treewide: Use array_size() in vmalloc()

The vmalloc() function has no 2-factor argument form, so multiplication
factors need to be wrapped in array_size(). This patch replaces cases of:

        vmalloc(a * b)

with:
        vmalloc(array_size(a, b))

as well as handling cases of:

        vmalloc(a * b * c)

with:

        vmalloc(array3_size(a, b, c))

This does, however, attempt to ignore constant size factors like:

        vmalloc(4 * 1024)

though any constants defined via macros get caught up in the conversion.

Any factors with a sizeof() of "unsigned char", "char", and "u8" were
dropped, since they're redundant.

The Coccinelle script used for this was:

// Fix redundant parens around sizeof().
@@
type TYPE;
expression THING, E;
@@

(
  vmalloc(
-	(sizeof(TYPE)) * E
+	sizeof(TYPE) * E
  , ...)
|
  vmalloc(
-	(sizeof(THING)) * E
+	sizeof(THING) * E
  , ...)
)

// Drop single-byte sizes and redundant parens.
@@
expression COUNT;
typedef u8;
typedef __u8;
@@

(
  vmalloc(
-	sizeof(u8) * (COUNT)
+	COUNT
  , ...)
|
  vmalloc(
-	sizeof(__u8) * (COUNT)
+	COUNT
  , ...)
|
  vmalloc(
-	sizeof(char) * (COUNT)
+	COUNT
  , ...)
|
  vmalloc(
-	sizeof(unsigned char) * (COUNT)
+	COUNT
  , ...)
|
  vmalloc(
-	sizeof(u8) * COUNT
+	COUNT
  , ...)
|
  vmalloc(
-	sizeof(__u8) * COUNT
+	COUNT
  , ...)
|
  vmalloc(
-	sizeof(char) * COUNT
+	COUNT
  , ...)
|
  vmalloc(
-	sizeof(unsigned char) * COUNT
+	COUNT
  , ...)
)

// 2-factor product with sizeof(type/expression) and identifier or constant.
@@
type TYPE;
expression THING;
identifier COUNT_ID;
constant COUNT_CONST;
@@

(
  vmalloc(
-	sizeof(TYPE) * (COUNT_ID)
+	array_size(COUNT_ID, sizeof(TYPE))
  , ...)
|
  vmalloc(
-	sizeof(TYPE) * COUNT_ID
+	array_size(COUNT_ID, sizeof(TYPE))
  , ...)
|
  vmalloc(
-	sizeof(TYPE) * (COUNT_CONST)
+	array_size(COUNT_CONST, sizeof(TYPE))
  , ...)
|
  vmalloc(
-	sizeof(TYPE) * COUNT_CONST
+	array_size(COUNT_CONST, sizeof(TYPE))
  , ...)
|
  vmalloc(
-	sizeof(THING) * (COUNT_ID)
+	array_size(COUNT_ID, sizeof(THING))
  , ...)
|
  vmalloc(
-	sizeof(THING) * COUNT_ID
+	array_size(COUNT_ID, sizeof(THING))
  , ...)
|
  vmalloc(
-	sizeof(THING) * (COUNT_CONST)
+	array_size(COUNT_CONST, sizeof(THING))
  , ...)
|
  vmalloc(
-	sizeof(THING) * COUNT_CONST
+	array_size(COUNT_CONST, sizeof(THING))
  , ...)
)

// 2-factor product, only identifiers.
@@
identifier SIZE, COUNT;
@@

  vmalloc(
-	SIZE * COUNT
+	array_size(COUNT, SIZE)
  , ...)

// 3-factor product with 1 sizeof(type) or sizeof(expression), with
// redundant parens removed.
@@
expression THING;
identifier STRIDE, COUNT;
type TYPE;
@@

(
  vmalloc(
-	sizeof(TYPE) * (COUNT) * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  vmalloc(
-	sizeof(TYPE) * (COUNT) * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  vmalloc(
-	sizeof(TYPE) * COUNT * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  vmalloc(
-	sizeof(TYPE) * COUNT * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  vmalloc(
-	sizeof(THING) * (COUNT) * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  vmalloc(
-	sizeof(THING) * (COUNT) * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  vmalloc(
-	sizeof(THING) * COUNT * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  vmalloc(
-	sizeof(THING) * COUNT * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
)

// 3-factor product with 2 sizeof(variable), with redundant parens removed.
@@
expression THING1, THING2;
identifier COUNT;
type TYPE1, TYPE2;
@@

(
  vmalloc(
-	sizeof(TYPE1) * sizeof(TYPE2) * COUNT
+	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
  , ...)
|
  vmalloc(
-	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
  , ...)
|
  vmalloc(
-	sizeof(THING1) * sizeof(THING2) * COUNT
+	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
  , ...)
|
  vmalloc(
-	sizeof(THING1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
  , ...)
|
  vmalloc(
-	sizeof(TYPE1) * sizeof(THING2) * COUNT
+	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
  , ...)
|
  vmalloc(
-	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
  , ...)
)

// 3-factor product, only identifiers, with redundant parens removed.
@@
identifier STRIDE, SIZE, COUNT;
@@

(
  vmalloc(
-	(COUNT) * STRIDE * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vmalloc(
-	COUNT * (STRIDE) * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vmalloc(
-	COUNT * STRIDE * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vmalloc(
-	(COUNT) * (STRIDE) * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vmalloc(
-	COUNT * (STRIDE) * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vmalloc(
-	(COUNT) * STRIDE * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vmalloc(
-	(COUNT) * (STRIDE) * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vmalloc(
-	COUNT * STRIDE * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
)

// Any remaining multi-factor products, first at least 3-factor products
// when they're not all constants...
@@
expression E1, E2, E3;
constant C1, C2, C3;
@@

(
  vmalloc(C1 * C2 * C3, ...)
|
  vmalloc(
-	E1 * E2 * E3
+	array3_size(E1, E2, E3)
  , ...)
)

// And then all remaining 2 factors products when they're not all constants.
@@
expression E1, E2;
constant C1, C2;
@@

(
  vmalloc(C1 * C2, ...)
|
  vmalloc(
-	E1 * E2
+	array_size(E1, E2)
  , ...)
)

Signed-off-by: Kees Cook <keescook@chromium.org>

78 files changed, 160 insertions, 116 deletions

diff --git a/arch/powerpc/kernel/rtasd.c b/arch/powerpc/kernel/rtasd.c
index f915db93cd42..44d66c33d59d 100644
--- a/arch/powerpc/kernel/rtasd.c
+++ b/arch/powerpc/kernel/rtasd.c
@@ -559,7 +559,8 @@ static int __init rtas_event_scan_init(void)
         rtas_error_log_max = rtas_get_error_log_max();
         rtas_error_log_buffer_max = rtas_error_log_max + sizeof(int);
 
-        rtas_log_buf = vmalloc(rtas_error_log_buffer_max*LOG_NUMBER);
+        rtas_log_buf = vmalloc(array_size(LOG_NUMBER,
+                                          rtas_error_log_buffer_max));
         if (!rtas_log_buf) {
                 printk(KERN_ERR "rtasd: no memory\n");
                 return -ENOMEM;
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index a670fa5fbe50..1b3fcafc685e 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -108,7 +108,7 @@ int kvmppc_allocate_hpt(struct kvm_hpt_info *info, u32 order)
         npte = 1ul << (order - 4);
 
         /* Allocate reverse map array */
-        rev = vmalloc(sizeof(struct revmap_entry) * npte);
+        rev = vmalloc(array_size(npte, sizeof(struct revmap_entry)));
         if (!rev) {
                 if (cma)
                         kvm_free_hpt_cma(page, 1 << (order - PAGE_SHIFT));
diff --git a/arch/s390/hypfs/hypfs_diag.c b/arch/s390/hypfs/hypfs_diag.c
index be8cc53204b5..a2945b289a29 100644
--- a/arch/s390/hypfs/hypfs_diag.c
+++ b/arch/s390/hypfs/hypfs_diag.c
@@ -239,7 +239,7 @@ static void *page_align_ptr(void *ptr)
 static void *diag204_alloc_vbuf(int pages)
 {
         /* The buffer has to be page aligned! */
-        diag204_buf_vmalloc = vmalloc(PAGE_SIZE * (pages + 1));
+        diag204_buf_vmalloc = vmalloc(array_size(PAGE_SIZE, (pages + 1)));
         if (!diag204_buf_vmalloc)
                 return ERR_PTR(-ENOMEM);
         diag204_buf = page_align_ptr(diag204_buf_vmalloc);
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 0dc8ac8548ee..d298d3cb46d0 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -123,8 +123,8 @@ int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
 
         /* Allocate one syminfo structure per symbol. */
         me->arch.nsyms = symtab->sh_size / sizeof(Elf_Sym);
-        me->arch.syminfo = vmalloc(me->arch.nsyms *
-                                   sizeof(struct mod_arch_syminfo));
+        me->arch.syminfo = vmalloc(array_size(sizeof(struct mod_arch_syminfo),
+                                              me->arch.nsyms));
         if (!me->arch.syminfo)
                 return -ENOMEM;
         symbols = (void *) hdr + symtab->sh_offset;
diff --git a/arch/s390/kernel/sthyi.c b/arch/s390/kernel/sthyi.c
index 80b862e9c53c..0859cde36f75 100644
--- a/arch/s390/kernel/sthyi.c
+++ b/arch/s390/kernel/sthyi.c
@@ -315,7 +315,7 @@ static void fill_diag(struct sthyi_sctns *sctns)
         if (pages <= 0)
                 return;
 
-        diag204_buf = vmalloc(PAGE_SIZE * pages);
+        diag204_buf = vmalloc(array_size(pages, PAGE_SIZE));
         if (!diag204_buf)
                 return;
 
diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
index 8e2b8647ee12..07d30ffcfa41 100644
--- a/arch/s390/kvm/gaccess.c
+++ b/arch/s390/kvm/gaccess.c
@@ -847,7 +847,7 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data,
         nr_pages = (((ga & ~PAGE_MASK) + len - 1) >> PAGE_SHIFT) + 1;
         pages = pages_array;
         if (nr_pages > ARRAY_SIZE(pages_array))
-                pages = vmalloc(nr_pages * sizeof(unsigned long));
+                pages = vmalloc(array_size(nr_pages, sizeof(unsigned long)));
         if (!pages)
                 return -ENOMEM;
         need_ipte_lock = psw_bits(*psw).dat && !asce.r;
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 64c986243018..3f6625c64341 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -1725,7 +1725,7 @@ static int kvm_s390_set_cmma_bits(struct kvm *kvm,
         if (args->count == 0)
                 return 0;
 
-        bits = vmalloc(sizeof(*bits) * args->count);
+        bits = vmalloc(array_size(sizeof(*bits), args->count));
         if (!bits)
                 return -ENOMEM;
 
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index f4f30d0c25c4..66fc27b92c59 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -203,8 +203,9 @@ int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu,
                 goto out;
         r = -ENOMEM;
         if (cpuid->nent) {
-                cpuid_entries = vmalloc(sizeof(struct kvm_cpuid_entry) *
-                                        cpuid->nent);
+                cpuid_entries =
+                        vmalloc(array_size(sizeof(struct kvm_cpuid_entry),
+                                           cpuid->nent));
                 if (!cpuid_entries)
                         goto out;
                 r = -EFAULT;
diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
index b676a99c469c..7f732744f0d3 100644
--- a/drivers/base/firmware_loader/fallback.c
+++ b/drivers/base/firmware_loader/fallback.c
@@ -403,7 +403,7 @@ static int fw_realloc_pages(struct fw_sysfs *fw_sysfs, int min_size)
                                          fw_priv->page_array_size * 2);
                 struct page **new_pages;
 
-                new_pages = vmalloc(new_array_size * sizeof(void *));
+                new_pages = vmalloc(array_size(new_array_size, sizeof(void *)));
                 if (!new_pages) {
                         fw_load_abort(fw_sysfs);
                         return -ENOMEM;
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
index ed76044ce4b9..bbff52be4f0f 100644
--- a/drivers/dma/ipu/ipu_idmac.c
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -910,7 +910,8 @@ out:
 /* Called with ichan->chan_mutex held */
 static int idmac_desc_alloc(struct idmac_channel *ichan, int n)
 {
-        struct idmac_tx_desc *desc = vmalloc(n * sizeof(struct idmac_tx_desc));
+        struct idmac_tx_desc *desc =
+                vmalloc(array_size(n, sizeof(struct idmac_tx_desc)));
         struct idmac *idmac = to_idmac(ichan->dma_chan.device);
 
         if (!desc)
diff --git a/drivers/gpu/drm/drm_memory.c b/drivers/gpu/drm/drm_memory.c
index 3c54044214db..d69e4fc1ee77 100644
--- a/drivers/gpu/drm/drm_memory.c
+++ b/drivers/gpu/drm/drm_memory.c
@@ -80,7 +80,7 @@ static void *agp_remap(unsigned long offset, unsigned long size,
          * page-table instead (that's probably faster anyhow...).
          */
         /* note: use vmalloc() because num_pages could be large... */
-        page_map = vmalloc(num_pages * sizeof(struct page *));
+        page_map = vmalloc(array_size(num_pages, sizeof(struct page *)));
         if (!page_map)
                 return NULL;
 
diff --git a/drivers/gpu/drm/nouveau/nv84_fence.c b/drivers/gpu/drm/nouveau/nv84_fence.c
index 090664899247..e721bb2163a0 100644
--- a/drivers/gpu/drm/nouveau/nv84_fence.c
+++ b/drivers/gpu/drm/nouveau/nv84_fence.c
@@ -141,7 +141,7 @@ nv84_fence_suspend(struct nouveau_drm *drm)
         struct nv84_fence_priv *priv = drm->fence;
         int i;
 
-        priv->suspend = vmalloc(drm->chan.nr * sizeof(u32));
+        priv->suspend = vmalloc(array_size(sizeof(u32), drm->chan.nr));
         if (priv->suspend) {
                 for (i = 0; i < drm->chan.nr; i++)
                         priv->suspend[i] = nouveau_bo_rd32(priv->bo, i*4);
diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
index 9a6752606079..ca465c0d49fa 100644
--- a/drivers/gpu/drm/qxl/qxl_fb.c
+++ b/drivers/gpu/drm/qxl/qxl_fb.c
@@ -241,7 +241,7 @@ static int qxlfb_create(struct qxl_fbdev *qfbdev,
         DRM_DEBUG_DRIVER("%dx%d %d\n", mode_cmd.width,
                          mode_cmd.height, mode_cmd.pitches[0]);
 
-        shadow = vmalloc(mode_cmd.pitches[0] * mode_cmd.height);
+        shadow = vmalloc(array_size(mode_cmd.pitches[0], mode_cmd.height));
         /* TODO: what's the usual response to memory allocation errors? */
         BUG_ON(!shadow);
         DRM_DEBUG_DRIVER("surface0 at gpu offset %lld, mmap_offset %lld (virt %p, shadow %p)\n",
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 0b3ec35515f3..66149eaba78c 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -352,8 +352,8 @@ int radeon_gart_init(struct radeon_device *rdev)
                 radeon_gart_fini(rdev);
                 return -ENOMEM;
         }
-        rdev->gart.pages_entry = vmalloc(sizeof(uint64_t) *
-                                         rdev->gart.num_gpu_pages);
+        rdev->gart.pages_entry = vmalloc(array_size(sizeof(uint64_t),
+                                                    rdev->gart.num_gpu_pages));
         if (rdev->gart.pages_entry == NULL) {
                 radeon_gart_fini(rdev);
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/selftests/test-drm_mm.c b/drivers/gpu/drm/selftests/test-drm_mm.c
index ab6c6c9c5b5c..7027a6739845 100644
--- a/drivers/gpu/drm/selftests/test-drm_mm.c
+++ b/drivers/gpu/drm/selftests/test-drm_mm.c
@@ -579,7 +579,7 @@ static int __igt_insert(unsigned int count, u64 size, bool replace)
         DRM_MM_BUG_ON(!size);
 
         ret = -ENOMEM;
-        nodes = vmalloc(count * sizeof(*nodes));
+        nodes = vmalloc(array_size(count, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
diff --git a/drivers/iommu/tegra-gart.c b/drivers/iommu/tegra-gart.c
index 89ec24c6952c..a004f6da35f2 100644
--- a/drivers/iommu/tegra-gart.c
+++ b/drivers/iommu/tegra-gart.c
@@ -465,7 +465,7 @@ static int tegra_gart_probe(struct platform_device *pdev)
         gart->iovmm_base = (dma_addr_t)res_remap->start;
         gart->page_count = (resource_size(res_remap) >> GART_PAGE_SHIFT);
 
-        gart->savedata = vmalloc(sizeof(u32) * gart->page_count);
+        gart->savedata = vmalloc(array_size(sizeof(u32), gart->page_count));
         if (!gart->savedata) {
                 dev_err(dev, "failed to allocate context save area\n");
                 return -ENOMEM;
diff --git a/drivers/isdn/i4l/isdn_bsdcomp.c b/drivers/isdn/i4l/isdn_bsdcomp.c
index 99012c047751..7f28b967ed19 100644
--- a/drivers/isdn/i4l/isdn_bsdcomp.c
+++ b/drivers/isdn/i4l/isdn_bsdcomp.c
@@ -340,7 +340,7 @@ static void *bsd_alloc(struct isdn_ppp_comp_data *data)
          * Allocate space for the dictionary. This may be more than one page in
          * length.
          */
-        db->dict = vmalloc(hsize * sizeof(struct bsd_dict));
+        db->dict = vmalloc(array_size(hsize, sizeof(struct bsd_dict)));
         if (!db->dict) {
                 bsd_free(db);
                 return NULL;
@@ -353,7 +353,8 @@ static void *bsd_alloc(struct isdn_ppp_comp_data *data)
         if (!decomp)
                 db->lens = NULL;
         else {
-                db->lens = vmalloc((maxmaxcode + 1) * sizeof(db->lens[0]));
+                db->lens = vmalloc(array_size(sizeof(db->lens[0]),
+                                              maxmaxcode + 1));
                 if (!db->lens) {
                         bsd_free(db);
                         return (NULL);
diff --git a/drivers/lightnvm/pblk-gc.c b/drivers/lightnvm/pblk-gc.c
index 6a4883e40cc0..080469d90b40 100644
--- a/drivers/lightnvm/pblk-gc.c
+++ b/drivers/lightnvm/pblk-gc.c
@@ -88,7 +88,7 @@ static void pblk_gc_line_ws(struct work_struct *work)
 
         up(&gc->gc_sem);
 
-        gc_rq->data = vmalloc(gc_rq->nr_secs * geo->csecs);
+        gc_rq->data = vmalloc(array_size(gc_rq->nr_secs, geo->csecs));
         if (!gc_rq->data) {
                 pr_err("pblk: could not GC line:%d (%d/%d)\n",
                                         line->id, *line->vsc, gc_rq->nr_secs);
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 8ccbc8f3b3af..225b15aa0340 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -881,7 +881,8 @@ SHOW(__bch_cache)
                 uint16_t q[31], *p, *cached;
                 ssize_t ret;
 
-                cached = p = vmalloc(ca->sb.nbuckets * sizeof(uint16_t));
+                cached = p = vmalloc(array_size(sizeof(uint16_t),
+                                                ca->sb.nbuckets));
                 if (!p)
                         return -ENOMEM;
 
diff --git a/drivers/md/dm-cache-policy-smq.c b/drivers/md/dm-cache-policy-smq.c
index 4ab23d0075f6..4d69b6f4129e 100644
--- a/drivers/md/dm-cache-policy-smq.c
+++ b/drivers/md/dm-cache-policy-smq.c
@@ -588,7 +588,7 @@ static int h_init(struct smq_hash_table *ht, struct entry_space *es, unsigned nr
         nr_buckets = roundup_pow_of_two(max(nr_entries / 4u, 16u));
         ht->hash_bits = __ffs(nr_buckets);
 
-        ht->buckets = vmalloc(sizeof(*ht->buckets) * nr_buckets);
+        ht->buckets = vmalloc(array_size(nr_buckets, sizeof(*ht->buckets)));
         if (!ht->buckets)
                 return -ENOMEM;
 
diff --git a/drivers/md/dm-region-hash.c b/drivers/md/dm-region-hash.c
index abf3521b80a8..bc7795095dd9 100644
--- a/drivers/md/dm-region-hash.c
+++ b/drivers/md/dm-region-hash.c
@@ -202,7 +202,7 @@ struct dm_region_hash *dm_region_hash_create(
         rh->shift = RH_HASH_SHIFT;
         rh->prime = RH_HASH_MULT;
 
-        rh->buckets = vmalloc(nr_buckets * sizeof(*rh->buckets));
+        rh->buckets = vmalloc(array_size(nr_buckets, sizeof(*rh->buckets)));
         if (!rh->buckets) {
                 DMERR("unable to allocate region hash bucket memory");
                 kfree(rh);
diff --git a/drivers/md/dm-switch.c b/drivers/md/dm-switch.c
index 7924a6a33ddc..fae35caf3672 100644
--- a/drivers/md/dm-switch.c
+++ b/drivers/md/dm-switch.c
@@ -114,7 +114,8 @@ static int alloc_region_table(struct dm_target *ti, unsigned nr_paths)
                 return -EINVAL;
         }
 
-        sctx->region_table = vmalloc(nr_slots * sizeof(region_table_slot_t));
+        sctx->region_table = vmalloc(array_size(nr_slots,
+                                                sizeof(region_table_slot_t)));
         if (!sctx->region_table) {
                 ti->error = "Cannot allocate region table";
                 return -ENOMEM;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 5772756c63c1..a91332557bc8 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2939,7 +2939,9 @@ static struct pool *pool_create(struct mapped_device *pool_md,
                 goto bad_mapping_pool;
         }
 
-        pool->cell_sort_array = vmalloc(sizeof(*pool->cell_sort_array) * CELL_SORT_ARRAY_SIZE);
+        pool->cell_sort_array =
+                vmalloc(array_size(CELL_SORT_ARRAY_SIZE,
+                                   sizeof(*pool->cell_sort_array)));
         if (!pool->cell_sort_array) {
                 *error = "Error allocating cell sort array";
                 err_p = ERR_PTR(-ENOMEM);
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index cb078d688c70..d548f98c7a67 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -1417,7 +1417,8 @@ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter)
         if (dmxdev->demux->open(dmxdev->demux) < 0)
                 return -EUSERS;
 
-        dmxdev->filter = vmalloc(dmxdev->filternum * sizeof(struct dmxdev_filter));
+        dmxdev->filter = vmalloc(array_size(sizeof(struct dmxdev_filter),
+                                            dmxdev->filternum));
         if (!dmxdev->filter)
                 return -ENOMEM;
 
diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c
index f45091246bdc..39a2c6ccf31d 100644
--- a/drivers/media/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb-core/dvb_demux.c
@@ -1247,12 +1247,14 @@ int dvb_dmx_init(struct dvb_demux *dvbdemux)
 
         dvbdemux->cnt_storage = NULL;
         dvbdemux->users = 0;
-        dvbdemux->filter = vmalloc(dvbdemux->filternum * sizeof(struct dvb_demux_filter));
+        dvbdemux->filter = vmalloc(array_size(sizeof(struct dvb_demux_filter),
+                                              dvbdemux->filternum));
 
         if (!dvbdemux->filter)
                 return -ENOMEM;
 
-        dvbdemux->feed = vmalloc(dvbdemux->feednum * sizeof(struct dvb_demux_feed));
+        dvbdemux->feed = vmalloc(array_size(sizeof(struct dvb_demux_feed),
+                                            dvbdemux->feednum));
         if (!dvbdemux->feed) {
                 vfree(dvbdemux->filter);
                 dvbdemux->filter = NULL;
diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c
index dedcdb573427..8001d3e9134e 100644
--- a/drivers/media/pci/meye/meye.c
+++ b/drivers/media/pci/meye/meye.c
@@ -1625,7 +1625,7 @@ static int meye_probe(struct pci_dev *pcidev, const struct pci_device_id *ent)
         ret = -ENOMEM;
         meye.mchip_dev = pcidev;
 
-        meye.grab_temp = vmalloc(MCHIP_NB_PAGES_MJPEG * PAGE_SIZE);
+        meye.grab_temp = vmalloc(array_size(PAGE_SIZE, MCHIP_NB_PAGES_MJPEG));
         if (!meye.grab_temp)
                 goto outvmalloc;
 
diff --git a/drivers/media/pci/pt1/pt1.c b/drivers/media/pci/pt1/pt1.c
index 5708f69622cc..fda969a85684 100644
--- a/drivers/media/pci/pt1/pt1.c
+++ b/drivers/media/pci/pt1/pt1.c
@@ -615,7 +615,7 @@ static int pt1_init_tables(struct pt1 *pt1)
         if (!pt1_nr_tables)
                 return 0;
 
-        tables = vmalloc(sizeof(struct pt1_table) * pt1_nr_tables);
+        tables = vmalloc(array_size(pt1_nr_tables, sizeof(struct pt1_table)));
         if (tables == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/media/pci/ttpci/av7110_ipack.c b/drivers/media/pci/ttpci/av7110_ipack.c
index 5aff26574fe1..ec528fae7333 100644
--- a/drivers/media/pci/ttpci/av7110_ipack.c
+++ b/drivers/media/pci/ttpci/av7110_ipack.c
@@ -24,7 +24,7 @@ void av7110_ipack_reset(struct ipack *p)
 int av7110_ipack_init(struct ipack *p, int size,
                       void (*func)(u8 *buf, int size, void *priv))
 {
-        if (!(p->buf = vmalloc(size*sizeof(u8)))) {
+        if (!(p->buf = vmalloc(size))) {
                 printk(KERN_WARNING "Couldn't allocate memory for ipack\n");
                 return -ENOMEM;
         }
diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c
index 69f0d8e80bd8..66d613629167 100644
--- a/drivers/media/platform/soc_camera/soc_camera.c
+++ b/drivers/media/platform/soc_camera/soc_camera.c
@@ -481,7 +481,8 @@ static int soc_camera_init_user_formats(struct soc_camera_device *icd)
                 return -ENXIO;
 
         icd->user_formats =
-                vmalloc(fmts * sizeof(struct soc_camera_format_xlate));
+                vmalloc(array_size(fmts,
+                                   sizeof(struct soc_camera_format_xlate)));
         if (!icd->user_formats)
                 return -ENOMEM;
 
diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
index 78155f596f74..314abde9a922 100644
--- a/drivers/media/v4l2-core/videobuf-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
@@ -100,7 +100,7 @@ static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
 
         if (NULL == pages[0])
                 return NULL;
-        sglist = vmalloc(nr_pages * sizeof(*sglist));
+        sglist = vmalloc(array_size(nr_pages, sizeof(*sglist)));
         if (NULL == sglist)
                 return NULL;
         sg_init_table(sglist, nr_pages);
diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
index 1f8063c6aed1..2578f27914ef 100644
--- a/drivers/mtd/ftl.c
+++ b/drivers/mtd/ftl.c
@@ -263,7 +263,7 @@ static int build_maps(partition_t *part)
 
     /* Set up virtual page map */
     blocks = le32_to_cpu(header.FormattedSize) >> header.BlockSize;
-    part->VirtualBlockMap = vmalloc(blocks * sizeof(uint32_t));
+    part->VirtualBlockMap = vmalloc(array_size(blocks, sizeof(uint32_t)));
     if (!part->VirtualBlockMap)
             goto out_XferInfo;
 
diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
index 9f25111fd559..e078fc41aa61 100644
--- a/drivers/mtd/mtdoops.c
+++ b/drivers/mtd/mtdoops.c
@@ -330,8 +330,10 @@ static void mtdoops_notify_add(struct mtd_info *mtd)
         }
 
         /* oops_page_used is a bit field */
-        cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages,
-                        BITS_PER_LONG) * sizeof(unsigned long));
+        cxt->oops_page_used =
+                vmalloc(array_size(sizeof(unsigned long),
+                                   DIV_ROUND_UP(mtdoops_pages,
+                                                BITS_PER_LONG)));
         if (!cxt->oops_page_used) {
                 printk(KERN_ERR "mtdoops: could not allocate page array\n");
                 return;
diff --git a/drivers/mtd/mtdswap.c b/drivers/mtd/mtdswap.c
index 6593879595e3..d9dcb2d051b4 100644
--- a/drivers/mtd/mtdswap.c
+++ b/drivers/mtd/mtdswap.c
@@ -1317,11 +1317,11 @@ static int mtdswap_init(struct mtdswap_dev *d, unsigned int eblocks,
         for (i = 0; i < MTDSWAP_TREE_CNT; i++)
                 d->trees[i].root = RB_ROOT;
 
-        d->page_data = vmalloc(sizeof(int)*pages);
+        d->page_data = vmalloc(array_size(pages, sizeof(int)));
         if (!d->page_data)
                 goto page_data_fail;
 
-        d->revmap = vmalloc(sizeof(int)*blocks);
+        d->revmap = vmalloc(array_size(blocks, sizeof(int)));
         if (!d->revmap)
                 goto revmap_fail;
 
diff --git a/drivers/mtd/nand/raw/nandsim.c b/drivers/mtd/nand/raw/nandsim.c
index e027c6f9d327..9dc29d4389f7 100644
--- a/drivers/mtd/nand/raw/nandsim.c
+++ b/drivers/mtd/nand/raw/nandsim.c
@@ -582,7 +582,7 @@ static int __init alloc_device(struct nandsim *ns)
                 return 0;
         }
 
-        ns->pages = vmalloc(ns->geom.pgnum * sizeof(union ns_mem));
+        ns->pages = vmalloc(array_size(sizeof(union ns_mem), ns->geom.pgnum));
         if (!ns->pages) {
                 NS_ERR("alloc_device: unable to allocate page array\n");
                 return -ENOMEM;
diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c
index df27f24ce0fa..94720f2ca9a8 100644
--- a/drivers/mtd/rfd_ftl.c
+++ b/drivers/mtd/rfd_ftl.c
@@ -189,7 +189,8 @@ static int scan_header(struct partition *part)
         if (!part->blocks)
                 goto err;
 
-        part->sector_map = vmalloc(part->sector_count * sizeof(u_long));
+        part->sector_map = vmalloc(array_size(sizeof(u_long),
+                                              part->sector_count));
         if (!part->sector_map) {
                 printk(KERN_ERR PREFIX "'%s': unable to allocate memory for "
                         "sector map", part->mbd.mtd->name);
diff --git a/drivers/net/ethernet/cavium/liquidio/request_manager.c b/drivers/net/ethernet/cavium/liquidio/request_manager.c
index b1270355b0b1..1f2e75da28f8 100644
--- a/drivers/net/ethernet/cavium/liquidio/request_manager.c
+++ b/drivers/net/ethernet/cavium/liquidio/request_manager.c
@@ -98,8 +98,9 @@ int octeon_init_instr_queue(struct octeon_device *oct,
         iq->request_list = vmalloc_node((sizeof(*iq->request_list) * num_descs),
                                                numa_node);
         if (!iq->request_list)
-                iq->request_list = vmalloc(sizeof(*iq->request_list) *
-                                                  num_descs);
+                iq->request_list =
+                        vmalloc(array_size(num_descs,
+                                           sizeof(*iq->request_list)));
         if (!iq->request_list) {
                 lio_dma_free(oct, q_size, iq->base_addr, iq->base_addr_dma);
                 dev_err(&oct->pci_dev->dev, "Alloc failed for IQ[%d] nr free list\n",
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
index 7657daa27298..4895dd83dd08 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
@@ -558,7 +558,7 @@ static int fm10k_set_ringparam(struct net_device *netdev,
 
         /* allocate temporary buffer to store rings in */
         i = max_t(int, interface->num_tx_queues, interface->num_rx_queues);
-        temp_ring = vmalloc(i * sizeof(struct fm10k_ring));
+        temp_ring = vmalloc(array_size(i, sizeof(struct fm10k_ring)));
 
         if (!temp_ring) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 0edd3cdd84b0..f92f7918112d 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -902,11 +902,11 @@ static int igb_set_ringparam(struct net_device *netdev,
         }
 
         if (adapter->num_tx_queues > adapter->num_rx_queues)
-                temp_ring = vmalloc(adapter->num_tx_queues *
-                                    sizeof(struct igb_ring));
+                temp_ring = vmalloc(array_size(sizeof(struct igb_ring),
+                                               adapter->num_tx_queues));
         else
-                temp_ring = vmalloc(adapter->num_rx_queues *
-                                    sizeof(struct igb_ring));
+                temp_ring = vmalloc(array_size(sizeof(struct igb_ring),
+                                               adapter->num_rx_queues));
 
         if (!temp_ring) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index be2636ea945b..bd1ba88ec1d5 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -1063,7 +1063,7 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
         /* allocate temporary buffer to store rings in */
         i = max_t(int, adapter->num_tx_queues + adapter->num_xdp_queues,
                   adapter->num_rx_queues);
-        temp_ring = vmalloc(i * sizeof(struct ixgbe_ring));
+        temp_ring = vmalloc(array_size(i, sizeof(struct ixgbe_ring)));
 
         if (!temp_ring) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/intel/ixgbevf/ethtool.c b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
index e7813d76527c..631c91046f39 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
@@ -282,8 +282,9 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
         }
 
         if (new_tx_count != adapter->tx_ring_count) {
-                tx_ring = vmalloc((adapter->num_tx_queues +
-                                   adapter->num_xdp_queues) * sizeof(*tx_ring));
+                tx_ring = vmalloc(array_size(sizeof(*tx_ring),
+                                             adapter->num_tx_queues +
+                                                adapter->num_xdp_queues));
                 if (!tx_ring) {
                         err = -ENOMEM;
                         goto clear_reset;
@@ -327,7 +328,8 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
         }
 
         if (new_rx_count != adapter->rx_ring_count) {
-                rx_ring = vmalloc(adapter->num_rx_queues * sizeof(*rx_ring));
+                rx_ring = vmalloc(array_size(sizeof(*rx_ring),
+                                             adapter->num_rx_queues));
                 if (!rx_ring) {
                         err = -ENOMEM;
                         goto clear_reset;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
index 21668aa435e8..93fb809f50d1 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
@@ -417,7 +417,8 @@ int nfp_flower_metadata_init(struct nfp_app *app)
 
         /* Init ring buffer and unallocated stats_ids. */
         priv->stats_ids.free_list.buf =
-                vmalloc(NFP_FL_STATS_ENTRY_RS * NFP_FL_STATS_ELEM_RS);
+                vmalloc(array_size(NFP_FL_STATS_ELEM_RS,
+                                   NFP_FL_STATS_ENTRY_RS));
         if (!priv->stats_ids.free_list.buf)
                 goto err_free_last_used;
 
diff --git a/drivers/net/ppp/bsd_comp.c b/drivers/net/ppp/bsd_comp.c
index a9b759add187..61fedb23d3cf 100644
--- a/drivers/net/ppp/bsd_comp.c
+++ b/drivers/net/ppp/bsd_comp.c
@@ -406,7 +406,7 @@ static void *bsd_alloc (unsigned char *options, int opt_len, int decomp)
  * Allocate space for the dictionary. This may be more than one page in
  * length.
  */
-    db->dict = vmalloc(hsize * sizeof(struct bsd_dict));
+    db->dict = vmalloc(array_size(hsize, sizeof(struct bsd_dict)));
     if (!db->dict)
       {
         bsd_free (db);
@@ -425,7 +425,7 @@ static void *bsd_alloc (unsigned char *options, int opt_len, int decomp)
  */
     else
       {
-        db->lens = vmalloc((maxmaxcode + 1) * sizeof(db->lens[0]));
+        db->lens = vmalloc(array_size(sizeof(db->lens[0]), (maxmaxcode + 1)));
         if (!db->lens)
           {
             bsd_free (db);
diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
index 3513bbec4639..e01faf641288 100644
--- a/drivers/net/wireless/ath/ath5k/debug.c
+++ b/drivers/net/wireless/ath/ath5k/debug.c
@@ -931,7 +931,7 @@ static int open_file_eeprom(struct inode *inode, struct file *file)
 
         /* Create buffer and read in eeprom */
 
-        buf = vmalloc(eesize * 2);
+        buf = vmalloc(array_size(eesize, 2));
         if (!buf) {
                 ret = -ENOMEM;
                 goto err;
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index a67e2d66ac9d..4b5ae9098504 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -4242,8 +4242,8 @@ int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter)
          * additional active scan request for hidden SSIDs on passive channels.
          */
         adapter->num_in_chan_stats = 2 * (n_channels_bg + n_channels_a);
-        adapter->chan_stats = vmalloc(sizeof(*adapter->chan_stats) *
-                                      adapter->num_in_chan_stats);
+        adapter->chan_stats = vmalloc(array_size(sizeof(*adapter->chan_stats),
+                                                 adapter->num_in_chan_stats));
 
         if (!adapter->chan_stats)
                 return -ENOMEM;
diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
index 32888f2bd1a9..12ea4a4ad607 100644
--- a/drivers/oprofile/event_buffer.c
+++ b/drivers/oprofile/event_buffer.c
@@ -91,7 +91,7 @@ int alloc_event_buffer(void)
                 return -EINVAL;
 
         buffer_pos = 0;
-        event_buffer = vmalloc(sizeof(unsigned long) * buffer_size);
+        event_buffer = vmalloc(array_size(buffer_size, sizeof(unsigned long)));
         if (!event_buffer)
                 return -ENOMEM;
 
diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index 0434ab7b6497..a8cb8d2f2abb 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -975,7 +975,7 @@ static int rio_mport_transfer_ioctl(struct file *filp, void __user *arg)
              priv->md->properties.transfer_mode) == 0)
                 return -ENODEV;
 
-        transfer = vmalloc(transaction.count * sizeof(*transfer));
+        transfer = vmalloc(array_size(sizeof(*transfer), transaction.count));
         if (!transfer)
                 return -ENOMEM;
 
diff --git a/drivers/scsi/fnic/fnic_debugfs.c b/drivers/scsi/fnic/fnic_debugfs.c
index 6d3e1cb4fea6..139fffa3658a 100644
--- a/drivers/scsi/fnic/fnic_debugfs.c
+++ b/drivers/scsi/fnic/fnic_debugfs.c
@@ -233,8 +233,8 @@ static int fnic_trace_debugfs_open(struct inode *inode,
                 return -ENOMEM;
 
         if (*rdata_ptr == fc_trc_flag->fnic_trace) {
-                fnic_dbg_prt->buffer = vmalloc(3 *
-                                        (trace_max_pages * PAGE_SIZE));
+                fnic_dbg_prt->buffer = vmalloc(array3_size(3, trace_max_pages,
+                                                           PAGE_SIZE));
                 if (!fnic_dbg_prt->buffer) {
                         kfree(fnic_dbg_prt);
                         return -ENOMEM;
@@ -244,7 +244,8 @@ static int fnic_trace_debugfs_open(struct inode *inode,
                 fnic_dbg_prt->buffer_len = fnic_get_trace_data(fnic_dbg_prt);
         } else {
                 fnic_dbg_prt->buffer =
-                        vmalloc(3 * (fnic_fc_trace_max_pages * PAGE_SIZE));
+                        vmalloc(array3_size(3, fnic_fc_trace_max_pages,
+                                            PAGE_SIZE));
                 if (!fnic_dbg_prt->buffer) {
                         kfree(fnic_dbg_prt);
                         return -ENOMEM;
diff --git a/drivers/scsi/fnic/fnic_trace.c b/drivers/scsi/fnic/fnic_trace.c
index 98597b59c12a..8271785bdb93 100644
--- a/drivers/scsi/fnic/fnic_trace.c
+++ b/drivers/scsi/fnic/fnic_trace.c
@@ -477,8 +477,9 @@ int fnic_trace_buf_init(void)
         }
         memset((void *)fnic_trace_buf_p, 0, (trace_max_pages * PAGE_SIZE));
 
-        fnic_trace_entries.page_offset = vmalloc(fnic_max_trace_entries *
-                                                  sizeof(unsigned long));
+        fnic_trace_entries.page_offset =
+                vmalloc(array_size(fnic_max_trace_entries,
+                                   sizeof(unsigned long)));
         if (!fnic_trace_entries.page_offset) {
                 printk(KERN_ERR PFX "Failed to allocate memory for"
                                   " page_offset\n");
@@ -555,8 +556,9 @@ int fnic_fc_trace_init(void)
 
         fc_trace_max_entries = (fnic_fc_trace_max_pages * PAGE_SIZE)/
                                 FC_TRC_SIZE_BYTES;
-        fnic_fc_ctlr_trace_buf_p = (unsigned long)vmalloc(
-                                        fnic_fc_trace_max_pages * PAGE_SIZE);
+        fnic_fc_ctlr_trace_buf_p =
+                (unsigned long)vmalloc(array_size(PAGE_SIZE,
+                                                  fnic_fc_trace_max_pages));
         if (!fnic_fc_ctlr_trace_buf_p) {
                 pr_err("fnic: Failed to allocate memory for "
                        "FC Control Trace Buf\n");
@@ -568,8 +570,9 @@ int fnic_fc_trace_init(void)
                         fnic_fc_trace_max_pages * PAGE_SIZE);
 
         /* Allocate memory for page offset */
-        fc_trace_entries.page_offset = vmalloc(fc_trace_max_entries *
-                                                sizeof(unsigned long));
+        fc_trace_entries.page_offset =
+                vmalloc(array_size(fc_trace_max_entries,
+                                   sizeof(unsigned long)));
         if (!fc_trace_entries.page_offset) {
                 pr_err("fnic:Failed to allocate memory for page_offset\n");
                 if (fnic_fc_ctlr_trace_buf_p) {
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index e63785d5df32..0a9b8b387bd2 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4331,9 +4331,11 @@ static int ipr_alloc_dump(struct ipr_ioa_cfg *ioa_cfg)
         }
 
         if (ioa_cfg->sis64)
-                ioa_data = vmalloc(IPR_FMT3_MAX_NUM_DUMP_PAGES * sizeof(__be32 *));
+                ioa_data = vmalloc(array_size(IPR_FMT3_MAX_NUM_DUMP_PAGES,
+                                              sizeof(__be32 *)));
         else
-                ioa_data = vmalloc(IPR_FMT2_MAX_NUM_DUMP_PAGES * sizeof(__be32 *));
+                ioa_data = vmalloc(array_size(IPR_FMT2_MAX_NUM_DUMP_PAGES,
+                                              sizeof(__be32 *)));
 
         if (!ioa_data) {
                 ipr_err("Dump memory allocation failed\n");
diff --git a/drivers/scsi/osst.c b/drivers/scsi/osst.c
index 928ee4e89813..7a1a1edde35d 100644
--- a/drivers/scsi/osst.c
+++ b/drivers/scsi/osst.c
@@ -1488,7 +1488,7 @@ static int osst_read_back_buffer_and_rewrite(struct osst_tape * STp, struct osst
         int                     dbg              = debugging;
 #endif
 
-        if ((buffer = vmalloc((nframes + 1) * OS_DATA_SIZE)) == NULL)
+        if ((buffer = vmalloc(array_size((nframes + 1), OS_DATA_SIZE))) == NULL)
                 return (-EIO);
 
         printk(KERN_INFO "%s:I: Reading back %d frames from drive buffer%s\n",
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 798a6afa4cbf..24d7496cd9e2 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -5439,7 +5439,8 @@ static int __init scsi_debug_init(void)
                 }
 
                 map_size = lba_to_map_index(sdebug_store_sectors - 1) + 1;
-                map_storep = vmalloc(BITS_TO_LONGS(map_size) * sizeof(long));
+                map_storep = vmalloc(array_size(sizeof(long),
+                                                BITS_TO_LONGS(map_size)));
 
                 pr_info("%lu provisioning blocks\n", map_size);
 
diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c
index 772dad65396e..e8c440329708 100644
--- a/drivers/staging/android/ion/ion_heap.c
+++ b/drivers/staging/android/ion/ion_heap.c
@@ -25,7 +25,8 @@ void *ion_heap_map_kernel(struct ion_heap *heap,
         pgprot_t pgprot;
         struct sg_table *table = buffer->sg_table;
         int npages = PAGE_ALIGN(buffer->size) / PAGE_SIZE;
-        struct page **pages = vmalloc(sizeof(struct page *) * npages);
+        struct page **pages = vmalloc(array_size(npages,
+                                                 sizeof(struct page *)));
         struct page **tmp = pages;
 
         if (!pages)
diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c
index 341f729a9779..6dded10f4155 100644
--- a/drivers/staging/greybus/camera.c
+++ b/drivers/staging/greybus/camera.c
@@ -1175,8 +1175,9 @@ static int gb_camera_debugfs_init(struct gb_camera *gcam)
 
         gcam->debugfs.root = debugfs_create_dir(dirname, gb_debugfs_get());
 
-        gcam->debugfs.buffers = vmalloc(sizeof(*gcam->debugfs.buffers) *
-                                        GB_CAMERA_DEBUGFS_BUFFER_MAX);
+        gcam->debugfs.buffers =
+                vmalloc(array_size(GB_CAMERA_DEBUGFS_BUFFER_MAX,
+                                   sizeof(*gcam->debugfs.buffers)));
         if (!gcam->debugfs.buffers)
                 return -ENOMEM;
 
diff --git a/drivers/staging/media/zoran/zoran_driver.c b/drivers/staging/media/zoran/zoran_driver.c
index 906c3549e2ba..d7842224fff6 100644
--- a/drivers/staging/media/zoran/zoran_driver.c
+++ b/drivers/staging/media/zoran/zoran_driver.c
@@ -1220,7 +1220,8 @@ static int setup_window(struct zoran_fh *fh,
                 }
         } else if (clipcount) {
                 /* write our own bitmap from the clips */
-                vcp = vmalloc(sizeof(struct v4l2_clip) * (clipcount + 4));
+                vcp = vmalloc(array_size(sizeof(struct v4l2_clip),
+                                         clipcount + 4));
                 if (vcp == NULL) {
                         dprintk(1,
                                 KERN_ERR
diff --git a/drivers/staging/rts5208/ms.c b/drivers/staging/rts5208/ms.c
index 821256b95e22..b89ef15e3c20 100644
--- a/drivers/staging/rts5208/ms.c
+++ b/drivers/staging/rts5208/ms.c
@@ -2618,7 +2618,7 @@ static int ms_build_l2p_tbl(struct rtsx_chip *chip, int seg_no)
         segment = &ms_card->segment[seg_no];
 
         if (!segment->l2p_table) {
-                segment->l2p_table = vmalloc(table_size * 2);
+                segment->l2p_table = vmalloc(array_size(table_size, 2));
                 if (!segment->l2p_table) {
                         rtsx_trace(chip);
                         goto BUILD_FAIL;
diff --git a/drivers/staging/rts5208/rtsx_chip.c b/drivers/staging/rts5208/rtsx_chip.c
index 4ad472dd9daf..f8f9579cc679 100644
--- a/drivers/staging/rts5208/rtsx_chip.c
+++ b/drivers/staging/rts5208/rtsx_chip.c
@@ -1721,7 +1721,7 @@ int rtsx_read_cfg_seq(struct rtsx_chip *chip, u8 func, u16 addr, u8 *buf,
 
         dev_dbg(rtsx_dev(chip), "dw_len = %d\n", dw_len);
 
-        data = vmalloc(dw_len * 4);
+        data = vmalloc(array_size(dw_len, 4));
         if (!data) {
                 rtsx_trace(chip);
                 return STATUS_NOMEM;
diff --git a/drivers/usb/misc/sisusbvga/sisusb_con.c b/drivers/usb/misc/sisusbvga/sisusb_con.c
index a0d6e0af957c..c4f017e1d17a 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_con.c
+++ b/drivers/usb/misc/sisusbvga/sisusb_con.c
@@ -1243,7 +1243,7 @@ sisusbcon_font_set(struct vc_data *c, struct console_font *font,
         }
 
         if (!sisusb->font_backup)
-                sisusb->font_backup = vmalloc(charcount * 32);
+                sisusb->font_backup = vmalloc(array_size(charcount, 32));
 
         if (sisusb->font_backup) {
                 memcpy(sisusb->font_backup, font->data, charcount * 32);
diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c
index 46f63960fa9e..6a4bbc9e1fb0 100644
--- a/drivers/video/fbdev/xen-fbfront.c
+++ b/drivers/video/fbdev/xen-fbfront.c
@@ -412,7 +412,7 @@ static int xenfb_probe(struct xenbus_device *dev,
 
         info->nr_pages = (fb_size + PAGE_SIZE - 1) >> PAGE_SHIFT;
 
-        info->gfns = vmalloc(sizeof(unsigned long) * info->nr_pages);
+        info->gfns = vmalloc(array_size(sizeof(unsigned long), info->nr_pages));
         if (!info->gfns)
                 goto error_nomem;
 
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index bf5ee6f741cd..070b6184642d 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -2294,7 +2294,7 @@ static int elf_core_dump(struct coredump_params *cprm)
 
         if (segs - 1 > ULONG_MAX / sizeof(*vma_filesz))
                 goto end_coredump;
-        vma_filesz = vmalloc((segs - 1) * sizeof(*vma_filesz));
+        vma_filesz = vmalloc(array_size(sizeof(*vma_filesz), (segs - 1)));
         if (!vma_filesz)
                 goto end_coredump;
 
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index f90d4ad6624c..af29ade195c0 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -789,7 +789,7 @@ setup_aio_ctx_iter(struct cifs_aio_ctx *ctx, struct iov_iter *iter, int rw)
                                    GFP_KERNEL);
 
         if (!bv) {
-                bv = vmalloc(max_pages * sizeof(struct bio_vec));
+                bv = vmalloc(array_size(max_pages, sizeof(struct bio_vec)));
                 if (!bv)
                         return -ENOMEM;
         }
@@ -799,7 +799,7 @@ setup_aio_ctx_iter(struct cifs_aio_ctx *ctx, struct iov_iter *iter, int rw)
                                       GFP_KERNEL);
 
         if (!pages) {
-                pages = vmalloc(max_pages * sizeof(struct page *));
+                pages = vmalloc(array_size(max_pages, sizeof(struct page *)));
                 if (!pages) {
                         kvfree(bv);
                         return -ENOMEM;
diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
index 78a7c855b06b..5ba94be006ee 100644
--- a/fs/dlm/lockspace.c
+++ b/fs/dlm/lockspace.c
@@ -517,7 +517,7 @@ static int new_lockspace(const char *name, const char *cluster,
         size = dlm_config.ci_rsbtbl_size;
         ls->ls_rsbtbl_size = size;
 
-        ls->ls_rsbtbl = vmalloc(sizeof(struct dlm_rsbtable) * size);
+        ls->ls_rsbtbl = vmalloc(array_size(size, sizeof(struct dlm_rsbtable)));
         if (!ls->ls_rsbtbl)
                 goto out_lsfree;
         for (i = 0; i < size; i++) {
diff --git a/fs/reiserfs/bitmap.c b/fs/reiserfs/bitmap.c
index edc8ef78b63f..bf708ac287b4 100644
--- a/fs/reiserfs/bitmap.c
+++ b/fs/reiserfs/bitmap.c
@@ -1456,7 +1456,7 @@ int reiserfs_init_bitmap_cache(struct super_block *sb)
         struct reiserfs_bitmap_info *bitmap;
         unsigned int bmap_nr = reiserfs_bmap_count(sb);
 
-        bitmap = vmalloc(sizeof(*bitmap) * bmap_nr);
+        bitmap = vmalloc(array_size(bmap_nr, sizeof(*bitmap)));
         if (bitmap == NULL)
                 return -ENOMEM;
 
diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index d4e45adddf1e..8e99dad18880 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -632,7 +632,8 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
         pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_KERNEL);
         nnode = kzalloc(sizeof(struct ubifs_nnode), GFP_KERNEL);
         buf = vmalloc(c->leb_size);
-        ltab = vmalloc(sizeof(struct ubifs_lpt_lprops) * c->lpt_lebs);
+        ltab = vmalloc(array_size(sizeof(struct ubifs_lpt_lprops),
+                                  c->lpt_lebs));
         if (!pnode || !nnode || !buf || !ltab || !lsave) {
                 err = -ENOMEM;
                 goto out;
@@ -1626,7 +1627,8 @@ static int lpt_init_rd(struct ubifs_info *c)
 {
         int err, i;
 
-        c->ltab = vmalloc(sizeof(struct ubifs_lpt_lprops) * c->lpt_lebs);
+        c->ltab = vmalloc(array_size(sizeof(struct ubifs_lpt_lprops),
+                                     c->lpt_lebs));
         if (!c->ltab)
                 return -ENOMEM;
 
@@ -1690,7 +1692,8 @@ static int lpt_init_wr(struct ubifs_info *c)
 {
         int err, i;
 
-        c->ltab_cmt = vmalloc(sizeof(struct ubifs_lpt_lprops) * c->lpt_lebs);
+        c->ltab_cmt = vmalloc(array_size(sizeof(struct ubifs_lpt_lprops),
+                                         c->lpt_lebs));
         if (!c->ltab_cmt)
                 return -ENOMEM;
 
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index 9b3f9b04f817..8b4f0768efd6 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -195,7 +195,7 @@ struct cgroup_pidlist {
 static void *pidlist_allocate(int count)
 {
         if (PIDLIST_TOO_LARGE(count))
-                return vmalloc(count * sizeof(pid_t));
+                return vmalloc(array_size(count, sizeof(pid_t)));
         else
                 return kmalloc_array(count, sizeof(pid_t), GFP_KERNEL);
 }
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 1efcb5b0c3ed..c2bcf97d24c8 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -698,7 +698,7 @@ static int save_image_lzo(struct swap_map_handle *handle,
                 goto out_clean;
         }
 
-        data = vmalloc(sizeof(*data) * nr_threads);
+        data = vmalloc(array_size(nr_threads, sizeof(*data)));
         if (!data) {
                 pr_err("Failed to allocate LZO data\n");
                 ret = -ENOMEM;
@@ -1183,14 +1183,14 @@ static int load_image_lzo(struct swap_map_handle *handle,
         nr_threads = num_online_cpus() - 1;
         nr_threads = clamp_val(nr_threads, 1, LZO_THREADS);
 
-        page = vmalloc(sizeof(*page) * LZO_MAX_RD_PAGES);
+        page = vmalloc(array_size(LZO_MAX_RD_PAGES, sizeof(*page)));
         if (!page) {
                 pr_err("Failed to allocate LZO page\n");
                 ret = -ENOMEM;
                 goto out_clean;
         }
 
-        data = vmalloc(sizeof(*data) * nr_threads);
+        data = vmalloc(array_size(nr_threads, sizeof(*data)));
         if (!data) {
                 pr_err("Failed to allocate LZO data\n");
                 ret = -ENOMEM;
diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index e628fcfd1bde..42fcb7f05fac 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -831,8 +831,9 @@ rcu_torture_cbflood(void *arg)
             cbflood_intra_holdoff > 0 &&
             cur_ops->call &&
             cur_ops->cb_barrier) {
-                rhp = vmalloc(sizeof(*rhp) *
-                              cbflood_n_burst * cbflood_n_per_burst);
+                rhp = vmalloc(array3_size(cbflood_n_burst,
+                                          cbflood_n_per_burst,
+                                          sizeof(*rhp)));
                 err = !rhp;
         }
         if (err) {
diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
index 5cadb1b8b5fe..752d8042bad4 100644
--- a/kernel/trace/tracing_map.c
+++ b/kernel/trace/tracing_map.c
@@ -1075,7 +1075,7 @@ int tracing_map_sort_entries(struct tracing_map *map,
         struct tracing_map_sort_entry *sort_entry, **entries;
         int i, n_entries, ret;
 
-        entries = vmalloc(map->max_elts * sizeof(sort_entry));
+        entries = vmalloc(array_size(sizeof(sort_entry), map->max_elts));
         if (!entries)
                 return -ENOMEM;
 
diff --git a/mm/percpu-stats.c b/mm/percpu-stats.c
index 063ff60ecd90..b5fdd43b60c9 100644
--- a/mm/percpu-stats.c
+++ b/mm/percpu-stats.c
@@ -144,7 +144,7 @@ alloc_buffer:
         spin_unlock_irq(&pcpu_lock);
 
         /* there can be at most this many free and allocated fragments */
-        buffer = vmalloc((2 * max_nr_alloc + 1) * sizeof(int));
+        buffer = vmalloc(array_size(sizeof(int), (2 * max_nr_alloc + 1)));
         if (!buffer)
                 return -ENOMEM;
 
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 28f68a2ec911..684b66bfa199 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -903,12 +903,13 @@ static int translate_table(struct net *net, const char *name,
                  * if an error occurs
                  */
                 newinfo->chainstack =
-                        vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
+                        vmalloc(array_size(nr_cpu_ids,
+                                           sizeof(*(newinfo->chainstack))));
                 if (!newinfo->chainstack)
                         return -ENOMEM;
                 for_each_possible_cpu(i) {
                         newinfo->chainstack[i] =
-                          vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
+                          vmalloc(array_size(udc_cnt, sizeof(*(newinfo->chainstack[0]))));
                         if (!newinfo->chainstack[i]) {
                                 while (i)
                                         vfree(newinfo->chainstack[--i]);
@@ -918,7 +919,7 @@ static int translate_table(struct net *net, const char *name,
                         }
                 }
 
-                cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
+                cl_s = vmalloc(array_size(udc_cnt, sizeof(*cl_s)));
                 if (!cl_s)
                         return -ENOMEM;
                 i = 0; /* the i'th udc */
@@ -1293,7 +1294,7 @@ static int do_update_counters(struct net *net, const char *name,
         if (num_counters == 0)
                 return -EINVAL;
 
-        tmp = vmalloc(num_counters * sizeof(*tmp));
+        tmp = vmalloc(array_size(num_counters, sizeof(*tmp)));
         if (!tmp)
                 return -ENOMEM;
 
@@ -1434,7 +1435,7 @@ static int copy_counters_to_user(struct ebt_table *t,
                 return -EINVAL;
         }
 
-        counterstmp = vmalloc(nentries * sizeof(*counterstmp));
+        counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp)));
         if (!counterstmp)
                 return -ENOMEM;
 
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 61c3a389da89..99e0aa350dc5 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -1380,7 +1380,8 @@ int __init ip_vs_conn_init(void)
         /*
          * Allocate the connection hash table and initialize its list heads
          */
-        ip_vs_conn_tab = vmalloc(ip_vs_conn_tab_size * sizeof(*ip_vs_conn_tab));
+        ip_vs_conn_tab = vmalloc(array_size(ip_vs_conn_tab_size,
+                                            sizeof(*ip_vs_conn_tab)));
         if (!ip_vs_conn_tab)
                 return -ENOMEM;
 
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index ab1112e90f88..a4c8543176b2 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -389,7 +389,8 @@ int snd_seq_pool_init(struct snd_seq_pool *pool)
         if (snd_BUG_ON(!pool))
                 return -EINVAL;
 
-        cellptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
+        cellptr = vmalloc(array_size(sizeof(struct snd_seq_event_cell),
+                                     pool->size));
         if (!cellptr)
                 return -ENOMEM;
 
diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c
index 99d5a02f9169..598d140bb7cb 100644
--- a/sound/pci/cs46xx/dsp_spos.c
+++ b/sound/pci/cs46xx/dsp_spos.c
@@ -240,8 +240,9 @@ struct dsp_spos_instance *cs46xx_dsp_spos_create (struct snd_cs46xx * chip)
                 return NULL;
 
         /* better to use vmalloc for this big table */
-        ins->symbol_table.symbols = vmalloc(sizeof(struct dsp_symbol_entry) *
-                                            DSP_MAX_SYMBOLS);
+        ins->symbol_table.symbols =
+                vmalloc(array_size(DSP_MAX_SYMBOLS,
+                                   sizeof(struct dsp_symbol_entry)));
         ins->code.data = kmalloc(DSP_CODE_BYTE_SIZE, GFP_KERNEL);
         ins->modules = kmalloc_array(DSP_MAX_MODULES,
                                      sizeof(struct dsp_module_desc),
diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
index 18267de3a269..61f85ff91cd9 100644
--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -1941,9 +1941,10 @@ int snd_emu10k1_create(struct snd_card *card,
                 (unsigned long)emu->ptb_pages.addr,
                 (unsigned long)(emu->ptb_pages.addr + emu->ptb_pages.bytes));
 
-        emu->page_ptr_table = vmalloc(emu->max_cache_pages * sizeof(void *));
-        emu->page_addr_table = vmalloc(emu->max_cache_pages *
-                                       sizeof(unsigned long));
+        emu->page_ptr_table = vmalloc(array_size(sizeof(void *),
+                                                 emu->max_cache_pages));
+        emu->page_addr_table = vmalloc(array_size(sizeof(unsigned long),
+                                                  emu->max_cache_pages));
         if (emu->page_ptr_table == NULL || emu->page_addr_table == NULL) {
                 err = -ENOMEM;
                 goto error;
@@ -2099,7 +2100,7 @@ static int alloc_pm_buffer(struct snd_emu10k1 *emu)
         size = ARRAY_SIZE(saved_regs);
         if (emu->audigy)
                 size += ARRAY_SIZE(saved_regs_audigy);
-        emu->saved_ptr = vmalloc(4 * NUM_G * size);
+        emu->saved_ptr = vmalloc(array3_size(4, NUM_G, size));
         if (!emu->saved_ptr)
                 return -ENOMEM;
         if (snd_emu10k1_efx_alloc_pm_buffer(emu) < 0)
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index af1085d946ec..de2ecbe95d6c 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -2692,7 +2692,7 @@ int snd_emu10k1_efx_alloc_pm_buffer(struct snd_emu10k1 *emu)
         if (! emu->tram_val_saved || ! emu->tram_addr_saved)
                 return -ENOMEM;
         len = emu->audigy ? 2 * 1024 : 2 * 512;
-        emu->saved_icode = vmalloc(len * 4);
+        emu->saved_icode = vmalloc(array_size(len, 4));
         if (! emu->saved_icode)
                 return -ENOMEM;
         return 0;
diff --git a/sound/pci/emu10k1/p16v.c b/sound/pci/emu10k1/p16v.c
index a30da78a95b7..4948b95f6665 100644
--- a/sound/pci/emu10k1/p16v.c
+++ b/sound/pci/emu10k1/p16v.c
@@ -874,7 +874,7 @@ int snd_p16v_mixer(struct snd_emu10k1 *emu)
 
 int snd_p16v_alloc_pm_buffer(struct snd_emu10k1 *emu)
 {
-        emu->p16v_saved = vmalloc(NUM_CHS * 4 * 0x80);
+        emu->p16v_saved = vmalloc(array_size(NUM_CHS * 4, 0x80));
         if (! emu->p16v_saved)
                 return -ENOMEM;
         return 0;
diff --git a/sound/pci/maestro3.c b/sound/pci/maestro3.c
index 8f20dec97843..224e942f556d 100644
--- a/sound/pci/maestro3.c
+++ b/sound/pci/maestro3.c
@@ -2657,7 +2657,10 @@ snd_m3_create(struct snd_card *card, struct pci_dev *pci,
         chip->irq = pci->irq;
 
 #ifdef CONFIG_PM_SLEEP
-        chip->suspend_mem = vmalloc(sizeof(u16) * (REV_B_CODE_MEMORY_LENGTH + REV_B_DATA_MEMORY_LENGTH));
+        chip->suspend_mem =
+                vmalloc(array_size(sizeof(u16),
+                                   REV_B_CODE_MEMORY_LENGTH +
+                                        REV_B_DATA_MEMORY_LENGTH));
         if (chip->suspend_mem == NULL)
                 dev_warn(card->dev, "can't allocate apm buffer\n");
 #endif
diff --git a/sound/pci/trident/trident_main.c b/sound/pci/trident/trident_main.c
index eabd84d9ffee..49c64fae3466 100644
--- a/sound/pci/trident/trident_main.c
+++ b/sound/pci/trident/trident_main.c
@@ -3362,7 +3362,9 @@ static int snd_trident_tlb_alloc(struct snd_trident *trident)
         trident->tlb.entries = (unsigned int*)ALIGN((unsigned long)trident->tlb.buffer.area, SNDRV_TRIDENT_MAX_PAGES * 4);
         trident->tlb.entries_dmaaddr = ALIGN(trident->tlb.buffer.addr, SNDRV_TRIDENT_MAX_PAGES * 4);
         /* allocate shadow TLB page table (virtual addresses) */
-        trident->tlb.shadow_entries = vmalloc(SNDRV_TRIDENT_MAX_PAGES*sizeof(unsigned long));
+        trident->tlb.shadow_entries =
+                vmalloc(array_size(SNDRV_TRIDENT_MAX_PAGES,
+                                   sizeof(unsigned long)));
         if (!trident->tlb.shadow_entries)
                 return -ENOMEM;
 
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index c7b2e927f699..828ec2ca9b31 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3059,7 +3059,8 @@ static long kvm_vm_ioctl(struct file *filp,
                         goto out;
                 if (routing.nr) {
                         r = -ENOMEM;
-                        entries = vmalloc(routing.nr * sizeof(*entries));
+                        entries = vmalloc(array_size(sizeof(*entries),
+                                                     routing.nr));
                         if (!entries)
                                 goto out;
                         r = -EFAULT;