index++) {
pwrb_context = &phwi_ctrlr->wrb_context[index];
pwrb_context->pwrb_handle_base =
- kzalloc(sizeof(struct wrb_handle *) *
- phba->params.wrbs_per_cxn, GFP_KERNEL);
+ kzalloc(array_size(sizeof(struct wrb_handle *), phba->params.wrbs_per_cxn),
+ GFP_KERNEL);
if (!pwrb_context->pwrb_handle_base) {
beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
"BM_%d : Mem Alloc Failed. Failing to load\n");
goto init_wrb_hndl_failed;
}
pwrb_context->pwrb_handle_basestd =
- kzalloc(sizeof(struct wrb_handle *) *
- phba->params.wrbs_per_cxn, GFP_KERNEL);
+ kzalloc(array_size(sizeof(struct wrb_handle *), phba->params.wrbs_per_cxn),
+ GFP_KERNEL);
if (!pwrb_context->pwrb_handle_basestd) {
beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
"BM_%d : Mem Alloc Failed. Failing to load\n");
@@ -3353,7 +3351,7 @@ beiscsi_create_wrb_rings(struct beiscsi_hba *phba,
idx = 0;
mem_descr = phba->init_mem;
mem_descr += HWI_MEM_WRB;
- pwrb_arr = kmalloc(sizeof(*pwrb_arr) * phba->params.cxns_per_ctrl,
+ pwrb_arr = kmalloc(array_size(sizeof(*pwrb_arr), phba->params.cxns_per_ctrl),
GFP_KERNEL);
if (!pwrb_arr) {
beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
@@ -3894,17 +3892,14 @@ static int beiscsi_init_sgl_handle(struct beiscsi_hba *phba)
mem_descr_sglh = phba->init_mem;
mem_descr_sglh += HWI_MEM_SGLH;
if (1 == mem_descr_sglh->num_elements) {
- phba->io_sgl_hndl_base = kzalloc(sizeof(struct sgl_handle *) *
- phba->params.ios_per_ctrl,
+ phba->io_sgl_hndl_base = kzalloc(array_size(sizeof(struct sgl_handle *), phba->params.ios_per_ctrl),
GFP_KERNEL);
if (!phba->io_sgl_hndl_base) {
beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
"BM_%d : Mem Alloc Failed. Failing to load\n");
return -ENOMEM;
}
- phba->eh_sgl_hndl_base = kzalloc(sizeof(struct sgl_handle *) *
- (phba->params.icds_per_ctrl -
- phba->params.ios_per_ctrl),
+ phba->eh_sgl_hndl_base = kzalloc(array_size(sizeof(struct sgl_handle *), (phba->params.icds_per_ctrl - phba->params.ios_per_ctrl)),
GFP_KERNEL);
if (!phba->eh_sgl_hndl_base) {
kfree(phba->io_sgl_hndl_base);
@@ -4032,8 +4027,8 @@ static int hba_setup_cid_tbls(struct beiscsi_hba *phba)
phba->cid_array_info[ulp_num] = ptr_cid_info;
}
}
- phba->ep_array = kzalloc(sizeof(struct iscsi_endpoint *) *
- phba->params.cxns_per_ctrl, GFP_KERNEL);
+ phba->ep_array = kzalloc(array_size(sizeof(struct iscsi_endpoint *), phba->params.cxns_per_ctrl),
+ GFP_KERNEL);
if (!phba->ep_array) {
beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
"BM_%d : Failed to allocate memory in "
@@ -4043,8 +4038,8 @@ static int hba_setup_cid_tbls(struct beiscsi_hba *phba)
goto free_memory;
}
- phba->conn_table = kzalloc(sizeof(struct beiscsi_conn *) *
- phba->params.cxns_per_ctrl, GFP_KERNEL);
+ phba->conn_table = kzalloc(array_size(sizeof(struct beiscsi_conn *), phba->params.cxns_per_ctrl),
+ GFP_KERNEL);
if (!phba->conn_table) {
beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
"BM_%d : Failed to allocate memory in"
diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
index 7c884f881180..ad6ae5d1ca25 100644
--- a/drivers/scsi/bfa/bfad_bsg.c
+++ b/drivers/scsi/bfa/bfad_bsg.c
@@ -3252,8 +3252,8 @@ bfad_fcxp_map_sg(struct bfad_s *bfad, void *payload_kbuf,
struct bfa_sge_s *sg_table;
int sge_num = 1;
- buf_base = kzalloc((sizeof(struct bfad_buf_info) +
- sizeof(struct bfa_sge_s)) * sge_num, GFP_KERNEL);
+ buf_base = kzalloc(array_size((sizeof(struct bfad_buf_info) + sizeof(struct bfa_sge_s)), sge_num),
+ GFP_KERNEL);
if (!buf_base)
return NULL;
diff --git a/drivers/scsi/csiostor/csio_wr.c b/drivers/scsi/csiostor/csio_wr.c
index c0a17789752f..6dd3742d575f 100644
--- a/drivers/scsi/csiostor/csio_wr.c
+++ b/drivers/scsi/csiostor/csio_wr.c
@@ -276,8 +276,7 @@ csio_wr_alloc_q(struct csio_hw *hw, uint32_t qsize, uint32_t wrsize,
q->un.iq.flq_idx = flq_idx;
flq = wrm->q_arr[q->un.iq.flq_idx];
- flq->un.fl.bufs = kzalloc(flq->credits *
- sizeof(struct csio_dma_buf),
+ flq->un.fl.bufs = kzalloc(array_size(flq->credits, sizeof(struct csio_dma_buf)),
GFP_KERNEL);
if (!flq->un.fl.bufs) {
csio_err(hw,
@@ -1579,7 +1578,8 @@ csio_wrm_init(struct csio_wrm *wrm, struct csio_hw *hw)
return -EINVAL;
}
- wrm->q_arr = kzalloc(sizeof(struct csio_q *) * wrm->num_q, GFP_KERNEL);
+ wrm->q_arr = kzalloc(array_size(sizeof(struct csio_q *), wrm->num_q),
+ GFP_KERNEL);
if (!wrm->q_arr)
goto err;
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index 5ceea8da7bb6..24af766ca1cb 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -1739,7 +1739,7 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
reply_size = REPLY_FRAME_SIZE;
}
reply_size *= 4;
- reply = kzalloc(REPLY_FRAME_SIZE*4, GFP_KERNEL);
+ reply = kzalloc(array_size(REPLY_FRAME_SIZE, 4), GFP_KERNEL);
if(reply == NULL) {
printk(KERN_WARNING"%s: Could not allocate reply buffer\n",pHba->name);
return -ENOMEM;
diff --git a/drivers/scsi/esas2r/esas2r_init.c b/drivers/scsi/esas2r/esas2r_init.c
index ed2dd0d23a2a..99033d53570b 100644
--- a/drivers/scsi/esas2r/esas2r_init.c
+++ b/drivers/scsi/esas2r/esas2r_init.c
@@ -854,8 +854,8 @@ bool esas2r_init_adapter_struct(struct esas2r_adapter *a,
/* allocate the request table */
a->req_table =
- kzalloc((num_requests + num_ae_requests +
- 1) * sizeof(struct esas2r_request *), GFP_KERNEL);
+ kzalloc(array_size((num_requests + num_ae_requests + 1), sizeof(struct esas2r_request *)),
+ GFP_KERNEL);
if (a->req_table == NULL) {
esas2r_log(ESAS2R_LOG_CRIT,
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 307344abc722..614ce0c52b81 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2173,14 +2173,14 @@ static int hpsa_allocate_ioaccel2_sg_chain_blocks(struct ctlr_info *h)
return 0;
h->ioaccel2_cmd_sg_list =
- kzalloc(sizeof(*h->ioaccel2_cmd_sg_list) * h->nr_cmds,
- GFP_KERNEL);
+ kzalloc(array_size(sizeof(*h->ioaccel2_cmd_sg_list), h->nr_cmds),
+ GFP_KERNEL);
if (!h->ioaccel2_cmd_sg_list)
return -ENOMEM;
for (i = 0; i < h->nr_cmds; i++) {
h->ioaccel2_cmd_sg_list[i] =
- kmalloc(sizeof(*h->ioaccel2_cmd_sg_list[i]) *
- h->maxsgentries, GFP_KERNEL);
+ kmalloc(array_size(sizeof(*h->ioaccel2_cmd_sg_list[i]), h->maxsgentries),
+ GFP_KERNEL);
if (!h->ioaccel2_cmd_sg_list[i])
goto clean;
}
@@ -2212,14 +2212,14 @@ static int hpsa_alloc_sg_chain_blocks(struct ctlr_info *h)
if (h->chainsize <= 0)
return 0;
- h->cmd_sg_list = kzalloc(sizeof(*h->cmd_sg_list) * h->nr_cmds,
- GFP_KERNEL);
+ h->cmd_sg_list = kzalloc(array_size(sizeof(*h->cmd_sg_list), h->nr_cmds),
+ GFP_KERNEL);
if (!h->cmd_sg_list)
return -ENOMEM;
for (i = 0; i < h->nr_cmds; i++) {
- h->cmd_sg_list[i] = kmalloc(sizeof(*h->cmd_sg_list[i]) *
- h->chainsize, GFP_KERNEL);
+ h->cmd_sg_list[i] = kmalloc(array_size(sizeof(*h->cmd_sg_list[i]), h->chainsize),
+ GFP_KERNEL);
if (!h->cmd_sg_list[i])
goto clean;
@@ -7156,7 +7156,7 @@ static int controller_reset_failed(struct CfgTable __iomem *cfgtable)
char *driver_ver, *old_driver_ver;
int rc, size = sizeof(cfgtable->driver_version);
- old_driver_ver = kmalloc(2 * size, GFP_KERNEL);
+ old_driver_ver = kmalloc(array_size(2, size), GFP_KERNEL);
if (!old_driver_ver)
return -ENOMEM;
driver_ver = old_driver_ver + size;
@@ -7936,9 +7936,8 @@ static void hpsa_free_cmd_pool(struct ctlr_info *h)
static int hpsa_alloc_cmd_pool(struct ctlr_info *h)
{
- h->cmd_pool_bits = kzalloc(
- DIV_ROUND_UP(h->nr_cmds, BITS_PER_LONG) *
- sizeof(unsigned long), GFP_KERNEL);
+ h->cmd_pool_bits = kzalloc(array_size(DIV_ROUND_UP(h->nr_cmds, BITS_PER_LONG), sizeof(unsigned long)),
+ GFP_KERNEL);
h->cmd_pool = pci_alloc_consistent(h->pdev,
h->nr_cmds * sizeof(*h->cmd_pool),
&(h->cmd_pool_dhandle));
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index d28b68c0d25d..45b9469cb963 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -9711,8 +9711,8 @@ static int ipr_alloc_mem(struct ipr_ioa_cfg *ioa_cfg)
int i, rc = -ENOMEM;
ENTER;
- ioa_cfg->res_entries = kzalloc(sizeof(struct ipr_resource_entry) *
- ioa_cfg->max_devs_supported, GFP_KERNEL);
+ ioa_cfg->res_entries = kzalloc(array_size(sizeof(struct ipr_resource_entry), ioa_cfg->max_devs_supported),
+ GFP_KERNEL);
if (!ioa_cfg->res_entries)
goto out;
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 15a2fef51e38..5016c429bbe1 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -2576,7 +2576,8 @@ iscsi_pool_init(struct iscsi_pool *q, int max, void ***items, int item_size)
* the array. */
if (items)
num_arrays++;
- q->pool = kvzalloc(num_arrays * max * sizeof(void*), GFP_KERNEL);
+ q->pool = kvzalloc(array3_size(num_arrays, max, sizeof(void *)),
+ GFP_KERNEL);
if (q->pool == NULL)
return -ENOMEM;
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 8b7114348def..a8e185db1900 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -443,7 +443,8 @@ static int sas_expander_discover(struct domain_device *dev)
struct expander_device *ex = &dev->ex_dev;
int res = -ENOMEM;
- ex->ex_phy = kzalloc(sizeof(*ex->ex_phy)*ex->num_phys, GFP_KERNEL);
+ ex->ex_phy = kzalloc(array_size(sizeof(*ex->ex_phy), ex->num_phys),
+ GFP_KERNEL);
if (!ex->ex_phy)
return -ENOMEM;
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index ac999abb4466..87f2616e7a65 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -5121,9 +5121,8 @@ lpfc_sli_hba_setup(struct lpfc_hba *phba)
goto lpfc_sli_hba_setup_error;
}
- phba->vpi_ids = kzalloc(
- (phba->max_vpi+1) * sizeof(uint16_t),
- GFP_KERNEL);
+ phba->vpi_ids = kzalloc(array_size((phba->max_vpi + 1), sizeof(uint16_t)),
+ GFP_KERNEL);
if (!phba->vpi_ids) {
kfree(phba->vpi_bmask);
rc = -ENOMEM;
diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c
index c9d33b1268cb..068c5d7a5ee2 100644
--- a/drivers/scsi/lpfc/lpfc_vport.c
+++ b/drivers/scsi/lpfc/lpfc_vport.c
@@ -840,7 +840,7 @@ lpfc_create_vport_work_array(struct lpfc_hba *phba)
struct lpfc_vport *port_iterator;
struct lpfc_vport **vports;
int index = 0;
- vports = kzalloc((phba->max_vports + 1) * sizeof(struct lpfc_vport *),
+ vports = kzalloc(array_size((phba->max_vports + 1), sizeof(struct lpfc_vport *)),
GFP_KERNEL);
if (vports == NULL)
return NULL;
diff --git a/drivers/scsi/mac53c94.c b/drivers/scsi/mac53c94.c
index 8c4d3003b68b..e3d8fab8bd08 100644
--- a/drivers/scsi/mac53c94.c
+++ b/drivers/scsi/mac53c94.c
@@ -464,8 +464,8 @@ static int mac53c94_probe(struct macio_dev *mdev, const struct of_device_id *mat
* +1 to allow for aligning.
* XXX FIXME: Use DMA consistent routines
*/
- dma_cmd_space = kmalloc((host->sg_tablesize + 2) *
- sizeof(struct dbdma_cmd), GFP_KERNEL);
+ dma_cmd_space = kmalloc(array_size((host->sg_tablesize + 2), sizeof(struct dbdma_cmd)),
+ GFP_KERNEL);
if (dma_cmd_space == 0) {
printk(KERN_ERR "mac53c94: couldn't allocate dma "
"command space for %pOF\n", node);
diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c
index bb802b0c12b8..747bf93ad8f0 100644
--- a/drivers/scsi/megaraid/megaraid_mm.c
+++ b/drivers/scsi/megaraid/megaraid_mm.c
@@ -935,10 +935,10 @@ mraid_mm_register_adp(mraid_mmadp_t *lld_adp)
* Allocate single blocks of memory for all required kiocs,
* mailboxes and passthru structures.
*/
- adapter->kioc_list = kmalloc(sizeof(uioc_t) * lld_adp->max_kioc,
- GFP_KERNEL);
- adapter->mbox_list = kmalloc(sizeof(mbox64_t) * lld_adp->max_kioc,
- GFP_KERNEL);
+ adapter->kioc_list = kmalloc(array_size(sizeof(uioc_t), lld_adp->max_kioc),
+ GFP_KERNEL);
+ adapter->mbox_list = kmalloc(array_size(sizeof(mbox64_t), lld_adp->max_kioc),
+ GFP_KERNEL);
adapter->pthru_dma_pool = dma_pool_create("megaraid mm pthru pool",
&adapter->pdev->dev,
sizeof(mraid_passthru_t),
diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
index 596f3ff965f5..4bdbcaf4929c 100644
--- a/drivers/scsi/pm8001/pm8001_ctl.c
+++ b/drivers/scsi/pm8001/pm8001_ctl.c
@@ -705,7 +705,7 @@ static ssize_t pm8001_store_update_fw(struct device *cdev,
return -EINPROGRESS;
pm8001_ha->fw_status = FLASH_IN_PROGRESS;
- cmd_ptr = kzalloc(count*2, GFP_KERNEL);
+ cmd_ptr = kzalloc(array_size(count, 2), GFP_KERNEL);
if (!cmd_ptr) {
pm8001_ha->fw_status = FAIL_OUT_MEMORY;
return -ENOMEM;
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 4da3592aec0f..05017a3be374 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -523,7 +523,8 @@ static int qedi_init_id_tbl(struct qedi_portid_tbl *id_tbl, u16 size,
id_tbl->max = size;
id_tbl->next = next;
spin_lock_init(&id_tbl->lock);
- id_tbl->table = kzalloc(DIV_ROUND_UP(size, 32) * 4, GFP_KERNEL);
+ id_tbl->table = kzalloc(array_size(DIV_ROUND_UP(size, 32), 4),
+ GFP_KERNEL);
if (!id_tbl->table)
return -ENOMEM;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 8f55dd44adae..95ad539cd3b6 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -3118,8 +3118,8 @@ qla2x00_alloc_outstanding_cmds(struct qla_hw_data *ha, struct req_que *req)
req->num_outstanding_cmds = ha->cur_fw_iocb_count;
}
- req->outstanding_cmds = kzalloc(sizeof(srb_t *) *
- req->num_outstanding_cmds, GFP_KERNEL);
+ req->outstanding_cmds = kzalloc(array_size(sizeof(srb_t *), req->num_outstanding_cmds),
+ GFP_KERNEL);
if (!req->outstanding_cmds) {
/*
@@ -3127,8 +3127,8 @@ qla2x00_alloc_outstanding_cmds(struct qla_hw_data *ha, struct req_que *req)
* initialization.
*/
req->num_outstanding_cmds = MIN_OUTSTANDING_COMMANDS;
- req->outstanding_cmds = kzalloc(sizeof(srb_t *) *
- req->num_outstanding_cmds, GFP_KERNEL);
+ req->outstanding_cmds = kzalloc(array_size(sizeof(srb_t *), req->num_outstanding_cmds),
+ GFP_KERNEL);
if (!req->outstanding_cmds) {
ql_log(ql_log_fatal, NULL, 0x0126,
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index a3dc83f9444d..c59401b4503f 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3434,8 +3434,8 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
"Adjusted Max no of queues pairs: %d.\n", ha->max_qpairs);
}
}
- ha->msix_entries = kzalloc(sizeof(struct qla_msix_entry) *
- ha->msix_count, GFP_KERNEL);
+ ha->msix_entries = kzalloc(array_size(sizeof(struct qla_msix_entry), ha->msix_count),
+ GFP_KERNEL);
if (!ha->msix_entries) {
ql_log(ql_log_fatal, vha, 0x00c8,
"Failed to allocate memory for ha->msix_entries.\n");
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 15eaa6dded04..db39396bfaa0 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -410,7 +410,7 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req,
struct rsp_que *rsp)
{
scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev);
- ha->req_q_map = kzalloc(sizeof(struct req_que *) * ha->max_req_queues,
+ ha->req_q_map = kzalloc(array_size(sizeof(struct req_que *), ha->max_req_queues),
GFP_KERNEL);
if (!ha->req_q_map) {
ql_log(ql_log_fatal, vha, 0x003b,
@@ -418,7 +418,7 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req,
goto fail_req_map;
}
- ha->rsp_q_map = kzalloc(sizeof(struct rsp_que *) * ha->max_rsp_queues,
+ ha->rsp_q_map = kzalloc(array_size(sizeof(struct rsp_que *), ha->max_rsp_queues),
GFP_KERNEL);
if (!ha->rsp_q_map) {
ql_log(ql_log_fatal, vha, 0x003c,
@@ -4045,8 +4045,8 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
(*rsp)->ring);
/* Allocate memory for NVRAM data for vports */
if (ha->nvram_npiv_size) {
- ha->npiv_info = kzalloc(sizeof(struct qla_npiv_entry) *
- ha->nvram_npiv_size, GFP_KERNEL);
+ ha->npiv_info = kzalloc(array_size(sizeof(struct qla_npiv_entry), ha->nvram_npiv_size),
+ GFP_KERNEL);
if (!ha->npiv_info) {
ql_log_pci(ql_log_fatal, ha->pdev, 0x002d,
"Failed to allocate memory for npiv_info.\n");
@@ -4080,8 +4080,8 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
INIT_LIST_HEAD(&ha->vp_list);
/* Allocate memory for our loop_id bitmap */
- ha->loop_id_map = kzalloc(BITS_TO_LONGS(LOOPID_MAP_SIZE) * sizeof(long),
- GFP_KERNEL);
+ ha->loop_id_map = kzalloc(array_size(BITS_TO_LONGS(LOOPID_MAP_SIZE), sizeof(long)),
+ GFP_KERNEL);
if (!ha->loop_id_map)
goto fail_loop_id_map;
else {
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 09997a1b1ec3..58ec467834b2 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -6166,8 +6166,8 @@ int qlt_add_target(struct qla_hw_data *ha, struct scsi_qla_host *base_vha)
return -ENOMEM;
}
- tgt->qphints = kzalloc((ha->max_qpairs + 1) *
- sizeof(struct qla_qpair_hint), GFP_KERNEL);
+ tgt->qphints = kzalloc(array_size((ha->max_qpairs + 1), sizeof(struct qla_qpair_hint)),
+ GFP_KERNEL);
if (!tgt->qphints) {
kfree(tgt);
ql_log(ql_log_warn, base_vha, 0x0197,
diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 060bf5a27df8..cea66df27781 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -4251,8 +4251,8 @@ static int pqi_alloc_io_resources(struct pqi_ctrl_info *ctrl_info)
struct device *dev;
struct pqi_io_request *io_request;
- ctrl_info->io_request_pool = kzalloc(ctrl_info->max_io_slots *
- sizeof(ctrl_info->io_request_pool[0]), GFP_KERNEL);
+ ctrl_info->io_request_pool = kzalloc(array_size(ctrl_info->max_io_slots, sizeof(ctrl_info->io_request_pool[0])),
+ GFP_KERNEL);
if (!ctrl_info->io_request_pool) {
dev_err(&ctrl_info->pci_dev->dev,
diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c
index 8e72bcbd3d6d..60dccb04ebc0 100644
--- a/drivers/sh/intc/core.c
+++ b/drivers/sh/intc/core.c
@@ -203,7 +203,7 @@ int __init register_intc_controller(struct intc_desc *desc)
if (desc->num_resources) {
d->nr_windows = desc->num_resources;
- d->window = kzalloc(d->nr_windows * sizeof(*d->window),
+ d->window = kzalloc(array_size(d->nr_windows, sizeof(*d->window)),
GFP_NOWAIT);
if (!d->window)
goto err1;
@@ -230,12 +230,12 @@ int __init register_intc_controller(struct intc_desc *desc)
d->nr_reg += hw->ack_regs ? hw->nr_ack_regs : 0;
d->nr_reg += hw->subgroups ? hw->nr_subgroups : 0;
- d->reg = kzalloc(d->nr_reg * sizeof(*d->reg), GFP_NOWAIT);
+ d->reg = kzalloc(array_size(d->nr_reg, sizeof(*d->reg)), GFP_NOWAIT);
if (!d->reg)
goto err2;
#ifdef CONFIG_SMP
- d->smp = kzalloc(d->nr_reg * sizeof(*d->smp), GFP_NOWAIT);
+ d->smp = kzalloc(array_size(d->nr_reg, sizeof(*d->smp)), GFP_NOWAIT);
if (!d->smp)
goto err3;
#endif
@@ -253,7 +253,7 @@ int __init register_intc_controller(struct intc_desc *desc)
}
if (hw->prio_regs) {
- d->prio = kzalloc(hw->nr_vectors * sizeof(*d->prio),
+ d->prio = kzalloc(array_size(hw->nr_vectors, sizeof(*d->prio)),
GFP_NOWAIT);
if (!d->prio)
goto err4;
@@ -269,7 +269,7 @@ int __init register_intc_controller(struct intc_desc *desc)
}
if (hw->sense_regs) {
- d->sense = kzalloc(hw->nr_vectors * sizeof(*d->sense),
+ d->sense = kzalloc(array_size(hw->nr_vectors, sizeof(*d->sense)),
GFP_NOWAIT);
if (!d->sense)
goto err5;
diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c
index 7525039d812c..476aff20a67e 100644
--- a/drivers/sh/maple/maple.c
+++ b/drivers/sh/maple/maple.c
@@ -161,7 +161,7 @@ int maple_add_packet(struct maple_device *mdev, u32 function, u32 command,
void *sendbuf = NULL;
if (length) {
- sendbuf = kzalloc(length * 4, GFP_KERNEL);
+ sendbuf = kzalloc(array_size(length, 4), GFP_KERNEL);
if (!sendbuf) {
ret = -ENOMEM;
goto out;
diff --git a/drivers/soc/fsl/qbman/qman_test_stash.c b/drivers/soc/fsl/qbman/qman_test_stash.c
index e87b65403b67..e39356db13aa 100644
--- a/drivers/soc/fsl/qbman/qman_test_stash.c
+++ b/drivers/soc/fsl/qbman/qman_test_stash.c
@@ -221,7 +221,7 @@ static int allocate_frame_data(void)
pcfg = qman_get_qm_portal_config(qman_dma_portal);
- __frame_ptr = kmalloc(4 * HP_NUM_WORDS, GFP_KERNEL);
+ __frame_ptr = kmalloc(array_size(4, HP_NUM_WORDS), GFP_KERNEL);
if (!__frame_ptr)
return -ENOMEM;
diff --git a/drivers/staging/lustre/lustre/lov/lov_io.c b/drivers/staging/lustre/lustre/lov/lov_io.c
index b823f8a21856..406ecaf64930 100644
--- a/drivers/staging/lustre/lustre/lov/lov_io.c
+++ b/drivers/staging/lustre/lustre/lov/lov_io.c
@@ -243,9 +243,8 @@ static int lov_io_subio_init(const struct lu_env *env, struct lov_io *lio,
* when writing a page. -jay
*/
lio->lis_subs =
- kvzalloc(lsm->lsm_stripe_count *
- sizeof(lio->lis_subs[0]),
- GFP_NOFS);
+ kvzalloc(array_size(lsm->lsm_stripe_count, sizeof(lio->lis_subs[0])),
+ GFP_NOFS);
if (lio->lis_subs) {
lio->lis_nr_subios = lio->lis_stripe_count;
lio->lis_single_subio_index = -1;
diff --git a/drivers/staging/lustre/lustre/lov/lov_object.c b/drivers/staging/lustre/lustre/lov/lov_object.c
index f7c69680cb7d..6aab63bc1063 100644
--- a/drivers/staging/lustre/lustre/lov/lov_object.c
+++ b/drivers/staging/lustre/lustre/lov/lov_object.c
@@ -242,8 +242,8 @@ static int lov_init_raid0(const struct lu_env *env, struct lov_device *dev,
r0->lo_nr = lsm->lsm_stripe_count;
LASSERT(r0->lo_nr <= lov_targets_nr(dev));
- r0->lo_sub = kvzalloc(r0->lo_nr * sizeof(r0->lo_sub[0]),
- GFP_NOFS);
+ r0->lo_sub = kvzalloc(array_size(r0->lo_nr, sizeof(r0->lo_sub[0])),
+ GFP_NOFS);
if (r0->lo_sub) {
int psz = 0;
diff --git a/drivers/staging/lustre/lustre/ptlrpc/sec_bulk.c b/drivers/staging/lustre/lustre/ptlrpc/sec_bulk.c
index 625b9520d78f..ce1c152f79bb 100644
--- a/drivers/staging/lustre/lustre/ptlrpc/sec_bulk.c
+++ b/drivers/staging/lustre/lustre/ptlrpc/sec_bulk.c
@@ -375,9 +375,8 @@ static inline void enc_pools_alloc(void)
{
LASSERT(page_pools.epp_max_pools);
page_pools.epp_pools =
- kvzalloc(page_pools.epp_max_pools *
- sizeof(*page_pools.epp_pools),
- GFP_KERNEL);
+ kvzalloc(array_size(page_pools.epp_max_pools, sizeof(*page_pools.epp_pools)),
+ GFP_KERNEL);
}
static inline void enc_pools_free(void)
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_firmware.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_firmware.c
index 8158ea40d069..bf2d6aa5db36 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_firmware.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_firmware.c
@@ -226,9 +226,8 @@ sh_css_load_firmware(const char *fw_data,
sh_css_num_binaries = file_header->binary_nr;
/* Only allocate memory for ISP blob info */
if (sh_css_num_binaries > NUM_OF_SPS) {
- sh_css_blob_info = kmalloc(
- (sh_css_num_binaries - NUM_OF_SPS) *
- sizeof(*sh_css_blob_info), GFP_KERNEL);
+ sh_css_blob_info = kmalloc(array_size((sh_css_num_binaries - NUM_OF_SPS), sizeof(*sh_css_blob_info)),
+ GFP_KERNEL);
if (!sh_css_blob_info)
return IA_CSS_ERR_CANNOT_ALLOCATE_MEMORY;
} else {
diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index d607c59761cf..0d4b85246210 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -1679,7 +1679,7 @@ static short rtl8192_usb_initendpoints(struct net_device *dev)
{
struct r8192_priv *priv = ieee80211_priv(dev);
- priv->rx_urb = kmalloc(sizeof(struct urb *) * (MAX_RX_URB + 1),
+ priv->rx_urb = kmalloc(array_size(sizeof(struct urb *), (MAX_RX_URB + 1)),
GFP_KERNEL);
if (!priv->rx_urb)
return -ENOMEM;
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
index b26533983864..12474855c806 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -321,7 +321,7 @@ static char *translate_scan(struct adapter *padapter,
RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_wx_get_scan: ssid =%s\n", pnetwork->network.Ssid.Ssid));
RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_wx_get_scan: wpa_len =%d rsn_len =%d\n", wpa_len, rsn_len));
- buf = kzalloc(MAX_WPA_IE_LEN*2, GFP_KERNEL);
+ buf = kzalloc(array_size(MAX_WPA_IE_LEN, 2), GFP_KERNEL);
if (!buf)
return start;
if (wpa_len > 0) {
diff --git a/drivers/staging/rtlwifi/efuse.c b/drivers/staging/rtlwifi/efuse.c
index d74c80d512c9..99f1f22505d4 100644
--- a/drivers/staging/rtlwifi/efuse.c
+++ b/drivers/staging/rtlwifi/efuse.c
@@ -248,8 +248,8 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
}
/* allocate memory for efuse_tbl and efuse_word */
- efuse_tbl = kzalloc(rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE] *
- sizeof(u8), GFP_ATOMIC);
+ efuse_tbl = kzalloc(array_size(rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE], sizeof(u8)),
+ GFP_ATOMIC);
if (!efuse_tbl)
return;
efuse_word = kcalloc(EFUSE_MAX_WORD_UNIT, sizeof(u16 *), GFP_ATOMIC);
diff --git a/drivers/staging/rts5208/ms.c b/drivers/staging/rts5208/ms.c
index 821256b95e22..126fa860a919 100644
--- a/drivers/staging/rts5208/ms.c
+++ b/drivers/staging/rts5208/ms.c
@@ -1049,7 +1049,7 @@ static int ms_read_attribute_info(struct rtsx_chip *chip)
return STATUS_FAIL;
}
- buf = kmalloc(64 * 512, GFP_KERNEL);
+ buf = kmalloc(array_size(64, 512), GFP_KERNEL);
if (!buf) {
rtsx_trace(chip);
return STATUS_ERROR;
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 4ad89ea71a70..63a62ff5a868 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1692,8 +1692,8 @@ static int tcmu_configure_device(struct se_device *dev)
info = &udev->uio_info;
- udev->data_bitmap = kzalloc(BITS_TO_LONGS(udev->max_blocks) *
- sizeof(unsigned long), GFP_KERNEL);
+ udev->data_bitmap = kzalloc(array_size(BITS_TO_LONGS(udev->max_blocks), sizeof(unsigned long)),
+ GFP_KERNEL);
if (!udev->data_bitmap) {
ret = -ENOMEM;
goto err_bitmap_alloc;
diff --git a/drivers/thermal/int340x_thermal/acpi_thermal_rel.c b/drivers/thermal/int340x_thermal/acpi_thermal_rel.c
index c719167e9f28..832bd6d61db6 100644
--- a/drivers/thermal/int340x_thermal/acpi_thermal_rel.c
+++ b/drivers/thermal/int340x_thermal/acpi_thermal_rel.c
@@ -96,7 +96,7 @@ int acpi_parse_trt(acpi_handle handle, int *trt_count, struct trt **trtp,
}
*trt_count = p->package.count;
- trts = kzalloc(*trt_count * sizeof(struct trt), GFP_KERNEL);
+ trts = kzalloc(array_size(*trt_count, sizeof(struct trt)), GFP_KERNEL);
if (!trts) {
result = -ENOMEM;
goto end;
@@ -178,7 +178,7 @@ int acpi_parse_art(acpi_handle handle, int *art_count, struct art **artp,
/* ignore p->package.elements[0], as this is _ART Revision field */
*art_count = p->package.count - 1;
- arts = kzalloc(*art_count * sizeof(struct art), GFP_KERNEL);
+ arts = kzalloc(array_size(*art_count, sizeof(struct art)), GFP_KERNEL);
if (!arts) {
result = -ENOMEM;
goto end;
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index e09f0354a4bc..d758d7f7aa07 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -870,7 +870,8 @@ __init *thermal_of_build_thermal_zone(struct device_node *np)
if (tz->ntrips == 0) /* must have at least one child */
goto finish;
- tz->trips = kzalloc(tz->ntrips * sizeof(*tz->trips), GFP_KERNEL);
+ tz->trips = kzalloc(array_size(tz->ntrips, sizeof(*tz->trips)),
+ GFP_KERNEL);
if (!tz->trips) {
ret = -ENOMEM;
goto free_tz;
@@ -896,7 +897,8 @@ __init *thermal_of_build_thermal_zone(struct device_node *np)
if (tz->num_tbps == 0)
goto finish;
- tz->tbps = kzalloc(tz->num_tbps * sizeof(*tz->tbps), GFP_KERNEL);
+ tz->tbps = kzalloc(array_size(tz->num_tbps, sizeof(*tz->tbps)),
+ GFP_KERNEL);
if (!tz->tbps) {
ret = -ENOMEM;
goto free_trips;
diff --git a/drivers/tty/hvc/hvc_iucv.c b/drivers/tty/hvc/hvc_iucv.c
index a74680729825..825331079061 100644
--- a/drivers/tty/hvc/hvc_iucv.c
+++ b/drivers/tty/hvc/hvc_iucv.c
@@ -1252,7 +1252,7 @@ static int hvc_iucv_setup_filter(const char *val)
if (size > MAX_VMID_FILTER)
return -ENOSPC;
- array = kzalloc(size * 8, GFP_KERNEL);
+ array = kzalloc(array_size(size, 8), GFP_KERNEL);
if (!array)
return -ENOMEM;
diff --git a/drivers/tty/isicom.c b/drivers/tty/isicom.c
index bdd3027ef01b..10c39cf042c9 100644
--- a/drivers/tty/isicom.c
+++ b/drivers/tty/isicom.c
@@ -1477,7 +1477,7 @@ static int load_firmware(struct pci_dev *pdev,
goto errrelfw;
}
- data = kmalloc(word_count * 2, GFP_KERNEL);
+ data = kmalloc(array_size(word_count, 2), GFP_KERNEL);
if (data == NULL) {
dev_err(&pdev->dev, "Card%d, firmware upload "
"failed, not enough memory\n", index + 1);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 0466f9f08a91..be8f348da37f 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2458,7 +2458,8 @@ int uart_register_driver(struct uart_driver *drv)
* Maybe we should be using a slab cache for this, especially if
* we have a large number of ports to handle.
*/
- drv->state = kzalloc(sizeof(struct uart_state) * drv->nr, GFP_KERNEL);
+ drv->state = kzalloc(array_size(sizeof(struct uart_state), drv->nr),
+ GFP_KERNEL);
if (!drv->state)
goto out;
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index 7851383fbd6c..b521a6732f72 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -280,7 +280,8 @@ int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *t
/* Allocate a new buffer before freeing the old one ... */
multiplier = use_unicode ? 3 : 1; /* chars can take up to 3 bytes */
- bp = kmalloc(((sel_end-sel_start)/2+1)*multiplier, GFP_KERNEL);
+ bp = kmalloc(array_size(((sel_end - sel_start) / 2 + 1), multiplier),
+ GFP_KERNEL);
if (!bp) {
printk(KERN_WARNING "selection: kmalloc() failed\n");
clear_selection();
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index f6fdc9f54ec7..2adf21e65a58 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -390,7 +390,8 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
}
/* initialize all the urbs we'll use */
- io->urbs = kmalloc(io->entries * sizeof(*io->urbs), mem_flags);
+ io->urbs = kmalloc(array_size(io->entries, sizeof(*io->urbs)),
+ mem_flags);
if (!io->urbs)
goto nomem;
diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
index 56b517a38865..c00d610ed648 100644
--- a/drivers/usb/gadget/udc/fsl_udc_core.c
+++ b/drivers/usb/gadget/udc/fsl_udc_core.c
@@ -2259,7 +2259,8 @@ static int struct_udc_setup(struct fsl_udc *udc,
pdata = dev_get_platdata(&pdev->dev);
udc->phy_mode = pdata->phy_mode;
- udc->eps = kzalloc(sizeof(struct fsl_ep) * udc->max_ep, GFP_KERNEL);
+ udc->eps = kzalloc(array_size(sizeof(struct fsl_ep), udc->max_ep),
+ GFP_KERNEL);
if (!udc->eps)
return -1;
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index e56db44708bc..962285c95151 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -117,8 +117,8 @@ static struct ehci_tt *find_tt(struct usb_device *udev)
if (utt->multi) {
tt_index = utt->hcpriv;
if (!tt_index) { /* Create the index array */
- tt_index = kzalloc(utt->hub->maxchild *
- sizeof(*tt_index), GFP_ATOMIC);
+ tt_index = kzalloc(array_size(utt->hub->maxchild, sizeof(*tt_index)),
+ GFP_ATOMIC);
if (!tt_index)
return ERR_PTR(-ENOMEM);
utt->hcpriv = tt_index;
diff --git a/drivers/usb/host/imx21-hcd.c b/drivers/usb/host/imx21-hcd.c
index 3a8bbfe43a8e..26c816133de7 100644
--- a/drivers/usb/host/imx21-hcd.c
+++ b/drivers/usb/host/imx21-hcd.c
@@ -741,8 +741,8 @@ static int imx21_hc_urb_enqueue_isoc(struct usb_hcd *hcd,
if (urb_priv == NULL)
return -ENOMEM;
- urb_priv->isoc_td = kzalloc(
- sizeof(struct td) * urb->number_of_packets, mem_flags);
+ urb_priv->isoc_td = kzalloc(array_size(sizeof(struct td), urb->number_of_packets),
+ mem_flags);
if (urb_priv->isoc_td == NULL) {
ret = -ENOMEM;
goto alloc_td_failed;
diff --git a/drivers/usb/host/isp1362-hcd.c b/drivers/usb/host/isp1362-hcd.c
index b21c386e6a46..c054b52148e5 100644
--- a/drivers/usb/host/isp1362-hcd.c
+++ b/drivers/usb/host/isp1362-hcd.c
@@ -2400,7 +2400,7 @@ static int isp1362_chip_test(struct isp1362_hcd *isp1362_hcd)
u16 *ref;
unsigned long flags;
- ref = kmalloc(2 * ISP1362_BUF_SIZE, GFP_KERNEL);
+ ref = kmalloc(array_size(2, ISP1362_BUF_SIZE), GFP_KERNEL);
if (ref) {
int offset;
u16 *tst = &ref[ISP1362_BUF_SIZE / 2];
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 0b0d4893715e..8b32d7261b57 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2310,8 +2310,8 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
* Not sure how the USB core will handle a hub with no ports...
*/
if (xhci->num_usb2_ports) {
- xhci->usb2_ports = kmalloc(sizeof(*xhci->usb2_ports)*
- xhci->num_usb2_ports, flags);
+ xhci->usb2_ports = kmalloc(array_size(sizeof(*xhci->usb2_ports), xhci->num_usb2_ports),
+ flags);
if (!xhci->usb2_ports)
return -ENOMEM;
@@ -2335,8 +2335,8 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
}
}
if (xhci->num_usb3_ports) {
- xhci->usb3_ports = kmalloc(sizeof(*xhci->usb3_ports)*
- xhci->num_usb3_ports, flags);
+ xhci->usb3_ports = kmalloc(array_size(sizeof(*xhci->usb3_ports), xhci->num_usb3_ports),
+ flags);
if (!xhci->usb3_ports)
return -ENOMEM;
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index 236a60f53099..55f13e665a86 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -695,7 +695,8 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n");
dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
- dev->ring_buffer = kmalloc(ring_buffer_size*(sizeof(size_t)+dev->interrupt_in_endpoint_size), GFP_KERNEL);
+ dev->ring_buffer = kmalloc(array_size(ring_buffer_size, (sizeof(size_t) + dev->interrupt_in_endpoint_size)),
+ GFP_KERNEL);
if (!dev->ring_buffer)
goto error;
dev->interrupt_in_buffer = kmalloc(dev->interrupt_in_endpoint_size, GFP_KERNEL);
@@ -706,7 +707,8 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
goto error;
dev->interrupt_out_endpoint_size = dev->interrupt_out_endpoint ? usb_endpoint_maxp(dev->interrupt_out_endpoint) :
udev->descriptor.bMaxPacketSize0;
- dev->interrupt_out_buffer = kmalloc(write_buffer_size*dev->interrupt_out_endpoint_size, GFP_KERNEL);
+ dev->interrupt_out_buffer = kmalloc(array_size(write_buffer_size, dev->interrupt_out_endpoint_size),
+ GFP_KERNEL);
if (!dev->interrupt_out_buffer)
goto error;
dev->interrupt_out_urb = usb_alloc_urb(0, GFP_KERNEL);
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index 2761fad66b95..d3bb24dc2be2 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -1024,7 +1024,8 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg
return -EINVAL;
size = CHUNK_ALIGN(arg);
- vec = kzalloc(sizeof(struct mon_pgmap) * (size / CHUNK_SIZE), GFP_KERNEL);
+ vec = kzalloc(array_size(sizeof(struct mon_pgmap), (size / CHUNK_SIZE)),
+ GFP_KERNEL);
if (vec == NULL) {
ret = -ENOMEM;
break;
diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
index 900591df8bb2..cd1fe1e87125 100644
--- a/drivers/usb/storage/alauda.c
+++ b/drivers/usb/storage/alauda.c
@@ -1025,7 +1025,8 @@ static int alauda_write_data(struct us_data *us, unsigned long address,
* We also need a temporary block buffer, where we read in the old data,
* overwrite parts with the new data, and manipulate the redundancy data
*/
- blockbuffer = kmalloc((pagesize + 64) * blocksize, GFP_NOIO);
+ blockbuffer = kmalloc(array_size((pagesize + 64), blocksize),
+ GFP_NOIO);
if (!blockbuffer) {
kfree(buffer);
return USB_STOR_TRANSPORT_ERROR;
diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index 93cf57ac47d6..1b96afbc1b0d 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -807,8 +807,10 @@ static int ms_lib_alloc_logicalmap(struct us_data *us)
u32 i;
struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
- info->MS_Lib.Phy2LogMap = kmalloc(info->MS_Lib.NumberOfPhyBlock * sizeof(u16), GFP_KERNEL);
- info->MS_Lib.Log2PhyMap = kmalloc(info->MS_Lib.NumberOfLogBlock * sizeof(u16), GFP_KERNEL);
+ info->MS_Lib.Phy2LogMap = kmalloc(array_size(info->MS_Lib.NumberOfPhyBlock, sizeof(u16)),
+ GFP_KERNEL);
+ info->MS_Lib.Log2PhyMap = kmalloc(array_size(info->MS_Lib.NumberOfLogBlock, sizeof(u16)),
+ GFP_KERNEL);
if ((info->MS_Lib.Phy2LogMap == NULL) || (info->MS_Lib.Log2PhyMap == NULL)) {
ms_lib_free_logicalmap(us);
@@ -1113,8 +1115,10 @@ static int ms_lib_alloc_writebuf(struct us_data *us)
info->MS_Lib.wrtblk = (u16)-1;
- info->MS_Lib.blkpag = kmalloc(info->MS_Lib.PagesPerBlock * info->MS_Lib.BytesPerSector, GFP_KERNEL);
- info->MS_Lib.blkext = kmalloc(info->MS_Lib.PagesPerBlock * sizeof(struct ms_lib_type_extdat), GFP_KERNEL);
+ info->MS_Lib.blkpag = kmalloc(array_size(info->MS_Lib.PagesPerBlock, info->MS_Lib.BytesPerSector),
+ GFP_KERNEL);
+ info->MS_Lib.blkext = kmalloc(array_size(info->MS_Lib.PagesPerBlock, sizeof(struct ms_lib_type_extdat)),
+ GFP_KERNEL);
if ((info->MS_Lib.blkpag == NULL) || (info->MS_Lib.blkext == NULL)) {
ms_lib_free_writebuf(us);
diff --git a/drivers/usb/storage/isd200.c b/drivers/usb/storage/isd200.c
index f5e4500d9970..6938f096f3c8 100644
--- a/drivers/usb/storage/isd200.c
+++ b/drivers/usb/storage/isd200.c
@@ -1458,7 +1458,7 @@ static int isd200_init_info(struct us_data *us)
if (!info)
return ISD200_ERROR;
- info->id = kzalloc(ATA_ID_WORDS * 2, GFP_KERNEL);
+ info->id = kzalloc(array_size(ATA_ID_WORDS, 2), GFP_KERNEL);
info->RegsBuf = kmalloc(sizeof(info->ATARegs), GFP_KERNEL);
info->srb.sense_buffer = kmalloc(SCSI_SENSE_BUFFERSIZE, GFP_KERNEL);
diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c
index 306fa78a026d..4295621ed796 100644
--- a/drivers/usb/storage/sddr55.c
+++ b/drivers/usb/storage/sddr55.c
@@ -651,7 +651,7 @@ static int sddr55_read_map(struct us_data *us) {
numblocks = info->capacity >> (info->blockshift + info->pageshift);
- buffer = kmalloc( numblocks * 2, GFP_NOIO );
+ buffer = kmalloc(array_size(numblocks, 2), GFP_NOIO);
if (!buffer)
return -1;
diff --git a/drivers/usb/wusbcore/wa-rpipe.c b/drivers/usb/wusbcore/wa-rpipe.c
index d0f1a6698460..0e9e30436f37 100644
--- a/drivers/usb/wusbcore/wa-rpipe.c
+++ b/drivers/usb/wusbcore/wa-rpipe.c
@@ -470,7 +470,7 @@ int rpipe_get_by_ep(struct wahc *wa, struct usb_host_endpoint *ep,
int wa_rpipes_create(struct wahc *wa)
{
wa->rpipes = le16_to_cpu(wa->wa_descr->wNumRPipes);
- wa->rpipe_bm = kzalloc(BITS_TO_LONGS(wa->rpipes)*sizeof(unsigned long),
+ wa->rpipe_bm = kzalloc(array_size(BITS_TO_LONGS(wa->rpipes), sizeof(unsigned long)),
GFP_KERNEL);
if (wa->rpipe_bm == NULL)
return -ENOMEM;
diff --git a/drivers/uwb/est.c b/drivers/uwb/est.c
index f3e232584284..7c9ba8195c2c 100644
--- a/drivers/uwb/est.c
+++ b/drivers/uwb/est.c
@@ -217,7 +217,7 @@ static
int uwb_est_grow(void)
{
size_t actual_size = uwb_est_size * sizeof(uwb_est[0]);
- void *new = kmalloc(2 * actual_size, GFP_ATOMIC);
+ void *new = kmalloc(array_size(2, actual_size), GFP_ATOMIC);
if (new == NULL)
return -ENOMEM;
memcpy(new, uwb_est, actual_size);
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index a50cf45e530f..4a511052dd13 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -376,7 +376,7 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
i1480 = &i1480_usb->i1480;
i1480->buf_size = 512;
- i1480->cmd_buf = kmalloc(2 * i1480->buf_size, GFP_KERNEL);
+ i1480->cmd_buf = kmalloc(array_size(2, i1480->buf_size), GFP_KERNEL);
if (i1480->cmd_buf == NULL) {
dev_err(dev, "Cannot allocate transfer buffers\n");
result = -ENOMEM;
diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
index 08b822656846..34f508444a27 100644
--- a/drivers/video/console/sticore.c
+++ b/drivers/video/console/sticore.c
@@ -649,7 +649,7 @@ static void *sti_bmode_font_raw(struct sti_cooked_font *f)
unsigned char *n, *p, *q;
int size = f->raw->bytes_per_char*256+sizeof(struct sti_rom_font);
- n = kzalloc(4*size, STI_LOWMEM);
+ n = kzalloc(array_size(4, size), STI_LOWMEM);
if (!n)
return NULL;
p = n + 3;
diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index 790900d646c0..85dd4278a0b7 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -269,7 +269,7 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
if (attribute) {
u8 *dst;
- dst = kmalloc(w * vc->vc_font.height, GFP_ATOMIC);
+ dst = kmalloc(array_size(w, vc->vc_font.height), GFP_ATOMIC);
if (!dst)
return;
kfree(ops->cursor_data);
@@ -312,7 +312,8 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
vc->vc_cursor_type != ops->p->cursor_shape ||
ops->cursor_state.mask == NULL ||
ops->cursor_reset) {
- char *mask = kmalloc(w*vc->vc_font.height, GFP_ATOMIC);
+ char *mask = kmalloc(array_size(w, vc->vc_font.height),
+ GFP_ATOMIC);
int cur_height, size, i = 0;
u8 msk = 0xff;
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 3e330e0f56ed..c910e74d46ff 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -591,7 +591,8 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info,
if (scr_readw(r) != vc->vc_video_erase_char)
break;
if (r != q && new_rows >= rows + logo_lines) {
- save = kmalloc(logo_lines * new_cols * 2, GFP_KERNEL);
+ save = kmalloc(array3_size(logo_lines, new_cols, 2),
+ GFP_KERNEL);
if (save) {
int i = cols < new_cols ? cols : new_cols;
scr_memsetw(save, erase, logo_lines * new_cols * 2);
diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c
index 37a8b0b22566..8267510f3125 100644
--- a/drivers/video/fbdev/core/fbcon_ccw.c
+++ b/drivers/video/fbdev/core/fbcon_ccw.c
@@ -258,7 +258,7 @@ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
if (attribute) {
u8 *dst;
- dst = kmalloc(w * vc->vc_font.width, GFP_ATOMIC);
+ dst = kmalloc(array_size(w, vc->vc_font.width), GFP_ATOMIC);
if (!dst)
return;
kfree(ops->cursor_data);
@@ -304,14 +304,16 @@ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
vc->vc_cursor_type != ops->p->cursor_shape ||
ops->cursor_state.mask == NULL ||
ops->cursor_reset) {
- char *tmp, *mask = kmalloc(w*vc->vc_font.width, GFP_ATOMIC);
+ char *tmp, *mask = kmalloc(array_size(w, vc->vc_font.width),
+ GFP_ATOMIC);
int cur_height, size, i = 0;
int width = (vc->vc_font.width + 7)/8;
if (!mask)
return;
- tmp = kmalloc(width * vc->vc_font.height, GFP_ATOMIC);
+ tmp = kmalloc(array_size(width, vc->vc_font.height),
+ GFP_ATOMIC);
if (!tmp) {
kfree(mask);
diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c
index 1888f8c866e8..1a770f970c3f 100644
--- a/drivers/video/fbdev/core/fbcon_cw.c
+++ b/drivers/video/fbdev/core/fbcon_cw.c
@@ -241,7 +241,7 @@ static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
if (attribute) {
u8 *dst;
- dst = kmalloc(w * vc->vc_font.width, GFP_ATOMIC);
+ dst = kmalloc(array_size(w, vc->vc_font.width), GFP_ATOMIC);
if (!dst)
return;
kfree(ops->cursor_data);
@@ -287,14 +287,16 @@ static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
vc->vc_cursor_type != ops->p->cursor_shape ||
ops->cursor_state.mask == NULL ||
ops->cursor_reset) {
- char *tmp, *mask = kmalloc(w*vc->vc_font.width, GFP_ATOMIC);
+ char *tmp, *mask = kmalloc(array_size(w, vc->vc_font.width),
+ GFP_ATOMIC);
int cur_height, size, i = 0;
int width = (vc->vc_font.width + 7)/8;
if (!mask)
return;
- tmp = kmalloc(width * vc->vc_font.height, GFP_ATOMIC);
+ tmp = kmalloc(array_size(width, vc->vc_font.height),
+ GFP_ATOMIC);
if (!tmp) {
kfree(mask);
diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c
index f98eee263597..0d9fded15f3a 100644
--- a/drivers/video/fbdev/core/fbcon_ud.c
+++ b/drivers/video/fbdev/core/fbcon_ud.c
@@ -289,7 +289,7 @@ static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode,
if (attribute) {
u8 *dst;
- dst = kmalloc(w * vc->vc_font.height, GFP_ATOMIC);
+ dst = kmalloc(array_size(w, vc->vc_font.height), GFP_ATOMIC);
if (!dst)
return;
kfree(ops->cursor_data);
@@ -335,7 +335,8 @@ static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode,
vc->vc_cursor_type != ops->p->cursor_shape ||
ops->cursor_state.mask == NULL ||
ops->cursor_reset) {
- char *mask = kmalloc(w*vc->vc_font.height, GFP_ATOMIC);
+ char *mask = kmalloc(array_size(w, vc->vc_font.height),
+ GFP_ATOMIC);
int cur_height, size, i = 0;
u8 msk = 0xff;
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index f741ba8df01b..e5620d065866 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -475,7 +475,7 @@ static int fb_show_logo_line(struct fb_info *info, int rotate,
if (fb_logo.needs_truepalette ||
fb_logo.needs_directpalette) {
- palette = kmalloc(256 * 4, GFP_KERNEL);
+ palette = kmalloc(array_size(256, 4), GFP_KERNEL);
if (palette == NULL)
return 0;
@@ -489,7 +489,8 @@ static int fb_show_logo_line(struct fb_info *info, int rotate,
}
if (fb_logo.depth <= 4) {
- logo_new = kmalloc(logo->width * logo->height, GFP_KERNEL);
+ logo_new = kmalloc(array_size(logo->width, logo->height),
+ GFP_KERNEL);
if (logo_new == NULL) {
kfree(palette);
if (saved_pseudo_palette)
@@ -506,8 +507,8 @@ static int fb_show_logo_line(struct fb_info *info, int rotate,
image.height = logo->height;
if (rotate) {
- logo_rotate = kmalloc(logo->width *
- logo->height, GFP_KERNEL);
+ logo_rotate = kmalloc(array_size(logo->width, logo->height),
+ GFP_KERNEL);
if (logo_rotate)
fb_rotate_logo(info, logo_rotate, &image, rotate);
}
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index 24642cd9d25b..1b5c49e0923c 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -1056,8 +1056,8 @@ void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs)
if (!(num + svd_n))
return;
- m = kzalloc((specs->modedb_len + num + svd_n) *
- sizeof(struct fb_videomode), GFP_KERNEL);
+ m = kzalloc(array_size((specs->modedb_len + num + svd_n), sizeof(struct fb_videomode)),
+ GFP_KERNEL);
if (!m)
return;
diff --git a/drivers/video/fbdev/i810/i810_main.c b/drivers/video/fbdev/i810/i810_main.c
index d18f7b31932c..aac30cfaaf5e 100644
--- a/drivers/video/fbdev/i810/i810_main.c
+++ b/drivers/video/fbdev/i810/i810_main.c
@@ -1513,7 +1513,7 @@ static int i810fb_cursor(struct fb_info *info, struct fb_cursor *cursor)
int size = ((cursor->image.width + 7) >> 3) *
cursor->image.height;
int i;
- u8 *data = kmalloc(64 * 8, GFP_ATOMIC);
+ u8 *data = kmalloc(array_size(64, 8), GFP_ATOMIC);
if (data == NULL)
return -ENOMEM;
@@ -2023,7 +2023,7 @@ static int i810fb_init_pci(struct pci_dev *dev,
par = info->par;
par->dev = dev;
- if (!(info->pixmap.addr = kzalloc(8*1024, GFP_KERNEL))) {
+ if (!(info->pixmap.addr = kzalloc(array_size(8, 1024), GFP_KERNEL))) {
i810fb_release_resource(info, par);
return -ENOMEM;
}
diff --git a/drivers/video/fbdev/intelfb/intelfbdrv.c b/drivers/video/fbdev/intelfb/intelfbdrv.c
index d7463a2a5d83..b1f4b68967d6 100644
--- a/drivers/video/fbdev/intelfb/intelfbdrv.c
+++ b/drivers/video/fbdev/intelfb/intelfbdrv.c
@@ -506,7 +506,7 @@ static int intelfb_pci_register(struct pci_dev *pdev,
dinfo->pdev = pdev;
/* Reserve pixmap space. */
- info->pixmap.addr = kzalloc(64 * 1024, GFP_KERNEL);
+ info->pixmap.addr = kzalloc(array_size(64, 1024), GFP_KERNEL);
if (info->pixmap.addr == NULL) {
ERR_MSG("Cannot reserve pixmap memory.\n");
goto err_out_pixmap;
diff --git a/drivers/video/fbdev/matrox/g450_pll.c b/drivers/video/fbdev/matrox/g450_pll.c
index c15f8a57498e..6adf58736da6 100644
--- a/drivers/video/fbdev/matrox/g450_pll.c
+++ b/drivers/video/fbdev/matrox/g450_pll.c
@@ -518,7 +518,8 @@ int matroxfb_g450_setclk(struct matrox_fb_info *minfo, unsigned int fout,
{
unsigned int* arr;
- arr = kmalloc(sizeof(*arr) * MNP_TABLE_SIZE * 2, GFP_KERNEL);
+ arr = kmalloc(array3_size(sizeof(*arr), MNP_TABLE_SIZE, 2),
+ GFP_KERNEL);
if (arr) {
int r;
diff --git a/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
index fe92eed6da70..f7012a88af34 100644
--- a/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
+++ b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
@@ -245,7 +245,7 @@ static void mb86290fb_imageblit(struct fb_info *info,
return;
}
- cmd = kmalloc(cmdlen * 4, GFP_DMA);
+ cmd = kmalloc(array_size(cmdlen, 4), GFP_DMA);
if (!cmd)
return cfb_imageblit(info, image);
cmdfn(cmd, step, dx, dy, width, height, fgcolor, bgcolor, image, info);
diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
index 418a2d0d06a9..d35970a8887c 100644
--- a/drivers/video/fbdev/nvidia/nvidia.c
+++ b/drivers/video/fbdev/nvidia/nvidia.c
@@ -566,7 +566,8 @@ static int nvidiafb_cursor(struct fb_info *info, struct fb_cursor *cursor)
u8 *msk = (u8 *) cursor->mask;
u8 *src;
- src = kmalloc(s_pitch * cursor->image.height, GFP_ATOMIC);
+ src = kmalloc(array_size(s_pitch, cursor->image.height),
+ GFP_ATOMIC);
if (src) {
switch (cursor->rop) {
@@ -1284,7 +1285,7 @@ static int nvidiafb_probe(struct pci_dev *pd, const struct pci_device_id *ent)
par = info->par;
par->pci_dev = pd;
- info->pixmap.addr = kzalloc(8 * 1024, GFP_KERNEL);
+ info->pixmap.addr = kzalloc(array_size(8, 1024), GFP_KERNEL);
if (info->pixmap.addr == NULL)
goto err_out_kfree;
diff --git a/drivers/video/fbdev/riva/fbdev.c b/drivers/video/fbdev/riva/fbdev.c
index ff8282374f37..1a7f7a3fc93a 100644
--- a/drivers/video/fbdev/riva/fbdev.c
+++ b/drivers/video/fbdev/riva/fbdev.c
@@ -1615,7 +1615,8 @@ static int rivafb_cursor(struct fb_info *info, struct fb_cursor *cursor)
u8 *msk = (u8 *) cursor->mask;
u8 *src;
- src = kmalloc(s_pitch * cursor->image.height, GFP_ATOMIC);
+ src = kmalloc(array_size(s_pitch, cursor->image.height),
+ GFP_ATOMIC);
if (src) {
switch (cursor->rop) {
@@ -1909,7 +1910,7 @@ static int rivafb_probe(struct pci_dev *pd, const struct pci_device_id *ent)
default_par = info->par;
default_par->pdev = pd;
- info->pixmap.addr = kzalloc(8 * 1024, GFP_KERNEL);
+ info->pixmap.addr = kzalloc(array_size(8, 1024), GFP_KERNEL);
if (info->pixmap.addr == NULL) {
ret = -ENOMEM;
goto err_framebuffer_release;
diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
index 889a3dee98e9..06a408fd6f2e 100644
--- a/drivers/video/fbdev/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
@@ -486,8 +486,8 @@ static int uvesafb_vbe_getmodes(struct uvesafb_ktask *task,
mode++;
}
- par->vbe_modes = kzalloc(sizeof(struct vbe_mode_ib) *
- par->vbe_modes_cnt, GFP_KERNEL);
+ par->vbe_modes = kzalloc(array_size(sizeof(struct vbe_mode_ib), par->vbe_modes_cnt),
+ GFP_KERNEL);
if (!par->vbe_modes)
return -ENOMEM;
@@ -1044,7 +1044,8 @@ static int uvesafb_setcmap(struct fb_cmap *cmap, struct fb_info *info)
info->cmap.len || cmap->start < info->cmap.start)
return -EINVAL;
- entries = kmalloc(sizeof(*entries) * cmap->len, GFP_KERNEL);
+ entries = kmalloc(array_size(sizeof(*entries), cmap->len),
+ GFP_KERNEL);
if (!entries)
return -ENOMEM;
diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
index 83b8963c9657..8b1fdc19cde5 100644
--- a/drivers/video/of_display_timing.c
+++ b/drivers/video/of_display_timing.c
@@ -181,8 +181,8 @@ struct display_timings *of_get_display_timings(const struct device_node *np)
goto entryfail;
}
- disp->timings = kzalloc(sizeof(struct display_timing *) *
- disp->num_timings, GFP_KERNEL);
+ disp->timings = kzalloc(array_size(sizeof(struct display_timing *), disp->num_timings),
+ GFP_KERNEL);
if (!disp->timings) {
pr_err("%pOF: could not allocate timings array\n", np);
goto entryfail;
diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
index 7351f620fe4b..ef393e9bcbcd 100644
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -69,7 +69,8 @@ static void vbg_guest_mappings_init(struct vbg_dev *gdev)
/* Add 4M so that we can align the vmap to 4MiB as the host requires. */
size = PAGE_ALIGN(req->hypervisor_size) + SZ_4M;
- pages = kmalloc(sizeof(*pages) * (size >> PAGE_SHIFT), GFP_KERNEL);
+ pages = kmalloc(array_size(sizeof(*pages), (size >> PAGE_SHIFT)),
+ GFP_KERNEL);
if (!pages)
goto out;
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index ee2c891b55c6..43897e381505 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -234,7 +234,7 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY))
return -ENXIO;
- entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
+ entries = kmalloc(array_size(op->value, sizeof(*entries)), GFP_KERNEL);
if (entries == NULL)
return -ENOMEM;
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index b2c9728f8164..39b9af14e913 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -203,7 +203,8 @@ static int afs_deliver_cb_callback(struct afs_call *call)
if (call->count > AFSCBMAX)
return afs_protocol_error(call, -EBADMSG);
- call->buffer = kmalloc(call->count * 3 * 4, GFP_KERNEL);
+ call->buffer = kmalloc(array3_size(call->count, 3, 4),
+ GFP_KERNEL);
if (!call->buffer)
return -ENOMEM;
call->offset = 0;
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index dc062b195c46..5ef9a7b4bcbc 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -1603,9 +1603,8 @@ static int btrfsic_read_block(struct btrfsic_state *state,
num_pages = (block_ctx->len + (u64)PAGE_SIZE - 1) >>
PAGE_SHIFT;
- block_ctx->mem_to_free = kzalloc((sizeof(*block_ctx->datav) +
- sizeof(*block_ctx->pagev)) *
- num_pages, GFP_NOFS);
+ block_ctx->mem_to_free = kzalloc(array_size((sizeof(*block_ctx->datav) + sizeof(*block_ctx->pagev)), num_pages),
+ GFP_NOFS);
if (!block_ctx->mem_to_free)
return -ENOMEM;
block_ctx->datav = block_ctx->mem_to_free;
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 5ece2e6ad154..9eb0df9b44d0 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2992,8 +2992,8 @@ static int encode_caps_cb(struct inode *inode, struct ceph_cap *cap,
num_flock_locks = 0;
}
if (num_fcntl_locks + num_flock_locks > 0) {
- flocks = kmalloc((num_fcntl_locks + num_flock_locks) *
- sizeof(struct ceph_filelock), GFP_NOFS);
+ flocks = kmalloc(array_size((num_fcntl_locks + num_flock_locks), sizeof(struct ceph_filelock)),
+ GFP_NOFS);
if (!flocks) {
err = -ENOMEM;
goto out_free;
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 29e48ae8e269..b85ff8a1b69c 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1379,7 +1379,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
if (!(ses->server) || !tree)
return -EIO;
- unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
+ unc_path = kmalloc(array_size(MAX_SHARENAME_LENGTH, 2), GFP_KERNEL);
if (unc_path == NULL)
return -ENOMEM;
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 927226a2122f..5e4dfe6f6fbd 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -832,7 +832,7 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses,
int rc;
if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
- new_iov = kmalloc(sizeof(struct kvec) * (n_vec + 1),
+ new_iov = kmalloc(array_size(sizeof(struct kvec), (n_vec + 1)),
GFP_KERNEL);
if (!new_iov) {
/* otherwise cifs_send_recv below sets resp_buf_type */
@@ -874,7 +874,7 @@ smb2_send_recv(const unsigned int xid, struct cifs_ses *ses,
__be32 rfc1002_marker;
if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
- new_iov = kmalloc(sizeof(struct kvec) * (n_vec + 1),
+ new_iov = kmalloc(array_size(sizeof(struct kvec), (n_vec + 1)),
GFP_KERNEL);
if (!new_iov)
return -ENOMEM;
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 708b574a35a4..fa8aaa4cb60f 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -577,7 +577,7 @@ int ext4_ext_precache(struct inode *inode)
down_read(&ei->i_data_sem);
depth = ext_depth(inode);
- path = kzalloc(sizeof(struct ext4_ext_path) * (depth + 1),
+ path = kzalloc(array_size(sizeof(struct ext4_ext_path), (depth + 1)),
GFP_NOFS);
if (path == NULL) {
up_read(&ei->i_data_sem);
@@ -879,8 +879,8 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block,
}
if (!path) {
/* account possible depth increase */
- path = kzalloc(sizeof(struct ext4_ext_path) * (depth + 2),
- GFP_NOFS);
+ path = kzalloc(array_size(sizeof(struct ext4_ext_path), (depth + 2)),
+ GFP_NOFS);
if (unlikely(!path))
return ERR_PTR(-ENOMEM);
path[0].p_maxdepth = depth + 1;
@@ -2921,7 +2921,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
path[k].p_block =
le16_to_cpu(path[k].p_hdr->eh_entries)+1;
} else {
- path = kzalloc(sizeof(struct ext4_ext_path) * (depth + 1),
+ path = kzalloc(array_size(sizeof(struct ext4_ext_path), (depth + 1)),
GFP_NOFS);
if (path == NULL) {
ext4_journal_stop(handle);
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index d5640ca8c499..c0b74b875b96 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -839,8 +839,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
if (unlikely(err))
goto exit_dind;
- n_group_desc = ext4_kvmalloc((gdb_num + 1) *
- sizeof(struct buffer_head *),
+ n_group_desc = ext4_kvmalloc(array_size((gdb_num + 1), sizeof(struct buffer_head *)),
GFP_NOFS);
if (!n_group_desc) {
err = -ENOMEM;
@@ -918,8 +917,7 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
gdb_bh = sb_bread(sb, gdblock);
if (!gdb_bh)
return -EIO;
- n_group_desc = ext4_kvmalloc((gdb_num + 1) *
- sizeof(struct buffer_head *),
+ n_group_desc = ext4_kvmalloc(array_size((gdb_num + 1), sizeof(struct buffer_head *)),
GFP_NOFS);
if (!n_group_desc) {
err = -ENOMEM;
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 947e64abb95d..74975b3be6aa 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1362,7 +1362,8 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
if (!fud)
return -EPERM;
- bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
+ bufs = kmalloc(array_size(pipe->buffers, sizeof(struct pipe_buffer)),
+ GFP_KERNEL);
if (!bufs)
return -ENOMEM;
@@ -1943,7 +1944,8 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
if (!fud)
return -EPERM;
- bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
+ bufs = kmalloc(array_size(pipe->buffers, sizeof(struct pipe_buffer)),
+ GFP_KERNEL);
if (!bufs)
return -ENOMEM;
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index d68bf63af8b8..3f6aba012006 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -1169,7 +1169,7 @@ static int dir_double_exhash(struct gfs2_inode *dip)
if (IS_ERR(hc))
return PTR_ERR(hc);
- hc2 = kmalloc(hsize_bytes * 2, GFP_NOFS | __GFP_NOWARN);
+ hc2 = kmalloc(array_size(hsize_bytes, 2), GFP_NOFS | __GFP_NOWARN);
if (hc2 == NULL)
hc2 = __vmalloc(hsize_bytes * 2, GFP_NOFS, PAGE_KERNEL);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 8b683917a27e..948a167d34cf 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -2605,7 +2605,7 @@ void gfs2_rlist_alloc(struct gfs2_rgrp_list *rlist, unsigned int state)
{
unsigned int x;
- rlist->rl_ghs = kmalloc(rlist->rl_rgrps * sizeof(struct gfs2_holder),
+ rlist->rl_ghs = kmalloc(array_size(rlist->rl_rgrps, sizeof(struct gfs2_holder)),
GFP_NOFS | __GFP_NOFAIL);
for (x = 0; x < rlist->rl_rgrps; x++)
gfs2_holder_init(rlist->rl_rgd[x]->rd_gl,
diff --git a/fs/hpfs/dnode.c b/fs/hpfs/dnode.c
index a4ad18afbdec..052a2dd64ea6 100644
--- a/fs/hpfs/dnode.c
+++ b/fs/hpfs/dnode.c
@@ -33,7 +33,7 @@ int hpfs_add_pos(struct inode *inode, loff_t *pos)
if (hpfs_inode->i_rddir_off[i] == pos)
return 0;
if (!(i&0x0f)) {
- if (!(ppos = kmalloc((i+0x11) * sizeof(loff_t*), GFP_NOFS))) {
+ if (!(ppos = kmalloc(array_size((i + 0x11), sizeof(loff_t *)), GFP_NOFS))) {
pr_err("out of memory for position list\n");
return -ENOMEM;
}
diff --git a/fs/hpfs/map.c b/fs/hpfs/map.c
index 7c49f1ef0c85..616ffe643e1e 100644
--- a/fs/hpfs/map.c
+++ b/fs/hpfs/map.c
@@ -115,7 +115,7 @@ __le32 *hpfs_load_bitmap_directory(struct super_block *s, secno bmp)
int n = (hpfs_sb(s)->sb_fs_size + 0x200000 - 1) >> 21;
int i;
__le32 *b;
- if (!(b = kmalloc(n * 512, GFP_KERNEL))) {
+ if (!(b = kmalloc(array_size(n, 512), GFP_KERNEL))) {
pr_err("can't allocate memory for bitmap directory\n");
return NULL;
}
diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
index 2cfe487708e0..ac8ec1680544 100644
--- a/fs/jffs2/wbuf.c
+++ b/fs/jffs2/wbuf.c
@@ -1208,7 +1208,8 @@ int jffs2_nand_flash_setup(struct jffs2_sb_info *c)
if (!c->wbuf)
return -ENOMEM;
- c->oobbuf = kmalloc(NR_OOB_SCAN_PAGES * c->oobavail, GFP_KERNEL);
+ c->oobbuf = kmalloc(array_size(NR_OOB_SCAN_PAGES, c->oobavail),
+ GFP_KERNEL);
if (!c->oobbuf) {
kfree(c->wbuf);
return -ENOMEM;
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index de2bcb36e079..70880fb1db18 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -594,7 +594,8 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
struct component_name ciKey;
struct super_block *sb = ip->i_sb;
- ciKey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t), GFP_NOFS);
+ ciKey.name = kmalloc(array_size((JFS_NAME_MAX + 1), sizeof(wchar_t)),
+ GFP_NOFS);
if (!ciKey.name) {
rc = -ENOMEM;
goto dtSearch_Exit2;
@@ -957,7 +958,8 @@ static int dtSplitUp(tid_t tid,
smp = split->mp;
sp = DT_PAGE(ip, smp);
- key.name = kmalloc((JFS_NAME_MAX + 2) * sizeof(wchar_t), GFP_NOFS);
+ key.name = kmalloc(array_size((JFS_NAME_MAX + 2), sizeof(wchar_t)),
+ GFP_NOFS);
if (!key.name) {
DT_PUTPAGE(smp);
rc = -ENOMEM;
@@ -3779,13 +3781,13 @@ static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
struct component_name lkey;
struct component_name rkey;
- lkey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t),
- GFP_KERNEL);
+ lkey.name = kmalloc(array_size((JFS_NAME_MAX + 1), sizeof(wchar_t)),
+ GFP_KERNEL);
if (lkey.name == NULL)
return -ENOMEM;
- rkey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t),
- GFP_KERNEL);
+ rkey.name = kmalloc(array_size((JFS_NAME_MAX + 1), sizeof(wchar_t)),
+ GFP_KERNEL);
if (rkey.name == NULL) {
kfree(lkey.name);
return -ENOMEM;
diff --git a/fs/jfs/jfs_unicode.c b/fs/jfs/jfs_unicode.c
index c7de6f5bbefc..3c324911b127 100644
--- a/fs/jfs/jfs_unicode.c
+++ b/fs/jfs/jfs_unicode.c
@@ -121,7 +121,7 @@ int get_UCSname(struct component_name * uniName, struct dentry *dentry)
return -ENAMETOOLONG;
uniName->name =
- kmalloc((length + 1) * sizeof(wchar_t), GFP_NOFS);
+ kmalloc(array_size((length + 1), sizeof(wchar_t)), GFP_NOFS);
if (uniName->name == NULL)
return -ENOMEM;
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 8ceb25a10ea0..fd042ba61e10 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -404,8 +404,8 @@ fsloc_parse(char **mesg, char *buf, struct nfsd4_fs_locations *fsloc)
if (fsloc->locations_count == 0)
return 0;
- fsloc->locations = kzalloc(fsloc->locations_count
- * sizeof(struct nfsd4_fs_location), GFP_KERNEL);
+ fsloc->locations = kzalloc(array_size(fsloc->locations_count, sizeof(struct nfsd4_fs_location)),
+ GFP_KERNEL);
if (!fsloc->locations)
return -ENOMEM;
for (i=0; i < fsloc->locations_count; i++) {
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index e5dcea6cee5f..748d7e81bfcf 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -1383,7 +1383,7 @@ static int __ocfs2_recovery_thread(void *arg)
goto bail;
}
- rm_quota = kzalloc(osb->max_slots * sizeof(int), GFP_NOFS);
+ rm_quota = kzalloc(array_size(osb->max_slots, sizeof(int)), GFP_NOFS);
if (!rm_quota) {
status = -ENOMEM;
goto bail;
diff --git a/fs/ocfs2/sysfile.c b/fs/ocfs2/sysfile.c
index af155c183123..bef0932590ce 100644
--- a/fs/ocfs2/sysfile.c
+++ b/fs/ocfs2/sysfile.c
@@ -69,9 +69,7 @@ static struct inode **get_local_system_inode(struct ocfs2_super *osb,
spin_unlock(&osb->osb_lock);
if (unlikely(!local_system_inodes)) {
- local_system_inodes = kzalloc(sizeof(struct inode *) *
- NUM_LOCAL_SYSTEM_INODES *
- osb->max_slots,
+ local_system_inodes = kzalloc(array3_size(sizeof(struct inode *), NUM_LOCAL_SYSTEM_INODES, osb->max_slots),
GFP_NOFS);
if (!local_system_inodes) {
mlog_errno(-ENOMEM);
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index 2dba29eadde6..ca9b06516f0d 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -612,7 +612,7 @@ static int ovl_get_index_name_fh(struct ovl_fh *fh, struct qstr *name)
{
char *n, *s;
- n = kzalloc(fh->len * 2, GFP_KERNEL);
+ n = kzalloc(array_size(fh->len, 2), GFP_KERNEL);
if (!n)
return -ENOMEM;
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 8989936f2995..e4bb535b4df3 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -1417,7 +1417,7 @@ static int register_leaf_sysctl_tables(const char *path, char *pos,
/* If there are mixed files and directories we need a new table */
if (nr_dirs && nr_files) {
struct ctl_table *new;
- files = kzalloc(sizeof(struct ctl_table) * (nr_files + 1),
+ files = kzalloc(array_size(sizeof(struct ctl_table), (nr_files + 1)),
GFP_KERNEL);
if (!files)
goto out;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index c486ad4b43f0..70448d34bf2d 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1466,7 +1466,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
pm.show_pfn = file_ns_capable(file, &init_user_ns, CAP_SYS_ADMIN);
pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
- pm.buffer = kmalloc(pm.len * PM_ENTRY_BYTES, GFP_KERNEL);
+ pm.buffer = kmalloc(array_size(pm.len, PM_ENTRY_BYTES), GFP_KERNEL);
ret = -ENOMEM;
if (!pm.buffer)
goto out_mm;
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index b13fc024d2ee..e5e0781f6c35 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -1044,7 +1044,8 @@ int reiserfs_get_block(struct inode *inode, sector_t block,
if (blocks_needed == 1) {
un = &unf_single;
} else {
- un = kzalloc(min(blocks_needed, max_to_insert) * UNFM_P_SIZE, GFP_NOFS);
+ un = kzalloc(array_size(min(blocks_needed, max_to_insert), UNFM_P_SIZE),
+ GFP_NOFS);
if (!un) {
un = &unf_single;
blocks_needed = 1;
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 23148c3ed675..d8c85c9a3227 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2192,10 +2192,10 @@ static int journal_read_transaction(struct super_block *sb,
* now we know we've got a good transaction, and it was
* inside the valid time ranges
*/
- log_blocks = kmalloc(get_desc_trans_len(desc) *
- sizeof(struct buffer_head *), GFP_NOFS);
- real_blocks = kmalloc(get_desc_trans_len(desc) *
- sizeof(struct buffer_head *), GFP_NOFS);
+ log_blocks = kmalloc(array_size(get_desc_trans_len(desc), sizeof(struct buffer_head *)),
+ GFP_NOFS);
+ real_blocks = kmalloc(array_size(get_desc_trans_len(desc), sizeof(struct buffer_head *)),
+ GFP_NOFS);
if (!log_blocks || !real_blocks) {
brelse(c_bh);
brelse(d_bh);
diff --git a/fs/select.c b/fs/select.c
index ba879c51288f..41ad4307f7b5 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -1223,7 +1223,7 @@ static int compat_core_sys_select(int n, compat_ulong_t __user *inp,
size = FDS_BYTES(n);
bits = stack_fds;
if (size > sizeof(stack_fds) / 6) {
- bits = kmalloc(6 * size, GFP_KERNEL);
+ bits = kmalloc(array_size(6, size), GFP_KERNEL);
ret = -ENOMEM;
if (!bits)
goto out_nofds;
diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index 322f7aa7f44f..6f3a83cce258 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -628,7 +628,7 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
/* Needed by 'ubifs_pack_lsave()' */
c->main_first = c->leb_cnt - *main_lebs;
- lsave = kmalloc(sizeof(int) * c->lsave_cnt, GFP_KERNEL);
+ lsave = kmalloc(array_size(sizeof(int), c->lsave_cnt), GFP_KERNEL);
pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_KERNEL);
nnode = kzalloc(sizeof(struct ubifs_nnode), GFP_KERNEL);
buf = vmalloc(c->leb_size);
@@ -1698,7 +1698,8 @@ static int lpt_init_wr(struct ubifs_info *c)
return -ENOMEM;
if (c->big_lpt) {
- c->lsave = kmalloc(sizeof(int) * c->lsave_cnt, GFP_NOFS);
+ c->lsave = kmalloc(array_size(sizeof(int), c->lsave_cnt),
+ GFP_NOFS);
if (!c->lsave)
return -ENOMEM;
err = read_lsave(c);
@@ -1940,7 +1941,7 @@ int ubifs_lpt_scan_nolock(struct ubifs_info *c, int start_lnum, int end_lnum,
return err;
}
- path = kmalloc(sizeof(struct lpt_scan_node) * (c->lpt_hght + 1),
+ path = kmalloc(array_size(sizeof(struct lpt_scan_node), (c->lpt_hght + 1)),
GFP_NOFS);
if (!path)
return -ENOMEM;
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index ba3d0e0f8615..d3ccabce9be0 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -1104,7 +1104,7 @@ static struct ubifs_znode *dirty_cow_bottom_up(struct ubifs_info *c,
ubifs_assert(znode);
if (c->zroot.znode->level > BOTTOM_UP_HEIGHT) {
kfree(c->bottom_up_buf);
- c->bottom_up_buf = kmalloc(c->zroot.znode->level * sizeof(int),
+ c->bottom_up_buf = kmalloc(array_size(c->zroot.znode->level, sizeof(int)),
GFP_NOFS);
if (!c->bottom_up_buf)
return ERR_PTR(-ENOMEM);
diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
index 3fad907bbd25..74841922335d 100644
--- a/fs/ubifs/tnc_commit.c
+++ b/fs/ubifs/tnc_commit.c
@@ -366,7 +366,8 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
dbg_gc("%d znodes to write", cnt);
- c->gap_lebs = kmalloc(sizeof(int) * (c->lst.idx_lebs + 1), GFP_NOFS);
+ c->gap_lebs = kmalloc(array_size(sizeof(int), (c->lst.idx_lebs + 1)),
+ GFP_NOFS);
if (!c->gap_lebs)
return -ENOMEM;
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 55bcd93a1145..6a9a664848fc 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1647,8 +1647,8 @@ static noinline int udf_process_sequence(
memset(data.vds, 0, sizeof(struct udf_vds_record) * VDS_POS_LENGTH);
data.size_part_descs = PART_DESC_ALLOC_STEP;
- data.part_descs_loc = kzalloc(sizeof(*data.part_descs_loc) *
- data.size_part_descs, GFP_KERNEL);
+ data.part_descs_loc = kzalloc(array_size(sizeof(*data.part_descs_loc), data.size_part_descs),
+ GFP_KERNEL);
if (!data.part_descs_loc)
return -ENOMEM;
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 8254b8b3690f..543802fbf86d 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -541,7 +541,7 @@ static int ufs_read_cylinder_structures(struct super_block *sb)
* Read cylinder group (we read only first fragment from block
* at this time) and prepare internal data structures for cg caching.
*/
- if (!(sbi->s_ucg = kmalloc (sizeof(struct buffer_head *) * uspi->s_ncg, GFP_NOFS)))
+ if (!(sbi->s_ucg = kmalloc(array_size(sizeof(struct buffer_head *), uspi->s_ncg), GFP_NOFS)))
goto failed;
for (i = 0; i < uspi->s_ncg; i++)
sbi->s_ucg[i] = NULL;
diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index b4b5b81e7251..6860fb1108f0 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -623,7 +623,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key)
if (!key || key->prefixlen > trie->max_prefixlen)
goto find_leftmost;
- node_stack = kmalloc(trie->max_prefixlen * sizeof(struct lpm_trie_node *),
+ node_stack = kmalloc(array_size(trie->max_prefixlen, sizeof(struct lpm_trie_node *)),
GFP_ATOMIC | __GFP_NOWARN);
if (!node_stack)
return -ENOMEM;
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5dd1dcb902bf..a3170ed0f8c9 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5265,7 +5265,8 @@ static int jit_subprogs(struct bpf_verifier_env *env)
insn->imm = 1;
}
- func = kzalloc(sizeof(prog) * (env->subprog_cnt + 1), GFP_KERNEL);
+ func = kzalloc(array_size(sizeof(prog), (env->subprog_cnt + 1)),
+ GFP_KERNEL);
if (!func)
return -ENOMEM;
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index d68ef0115ee9..4c3f39aff8e6 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -683,7 +683,7 @@ static int generate_sched_domains(cpumask_var_t **domains,
goto done;
}
- csa = kmalloc(nr_cpusets() * sizeof(cp), GFP_KERNEL);
+ csa = kmalloc(array_size(nr_cpusets(), sizeof(cp)), GFP_KERNEL);
if (!csa)
goto done;
csn = 0;
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index e405677ee08d..ac7be4cc0809 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -691,7 +691,8 @@ static int kdb_defcmd2(const char *cmdstr, const char *argv0)
}
if (!s->usable)
return KDB_NOTIMP;
- s->command = kzalloc((s->count + 1) * sizeof(*(s->command)), GFP_KDB);
+ s->command = kzalloc(array_size((s->count + 1), sizeof(*(s->command))),
+ GFP_KDB);
if (!s->command) {
kdb_printf("Could not allocate new kdb_defcmd table for %s\n",
cmdstr);
@@ -729,7 +730,7 @@ static int kdb_defcmd(int argc, const char **argv)
kdb_printf("Command only available during kdb_init()\n");
return KDB_NOTIMP;
}
- defcmd_set = kmalloc((defcmd_set_count + 1) * sizeof(*defcmd_set),
+ defcmd_set = kmalloc(array_size((defcmd_set_count + 1), sizeof(*defcmd_set)),
GFP_KDB);
if (!defcmd_set)
goto fail_defcmd;
@@ -2706,8 +2707,8 @@ int kdb_register_flags(char *cmd,
}
if (i >= kdb_max_commands) {
- kdbtab_t *new = kmalloc((kdb_max_commands - KDB_BASE_CMD_MAX +
- kdb_command_extend) * sizeof(*new), GFP_KDB);
+ kdbtab_t *new = kmalloc(array_size((kdb_max_commands - KDB_BASE_CMD_MAX + kdb_command_extend), sizeof(*new)),
+ GFP_KDB);
if (!new) {
kdb_printf("Could not allocate new kdb_command "
"table\n");
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 1725b902983f..1ef39478b866 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1184,7 +1184,8 @@ static struct xol_area *__create_xol_area(unsigned long vaddr)
if (unlikely(!area))
goto out;
- area->bitmap = kzalloc(BITS_TO_LONGS(UINSNS_PER_PAGE) * sizeof(long), GFP_KERNEL);
+ area->bitmap = kzalloc(array_size(BITS_TO_LONGS(UINSNS_PER_PAGE), sizeof(long)),
+ GFP_KERNEL);
if (!area->bitmap)
goto free_area;
diff --git a/kernel/fail_function.c b/kernel/fail_function.c
index 1d5632d8bbcc..c0694c049c2c 100644
--- a/kernel/fail_function.c
+++ b/kernel/fail_function.c
@@ -258,7 +258,7 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
/* cut off if it is too long */
if (count > KSYM_NAME_LEN)
count = KSYM_NAME_LEN;
- buf = kmalloc(sizeof(char) * (count + 1), GFP_KERNEL);
+ buf = kmalloc(array_size(sizeof(char), (count + 1)), GFP_KERNEL);
if (!buf)
return -ENOMEM;
diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c
index 6850ffd69125..194c341e327f 100644
--- a/kernel/locking/locktorture.c
+++ b/kernel/locking/locktorture.c
@@ -913,7 +913,8 @@ static int __init lock_torture_init(void)
/* Initialize the statistics so that each run gets its own numbers. */
if (nwriters_stress) {
lock_is_write_held = 0;
- cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL);
+ cxt.lwsa = kmalloc(array_size(sizeof(*cxt.lwsa), cxt.nrealwriters_stress),
+ GFP_KERNEL);
if (cxt.lwsa == NULL) {
VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory");
firsterr = -ENOMEM;
@@ -942,7 +943,8 @@ static int __init lock_torture_init(void)
if (nreaders_stress) {
lock_is_read_held = 0;
- cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL);
+ cxt.lrsa = kmalloc(array_size(sizeof(*cxt.lrsa), cxt.nrealreaders_stress),
+ GFP_KERNEL);
if (cxt.lrsa == NULL) {
VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory");
firsterr = -ENOMEM;
@@ -985,7 +987,7 @@ static int __init lock_torture_init(void)
}
if (nwriters_stress) {
- writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]),
+ writer_tasks = kzalloc(array_size(cxt.nrealwriters_stress, sizeof(writer_tasks[0])),
GFP_KERNEL);
if (writer_tasks == NULL) {
VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory");
@@ -995,7 +997,7 @@ static int __init lock_torture_init(void)
}
if (cxt.cur_ops->readlock) {
- reader_tasks = kzalloc(cxt.nrealreaders_stress * sizeof(reader_tasks[0]),
+ reader_tasks = kzalloc(array_size(cxt.nrealreaders_stress, sizeof(reader_tasks[0])),
GFP_KERNEL);
if (reader_tasks == NULL) {
VERBOSE_TOROUT_ERRSTRING("reader_tasks: Out of memory");
diff --git a/kernel/relay.c b/kernel/relay.c
index c955b10c973c..248ab20adc77 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -169,7 +169,8 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan)
buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
if (!buf)
return NULL;
- buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL);
+ buf->padding = kmalloc(array_size(chan->n_subbufs, sizeof(size_t *)),
+ GFP_KERNEL);
if (!buf->padding)
goto free_buf;
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 6a78cf70761d..2a43effaaea3 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -3047,7 +3047,7 @@ int proc_do_large_bitmap(struct ctl_table *table, int write,
if (IS_ERR(kbuf))
return PTR_ERR(kbuf);
- tmp_bitmap = kzalloc(BITS_TO_LONGS(bitmap_len) * sizeof(unsigned long),
+ tmp_bitmap = kzalloc(array_size(BITS_TO_LONGS(bitmap_len), sizeof(unsigned long)),
GFP_KERNEL);
if (!tmp_bitmap) {
kfree(kbuf);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 2ca63426d8f0..6af952aab9f5 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4361,7 +4361,7 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
if (mask == TRACE_ITER_RECORD_TGID) {
if (!tgid_map)
- tgid_map = kzalloc((PID_MAX_DEFAULT + 1) * sizeof(*tgid_map),
+ tgid_map = kzalloc(array_size((PID_MAX_DEFAULT + 1), sizeof(*tgid_map)),
GFP_KERNEL);
if (!tgid_map) {
tr->trace_flags &= ~TRACE_ITER_RECORD_TGID;
@@ -5069,7 +5069,8 @@ trace_insert_eval_map_file(struct module *mod, struct trace_eval_map **start,
* where the head holds the module and length of array, and the
* tail holds a pointer to the next list.
*/
- map_array = kmalloc(sizeof(*map_array) * (len + 2), GFP_KERNEL);
+ map_array = kmalloc(array_size(sizeof(*map_array), (len + 2)),
+ GFP_KERNEL);
if (!map_array) {
pr_warn("Unable to allocate trace eval mapping\n");
return;
diff --git a/lib/argv_split.c b/lib/argv_split.c
index 5c35752a9414..67721cf97a63 100644
--- a/lib/argv_split.c
+++ b/lib/argv_split.c
@@ -69,7 +69,7 @@ char **argv_split(gfp_t gfp, const char *str, int *argcp)
return NULL;
argc = count_argc(argv_str);
- argv = kmalloc(sizeof(*argv) * (argc + 2), gfp);
+ argv = kmalloc(array_size(sizeof(*argv), (argc + 2)), gfp);
if (!argv) {
kfree(argv_str);
return NULL;
diff --git a/lib/reed_solomon/reed_solomon.c b/lib/reed_solomon/reed_solomon.c
index 06d04cfa9339..bde83becda91 100644
--- a/lib/reed_solomon/reed_solomon.c
+++ b/lib/reed_solomon/reed_solomon.c
@@ -85,15 +85,18 @@ static struct rs_control *rs_init(int symsize, int gfpoly, int (*gffunc)(int),
rs->gffunc = gffunc;
/* Allocate the arrays */
- rs->alpha_to = kmalloc(sizeof(uint16_t) * (rs->nn + 1), GFP_KERNEL);
+ rs->alpha_to = kmalloc(array_size(sizeof(uint16_t), (rs->nn + 1)),
+ GFP_KERNEL);
if (rs->alpha_to == NULL)
goto errrs;
- rs->index_of = kmalloc(sizeof(uint16_t) * (rs->nn + 1), GFP_KERNEL);
+ rs->index_of = kmalloc(array_size(sizeof(uint16_t), (rs->nn + 1)),
+ GFP_KERNEL);
if (rs->index_of == NULL)
goto erralp;
- rs->genpoly = kmalloc(sizeof(uint16_t) * (rs->nroots + 1), GFP_KERNEL);
+ rs->genpoly = kmalloc(array_size(sizeof(uint16_t), (rs->nroots + 1)),
+ GFP_KERNEL);
if(rs->genpoly == NULL)
goto erridx;
diff --git a/lib/test_string.c b/lib/test_string.c
index 0fcdb82dca86..6c0c8f5f0b28 100644
--- a/lib/test_string.c
+++ b/lib/test_string.c
@@ -8,7 +8,7 @@ static __init int memset16_selftest(void)
unsigned i, j, k;
u16 v, *p;
- p = kmalloc(256 * 2 * 2, GFP_KERNEL);
+ p = kmalloc(array3_size(256, 2, 2), GFP_KERNEL);
if (!p)
return -1;
@@ -44,7 +44,7 @@ static __init int memset32_selftest(void)
unsigned i, j, k;
u32 v, *p;
- p = kmalloc(256 * 2 * 4, GFP_KERNEL);
+ p = kmalloc(array3_size(256, 2, 4), GFP_KERNEL);
if (!p)
return -1;
@@ -80,7 +80,7 @@ static __init int memset64_selftest(void)
unsigned i, j, k;
u64 v, *p;
- p = kmalloc(256 * 2 * 8, GFP_KERNEL);
+ p = kmalloc(array3_size(256, 2, 8), GFP_KERNEL);
if (!p)
return -1;
diff --git a/lib/test_user_copy.c b/lib/test_user_copy.c
index e161f0498f42..9e7a3af57fbc 100644
--- a/lib/test_user_copy.c
+++ b/lib/test_user_copy.c
@@ -61,7 +61,7 @@ static int __init test_user_copy_init(void)
u64 val_u64;
#endif
- kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL);
+ kmem = kmalloc(array_size(PAGE_SIZE, 2), GFP_KERNEL);
if (!kmem)
return -ENOMEM;
diff --git a/mm/slab.c b/mm/slab.c
index 2f308253c3d7..815828a26036 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4338,7 +4338,8 @@ static int leaks_show(struct seq_file *m, void *p)
if (x[0] == x[1]) {
/* Increase the buffer size */
mutex_unlock(&slab_mutex);
- m->private = kzalloc(x[0] * 4 * sizeof(unsigned long), GFP_KERNEL);
+ m->private = kzalloc(array3_size(x[0], 4, sizeof(unsigned long)),
+ GFP_KERNEL);
if (!m->private) {
/* Too bad, we are really out */
m->private = x;
diff --git a/mm/slub.c b/mm/slub.c
index 2726905b9dbf..9e7c7157f8cd 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3660,8 +3660,8 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
#ifdef CONFIG_SLUB_DEBUG
void *addr = page_address(page);
void *p;
- unsigned long *map = kzalloc(BITS_TO_LONGS(page->objects) *
- sizeof(long), GFP_ATOMIC);
+ unsigned long *map = kzalloc(array_size(BITS_TO_LONGS(page->objects), sizeof(long)),
+ GFP_ATOMIC);
if (!map)
return;
slab_err(s, page, text, s->name);
@@ -4455,8 +4455,8 @@ static long validate_slab_cache(struct kmem_cache *s)
{
int node;
unsigned long count = 0;
- unsigned long *map = kmalloc(BITS_TO_LONGS(oo_objects(s->max)) *
- sizeof(unsigned long), GFP_KERNEL);
+ unsigned long *map = kmalloc(array_size(BITS_TO_LONGS(oo_objects(s->max)), sizeof(unsigned long)),
+ GFP_KERNEL);
struct kmem_cache_node *n;
if (!map)
@@ -4616,8 +4616,8 @@ static int list_locations(struct kmem_cache *s, char *buf,
unsigned long i;
struct loc_track t = { 0, 0, NULL };
int node;
- unsigned long *map = kmalloc(BITS_TO_LONGS(oo_objects(s->max)) *
- sizeof(unsigned long), GFP_KERNEL);
+ unsigned long *map = kmalloc(array_size(BITS_TO_LONGS(oo_objects(s->max)), sizeof(unsigned long)),
+ GFP_KERNEL);
struct kmem_cache_node *n;
if (!map || !alloc_loc_track(&t, PAGE_SIZE / sizeof(struct location),
diff --git a/mm/swapfile.c b/mm/swapfile.c
index fac13e7aab69..2f75036ea4b0 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -3230,7 +3230,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
}
/* frontswap enabled? set up bit-per-page map for frontswap */
if (IS_ENABLED(CONFIG_FRONTSWAP))
- frontswap_map = kvzalloc(BITS_TO_LONGS(maxpages) * sizeof(long),
+ frontswap_map = kvzalloc(array_size(BITS_TO_LONGS(maxpages), sizeof(long)),
GFP_KERNEL);
if (p->bdev &&(swap_flags & SWAP_FLAG_DISCARD) && swap_discardable(p)) {
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 16e10680518c..e53fb3fcc9a6 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -242,7 +242,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
"w", nwname);
if (!errcode) {
*wnames =
- kmalloc(sizeof(char *) * *nwname,
+ kmalloc(array_size(sizeof(char *), *nwname),
GFP_NOFS);
if (!*wnames)
errcode = -ENOMEM;
@@ -285,8 +285,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
p9pdu_readf(pdu, proto_version, "w", nwqid);
if (!errcode) {
*wqids =
- kmalloc(*nwqid *
- sizeof(struct p9_qid),
+ kmalloc(array_size(*nwqid, sizeof(struct p9_qid)),
GFP_NOFS);
if (*wqids == NULL)
errcode = -ENOMEM;
diff --git a/net/can/bcm.c b/net/can/bcm.c
index ac5e5e34fee3..44ede6298dbc 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -935,7 +935,7 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
/* create array for CAN frames and copy the data */
if (msg_head->nframes > 1) {
- op->frames = kmalloc(msg_head->nframes * op->cfsiz,
+ op->frames = kmalloc(array_size(msg_head->nframes, op->cfsiz),
GFP_KERNEL);
if (!op->frames) {
kfree(op);
@@ -1107,7 +1107,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
if (msg_head->nframes > 1) {
/* create array for CAN frames and copy the data */
- op->frames = kmalloc(msg_head->nframes * op->cfsiz,
+ op->frames = kmalloc(array_size(msg_head->nframes, op->cfsiz),
GFP_KERNEL);
if (!op->frames) {
kfree(op);
@@ -1115,7 +1115,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
}
/* create and init array for received CAN frames */
- op->last_frames = kzalloc(msg_head->nframes * op->cfsiz,
+ op->last_frames = kzalloc(array_size(msg_head->nframes, op->cfsiz),
GFP_KERNEL);
if (!op->last_frames) {
kfree(op->frames);
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 9645ffd6acfb..e69907f531da 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1299,7 +1299,7 @@ static int set_primary_affinity(struct ceph_osdmap *map, int osd, u32 aff)
if (!map->osd_primary_affinity) {
int i;
- map->osd_primary_affinity = kmalloc(map->max_osd*sizeof(u32),
+ map->osd_primary_affinity = kmalloc(array_size(map->max_osd, sizeof(u32)),
GFP_NOFS);
if (!map->osd_primary_affinity)
return -ENOMEM;
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index f11086fa153f..0646c35e4b4e 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1042,7 +1042,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
if (info.cmd == ETHTOOL_GRXCLSRLALL) {
if (info.rule_cnt > 0) {
if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
- rule_buf = kzalloc(info.rule_cnt * sizeof(u32),
+ rule_buf = kzalloc(array_size(info.rule_cnt, sizeof(u32)),
GFP_USER);
if (!rule_buf)
return -ENOMEM;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index f05afaf3235c..6fdea81c6ae6 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -563,7 +563,7 @@ static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt,
struct nlattr *mx;
int len = 0;
- mx = kzalloc(3 * nla_total_size(4), GFP_KERNEL);
+ mx = kzalloc(array_size(3, nla_total_size(4)), GFP_KERNEL);
if (!mx)
return -ENOMEM;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 11f9cfc016d9..b2158c392fd2 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1803,8 +1803,8 @@ static int ieee80211_reconfig_nan(struct ieee80211_sub_if_data *sdata)
if (WARN_ON(res))
return res;
- funcs = kzalloc((sdata->local->hw.max_nan_de_entries + 1) *
- sizeof(*funcs), GFP_KERNEL);
+ funcs = kzalloc(array_size((sdata->local->hw.max_nan_de_entries + 1), sizeof(*funcs)),
+ GFP_KERNEL);
if (!funcs)
return -ENOMEM;
diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
index b63d2a3d80ba..1de43cccf5a4 100644
--- a/net/netfilter/xt_dccp.c
+++ b/net/netfilter/xt_dccp.c
@@ -165,7 +165,7 @@ static int __init dccp_mt_init(void)
/* doff is 8 bits, so the maximum option size is (4*256). Don't put
* this in BSS since DaveM is worried about locked TLB's for kernel
* BSS. */
- dccp_optbuf = kmalloc(256 * 4, GFP_KERNEL);
+ dccp_optbuf = kmalloc(array_size(256, 4), GFP_KERNEL);
if (!dccp_optbuf)
return -ENOMEM;
ret = xt_register_matches(dccp_mt_reg, ARRAY_SIZE(dccp_mt_reg));
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index b9ce82c9440f..14d81a8a6da7 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -352,8 +352,8 @@ int genl_register_family(struct genl_family *family)
}
if (family->maxattr && !family->parallel_ops) {
- family->attrbuf = kmalloc((family->maxattr+1) *
- sizeof(struct nlattr *), GFP_KERNEL);
+ family->attrbuf = kmalloc(array_size((family->maxattr + 1), sizeof(struct nlattr *)),
+ GFP_KERNEL);
if (family->attrbuf == NULL) {
err = -ENOMEM;
goto errout_locked;
@@ -566,8 +566,8 @@ static int genl_family_rcv_msg(const struct genl_family *family,
return -EOPNOTSUPP;
if (family->maxattr && family->parallel_ops) {
- attrbuf = kmalloc((family->maxattr+1) *
- sizeof(struct nlattr *), GFP_KERNEL);
+ attrbuf = kmalloc(array_size((family->maxattr + 1), sizeof(struct nlattr *)),
+ GFP_KERNEL);
if (attrbuf == NULL)
return -ENOMEM;
} else
diff --git a/net/rds/ib.c b/net/rds/ib.c
index 02deee29e7f1..2a6c2817df4b 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -163,7 +163,7 @@ static void rds_ib_add_one(struct ib_device *device)
rds_ibdev->max_initiator_depth = device->attrs.max_qp_init_rd_atom;
rds_ibdev->max_responder_resources = device->attrs.max_qp_rd_atom;
- rds_ibdev->vector_load = kzalloc(sizeof(int) * device->num_comp_vectors,
+ rds_ibdev->vector_load = kzalloc(array_size(sizeof(int), device->num_comp_vectors),
GFP_KERNEL);
if (!rds_ibdev->vector_load) {
pr_err("RDS/IB: %s failed to allocate vector memory\n",
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 22fa13cf5d8b..22e2745b853d 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -489,11 +489,12 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt,
return err;
if (!q->flows) {
- q->flows = kvzalloc(q->flows_cnt *
- sizeof(struct fq_codel_flow), GFP_KERNEL);
+ q->flows = kvzalloc(array_size(q->flows_cnt, sizeof(struct fq_codel_flow)),
+ GFP_KERNEL);
if (!q->flows)
return -ENOMEM;
- q->backlogs = kvzalloc(q->flows_cnt * sizeof(u32), GFP_KERNEL);
+ q->backlogs = kvzalloc(array_size(q->flows_cnt, sizeof(u32)),
+ GFP_KERNEL);
if (!q->backlogs)
return -ENOMEM;
for (i = 0; i < q->flows_cnt; i++) {
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index 1b8af23e6e2b..ce23302d3bce 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -583,9 +583,8 @@ int smc_wr_alloc_link_mem(struct smc_link *link)
GFP_KERNEL);
if (!link->wr_rx_sges)
goto no_mem_wr_tx_sges;
- link->wr_tx_mask = kzalloc(
- BITS_TO_LONGS(SMC_WR_BUF_CNT) * sizeof(*link->wr_tx_mask),
- GFP_KERNEL);
+ link->wr_tx_mask = kzalloc(array_size(BITS_TO_LONGS(SMC_WR_BUF_CNT), sizeof(*link->wr_tx_mask)),
+ GFP_KERNEL);
if (!link->wr_tx_mask)
goto no_mem_wr_rx_sges;
link->wr_tx_pends = kcalloc(SMC_WR_BUF_CNT,
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 9463af4b32e8..bb4857075a31 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1753,8 +1753,8 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT;
rqstp->rq_enc_pages_num = last - first + 1 + 1;
rqstp->rq_enc_pages
- = kmalloc(rqstp->rq_enc_pages_num * sizeof(struct page *),
- GFP_NOFS);
+ = kmalloc(array_size(rqstp->rq_enc_pages_num, sizeof(struct page *)),
+ GFP_NOFS);
if (!rqstp->rq_enc_pages)
goto out;
for (i=0; i < rqstp->rq_enc_pages_num; i++) {
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index 8654494b4d0a..5859a6e64acd 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -682,7 +682,7 @@ gss_krb5_cts_crypt(struct crypto_skcipher *cipher, struct xdr_buf *buf,
WARN_ON(0);
return -ENOMEM;
}
- data = kmalloc(GSS_KRB5_MAX_BLOCKSIZE * 2, GFP_NOFS);
+ data = kmalloc(array_size(GSS_KRB5_MAX_BLOCKSIZE, 2), GFP_NOFS);
if (!data)
return -ENOMEM;
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index 46b295e4f2b8..1b6375bac18a 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -224,7 +224,8 @@ static void gssp_free_receive_pages(struct gssx_arg_accept_sec_context *arg)
static int gssp_alloc_receive_pages(struct gssx_arg_accept_sec_context *arg)
{
arg->npages = DIV_ROUND_UP(NGROUPS_MAX * 4, PAGE_SIZE);
- arg->pages = kzalloc(arg->npages * sizeof(struct page *), GFP_KERNEL);
+ arg->pages = kzalloc(array_size(arg->npages, sizeof(struct page *)),
+ GFP_KERNEL);
/*
* XXX: actual pages are allocated by xdr layer in
* xdr_partial_copy_from_skb.
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index cdda4744c9b1..27a5bbb8e880 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1683,7 +1683,7 @@ struct cache_detail *cache_create_net(const struct cache_detail *tmpl, struct ne
if (cd == NULL)
return ERR_PTR(-ENOMEM);
- cd->hash_table = kzalloc(cd->hash_size * sizeof(struct hlist_head),
+ cd->hash_table = kzalloc(array_size(cd->hash_size, sizeof(struct hlist_head)),
GFP_KERNEL);
if (cd->hash_table == NULL) {
kfree(cd);
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 4492cda45566..7544e3efec02 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -285,8 +285,8 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
if (!trans_buf)
return -ENOMEM;
- attrbuf = kmalloc((tipc_genl_family.maxattr + 1) *
- sizeof(struct nlattr *), GFP_KERNEL);
+ attrbuf = kmalloc(array_size((tipc_genl_family.maxattr + 1), sizeof(struct nlattr *)),
+ GFP_KERNEL);
if (!attrbuf) {
err = -ENOMEM;
goto trans_out;
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 423776682025..a4b1f4f94ea8 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1148,7 +1148,7 @@ static long trusted_read(const struct key *key, char __user *buffer,
return -EINVAL;
if (buffer && buflen >= 2 * p->blob_len) {
- ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
+ ascii_buf = kmalloc(array_size(2, p->blob_len), GFP_KERNEL);
if (!ascii_buf)
return -ENOMEM;
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 0e875d5a9e86..ce5ca784b7f2 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3093,7 +3093,7 @@ static ssize_t snd_pcm_readv(struct kiocb *iocb, struct iov_iter *to)
if (!frame_aligned(runtime, to->iov->iov_len))
return -EINVAL;
frames = bytes_to_samples(runtime, to->iov->iov_len);
- bufs = kmalloc(sizeof(void *) * to->nr_segs, GFP_KERNEL);
+ bufs = kmalloc(array_size(sizeof(void *), to->nr_segs), GFP_KERNEL);
if (bufs == NULL)
return -ENOMEM;
for (i = 0; i < to->nr_segs; ++i)
@@ -3128,7 +3128,7 @@ static ssize_t snd_pcm_writev(struct kiocb *iocb, struct iov_iter *from)
!frame_aligned(runtime, from->iov->iov_len))
return -EINVAL;
frames = bytes_to_samples(runtime, from->iov->iov_len);
- bufs = kmalloc(sizeof(void *) * from->nr_segs, GFP_KERNEL);
+ bufs = kmalloc(array_size(sizeof(void *), from->nr_segs), GFP_KERNEL);
if (bufs == NULL)
return -ENOMEM;
for (i = 0; i < from->nr_segs; ++i)
diff --git a/sound/firewire/dice/dice-transaction.c b/sound/firewire/dice/dice-transaction.c
index 0f0350320ae8..ae7c1ac80207 100644
--- a/sound/firewire/dice/dice-transaction.c
+++ b/sound/firewire/dice/dice-transaction.c
@@ -170,7 +170,7 @@ static int register_notification_address(struct snd_dice *dice, bool retry)
retries = (retry) ? 3 : 0;
- buffer = kmalloc(2 * 8, GFP_KERNEL);
+ buffer = kmalloc(array_size(2, 8), GFP_KERNEL);
if (!buffer)
return -ENOMEM;
@@ -220,7 +220,7 @@ static void unregister_notification_address(struct snd_dice *dice)
struct fw_device *device = fw_parent_device(dice->unit);
__be64 *buffer;
- buffer = kmalloc(2 * 8, GFP_KERNEL);
+ buffer = kmalloc(array_size(2, 8), GFP_KERNEL);
if (buffer == NULL)
return;
diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c
index 0020fd0efc46..314c7bf81429 100644
--- a/sound/pci/cs46xx/cs46xx_lib.c
+++ b/sound/pci/cs46xx/cs46xx_lib.c
@@ -460,7 +460,7 @@ static int load_firmware(struct snd_cs46xx *chip,
entry->size = le32_to_cpu(fwdat[fwlen++]);
if (fwlen + entry->size > fwsize)
goto error_inval;
- entry->data = kmalloc(entry->size * 4, GFP_KERNEL);
+ entry->data = kmalloc(array_size(entry->size, 4), GFP_KERNEL);
if (!entry->data)
goto error;
memcpy_le32(entry->data, &fwdat[fwlen], entry->size * 4);
@@ -4036,8 +4036,8 @@ int snd_cs46xx_create(struct snd_card *card,
snd_cs46xx_proc_init(card, chip);
#ifdef CONFIG_PM_SLEEP
- chip->saved_regs = kmalloc(sizeof(*chip->saved_regs) *
- ARRAY_SIZE(saved_regs), GFP_KERNEL);
+ chip->saved_regs = kmalloc(array_size(sizeof(*chip->saved_regs), ARRAY_SIZE(saved_regs)),
+ GFP_KERNEL);
if (!chip->saved_regs) {
snd_cs46xx_free(chip);
return -ENOMEM;
diff --git a/sound/pci/ctxfi/ctatc.c b/sound/pci/ctxfi/ctatc.c
index 6fd0e030615d..33b9038adbe9 100644
--- a/sound/pci/ctxfi/ctatc.c
+++ b/sound/pci/ctxfi/ctatc.c
@@ -1397,7 +1397,7 @@ static int atc_get_resources(struct ct_atc *atc)
if (!atc->srcimps)
return -ENOMEM;
- atc->pcm = kzalloc(sizeof(void *)*(2*4), GFP_KERNEL);
+ atc->pcm = kzalloc(array_size(sizeof(void *), (2 * 4)), GFP_KERNEL);
if (!atc->pcm)
return -ENOMEM;
diff --git a/sound/pci/ctxfi/ctdaio.c b/sound/pci/ctxfi/ctdaio.c
index 7f089cb433e1..f35a7341e446 100644
--- a/sound/pci/ctxfi/ctdaio.c
+++ b/sound/pci/ctxfi/ctdaio.c
@@ -398,7 +398,8 @@ static int dao_rsc_init(struct dao *dao,
if (err)
return err;
- dao->imappers = kzalloc(sizeof(void *)*desc->msr*2, GFP_KERNEL);
+ dao->imappers = kzalloc(array3_size(sizeof(void *), desc->msr, 2),
+ GFP_KERNEL);
if (!dao->imappers) {
err = -ENOMEM;
goto error1;
diff --git a/sound/pci/ctxfi/ctmixer.c b/sound/pci/ctxfi/ctmixer.c
index 4f4a2a5dedb8..e47067d05171 100644
--- a/sound/pci/ctxfi/ctmixer.c
+++ b/sound/pci/ctxfi/ctmixer.c
@@ -910,13 +910,14 @@ static int ct_mixer_get_mem(struct ct_mixer **rmixer)
if (!mixer)
return -ENOMEM;
- mixer->amixers = kzalloc(sizeof(void *)*(NUM_CT_AMIXERS*CHN_NUM),
+ mixer->amixers = kzalloc(array_size(sizeof(void *), (NUM_CT_AMIXERS * CHN_NUM)),
GFP_KERNEL);
if (!mixer->amixers) {
err = -ENOMEM;
goto error1;
}
- mixer->sums = kzalloc(sizeof(void *)*(NUM_CT_SUMS*CHN_NUM), GFP_KERNEL);
+ mixer->sums = kzalloc(array_size(sizeof(void *), (NUM_CT_SUMS * CHN_NUM)),
+ GFP_KERNEL);
if (!mixer->sums) {
err = -ENOMEM;
goto error2;
diff --git a/sound/pci/ctxfi/ctsrc.c b/sound/pci/ctxfi/ctsrc.c
index bb4c9c3c89ae..4931fb382045 100644
--- a/sound/pci/ctxfi/ctsrc.c
+++ b/sound/pci/ctxfi/ctsrc.c
@@ -679,7 +679,7 @@ static int srcimp_rsc_init(struct srcimp *srcimp,
return err;
/* Reserve memory for imapper nodes */
- srcimp->imappers = kzalloc(sizeof(struct imapper)*desc->msr,
+ srcimp->imappers = kzalloc(array_size(sizeof(struct imapper), desc->msr),
GFP_KERNEL);
if (!srcimp->imappers) {
err = -ENOMEM;
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index a2b56b188be4..f31971b6fce7 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -2690,12 +2690,12 @@ int snd_emu10k1_efx_alloc_pm_buffer(struct snd_emu10k1 *emu)
int len;
len = emu->audigy ? 0x200 : 0x100;
- emu->saved_gpr = kmalloc(len * 4, GFP_KERNEL);
+ emu->saved_gpr = kmalloc(array_size(len, 4), GFP_KERNEL);
if (! emu->saved_gpr)
return -ENOMEM;
len = emu->audigy ? 0x100 : 0xa0;
- emu->tram_val_saved = kmalloc(len * 4, GFP_KERNEL);
- emu->tram_addr_saved = kmalloc(len * 4, GFP_KERNEL);
+ emu->tram_val_saved = kmalloc(array_size(len, 4), GFP_KERNEL);
+ emu->tram_addr_saved = kmalloc(array_size(len, 4), GFP_KERNEL);
if (! emu->tram_val_saved || ! emu->tram_addr_saved)
return -ENOMEM;
len = emu->audigy ? 2 * 1024 : 2 * 512;
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index acce4219e234..956071137057 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -439,7 +439,8 @@ static int read_widget_caps(struct hda_codec *codec, hda_nid_t fg_node)
int i;
hda_nid_t nid;
- codec->wcaps = kmalloc(codec->core.num_nodes * 4, GFP_KERNEL);
+ codec->wcaps = kmalloc(array_size(codec->core.num_nodes, 4),
+ GFP_KERNEL);
if (!codec->wcaps)
return -ENOMEM;
nid = codec->core.start_nid;
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index 20fdcae06c6b..ce5f8d4ac767 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -2023,8 +2023,8 @@ static void wm8904_handle_pdata(struct snd_soc_component *component)
wm8904_get_drc_enum, wm8904_put_drc_enum);
/* We need an array of texts for the enum API */
- wm8904->drc_texts = kmalloc(sizeof(char *)
- * pdata->num_drc_cfgs, GFP_KERNEL);
+ wm8904->drc_texts = kmalloc(array_size(sizeof(char *), pdata->num_drc_cfgs),
+ GFP_KERNEL);
if (!wm8904->drc_texts)
return;
diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c
index 8d495220fa25..df77636f3113 100644
--- a/sound/soc/codecs/wm8958-dsp2.c
+++ b/sound/soc/codecs/wm8958-dsp2.c
@@ -932,8 +932,8 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
};
/* We need an array of texts for the enum API */
- wm8994->mbc_texts = kmalloc(sizeof(char *)
- * pdata->num_mbc_cfgs, GFP_KERNEL);
+ wm8994->mbc_texts = kmalloc(array_size(sizeof(char *), pdata->num_mbc_cfgs),
+ GFP_KERNEL);
if (!wm8994->mbc_texts)
return;
@@ -957,8 +957,8 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
};
/* We need an array of texts for the enum API */
- wm8994->vss_texts = kmalloc(sizeof(char *)
- * pdata->num_vss_cfgs, GFP_KERNEL);
+ wm8994->vss_texts = kmalloc(array_size(sizeof(char *), pdata->num_vss_cfgs),
+ GFP_KERNEL);
if (!wm8994->vss_texts)
return;
@@ -983,8 +983,8 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
};
/* We need an array of texts for the enum API */
- wm8994->vss_hpf_texts = kmalloc(sizeof(char *)
- * pdata->num_vss_hpf_cfgs, GFP_KERNEL);
+ wm8994->vss_hpf_texts = kmalloc(array_size(sizeof(char *), pdata->num_vss_hpf_cfgs),
+ GFP_KERNEL);
if (!wm8994->vss_hpf_texts)
return;
@@ -1010,8 +1010,8 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
};
/* We need an array of texts for the enum API */
- wm8994->enh_eq_texts = kmalloc(sizeof(char *)
- * pdata->num_enh_eq_cfgs, GFP_KERNEL);
+ wm8994->enh_eq_texts = kmalloc(array_size(sizeof(char *), pdata->num_enh_eq_cfgs),
+ GFP_KERNEL);
if (!wm8994->enh_eq_texts)
return;
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 82b0927e6ed7..9675edabefb9 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1900,7 +1900,7 @@ static void *wm_adsp_read_algs(struct wm_adsp *dsp, size_t n_algs,
adsp_warn(dsp, "Algorithm list end %x 0x%x != 0xbedead\n",
pos + len, be32_to_cpu(val));
- alg = kzalloc(len * 2, GFP_KERNEL | GFP_DMA);
+ alg = kzalloc(array_size(len, 2), GFP_KERNEL | GFP_DMA);
if (!alg)
return ERR_PTR(-ENOMEM);
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index bf7ca32ab31f..ae5d7f515697 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -570,9 +570,8 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
if (!rtd->dai_link->ops)
rtd->dai_link->ops = &null_snd_soc_ops;
- rtd->codec_dais = kzalloc(sizeof(struct snd_soc_dai *) *
- dai_link->num_codecs,
- GFP_KERNEL);
+ rtd->codec_dais = kzalloc(array_size(sizeof(struct snd_soc_dai *), dai_link->num_codecs),
+ GFP_KERNEL);
if (!rtd->codec_dais) {
kfree(rtd);
return NULL;
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index fadf9896bf2c..1fdbe6aa4b51 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3057,9 +3057,8 @@ int snd_soc_dapm_new_widgets(struct snd_soc_card *card)
continue;
if (w->num_kcontrols) {
- w->kcontrols = kzalloc(w->num_kcontrols *
- sizeof(struct snd_kcontrol *),
- GFP_KERNEL);
+ w->kcontrols = kzalloc(array_size(w->num_kcontrols, sizeof(struct snd_kcontrol *)),
+ GFP_KERNEL);
if (!w->kcontrols) {
mutex_unlock(&card->dapm_mutex);
return -ENOMEM;
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 986b8b2f90fb..be5398010d2b 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -941,7 +941,7 @@ static int soc_tplg_denum_create_texts(struct soc_enum *se,
int i, ret;
se->dobj.control.dtexts =
- kzalloc(sizeof(char *) * ec->items, GFP_KERNEL);
+ kzalloc(array_size(sizeof(char *), ec->items), GFP_KERNEL);
if (se->dobj.control.dtexts == NULL)
return -ENOMEM;
diff --git a/sound/usb/format.c b/sound/usb/format.c
index ba7c14e20b37..c38a3290d2d8 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -363,7 +363,8 @@ static int parse_audio_format_rates_v2v3(struct snd_usb_audio *chip,
goto err_free;
}
- fp->rate_table = kmalloc(sizeof(int) * fp->nr_rates, GFP_KERNEL);
+ fp->rate_table = kmalloc(array_size(sizeof(int), fp->nr_rates),
+ GFP_KERNEL);
if (!fp->rate_table) {
ret = -ENOMEM;
goto err_free;
diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c
index 947d6168f24a..69f5cb7eb3cf 100644
--- a/sound/usb/line6/capture.c
+++ b/sound/usb/line6/capture.c
@@ -264,8 +264,8 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm)
struct usb_line6 *line6 = line6pcm->line6;
int i;
- line6pcm->in.urbs = kzalloc(
- sizeof(struct urb *) * line6->iso_buffers, GFP_KERNEL);
+ line6pcm->in.urbs = kzalloc(array_size(sizeof(struct urb *), line6->iso_buffers),
+ GFP_KERNEL);
if (line6pcm->in.urbs == NULL)
return -ENOMEM;
diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index b3854f8c0c67..8fd838ba9997 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -158,8 +158,8 @@ static int line6_buffer_acquire(struct snd_line6_pcm *line6pcm,
/* Invoked multiple times in a row so allocate once only */
if (!test_and_set_bit(type, &pstr->opened) && !pstr->buffer) {
- pstr->buffer = kmalloc(line6pcm->line6->iso_buffers *
- LINE6_ISO_PACKETS * pkt_size, GFP_KERNEL);
+ pstr->buffer = kmalloc(array3_size(line6pcm->line6->iso_buffers, LINE6_ISO_PACKETS, pkt_size),
+ GFP_KERNEL);
if (!pstr->buffer)
return -ENOMEM;
}
diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c
index 819e9b2d1d6e..b5141f3e70b0 100644
--- a/sound/usb/line6/playback.c
+++ b/sound/usb/line6/playback.c
@@ -409,8 +409,8 @@ int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm)
struct usb_line6 *line6 = line6pcm->line6;
int i;
- line6pcm->out.urbs = kzalloc(
- sizeof(struct urb *) * line6->iso_buffers, GFP_KERNEL);
+ line6pcm->out.urbs = kzalloc(array_size(sizeof(struct urb *), line6->iso_buffers),
+ GFP_KERNEL);
if (line6pcm->out.urbs == NULL)
return -ENOMEM;
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 344d7b069d59..f4b2cb293606 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2330,7 +2330,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
cval->control = (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR) ?
UAC2_CX_CLOCK_SELECTOR : UAC2_SU_SELECTOR;
- namelist = kmalloc(sizeof(char *) * desc->bNrInPins, GFP_KERNEL);
+ namelist = kmalloc(array_size(sizeof(char *), desc->bNrInPins),
+ GFP_KERNEL);
if (!namelist) {
kfree(cval);
return -ENOMEM;
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index 6b662e0905c6..4067a367165e 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -436,7 +436,8 @@ static int usX2Y_urbs_allocate(struct snd_usX2Y_substream *subs)
}
if (!is_playback && !(*purb)->transfer_buffer) {
/* allocate a capture buffer per urb */
- (*purb)->transfer_buffer = kmalloc(subs->maxpacksize * nr_of_packs(), GFP_KERNEL);
+ (*purb)->transfer_buffer = kmalloc(array_size(subs->maxpacksize, nr_of_packs()),
+ GFP_KERNEL);
if (NULL == (*purb)->transfer_buffer) {
usX2Y_urbs_release(subs);
return -ENOMEM;
--
2.17.0
next prev parent reply other threads:[~2018-06-01 0:45 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-01 0:42 [PATCH v3 00/16] Provide saturating helpers for allocation Kees Cook
2018-06-01 0:42 ` [PATCH v3 01/16] compiler.h: enable builtin overflow checkers and add fallback code Kees Cook
2018-06-01 0:42 ` [PATCH v3 02/16] lib: add runtime test of check_*_overflow functions Kees Cook
2018-06-01 0:42 ` [PATCH v3 03/16] lib: overflow: Report test failures Kees Cook
2018-06-01 0:42 ` [PATCH v3 04/16] overflow.h: Add allocation size calculation helpers Kees Cook
2018-06-01 0:42 ` [PATCH v3 05/16] lib: overflow: Add memory allocation overflow tests Kees Cook
2018-06-01 10:18 ` Andy Shevchenko
2018-06-01 0:42 ` [PATCH v3 06/16] mm: Use overflow helpers in kmalloc_array*() Kees Cook
2018-06-01 0:42 ` [PATCH v3 07/16] mm: Use overflow helpers in kvmalloc() Kees Cook
2018-06-01 0:42 ` [PATCH v3 08/16] device: Use overflow helpers for devm_kmalloc() Kees Cook
2018-06-01 0:42 ` [PATCH v3 09/16] treewide: Use struct_size() for kmalloc()-family Kees Cook
2018-06-01 0:42 ` [PATCH v3 10/16] treewide: Use struct_size() for vmalloc()-family Kees Cook
2018-06-01 0:42 ` [PATCH v3 11/16] treewide: Use struct_size() for devm_kmalloc() and friends Kees Cook
2018-06-01 0:42 ` [PATCH v3 12/16] treewide: Use array_size() for kmalloc()-family Kees Cook
2018-07-01 8:46 ` SF Markus Elfring
2018-07-01 8:46 ` SF Markus Elfring
2018-07-01 8:46 ` SF Markus Elfring
2018-07-01 9:03 ` Julia Lawall
2018-07-01 9:03 ` Julia Lawall
2018-07-01 9:03 ` Julia Lawall
2018-07-01 9:22 ` SF Markus Elfring
2018-07-01 9:22 ` SF Markus Elfring
2018-06-01 0:42 ` Kees Cook [this message]
2018-06-01 0:42 ` [PATCH v3 14/16] treewide: Use array_size() for vmalloc() Kees Cook
2018-06-01 0:42 ` [PATCH v3 15/16] treewide: Use array_size() for devm_*alloc()-like Kees Cook
2018-06-01 0:42 ` [PATCH v3 16/16] treewide: Use array_size() for devm_*alloc()-like, leftovers Kees Cook
2018-06-01 0:54 ` [PATCH v3 00/16] Provide saturating helpers for allocation Linus Torvalds
2018-06-01 4:18 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180601004233.37822-14-keescook@chromium.org \
--to=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux@rasmusvillemoes.dk \
--cc=mawilcox@microsoft.com \
--cc=torvalds@linux-foundation.org \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.