summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2018-06-12 16:55:00 -0400
committerKees Cook <keescook@chromium.org>2018-06-12 19:19:22 -0400
commit6da2ec56059c3c7a7e5f729e6349e74ace1e5c57 (patch)
tree2278b513e904a46e930a856da3ed3ac5bc3fe4a4
parent1c542f38ab8d30d9c852a16d49ac5a15267bbf1f (diff)
treewide: kmalloc() -> kmalloc_array()
The kmalloc() function has a 2-factor argument form, kmalloc_array(). This patch replaces cases of: kmalloc(a * b, gfp) with: kmalloc_array(a * b, gfp) as well as handling cases of: kmalloc(a * b * c, gfp) with: kmalloc(array3_size(a, b, c), gfp) as it's slightly less ugly than: kmalloc_array(array_size(a, b), c, gfp) This does, however, attempt to ignore constant size factors like: kmalloc(4 * 1024, gfp) though any constants defined via macros get caught up in the conversion. Any factors with a sizeof() of "unsigned char", "char", and "u8" were dropped, since they're redundant. The tools/ directory was manually excluded, since it has its own implementation of kmalloc(). The Coccinelle script used for this was: // Fix redundant parens around sizeof(). @@ type TYPE; expression THING, E; @@ ( kmalloc( - (sizeof(TYPE)) * E + sizeof(TYPE) * E , ...) | kmalloc( - (sizeof(THING)) * E + sizeof(THING) * E , ...) ) // Drop single-byte sizes and redundant parens. @@ expression COUNT; typedef u8; typedef __u8; @@ ( kmalloc( - sizeof(u8) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(__u8) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(char) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(unsigned char) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(u8) * COUNT + COUNT , ...) | kmalloc( - sizeof(__u8) * COUNT + COUNT , ...) | kmalloc( - sizeof(char) * COUNT + COUNT , ...) | kmalloc( - sizeof(unsigned char) * COUNT + COUNT , ...) ) // 2-factor product with sizeof(type/expression) and identifier or constant. @@ type TYPE; expression THING; identifier COUNT_ID; constant COUNT_CONST; @@ ( - kmalloc + kmalloc_array ( - sizeof(TYPE) * (COUNT_ID) + COUNT_ID, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * COUNT_ID + COUNT_ID, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * (COUNT_CONST) + COUNT_CONST, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * COUNT_CONST + COUNT_CONST, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (COUNT_ID) + COUNT_ID, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * COUNT_ID + COUNT_ID, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (COUNT_CONST) + COUNT_CONST, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * COUNT_CONST + COUNT_CONST, sizeof(THING) , ...) ) // 2-factor product, only identifiers. @@ identifier SIZE, COUNT; @@ - kmalloc + kmalloc_array ( - SIZE * COUNT + COUNT, SIZE , ...) // 3-factor product with 1 sizeof(type) or sizeof(expression), with // redundant parens removed. @@ expression THING; identifier STRIDE, COUNT; type TYPE; @@ ( kmalloc( - sizeof(TYPE) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(THING) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) ) // 3-factor product with 2 sizeof(variable), with redundant parens removed. @@ expression THING1, THING2; identifier COUNT; type TYPE1, TYPE2; @@ ( kmalloc( - sizeof(TYPE1) * sizeof(TYPE2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kmalloc( - sizeof(THING1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kmalloc( - sizeof(THING1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) ) // 3-factor product, only identifiers, with redundant parens removed. @@ identifier STRIDE, SIZE, COUNT; @@ ( kmalloc( - (COUNT) * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) ) // Any remaining multi-factor products, first at least 3-factor products, // when they're not all constants... @@ expression E1, E2, E3; constant C1, C2, C3; @@ ( kmalloc(C1 * C2 * C3, ...) | kmalloc( - (E1) * E2 * E3 + array3_size(E1, E2, E3) , ...) | kmalloc( - (E1) * (E2) * E3 + array3_size(E1, E2, E3) , ...) | kmalloc( - (E1) * (E2) * (E3) + array3_size(E1, E2, E3) , ...) | kmalloc( - E1 * E2 * E3 + array3_size(E1, E2, E3) , ...) ) // And then all remaining 2 factors products when they're not all constants, // keeping sizeof() as the second factor argument. @@ expression THING, E1, E2; type TYPE; constant C1, C2, C3; @@ ( kmalloc(sizeof(THING) * C2, ...) | kmalloc(sizeof(TYPE) * C2, ...) | kmalloc(C1 * C2 * C3, ...) | kmalloc(C1 * C2, ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * (E2) + E2, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * E2 + E2, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (E2) + E2, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * E2 + E2, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - (E1) * E2 + E1, E2 , ...) | - kmalloc + kmalloc_array ( - (E1) * (E2) + E1, E2 , ...) | - kmalloc + kmalloc_array ( - E1 * E2 + E1, E2 , ...) ) Signed-off-by: Kees Cook <keescook@chromium.org>
-rw-r--r--arch/arm/kernel/sys_oabi-compat.c4
-rw-r--r--arch/arm/mm/pgd.c2
-rw-r--r--arch/arm/probes/kprobes/test-core.c5
-rw-r--r--arch/ia64/kernel/mca_drv.c3
-rw-r--r--arch/ia64/mm/tlb.c5
-rw-r--r--arch/ia64/sn/kernel/irq.c3
-rw-r--r--arch/mips/alchemy/common/dbdma.c4
-rw-r--r--arch/powerpc/lib/rheap.c2
-rw-r--r--arch/powerpc/platforms/4xx/hsta_msi.c3
-rw-r--r--arch/powerpc/platforms/4xx/msi.c2
-rw-r--r--arch/powerpc/sysdev/mpic.c5
-rw-r--r--arch/s390/hypfs/hypfs_diag0c.c3
-rw-r--r--arch/s390/kernel/debug.c6
-rw-r--r--arch/s390/kernel/perf_cpum_cf_events.c2
-rw-r--r--arch/s390/mm/extmem.c2
-rw-r--r--arch/sparc/kernel/nmi.c3
-rw-r--r--arch/sparc/kernel/sys_sparc_64.c5
-rw-r--r--arch/sparc/net/bpf_jit_comp_32.c2
-rw-r--r--arch/um/drivers/ubd_kern.c12
-rw-r--r--arch/um/drivers/vector_kern.c12
-rw-r--r--arch/unicore32/kernel/pm.c5
-rw-r--r--arch/x86/events/core.c2
-rw-r--r--arch/x86/kernel/hpet.c4
-rw-r--r--arch/x86/kernel/ksysfs.c2
-rw-r--r--arch/x86/kvm/svm.c4
-rw-r--r--arch/x86/net/bpf_jit_comp.c2
-rw-r--r--arch/x86/net/bpf_jit_comp32.c2
-rw-r--r--arch/x86/platform/uv/tlb_uv.c2
-rw-r--r--block/partitions/ldm.c2
-rw-r--r--crypto/testmgr.c3
-rw-r--r--drivers/acpi/acpi_video.c5
-rw-r--r--drivers/acpi/apei/hest.c3
-rw-r--r--drivers/acpi/processor_perflib.c5
-rw-r--r--drivers/acpi/processor_throttling.c5
-rw-r--r--drivers/atm/solos-pci.c3
-rw-r--r--drivers/auxdisplay/cfag12864b.c4
-rw-r--r--drivers/block/DAC960.c4
-rw-r--r--drivers/block/loop.c3
-rw-r--r--drivers/block/z2ram.c5
-rw-r--r--drivers/cdrom/cdrom.c2
-rw-r--r--drivers/char/agp/compat_ioctl.c8
-rw-r--r--drivers/char/agp/isoch.c3
-rw-r--r--drivers/char/agp/sgi-agp.c6
-rw-r--r--drivers/char/agp/uninorth-agp.c4
-rw-r--r--drivers/char/virtio_console.c15
-rw-r--r--drivers/cpufreq/bmips-cpufreq.c2
-rw-r--r--drivers/crypto/chelsio/chtls/chtls_io.c2
-rw-r--r--drivers/crypto/stm32/stm32-hash.c5
-rw-r--r--drivers/dma/bestcomm/bestcomm.c3
-rw-r--r--drivers/dma/mv_xor.c2
-rw-r--r--drivers/firewire/core-iso.c4
-rw-r--r--drivers/firewire/net.c2
-rw-r--r--drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c4
-rw-r--r--drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c4
-rw-r--r--drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c4
-rw-r--r--drivers/gpu/drm/drm_edid.c3
-rw-r--r--drivers/gpu/drm/gma500/mid_bios.c2
-rw-r--r--drivers/gpu/drm/nouveau/nvif/mmu.c9
-rw-r--r--drivers/gpu/drm/nouveau/nvif/vmm.c3
-rw-r--r--drivers/gpu/drm/nouveau/nvkm/subdev/bios/iccsense.c3
-rw-r--r--drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c2
-rw-r--r--drivers/gpu/drm/omapdrm/omap_dmm_tiler.c4
-rw-r--r--drivers/gpu/drm/omapdrm/omap_gem.c2
-rw-r--r--drivers/gpu/drm/qxl/qxl_kms.c4
-rw-r--r--drivers/gpu/drm/savage/savage_bci.c5
-rw-r--r--drivers/gpu/drm/tinydrm/repaper.c2
-rw-r--r--drivers/gpu/drm/ttm/ttm_page_alloc.c8
-rw-r--r--drivers/gpu/drm/ttm/ttm_page_alloc_dma.c8
-rw-r--r--drivers/gpu/drm/vc4/vc4_plane.c2
-rw-r--r--drivers/hid/hid-core.c9
-rw-r--r--drivers/hid/hid-debug.c2
-rw-r--r--drivers/hid/hid-picolcd_fb.c3
-rw-r--r--drivers/hid/hidraw.c2
-rw-r--r--drivers/i2c/i2c-dev.c2
-rw-r--r--drivers/ide/ide-probe.c5
-rw-r--r--drivers/infiniband/core/cma.c4
-rw-r--r--drivers/infiniband/core/fmr_pool.c5
-rw-r--r--drivers/infiniband/hw/cxgb4/id_table.c4
-rw-r--r--drivers/infiniband/hw/mlx4/main.c12
-rw-r--r--drivers/infiniband/hw/mlx4/qp.c4
-rw-r--r--drivers/infiniband/hw/mthca/mthca_allocator.c18
-rw-r--r--drivers/infiniband/hw/mthca/mthca_cmd.c6
-rw-r--r--drivers/infiniband/hw/mthca/mthca_eq.c6
-rw-r--r--drivers/infiniband/hw/mthca/mthca_memfree.c6
-rw-r--r--drivers/infiniband/hw/mthca/mthca_mr.c2
-rw-r--r--drivers/infiniband/hw/mthca/mthca_qp.c4
-rw-r--r--drivers/infiniband/hw/mthca/mthca_srq.c2
-rw-r--r--drivers/infiniband/hw/nes/nes_nic.c2
-rw-r--r--drivers/infiniband/hw/ocrdma/ocrdma_verbs.c3
-rw-r--r--drivers/infiniband/hw/qib/qib_iba6120.c9
-rw-r--r--drivers/infiniband/hw/qib/qib_iba7220.c9
-rw-r--r--drivers/infiniband/hw/qib/qib_iba7322.c29
-rw-r--r--drivers/infiniband/ulp/iser/iser_initiator.c5
-rw-r--r--drivers/infiniband/ulp/srp/ib_srp.c9
-rw-r--r--drivers/infiniband/ulp/srpt/ib_srpt.c2
-rw-r--r--drivers/input/joystick/joydump.c2
-rw-r--r--drivers/irqchip/irq-gic-v3-its.c4
-rw-r--r--drivers/isdn/capi/capidrv.c3
-rw-r--r--drivers/isdn/gigaset/capi.c4
-rw-r--r--drivers/isdn/gigaset/common.c4
-rw-r--r--drivers/isdn/hisax/hfc_2bds0.c2
-rw-r--r--drivers/isdn/hisax/hfc_2bs0.c3
-rw-r--r--drivers/isdn/hisax/netjet.c12
-rw-r--r--drivers/isdn/i4l/isdn_common.c6
-rw-r--r--drivers/lightnvm/pblk-init.c4
-rw-r--r--drivers/md/dm-integrity.c3
-rw-r--r--drivers/md/dm-snap.c9
-rw-r--r--drivers/md/dm-stats.c4
-rw-r--r--drivers/md/dm-table.c2
-rw-r--r--drivers/md/md-bitmap.c4
-rw-r--r--drivers/md/raid1.c4
-rw-r--r--drivers/md/raid10.c2
-rw-r--r--drivers/media/pci/bt8xx/bttv-risc.c3
-rw-r--r--drivers/media/pci/ivtv/ivtvfb.c2
-rw-r--r--drivers/media/platform/vivid/vivid-core.c5
-rw-r--r--drivers/media/usb/cpia2/cpia2_usb.c3
-rw-r--r--drivers/media/usb/cx231xx/cx231xx-audio.c2
-rw-r--r--drivers/media/usb/go7007/go7007-usb.c3
-rw-r--r--drivers/media/usb/gspca/t613.c2
-rw-r--r--drivers/media/usb/stk1160/stk1160-core.c5
-rw-r--r--drivers/media/usb/tm6000/tm6000-video.c13
-rw-r--r--drivers/media/usb/usbvision/usbvision-video.c3
-rw-r--r--drivers/media/usb/uvc/uvc_video.c4
-rw-r--r--drivers/media/v4l2-core/videobuf-dma-sg.c3
-rw-r--r--drivers/memstick/core/ms_block.c6
-rw-r--r--drivers/message/fusion/mptlan.c7
-rw-r--r--drivers/misc/eeprom/idt_89hpesx.c2
-rw-r--r--drivers/misc/vmw_vmci/vmci_queue_pair.c6
-rw-r--r--drivers/mtd/chips/cfi_cmdset_0001.c4
-rw-r--r--drivers/mtd/chips/cfi_cmdset_0002.c5
-rw-r--r--drivers/mtd/chips/cfi_cmdset_0020.c5
-rw-r--r--drivers/mtd/ftl.c13
-rw-r--r--drivers/mtd/inftlmount.c6
-rw-r--r--drivers/mtd/lpddr/lpddr_cmds.c2
-rw-r--r--drivers/mtd/maps/vmu-flash.c8
-rw-r--r--drivers/mtd/mtdconcat.c5
-rw-r--r--drivers/mtd/mtdswap.c2
-rw-r--r--drivers/mtd/nand/raw/nand_bch.c2
-rw-r--r--drivers/mtd/nftlmount.c7
-rw-r--r--drivers/mtd/sm_ftl.c2
-rw-r--r--drivers/mtd/ssfdc.c5
-rw-r--r--drivers/mtd/tests/stresstest.c2
-rw-r--r--drivers/mtd/ubi/eba.c14
-rw-r--r--drivers/net/ethernet/amd/lance.c8
-rw-r--r--drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c4
-rw-r--r--drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c4
-rw-r--r--drivers/net/ethernet/atheros/atlx/atl2.c4
-rw-r--r--drivers/net/ethernet/broadcom/bnx2.c2
-rw-r--r--drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c4
-rw-r--r--drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c2
-rw-r--r--drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c6
-rw-r--r--drivers/net/ethernet/freescale/ucc_geth.c12
-rw-r--r--drivers/net/ethernet/ibm/ibmveth.c2
-rw-r--r--drivers/net/ethernet/intel/e1000/e1000_ethtool.c4
-rw-r--r--drivers/net/ethernet/intel/e1000e/ethtool.c4
-rw-r--r--drivers/net/ethernet/intel/igb/igb_ethtool.c8
-rw-r--r--drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c5
-rw-r--r--drivers/net/ethernet/intel/ixgb/ixgb_main.c5
-rw-r--r--drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c2
-rw-r--r--drivers/net/ethernet/mellanox/mlx4/cmd.c6
-rw-r--r--drivers/net/ethernet/mellanox/mlx4/eq.c5
-rw-r--r--drivers/net/ethernet/mellanox/mlx4/resource_tracker.c10
-rw-r--r--drivers/net/ethernet/moxa/moxart_ether.c8
-rw-r--r--drivers/net/ethernet/nvidia/forcedeth.c6
-rw-r--r--drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c2
-rw-r--r--drivers/net/ethernet/qlogic/qed/qed_mcp.c6
-rw-r--r--drivers/net/ethernet/qlogic/qlge/qlge_main.c3
-rw-r--r--drivers/net/gtp.c6
-rw-r--r--drivers/net/hippi/rrunner.c2
-rw-r--r--drivers/net/team/team.c3
-rw-r--r--drivers/net/usb/asix_common.c8
-rw-r--r--drivers/net/usb/ax88179_178a.c4
-rw-r--r--drivers/net/usb/usbnet.c4
-rw-r--r--drivers/net/virtio_net.c4
-rw-r--r--drivers/net/wireless/ath/ath5k/phy.c3
-rw-r--r--drivers/net/wireless/ath/ath9k/ar9003_paprd.c2
-rw-r--r--drivers/net/wireless/ath/ath9k/hw.c4
-rw-r--r--drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c8
-rw-r--r--drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c5
-rw-r--r--drivers/net/wireless/cisco/airo.c2
-rw-r--r--drivers/net/wireless/intel/ipw2x00/ipw2100.c11
-rw-r--r--drivers/net/wireless/intel/ipw2x00/ipw2200.c10
-rw-r--r--drivers/net/wireless/intersil/hostap/hostap_info.c5
-rw-r--r--drivers/net/wireless/intersil/hostap/hostap_ioctl.c4
-rw-r--r--drivers/net/wireless/zydas/zd1211rw/zd_mac.c3
-rw-r--r--drivers/pcmcia/cistpl.c4
-rw-r--r--drivers/pinctrl/freescale/pinctrl-imx.c3
-rw-r--r--drivers/pinctrl/freescale/pinctrl-imx1-core.c3
-rw-r--r--drivers/pinctrl/sunxi/pinctrl-sunxi.c2
-rw-r--r--drivers/s390/block/dasd_eer.c4
-rw-r--r--drivers/s390/char/tty3270.c3
-rw-r--r--drivers/s390/crypto/pkey_api.c6
-rw-r--r--drivers/scsi/aacraid/aachba.c2
-rw-r--r--drivers/scsi/aha1542.c3
-rw-r--r--drivers/scsi/aic7xxx/aic79xx_core.c3
-rw-r--r--drivers/scsi/aic94xx/aic94xx_hwi.c7
-rw-r--r--drivers/scsi/arm/queue.c2
-rw-r--r--drivers/scsi/be2iscsi/be_main.c14
-rw-r--r--drivers/scsi/fcoe/fcoe_ctlr.c4
-rw-r--r--drivers/scsi/hpsa.c14
-rw-r--r--drivers/scsi/lpfc/lpfc_mem.c5
-rw-r--r--drivers/scsi/mac53c94.c5
-rw-r--r--drivers/scsi/megaraid.c3
-rw-r--r--drivers/scsi/megaraid/megaraid_mm.c10
-rw-r--r--drivers/scsi/osst.c4
-rw-r--r--drivers/scsi/qla2xxx/qla_nx.c2
-rw-r--r--drivers/scsi/qla4xxx/ql4_nx.c2
-rw-r--r--drivers/scsi/smartpqi/smartpqi_init.c5
-rw-r--r--drivers/scsi/st.c3
-rw-r--r--drivers/scsi/virtio_scsi.c7
-rw-r--r--drivers/soc/fsl/qbman/qman.c2
-rw-r--r--drivers/staging/media/zoran/zoran_driver.c2
-rw-r--r--drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c5
-rw-r--r--drivers/staging/rtl8192u/r8192U_core.c4
-rw-r--r--drivers/tty/hvc/hvcs.c3
-rw-r--r--drivers/tty/isicom.c2
-rw-r--r--drivers/tty/serial/atmel_serial.c5
-rw-r--r--drivers/tty/vt/consolemap.c7
-rw-r--r--drivers/tty/vt/keyboard.c4
-rw-r--r--drivers/tty/vt/selection.c3
-rw-r--r--drivers/usb/core/devio.c7
-rw-r--r--drivers/usb/core/message.c6
-rw-r--r--drivers/usb/host/fhci-tds.c2
-rw-r--r--drivers/usb/host/ohci-dbg.c2
-rw-r--r--drivers/usb/misc/ldusb.c9
-rw-r--r--drivers/usb/serial/iuu_phoenix.c4
-rw-r--r--drivers/usb/storage/alauda.c2
-rw-r--r--drivers/usb/storage/ene_ub6250.c16
-rw-r--r--drivers/usb/storage/sddr09.c4
-rw-r--r--drivers/usb/storage/sddr55.c6
-rw-r--r--drivers/uwb/est.c2
-rw-r--r--drivers/uwb/i1480/dfu/usb.c2
-rw-r--r--drivers/vhost/net.c8
-rw-r--r--drivers/vhost/scsi.c2
-rw-r--r--drivers/vhost/test.c2
-rw-r--r--drivers/vhost/vhost.c11
-rw-r--r--drivers/vhost/vringh.c2
-rw-r--r--drivers/video/fbdev/core/bitblit.c4
-rw-r--r--drivers/video/fbdev/core/fbcon.c3
-rw-r--r--drivers/video/fbdev/core/fbcon_ccw.c7
-rw-r--r--drivers/video/fbdev/core/fbcon_cw.c7
-rw-r--r--drivers/video/fbdev/core/fbcon_rotate.c2
-rw-r--r--drivers/video/fbdev/core/fbcon_ud.c4
-rw-r--r--drivers/video/fbdev/core/fbmem.c7
-rw-r--r--drivers/video/fbdev/core/fbmon.c2
-rw-r--r--drivers/video/fbdev/imxfb.c2
-rw-r--r--drivers/video/fbdev/mb862xx/mb862xxfb_accel.c2
-rw-r--r--drivers/video/fbdev/nvidia/nvidia.c2
-rw-r--r--drivers/video/fbdev/pvr2fb.c2
-rw-r--r--drivers/video/fbdev/riva/fbdev.c2
-rw-r--r--drivers/video/fbdev/via/viafbdev.c3
-rw-r--r--drivers/video/fbdev/w100fb.c3
-rw-r--r--drivers/virt/vboxguest/vboxguest_core.c7
-rw-r--r--drivers/virtio/virtio_pci_common.c5
-rw-r--r--drivers/virtio/virtio_ring.c2
-rw-r--r--drivers/xen/grant-table.c7
-rw-r--r--drivers/xen/xen-pciback/pciback_ops.c2
-rw-r--r--fs/9p/fid.c2
-rw-r--r--fs/adfs/super.c2
-rw-r--r--fs/afs/cmservice.c7
-rw-r--r--fs/binfmt_elf.c2
-rw-r--r--fs/binfmt_elf_fdpic.c3
-rw-r--r--fs/block_dev.c3
-rw-r--r--fs/ceph/addr.c11
-rw-r--r--fs/ceph/mds_client.c5
-rw-r--r--fs/cifs/asn1.c2
-rw-r--r--fs/cifs/cifsacl.c4
-rw-r--r--fs/cifs/inode.c2
-rw-r--r--fs/cifs/smb2pdu.c6
-rw-r--r--fs/cifs/transport.c8
-rw-r--r--fs/exofs/inode.c4
-rw-r--r--fs/ext2/super.c4
-rw-r--r--fs/ext4/resize.c10
-rw-r--r--fs/fat/namei_vfat.c2
-rw-r--r--fs/fuse/dev.c15
-rw-r--r--fs/gfs2/dir.c6
-rw-r--r--fs/gfs2/glock.c3
-rw-r--r--fs/gfs2/quota.c2
-rw-r--r--fs/gfs2/rgrp.c5
-rw-r--r--fs/gfs2/super.c2
-rw-r--r--fs/hpfs/dnode.c3
-rw-r--r--fs/hpfs/map.c2
-rw-r--r--fs/jbd2/revoke.c2
-rw-r--r--fs/jffs2/wbuf.c2
-rw-r--r--fs/jfs/jfs_dmap.c2
-rw-r--r--fs/jfs/jfs_dtree.c9
-rw-r--r--fs/jfs/jfs_unicode.c2
-rw-r--r--fs/mbcache.c5
-rw-r--r--fs/namei.c4
-rw-r--r--fs/nfsd/nfs4recover.c5
-rw-r--r--fs/nfsd/nfs4state.c20
-rw-r--r--fs/ntfs/compress.c2
-rw-r--r--fs/ocfs2/cluster/tcp.c2
-rw-r--r--fs/ocfs2/dlm/dlmdomain.c2
-rw-r--r--fs/proc/base.c3
-rw-r--r--fs/proc/task_mmu.c2
-rw-r--r--fs/read_write.c4
-rw-r--r--fs/reiserfs/journal.c10
-rw-r--r--fs/select.c2
-rw-r--r--fs/splice.c7
-rw-r--r--fs/ubifs/lpt.c16
-rw-r--r--fs/ubifs/super.c3
-rw-r--r--fs/ubifs/tnc.c5
-rw-r--r--fs/ubifs/tnc_commit.c5
-rw-r--r--fs/ufs/super.c4
-rw-r--r--kernel/bpf/lpm_trie.c5
-rw-r--r--kernel/cgroup/cgroup-v1.c2
-rw-r--r--kernel/cgroup/cpuset.c5
-rw-r--r--kernel/debug/kdb/kdb_main.c11
-rw-r--r--kernel/fail_function.c2
-rw-r--r--kernel/locking/locktorture.c8
-rw-r--r--kernel/relay.c3
-rw-r--r--kernel/sched/topology.c2
-rw-r--r--kernel/trace/ftrace.c26
-rw-r--r--kernel/trace/trace.c9
-rw-r--r--kernel/trace/trace_events_filter.c6
-rw-r--r--kernel/user_namespace.c5
-rw-r--r--lib/argv_split.c2
-rw-r--r--lib/interval_tree_test.c5
-rw-r--r--lib/kfifo.c2
-rw-r--r--lib/mpi/mpiutil.c2
-rw-r--r--lib/rbtree_test.c2
-rw-r--r--lib/reed_solomon/reed_solomon.c6
-rw-r--r--lib/scatterlist.c3
-rw-r--r--mm/huge_memory.c4
-rw-r--r--mm/hugetlb.c3
-rw-r--r--mm/slub.c12
-rw-r--r--net/9p/protocol.c11
-rw-r--r--net/9p/trans_virtio.c3
-rw-r--r--net/atm/mpc.c2
-rw-r--r--net/bluetooth/hci_core.c2
-rw-r--r--net/bluetooth/l2cap_core.c2
-rw-r--r--net/can/bcm.c10
-rw-r--r--net/ceph/osdmap.c5
-rw-r--r--net/ceph/pagevec.c4
-rw-r--r--net/core/dev.c2
-rw-r--r--net/core/ethtool.c2
-rw-r--r--net/dcb/dcbnl.c3
-rw-r--r--net/dccp/ccids/ccid2.c3
-rw-r--r--net/ipv4/route.c3
-rw-r--r--net/mac80211/main.c2
-rw-r--r--net/mac80211/rc80211_minstrel.c2
-rw-r--r--net/mac80211/rc80211_minstrel_ht.c2
-rw-r--r--net/netfilter/nf_conntrack_proto.c3
-rw-r--r--net/netfilter/nf_nat_core.c5
-rw-r--r--net/netfilter/nf_tables_api.c4
-rw-r--r--net/netfilter/x_tables.c2
-rw-r--r--net/netlink/genetlink.c10
-rw-r--r--net/openvswitch/datapath.c5
-rw-r--r--net/rds/info.c2
-rw-r--r--net/rxrpc/rxkad.c2
-rw-r--r--net/sctp/protocol.c2
-rw-r--r--net/sunrpc/auth_gss/auth_gss.c3
-rw-r--r--net/tipc/netlink_compat.c5
-rw-r--r--security/keys/trusted.c2
-rw-r--r--sound/core/pcm_compat.c2
-rw-r--r--sound/core/pcm_native.c4
-rw-r--r--sound/core/seq/seq_midi_emul.c2
-rw-r--r--sound/firewire/packets-buffer.c2
-rw-r--r--sound/oss/dmasound/dmasound_core.c2
-rw-r--r--sound/pci/cs46xx/cs46xx_lib.c7
-rw-r--r--sound/pci/cs46xx/dsp_spos.c4
-rw-r--r--sound/pci/emu10k1/emufx.c6
-rw-r--r--sound/pci/hda/hda_codec.c4
-rw-r--r--sound/pci/hda/hda_proc.c5
-rw-r--r--sound/pci/via82xx.c4
-rw-r--r--sound/pci/via82xx_modem.c4
-rw-r--r--sound/pci/ymfpci/ymfpci_main.c4
-rw-r--r--sound/soc/codecs/wm8904.c5
-rw-r--r--sound/soc/codecs/wm8958-dsp2.c20
-rw-r--r--sound/usb/caiaq/audio.c7
-rw-r--r--sound/usb/format.c5
-rw-r--r--sound/usb/line6/pcm.c6
-rw-r--r--sound/usb/mixer.c2
-rw-r--r--sound/usb/pcm.c2
-rw-r--r--sound/usb/usx2y/usbusx2y.c4
-rw-r--r--sound/usb/usx2y/usbusx2yaudio.c7
377 files changed, 1014 insertions, 748 deletions
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index b9786f491873..1df21a61e379 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -286,7 +286,7 @@ asmlinkage long sys_oabi_epoll_wait(int epfd,
286 return -EINVAL; 286 return -EINVAL;
287 if (!access_ok(VERIFY_WRITE, events, sizeof(*events) * maxevents)) 287 if (!access_ok(VERIFY_WRITE, events, sizeof(*events) * maxevents))
288 return -EFAULT; 288 return -EFAULT;
289 kbuf = kmalloc(sizeof(*kbuf) * maxevents, GFP_KERNEL); 289 kbuf = kmalloc_array(maxevents, sizeof(*kbuf), GFP_KERNEL);
290 if (!kbuf) 290 if (!kbuf)
291 return -ENOMEM; 291 return -ENOMEM;
292 fs = get_fs(); 292 fs = get_fs();
@@ -324,7 +324,7 @@ asmlinkage long sys_oabi_semtimedop(int semid,
324 return -EINVAL; 324 return -EINVAL;
325 if (!access_ok(VERIFY_READ, tsops, sizeof(*tsops) * nsops)) 325 if (!access_ok(VERIFY_READ, tsops, sizeof(*tsops) * nsops))
326 return -EFAULT; 326 return -EFAULT;
327 sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL); 327 sops = kmalloc_array(nsops, sizeof(*sops), GFP_KERNEL);
328 if (!sops) 328 if (!sops)
329 return -ENOMEM; 329 return -ENOMEM;
330 err = 0; 330 err = 0;
diff --git a/arch/arm/mm/pgd.c b/arch/arm/mm/pgd.c
index 61e281cb29fb..a1606d950251 100644
--- a/arch/arm/mm/pgd.c
+++ b/arch/arm/mm/pgd.c
@@ -20,7 +20,7 @@
20#include "mm.h" 20#include "mm.h"
21 21
22#ifdef CONFIG_ARM_LPAE 22#ifdef CONFIG_ARM_LPAE
23#define __pgd_alloc() kmalloc(PTRS_PER_PGD * sizeof(pgd_t), GFP_KERNEL) 23#define __pgd_alloc() kmalloc_array(PTRS_PER_PGD, sizeof(pgd_t), GFP_KERNEL)
24#define __pgd_free(pgd) kfree(pgd) 24#define __pgd_free(pgd) kfree(pgd)
25#else 25#else
26#define __pgd_alloc() (pgd_t *)__get_free_pages(GFP_KERNEL, 2) 26#define __pgd_alloc() (pgd_t *)__get_free_pages(GFP_KERNEL, 2)
diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c
index 9ed0129bed3c..14db14152909 100644
--- a/arch/arm/probes/kprobes/test-core.c
+++ b/arch/arm/probes/kprobes/test-core.c
@@ -766,8 +766,9 @@ static int coverage_start_fn(const struct decode_header *h, void *args)
766 766
767static int coverage_start(const union decode_item *table) 767static int coverage_start(const union decode_item *table)
768{ 768{
769 coverage.base = kmalloc(MAX_COVERAGE_ENTRIES * 769 coverage.base = kmalloc_array(MAX_COVERAGE_ENTRIES,
770 sizeof(struct coverage_entry), GFP_KERNEL); 770 sizeof(struct coverage_entry),
771 GFP_KERNEL);
771 coverage.num_entries = 0; 772 coverage.num_entries = 0;
772 coverage.nesting = 0; 773 coverage.nesting = 0;
773 return table_iter(table, coverage_start_fn, &coverage); 774 return table_iter(table, coverage_start_fn, &coverage);
diff --git a/arch/ia64/kernel/mca_drv.c b/arch/ia64/kernel/mca_drv.c
index 94f8bf777afa..dfe40cbdf3b3 100644
--- a/arch/ia64/kernel/mca_drv.c
+++ b/arch/ia64/kernel/mca_drv.c
@@ -350,7 +350,8 @@ init_record_index_pools(void)
350 /* - 3 - */ 350 /* - 3 - */
351 slidx_pool.max_idx = (rec_max_size/sect_min_size) * 2 + 1; 351 slidx_pool.max_idx = (rec_max_size/sect_min_size) * 2 + 1;
352 slidx_pool.buffer = 352 slidx_pool.buffer =
353 kmalloc(slidx_pool.max_idx * sizeof(slidx_list_t), GFP_KERNEL); 353 kmalloc_array(slidx_pool.max_idx, sizeof(slidx_list_t),
354 GFP_KERNEL);
354 355
355 return slidx_pool.buffer ? 0 : -ENOMEM; 356 return slidx_pool.buffer ? 0 : -ENOMEM;
356} 357}
diff --git a/arch/ia64/mm/tlb.c b/arch/ia64/mm/tlb.c
index 46ecc5d948aa..acf10eb9da15 100644
--- a/arch/ia64/mm/tlb.c
+++ b/arch/ia64/mm/tlb.c
@@ -430,8 +430,9 @@ int ia64_itr_entry(u64 target_mask, u64 va, u64 pte, u64 log_size)
430 int cpu = smp_processor_id(); 430 int cpu = smp_processor_id();
431 431
432 if (!ia64_idtrs[cpu]) { 432 if (!ia64_idtrs[cpu]) {
433 ia64_idtrs[cpu] = kmalloc(2 * IA64_TR_ALLOC_MAX * 433 ia64_idtrs[cpu] = kmalloc_array(2 * IA64_TR_ALLOC_MAX,
434 sizeof (struct ia64_tr_entry), GFP_KERNEL); 434 sizeof(struct ia64_tr_entry),
435 GFP_KERNEL);
435 if (!ia64_idtrs[cpu]) 436 if (!ia64_idtrs[cpu])
436 return -ENOMEM; 437 return -ENOMEM;
437 } 438 }
diff --git a/arch/ia64/sn/kernel/irq.c b/arch/ia64/sn/kernel/irq.c
index 85d095154902..d9b576df4f82 100644
--- a/arch/ia64/sn/kernel/irq.c
+++ b/arch/ia64/sn/kernel/irq.c
@@ -474,7 +474,8 @@ void __init sn_irq_lh_init(void)
474{ 474{
475 int i; 475 int i;
476 476
477 sn_irq_lh = kmalloc(sizeof(struct list_head *) * NR_IRQS, GFP_KERNEL); 477 sn_irq_lh = kmalloc_array(NR_IRQS, sizeof(struct list_head *),
478 GFP_KERNEL);
478 if (!sn_irq_lh) 479 if (!sn_irq_lh)
479 panic("SN PCI INIT: Failed to allocate memory for PCI init\n"); 480 panic("SN PCI INIT: Failed to allocate memory for PCI init\n");
480 481
diff --git a/arch/mips/alchemy/common/dbdma.c b/arch/mips/alchemy/common/dbdma.c
index fc482d900ddd..24b04758cce5 100644
--- a/arch/mips/alchemy/common/dbdma.c
+++ b/arch/mips/alchemy/common/dbdma.c
@@ -411,8 +411,8 @@ u32 au1xxx_dbdma_ring_alloc(u32 chanid, int entries)
411 * and if we try that first we are likely to not waste larger 411 * and if we try that first we are likely to not waste larger
412 * slabs of memory. 412 * slabs of memory.
413 */ 413 */
414 desc_base = (u32)kmalloc(entries * sizeof(au1x_ddma_desc_t), 414 desc_base = (u32)kmalloc_array(entries, sizeof(au1x_ddma_desc_t),
415 GFP_KERNEL|GFP_DMA); 415 GFP_KERNEL|GFP_DMA);
416 if (desc_base == 0) 416 if (desc_base == 0)
417 return 0; 417 return 0;
418 418
diff --git a/arch/powerpc/lib/rheap.c b/arch/powerpc/lib/rheap.c
index 94058c21a482..6aa774aa5b16 100644
--- a/arch/powerpc/lib/rheap.c
+++ b/arch/powerpc/lib/rheap.c
@@ -54,7 +54,7 @@ static int grow(rh_info_t * info, int max_blocks)
54 54
55 new_blocks = max_blocks - info->max_blocks; 55 new_blocks = max_blocks - info->max_blocks;
56 56
57 block = kmalloc(sizeof(rh_block_t) * max_blocks, GFP_ATOMIC); 57 block = kmalloc_array(max_blocks, sizeof(rh_block_t), GFP_ATOMIC);
58 if (block == NULL) 58 if (block == NULL)
59 return -ENOMEM; 59 return -ENOMEM;
60 60
diff --git a/arch/powerpc/platforms/4xx/hsta_msi.c b/arch/powerpc/platforms/4xx/hsta_msi.c
index 9926ad67af76..1c18f2955f7d 100644
--- a/arch/powerpc/platforms/4xx/hsta_msi.c
+++ b/arch/powerpc/platforms/4xx/hsta_msi.c
@@ -156,7 +156,8 @@ static int hsta_msi_probe(struct platform_device *pdev)
156 if (ret) 156 if (ret)
157 goto out; 157 goto out;
158 158
159 ppc4xx_hsta_msi.irq_map = kmalloc(sizeof(int) * irq_count, GFP_KERNEL); 159 ppc4xx_hsta_msi.irq_map = kmalloc_array(irq_count, sizeof(int),
160 GFP_KERNEL);
160 if (!ppc4xx_hsta_msi.irq_map) { 161 if (!ppc4xx_hsta_msi.irq_map) {
161 ret = -ENOMEM; 162 ret = -ENOMEM;
162 goto out1; 163 goto out1;
diff --git a/arch/powerpc/platforms/4xx/msi.c b/arch/powerpc/platforms/4xx/msi.c
index 96aaae678928..81b2cbce7df8 100644
--- a/arch/powerpc/platforms/4xx/msi.c
+++ b/arch/powerpc/platforms/4xx/msi.c
@@ -89,7 +89,7 @@ static int ppc4xx_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
89 if (type == PCI_CAP_ID_MSIX) 89 if (type == PCI_CAP_ID_MSIX)
90 pr_debug("ppc4xx msi: MSI-X untested, trying anyway.\n"); 90 pr_debug("ppc4xx msi: MSI-X untested, trying anyway.\n");
91 91
92 msi_data->msi_virqs = kmalloc((msi_irqs) * sizeof(int), GFP_KERNEL); 92 msi_data->msi_virqs = kmalloc_array(msi_irqs, sizeof(int), GFP_KERNEL);
93 if (!msi_data->msi_virqs) 93 if (!msi_data->msi_virqs)
94 return -ENOMEM; 94 return -ENOMEM;
95 95
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 1d4e0ef658d3..df062a154ca8 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -1639,8 +1639,9 @@ void __init mpic_init(struct mpic *mpic)
1639 1639
1640#ifdef CONFIG_PM 1640#ifdef CONFIG_PM
1641 /* allocate memory to save mpic state */ 1641 /* allocate memory to save mpic state */
1642 mpic->save_data = kmalloc(mpic->num_sources * sizeof(*mpic->save_data), 1642 mpic->save_data = kmalloc_array(mpic->num_sources,
1643 GFP_KERNEL); 1643 sizeof(*mpic->save_data),
1644 GFP_KERNEL);
1644 BUG_ON(mpic->save_data == NULL); 1645 BUG_ON(mpic->save_data == NULL);
1645#endif 1646#endif
1646 1647
diff --git a/arch/s390/hypfs/hypfs_diag0c.c b/arch/s390/hypfs/hypfs_diag0c.c
index dce87f1bec94..cebf05150cc1 100644
--- a/arch/s390/hypfs/hypfs_diag0c.c
+++ b/arch/s390/hypfs/hypfs_diag0c.c
@@ -49,7 +49,8 @@ static void *diag0c_store(unsigned int *count)
49 49
50 get_online_cpus(); 50 get_online_cpus();
51 cpu_count = num_online_cpus(); 51 cpu_count = num_online_cpus();
52 cpu_vec = kmalloc(sizeof(*cpu_vec) * num_possible_cpus(), GFP_KERNEL); 52 cpu_vec = kmalloc_array(num_possible_cpus(), sizeof(*cpu_vec),
53 GFP_KERNEL);
53 if (!cpu_vec) 54 if (!cpu_vec)
54 goto fail_put_online_cpus; 55 goto fail_put_online_cpus;
55 /* Note: Diag 0c needs 8 byte alignment and real storage */ 56 /* Note: Diag 0c needs 8 byte alignment and real storage */
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index 80e974adb9e8..d374f9b218b4 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -194,11 +194,13 @@ static debug_entry_t ***debug_areas_alloc(int pages_per_area, int nr_areas)
194 debug_entry_t ***areas; 194 debug_entry_t ***areas;
195 int i, j; 195 int i, j;
196 196
197 areas = kmalloc(nr_areas * sizeof(debug_entry_t **), GFP_KERNEL); 197 areas = kmalloc_array(nr_areas, sizeof(debug_entry_t **), GFP_KERNEL);
198 if (!areas) 198 if (!areas)
199 goto fail_malloc_areas; 199 goto fail_malloc_areas;
200 for (i = 0; i < nr_areas; i++) { 200 for (i = 0; i < nr_areas; i++) {
201 areas[i] = kmalloc(pages_per_area * sizeof(debug_entry_t *), GFP_KERNEL); 201 areas[i] = kmalloc_array(pages_per_area,
202 sizeof(debug_entry_t *),
203 GFP_KERNEL);
202 if (!areas[i]) 204 if (!areas[i])
203 goto fail_malloc_areas2; 205 goto fail_malloc_areas2;
204 for (j = 0; j < pages_per_area; j++) { 206 for (j = 0; j < pages_per_area; j++) {
diff --git a/arch/s390/kernel/perf_cpum_cf_events.c b/arch/s390/kernel/perf_cpum_cf_events.c
index feebb2944882..d63fb3c56b8a 100644
--- a/arch/s390/kernel/perf_cpum_cf_events.c
+++ b/arch/s390/kernel/perf_cpum_cf_events.c
@@ -527,7 +527,7 @@ static __init struct attribute **merge_attr(struct attribute **a,
527 j++; 527 j++;
528 j++; 528 j++;
529 529
530 new = kmalloc(sizeof(struct attribute *) * j, GFP_KERNEL); 530 new = kmalloc_array(j, sizeof(struct attribute *), GFP_KERNEL);
531 if (!new) 531 if (!new)
532 return NULL; 532 return NULL;
533 j = 0; 533 j = 0;
diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c
index 920d40894535..6ad15d3fab81 100644
--- a/arch/s390/mm/extmem.c
+++ b/arch/s390/mm/extmem.c
@@ -103,7 +103,7 @@ static int scode_set;
103static int 103static int
104dcss_set_subcodes(void) 104dcss_set_subcodes(void)
105{ 105{
106 char *name = kmalloc(8 * sizeof(char), GFP_KERNEL | GFP_DMA); 106 char *name = kmalloc(8, GFP_KERNEL | GFP_DMA);
107 unsigned long rx, ry; 107 unsigned long rx, ry;
108 int rc; 108 int rc;
109 109
diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
index 048ad783ea3f..8babbeb30adf 100644
--- a/arch/sparc/kernel/nmi.c
+++ b/arch/sparc/kernel/nmi.c
@@ -166,7 +166,8 @@ static int __init check_nmi_watchdog(void)
166 if (!atomic_read(&nmi_active)) 166 if (!atomic_read(&nmi_active))
167 return 0; 167 return 0;
168 168
169 prev_nmi_count = kmalloc(nr_cpu_ids * sizeof(unsigned int), GFP_KERNEL); 169 prev_nmi_count = kmalloc_array(nr_cpu_ids, sizeof(unsigned int),
170 GFP_KERNEL);
170 if (!prev_nmi_count) { 171 if (!prev_nmi_count) {
171 err = -ENOMEM; 172 err = -ENOMEM;
172 goto error; 173 goto error;
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index 7e49bbc925a5..33e351704f9f 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -575,8 +575,9 @@ SYSCALL_DEFINE5(utrap_install, utrap_entry_t, type,
575 unsigned long *p = current_thread_info()->utraps; 575 unsigned long *p = current_thread_info()->utraps;
576 576
577 current_thread_info()->utraps = 577 current_thread_info()->utraps =
578 kmalloc((UT_TRAP_INSTRUCTION_31+1)*sizeof(long), 578 kmalloc_array(UT_TRAP_INSTRUCTION_31 + 1,
579 GFP_KERNEL); 579 sizeof(long),
580 GFP_KERNEL);
580 if (!current_thread_info()->utraps) { 581 if (!current_thread_info()->utraps) {
581 current_thread_info()->utraps = p; 582 current_thread_info()->utraps = p;
582 return -ENOMEM; 583 return -ENOMEM;
diff --git a/arch/sparc/net/bpf_jit_comp_32.c b/arch/sparc/net/bpf_jit_comp_32.c
index 3bd8ca95e521..a5ff88643d5c 100644
--- a/arch/sparc/net/bpf_jit_comp_32.c
+++ b/arch/sparc/net/bpf_jit_comp_32.c
@@ -335,7 +335,7 @@ void bpf_jit_compile(struct bpf_prog *fp)
335 if (!bpf_jit_enable) 335 if (!bpf_jit_enable)
336 return; 336 return;
337 337
338 addrs = kmalloc(flen * sizeof(*addrs), GFP_KERNEL); 338 addrs = kmalloc_array(flen, sizeof(*addrs), GFP_KERNEL);
339 if (addrs == NULL) 339 if (addrs == NULL)
340 return; 340 return;
341 341
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index dcf5ea28a281..83c470364dfb 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -1127,9 +1127,9 @@ static int __init ubd_init(void)
1127 return -1; 1127 return -1;
1128 } 1128 }
1129 1129
1130 irq_req_buffer = kmalloc( 1130 irq_req_buffer = kmalloc_array(UBD_REQ_BUFFER_SIZE,
1131 sizeof(struct io_thread_req *) * UBD_REQ_BUFFER_SIZE, 1131 sizeof(struct io_thread_req *),
1132 GFP_KERNEL 1132 GFP_KERNEL
1133 ); 1133 );
1134 irq_remainder = 0; 1134 irq_remainder = 0;
1135 1135
@@ -1137,9 +1137,9 @@ static int __init ubd_init(void)
1137 printk(KERN_ERR "Failed to initialize ubd buffering\n"); 1137 printk(KERN_ERR "Failed to initialize ubd buffering\n");
1138 return -1; 1138 return -1;
1139 } 1139 }
1140 io_req_buffer = kmalloc( 1140 io_req_buffer = kmalloc_array(UBD_REQ_BUFFER_SIZE,
1141 sizeof(struct io_thread_req *) * UBD_REQ_BUFFER_SIZE, 1141 sizeof(struct io_thread_req *),
1142 GFP_KERNEL 1142 GFP_KERNEL
1143 ); 1143 );
1144 1144
1145 io_remainder = 0; 1145 io_remainder = 0;
diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
index 02168fe25105..627075e6d875 100644
--- a/arch/um/drivers/vector_kern.c
+++ b/arch/um/drivers/vector_kern.c
@@ -527,14 +527,14 @@ static struct vector_queue *create_queue(
527 result->max_iov_frags = num_extra_frags; 527 result->max_iov_frags = num_extra_frags;
528 for (i = 0; i < max_size; i++) { 528 for (i = 0; i < max_size; i++) {
529 if (vp->header_size > 0) 529 if (vp->header_size > 0)
530 iov = kmalloc( 530 iov = kmalloc_array(3 + num_extra_frags,
531 sizeof(struct iovec) * (3 + num_extra_frags), 531 sizeof(struct iovec),
532 GFP_KERNEL 532 GFP_KERNEL
533 ); 533 );
534 else 534 else
535 iov = kmalloc( 535 iov = kmalloc_array(2 + num_extra_frags,
536 sizeof(struct iovec) * (2 + num_extra_frags), 536 sizeof(struct iovec),
537 GFP_KERNEL 537 GFP_KERNEL
538 ); 538 );
539 if (iov == NULL) 539 if (iov == NULL)
540 goto out_fail; 540 goto out_fail;
diff --git a/arch/unicore32/kernel/pm.c b/arch/unicore32/kernel/pm.c
index 784bc2db3b28..6f8164d91dc2 100644
--- a/arch/unicore32/kernel/pm.c
+++ b/arch/unicore32/kernel/pm.c
@@ -109,8 +109,9 @@ static int __init puv3_pm_init(void)
109 return -EINVAL; 109 return -EINVAL;
110 } 110 }
111 111
112 sleep_save = kmalloc(puv3_cpu_pm_fns->save_count 112 sleep_save = kmalloc_array(puv3_cpu_pm_fns->save_count,
113 * sizeof(unsigned long), GFP_KERNEL); 113 sizeof(unsigned long),
114 GFP_KERNEL);
114 if (!sleep_save) { 115 if (!sleep_save) {
115 printk(KERN_ERR "failed to alloc memory for pm save\n"); 116 printk(KERN_ERR "failed to alloc memory for pm save\n");
116 return -ENOMEM; 117 return -ENOMEM;
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 6e461fb1e0d4..5f4829f10129 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -1637,7 +1637,7 @@ __init struct attribute **merge_attr(struct attribute **a, struct attribute **b)
1637 j++; 1637 j++;
1638 j++; 1638 j++;
1639 1639
1640 new = kmalloc(sizeof(struct attribute *) * j, GFP_KERNEL); 1640 new = kmalloc_array(j, sizeof(struct attribute *), GFP_KERNEL);
1641 if (!new) 1641 if (!new)
1642 return NULL; 1642 return NULL;
1643 1643
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index b6be34ee88e9..ddccdea0b63b 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -966,8 +966,8 @@ int __init hpet_enable(void)
966#endif 966#endif
967 967
968 cfg = hpet_readl(HPET_CFG); 968 cfg = hpet_readl(HPET_CFG);
969 hpet_boot_cfg = kmalloc((last + 2) * sizeof(*hpet_boot_cfg), 969 hpet_boot_cfg = kmalloc_array(last + 2, sizeof(*hpet_boot_cfg),
970 GFP_KERNEL); 970 GFP_KERNEL);
971 if (hpet_boot_cfg) 971 if (hpet_boot_cfg)
972 *hpet_boot_cfg = cfg; 972 *hpet_boot_cfg = cfg;
973 else 973 else
diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c
index 8c1cc08f514f..163ae706a0d4 100644
--- a/arch/x86/kernel/ksysfs.c
+++ b/arch/x86/kernel/ksysfs.c
@@ -283,7 +283,7 @@ static int __init create_setup_data_nodes(struct kobject *parent)
283 if (ret) 283 if (ret)
284 goto out_setup_data_kobj; 284 goto out_setup_data_kobj;
285 285
286 kobjp = kmalloc(sizeof(*kobjp) * nr, GFP_KERNEL); 286 kobjp = kmalloc_array(nr, sizeof(*kobjp), GFP_KERNEL);
287 if (!kobjp) { 287 if (!kobjp) {
288 ret = -ENOMEM; 288 ret = -ENOMEM;
289 goto out_setup_data_kobj; 289 goto out_setup_data_kobj;
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 950ec50f77c3..e831e6d3b70e 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1001,7 +1001,9 @@ static int svm_cpu_init(int cpu)
1001 1001
1002 if (svm_sev_enabled()) { 1002 if (svm_sev_enabled()) {
1003 r = -ENOMEM; 1003 r = -ENOMEM;
1004 sd->sev_vmcbs = kmalloc((max_sev_asid + 1) * sizeof(void *), GFP_KERNEL); 1004 sd->sev_vmcbs = kmalloc_array(max_sev_asid + 1,
1005 sizeof(void *),
1006 GFP_KERNEL);
1005 if (!sd->sev_vmcbs) 1007 if (!sd->sev_vmcbs)
1006 goto err_1; 1008 goto err_1;
1007 } 1009 }
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 8fca446aaef6..2580cd2e98b1 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1107,7 +1107,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
1107 extra_pass = true; 1107 extra_pass = true;
1108 goto skip_init_addrs; 1108 goto skip_init_addrs;
1109 } 1109 }
1110 addrs = kmalloc(prog->len * sizeof(*addrs), GFP_KERNEL); 1110 addrs = kmalloc_array(prog->len, sizeof(*addrs), GFP_KERNEL);
1111 if (!addrs) { 1111 if (!addrs) {
1112 prog = orig_prog; 1112 prog = orig_prog;
1113 goto out_addrs; 1113 goto out_addrs;
diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
index 0cc04e30adc1..55799873ebe5 100644
--- a/arch/x86/net/bpf_jit_comp32.c
+++ b/arch/x86/net/bpf_jit_comp32.c
@@ -2345,7 +2345,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
2345 prog = tmp; 2345 prog = tmp;
2346 } 2346 }
2347 2347
2348 addrs = kmalloc(prog->len * sizeof(*addrs), GFP_KERNEL); 2348 addrs = kmalloc_array(prog->len, sizeof(*addrs), GFP_KERNEL);
2349 if (!addrs) { 2349 if (!addrs) {
2350 prog = orig_prog; 2350 prog = orig_prog;
2351 goto out; 2351 goto out;
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index b96d38288c60..ca446da48fd2 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -2142,7 +2142,7 @@ static int __init init_per_cpu(int nuvhubs, int base_part_pnode)
2142 if (is_uv3_hub() || is_uv2_hub() || is_uv1_hub()) 2142 if (is_uv3_hub() || is_uv2_hub() || is_uv1_hub())
2143 timeout_us = calculate_destination_timeout(); 2143 timeout_us = calculate_destination_timeout();
2144 2144
2145 vp = kmalloc(nuvhubs * sizeof(struct uvhub_desc), GFP_KERNEL); 2145 vp = kmalloc_array(nuvhubs, sizeof(struct uvhub_desc), GFP_KERNEL);
2146 uvhub_descs = (struct uvhub_desc *)vp; 2146 uvhub_descs = (struct uvhub_desc *)vp;
2147 memset(uvhub_descs, 0, nuvhubs * sizeof(struct uvhub_desc)); 2147 memset(uvhub_descs, 0, nuvhubs * sizeof(struct uvhub_desc));
2148 uvhub_mask = kzalloc((nuvhubs+7)/8, GFP_KERNEL); 2148 uvhub_mask = kzalloc((nuvhubs+7)/8, GFP_KERNEL);
diff --git a/block/partitions/ldm.c b/block/partitions/ldm.c
index 2a365c756648..0417937dfe99 100644
--- a/block/partitions/ldm.c
+++ b/block/partitions/ldm.c
@@ -378,7 +378,7 @@ static bool ldm_validate_tocblocks(struct parsed_partitions *state,
378 BUG_ON(!state || !ldb); 378 BUG_ON(!state || !ldb);
379 ph = &ldb->ph; 379 ph = &ldb->ph;
380 tb[0] = &ldb->toc; 380 tb[0] = &ldb->toc;
381 tb[1] = kmalloc(sizeof(*tb[1]) * 3, GFP_KERNEL); 381 tb[1] = kmalloc_array(3, sizeof(*tb[1]), GFP_KERNEL);
382 if (!tb[1]) { 382 if (!tb[1]) {
383 ldm_crit("Out of memory."); 383 ldm_crit("Out of memory.");
384 goto err; 384 goto err;
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index d1d99843cce4..11e45352fd0b 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -603,7 +603,8 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
603 goto out_nooutbuf; 603 goto out_nooutbuf;
604 604
605 /* avoid "the frame size is larger than 1024 bytes" compiler warning */ 605 /* avoid "the frame size is larger than 1024 bytes" compiler warning */
606 sg = kmalloc(sizeof(*sg) * 8 * (diff_dst ? 4 : 2), GFP_KERNEL); 606 sg = kmalloc(array3_size(sizeof(*sg), 8, (diff_dst ? 4 : 2)),
607 GFP_KERNEL);
607 if (!sg) 608 if (!sg)
608 goto out_nosg; 609 goto out_nosg;
609 sgout = &sg[16]; 610 sgout = &sg[16];
diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index 2f2e737be0f8..f0b52266b3ac 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -832,8 +832,9 @@ int acpi_video_get_levels(struct acpi_device *device,
832 * in order to account for buggy BIOS which don't export the first two 832 * in order to account for buggy BIOS which don't export the first two
833 * special levels (see below) 833 * special levels (see below)
834 */ 834 */
835 br->levels = kmalloc((obj->package.count + ACPI_VIDEO_FIRST_LEVEL) * 835 br->levels = kmalloc_array(obj->package.count + ACPI_VIDEO_FIRST_LEVEL,
836 sizeof(*br->levels), GFP_KERNEL); 836 sizeof(*br->levels),
837 GFP_KERNEL);
837 if (!br->levels) { 838 if (!br->levels) {
838 result = -ENOMEM; 839 result = -ENOMEM;
839 goto out_free; 840 goto out_free;
diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
index 9cb74115a43d..b1e9f81ebeea 100644
--- a/drivers/acpi/apei/hest.c
+++ b/drivers/acpi/apei/hest.c
@@ -195,7 +195,8 @@ static int __init hest_ghes_dev_register(unsigned int ghes_count)
195 struct ghes_arr ghes_arr; 195 struct ghes_arr ghes_arr;
196 196
197 ghes_arr.count = 0; 197 ghes_arr.count = 0;
198 ghes_arr.ghes_devs = kmalloc(sizeof(void *) * ghes_count, GFP_KERNEL); 198 ghes_arr.ghes_devs = kmalloc_array(ghes_count, sizeof(void *),
199 GFP_KERNEL);
199 if (!ghes_arr.ghes_devs) 200 if (!ghes_arr.ghes_devs)
200 return -ENOMEM; 201 return -ENOMEM;
201 202
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index a651ab3490d8..a303fd0e108c 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -343,8 +343,9 @@ static int acpi_processor_get_performance_states(struct acpi_processor *pr)
343 343
344 pr->performance->state_count = pss->package.count; 344 pr->performance->state_count = pss->package.count;
345 pr->performance->states = 345 pr->performance->states =
346 kmalloc(sizeof(struct acpi_processor_px) * pss->package.count, 346 kmalloc_array(pss->package.count,
347 GFP_KERNEL); 347 sizeof(struct acpi_processor_px),
348 GFP_KERNEL);
348 if (!pr->performance->states) { 349 if (!pr->performance->states) {
349 result = -ENOMEM; 350 result = -ENOMEM;
350 goto end; 351 goto end;
diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
index 7f9aff4b8d62..fbc936cf2025 100644
--- a/drivers/acpi/processor_throttling.c
+++ b/drivers/acpi/processor_throttling.c
@@ -534,8 +534,9 @@ static int acpi_processor_get_throttling_states(struct acpi_processor *pr)
534 534
535 pr->throttling.state_count = tss->package.count; 535 pr->throttling.state_count = tss->package.count;
536 pr->throttling.states_tss = 536 pr->throttling.states_tss =
537 kmalloc(sizeof(struct acpi_processor_tx_tss) * tss->package.count, 537 kmalloc_array(tss->package.count,
538 GFP_KERNEL); 538 sizeof(struct acpi_processor_tx_tss),
539 GFP_KERNEL);
539 if (!pr->throttling.states_tss) { 540 if (!pr->throttling.states_tss) {
540 result = -ENOMEM; 541 result = -ENOMEM;
541 goto end; 542 goto end;
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 0df1a1c80b00..17283018269f 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1291,7 +1291,8 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
1291 card->using_dma = 1; 1291 card->using_dma = 1;
1292 if (1) { /* All known FPGA versions so far */ 1292 if (1) { /* All known FPGA versions so far */
1293 card->dma_alignment = 3; 1293 card->dma_alignment = 3;
1294 card->dma_bounce = kmalloc(card->nr_ports * BUF_SIZE, GFP_KERNEL); 1294 card->dma_bounce = kmalloc_array(card->nr_ports,
1295 BUF_SIZE, GFP_KERNEL);
1295 if (!card->dma_bounce) { 1296 if (!card->dma_bounce) {
1296 dev_warn(&card->dev->dev, "Failed to allocate DMA bounce buffers\n"); 1297 dev_warn(&card->dev->dev, "Failed to allocate DMA bounce buffers\n");
1297 err = -ENOMEM; 1298 err = -ENOMEM;
diff --git a/drivers/auxdisplay/cfag12864b.c b/drivers/auxdisplay/cfag12864b.c
index 6bd2f65e116a..7eebae7e322c 100644
--- a/drivers/auxdisplay/cfag12864b.c
+++ b/drivers/auxdisplay/cfag12864b.c
@@ -333,8 +333,8 @@ static int __init cfag12864b_init(void)
333 goto none; 333 goto none;
334 } 334 }
335 335
336 cfag12864b_cache = kmalloc(sizeof(unsigned char) * 336 cfag12864b_cache = kmalloc(CFAG12864B_SIZE,
337 CFAG12864B_SIZE, GFP_KERNEL); 337 GFP_KERNEL);
338 if (cfag12864b_cache == NULL) { 338 if (cfag12864b_cache == NULL) {
339 printk(KERN_ERR CFAG12864B_NAME ": ERROR: " 339 printk(KERN_ERR CFAG12864B_NAME ": ERROR: "
340 "can't alloc cache buffer (%i bytes)\n", 340 "can't alloc cache buffer (%i bytes)\n",
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 6ca77d6047d6..f6518067aa7d 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -5719,8 +5719,8 @@ static bool DAC960_CheckStatusBuffer(DAC960_Controller_T *Controller,
5719 Controller->CombinedStatusBufferLength = NewStatusBufferLength; 5719 Controller->CombinedStatusBufferLength = NewStatusBufferLength;
5720 return true; 5720 return true;
5721 } 5721 }
5722 NewStatusBuffer = kmalloc(2 * Controller->CombinedStatusBufferLength, 5722 NewStatusBuffer = kmalloc_array(2, Controller->CombinedStatusBufferLength,
5723 GFP_ATOMIC); 5723 GFP_ATOMIC);
5724 if (NewStatusBuffer == NULL) 5724 if (NewStatusBuffer == NULL)
5725 { 5725 {
5726 DAC960_Warning("Unable to expand Combined Status Buffer - Truncating\n", 5726 DAC960_Warning("Unable to expand Combined Status Buffer - Truncating\n",
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 21e6d1b3b393..d6b6f434fd4b 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -524,7 +524,8 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
524 524
525 __rq_for_each_bio(bio, rq) 525 __rq_for_each_bio(bio, rq)
526 segments += bio_segments(bio); 526 segments += bio_segments(bio);
527 bvec = kmalloc(sizeof(struct bio_vec) * segments, GFP_NOIO); 527 bvec = kmalloc_array(segments, sizeof(struct bio_vec),
528 GFP_NOIO);
528 if (!bvec) 529 if (!bvec)
529 return -EIO; 530 return -EIO;
530 cmd->bvec = bvec; 531 cmd->bvec = bvec;
diff --git a/drivers/block/z2ram.c b/drivers/block/z2ram.c
index 8f9130ab5887..d0c5bc4e0703 100644
--- a/drivers/block/z2ram.c
+++ b/drivers/block/z2ram.c
@@ -197,8 +197,9 @@ static int z2_open(struct block_device *bdev, fmode_t mode)
197 vaddr = (unsigned long)z_remap_nocache_nonser(paddr, size); 197 vaddr = (unsigned long)z_remap_nocache_nonser(paddr, size);
198#endif 198#endif
199 z2ram_map = 199 z2ram_map =
200 kmalloc((size/Z2RAM_CHUNKSIZE)*sizeof(z2ram_map[0]), 200 kmalloc_array(size / Z2RAM_CHUNKSIZE,
201 GFP_KERNEL); 201 sizeof(z2ram_map[0]),
202 GFP_KERNEL);
202 if ( z2ram_map == NULL ) 203 if ( z2ram_map == NULL )
203 { 204 {
204 printk( KERN_ERR DEVICE_NAME 205 printk( KERN_ERR DEVICE_NAME
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 9adc8c3eb0fa..a78b8e7085e9 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2132,7 +2132,7 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
2132 */ 2132 */
2133 nr = nframes; 2133 nr = nframes;
2134 do { 2134 do {
2135 cgc.buffer = kmalloc(CD_FRAMESIZE_RAW * nr, GFP_KERNEL); 2135 cgc.buffer = kmalloc_array(nr, CD_FRAMESIZE_RAW, GFP_KERNEL);
2136 if (cgc.buffer) 2136 if (cgc.buffer)
2137 break; 2137 break;
2138 2138
diff --git a/drivers/char/agp/compat_ioctl.c b/drivers/char/agp/compat_ioctl.c
index 2053f70ef66b..52ffe1706ce0 100644
--- a/drivers/char/agp/compat_ioctl.c
+++ b/drivers/char/agp/compat_ioctl.c
@@ -98,11 +98,15 @@ static int compat_agpioc_reserve_wrap(struct agp_file_private *priv, void __user
98 if (ureserve.seg_count >= 16384) 98 if (ureserve.seg_count >= 16384)
99 return -EINVAL; 99 return -EINVAL;
100 100
101 usegment = kmalloc(sizeof(*usegment) * ureserve.seg_count, GFP_KERNEL); 101 usegment = kmalloc_array(ureserve.seg_count,
102 sizeof(*usegment),
103 GFP_KERNEL);
102 if (!usegment) 104 if (!usegment)
103 return -ENOMEM; 105 return -ENOMEM;
104 106
105 ksegment = kmalloc(sizeof(*ksegment) * kreserve.seg_count, GFP_KERNEL); 107 ksegment = kmalloc_array(kreserve.seg_count,
108 sizeof(*ksegment),
109 GFP_KERNEL);
106 if (!ksegment) { 110 if (!ksegment) {
107 kfree(usegment); 111 kfree(usegment);
108 return -ENOMEM; 112 return -ENOMEM;
diff --git a/drivers/char/agp/isoch.c b/drivers/char/agp/isoch.c
index fc8e1bc3347d..31c374b1b91b 100644
--- a/drivers/char/agp/isoch.c
+++ b/drivers/char/agp/isoch.c
@@ -93,7 +93,8 @@ static int agp_3_5_isochronous_node_enable(struct agp_bridge_data *bridge,
93 * We'll work with an array of isoch_data's (one for each 93 * We'll work with an array of isoch_data's (one for each
94 * device in dev_list) throughout this function. 94 * device in dev_list) throughout this function.
95 */ 95 */
96 if ((master = kmalloc(ndevs * sizeof(*master), GFP_KERNEL)) == NULL) { 96 master = kmalloc_array(ndevs, sizeof(*master), GFP_KERNEL);
97 if (master == NULL) {
97 ret = -ENOMEM; 98 ret = -ENOMEM;
98 goto get_out; 99 goto get_out;
99 } 100 }
diff --git a/drivers/char/agp/sgi-agp.c b/drivers/char/agp/sgi-agp.c
index 3051c73bc383..e7d5bdc02d93 100644
--- a/drivers/char/agp/sgi-agp.c
+++ b/drivers/char/agp/sgi-agp.c
@@ -280,9 +280,9 @@ static int agp_sgi_init(void)
280 else 280 else
281 return 0; 281 return 0;
282 282
283 sgi_tioca_agp_bridges = kmalloc(tioca_gart_found * 283 sgi_tioca_agp_bridges = kmalloc_array(tioca_gart_found,
284 sizeof(struct agp_bridge_data *), 284 sizeof(struct agp_bridge_data *),
285 GFP_KERNEL); 285 GFP_KERNEL);
286 if (!sgi_tioca_agp_bridges) 286 if (!sgi_tioca_agp_bridges)
287 return -ENOMEM; 287 return -ENOMEM;
288 288
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index 79d8c84693a1..31fcd0430426 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -402,7 +402,9 @@ static int uninorth_create_gatt_table(struct agp_bridge_data *bridge)
402 if (table == NULL) 402 if (table == NULL)
403 return -ENOMEM; 403 return -ENOMEM;
404 404
405 uninorth_priv.pages_arr = kmalloc((1 << page_order) * sizeof(struct page*), GFP_KERNEL); 405 uninorth_priv.pages_arr = kmalloc_array(1 << page_order,
406 sizeof(struct page *),
407 GFP_KERNEL);
406 if (uninorth_priv.pages_arr == NULL) 408 if (uninorth_priv.pages_arr == NULL)
407 goto enomem; 409 goto enomem;
408 410
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 4bf7c06c2343..17084cfcf53e 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1891,13 +1891,14 @@ static int init_vqs(struct ports_device *portdev)
1891 nr_ports = portdev->max_nr_ports; 1891 nr_ports = portdev->max_nr_ports;
1892 nr_queues = use_multiport(portdev) ? (nr_ports + 1) * 2 : 2; 1892 nr_queues = use_multiport(portdev) ? (nr_ports + 1) * 2 : 2;
1893 1893
1894 vqs = kmalloc(nr_queues * sizeof(struct virtqueue *), GFP_KERNEL); 1894 vqs = kmalloc_array(nr_queues, sizeof(struct virtqueue *), GFP_KERNEL);
1895 io_callbacks = kmalloc(nr_queues * sizeof(vq_callback_t *), GFP_KERNEL); 1895 io_callbacks = kmalloc_array(nr_queues, sizeof(vq_callback_t *),
1896 io_names = kmalloc(nr_queues * sizeof(char *), GFP_KERNEL); 1896 GFP_KERNEL);
1897 portdev->in_vqs = kmalloc(nr_ports * sizeof(struct virtqueue *), 1897 io_names = kmalloc_array(nr_queues, sizeof(char *), GFP_KERNEL);
1898 GFP_KERNEL); 1898 portdev->in_vqs = kmalloc_array(nr_ports, sizeof(struct virtqueue *),
1899 portdev->out_vqs = kmalloc(nr_ports * sizeof(struct virtqueue *), 1899 GFP_KERNEL);
1900 GFP_KERNEL); 1900 portdev->out_vqs = kmalloc_array(nr_ports, sizeof(struct virtqueue *),
1901 GFP_KERNEL);
1901 if (!vqs || !io_callbacks || !io_names || !portdev->in_vqs || 1902 if (!vqs || !io_callbacks || !io_names || !portdev->in_vqs ||
1902 !portdev->out_vqs) { 1903 !portdev->out_vqs) {
1903 err = -ENOMEM; 1904 err = -ENOMEM;
diff --git a/drivers/cpufreq/bmips-cpufreq.c b/drivers/cpufreq/bmips-cpufreq.c
index 1653151b77df..56a4ebbf00e0 100644
--- a/drivers/cpufreq/bmips-cpufreq.c
+++ b/drivers/cpufreq/bmips-cpufreq.c
@@ -71,7 +71,7 @@ bmips_cpufreq_get_freq_table(const struct cpufreq_policy *policy)
71 71
72 cpu_freq = htp_freq_to_cpu_freq(priv->clk_mult); 72 cpu_freq = htp_freq_to_cpu_freq(priv->clk_mult);
73 73
74 table = kmalloc((priv->max_freqs + 1) * sizeof(*table), GFP_KERNEL); 74 table = kmalloc_array(priv->max_freqs + 1, sizeof(*table), GFP_KERNEL);
75 if (!table) 75 if (!table)
76 return ERR_PTR(-ENOMEM); 76 return ERR_PTR(-ENOMEM);
77 77
diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c
index 51fc6821cbbf..00c7aab8e7d0 100644
--- a/drivers/crypto/chelsio/chtls/chtls_io.c
+++ b/drivers/crypto/chelsio/chtls/chtls_io.c
@@ -240,7 +240,7 @@ static int tls_copy_ivs(struct sock *sk, struct sk_buff *skb)
240 } 240 }
241 241
242 /* generate the IVs */ 242 /* generate the IVs */
243 ivs = kmalloc(number_of_ivs * CIPHER_BLOCK_SIZE, GFP_ATOMIC); 243 ivs = kmalloc_array(CIPHER_BLOCK_SIZE, number_of_ivs, GFP_ATOMIC);
244 if (!ivs) 244 if (!ivs)
245 return -ENOMEM; 245 return -ENOMEM;
246 get_random_bytes(ivs, number_of_ivs * CIPHER_BLOCK_SIZE); 246 get_random_bytes(ivs, number_of_ivs * CIPHER_BLOCK_SIZE);
diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c
index 981e45692695..cdc96f1bb917 100644
--- a/drivers/crypto/stm32/stm32-hash.c
+++ b/drivers/crypto/stm32/stm32-hash.c
@@ -970,8 +970,9 @@ static int stm32_hash_export(struct ahash_request *req, void *out)
970 while (!(stm32_hash_read(hdev, HASH_SR) & HASH_SR_DATA_INPUT_READY)) 970 while (!(stm32_hash_read(hdev, HASH_SR) & HASH_SR_DATA_INPUT_READY))
971 cpu_relax(); 971 cpu_relax();
972 972
973 rctx->hw_context = kmalloc(sizeof(u32) * (3 + HASH_CSR_REGISTER_NUMBER), 973 rctx->hw_context = kmalloc_array(3 + HASH_CSR_REGISTER_NUMBER,
974 GFP_KERNEL); 974 sizeof(u32),
975 GFP_KERNEL);
975 976
976 preg = rctx->hw_context; 977 preg = rctx->hw_context;
977 978
diff --git a/drivers/dma/bestcomm/bestcomm.c b/drivers/dma/bestcomm/bestcomm.c
index 7a67b8345092..d91cbbe7a48f 100644
--- a/drivers/dma/bestcomm/bestcomm.c
+++ b/drivers/dma/bestcomm/bestcomm.c
@@ -87,7 +87,8 @@ bcom_task_alloc(int bd_count, int bd_size, int priv_size)
87 87
88 /* Init the BDs, if needed */ 88 /* Init the BDs, if needed */
89 if (bd_count) { 89 if (bd_count) {
90 tsk->cookie = kmalloc(sizeof(void*) * bd_count, GFP_KERNEL); 90 tsk->cookie = kmalloc_array(bd_count, sizeof(void *),
91 GFP_KERNEL);
91 if (!tsk->cookie) 92 if (!tsk->cookie)
92 goto error; 93 goto error;
93 94
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 1993889003fd..4528b560dc4c 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -777,7 +777,7 @@ static int mv_chan_memcpy_self_test(struct mv_xor_chan *mv_chan)
777 struct dmaengine_unmap_data *unmap; 777 struct dmaengine_unmap_data *unmap;
778 int err = 0; 778 int err = 0;
779 779
780 src = kmalloc(sizeof(u8) * PAGE_SIZE, GFP_KERNEL); 780 src = kmalloc(PAGE_SIZE, GFP_KERNEL);
781 if (!src) 781 if (!src)
782 return -ENOMEM; 782 return -ENOMEM;
783 783
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c
index 38c0aa60b2cb..051327a951b1 100644
--- a/drivers/firewire/core-iso.c
+++ b/drivers/firewire/core-iso.c
@@ -45,8 +45,8 @@ int fw_iso_buffer_alloc(struct fw_iso_buffer *buffer, int page_count)
45 45
46 buffer->page_count = 0; 46 buffer->page_count = 0;
47 buffer->page_count_mapped = 0; 47 buffer->page_count_mapped = 0;
48 buffer->pages = kmalloc(page_count * sizeof(buffer->pages[0]), 48 buffer->pages = kmalloc_array(page_count, sizeof(buffer->pages[0]),
49 GFP_KERNEL); 49 GFP_KERNEL);
50 if (buffer->pages == NULL) 50 if (buffer->pages == NULL)
51 return -ENOMEM; 51 return -ENOMEM;
52 52
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 60e75e6d9104..82ba110d9d1a 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -1121,7 +1121,7 @@ static int fwnet_broadcast_start(struct fwnet_device *dev)
1121 max_receive = 1U << (dev->card->max_receive + 1); 1121 max_receive = 1U << (dev->card->max_receive + 1);
1122 num_packets = (FWNET_ISO_PAGE_COUNT * PAGE_SIZE) / max_receive; 1122 num_packets = (FWNET_ISO_PAGE_COUNT * PAGE_SIZE) / max_receive;
1123 1123
1124 ptrptr = kmalloc(sizeof(void *) * num_packets, GFP_KERNEL); 1124 ptrptr = kmalloc_array(num_packets, sizeof(void *), GFP_KERNEL);
1125 if (!ptrptr) { 1125 if (!ptrptr) {
1126 retval = -ENOMEM; 1126 retval = -ENOMEM;
1127 goto failed; 1127 goto failed;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
index 0ff36d45a597..ea79908dac4c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
@@ -407,7 +407,7 @@ static int kgd_hqd_dump(struct kgd_dev *kgd,
407 (*dump)[i++][1] = RREG32(addr); \ 407 (*dump)[i++][1] = RREG32(addr); \
408 } while (0) 408 } while (0)
409 409
410 *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL); 410 *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
411 if (*dump == NULL) 411 if (*dump == NULL)
412 return -ENOMEM; 412 return -ENOMEM;
413 413
@@ -504,7 +504,7 @@ static int kgd_hqd_sdma_dump(struct kgd_dev *kgd,
504#undef HQD_N_REGS 504#undef HQD_N_REGS
505#define HQD_N_REGS (19+4) 505#define HQD_N_REGS (19+4)
506 506
507 *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL); 507 *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
508 if (*dump == NULL) 508 if (*dump == NULL)
509 return -ENOMEM; 509 return -ENOMEM;
510 510
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c
index 6ef9762b4b00..19dd665e7307 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c
@@ -395,7 +395,7 @@ static int kgd_hqd_dump(struct kgd_dev *kgd,
395 (*dump)[i++][1] = RREG32(addr); \ 395 (*dump)[i++][1] = RREG32(addr); \
396 } while (0) 396 } while (0)
397 397
398 *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL); 398 *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
399 if (*dump == NULL) 399 if (*dump == NULL)
400 return -ENOMEM; 400 return -ENOMEM;
401 401
@@ -491,7 +491,7 @@ static int kgd_hqd_sdma_dump(struct kgd_dev *kgd,
491#undef HQD_N_REGS 491#undef HQD_N_REGS
492#define HQD_N_REGS (19+4+2+3+7) 492#define HQD_N_REGS (19+4+2+3+7)
493 493
494 *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL); 494 *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
495 if (*dump == NULL) 495 if (*dump == NULL)
496 return -ENOMEM; 496 return -ENOMEM;
497 497
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c
index f0c0d3953f69..1db60aa5b7f0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c
@@ -504,7 +504,7 @@ static int kgd_hqd_dump(struct kgd_dev *kgd,
504 (*dump)[i++][1] = RREG32(addr); \ 504 (*dump)[i++][1] = RREG32(addr); \
505 } while (0) 505 } while (0)
506 506
507 *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL); 507 *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
508 if (*dump == NULL) 508 if (*dump == NULL)
509 return -ENOMEM; 509 return -ENOMEM;
510 510
@@ -606,7 +606,7 @@ static int kgd_hqd_sdma_dump(struct kgd_dev *kgd,
606#undef HQD_N_REGS 606#undef HQD_N_REGS
607#define HQD_N_REGS (19+6+7+10) 607#define HQD_N_REGS (19+6+7+10)
608 608
609 *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL); 609 *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
610 if (*dump == NULL) 610 if (*dump == NULL)
611 return -ENOMEM; 611 return -ENOMEM;
612 612
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 40e1e24f2ff0..a5808382bdf0 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1633,7 +1633,8 @@ struct edid *drm_do_get_edid(struct drm_connector *connector,
1633 edid[EDID_LENGTH-1] += edid[0x7e] - valid_extensions; 1633 edid[EDID_LENGTH-1] += edid[0x7e] - valid_extensions;
1634 edid[0x7e] = valid_extensions; 1634 edid[0x7e] = valid_extensions;
1635 1635
1636 new = kmalloc((valid_extensions + 1) * EDID_LENGTH, GFP_KERNEL); 1636 new = kmalloc_array(valid_extensions + 1, EDID_LENGTH,
1637 GFP_KERNEL);
1637 if (!new) 1638 if (!new)
1638 goto out; 1639 goto out;
1639 1640
diff --git a/drivers/gpu/drm/gma500/mid_bios.c b/drivers/gpu/drm/gma500/mid_bios.c
index 7171b7475f58..237041a37532 100644
--- a/drivers/gpu/drm/gma500/mid_bios.c
+++ b/drivers/gpu/drm/gma500/mid_bios.c
@@ -239,7 +239,7 @@ static int mid_get_vbt_data_r10(struct drm_psb_private *dev_priv, u32 addr)
239 if (read_vbt_r10(addr, &vbt)) 239 if (read_vbt_r10(addr, &vbt))
240 return -1; 240 return -1;
241 241
242 gct = kmalloc(sizeof(*gct) * vbt.panel_count, GFP_KERNEL); 242 gct = kmalloc_array(vbt.panel_count, sizeof(*gct), GFP_KERNEL);
243 if (!gct) 243 if (!gct)
244 return -ENOMEM; 244 return -ENOMEM;
245 245
diff --git a/drivers/gpu/drm/nouveau/nvif/mmu.c b/drivers/gpu/drm/nouveau/nvif/mmu.c
index 358ac4f3cf91..ae08a1ca8044 100644
--- a/drivers/gpu/drm/nouveau/nvif/mmu.c
+++ b/drivers/gpu/drm/nouveau/nvif/mmu.c
@@ -65,12 +65,15 @@ nvif_mmu_init(struct nvif_object *parent, s32 oclass, struct nvif_mmu *mmu)
65 goto done; 65 goto done;
66 mmu->mem = mems[ret].oclass; 66 mmu->mem = mems[ret].oclass;
67 67
68 mmu->heap = kmalloc(sizeof(*mmu->heap) * mmu->heap_nr, GFP_KERNEL); 68 mmu->heap = kmalloc_array(mmu->heap_nr, sizeof(*mmu->heap),
69 mmu->type = kmalloc(sizeof(*mmu->type) * mmu->type_nr, GFP_KERNEL); 69 GFP_KERNEL);
70 mmu->type = kmalloc_array(mmu->type_nr, sizeof(*mmu->type),
71 GFP_KERNEL);
70 if (ret = -ENOMEM, !mmu->heap || !mmu->type) 72 if (ret = -ENOMEM, !mmu->heap || !mmu->type)
71 goto done; 73 goto done;
72 74
73 mmu->kind = kmalloc(sizeof(*mmu->kind) * mmu->kind_nr, GFP_KERNEL); 75 mmu->kind = kmalloc_array(mmu->kind_nr, sizeof(*mmu->kind),
76 GFP_KERNEL);
74 if (!mmu->kind && mmu->kind_nr) 77 if (!mmu->kind && mmu->kind_nr)
75 goto done; 78 goto done;
76 79
diff --git a/drivers/gpu/drm/nouveau/nvif/vmm.c b/drivers/gpu/drm/nouveau/nvif/vmm.c
index 191832be6c65..6b9c5776547f 100644
--- a/drivers/gpu/drm/nouveau/nvif/vmm.c
+++ b/drivers/gpu/drm/nouveau/nvif/vmm.c
@@ -138,7 +138,8 @@ nvif_vmm_init(struct nvif_mmu *mmu, s32 oclass, u64 addr, u64 size,
138 vmm->limit = args->size; 138 vmm->limit = args->size;
139 139
140 vmm->page_nr = args->page_nr; 140 vmm->page_nr = args->page_nr;
141 vmm->page = kmalloc(sizeof(*vmm->page) * vmm->page_nr, GFP_KERNEL); 141 vmm->page = kmalloc_array(vmm->page_nr, sizeof(*vmm->page),
142 GFP_KERNEL);
142 if (!vmm->page) { 143 if (!vmm->page) {
143 ret = -ENOMEM; 144 ret = -ENOMEM;
144 goto done; 145 goto done;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/iccsense.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/iccsense.c
index 73e463ed55c3..dea444d48f94 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/iccsense.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/iccsense.c
@@ -73,7 +73,8 @@ nvbios_iccsense_parse(struct nvkm_bios *bios, struct nvbios_iccsense *iccsense)
73 } 73 }
74 74
75 iccsense->nr_entry = cnt; 75 iccsense->nr_entry = cnt;
76 iccsense->rail = kmalloc(sizeof(struct pwr_rail_t) * cnt, GFP_KERNEL); 76 iccsense->rail = kmalloc_array(cnt, sizeof(struct pwr_rail_t),
77 GFP_KERNEL);
77 if (!iccsense->rail) 78 if (!iccsense->rail)
78 return -ENOMEM; 79 return -ENOMEM;
79 80
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c
index 920b3d347803..bbfde1cb3a17 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c
@@ -171,7 +171,7 @@ gt215_link_train(struct gt215_ram *ram)
171 return -ENOSYS; 171 return -ENOSYS;
172 172
173 /* XXX: Multiple partitions? */ 173 /* XXX: Multiple partitions? */
174 result = kmalloc(64 * sizeof(u32), GFP_KERNEL); 174 result = kmalloc_array(64, sizeof(u32), GFP_KERNEL);
175 if (!result) 175 if (!result)
176 return -ENOMEM; 176 return -ENOMEM;
177 177
diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
index 401c02e9e6b2..f92fe205550b 100644
--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
@@ -940,8 +940,8 @@ int tiler_map_show(struct seq_file *s, void *arg)
940 h_adj = omap_dmm->container_height / ydiv; 940 h_adj = omap_dmm->container_height / ydiv;
941 w_adj = omap_dmm->container_width / xdiv; 941 w_adj = omap_dmm->container_width / xdiv;
942 942
943 map = kmalloc(h_adj * sizeof(*map), GFP_KERNEL); 943 map = kmalloc_array(h_adj, sizeof(*map), GFP_KERNEL);
944 global_map = kmalloc((w_adj + 1) * h_adj, GFP_KERNEL); 944 global_map = kmalloc_array(w_adj + 1, h_adj, GFP_KERNEL);
945 945
946 if (!map || !global_map) 946 if (!map || !global_map)
947 goto error; 947 goto error;
diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapdrm/omap_gem.c
index 0faf042b82e1..3ea716875151 100644
--- a/drivers/gpu/drm/omapdrm/omap_gem.c
+++ b/drivers/gpu/drm/omapdrm/omap_gem.c
@@ -244,7 +244,7 @@ static int omap_gem_attach_pages(struct drm_gem_object *obj)
244 * DSS, GPU, etc. are not cache coherent: 244 * DSS, GPU, etc. are not cache coherent:
245 */ 245 */
246 if (omap_obj->flags & (OMAP_BO_WC|OMAP_BO_UNCACHED)) { 246 if (omap_obj->flags & (OMAP_BO_WC|OMAP_BO_UNCACHED)) {
247 addrs = kmalloc(npages * sizeof(*addrs), GFP_KERNEL); 247 addrs = kmalloc_array(npages, sizeof(*addrs), GFP_KERNEL);
248 if (!addrs) { 248 if (!addrs) {
249 ret = -ENOMEM; 249 ret = -ENOMEM;
250 goto free_pages; 250 goto free_pages;
diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c
index c5716a0ca3b8..771250aed78d 100644
--- a/drivers/gpu/drm/qxl/qxl_kms.c
+++ b/drivers/gpu/drm/qxl/qxl_kms.c
@@ -200,8 +200,8 @@ int qxl_device_init(struct qxl_device *qdev,
200 (~(uint64_t)0) >> (qdev->slot_id_bits + qdev->slot_gen_bits); 200 (~(uint64_t)0) >> (qdev->slot_id_bits + qdev->slot_gen_bits);
201 201
202 qdev->mem_slots = 202 qdev->mem_slots =
203 kmalloc(qdev->n_mem_slots * sizeof(struct qxl_memslot), 203 kmalloc_array(qdev->n_mem_slots, sizeof(struct qxl_memslot),
204 GFP_KERNEL); 204 GFP_KERNEL);
205 205
206 idr_init(&qdev->release_idr); 206 idr_init(&qdev->release_idr);
207 spin_lock_init(&qdev->release_idr_lock); 207 spin_lock_init(&qdev->release_idr_lock);
diff --git a/drivers/gpu/drm/savage/savage_bci.c b/drivers/gpu/drm/savage/savage_bci.c
index 2a5b8466d806..35dc74883f83 100644
--- a/drivers/gpu/drm/savage/savage_bci.c
+++ b/drivers/gpu/drm/savage/savage_bci.c
@@ -298,8 +298,9 @@ static int savage_dma_init(drm_savage_private_t * dev_priv)
298 298
299 dev_priv->nr_dma_pages = dev_priv->cmd_dma->size / 299 dev_priv->nr_dma_pages = dev_priv->cmd_dma->size /
300 (SAVAGE_DMA_PAGE_SIZE * 4); 300 (SAVAGE_DMA_PAGE_SIZE * 4);
301 dev_priv->dma_pages = kmalloc(sizeof(drm_savage_dma_page_t) * 301 dev_priv->dma_pages = kmalloc_array(dev_priv->nr_dma_pages,
302 dev_priv->nr_dma_pages, GFP_KERNEL); 302 sizeof(drm_savage_dma_page_t),
303 GFP_KERNEL);
303 if (dev_priv->dma_pages == NULL) 304 if (dev_priv->dma_pages == NULL)
304 return -ENOMEM; 305 return -ENOMEM;
305 306
diff --git a/drivers/gpu/drm/tinydrm/repaper.c b/drivers/gpu/drm/tinydrm/repaper.c
index 1ee6855212a0..50a1d4216ce7 100644
--- a/drivers/gpu/drm/tinydrm/repaper.c
+++ b/drivers/gpu/drm/tinydrm/repaper.c
@@ -548,7 +548,7 @@ static int repaper_fb_dirty(struct drm_framebuffer *fb,
548 DRM_DEBUG("Flushing [FB:%d] st=%ums\n", fb->base.id, 548 DRM_DEBUG("Flushing [FB:%d] st=%ums\n", fb->base.id,
549 epd->factored_stage_time); 549 epd->factored_stage_time);
550 550
551 buf = kmalloc(fb->width * fb->height, GFP_KERNEL); 551 buf = kmalloc_array(fb->width, fb->height, GFP_KERNEL);
552 if (!buf) 552 if (!buf)
553 return -ENOMEM; 553 return -ENOMEM;
554 554
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index 06c94e3a5f15..6e2d1300b457 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -348,8 +348,9 @@ static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free,
348 if (use_static) 348 if (use_static)
349 pages_to_free = static_buf; 349 pages_to_free = static_buf;
350 else 350 else
351 pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), 351 pages_to_free = kmalloc_array(npages_to_free,
352 GFP_KERNEL); 352 sizeof(struct page *),
353 GFP_KERNEL);
353 if (!pages_to_free) { 354 if (!pages_to_free) {
354 pr_debug("Failed to allocate memory for pool free operation\n"); 355 pr_debug("Failed to allocate memory for pool free operation\n");
355 return 0; 356 return 0;
@@ -547,7 +548,8 @@ static int ttm_alloc_new_pages(struct list_head *pages, gfp_t gfp_flags,
547 unsigned max_cpages = min(count << order, (unsigned)NUM_PAGES_TO_ALLOC); 548 unsigned max_cpages = min(count << order, (unsigned)NUM_PAGES_TO_ALLOC);
548 549
549 /* allocate array for page caching change */ 550 /* allocate array for page caching change */
550 caching_array = kmalloc(max_cpages*sizeof(struct page *), GFP_KERNEL); 551 caching_array = kmalloc_array(max_cpages, sizeof(struct page *),
552 GFP_KERNEL);
551 553
552 if (!caching_array) { 554 if (!caching_array) {
553 pr_debug("Unable to allocate table for new pages\n"); 555 pr_debug("Unable to allocate table for new pages\n");
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
index f63d99c302e4..3f14c1cc0789 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -463,8 +463,9 @@ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
463 if (use_static) 463 if (use_static)
464 pages_to_free = static_buf; 464 pages_to_free = static_buf;
465 else 465 else
466 pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), 466 pages_to_free = kmalloc_array(npages_to_free,
467 GFP_KERNEL); 467 sizeof(struct page *),
468 GFP_KERNEL);
468 469
469 if (!pages_to_free) { 470 if (!pages_to_free) {
470 pr_debug("%s: Failed to allocate memory for pool free operation\n", 471 pr_debug("%s: Failed to allocate memory for pool free operation\n",
@@ -753,7 +754,8 @@ static int ttm_dma_pool_alloc_new_pages(struct dma_pool *pool,
753 (unsigned)(PAGE_SIZE/sizeof(struct page *))); 754 (unsigned)(PAGE_SIZE/sizeof(struct page *)));
754 755
755 /* allocate array for page caching change */ 756 /* allocate array for page caching change */
756 caching_array = kmalloc(max_cpages*sizeof(struct page *), GFP_KERNEL); 757 caching_array = kmalloc_array(max_cpages, sizeof(struct page *),
758 GFP_KERNEL);
757 759
758 if (!caching_array) { 760 if (!caching_array) {
759 pr_debug("%s: Unable to allocate table for new pages\n", 761 pr_debug("%s: Unable to allocate table for new pages\n",
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 71d44c357d35..1d34619eb3fe 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -209,7 +209,7 @@ static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val)
209{ 209{
210 if (vc4_state->dlist_count == vc4_state->dlist_size) { 210 if (vc4_state->dlist_count == vc4_state->dlist_size) {
211 u32 new_size = max(4u, vc4_state->dlist_count * 2); 211 u32 new_size = max(4u, vc4_state->dlist_count * 2);
212 u32 *new_dlist = kmalloc(new_size * 4, GFP_KERNEL); 212 u32 *new_dlist = kmalloc_array(new_size, 4, GFP_KERNEL);
213 213
214 if (!new_dlist) 214 if (!new_dlist)
215 return; 215 return;
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 355dc7e49562..f858cc72011d 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -134,8 +134,11 @@ static int open_collection(struct hid_parser *parser, unsigned type)
134 } 134 }
135 135
136 if (parser->device->maxcollection == parser->device->collection_size) { 136 if (parser->device->maxcollection == parser->device->collection_size) {
137 collection = kmalloc(sizeof(struct hid_collection) * 137 collection = kmalloc(
138 parser->device->collection_size * 2, GFP_KERNEL); 138 array3_size(sizeof(struct hid_collection),
139 parser->device->collection_size,
140 2),
141 GFP_KERNEL);
139 if (collection == NULL) { 142 if (collection == NULL) {
140 hid_err(parser->device, "failed to reallocate collection array\n"); 143 hid_err(parser->device, "failed to reallocate collection array\n");
141 return -ENOMEM; 144 return -ENOMEM;
@@ -1278,7 +1281,7 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field,
1278 __s32 max = field->logical_maximum; 1281 __s32 max = field->logical_maximum;
1279 __s32 *value; 1282 __s32 *value;
1280 1283
1281 value = kmalloc(sizeof(__s32) * count, GFP_ATOMIC); 1284 value = kmalloc_array(count, sizeof(__s32), GFP_ATOMIC);
1282 if (!value) 1285 if (!value)
1283 return; 1286 return;
1284 1287
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index 4f4e7a08a07b..6d99534ac691 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -685,7 +685,7 @@ void hid_dump_report(struct hid_device *hid, int type, u8 *data,
685 char *buf; 685 char *buf;
686 unsigned int i; 686 unsigned int i;
687 687
688 buf = kmalloc(sizeof(char) * HID_DEBUG_BUFSIZE, GFP_ATOMIC); 688 buf = kmalloc(HID_DEBUG_BUFSIZE, GFP_ATOMIC);
689 689
690 if (!buf) 690 if (!buf)
691 return; 691 return;
diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
index 7f965e231433..864a084b6cba 100644
--- a/drivers/hid/hid-picolcd_fb.c
+++ b/drivers/hid/hid-picolcd_fb.c
@@ -394,7 +394,8 @@ static int picolcd_set_par(struct fb_info *info)
394 return -EINVAL; 394 return -EINVAL;
395 395
396 o_fb = fbdata->bitmap; 396 o_fb = fbdata->bitmap;
397 tmp_fb = kmalloc(PICOLCDFB_SIZE*info->var.bits_per_pixel, GFP_KERNEL); 397 tmp_fb = kmalloc_array(PICOLCDFB_SIZE, info->var.bits_per_pixel,
398 GFP_KERNEL);
398 if (!tmp_fb) 399 if (!tmp_fb)
399 return -ENOMEM; 400 return -ENOMEM;
400 401
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index b39844adea47..4a44e48e08b2 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -218,7 +218,7 @@ static ssize_t hidraw_get_report(struct file *file, char __user *buffer, size_t
218 goto out; 218 goto out;
219 } 219 }
220 220
221 buf = kmalloc(count * sizeof(__u8), GFP_KERNEL); 221 buf = kmalloc(count, GFP_KERNEL);
222 if (!buf) { 222 if (!buf) {
223 ret = -ENOMEM; 223 ret = -ENOMEM;
224 goto out; 224 goto out;
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 1667b6e7674f..1aca742fde4a 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -244,7 +244,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,
244 u8 __user **data_ptrs; 244 u8 __user **data_ptrs;
245 int i, res; 245 int i, res;
246 246
247 data_ptrs = kmalloc(nmsgs * sizeof(u8 __user *), GFP_KERNEL); 247 data_ptrs = kmalloc_array(nmsgs, sizeof(u8 __user *), GFP_KERNEL);
248 if (data_ptrs == NULL) { 248 if (data_ptrs == NULL) {
249 kfree(msgs); 249 kfree(msgs);
250 return -ENOMEM; 250 return -ENOMEM;
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 56d7bc228cb3..416a2f353071 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -985,8 +985,9 @@ static int hwif_init(ide_hwif_t *hwif)
985 if (!hwif->sg_max_nents) 985 if (!hwif->sg_max_nents)
986 hwif->sg_max_nents = PRD_ENTRIES; 986 hwif->sg_max_nents = PRD_ENTRIES;
987 987
988 hwif->sg_table = kmalloc(sizeof(struct scatterlist)*hwif->sg_max_nents, 988 hwif->sg_table = kmalloc_array(hwif->sg_max_nents,
989 GFP_KERNEL); 989 sizeof(struct scatterlist),
990 GFP_KERNEL);
990 if (!hwif->sg_table) { 991 if (!hwif->sg_table) {
991 printk(KERN_ERR "%s: unable to allocate SG table.\n", hwif->name); 992 printk(KERN_ERR "%s: unable to allocate SG table.\n", hwif->name);
992 goto out; 993 goto out;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 6813ee717a38..bff10ab141b0 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1855,8 +1855,8 @@ static struct rdma_id_private *cma_new_conn_id(struct rdma_cm_id *listen_id,
1855 1855
1856 rt = &id->route; 1856 rt = &id->route;
1857 rt->num_paths = ib_event->param.req_rcvd.alternate_path ? 2 : 1; 1857 rt->num_paths = ib_event->param.req_rcvd.alternate_path ? 2 : 1;
1858 rt->path_rec = kmalloc(sizeof *rt->path_rec * rt->num_paths, 1858 rt->path_rec = kmalloc_array(rt->num_paths, sizeof(*rt->path_rec),
1859 GFP_KERNEL); 1859 GFP_KERNEL);
1860 if (!rt->path_rec) 1860 if (!rt->path_rec)
1861 goto err; 1861 goto err;
1862 1862
diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
index a0a9ed719031..a077500f7f32 100644
--- a/drivers/infiniband/core/fmr_pool.c
+++ b/drivers/infiniband/core/fmr_pool.c
@@ -235,8 +235,9 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd *pd,
235 235
236 if (params->cache) { 236 if (params->cache) {
237 pool->cache_bucket = 237 pool->cache_bucket =
238 kmalloc(IB_FMR_HASH_SIZE * sizeof *pool->cache_bucket, 238 kmalloc_array(IB_FMR_HASH_SIZE,
239 GFP_KERNEL); 239 sizeof(*pool->cache_bucket),
240 GFP_KERNEL);
240 if (!pool->cache_bucket) { 241 if (!pool->cache_bucket) {
241 ret = -ENOMEM; 242 ret = -ENOMEM;
242 goto out_free_pool; 243 goto out_free_pool;
diff --git a/drivers/infiniband/hw/cxgb4/id_table.c b/drivers/infiniband/hw/cxgb4/id_table.c
index 5c2cfdea06ad..724d23297b35 100644
--- a/drivers/infiniband/hw/cxgb4/id_table.c
+++ b/drivers/infiniband/hw/cxgb4/id_table.c
@@ -92,8 +92,8 @@ int c4iw_id_table_alloc(struct c4iw_id_table *alloc, u32 start, u32 num,
92 alloc->last = 0; 92 alloc->last = 0;
93 alloc->max = num; 93 alloc->max = num;
94 spin_lock_init(&alloc->lock); 94 spin_lock_init(&alloc->lock);
95 alloc->table = kmalloc(BITS_TO_LONGS(num) * sizeof(long), 95 alloc->table = kmalloc_array(BITS_TO_LONGS(num), sizeof(long),
96 GFP_KERNEL); 96 GFP_KERNEL);
97 if (!alloc->table) 97 if (!alloc->table)
98 return -ENOMEM; 98 return -ENOMEM;
99 99
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index f839bf3b1497..4ec519afc45b 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -302,7 +302,8 @@ static int mlx4_ib_add_gid(const union ib_gid *gid,
302 ctx->refcount++; 302 ctx->refcount++;
303 } 303 }
304 if (!ret && hw_update) { 304 if (!ret && hw_update) {
305 gids = kmalloc(sizeof(*gids) * MLX4_MAX_PORT_GIDS, GFP_ATOMIC); 305 gids = kmalloc_array(MLX4_MAX_PORT_GIDS, sizeof(*gids),
306 GFP_ATOMIC);
306 if (!gids) { 307 if (!gids) {
307 ret = -ENOMEM; 308 ret = -ENOMEM;
308 } else { 309 } else {
@@ -355,7 +356,8 @@ static int mlx4_ib_del_gid(const struct ib_gid_attr *attr, void **context)
355 if (!ret && hw_update) { 356 if (!ret && hw_update) {
356 int i; 357 int i;
357 358
358 gids = kmalloc(sizeof(*gids) * MLX4_MAX_PORT_GIDS, GFP_ATOMIC); 359 gids = kmalloc_array(MLX4_MAX_PORT_GIDS, sizeof(*gids),
360 GFP_ATOMIC);
359 if (!gids) { 361 if (!gids) {
360 ret = -ENOMEM; 362 ret = -ENOMEM;
361 } else { 363 } else {
@@ -2872,9 +2874,9 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
2872 goto err_counter; 2874 goto err_counter;
2873 2875
2874 ibdev->ib_uc_qpns_bitmap = 2876 ibdev->ib_uc_qpns_bitmap =
2875 kmalloc(BITS_TO_LONGS(ibdev->steer_qpn_count) * 2877 kmalloc_array(BITS_TO_LONGS(ibdev->steer_qpn_count),
2876 sizeof(long), 2878 sizeof(long),
2877 GFP_KERNEL); 2879 GFP_KERNEL);
2878 if (!ibdev->ib_uc_qpns_bitmap) 2880 if (!ibdev->ib_uc_qpns_bitmap)
2879 goto err_steer_qp_release; 2881 goto err_steer_qp_release;
2880 2882
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index cd2c08c45334..3b8045fd23ed 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -573,8 +573,8 @@ static int alloc_proxy_bufs(struct ib_device *dev, struct mlx4_ib_qp *qp)
573 int i; 573 int i;
574 574
575 qp->sqp_proxy_rcv = 575 qp->sqp_proxy_rcv =
576 kmalloc(sizeof (struct mlx4_ib_buf) * qp->rq.wqe_cnt, 576 kmalloc_array(qp->rq.wqe_cnt, sizeof(struct mlx4_ib_buf),
577 GFP_KERNEL); 577 GFP_KERNEL);
578 if (!qp->sqp_proxy_rcv) 578 if (!qp->sqp_proxy_rcv)
579 return -ENOMEM; 579 return -ENOMEM;
580 for (i = 0; i < qp->rq.wqe_cnt; i++) { 580 for (i = 0; i < qp->rq.wqe_cnt; i++) {
diff --git a/drivers/infiniband/hw/mthca/mthca_allocator.c b/drivers/infiniband/hw/mthca/mthca_allocator.c
index b4e0cf4e95cd..aaf10dd5364d 100644
--- a/drivers/infiniband/hw/mthca/mthca_allocator.c
+++ b/drivers/infiniband/hw/mthca/mthca_allocator.c
@@ -90,8 +90,8 @@ int mthca_alloc_init(struct mthca_alloc *alloc, u32 num, u32 mask,
90 alloc->max = num; 90 alloc->max = num;
91 alloc->mask = mask; 91 alloc->mask = mask;
92 spin_lock_init(&alloc->lock); 92 spin_lock_init(&alloc->lock);
93 alloc->table = kmalloc(BITS_TO_LONGS(num) * sizeof (long), 93 alloc->table = kmalloc_array(BITS_TO_LONGS(num), sizeof(long),
94 GFP_KERNEL); 94 GFP_KERNEL);
95 if (!alloc->table) 95 if (!alloc->table)
96 return -ENOMEM; 96 return -ENOMEM;
97 97
@@ -162,7 +162,8 @@ int mthca_array_init(struct mthca_array *array, int nent)
162 int npage = (nent * sizeof (void *) + PAGE_SIZE - 1) / PAGE_SIZE; 162 int npage = (nent * sizeof (void *) + PAGE_SIZE - 1) / PAGE_SIZE;
163 int i; 163 int i;
164 164
165 array->page_list = kmalloc(npage * sizeof *array->page_list, GFP_KERNEL); 165 array->page_list = kmalloc_array(npage, sizeof(*array->page_list),
166 GFP_KERNEL);
166 if (!array->page_list) 167 if (!array->page_list)
167 return -ENOMEM; 168 return -ENOMEM;
168 169
@@ -220,7 +221,8 @@ int mthca_buf_alloc(struct mthca_dev *dev, int size, int max_direct,
220 npages *= 2; 221 npages *= 2;
221 } 222 }
222 223
223 dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL); 224 dma_list = kmalloc_array(npages, sizeof(*dma_list),
225 GFP_KERNEL);
224 if (!dma_list) 226 if (!dma_list)
225 goto err_free; 227 goto err_free;
226 228
@@ -231,12 +233,14 @@ int mthca_buf_alloc(struct mthca_dev *dev, int size, int max_direct,
231 npages = (size + PAGE_SIZE - 1) / PAGE_SIZE; 233 npages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
232 shift = PAGE_SHIFT; 234 shift = PAGE_SHIFT;
233 235
234 dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL); 236 dma_list = kmalloc_array(npages, sizeof(*dma_list),
237 GFP_KERNEL);
235 if (!dma_list) 238 if (!dma_list)
236 return -ENOMEM; 239 return -ENOMEM;
237 240
238 buf->page_list = kmalloc(npages * sizeof *buf->page_list, 241 buf->page_list = kmalloc_array(npages,
239 GFP_KERNEL); 242 sizeof(*buf->page_list),
243 GFP_KERNEL);
240 if (!buf->page_list) 244 if (!buf->page_list)
241 goto err_out; 245 goto err_out;
242 246
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 419a2a20c047..83aa47eb81a9 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -565,9 +565,9 @@ int mthca_cmd_use_events(struct mthca_dev *dev)
565{ 565{
566 int i; 566 int i;
567 567
568 dev->cmd.context = kmalloc(dev->cmd.max_cmds * 568 dev->cmd.context = kmalloc_array(dev->cmd.max_cmds,
569 sizeof (struct mthca_cmd_context), 569 sizeof(struct mthca_cmd_context),
570 GFP_KERNEL); 570 GFP_KERNEL);
571 if (!dev->cmd.context) 571 if (!dev->cmd.context)
572 return -ENOMEM; 572 return -ENOMEM;
573 573
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 690201738993..30400ea4808b 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -479,15 +479,15 @@ static int mthca_create_eq(struct mthca_dev *dev,
479 eq->nent = roundup_pow_of_two(max(nent, 2)); 479 eq->nent = roundup_pow_of_two(max(nent, 2));
480 npages = ALIGN(eq->nent * MTHCA_EQ_ENTRY_SIZE, PAGE_SIZE) / PAGE_SIZE; 480 npages = ALIGN(eq->nent * MTHCA_EQ_ENTRY_SIZE, PAGE_SIZE) / PAGE_SIZE;
481 481
482 eq->page_list = kmalloc(npages * sizeof *eq->page_list, 482 eq->page_list = kmalloc_array(npages, sizeof(*eq->page_list),
483 GFP_KERNEL); 483 GFP_KERNEL);
484 if (!eq->page_list) 484 if (!eq->page_list)
485 goto err_out; 485 goto err_out;
486 486
487 for (i = 0; i < npages; ++i) 487 for (i = 0; i < npages; ++i)
488 eq->page_list[i].buf = NULL; 488 eq->page_list[i].buf = NULL;
489 489
490 dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL); 490 dma_list = kmalloc_array(npages, sizeof(*dma_list), GFP_KERNEL);
491 if (!dma_list) 491 if (!dma_list)
492 goto err_out_free; 492 goto err_out_free;
493 493
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 7a31be3c3e73..cc9c0c8ccba3 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -712,9 +712,9 @@ int mthca_init_db_tab(struct mthca_dev *dev)
712 dev->db_tab->max_group1 = 0; 712 dev->db_tab->max_group1 = 0;
713 dev->db_tab->min_group2 = dev->db_tab->npages - 1; 713 dev->db_tab->min_group2 = dev->db_tab->npages - 1;
714 714
715 dev->db_tab->page = kmalloc(dev->db_tab->npages * 715 dev->db_tab->page = kmalloc_array(dev->db_tab->npages,
716 sizeof *dev->db_tab->page, 716 sizeof(*dev->db_tab->page),
717 GFP_KERNEL); 717 GFP_KERNEL);
718 if (!dev->db_tab->page) { 718 if (!dev->db_tab->page) {
719 kfree(dev->db_tab); 719 kfree(dev->db_tab);
720 return -ENOMEM; 720 return -ENOMEM;
diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index ed9a989e501b..dc3c2346045c 100644
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -153,7 +153,7 @@ static int mthca_buddy_init(struct mthca_buddy *buddy, int max_order)
153 153
154 for (i = 0; i <= buddy->max_order; ++i) { 154 for (i = 0; i <= buddy->max_order; ++i) {
155 s = BITS_TO_LONGS(1 << (buddy->max_order - i)); 155 s = BITS_TO_LONGS(1 << (buddy->max_order - i));
156 buddy->bits[i] = kmalloc(s * sizeof (long), GFP_KERNEL); 156 buddy->bits[i] = kmalloc_array(s, sizeof(long), GFP_KERNEL);
157 if (!buddy->bits[i]) 157 if (!buddy->bits[i])
158 goto err_out_free; 158 goto err_out_free;
159 bitmap_zero(buddy->bits[i], 159 bitmap_zero(buddy->bits[i],
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index d21960cd9a49..af1c49d70b89 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -1054,8 +1054,8 @@ static int mthca_alloc_wqe_buf(struct mthca_dev *dev,
1054 size = PAGE_ALIGN(qp->send_wqe_offset + 1054 size = PAGE_ALIGN(qp->send_wqe_offset +
1055 (qp->sq.max << qp->sq.wqe_shift)); 1055 (qp->sq.max << qp->sq.wqe_shift));
1056 1056
1057 qp->wrid = kmalloc((qp->rq.max + qp->sq.max) * sizeof (u64), 1057 qp->wrid = kmalloc_array(qp->rq.max + qp->sq.max, sizeof(u64),
1058 GFP_KERNEL); 1058 GFP_KERNEL);
1059 if (!qp->wrid) 1059 if (!qp->wrid)
1060 goto err_out; 1060 goto err_out;
1061 1061
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index d22f970480c0..f79732bc73b4 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -155,7 +155,7 @@ static int mthca_alloc_srq_buf(struct mthca_dev *dev, struct mthca_pd *pd,
155 if (pd->ibpd.uobject) 155 if (pd->ibpd.uobject)
156 return 0; 156 return 0;
157 157
158 srq->wrid = kmalloc(srq->max * sizeof (u64), GFP_KERNEL); 158 srq->wrid = kmalloc_array(srq->max, sizeof(u64), GFP_KERNEL);
159 if (!srq->wrid) 159 if (!srq->wrid)
160 return -ENOMEM; 160 return -ENOMEM;
161 161
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index 007d5e8a0121..61014e251555 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -904,7 +904,7 @@ static void nes_netdev_set_multicast_list(struct net_device *netdev)
904 int i; 904 int i;
905 struct netdev_hw_addr *ha; 905 struct netdev_hw_addr *ha;
906 906
907 addrs = kmalloc(ETH_ALEN * mc_count, GFP_ATOMIC); 907 addrs = kmalloc_array(mc_count, ETH_ALEN, GFP_ATOMIC);
908 if (!addrs) { 908 if (!addrs) {
909 set_allmulti(nesdev, nic_active_bit); 909 set_allmulti(nesdev, nic_active_bit);
910 goto unlock; 910 goto unlock;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 784ed6b09a46..eb9f9e9e213b 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -1873,7 +1873,8 @@ struct ib_srq *ocrdma_create_srq(struct ib_pd *ibpd,
1873 srq->bit_fields_len = (srq->rq.max_cnt / 32) + 1873 srq->bit_fields_len = (srq->rq.max_cnt / 32) +
1874 (srq->rq.max_cnt % 32 ? 1 : 0); 1874 (srq->rq.max_cnt % 32 ? 1 : 0);
1875 srq->idx_bit_fields = 1875 srq->idx_bit_fields =
1876 kmalloc(srq->bit_fields_len * sizeof(u32), GFP_KERNEL); 1876 kmalloc_array(srq->bit_fields_len, sizeof(u32),
1877 GFP_KERNEL);
1877 if (srq->idx_bit_fields == NULL) 1878 if (srq->idx_bit_fields == NULL)
1878 goto arm_err; 1879 goto arm_err;
1879 memset(srq->idx_bit_fields, 0xff, 1880 memset(srq->idx_bit_fields, 0xff,
diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
index 8a15e5c7dd91..fb1ff59f40bd 100644
--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
@@ -2496,15 +2496,16 @@ static void init_6120_cntrnames(struct qib_devdata *dd)
2496 dd->cspec->cntrnamelen = sizeof(cntr6120names) - 1; 2496 dd->cspec->cntrnamelen = sizeof(cntr6120names) - 1;
2497 else 2497 else
2498 dd->cspec->cntrnamelen = 1 + s - cntr6120names; 2498 dd->cspec->cntrnamelen = 1 + s - cntr6120names;
2499 dd->cspec->cntrs = kmalloc(dd->cspec->ncntrs 2499 dd->cspec->cntrs = kmalloc_array(dd->cspec->ncntrs, sizeof(u64),
2500 * sizeof(u64), GFP_KERNEL); 2500 GFP_KERNEL);
2501 2501
2502 for (i = 0, s = (char *)portcntr6120names; s; i++) 2502 for (i = 0, s = (char *)portcntr6120names; s; i++)
2503 s = strchr(s + 1, '\n'); 2503 s = strchr(s + 1, '\n');
2504 dd->cspec->nportcntrs = i - 1; 2504 dd->cspec->nportcntrs = i - 1;
2505 dd->cspec->portcntrnamelen = sizeof(portcntr6120names) - 1; 2505 dd->cspec->portcntrnamelen = sizeof(portcntr6120names) - 1;
2506 dd->cspec->portcntrs = kmalloc(dd->cspec->nportcntrs 2506 dd->cspec->portcntrs = kmalloc_array(dd->cspec->nportcntrs,
2507 * sizeof(u64), GFP_KERNEL); 2507 sizeof(u64),
2508 GFP_KERNEL);
2508} 2509}
2509 2510
2510static u32 qib_read_6120cntrs(struct qib_devdata *dd, loff_t pos, char **namep, 2511static u32 qib_read_6120cntrs(struct qib_devdata *dd, loff_t pos, char **namep,
diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
index bdff2326731e..163a57a88742 100644
--- a/drivers/infiniband/hw/qib/qib_iba7220.c
+++ b/drivers/infiniband/hw/qib/qib_iba7220.c
@@ -3147,15 +3147,16 @@ static void init_7220_cntrnames(struct qib_devdata *dd)
3147 dd->cspec->cntrnamelen = sizeof(cntr7220names) - 1; 3147 dd->cspec->cntrnamelen = sizeof(cntr7220names) - 1;
3148 else 3148 else
3149 dd->cspec->cntrnamelen = 1 + s - cntr7220names; 3149 dd->cspec->cntrnamelen = 1 + s - cntr7220names;
3150 dd->cspec->cntrs = kmalloc(dd->cspec->ncntrs 3150 dd->cspec->cntrs = kmalloc_array(dd->cspec->ncntrs, sizeof(u64),
3151 * sizeof(u64), GFP_KERNEL); 3151 GFP_KERNEL);
3152 3152
3153 for (i = 0, s = (char *)portcntr7220names; s; i++) 3153 for (i = 0, s = (char *)portcntr7220names; s; i++)
3154 s = strchr(s + 1, '\n'); 3154 s = strchr(s + 1, '\n');
3155 dd->cspec->nportcntrs = i - 1; 3155 dd->cspec->nportcntrs = i - 1;
3156 dd->cspec->portcntrnamelen = sizeof(portcntr7220names) - 1; 3156 dd->cspec->portcntrnamelen = sizeof(portcntr7220names) - 1;
3157 dd->cspec->portcntrs = kmalloc(dd->cspec->nportcntrs 3157 dd->cspec->portcntrs = kmalloc_array(dd->cspec->nportcntrs,
3158 * sizeof(u64), GFP_KERNEL); 3158 sizeof(u64),
3159 GFP_KERNEL);
3159} 3160}
3160 3161
3161static u32 qib_read_7220cntrs(struct qib_devdata *dd, loff_t pos, char **namep, 3162static u32 qib_read_7220cntrs(struct qib_devdata *dd, loff_t pos, char **namep,
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 8414ae44a518..27155d92f810 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -3648,8 +3648,9 @@ static int qib_do_7322_reset(struct qib_devdata *dd)
3648 3648
3649 if (msix_entries) { 3649 if (msix_entries) {
3650 /* can be up to 512 bytes, too big for stack */ 3650 /* can be up to 512 bytes, too big for stack */
3651 msix_vecsave = kmalloc(2 * dd->cspec->num_msix_entries * 3651 msix_vecsave = kmalloc_array(2 * dd->cspec->num_msix_entries,
3652 sizeof(u64), GFP_KERNEL); 3652 sizeof(u64),
3653 GFP_KERNEL);
3653 } 3654 }
3654 3655
3655 /* 3656 /*
@@ -5009,16 +5010,17 @@ static void init_7322_cntrnames(struct qib_devdata *dd)
5009 dd->cspec->cntrnamelen = sizeof(cntr7322names) - 1; 5010 dd->cspec->cntrnamelen = sizeof(cntr7322names) - 1;
5010 else 5011 else
5011 dd->cspec->cntrnamelen = 1 + s - cntr7322names; 5012 dd->cspec->cntrnamelen = 1 + s - cntr7322names;
5012 dd->cspec->cntrs = kmalloc(dd->cspec->ncntrs 5013 dd->cspec->cntrs = kmalloc_array(dd->cspec->ncntrs, sizeof(u64),
5013 * sizeof(u64), GFP_KERNEL); 5014 GFP_KERNEL);
5014 5015
5015 for (i = 0, s = (char *)portcntr7322names; s; i++) 5016 for (i = 0, s = (char *)portcntr7322names; s; i++)
5016 s = strchr(s + 1, '\n'); 5017 s = strchr(s + 1, '\n');
5017 dd->cspec->nportcntrs = i - 1; 5018 dd->cspec->nportcntrs = i - 1;
5018 dd->cspec->portcntrnamelen = sizeof(portcntr7322names) - 1; 5019 dd->cspec->portcntrnamelen = sizeof(portcntr7322names) - 1;
5019 for (i = 0; i < dd->num_pports; ++i) { 5020 for (i = 0; i < dd->num_pports; ++i) {
5020 dd->pport[i].cpspec->portcntrs = kmalloc(dd->cspec->nportcntrs 5021 dd->pport[i].cpspec->portcntrs =
5021 * sizeof(u64), GFP_KERNEL); 5022 kmalloc_array(dd->cspec->nportcntrs, sizeof(u64),
5023 GFP_KERNEL);
5022 } 5024 }
5023} 5025}
5024 5026
@@ -6412,12 +6414,15 @@ static int qib_init_7322_variables(struct qib_devdata *dd)
6412 sbufcnt = dd->piobcnt2k + dd->piobcnt4k + 6414 sbufcnt = dd->piobcnt2k + dd->piobcnt4k +
6413 NUM_VL15_BUFS + BITS_PER_LONG - 1; 6415 NUM_VL15_BUFS + BITS_PER_LONG - 1;
6414 sbufcnt /= BITS_PER_LONG; 6416 sbufcnt /= BITS_PER_LONG;
6415 dd->cspec->sendchkenable = kmalloc(sbufcnt * 6417 dd->cspec->sendchkenable =
6416 sizeof(*dd->cspec->sendchkenable), GFP_KERNEL); 6418 kmalloc_array(sbufcnt, sizeof(*dd->cspec->sendchkenable),
6417 dd->cspec->sendgrhchk = kmalloc(sbufcnt * 6419 GFP_KERNEL);
6418 sizeof(*dd->cspec->sendgrhchk), GFP_KERNEL); 6420 dd->cspec->sendgrhchk =
6419 dd->cspec->sendibchk = kmalloc(sbufcnt * 6421 kmalloc_array(sbufcnt, sizeof(*dd->cspec->sendgrhchk),
6420 sizeof(*dd->cspec->sendibchk), GFP_KERNEL); 6422 GFP_KERNEL);
6423 dd->cspec->sendibchk =
6424 kmalloc_array(sbufcnt, sizeof(*dd->cspec->sendibchk),
6425 GFP_KERNEL);
6421 if (!dd->cspec->sendchkenable || !dd->cspec->sendgrhchk || 6426 if (!dd->cspec->sendchkenable || !dd->cspec->sendgrhchk ||
6422 !dd->cspec->sendibchk) { 6427 !dd->cspec->sendibchk) {
6423 ret = -ENOMEM; 6428 ret = -ENOMEM;
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index ca858d6bd37a..2f6388596f88 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -258,8 +258,9 @@ int iser_alloc_rx_descriptors(struct iser_conn *iser_conn,
258 goto alloc_login_buf_fail; 258 goto alloc_login_buf_fail;
259 259
260 iser_conn->num_rx_descs = session->cmds_max; 260 iser_conn->num_rx_descs = session->cmds_max;
261 iser_conn->rx_descs = kmalloc(iser_conn->num_rx_descs * 261 iser_conn->rx_descs = kmalloc_array(iser_conn->num_rx_descs,
262 sizeof(struct iser_rx_desc), GFP_KERNEL); 262 sizeof(struct iser_rx_desc),
263 GFP_KERNEL);
263 if (!iser_conn->rx_descs) 264 if (!iser_conn->rx_descs)
264 goto rx_desc_alloc_fail; 265 goto rx_desc_alloc_fail;
265 266
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index c35d2cd37d70..9786b24b956f 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1035,16 +1035,17 @@ static int srp_alloc_req_data(struct srp_rdma_ch *ch)
1035 1035
1036 for (i = 0; i < target->req_ring_size; ++i) { 1036 for (i = 0; i < target->req_ring_size; ++i) {
1037 req = &ch->req_ring[i]; 1037 req = &ch->req_ring[i];
1038 mr_list = kmalloc(target->mr_per_cmd * sizeof(void *), 1038 mr_list = kmalloc_array(target->mr_per_cmd, sizeof(void *),
1039 GFP_KERNEL); 1039 GFP_KERNEL);
1040 if (!mr_list) 1040 if (!mr_list)
1041 goto out; 1041 goto out;
1042 if (srp_dev->use_fast_reg) { 1042 if (srp_dev->use_fast_reg) {
1043 req->fr_list = mr_list; 1043 req->fr_list = mr_list;
1044 } else { 1044 } else {
1045 req->fmr_list = mr_list; 1045 req->fmr_list = mr_list;
1046 req->map_page = kmalloc(srp_dev->max_pages_per_mr * 1046 req->map_page = kmalloc_array(srp_dev->max_pages_per_mr,
1047 sizeof(void *), GFP_KERNEL); 1047 sizeof(void *),
1048 GFP_KERNEL);
1048 if (!req->map_page) 1049 if (!req->map_page)
1049 goto out; 1050 goto out;
1050 } 1051 }
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index dfec0e1fac29..3081c629a7f7 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -720,7 +720,7 @@ static struct srpt_ioctx **srpt_alloc_ioctx_ring(struct srpt_device *sdev,
720 WARN_ON(ioctx_size != sizeof(struct srpt_recv_ioctx) 720 WARN_ON(ioctx_size != sizeof(struct srpt_recv_ioctx)
721 && ioctx_size != sizeof(struct srpt_send_ioctx)); 721 && ioctx_size != sizeof(struct srpt_send_ioctx));
722 722
723 ring = kmalloc(ring_size * sizeof(ring[0]), GFP_KERNEL); 723 ring = kmalloc_array(ring_size, sizeof(ring[0]), GFP_KERNEL);
724 if (!ring) 724 if (!ring)
725 goto out; 725 goto out;
726 for (i = 0; i < ring_size; ++i) { 726 for (i = 0; i < ring_size; ++i) {
diff --git a/drivers/input/joystick/joydump.c b/drivers/input/joystick/joydump.c
index d1c6e4846a4a..7f4dff9a566f 100644
--- a/drivers/input/joystick/joydump.c
+++ b/drivers/input/joystick/joydump.c
@@ -80,7 +80,7 @@ static int joydump_connect(struct gameport *gameport, struct gameport_driver *dr
80 80
81 timeout = gameport_time(gameport, 10000); /* 10 ms */ 81 timeout = gameport_time(gameport, 10000); /* 10 ms */
82 82
83 buf = kmalloc(BUF_SIZE * sizeof(struct joydump), GFP_KERNEL); 83 buf = kmalloc_array(BUF_SIZE, sizeof(struct joydump), GFP_KERNEL);
84 if (!buf) { 84 if (!buf) {
85 printk(KERN_INFO "joydump: no memory for testing\n"); 85 printk(KERN_INFO "joydump: no memory for testing\n");
86 goto jd_end; 86 goto jd_end;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 5416f2b2ac21..4e7ce74e558d 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3567,8 +3567,8 @@ static void __init acpi_table_parse_srat_its(void)
3567 if (count <= 0) 3567 if (count <= 0)
3568 return; 3568 return;
3569 3569
3570 its_srat_maps = kmalloc(count * sizeof(struct its_srat_map), 3570 its_srat_maps = kmalloc_array(count, sizeof(struct its_srat_map),
3571 GFP_KERNEL); 3571 GFP_KERNEL);
3572 if (!its_srat_maps) { 3572 if (!its_srat_maps) {
3573 pr_warn("SRAT: Failed to allocate memory for its_srat_maps!\n"); 3573 pr_warn("SRAT: Failed to allocate memory for its_srat_maps!\n");
3574 return; 3574 return;
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index 7ac51798949d..ee510f901720 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -2268,7 +2268,8 @@ static int capidrv_addcontr(u16 contr, struct capi_profile *profp)
2268 strcpy(card->name, id); 2268 strcpy(card->name, id);
2269 card->contrnr = contr; 2269 card->contrnr = contr;
2270 card->nbchan = profp->nbchannel; 2270 card->nbchan = profp->nbchannel;
2271 card->bchans = kmalloc(sizeof(capidrv_bchan) * card->nbchan, GFP_ATOMIC); 2271 card->bchans = kmalloc_array(card->nbchan, sizeof(capidrv_bchan),
2272 GFP_ATOMIC);
2272 if (!card->bchans) { 2273 if (!card->bchans) {
2273 printk(KERN_WARNING 2274 printk(KERN_WARNING
2274 "capidrv: (%s) Could not allocate bchan-structs.\n", id); 2275 "capidrv: (%s) Could not allocate bchan-structs.\n", id);
diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index 56748af78c04..fd13ed44a54e 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -252,7 +252,7 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
252 return; 252 return;
253 if (l > 64) 253 if (l > 64)
254 l = 64; /* arbitrary limit */ 254 l = 64; /* arbitrary limit */
255 dbgline = kmalloc(3 * l, GFP_ATOMIC); 255 dbgline = kmalloc_array(3, l, GFP_ATOMIC);
256 if (!dbgline) 256 if (!dbgline)
257 return; 257 return;
258 for (i = 0; i < l; i++) { 258 for (i = 0; i < l; i++) {
@@ -272,7 +272,7 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
272 return; 272 return;
273 if (l > 64) 273 if (l > 64)
274 l = 64; /* arbitrary limit */ 274 l = 64; /* arbitrary limit */
275 dbgline = kmalloc(3 * l, GFP_ATOMIC); 275 dbgline = kmalloc_array(3, l, GFP_ATOMIC);
276 if (!dbgline) 276 if (!dbgline)
277 return; 277 return;
278 data += CAPIMSG_LEN(data); 278 data += CAPIMSG_LEN(data);
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 15482c5de33c..76b5407b5277 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -710,7 +710,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
710 cs->mode = M_UNKNOWN; 710 cs->mode = M_UNKNOWN;
711 cs->mstate = MS_UNINITIALIZED; 711 cs->mstate = MS_UNINITIALIZED;
712 712
713 cs->bcs = kmalloc(channels * sizeof(struct bc_state), GFP_KERNEL); 713 cs->bcs = kmalloc_array(channels, sizeof(struct bc_state), GFP_KERNEL);
714 cs->inbuf = kmalloc(sizeof(struct inbuf_t), GFP_KERNEL); 714 cs->inbuf = kmalloc(sizeof(struct inbuf_t), GFP_KERNEL);
715 if (!cs->bcs || !cs->inbuf) { 715 if (!cs->bcs || !cs->inbuf) {
716 pr_err("out of memory\n"); 716 pr_err("out of memory\n");
@@ -1089,7 +1089,7 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
1089 drv->owner = owner; 1089 drv->owner = owner;
1090 INIT_LIST_HEAD(&drv->list); 1090 INIT_LIST_HEAD(&drv->list);
1091 1091
1092 drv->cs = kmalloc(minors * sizeof *drv->cs, GFP_KERNEL); 1092 drv->cs = kmalloc_array(minors, sizeof(*drv->cs), GFP_KERNEL);
1093 if (!drv->cs) 1093 if (!drv->cs)
1094 goto error; 1094 goto error;
1095 1095
diff --git a/drivers/isdn/hisax/hfc_2bds0.c b/drivers/isdn/hisax/hfc_2bds0.c
index 86b82172e992..3715fa0343db 100644
--- a/drivers/isdn/hisax/hfc_2bds0.c
+++ b/drivers/isdn/hisax/hfc_2bds0.c
@@ -1024,7 +1024,7 @@ static unsigned int
1024 int i; 1024 int i;
1025 unsigned *send; 1025 unsigned *send;
1026 1026
1027 if (!(send = kmalloc(cnt * sizeof(unsigned int), GFP_ATOMIC))) { 1027 if (!(send = kmalloc_array(cnt, sizeof(unsigned int), GFP_ATOMIC))) {
1028 printk(KERN_WARNING 1028 printk(KERN_WARNING
1029 "HiSax: No memory for hfcd.send\n"); 1029 "HiSax: No memory for hfcd.send\n");
1030 return (NULL); 1030 return (NULL);
diff --git a/drivers/isdn/hisax/hfc_2bs0.c b/drivers/isdn/hisax/hfc_2bs0.c
index 14dada42874e..34d59992839a 100644
--- a/drivers/isdn/hisax/hfc_2bs0.c
+++ b/drivers/isdn/hisax/hfc_2bs0.c
@@ -557,7 +557,8 @@ init_send(struct BCState *bcs)
557{ 557{
558 int i; 558 int i;
559 559
560 if (!(bcs->hw.hfc.send = kmalloc(32 * sizeof(unsigned int), GFP_ATOMIC))) { 560 bcs->hw.hfc.send = kmalloc_array(32, sizeof(unsigned int), GFP_ATOMIC);
561 if (!bcs->hw.hfc.send) {
561 printk(KERN_WARNING 562 printk(KERN_WARNING
562 "HiSax: No memory for hfc.send\n"); 563 "HiSax: No memory for hfc.send\n");
563 return; 564 return;
diff --git a/drivers/isdn/hisax/netjet.c b/drivers/isdn/hisax/netjet.c
index b7f54fa29228..e932a152c405 100644
--- a/drivers/isdn/hisax/netjet.c
+++ b/drivers/isdn/hisax/netjet.c
@@ -912,8 +912,10 @@ setstack_tiger(struct PStack *st, struct BCState *bcs)
912void 912void
913inittiger(struct IsdnCardState *cs) 913inittiger(struct IsdnCardState *cs)
914{ 914{
915 if (!(cs->bcs[0].hw.tiger.send = kmalloc(NETJET_DMA_TXSIZE * sizeof(unsigned int), 915 cs->bcs[0].hw.tiger.send = kmalloc_array(NETJET_DMA_TXSIZE,
916 GFP_KERNEL | GFP_DMA))) { 916 sizeof(unsigned int),
917 GFP_KERNEL | GFP_DMA);
918 if (!cs->bcs[0].hw.tiger.send) {
917 printk(KERN_WARNING 919 printk(KERN_WARNING
918 "HiSax: No memory for tiger.send\n"); 920 "HiSax: No memory for tiger.send\n");
919 return; 921 return;
@@ -933,8 +935,10 @@ inittiger(struct IsdnCardState *cs)
933 cs->hw.njet.base + NETJET_DMA_READ_IRQ); 935 cs->hw.njet.base + NETJET_DMA_READ_IRQ);
934 outl(virt_to_bus(cs->bcs[0].hw.tiger.s_end), 936 outl(virt_to_bus(cs->bcs[0].hw.tiger.s_end),
935 cs->hw.njet.base + NETJET_DMA_READ_END); 937 cs->hw.njet.base + NETJET_DMA_READ_END);
936 if (!(cs->bcs[0].hw.tiger.rec = kmalloc(NETJET_DMA_RXSIZE * sizeof(unsigned int), 938 cs->bcs[0].hw.tiger.rec = kmalloc_array(NETJET_DMA_RXSIZE,
937 GFP_KERNEL | GFP_DMA))) { 939 sizeof(unsigned int),
940 GFP_KERNEL | GFP_DMA);
941 if (!cs->bcs[0].hw.tiger.rec) {
938 printk(KERN_WARNING 942 printk(KERN_WARNING
939 "HiSax: No memory for tiger.rec\n"); 943 "HiSax: No memory for tiger.rec\n");
940 return; 944 return;
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 7c6f3f5d9d9a..1644ac52548b 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -2089,7 +2089,8 @@ isdn_add_channels(isdn_driver_t *d, int drvidx, int n, int adding)
2089 skb_queue_purge(&d->rpqueue[j]); 2089 skb_queue_purge(&d->rpqueue[j]);
2090 kfree(d->rpqueue); 2090 kfree(d->rpqueue);
2091 } 2091 }
2092 if (!(d->rpqueue = kmalloc(sizeof(struct sk_buff_head) * m, GFP_ATOMIC))) { 2092 d->rpqueue = kmalloc_array(m, sizeof(struct sk_buff_head), GFP_ATOMIC);
2093 if (!d->rpqueue) {
2093 printk(KERN_WARNING "register_isdn: Could not alloc rpqueue\n"); 2094 printk(KERN_WARNING "register_isdn: Could not alloc rpqueue\n");
2094 if (!adding) { 2095 if (!adding) {
2095 kfree(d->rcvcount); 2096 kfree(d->rcvcount);
@@ -2103,7 +2104,8 @@ isdn_add_channels(isdn_driver_t *d, int drvidx, int n, int adding)
2103 2104
2104 if ((adding) && (d->rcv_waitq)) 2105 if ((adding) && (d->rcv_waitq))
2105 kfree(d->rcv_waitq); 2106 kfree(d->rcv_waitq);
2106 d->rcv_waitq = kmalloc(sizeof(wait_queue_head_t) * 2 * m, GFP_ATOMIC); 2107 d->rcv_waitq = kmalloc(array3_size(sizeof(wait_queue_head_t), 2, m),
2108 GFP_ATOMIC);
2107 if (!d->rcv_waitq) { 2109 if (!d->rcv_waitq) {
2108 printk(KERN_WARNING "register_isdn: Could not alloc rcv_waitq\n"); 2110 printk(KERN_WARNING "register_isdn: Could not alloc rcv_waitq\n");
2109 if (!adding) { 2111 if (!adding) {
diff --git a/drivers/lightnvm/pblk-init.c b/drivers/lightnvm/pblk-init.c
index 491df0fa0835..f497a77423a2 100644
--- a/drivers/lightnvm/pblk-init.c
+++ b/drivers/lightnvm/pblk-init.c
@@ -833,8 +833,8 @@ static int pblk_alloc_line_meta(struct pblk *pblk, struct pblk_line *line)
833 goto free_blk_bitmap; 833 goto free_blk_bitmap;
834 834
835 835
836 line->chks = kmalloc(lm->blk_per_line * sizeof(struct nvm_chk_meta), 836 line->chks = kmalloc_array(lm->blk_per_line,
837 GFP_KERNEL); 837 sizeof(struct nvm_chk_meta), GFP_KERNEL);
838 if (!line->chks) 838 if (!line->chks)
839 goto free_erase_bitmap; 839 goto free_erase_bitmap;
840 840
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index fc68c7aaef8e..136e7e66d870 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -2743,7 +2743,8 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
2743 r = -ENOMEM; 2743 r = -ENOMEM;
2744 goto bad; 2744 goto bad;
2745 } 2745 }
2746 section_req->iv = kmalloc(ivsize * 2, GFP_KERNEL); 2746 section_req->iv = kmalloc_array(ivsize, 2,
2747 GFP_KERNEL);
2747 if (!section_req->iv) { 2748 if (!section_req->iv) {
2748 skcipher_request_free(section_req); 2749 skcipher_request_free(section_req);
2749 *error = "Unable to allocate iv"; 2750 *error = "Unable to allocate iv";
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index f745404da721..97de7a7334d4 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -326,8 +326,8 @@ static int init_origin_hash(void)
326{ 326{
327 int i; 327 int i;
328 328
329 _origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head), 329 _origins = kmalloc_array(ORIGIN_HASH_SIZE, sizeof(struct list_head),
330 GFP_KERNEL); 330 GFP_KERNEL);
331 if (!_origins) { 331 if (!_origins) {
332 DMERR("unable to allocate memory for _origins"); 332 DMERR("unable to allocate memory for _origins");
333 return -ENOMEM; 333 return -ENOMEM;
@@ -335,8 +335,9 @@ static int init_origin_hash(void)
335 for (i = 0; i < ORIGIN_HASH_SIZE; i++) 335 for (i = 0; i < ORIGIN_HASH_SIZE; i++)
336 INIT_LIST_HEAD(_origins + i); 336 INIT_LIST_HEAD(_origins + i);
337 337
338 _dm_origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head), 338 _dm_origins = kmalloc_array(ORIGIN_HASH_SIZE,
339 GFP_KERNEL); 339 sizeof(struct list_head),
340 GFP_KERNEL);
340 if (!_dm_origins) { 341 if (!_dm_origins) {
341 DMERR("unable to allocate memory for _dm_origins"); 342 DMERR("unable to allocate memory for _dm_origins");
342 kfree(_origins); 343 kfree(_origins);
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
index 56059fb56e2d..21de30b4e2a1 100644
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -915,7 +915,9 @@ static int parse_histogram(const char *h, unsigned *n_histogram_entries,
915 if (*q == ',') 915 if (*q == ',')
916 (*n_histogram_entries)++; 916 (*n_histogram_entries)++;
917 917
918 *histogram_boundaries = kmalloc(*n_histogram_entries * sizeof(unsigned long long), GFP_KERNEL); 918 *histogram_boundaries = kmalloc_array(*n_histogram_entries,
919 sizeof(unsigned long long),
920 GFP_KERNEL);
919 if (!*histogram_boundaries) 921 if (!*histogram_boundaries)
920 return -ENOMEM; 922 return -ENOMEM;
921 923
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index caa51dd351b6..938766794c2e 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -561,7 +561,7 @@ static char **realloc_argv(unsigned *size, char **old_argv)
561 new_size = 8; 561 new_size = 8;
562 gfp = GFP_NOIO; 562 gfp = GFP_NOIO;
563 } 563 }
564 argv = kmalloc(new_size * sizeof(*argv), gfp); 564 argv = kmalloc_array(new_size, sizeof(*argv), gfp);
565 if (argv) { 565 if (argv) {
566 memcpy(argv, old_argv, *size * sizeof(*argv)); 566 memcpy(argv, old_argv, *size * sizeof(*argv));
567 *size = new_size; 567 *size = new_size;
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index 239c7bb3929b..01c8329b512d 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -789,8 +789,8 @@ static int bitmap_storage_alloc(struct bitmap_storage *store,
789 num_pages = DIV_ROUND_UP(bytes, PAGE_SIZE); 789 num_pages = DIV_ROUND_UP(bytes, PAGE_SIZE);
790 offset = slot_number * num_pages; 790 offset = slot_number * num_pages;
791 791
792 store->filemap = kmalloc(sizeof(struct page *) 792 store->filemap = kmalloc_array(num_pages, sizeof(struct page *),
793 * num_pages, GFP_KERNEL); 793 GFP_KERNEL);
794 if (!store->filemap) 794 if (!store->filemap)
795 return -ENOMEM; 795 return -ENOMEM;
796 796
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 0b344d087581..e7c0ecd19234 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -126,8 +126,8 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
126 if (!r1_bio) 126 if (!r1_bio)
127 return NULL; 127 return NULL;
128 128
129 rps = kmalloc(sizeof(struct resync_pages) * pi->raid_disks, 129 rps = kmalloc_array(pi->raid_disks, sizeof(struct resync_pages),
130 gfp_flags); 130 gfp_flags);
131 if (!rps) 131 if (!rps)
132 goto out_free_r1bio; 132 goto out_free_r1bio;
133 133
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1147ae59e3b6..e35db73b9b9e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -175,7 +175,7 @@ static void * r10buf_pool_alloc(gfp_t gfp_flags, void *data)
175 nalloc_rp = nalloc; 175 nalloc_rp = nalloc;
176 else 176 else
177 nalloc_rp = nalloc * 2; 177 nalloc_rp = nalloc * 2;
178 rps = kmalloc(sizeof(struct resync_pages) * nalloc_rp, gfp_flags); 178 rps = kmalloc_array(nalloc_rp, sizeof(struct resync_pages), gfp_flags);
179 if (!rps) 179 if (!rps)
180 goto out_free_r10bio; 180 goto out_free_r10bio;
181 181
diff --git a/drivers/media/pci/bt8xx/bttv-risc.c b/drivers/media/pci/bt8xx/bttv-risc.c
index 6a6be0b49f70..74aff6877d9c 100644
--- a/drivers/media/pci/bt8xx/bttv-risc.c
+++ b/drivers/media/pci/bt8xx/bttv-risc.c
@@ -256,7 +256,8 @@ bttv_risc_overlay(struct bttv *btv, struct btcx_riscmem *risc,
256 u32 addr; 256 u32 addr;
257 257
258 /* skip list for window clipping */ 258 /* skip list for window clipping */
259 if (NULL == (skips = kmalloc(sizeof(*skips) * ov->nclips,GFP_KERNEL))) 259 skips = kmalloc_array(ov->nclips, sizeof(*skips),GFP_KERNEL);
260 if (NULL == skips)
260 return -ENOMEM; 261 return -ENOMEM;
261 262
262 /* estimate risc mem: worst case is (1.5*clip+1) * lines instructions 263 /* estimate risc mem: worst case is (1.5*clip+1) * lines instructions
diff --git a/drivers/media/pci/ivtv/ivtvfb.c b/drivers/media/pci/ivtv/ivtvfb.c
index 8e62b8be6529..b19058e36853 100644
--- a/drivers/media/pci/ivtv/ivtvfb.c
+++ b/drivers/media/pci/ivtv/ivtvfb.c
@@ -1077,7 +1077,7 @@ static int ivtvfb_init_vidmode(struct ivtv *itv)
1077 1077
1078 /* Allocate the pseudo palette */ 1078 /* Allocate the pseudo palette */
1079 oi->ivtvfb_info.pseudo_palette = 1079 oi->ivtvfb_info.pseudo_palette =
1080 kmalloc(sizeof(u32) * 16, GFP_KERNEL|__GFP_NOWARN); 1080 kmalloc_array(16, sizeof(u32), GFP_KERNEL|__GFP_NOWARN);
1081 1081
1082 if (!oi->ivtvfb_info.pseudo_palette) { 1082 if (!oi->ivtvfb_info.pseudo_palette) {
1083 IVTVFB_ERR("abort, unable to alloc pseudo palette\n"); 1083 IVTVFB_ERR("abort, unable to alloc pseudo palette\n");
diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
index 82ec216f2ad8..59031018985e 100644
--- a/drivers/media/platform/vivid/vivid-core.c
+++ b/drivers/media/platform/vivid/vivid-core.c
@@ -859,8 +859,9 @@ static int vivid_create_instance(struct platform_device *pdev, int inst)
859 /* create a string array containing the names of all the preset timings */ 859 /* create a string array containing the names of all the preset timings */
860 while (v4l2_dv_timings_presets[dev->query_dv_timings_size].bt.width) 860 while (v4l2_dv_timings_presets[dev->query_dv_timings_size].bt.width)
861 dev->query_dv_timings_size++; 861 dev->query_dv_timings_size++;
862 dev->query_dv_timings_qmenu = kmalloc(dev->query_dv_timings_size * 862 dev->query_dv_timings_qmenu = kmalloc_array(dev->query_dv_timings_size,
863 (sizeof(void *) + 32), GFP_KERNEL); 863 (sizeof(void *) + 32),
864 GFP_KERNEL);
864 if (dev->query_dv_timings_qmenu == NULL) 865 if (dev->query_dv_timings_qmenu == NULL)
865 goto free_dev; 866 goto free_dev;
866 for (i = 0; i < dev->query_dv_timings_size; i++) { 867 for (i = 0; i < dev->query_dv_timings_size; i++) {
diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
index b51fc372ca25..a771e0a52610 100644
--- a/drivers/media/usb/cpia2/cpia2_usb.c
+++ b/drivers/media/usb/cpia2/cpia2_usb.c
@@ -663,7 +663,8 @@ static int submit_urbs(struct camera_data *cam)
663 if (cam->sbuf[i].data) 663 if (cam->sbuf[i].data)
664 continue; 664 continue;
665 cam->sbuf[i].data = 665 cam->sbuf[i].data =
666 kmalloc(FRAMES_PER_DESC * FRAME_SIZE_PER_DESC, GFP_KERNEL); 666 kmalloc_array(FRAME_SIZE_PER_DESC, FRAMES_PER_DESC,
667 GFP_KERNEL);
667 if (!cam->sbuf[i].data) { 668 if (!cam->sbuf[i].data) {
668 while (--i >= 0) { 669 while (--i >= 0) {
669 kfree(cam->sbuf[i].data); 670 kfree(cam->sbuf[i].data);
diff --git a/drivers/media/usb/cx231xx/cx231xx-audio.c b/drivers/media/usb/cx231xx/cx231xx-audio.c
index d96236d786d1..c4a84fb930b6 100644
--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -710,7 +710,7 @@ static int cx231xx_audio_init(struct cx231xx *dev)
710 dev_info(dev->dev, 710 dev_info(dev->dev,
711 "audio EndPoint Addr 0x%x, Alternate settings: %i\n", 711 "audio EndPoint Addr 0x%x, Alternate settings: %i\n",
712 adev->end_point_addr, adev->num_alt); 712 adev->end_point_addr, adev->num_alt);
713 adev->alt_max_pkt_size = kmalloc(32 * adev->num_alt, GFP_KERNEL); 713 adev->alt_max_pkt_size = kmalloc_array(32, adev->num_alt, GFP_KERNEL);
714 if (!adev->alt_max_pkt_size) { 714 if (!adev->alt_max_pkt_size) {
715 err = -ENOMEM; 715 err = -ENOMEM;
716 goto err_free_card; 716 goto err_free_card;
diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index ed9bcaf08d5e..19c6a0354ce0 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1143,7 +1143,8 @@ static int go7007_usb_probe(struct usb_interface *intf,
1143 usb->intr_urb = usb_alloc_urb(0, GFP_KERNEL); 1143 usb->intr_urb = usb_alloc_urb(0, GFP_KERNEL);
1144 if (usb->intr_urb == NULL) 1144 if (usb->intr_urb == NULL)
1145 goto allocfail; 1145 goto allocfail;
1146 usb->intr_urb->transfer_buffer = kmalloc(2*sizeof(u16), GFP_KERNEL); 1146 usb->intr_urb->transfer_buffer = kmalloc_array(2, sizeof(u16),
1147 GFP_KERNEL);
1147 if (usb->intr_urb->transfer_buffer == NULL) 1148 if (usb->intr_urb->transfer_buffer == NULL)
1148 goto allocfail; 1149 goto allocfail;
1149 1150
diff --git a/drivers/media/usb/gspca/t613.c b/drivers/media/usb/gspca/t613.c
index 0ae557cd15ef..445782919446 100644
--- a/drivers/media/usb/gspca/t613.c
+++ b/drivers/media/usb/gspca/t613.c
@@ -363,7 +363,7 @@ static void reg_w_ixbuf(struct gspca_dev *gspca_dev,
363 if (len * 2 <= USB_BUF_SZ) { 363 if (len * 2 <= USB_BUF_SZ) {
364 p = tmpbuf = gspca_dev->usb_buf; 364 p = tmpbuf = gspca_dev->usb_buf;
365 } else { 365 } else {
366 p = tmpbuf = kmalloc(len * 2, GFP_KERNEL); 366 p = tmpbuf = kmalloc_array(len, 2, GFP_KERNEL);
367 if (!tmpbuf) { 367 if (!tmpbuf) {
368 pr_err("Out of memory\n"); 368 pr_err("Out of memory\n");
369 return; 369 return;
diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c
index 72bd893c9659..468f5ccf4ae6 100644
--- a/drivers/media/usb/stk1160/stk1160-core.c
+++ b/drivers/media/usb/stk1160/stk1160-core.c
@@ -290,8 +290,9 @@ static int stk1160_probe(struct usb_interface *interface,
290 return -ENODEV; 290 return -ENODEV;
291 291
292 /* Alloc an array for all possible max_pkt_size */ 292 /* Alloc an array for all possible max_pkt_size */
293 alt_max_pkt_size = kmalloc(sizeof(alt_max_pkt_size[0]) * 293 alt_max_pkt_size = kmalloc_array(interface->num_altsetting,
294 interface->num_altsetting, GFP_KERNEL); 294 sizeof(alt_max_pkt_size[0]),
295 GFP_KERNEL);
295 if (alt_max_pkt_size == NULL) 296 if (alt_max_pkt_size == NULL)
296 return -ENOMEM; 297 return -ENOMEM;
297 298
diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c
index aa85fe31c835..96055de6e8ce 100644
--- a/drivers/media/usb/tm6000/tm6000-video.c
+++ b/drivers/media/usb/tm6000/tm6000-video.c
@@ -463,11 +463,12 @@ static int tm6000_alloc_urb_buffers(struct tm6000_core *dev)
463 if (dev->urb_buffer) 463 if (dev->urb_buffer)
464 return 0; 464 return 0;
465 465
466 dev->urb_buffer = kmalloc(sizeof(void *)*num_bufs, GFP_KERNEL); 466 dev->urb_buffer = kmalloc_array(num_bufs, sizeof(void *), GFP_KERNEL);
467 if (!dev->urb_buffer) 467 if (!dev->urb_buffer)
468 return -ENOMEM; 468 return -ENOMEM;
469 469
470 dev->urb_dma = kmalloc(sizeof(dma_addr_t *)*num_bufs, GFP_KERNEL); 470 dev->urb_dma = kmalloc_array(num_bufs, sizeof(dma_addr_t *),
471 GFP_KERNEL);
471 if (!dev->urb_dma) 472 if (!dev->urb_dma)
472 return -ENOMEM; 473 return -ENOMEM;
473 474
@@ -583,12 +584,14 @@ static int tm6000_prepare_isoc(struct tm6000_core *dev)
583 584
584 dev->isoc_ctl.num_bufs = num_bufs; 585 dev->isoc_ctl.num_bufs = num_bufs;
585 586
586 dev->isoc_ctl.urb = kmalloc(sizeof(void *)*num_bufs, GFP_KERNEL); 587 dev->isoc_ctl.urb = kmalloc_array(num_bufs, sizeof(void *),
588 GFP_KERNEL);
587 if (!dev->isoc_ctl.urb) 589 if (!dev->isoc_ctl.urb)
588 return -ENOMEM; 590 return -ENOMEM;
589 591
590 dev->isoc_ctl.transfer_buffer = kmalloc(sizeof(void *)*num_bufs, 592 dev->isoc_ctl.transfer_buffer = kmalloc_array(num_bufs,
591 GFP_KERNEL); 593 sizeof(void *),
594 GFP_KERNEL);
592 if (!dev->isoc_ctl.transfer_buffer) { 595 if (!dev->isoc_ctl.transfer_buffer) {
593 kfree(dev->isoc_ctl.urb); 596 kfree(dev->isoc_ctl.urb);
594 return -ENOMEM; 597 return -ENOMEM;
diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
index 0f5954a1fea2..f29d1bef0293 100644
--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -1492,7 +1492,8 @@ static int usbvision_probe(struct usb_interface *intf,
1492 1492
1493 usbvision->num_alt = uif->num_altsetting; 1493 usbvision->num_alt = uif->num_altsetting;
1494 PDEBUG(DBG_PROBE, "Alternate settings: %i", usbvision->num_alt); 1494 PDEBUG(DBG_PROBE, "Alternate settings: %i", usbvision->num_alt);
1495 usbvision->alt_max_pkt_size = kmalloc(32 * usbvision->num_alt, GFP_KERNEL); 1495 usbvision->alt_max_pkt_size = kmalloc_array(32, usbvision->num_alt,
1496 GFP_KERNEL);
1496 if (!usbvision->alt_max_pkt_size) { 1497 if (!usbvision->alt_max_pkt_size) {
1497 ret = -ENOMEM; 1498 ret = -ENOMEM;
1498 goto err_pkt; 1499 goto err_pkt;
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index b28c997a7ab0..a88b2e51a666 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -513,8 +513,8 @@ static int uvc_video_clock_init(struct uvc_streaming *stream)
513 spin_lock_init(&clock->lock); 513 spin_lock_init(&clock->lock);
514 clock->size = 32; 514 clock->size = 32;
515 515
516 clock->samples = kmalloc(clock->size * sizeof(*clock->samples), 516 clock->samples = kmalloc_array(clock->size, sizeof(*clock->samples),
517 GFP_KERNEL); 517 GFP_KERNEL);
518 if (clock->samples == NULL) 518 if (clock->samples == NULL)
519 return -ENOMEM; 519 return -ENOMEM;
520 520
diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
index 2e5c346f9c30..78155f596f74 100644
--- a/drivers/media/v4l2-core/videobuf-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
@@ -175,7 +175,8 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
175 dma->offset = data & ~PAGE_MASK; 175 dma->offset = data & ~PAGE_MASK;
176 dma->size = size; 176 dma->size = size;
177 dma->nr_pages = last-first+1; 177 dma->nr_pages = last-first+1;
178 dma->pages = kmalloc(dma->nr_pages * sizeof(struct page *), GFP_KERNEL); 178 dma->pages = kmalloc_array(dma->nr_pages, sizeof(struct page *),
179 GFP_KERNEL);
179 if (NULL == dma->pages) 180 if (NULL == dma->pages)
180 return -ENOMEM; 181 return -ENOMEM;
181 182
diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index a15181fa45f7..716fc8ed31d3 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -1201,7 +1201,8 @@ static int msb_read_boot_blocks(struct msb_data *msb)
1201 dbg_verbose("Start of a scan for the boot blocks"); 1201 dbg_verbose("Start of a scan for the boot blocks");
1202 1202
1203 if (!msb->boot_page) { 1203 if (!msb->boot_page) {
1204 page = kmalloc(sizeof(struct ms_boot_page)*2, GFP_KERNEL); 1204 page = kmalloc_array(2, sizeof(struct ms_boot_page),
1205 GFP_KERNEL);
1205 if (!page) 1206 if (!page)
1206 return -ENOMEM; 1207 return -ENOMEM;
1207 1208
@@ -1341,7 +1342,8 @@ static int msb_ftl_initialize(struct msb_data *msb)
1341 msb->used_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL); 1342 msb->used_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL);
1342 msb->erased_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL); 1343 msb->erased_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL);
1343 msb->lba_to_pba_table = 1344 msb->lba_to_pba_table =
1344 kmalloc(msb->logical_block_count * sizeof(u16), GFP_KERNEL); 1345 kmalloc_array(msb->logical_block_count, sizeof(u16),
1346 GFP_KERNEL);
1345 1347
1346 if (!msb->used_blocks_bitmap || !msb->lba_to_pba_table || 1348 if (!msb->used_blocks_bitmap || !msb->lba_to_pba_table ||
1347 !msb->erased_blocks_bitmap) { 1349 !msb->erased_blocks_bitmap) {
diff --git a/drivers/message/fusion/mptlan.c b/drivers/message/fusion/mptlan.c
index 4cbed4d06aa7..ebc00d47abf5 100644
--- a/drivers/message/fusion/mptlan.c
+++ b/drivers/message/fusion/mptlan.c
@@ -394,7 +394,8 @@ mpt_lan_open(struct net_device *dev)
394 "a moment.\n"); 394 "a moment.\n");
395 } 395 }
396 396
397 priv->mpt_txfidx = kmalloc(priv->tx_max_out * sizeof(int), GFP_KERNEL); 397 priv->mpt_txfidx = kmalloc_array(priv->tx_max_out, sizeof(int),
398 GFP_KERNEL);
398 if (priv->mpt_txfidx == NULL) 399 if (priv->mpt_txfidx == NULL)
399 goto out; 400 goto out;
400 priv->mpt_txfidx_tail = -1; 401 priv->mpt_txfidx_tail = -1;
@@ -408,8 +409,8 @@ mpt_lan_open(struct net_device *dev)
408 409
409 dlprintk((KERN_INFO MYNAM "@lo: Finished initializing SendCtl\n")); 410 dlprintk((KERN_INFO MYNAM "@lo: Finished initializing SendCtl\n"));
410 411
411 priv->mpt_rxfidx = kmalloc(priv->max_buckets_out * sizeof(int), 412 priv->mpt_rxfidx = kmalloc_array(priv->max_buckets_out, sizeof(int),
412 GFP_KERNEL); 413 GFP_KERNEL);
413 if (priv->mpt_rxfidx == NULL) 414 if (priv->mpt_rxfidx == NULL)
414 goto out_SendCtl; 415 goto out_SendCtl;
415 priv->mpt_rxfidx_tail = -1; 416 priv->mpt_rxfidx_tail = -1;
diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c
index 34a5a41578d7..59dc24bb70ec 100644
--- a/drivers/misc/eeprom/idt_89hpesx.c
+++ b/drivers/misc/eeprom/idt_89hpesx.c
@@ -964,7 +964,7 @@ static ssize_t idt_dbgfs_csr_write(struct file *filep, const char __user *ubuf,
964 if (colon_ch != NULL) { 964 if (colon_ch != NULL) {
965 csraddr_len = colon_ch - buf; 965 csraddr_len = colon_ch - buf;
966 csraddr_str = 966 csraddr_str =
967 kmalloc(sizeof(char)*(csraddr_len + 1), GFP_KERNEL); 967 kmalloc(csraddr_len + 1, GFP_KERNEL);
968 if (csraddr_str == NULL) { 968 if (csraddr_str == NULL) {
969 ret = -ENOMEM; 969 ret = -ENOMEM;
970 goto free_buf; 970 goto free_buf;
diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index 0339538c182d..b4d7774cfe07 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -449,12 +449,14 @@ static int qp_alloc_ppn_set(void *prod_q,
449 return VMCI_ERROR_ALREADY_EXISTS; 449 return VMCI_ERROR_ALREADY_EXISTS;
450 450
451 produce_ppns = 451 produce_ppns =
452 kmalloc(num_produce_pages * sizeof(*produce_ppns), GFP_KERNEL); 452 kmalloc_array(num_produce_pages, sizeof(*produce_ppns),
453 GFP_KERNEL);
453 if (!produce_ppns) 454 if (!produce_ppns)
454 return VMCI_ERROR_NO_MEM; 455 return VMCI_ERROR_NO_MEM;
455 456
456 consume_ppns = 457 consume_ppns =
457 kmalloc(num_consume_pages * sizeof(*consume_ppns), GFP_KERNEL); 458 kmalloc_array(num_consume_pages, sizeof(*consume_ppns),
459 GFP_KERNEL);
458 if (!consume_ppns) { 460 if (!consume_ppns) {
459 kfree(produce_ppns); 461 kfree(produce_ppns);
460 return VMCI_ERROR_NO_MEM; 462 return VMCI_ERROR_NO_MEM;
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index f5695be14499..5a81bd8073bc 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -758,7 +758,9 @@ static int cfi_intelext_partition_fixup(struct mtd_info *mtd,
758 newcfi = kmalloc(sizeof(struct cfi_private) + numvirtchips * sizeof(struct flchip), GFP_KERNEL); 758 newcfi = kmalloc(sizeof(struct cfi_private) + numvirtchips * sizeof(struct flchip), GFP_KERNEL);
759 if (!newcfi) 759 if (!newcfi)
760 return -ENOMEM; 760 return -ENOMEM;
761 shared = kmalloc(sizeof(struct flchip_shared) * cfi->numchips, GFP_KERNEL); 761 shared = kmalloc_array(cfi->numchips,
762 sizeof(struct flchip_shared),
763 GFP_KERNEL);
762 if (!shared) { 764 if (!shared) {
763 kfree(newcfi); 765 kfree(newcfi);
764 return -ENOMEM; 766 return -ENOMEM;
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 7c889eca9ab0..22506d22194e 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -692,8 +692,9 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd)
692 mtd->size = devsize * cfi->numchips; 692 mtd->size = devsize * cfi->numchips;
693 693
694 mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips; 694 mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips;
695 mtd->eraseregions = kmalloc(sizeof(struct mtd_erase_region_info) 695 mtd->eraseregions = kmalloc_array(mtd->numeraseregions,
696 * mtd->numeraseregions, GFP_KERNEL); 696 sizeof(struct mtd_erase_region_info),
697 GFP_KERNEL);
697 if (!mtd->eraseregions) 698 if (!mtd->eraseregions)
698 goto setup_err; 699 goto setup_err;
699 700
diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
index 7b7658a05036..35aa72b720a6 100644
--- a/drivers/mtd/chips/cfi_cmdset_0020.c
+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
@@ -184,8 +184,9 @@ static struct mtd_info *cfi_staa_setup(struct map_info *map)
184 mtd->size = devsize * cfi->numchips; 184 mtd->size = devsize * cfi->numchips;
185 185
186 mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips; 186 mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips;
187 mtd->eraseregions = kmalloc(sizeof(struct mtd_erase_region_info) 187 mtd->eraseregions = kmalloc_array(mtd->numeraseregions,
188 * mtd->numeraseregions, GFP_KERNEL); 188 sizeof(struct mtd_erase_region_info),
189 GFP_KERNEL);
189 if (!mtd->eraseregions) { 190 if (!mtd->eraseregions) {
190 kfree(cfi->cmdset_priv); 191 kfree(cfi->cmdset_priv);
191 kfree(mtd); 192 kfree(mtd);
diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
index ef6ad2551d57..1f8063c6aed1 100644
--- a/drivers/mtd/ftl.c
+++ b/drivers/mtd/ftl.c
@@ -201,15 +201,16 @@ static int build_maps(partition_t *part)
201 /* Set up erase unit maps */ 201 /* Set up erase unit maps */
202 part->DataUnits = le16_to_cpu(part->header.NumEraseUnits) - 202 part->DataUnits = le16_to_cpu(part->header.NumEraseUnits) -
203 part->header.NumTransferUnits; 203 part->header.NumTransferUnits;
204 part->EUNInfo = kmalloc(part->DataUnits * sizeof(struct eun_info_t), 204 part->EUNInfo = kmalloc_array(part->DataUnits, sizeof(struct eun_info_t),
205 GFP_KERNEL); 205 GFP_KERNEL);
206 if (!part->EUNInfo) 206 if (!part->EUNInfo)
207 goto out; 207 goto out;
208 for (i = 0; i < part->DataUnits; i++) 208 for (i = 0; i < part->DataUnits; i++)
209 part->EUNInfo[i].Offset = 0xffffffff; 209 part->EUNInfo[i].Offset = 0xffffffff;
210 part->XferInfo = 210 part->XferInfo =
211 kmalloc(part->header.NumTransferUnits * sizeof(struct xfer_info_t), 211 kmalloc_array(part->header.NumTransferUnits,
212 GFP_KERNEL); 212 sizeof(struct xfer_info_t),
213 GFP_KERNEL);
213 if (!part->XferInfo) 214 if (!part->XferInfo)
214 goto out_EUNInfo; 215 goto out_EUNInfo;
215 216
@@ -269,8 +270,8 @@ static int build_maps(partition_t *part)
269 memset(part->VirtualBlockMap, 0xff, blocks * sizeof(uint32_t)); 270 memset(part->VirtualBlockMap, 0xff, blocks * sizeof(uint32_t));
270 part->BlocksPerUnit = (1 << header.EraseUnitSize) >> header.BlockSize; 271 part->BlocksPerUnit = (1 << header.EraseUnitSize) >> header.BlockSize;
271 272
272 part->bam_cache = kmalloc(part->BlocksPerUnit * sizeof(uint32_t), 273 part->bam_cache = kmalloc_array(part->BlocksPerUnit, sizeof(uint32_t),
273 GFP_KERNEL); 274 GFP_KERNEL);
274 if (!part->bam_cache) 275 if (!part->bam_cache)
275 goto out_VirtualBlockMap; 276 goto out_VirtualBlockMap;
276 277
diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
index 2d598412972d..10d977e9709d 100644
--- a/drivers/mtd/inftlmount.c
+++ b/drivers/mtd/inftlmount.c
@@ -270,7 +270,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
270 inftl->nb_blocks = ip->lastUnit + 1; 270 inftl->nb_blocks = ip->lastUnit + 1;
271 271
272 /* Memory alloc */ 272 /* Memory alloc */
273 inftl->PUtable = kmalloc(inftl->nb_blocks * sizeof(u16), GFP_KERNEL); 273 inftl->PUtable = kmalloc_array(inftl->nb_blocks, sizeof(u16),
274 GFP_KERNEL);
274 if (!inftl->PUtable) { 275 if (!inftl->PUtable) {
275 printk(KERN_WARNING "INFTL: allocation of PUtable " 276 printk(KERN_WARNING "INFTL: allocation of PUtable "
276 "failed (%zd bytes)\n", 277 "failed (%zd bytes)\n",
@@ -278,7 +279,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
278 return -ENOMEM; 279 return -ENOMEM;
279 } 280 }
280 281
281 inftl->VUtable = kmalloc(inftl->nb_blocks * sizeof(u16), GFP_KERNEL); 282 inftl->VUtable = kmalloc_array(inftl->nb_blocks, sizeof(u16),
283 GFP_KERNEL);
282 if (!inftl->VUtable) { 284 if (!inftl->VUtable) {
283 kfree(inftl->PUtable); 285 kfree(inftl->PUtable);
284 printk(KERN_WARNING "INFTL: allocation of VUtable " 286 printk(KERN_WARNING "INFTL: allocation of VUtable "
diff --git a/drivers/mtd/lpddr/lpddr_cmds.c b/drivers/mtd/lpddr/lpddr_cmds.c
index 5c5ba3c7c79d..b13557fe52bd 100644
--- a/drivers/mtd/lpddr/lpddr_cmds.c
+++ b/drivers/mtd/lpddr/lpddr_cmds.c
@@ -78,7 +78,7 @@ struct mtd_info *lpddr_cmdset(struct map_info *map)
78 mtd->erasesize = 1 << lpddr->qinfo->UniformBlockSizeShift; 78 mtd->erasesize = 1 << lpddr->qinfo->UniformBlockSizeShift;
79 mtd->writesize = 1 << lpddr->qinfo->BufSizeShift; 79 mtd->writesize = 1 << lpddr->qinfo->BufSizeShift;
80 80
81 shared = kmalloc(sizeof(struct flchip_shared) * lpddr->numchips, 81 shared = kmalloc_array(lpddr->numchips, sizeof(struct flchip_shared),
82 GFP_KERNEL); 82 GFP_KERNEL);
83 if (!shared) { 83 if (!shared) {
84 kfree(lpddr); 84 kfree(lpddr);
diff --git a/drivers/mtd/maps/vmu-flash.c b/drivers/mtd/maps/vmu-flash.c
index 6b223cfe92b7..c5d4b6589488 100644
--- a/drivers/mtd/maps/vmu-flash.c
+++ b/drivers/mtd/maps/vmu-flash.c
@@ -629,15 +629,15 @@ static int vmu_connect(struct maple_device *mdev)
629 * Not sure there are actually any multi-partition devices in the 629 * Not sure there are actually any multi-partition devices in the
630 * real world, but the hardware supports them, so, so will we 630 * real world, but the hardware supports them, so, so will we
631 */ 631 */
632 card->parts = kmalloc(sizeof(struct vmupart) * card->partitions, 632 card->parts = kmalloc_array(card->partitions, sizeof(struct vmupart),
633 GFP_KERNEL); 633 GFP_KERNEL);
634 if (!card->parts) { 634 if (!card->parts) {
635 error = -ENOMEM; 635 error = -ENOMEM;
636 goto fail_partitions; 636 goto fail_partitions;
637 } 637 }
638 638
639 card->mtd = kmalloc(sizeof(struct mtd_info) * card->partitions, 639 card->mtd = kmalloc_array(card->partitions, sizeof(struct mtd_info),
640 GFP_KERNEL); 640 GFP_KERNEL);
641 if (!card->mtd) { 641 if (!card->mtd) {
642 error = -ENOMEM; 642 error = -ENOMEM;
643 goto fail_mtd_info; 643 goto fail_mtd_info;
diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 6b86d1a73cf2..cbc5925e6440 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -778,8 +778,9 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c
778 concat->mtd.erasesize = max_erasesize; 778 concat->mtd.erasesize = max_erasesize;
779 concat->mtd.numeraseregions = num_erase_region; 779 concat->mtd.numeraseregions = num_erase_region;
780 concat->mtd.eraseregions = erase_region_p = 780 concat->mtd.eraseregions = erase_region_p =
781 kmalloc(num_erase_region * 781 kmalloc_array(num_erase_region,
782 sizeof (struct mtd_erase_region_info), GFP_KERNEL); 782 sizeof(struct mtd_erase_region_info),
783 GFP_KERNEL);
783 if (!erase_region_p) { 784 if (!erase_region_p) {
784 kfree(concat); 785 kfree(concat);
785 printk 786 printk
diff --git a/drivers/mtd/mtdswap.c b/drivers/mtd/mtdswap.c
index 7161f8a17f62..6593879595e3 100644
--- a/drivers/mtd/mtdswap.c
+++ b/drivers/mtd/mtdswap.c
@@ -1340,7 +1340,7 @@ static int mtdswap_init(struct mtdswap_dev *d, unsigned int eblocks,
1340 if (!d->page_buf) 1340 if (!d->page_buf)
1341 goto page_buf_fail; 1341 goto page_buf_fail;
1342 1342
1343 d->oob_buf = kmalloc(2 * mtd->oobavail, GFP_KERNEL); 1343 d->oob_buf = kmalloc_array(2, mtd->oobavail, GFP_KERNEL);
1344 if (!d->oob_buf) 1344 if (!d->oob_buf)
1345 goto oob_buf_fail; 1345 goto oob_buf_fail;
1346 1346
diff --git a/drivers/mtd/nand/raw/nand_bch.c b/drivers/mtd/nand/raw/nand_bch.c
index 7f11b68f6db1..b7387ace567a 100644
--- a/drivers/mtd/nand/raw/nand_bch.c
+++ b/drivers/mtd/nand/raw/nand_bch.c
@@ -186,7 +186,7 @@ struct nand_bch_control *nand_bch_init(struct mtd_info *mtd)
186 } 186 }
187 187
188 nbc->eccmask = kmalloc(eccbytes, GFP_KERNEL); 188 nbc->eccmask = kmalloc(eccbytes, GFP_KERNEL);
189 nbc->errloc = kmalloc(t*sizeof(*nbc->errloc), GFP_KERNEL); 189 nbc->errloc = kmalloc_array(t, sizeof(*nbc->errloc), GFP_KERNEL);
190 if (!nbc->eccmask || !nbc->errloc) 190 if (!nbc->eccmask || !nbc->errloc)
191 goto fail; 191 goto fail;
192 /* 192 /*
diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
index 6281da3dadac..27184e3874db 100644
--- a/drivers/mtd/nftlmount.c
+++ b/drivers/mtd/nftlmount.c
@@ -199,13 +199,16 @@ device is already correct.
199 nftl->lastEUN = nftl->nb_blocks - 1; 199 nftl->lastEUN = nftl->nb_blocks - 1;
200 200
201 /* memory alloc */ 201 /* memory alloc */
202 nftl->EUNtable = kmalloc(nftl->nb_blocks * sizeof(u16), GFP_KERNEL); 202 nftl->EUNtable = kmalloc_array(nftl->nb_blocks, sizeof(u16),
203 GFP_KERNEL);
203 if (!nftl->EUNtable) { 204 if (!nftl->EUNtable) {
204 printk(KERN_NOTICE "NFTL: allocation of EUNtable failed\n"); 205 printk(KERN_NOTICE "NFTL: allocation of EUNtable failed\n");
205 return -ENOMEM; 206 return -ENOMEM;
206 } 207 }
207 208
208 nftl->ReplUnitTable = kmalloc(nftl->nb_blocks * sizeof(u16), GFP_KERNEL); 209 nftl->ReplUnitTable = kmalloc_array(nftl->nb_blocks,
210 sizeof(u16),
211 GFP_KERNEL);
209 if (!nftl->ReplUnitTable) { 212 if (!nftl->ReplUnitTable) {
210 kfree(nftl->EUNtable); 213 kfree(nftl->EUNtable);
211 printk(KERN_NOTICE "NFTL: allocation of ReplUnitTable failed\n"); 214 printk(KERN_NOTICE "NFTL: allocation of ReplUnitTable failed\n");
diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
index 79636349df96..9d019ce1589e 100644
--- a/drivers/mtd/sm_ftl.c
+++ b/drivers/mtd/sm_ftl.c
@@ -750,7 +750,7 @@ static int sm_init_zone(struct sm_ftl *ftl, int zone_num)
750 dbg("initializing zone %d", zone_num); 750 dbg("initializing zone %d", zone_num);
751 751
752 /* Allocate memory for FTL table */ 752 /* Allocate memory for FTL table */
753 zone->lba_to_phys_table = kmalloc(ftl->max_lba * 2, GFP_KERNEL); 753 zone->lba_to_phys_table = kmalloc_array(ftl->max_lba, 2, GFP_KERNEL);
754 754
755 if (!zone->lba_to_phys_table) 755 if (!zone->lba_to_phys_table)
756 return -ENOMEM; 756 return -ENOMEM;
diff --git a/drivers/mtd/ssfdc.c b/drivers/mtd/ssfdc.c
index 95f0bf95f095..7a1e54546f4a 100644
--- a/drivers/mtd/ssfdc.c
+++ b/drivers/mtd/ssfdc.c
@@ -332,8 +332,9 @@ static void ssfdcr_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
332 (long)ssfdc->sectors; 332 (long)ssfdc->sectors;
333 333
334 /* Allocate logical block map */ 334 /* Allocate logical block map */
335 ssfdc->logic_block_map = kmalloc(sizeof(ssfdc->logic_block_map[0]) * 335 ssfdc->logic_block_map =
336 ssfdc->map_len, GFP_KERNEL); 336 kmalloc_array(ssfdc->map_len,
337 sizeof(ssfdc->logic_block_map[0]), GFP_KERNEL);
337 if (!ssfdc->logic_block_map) 338 if (!ssfdc->logic_block_map)
338 goto out_err; 339 goto out_err;
339 memset(ssfdc->logic_block_map, 0xff, sizeof(ssfdc->logic_block_map[0]) * 340 memset(ssfdc->logic_block_map, 0xff, sizeof(ssfdc->logic_block_map[0]) *
diff --git a/drivers/mtd/tests/stresstest.c b/drivers/mtd/tests/stresstest.c
index e509f8aa9a7e..0fe1217f94b9 100644
--- a/drivers/mtd/tests/stresstest.c
+++ b/drivers/mtd/tests/stresstest.c
@@ -199,7 +199,7 @@ static int __init mtd_stresstest_init(void)
199 err = -ENOMEM; 199 err = -ENOMEM;
200 readbuf = vmalloc(bufsize); 200 readbuf = vmalloc(bufsize);
201 writebuf = vmalloc(bufsize); 201 writebuf = vmalloc(bufsize);
202 offsets = kmalloc(ebcnt * sizeof(int), GFP_KERNEL); 202 offsets = kmalloc_array(ebcnt, sizeof(int), GFP_KERNEL);
203 if (!readbuf || !writebuf || !offsets) 203 if (!readbuf || !writebuf || !offsets)
204 goto out; 204 goto out;
205 for (i = 0; i < ebcnt; i++) 205 for (i = 0; i < ebcnt; i++)
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index edb1c8362faa..b98481b69314 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -1536,11 +1536,11 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
1536 1536
1537 num_volumes = ubi->vtbl_slots + UBI_INT_VOL_COUNT; 1537 num_volumes = ubi->vtbl_slots + UBI_INT_VOL_COUNT;
1538 1538
1539 scan_eba = kmalloc(sizeof(*scan_eba) * num_volumes, GFP_KERNEL); 1539 scan_eba = kmalloc_array(num_volumes, sizeof(*scan_eba), GFP_KERNEL);
1540 if (!scan_eba) 1540 if (!scan_eba)
1541 return -ENOMEM; 1541 return -ENOMEM;
1542 1542
1543 fm_eba = kmalloc(sizeof(*fm_eba) * num_volumes, GFP_KERNEL); 1543 fm_eba = kmalloc_array(num_volumes, sizeof(*fm_eba), GFP_KERNEL);
1544 if (!fm_eba) { 1544 if (!fm_eba) {
1545 kfree(scan_eba); 1545 kfree(scan_eba);
1546 return -ENOMEM; 1546 return -ENOMEM;
@@ -1551,15 +1551,17 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
1551 if (!vol) 1551 if (!vol)
1552 continue; 1552 continue;
1553 1553
1554 scan_eba[i] = kmalloc(vol->reserved_pebs * sizeof(**scan_eba), 1554 scan_eba[i] = kmalloc_array(vol->reserved_pebs,
1555 GFP_KERNEL); 1555 sizeof(**scan_eba),
1556 GFP_KERNEL);
1556 if (!scan_eba[i]) { 1557 if (!scan_eba[i]) {
1557 ret = -ENOMEM; 1558 ret = -ENOMEM;
1558 goto out_free; 1559 goto out_free;
1559 } 1560 }
1560 1561
1561 fm_eba[i] = kmalloc(vol->reserved_pebs * sizeof(**fm_eba), 1562 fm_eba[i] = kmalloc_array(vol->reserved_pebs,
1562 GFP_KERNEL); 1563 sizeof(**fm_eba),
1564 GFP_KERNEL);
1563 if (!fm_eba[i]) { 1565 if (!fm_eba[i]) {
1564 ret = -ENOMEM; 1566 ret = -ENOMEM;
1565 goto out_free; 1567 goto out_free;
diff --git a/drivers/net/ethernet/amd/lance.c b/drivers/net/ethernet/amd/lance.c
index 12a6a93d221b..b56d84c7df46 100644
--- a/drivers/net/ethernet/amd/lance.c
+++ b/drivers/net/ethernet/amd/lance.c
@@ -551,13 +551,13 @@ static int __init lance_probe1(struct net_device *dev, int ioaddr, int irq, int
551 if (lance_debug > 6) printk(" (#0x%05lx)", (unsigned long)lp); 551 if (lance_debug > 6) printk(" (#0x%05lx)", (unsigned long)lp);
552 dev->ml_priv = lp; 552 dev->ml_priv = lp;
553 lp->name = chipname; 553 lp->name = chipname;
554 lp->rx_buffs = (unsigned long)kmalloc(PKT_BUF_SZ*RX_RING_SIZE, 554 lp->rx_buffs = (unsigned long)kmalloc_array(RX_RING_SIZE, PKT_BUF_SZ,
555 GFP_DMA | GFP_KERNEL); 555 GFP_DMA | GFP_KERNEL);
556 if (!lp->rx_buffs) 556 if (!lp->rx_buffs)
557 goto out_lp; 557 goto out_lp;
558 if (lance_need_isa_bounce_buffers) { 558 if (lance_need_isa_bounce_buffers) {
559 lp->tx_bounce_buffs = kmalloc(PKT_BUF_SZ*TX_RING_SIZE, 559 lp->tx_bounce_buffs = kmalloc_array(TX_RING_SIZE, PKT_BUF_SZ,
560 GFP_DMA | GFP_KERNEL); 560 GFP_DMA | GFP_KERNEL);
561 if (!lp->tx_bounce_buffs) 561 if (!lp->tx_bounce_buffs)
562 goto out_rx; 562 goto out_rx;
563 } else 563 } else
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c b/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
index cfe86a20c899..28e9ae1a193b 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
@@ -209,8 +209,8 @@ static int atl1c_get_eeprom(struct net_device *netdev,
209 first_dword = eeprom->offset >> 2; 209 first_dword = eeprom->offset >> 2;
210 last_dword = (eeprom->offset + eeprom->len - 1) >> 2; 210 last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
211 211
212 eeprom_buff = kmalloc(sizeof(u32) * 212 eeprom_buff = kmalloc_array(last_dword - first_dword + 1, sizeof(u32),
213 (last_dword - first_dword + 1), GFP_KERNEL); 213 GFP_KERNEL);
214 if (eeprom_buff == NULL) 214 if (eeprom_buff == NULL)
215 return -ENOMEM; 215 return -ENOMEM;
216 216
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c b/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
index cb489e7e8374..282ebdde4769 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
@@ -236,8 +236,8 @@ static int atl1e_get_eeprom(struct net_device *netdev,
236 first_dword = eeprom->offset >> 2; 236 first_dword = eeprom->offset >> 2;
237 last_dword = (eeprom->offset + eeprom->len - 1) >> 2; 237 last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
238 238
239 eeprom_buff = kmalloc(sizeof(u32) * 239 eeprom_buff = kmalloc_array(last_dword - first_dword + 1, sizeof(u32),
240 (last_dword - first_dword + 1), GFP_KERNEL); 240 GFP_KERNEL);
241 if (eeprom_buff == NULL) 241 if (eeprom_buff == NULL)
242 return -ENOMEM; 242 return -ENOMEM;
243 243
diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
index db4bcc51023a..bb41becb6609 100644
--- a/drivers/net/ethernet/atheros/atlx/atl2.c
+++ b/drivers/net/ethernet/atheros/atlx/atl2.c
@@ -1941,8 +1941,8 @@ static int atl2_get_eeprom(struct net_device *netdev,
1941 first_dword = eeprom->offset >> 2; 1941 first_dword = eeprom->offset >> 2;
1942 last_dword = (eeprom->offset + eeprom->len - 1) >> 2; 1942 last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
1943 1943
1944 eeprom_buff = kmalloc(sizeof(u32) * (last_dword - first_dword + 1), 1944 eeprom_buff = kmalloc_array(last_dword - first_dword + 1, sizeof(u32),
1945 GFP_KERNEL); 1945 GFP_KERNEL);
1946 if (!eeprom_buff) 1946 if (!eeprom_buff)
1947 return -ENOMEM; 1947 return -ENOMEM;
1948 1948
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 3853296d78c1..e13bf3b4636d 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -2666,7 +2666,7 @@ bnx2_alloc_bad_rbuf(struct bnx2 *bp)
2666 u32 good_mbuf_cnt; 2666 u32 good_mbuf_cnt;
2667 u32 val; 2667 u32 val;
2668 2668
2669 good_mbuf = kmalloc(512 * sizeof(u16), GFP_KERNEL); 2669 good_mbuf = kmalloc_array(512, sizeof(u16), GFP_KERNEL);
2670 if (!good_mbuf) 2670 if (!good_mbuf)
2671 return -ENOMEM; 2671 return -ENOMEM;
2672 2672
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c
index 38f635cf8408..05d405905906 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c
@@ -444,8 +444,8 @@ static int bnxt_vf_reps_create(struct bnxt *bp)
444 return -ENOMEM; 444 return -ENOMEM;
445 445
446 /* storage for cfa_code to vf-idx mapping */ 446 /* storage for cfa_code to vf-idx mapping */
447 cfa_code_map = kmalloc(sizeof(*bp->cfa_code_map) * MAX_CFA_CODE, 447 cfa_code_map = kmalloc_array(MAX_CFA_CODE, sizeof(*bp->cfa_code_map),
448 GFP_KERNEL); 448 GFP_KERNEL);
449 if (!cfa_code_map) { 449 if (!cfa_code_map) {
450 rc = -ENOMEM; 450 rc = -ENOMEM;
451 goto err; 451 goto err;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
index 251d5bdc972f..c301aaf79d64 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
@@ -873,7 +873,7 @@ static int cctrl_tbl_show(struct seq_file *seq, void *v)
873 u16 (*incr)[NCCTRL_WIN]; 873 u16 (*incr)[NCCTRL_WIN];
874 struct adapter *adap = seq->private; 874 struct adapter *adap = seq->private;
875 875
876 incr = kmalloc(sizeof(*incr) * NMTUS, GFP_KERNEL); 876 incr = kmalloc_array(NMTUS, sizeof(*incr), GFP_KERNEL);
877 if (!incr) 877 if (!incr)
878 return -ENOMEM; 878 return -ENOMEM;
879 879
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 35cb3ae4f7b6..3001d8ed1a0c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -713,7 +713,7 @@ int cxgb4_write_rss(const struct port_info *pi, const u16 *queues)
713 const struct sge_eth_rxq *rxq; 713 const struct sge_eth_rxq *rxq;
714 714
715 rxq = &adapter->sge.ethrxq[pi->first_qset]; 715 rxq = &adapter->sge.ethrxq[pi->first_qset];
716 rss = kmalloc(pi->rss_size * sizeof(u16), GFP_KERNEL); 716 rss = kmalloc_array(pi->rss_size, sizeof(u16), GFP_KERNEL);
717 if (!rss) 717 if (!rss)
718 return -ENOMEM; 718 return -ENOMEM;
719 719
@@ -4972,8 +4972,8 @@ static int enable_msix(struct adapter *adap)
4972 max_ingq += (MAX_OFLD_QSETS * adap->num_uld); 4972 max_ingq += (MAX_OFLD_QSETS * adap->num_uld);
4973 if (is_offload(adap)) 4973 if (is_offload(adap))
4974 max_ingq += (MAX_OFLD_QSETS * adap->num_ofld_uld); 4974 max_ingq += (MAX_OFLD_QSETS * adap->num_ofld_uld);
4975 entries = kmalloc(sizeof(*entries) * (max_ingq + 1), 4975 entries = kmalloc_array(max_ingq + 1, sizeof(*entries),
4976 GFP_KERNEL); 4976 GFP_KERNEL);
4977 if (!entries) 4977 if (!entries)
4978 return -ENOMEM; 4978 return -ENOMEM;
4979 4979
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index a96b838cffce..42fca3208c0b 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -2253,9 +2253,9 @@ static int ucc_geth_alloc_tx(struct ucc_geth_private *ugeth)
2253 /* Init Tx bds */ 2253 /* Init Tx bds */
2254 for (j = 0; j < ug_info->numQueuesTx; j++) { 2254 for (j = 0; j < ug_info->numQueuesTx; j++) {
2255 /* Setup the skbuff rings */ 2255 /* Setup the skbuff rings */
2256 ugeth->tx_skbuff[j] = kmalloc(sizeof(struct sk_buff *) * 2256 ugeth->tx_skbuff[j] =
2257 ugeth->ug_info->bdRingLenTx[j], 2257 kmalloc_array(ugeth->ug_info->bdRingLenTx[j],
2258 GFP_KERNEL); 2258 sizeof(struct sk_buff *), GFP_KERNEL);
2259 2259
2260 if (ugeth->tx_skbuff[j] == NULL) { 2260 if (ugeth->tx_skbuff[j] == NULL) {
2261 if (netif_msg_ifup(ugeth)) 2261 if (netif_msg_ifup(ugeth))
@@ -2326,9 +2326,9 @@ static int ucc_geth_alloc_rx(struct ucc_geth_private *ugeth)
2326 /* Init Rx bds */ 2326 /* Init Rx bds */
2327 for (j = 0; j < ug_info->numQueuesRx; j++) { 2327 for (j = 0; j < ug_info->numQueuesRx; j++) {
2328 /* Setup the skbuff rings */ 2328 /* Setup the skbuff rings */
2329 ugeth->rx_skbuff[j] = kmalloc(sizeof(struct sk_buff *) * 2329 ugeth->rx_skbuff[j] =
2330 ugeth->ug_info->bdRingLenRx[j], 2330 kmalloc_array(ugeth->ug_info->bdRingLenRx[j],
2331 GFP_KERNEL); 2331 sizeof(struct sk_buff *), GFP_KERNEL);
2332 2332
2333 if (ugeth->rx_skbuff[j] == NULL) { 2333 if (ugeth->rx_skbuff[j] == NULL) {
2334 if (netif_msg_ifup(ugeth)) 2334 if (netif_msg_ifup(ugeth))
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index c1b51edaaf62..525d8b89187b 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -171,7 +171,7 @@ static int ibmveth_alloc_buffer_pool(struct ibmveth_buff_pool *pool)
171{ 171{
172 int i; 172 int i;
173 173
174 pool->free_map = kmalloc(sizeof(u16) * pool->size, GFP_KERNEL); 174 pool->free_map = kmalloc_array(pool->size, sizeof(u16), GFP_KERNEL);
175 175
176 if (!pool->free_map) 176 if (!pool->free_map)
177 return -1; 177 return -1;
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index 5d365a986bb0..bdb3f8e65ed4 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -435,8 +435,8 @@ static int e1000_get_eeprom(struct net_device *netdev,
435 first_word = eeprom->offset >> 1; 435 first_word = eeprom->offset >> 1;
436 last_word = (eeprom->offset + eeprom->len - 1) >> 1; 436 last_word = (eeprom->offset + eeprom->len - 1) >> 1;
437 437
438 eeprom_buff = kmalloc(sizeof(u16) * 438 eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
439 (last_word - first_word + 1), GFP_KERNEL); 439 GFP_KERNEL);
440 if (!eeprom_buff) 440 if (!eeprom_buff)
441 return -ENOMEM; 441 return -ENOMEM;
442 442
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index e084cb734eb1..02ebf208f48b 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -509,8 +509,8 @@ static int e1000_get_eeprom(struct net_device *netdev,
509 first_word = eeprom->offset >> 1; 509 first_word = eeprom->offset >> 1;
510 last_word = (eeprom->offset + eeprom->len - 1) >> 1; 510 last_word = (eeprom->offset + eeprom->len - 1) >> 1;
511 511
512 eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1), 512 eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
513 GFP_KERNEL); 513 GFP_KERNEL);
514 if (!eeprom_buff) 514 if (!eeprom_buff)
515 return -ENOMEM; 515 return -ENOMEM;
516 516
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 2d798499d35e..0edd3cdd84b0 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -736,8 +736,8 @@ static int igb_get_eeprom(struct net_device *netdev,
736 first_word = eeprom->offset >> 1; 736 first_word = eeprom->offset >> 1;
737 last_word = (eeprom->offset + eeprom->len - 1) >> 1; 737 last_word = (eeprom->offset + eeprom->len - 1) >> 1;
738 738
739 eeprom_buff = kmalloc(sizeof(u16) * 739 eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
740 (last_word - first_word + 1), GFP_KERNEL); 740 GFP_KERNEL);
741 if (!eeprom_buff) 741 if (!eeprom_buff)
742 return -ENOMEM; 742 return -ENOMEM;
743 743
@@ -3245,8 +3245,8 @@ static int igb_get_module_eeprom(struct net_device *netdev,
3245 first_word = ee->offset >> 1; 3245 first_word = ee->offset >> 1;
3246 last_word = (ee->offset + ee->len - 1) >> 1; 3246 last_word = (ee->offset + ee->len - 1) >> 1;
3247 3247
3248 dataword = kmalloc(sizeof(u16) * (last_word - first_word + 1), 3248 dataword = kmalloc_array(last_word - first_word + 1, sizeof(u16),
3249 GFP_KERNEL); 3249 GFP_KERNEL);
3250 if (!dataword) 3250 if (!dataword)
3251 return -ENOMEM; 3251 return -ENOMEM;
3252 3252
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c b/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
index 43744bf0fc1c..c8c93ac436d4 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
@@ -375,8 +375,9 @@ ixgb_get_eeprom(struct net_device *netdev,
375 first_word = eeprom->offset >> 1; 375 first_word = eeprom->offset >> 1;
376 last_word = (eeprom->offset + eeprom->len - 1) >> 1; 376 last_word = (eeprom->offset + eeprom->len - 1) >> 1;
377 377
378 eeprom_buff = kmalloc(sizeof(__le16) * 378 eeprom_buff = kmalloc_array(last_word - first_word + 1,
379 (last_word - first_word + 1), GFP_KERNEL); 379 sizeof(__le16),
380 GFP_KERNEL);
380 if (!eeprom_buff) 381 if (!eeprom_buff)
381 return -ENOMEM; 382 return -ENOMEM;
382 383
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
index 62f2173bc20e..43664adf7a3c 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
@@ -1093,8 +1093,9 @@ ixgb_set_multi(struct net_device *netdev)
1093 rctl |= IXGB_RCTL_MPE; 1093 rctl |= IXGB_RCTL_MPE;
1094 IXGB_WRITE_REG(hw, RCTL, rctl); 1094 IXGB_WRITE_REG(hw, RCTL, rctl);
1095 } else { 1095 } else {
1096 u8 *mta = kmalloc(IXGB_MAX_NUM_MULTICAST_ADDRESSES * 1096 u8 *mta = kmalloc_array(ETH_ALEN,
1097 ETH_ALEN, GFP_ATOMIC); 1097 IXGB_MAX_NUM_MULTICAST_ADDRESSES,
1098 GFP_ATOMIC);
1098 u8 *addr; 1099 u8 *addr;
1099 if (!mta) 1100 if (!mta)
1100 goto alloc_failed; 1101 goto alloc_failed;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index bdd179c29ea4..be2636ea945b 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -901,7 +901,7 @@ static int ixgbe_get_eeprom(struct net_device *netdev,
901 last_word = (eeprom->offset + eeprom->len - 1) >> 1; 901 last_word = (eeprom->offset + eeprom->len - 1) >> 1;
902 eeprom_len = last_word - first_word + 1; 902 eeprom_len = last_word - first_word + 1;
903 903
904 eeprom_buff = kmalloc(sizeof(u16) * eeprom_len, GFP_KERNEL); 904 eeprom_buff = kmalloc_array(eeprom_len, sizeof(u16), GFP_KERNEL);
905 if (!eeprom_buff) 905 if (!eeprom_buff)
906 return -ENOMEM; 906 return -ENOMEM;
907 907
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index 6a9086dc1e92..03375c705df7 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2636,9 +2636,9 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
2636 int i; 2636 int i;
2637 int err = 0; 2637 int err = 0;
2638 2638
2639 priv->cmd.context = kmalloc(priv->cmd.max_cmds * 2639 priv->cmd.context = kmalloc_array(priv->cmd.max_cmds,
2640 sizeof(struct mlx4_cmd_context), 2640 sizeof(struct mlx4_cmd_context),
2641 GFP_KERNEL); 2641 GFP_KERNEL);
2642 if (!priv->cmd.context) 2642 if (!priv->cmd.context)
2643 return -ENOMEM; 2643 return -ENOMEM;
2644 2644
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 6f57c052053e..1f3372c1802e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1211,8 +1211,9 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
1211 } 1211 }
1212 1212
1213 priv->eq_table.irq_names = 1213 priv->eq_table.irq_names =
1214 kmalloc(MLX4_IRQNAME_SIZE * (dev->caps.num_comp_vectors + 1), 1214 kmalloc_array(MLX4_IRQNAME_SIZE,
1215 GFP_KERNEL); 1215 (dev->caps.num_comp_vectors + 1),
1216 GFP_KERNEL);
1216 if (!priv->eq_table.irq_names) { 1217 if (!priv->eq_table.irq_names) {
1217 err = -ENOMEM; 1218 err = -ENOMEM;
1218 goto err_out_clr_int; 1219 goto err_out_clr_int;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 29e50f787349..b0e11255a355 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -507,10 +507,12 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
507 for (i = 0; i < MLX4_NUM_OF_RESOURCE_TYPE; i++) { 507 for (i = 0; i < MLX4_NUM_OF_RESOURCE_TYPE; i++) {
508 struct resource_allocator *res_alloc = 508 struct resource_allocator *res_alloc =
509 &priv->mfunc.master.res_tracker.res_alloc[i]; 509 &priv->mfunc.master.res_tracker.res_alloc[i];
510 res_alloc->quota = kmalloc((dev->persist->num_vfs + 1) * 510 res_alloc->quota = kmalloc_array(dev->persist->num_vfs + 1,
511 sizeof(int), GFP_KERNEL); 511 sizeof(int),
512 res_alloc->guaranteed = kmalloc((dev->persist->num_vfs + 1) * 512 GFP_KERNEL);
513 sizeof(int), GFP_KERNEL); 513 res_alloc->guaranteed = kmalloc_array(dev->persist->num_vfs + 1,
514 sizeof(int),
515 GFP_KERNEL);
514 if (i == RES_MAC || i == RES_VLAN) 516 if (i == RES_MAC || i == RES_VLAN)
515 res_alloc->allocated = kzalloc(MLX4_MAX_PORTS * 517 res_alloc->allocated = kzalloc(MLX4_MAX_PORTS *
516 (dev->persist->num_vfs 518 (dev->persist->num_vfs
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 2e4effa9fe45..b34055ac476f 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -507,15 +507,15 @@ static int moxart_mac_probe(struct platform_device *pdev)
507 goto init_fail; 507 goto init_fail;
508 } 508 }
509 509
510 priv->tx_buf_base = kmalloc(priv->tx_buf_size * TX_DESC_NUM, 510 priv->tx_buf_base = kmalloc_array(priv->tx_buf_size, TX_DESC_NUM,
511 GFP_ATOMIC); 511 GFP_ATOMIC);
512 if (!priv->tx_buf_base) { 512 if (!priv->tx_buf_base) {
513 ret = -ENOMEM; 513 ret = -ENOMEM;
514 goto init_fail; 514 goto init_fail;
515 } 515 }
516 516
517 priv->rx_buf_base = kmalloc(priv->rx_buf_size * RX_DESC_NUM, 517 priv->rx_buf_base = kmalloc_array(priv->rx_buf_size, RX_DESC_NUM,
518 GFP_ATOMIC); 518 GFP_ATOMIC);
519 if (!priv->rx_buf_base) { 519 if (!priv->rx_buf_base) {
520 ret = -ENOMEM; 520 ret = -ENOMEM;
521 goto init_fail; 521 goto init_fail;
diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
index 66c665d0b926..7cbd0174459c 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -4630,8 +4630,10 @@ static int nv_set_ringparam(struct net_device *dev, struct ethtool_ringparam* ri
4630 ring->tx_pending), 4630 ring->tx_pending),
4631 &ring_addr, GFP_ATOMIC); 4631 &ring_addr, GFP_ATOMIC);
4632 } 4632 }
4633 rx_skbuff = kmalloc(sizeof(struct nv_skb_map) * ring->rx_pending, GFP_KERNEL); 4633 rx_skbuff = kmalloc_array(ring->rx_pending, sizeof(struct nv_skb_map),
4634 tx_skbuff = kmalloc(sizeof(struct nv_skb_map) * ring->tx_pending, GFP_KERNEL); 4634 GFP_KERNEL);
4635 tx_skbuff = kmalloc_array(ring->tx_pending, sizeof(struct nv_skb_map),
4636 GFP_KERNEL);
4635 if (!rxtx_ring || !rx_skbuff || !tx_skbuff) { 4637 if (!rxtx_ring || !rx_skbuff || !tx_skbuff) {
4636 /* fall back to old rings */ 4638 /* fall back to old rings */
4637 if (!nv_optimized(np)) { 4639 if (!nv_optimized(np)) {
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 7cd494611a74..34a1581eda95 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -2178,7 +2178,7 @@ static void pch_gbe_set_multi(struct net_device *netdev)
2178 2178
2179 if (mc_count >= PCH_GBE_MAR_ENTRIES) 2179 if (mc_count >= PCH_GBE_MAR_ENTRIES)
2180 return; 2180 return;
2181 mta_list = kmalloc(mc_count * ETH_ALEN, GFP_ATOMIC); 2181 mta_list = kmalloc_array(ETH_ALEN, mc_count, GFP_ATOMIC);
2182 if (!mta_list) 2182 if (!mta_list)
2183 return; 2183 return;
2184 2184
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index 6f9927d1a501..4e0b443c9519 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -2578,9 +2578,9 @@ int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
2578 goto err0; 2578 goto err0;
2579 } 2579 }
2580 2580
2581 nvm_info->image_att = kmalloc(nvm_info->num_images * 2581 nvm_info->image_att = kmalloc_array(nvm_info->num_images,
2582 sizeof(struct bist_nvm_image_att), 2582 sizeof(struct bist_nvm_image_att),
2583 GFP_KERNEL); 2583 GFP_KERNEL);
2584 if (!nvm_info->image_att) { 2584 if (!nvm_info->image_att) {
2585 rc = -ENOMEM; 2585 rc = -ENOMEM;
2586 goto err0; 2586 goto err0;
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 70de062b72a1..353f1c129af1 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -2810,7 +2810,8 @@ static int ql_alloc_tx_resources(struct ql_adapter *qdev,
2810 goto pci_alloc_err; 2810 goto pci_alloc_err;
2811 2811
2812 tx_ring->q = 2812 tx_ring->q =
2813 kmalloc(tx_ring->wq_len * sizeof(struct tx_ring_desc), GFP_KERNEL); 2813 kmalloc_array(tx_ring->wq_len, sizeof(struct tx_ring_desc),
2814 GFP_KERNEL);
2814 if (tx_ring->q == NULL) 2815 if (tx_ring->q == NULL)
2815 goto err; 2816 goto err;
2816 2817
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index f38e32a7ec9c..ec629a730005 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -742,11 +742,13 @@ static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize)
742{ 742{
743 int i; 743 int i;
744 744
745 gtp->addr_hash = kmalloc(sizeof(struct hlist_head) * hsize, GFP_KERNEL); 745 gtp->addr_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
746 GFP_KERNEL);
746 if (gtp->addr_hash == NULL) 747 if (gtp->addr_hash == NULL)
747 return -ENOMEM; 748 return -ENOMEM;
748 749
749 gtp->tid_hash = kmalloc(sizeof(struct hlist_head) * hsize, GFP_KERNEL); 750 gtp->tid_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
751 GFP_KERNEL);
750 if (gtp->tid_hash == NULL) 752 if (gtp->tid_hash == NULL)
751 goto err1; 753 goto err1;
752 754
diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
index f41116488079..029206e4da3b 100644
--- a/drivers/net/hippi/rrunner.c
+++ b/drivers/net/hippi/rrunner.c
@@ -1583,7 +1583,7 @@ static int rr_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
1583 return -EPERM; 1583 return -EPERM;
1584 } 1584 }
1585 1585
1586 image = kmalloc(EEPROM_WORDS * sizeof(u32), GFP_KERNEL); 1586 image = kmalloc_array(EEPROM_WORDS, sizeof(u32), GFP_KERNEL);
1587 if (!image) 1587 if (!image)
1588 return -ENOMEM; 1588 return -ENOMEM;
1589 1589
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 8863fa023500..ca0af0e15a2c 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -791,7 +791,8 @@ static int team_queue_override_init(struct team *team)
791 791
792 if (!queue_cnt) 792 if (!queue_cnt)
793 return 0; 793 return 0;
794 listarr = kmalloc(sizeof(struct list_head) * queue_cnt, GFP_KERNEL); 794 listarr = kmalloc_array(queue_cnt, sizeof(struct list_head),
795 GFP_KERNEL);
795 if (!listarr) 796 if (!listarr)
796 return -ENOMEM; 797 return -ENOMEM;
797 team->qom_lists = listarr; 798 team->qom_lists = listarr;
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index f4d7362eb325..e95dd12edec4 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -640,8 +640,8 @@ int asix_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
640 first_word = eeprom->offset >> 1; 640 first_word = eeprom->offset >> 1;
641 last_word = (eeprom->offset + eeprom->len - 1) >> 1; 641 last_word = (eeprom->offset + eeprom->len - 1) >> 1;
642 642
643 eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1), 643 eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
644 GFP_KERNEL); 644 GFP_KERNEL);
645 if (!eeprom_buff) 645 if (!eeprom_buff)
646 return -ENOMEM; 646 return -ENOMEM;
647 647
@@ -680,8 +680,8 @@ int asix_set_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
680 first_word = eeprom->offset >> 1; 680 first_word = eeprom->offset >> 1;
681 last_word = (eeprom->offset + eeprom->len - 1) >> 1; 681 last_word = (eeprom->offset + eeprom->len - 1) >> 1;
682 682
683 eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1), 683 eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
684 GFP_KERNEL); 684 GFP_KERNEL);
685 if (!eeprom_buff) 685 if (!eeprom_buff)
686 return -ENOMEM; 686 return -ENOMEM;
687 687
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index a6ef75907ae9..9e8ad372f419 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -599,8 +599,8 @@ ax88179_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
599 599
600 first_word = eeprom->offset >> 1; 600 first_word = eeprom->offset >> 1;
601 last_word = (eeprom->offset + eeprom->len - 1) >> 1; 601 last_word = (eeprom->offset + eeprom->len - 1) >> 1;
602 eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1), 602 eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
603 GFP_KERNEL); 603 GFP_KERNEL);
604 if (!eeprom_buff) 604 if (!eeprom_buff)
605 return -ENOMEM; 605 return -ENOMEM;
606 606
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index d9eea8cfe6cb..770aa624147f 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1323,8 +1323,8 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb)
1323 return 0; 1323 return 0;
1324 1324
1325 /* reserve one for zero packet */ 1325 /* reserve one for zero packet */
1326 urb->sg = kmalloc((num_sgs + 1) * sizeof(struct scatterlist), 1326 urb->sg = kmalloc_array(num_sgs + 1, sizeof(struct scatterlist),
1327 GFP_ATOMIC); 1327 GFP_ATOMIC);
1328 if (!urb->sg) 1328 if (!urb->sg)
1329 return -ENOMEM; 1329 return -ENOMEM;
1330 1330
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 1619ee3070b6..15b9a83bbd9d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2555,10 +2555,10 @@ static int virtnet_find_vqs(struct virtnet_info *vi)
2555 vqs = kzalloc(total_vqs * sizeof(*vqs), GFP_KERNEL); 2555 vqs = kzalloc(total_vqs * sizeof(*vqs), GFP_KERNEL);
2556 if (!vqs) 2556 if (!vqs)
2557 goto err_vq; 2557 goto err_vq;
2558 callbacks = kmalloc(total_vqs * sizeof(*callbacks), GFP_KERNEL); 2558 callbacks = kmalloc_array(total_vqs, sizeof(*callbacks), GFP_KERNEL);
2559 if (!callbacks) 2559 if (!callbacks)
2560 goto err_callback; 2560 goto err_callback;
2561 names = kmalloc(total_vqs * sizeof(*names), GFP_KERNEL); 2561 names = kmalloc_array(total_vqs, sizeof(*names), GFP_KERNEL);
2562 if (!names) 2562 if (!names)
2563 goto err_names; 2563 goto err_names;
2564 if (!vi->big_packets || vi->mergeable_rx_bufs) { 2564 if (!vi->big_packets || vi->mergeable_rx_bufs) {
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 641b13a279e1..b1b8bc326830 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -890,7 +890,8 @@ ath5k_hw_rfregs_init(struct ath5k_hw *ah,
890 * ah->ah_rf_banks based on ah->ah_rf_banks_size 890 * ah->ah_rf_banks based on ah->ah_rf_banks_size
891 * we set above */ 891 * we set above */
892 if (ah->ah_rf_banks == NULL) { 892 if (ah->ah_rf_banks == NULL) {
893 ah->ah_rf_banks = kmalloc(sizeof(u32) * ah->ah_rf_banks_size, 893 ah->ah_rf_banks = kmalloc_array(ah->ah_rf_banks_size,
894 sizeof(u32),
894 GFP_KERNEL); 895 GFP_KERNEL);
895 if (ah->ah_rf_banks == NULL) { 896 if (ah->ah_rf_banks == NULL) {
896 ATH5K_ERR(ah, "out of memory\n"); 897 ATH5K_ERR(ah, "out of memory\n");
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 6343cc91953e..34e100940284 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -925,7 +925,7 @@ int ar9003_paprd_create_curve(struct ath_hw *ah,
925 925
926 memset(caldata->pa_table[chain], 0, sizeof(caldata->pa_table[chain])); 926 memset(caldata->pa_table[chain], 0, sizeof(caldata->pa_table[chain]));
927 927
928 buf = kmalloc(2 * 48 * sizeof(u32), GFP_KERNEL); 928 buf = kmalloc_array(2 * 48, sizeof(u32), GFP_KERNEL);
929 if (!buf) 929 if (!buf)
930 return -ENOMEM; 930 return -ENOMEM;
931 931
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 6b37036b2d36..e60bea4604e4 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -127,13 +127,13 @@ void ath9k_hw_read_array(struct ath_hw *ah, u32 array[][2], int size)
127 u32 *tmp_reg_list, *tmp_data; 127 u32 *tmp_reg_list, *tmp_data;
128 int i; 128 int i;
129 129
130 tmp_reg_list = kmalloc(size * sizeof(u32), GFP_KERNEL); 130 tmp_reg_list = kmalloc_array(size, sizeof(u32), GFP_KERNEL);
131 if (!tmp_reg_list) { 131 if (!tmp_reg_list) {
132 dev_err(ah->dev, "%s: tmp_reg_list: alloc filed\n", __func__); 132 dev_err(ah->dev, "%s: tmp_reg_list: alloc filed\n", __func__);
133 return; 133 return;
134 } 134 }
135 135
136 tmp_data = kmalloc(size * sizeof(u32), GFP_KERNEL); 136 tmp_data = kmalloc_array(size, sizeof(u32), GFP_KERNEL);
137 if (!tmp_data) { 137 if (!tmp_data) {
138 dev_err(ah->dev, "%s tmp_data: alloc filed\n", __func__); 138 dev_err(ah->dev, "%s tmp_data: alloc filed\n", __func__);
139 goto error_tmp_data; 139 goto error_tmp_data;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
index 9d830d27b229..9fb0d9fbd939 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -1387,7 +1387,7 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
1387 s16 *ptr; 1387 s16 *ptr;
1388 struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy; 1388 struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy;
1389 1389
1390 ptr = kmalloc(sizeof(s16) * 131, GFP_ATOMIC); 1390 ptr = kmalloc_array(131, sizeof(s16), GFP_ATOMIC);
1391 if (NULL == ptr) 1391 if (NULL == ptr)
1392 return false; 1392 return false;
1393 if (module == 2) { 1393 if (module == 2) {
@@ -2670,7 +2670,7 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi,
2670 u16 *values_to_save; 2670 u16 *values_to_save;
2671 struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy; 2671 struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy;
2672 2672
2673 values_to_save = kmalloc(sizeof(u16) * 20, GFP_ATOMIC); 2673 values_to_save = kmalloc_array(20, sizeof(u16), GFP_ATOMIC);
2674 if (NULL == values_to_save) 2674 if (NULL == values_to_save)
2675 return; 2675 return;
2676 2676
@@ -3678,11 +3678,11 @@ wlc_lcnphy_a1(struct brcms_phy *pi, int cal_type, int num_levels,
3678 u16 *phy_c32; 3678 u16 *phy_c32;
3679 phy_c21 = 0; 3679 phy_c21 = 0;
3680 phy_c10 = phy_c13 = phy_c14 = phy_c8 = 0; 3680 phy_c10 = phy_c13 = phy_c14 = phy_c8 = 0;
3681 ptr = kmalloc(sizeof(s16) * 131, GFP_ATOMIC); 3681 ptr = kmalloc_array(131, sizeof(s16), GFP_ATOMIC);
3682 if (NULL == ptr) 3682 if (NULL == ptr)
3683 return; 3683 return;
3684 3684
3685 phy_c32 = kmalloc(sizeof(u16) * 20, GFP_ATOMIC); 3685 phy_c32 = kmalloc_array(20, sizeof(u16), GFP_ATOMIC);
3686 if (NULL == phy_c32) { 3686 if (NULL == phy_c32) {
3687 kfree(ptr); 3687 kfree(ptr);
3688 return; 3688 return;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
index 7e01981bc5c8..1a187557982e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
@@ -23032,7 +23032,7 @@ wlc_phy_loadsampletable_nphy(struct brcms_phy *pi, struct cordic_iq *tone_buf,
23032 u16 t; 23032 u16 t;
23033 u32 *data_buf = NULL; 23033 u32 *data_buf = NULL;
23034 23034
23035 data_buf = kmalloc(sizeof(u32) * num_samps, GFP_ATOMIC); 23035 data_buf = kmalloc_array(num_samps, sizeof(u32), GFP_ATOMIC);
23036 if (data_buf == NULL) 23036 if (data_buf == NULL)
23037 return; 23037 return;
23038 23038
@@ -23074,7 +23074,8 @@ wlc_phy_gen_load_samples_nphy(struct brcms_phy *pi, u32 f_kHz, u16 max_val,
23074 tbl_len = (phy_bw << 1); 23074 tbl_len = (phy_bw << 1);
23075 } 23075 }
23076 23076
23077 tone_buf = kmalloc(sizeof(struct cordic_iq) * tbl_len, GFP_ATOMIC); 23077 tone_buf = kmalloc_array(tbl_len, sizeof(struct cordic_iq),
23078 GFP_ATOMIC);
23078 if (tone_buf == NULL) 23079 if (tone_buf == NULL)
23079 return 0; 23080 return 0;
23080 23081
diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
index ce0fbf83285f..72046e182745 100644
--- a/drivers/net/wireless/cisco/airo.c
+++ b/drivers/net/wireless/cisco/airo.c
@@ -7127,7 +7127,7 @@ static int airo_get_aplist(struct net_device *dev,
7127 int i; 7127 int i;
7128 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1; 7128 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
7129 7129
7130 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL); 7130 qual = kmalloc_array(IW_MAX_AP, sizeof(*qual), GFP_KERNEL);
7131 if (!qual) 7131 if (!qual)
7132 return -ENOMEM; 7132 return -ENOMEM;
7133 7133
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
index 7c4f550a1475..b8fd3cc90634 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
@@ -3445,8 +3445,9 @@ static int ipw2100_msg_allocate(struct ipw2100_priv *priv)
3445 dma_addr_t p; 3445 dma_addr_t p;
3446 3446
3447 priv->msg_buffers = 3447 priv->msg_buffers =
3448 kmalloc(IPW_COMMAND_POOL_SIZE * sizeof(struct ipw2100_tx_packet), 3448 kmalloc_array(IPW_COMMAND_POOL_SIZE,
3449 GFP_KERNEL); 3449 sizeof(struct ipw2100_tx_packet),
3450 GFP_KERNEL);
3450 if (!priv->msg_buffers) 3451 if (!priv->msg_buffers)
3451 return -ENOMEM; 3452 return -ENOMEM;
3452 3453
@@ -4587,9 +4588,9 @@ static int ipw2100_rx_allocate(struct ipw2100_priv *priv)
4587 /* 4588 /*
4588 * allocate packets 4589 * allocate packets
4589 */ 4590 */
4590 priv->rx_buffers = kmalloc(RX_QUEUE_LENGTH * 4591 priv->rx_buffers = kmalloc_array(RX_QUEUE_LENGTH,
4591 sizeof(struct ipw2100_rx_packet), 4592 sizeof(struct ipw2100_rx_packet),
4592 GFP_KERNEL); 4593 GFP_KERNEL);
4593 if (!priv->rx_buffers) { 4594 if (!priv->rx_buffers) {
4594 IPW_DEBUG_INFO("can't allocate rx packet buffer table\n"); 4595 IPW_DEBUG_INFO("can't allocate rx packet buffer table\n");
4595 4596
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
index f26beeb6c5ff..8a858f7e36f4 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
@@ -3208,13 +3208,13 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
3208 3208
3209 IPW_DEBUG_TRACE("<< :\n"); 3209 IPW_DEBUG_TRACE("<< :\n");
3210 3210
3211 virts = kmalloc(sizeof(void *) * CB_NUMBER_OF_ELEMENTS_SMALL, 3211 virts = kmalloc_array(CB_NUMBER_OF_ELEMENTS_SMALL, sizeof(void *),
3212 GFP_KERNEL); 3212 GFP_KERNEL);
3213 if (!virts) 3213 if (!virts)
3214 return -ENOMEM; 3214 return -ENOMEM;
3215 3215
3216 phys = kmalloc(sizeof(dma_addr_t) * CB_NUMBER_OF_ELEMENTS_SMALL, 3216 phys = kmalloc_array(CB_NUMBER_OF_ELEMENTS_SMALL, sizeof(dma_addr_t),
3217 GFP_KERNEL); 3217 GFP_KERNEL);
3218 if (!phys) { 3218 if (!phys) {
3219 kfree(virts); 3219 kfree(virts);
3220 return -ENOMEM; 3220 return -ENOMEM;
@@ -3782,7 +3782,7 @@ static int ipw_queue_tx_init(struct ipw_priv *priv,
3782{ 3782{
3783 struct pci_dev *dev = priv->pci_dev; 3783 struct pci_dev *dev = priv->pci_dev;
3784 3784
3785 q->txb = kmalloc(sizeof(q->txb[0]) * count, GFP_KERNEL); 3785 q->txb = kmalloc_array(count, sizeof(q->txb[0]), GFP_KERNEL);
3786 if (!q->txb) { 3786 if (!q->txb) {
3787 IPW_ERROR("vmalloc for auxiliary BD structures failed\n"); 3787 IPW_ERROR("vmalloc for auxiliary BD structures failed\n");
3788 return -ENOMEM; 3788 return -ENOMEM;
diff --git a/drivers/net/wireless/intersil/hostap/hostap_info.c b/drivers/net/wireless/intersil/hostap/hostap_info.c
index de8a099a9386..da8c30f10d92 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_info.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_info.c
@@ -271,8 +271,9 @@ static void prism2_info_scanresults(local_info_t *local, unsigned char *buf,
271 left -= 4; 271 left -= 4;
272 272
273 new_count = left / sizeof(struct hfa384x_scan_result); 273 new_count = left / sizeof(struct hfa384x_scan_result);
274 results = kmalloc(new_count * sizeof(struct hfa384x_hostscan_result), 274 results = kmalloc_array(new_count,
275 GFP_ATOMIC); 275 sizeof(struct hfa384x_hostscan_result),
276 GFP_ATOMIC);
276 if (results == NULL) 277 if (results == NULL)
277 return; 278 return;
278 279
diff --git a/drivers/net/wireless/intersil/hostap/hostap_ioctl.c b/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
index c1bc0a6ef300..1ca9731d9b14 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
@@ -513,8 +513,8 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
513 return -EOPNOTSUPP; 513 return -EOPNOTSUPP;
514 } 514 }
515 515
516 addr = kmalloc(sizeof(struct sockaddr) * IW_MAX_AP, GFP_KERNEL); 516 addr = kmalloc_array(IW_MAX_AP, sizeof(struct sockaddr), GFP_KERNEL);
517 qual = kmalloc(sizeof(struct iw_quality) * IW_MAX_AP, GFP_KERNEL); 517 qual = kmalloc_array(IW_MAX_AP, sizeof(struct iw_quality), GFP_KERNEL);
518 if (addr == NULL || qual == NULL) { 518 if (addr == NULL || qual == NULL) {
519 kfree(addr); 519 kfree(addr);
520 kfree(qual); 520 kfree(qual);
diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
index b01b44a5d16e..1f6d9f357e57 100644
--- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
@@ -732,7 +732,8 @@ static int zd_mac_config_beacon(struct ieee80211_hw *hw, struct sk_buff *beacon,
732 732
733 /* Alloc memory for full beacon write at once. */ 733 /* Alloc memory for full beacon write at once. */
734 num_cmds = 1 + zd_chip_is_zd1211b(&mac->chip) + full_len; 734 num_cmds = 1 + zd_chip_is_zd1211b(&mac->chip) + full_len;
735 ioreqs = kmalloc(num_cmds * sizeof(struct zd_ioreq32), GFP_KERNEL); 735 ioreqs = kmalloc_array(num_cmds, sizeof(struct zd_ioreq32),
736 GFP_KERNEL);
736 if (!ioreqs) { 737 if (!ioreqs) {
737 r = -ENOMEM; 738 r = -ENOMEM;
738 goto out_nofree; 739 goto out_nofree;
diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
index 102646fedb56..ac0672b8dfca 100644
--- a/drivers/pcmcia/cistpl.c
+++ b/drivers/pcmcia/cistpl.c
@@ -1481,11 +1481,11 @@ static ssize_t pccard_extract_cis(struct pcmcia_socket *s, char *buf,
1481 u_char *tuplebuffer; 1481 u_char *tuplebuffer;
1482 u_char *tempbuffer; 1482 u_char *tempbuffer;
1483 1483
1484 tuplebuffer = kmalloc(sizeof(u_char) * 256, GFP_KERNEL); 1484 tuplebuffer = kmalloc_array(256, sizeof(u_char), GFP_KERNEL);
1485 if (!tuplebuffer) 1485 if (!tuplebuffer)
1486 return -ENOMEM; 1486 return -ENOMEM;
1487 1487
1488 tempbuffer = kmalloc(sizeof(u_char) * 258, GFP_KERNEL); 1488 tempbuffer = kmalloc_array(258, sizeof(u_char), GFP_KERNEL);
1489 if (!tempbuffer) { 1489 if (!tempbuffer) {
1490 ret = -ENOMEM; 1490 ret = -ENOMEM;
1491 goto free_tuple; 1491 goto free_tuple;
diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
index e582a21cfe54..844537681fd7 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx.c
@@ -81,7 +81,8 @@ static int imx_dt_node_to_map(struct pinctrl_dev *pctldev,
81 map_num++; 81 map_num++;
82 } 82 }
83 83
84 new_map = kmalloc(sizeof(struct pinctrl_map) * map_num, GFP_KERNEL); 84 new_map = kmalloc_array(map_num, sizeof(struct pinctrl_map),
85 GFP_KERNEL);
85 if (!new_map) 86 if (!new_map)
86 return -ENOMEM; 87 return -ENOMEM;
87 88
diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
index 5af89de0ff02..e7169ac7799f 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
@@ -241,7 +241,8 @@ static int imx1_dt_node_to_map(struct pinctrl_dev *pctldev,
241 for (i = 0; i < grp->npins; i++) 241 for (i = 0; i < grp->npins; i++)
242 map_num++; 242 map_num++;
243 243
244 new_map = kmalloc(sizeof(struct pinctrl_map) * map_num, GFP_KERNEL); 244 new_map = kmalloc_array(map_num, sizeof(struct pinctrl_map),
245 GFP_KERNEL);
245 if (!new_map) 246 if (!new_map)
246 return -ENOMEM; 247 return -ENOMEM;
247 248
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 25e80a5370ca..44459d28efd5 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -352,7 +352,7 @@ static int sunxi_pctrl_dt_node_to_map(struct pinctrl_dev *pctldev,
352 * any configuration. 352 * any configuration.
353 */ 353 */
354 nmaps = npins * 2; 354 nmaps = npins * 2;
355 *map = kmalloc(nmaps * sizeof(struct pinctrl_map), GFP_KERNEL); 355 *map = kmalloc_array(nmaps, sizeof(struct pinctrl_map), GFP_KERNEL);
356 if (!*map) 356 if (!*map)
357 return -ENOMEM; 357 return -ENOMEM;
358 358
diff --git a/drivers/s390/block/dasd_eer.c b/drivers/s390/block/dasd_eer.c
index fb2c3599d95c..0af8c5295b65 100644
--- a/drivers/s390/block/dasd_eer.c
+++ b/drivers/s390/block/dasd_eer.c
@@ -561,8 +561,8 @@ static int dasd_eer_open(struct inode *inp, struct file *filp)
561 return -EINVAL; 561 return -EINVAL;
562 } 562 }
563 eerb->buffersize = eerb->buffer_page_count * PAGE_SIZE; 563 eerb->buffersize = eerb->buffer_page_count * PAGE_SIZE;
564 eerb->buffer = kmalloc(eerb->buffer_page_count * sizeof(char *), 564 eerb->buffer = kmalloc_array(eerb->buffer_page_count, sizeof(char *),
565 GFP_KERNEL); 565 GFP_KERNEL);
566 if (!eerb->buffer) { 566 if (!eerb->buffer) {
567 kfree(eerb); 567 kfree(eerb);
568 return -ENOMEM; 568 return -ENOMEM;
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index 1c98023cffd4..5b8af2782282 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -719,7 +719,8 @@ tty3270_alloc_view(void)
719 if (!tp) 719 if (!tp)
720 goto out_err; 720 goto out_err;
721 tp->freemem_pages = 721 tp->freemem_pages =
722 kmalloc(sizeof(void *) * TTY3270_STRING_PAGES, GFP_KERNEL); 722 kmalloc_array(TTY3270_STRING_PAGES, sizeof(void *),
723 GFP_KERNEL);
723 if (!tp->freemem_pages) 724 if (!tp->freemem_pages)
724 goto out_tp; 725 goto out_tp;
725 INIT_LIST_HEAD(&tp->freemem); 726 INIT_LIST_HEAD(&tp->freemem);
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index ed80d00cdb6f..a9ae827cc1ce 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -899,9 +899,9 @@ int pkey_findcard(const struct pkey_seckey *seckey,
899 return -EINVAL; 899 return -EINVAL;
900 900
901 /* fetch status of all crypto cards */ 901 /* fetch status of all crypto cards */
902 device_status = kmalloc(MAX_ZDEV_ENTRIES_EXT 902 device_status = kmalloc_array(MAX_ZDEV_ENTRIES_EXT,
903 * sizeof(struct zcrypt_device_status_ext), 903 sizeof(struct zcrypt_device_status_ext),
904 GFP_KERNEL); 904 GFP_KERNEL);
905 if (!device_status) 905 if (!device_status)
906 return -ENOMEM; 906 return -ENOMEM;
907 zcrypt_device_status_mask_ext(device_status); 907 zcrypt_device_status_mask_ext(device_status);
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index e7961cbd2c55..a9831bd37a73 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -4132,7 +4132,7 @@ static int aac_convert_sgraw2(struct aac_raw_io2 *rio2, int pages, int nseg, int
4132 if (aac_convert_sgl == 0) 4132 if (aac_convert_sgl == 0)
4133 return 0; 4133 return 0;
4134 4134
4135 sge = kmalloc(nseg_new * sizeof(struct sge_ieee1212), GFP_ATOMIC); 4135 sge = kmalloc_array(nseg_new, sizeof(struct sge_ieee1212), GFP_ATOMIC);
4136 if (sge == NULL) 4136 if (sge == NULL)
4137 return -ENOMEM; 4137 return -ENOMEM;
4138 4138
diff --git a/drivers/scsi/aha1542.c b/drivers/scsi/aha1542.c
index 124217927c4a..41add33e3f1f 100644
--- a/drivers/scsi/aha1542.c
+++ b/drivers/scsi/aha1542.c
@@ -400,7 +400,8 @@ static int aha1542_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *cmd)
400#endif 400#endif
401 if (bufflen) { /* allocate memory before taking host_lock */ 401 if (bufflen) { /* allocate memory before taking host_lock */
402 sg_count = scsi_sg_count(cmd); 402 sg_count = scsi_sg_count(cmd);
403 cptr = kmalloc(sizeof(*cptr) * sg_count, GFP_KERNEL | GFP_DMA); 403 cptr = kmalloc_array(sg_count, sizeof(*cptr),
404 GFP_KERNEL | GFP_DMA);
404 if (!cptr) 405 if (!cptr)
405 return SCSI_MLQUEUE_HOST_BUSY; 406 return SCSI_MLQUEUE_HOST_BUSY;
406 } else { 407 } else {
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 034f4eebb160..67d292dcc607 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -7063,7 +7063,8 @@ ahd_init(struct ahd_softc *ahd)
7063 AHD_ASSERT_MODES(ahd, AHD_MODE_SCSI_MSK, AHD_MODE_SCSI_MSK); 7063 AHD_ASSERT_MODES(ahd, AHD_MODE_SCSI_MSK, AHD_MODE_SCSI_MSK);
7064 7064
7065 ahd->stack_size = ahd_probe_stack_size(ahd); 7065 ahd->stack_size = ahd_probe_stack_size(ahd);
7066 ahd->saved_stack = kmalloc(ahd->stack_size * sizeof(uint16_t), GFP_ATOMIC); 7066 ahd->saved_stack = kmalloc_array(ahd->stack_size, sizeof(uint16_t),
7067 GFP_ATOMIC);
7067 if (ahd->saved_stack == NULL) 7068 if (ahd->saved_stack == NULL)
7068 return (ENOMEM); 7069 return (ENOMEM);
7069 7070
diff --git a/drivers/scsi/aic94xx/aic94xx_hwi.c b/drivers/scsi/aic94xx/aic94xx_hwi.c
index 2dbc8330d7d3..35e0b5b64e8f 100644
--- a/drivers/scsi/aic94xx/aic94xx_hwi.c
+++ b/drivers/scsi/aic94xx/aic94xx_hwi.c
@@ -291,7 +291,8 @@ static int asd_alloc_edbs(struct asd_ha_struct *asd_ha, gfp_t gfp_flags)
291 struct asd_seq_data *seq = &asd_ha->seq; 291 struct asd_seq_data *seq = &asd_ha->seq;
292 int i; 292 int i;
293 293
294 seq->edb_arr = kmalloc(seq->num_edbs*sizeof(*seq->edb_arr), gfp_flags); 294 seq->edb_arr = kmalloc_array(seq->num_edbs, sizeof(*seq->edb_arr),
295 gfp_flags);
295 if (!seq->edb_arr) 296 if (!seq->edb_arr)
296 return -ENOMEM; 297 return -ENOMEM;
297 298
@@ -323,8 +324,8 @@ static int asd_alloc_escbs(struct asd_ha_struct *asd_ha,
323 struct asd_ascb *escb; 324 struct asd_ascb *escb;
324 int i, escbs; 325 int i, escbs;
325 326
326 seq->escb_arr = kmalloc(seq->num_escbs*sizeof(*seq->escb_arr), 327 seq->escb_arr = kmalloc_array(seq->num_escbs, sizeof(*seq->escb_arr),
327 gfp_flags); 328 gfp_flags);
328 if (!seq->escb_arr) 329 if (!seq->escb_arr)
329 return -ENOMEM; 330 return -ENOMEM;
330 331
diff --git a/drivers/scsi/arm/queue.c b/drivers/scsi/arm/queue.c
index 3441ce3ebabf..996dfe903928 100644
--- a/drivers/scsi/arm/queue.c
+++ b/drivers/scsi/arm/queue.c
@@ -70,7 +70,7 @@ int queue_initialise (Queue_t *queue)
70 * need to keep free lists or allocate this 70 * need to keep free lists or allocate this
71 * memory. 71 * memory.
72 */ 72 */
73 queue->alloc = q = kmalloc(sizeof(QE_t) * nqueues, GFP_KERNEL); 73 queue->alloc = q = kmalloc_array(nqueues, sizeof(QE_t), GFP_KERNEL);
74 if (q) { 74 if (q) {
75 for (; nqueues; q++, nqueues--) { 75 for (; nqueues; q++, nqueues--) {
76 SET_MAGIC(q, QUEUE_MAGIC_FREE); 76 SET_MAGIC(q, QUEUE_MAGIC_FREE);
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index b3cfdd5f4d1c..d981c16cd611 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -2483,8 +2483,9 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
2483 return -ENOMEM; 2483 return -ENOMEM;
2484 } 2484 }
2485 2485
2486 mem_arr_orig = kmalloc(sizeof(*mem_arr_orig) * BEISCSI_MAX_FRAGS_INIT, 2486 mem_arr_orig = kmalloc_array(BEISCSI_MAX_FRAGS_INIT,
2487 GFP_KERNEL); 2487 sizeof(*mem_arr_orig),
2488 GFP_KERNEL);
2488 if (!mem_arr_orig) { 2489 if (!mem_arr_orig) {
2489 kfree(phba->init_mem); 2490 kfree(phba->init_mem);
2490 kfree(phwi_ctrlr->wrb_context); 2491 kfree(phwi_ctrlr->wrb_context);
@@ -2533,8 +2534,8 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
2533 } while (alloc_size); 2534 } while (alloc_size);
2534 mem_descr->num_elements = j; 2535 mem_descr->num_elements = j;
2535 mem_descr->size_in_bytes = phba->mem_req[i]; 2536 mem_descr->size_in_bytes = phba->mem_req[i];
2536 mem_descr->mem_array = kmalloc(sizeof(*mem_arr) * j, 2537 mem_descr->mem_array = kmalloc_array(j, sizeof(*mem_arr),
2537 GFP_KERNEL); 2538 GFP_KERNEL);
2538 if (!mem_descr->mem_array) 2539 if (!mem_descr->mem_array)
2539 goto free_mem; 2540 goto free_mem;
2540 2541
@@ -3353,8 +3354,9 @@ beiscsi_create_wrb_rings(struct beiscsi_hba *phba,
3353 idx = 0; 3354 idx = 0;
3354 mem_descr = phba->init_mem; 3355 mem_descr = phba->init_mem;
3355 mem_descr += HWI_MEM_WRB; 3356 mem_descr += HWI_MEM_WRB;
3356 pwrb_arr = kmalloc(sizeof(*pwrb_arr) * phba->params.cxns_per_ctrl, 3357 pwrb_arr = kmalloc_array(phba->params.cxns_per_ctrl,
3357 GFP_KERNEL); 3358 sizeof(*pwrb_arr),
3359 GFP_KERNEL);
3358 if (!pwrb_arr) { 3360 if (!pwrb_arr) {
3359 beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT, 3361 beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
3360 "BM_%d : Memory alloc failed in create wrb ring.\n"); 3362 "BM_%d : Memory alloc failed in create wrb ring.\n");
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 097f37de6ce9..ea23c8dffc25 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -1390,8 +1390,8 @@ static void fcoe_ctlr_recv_clr_vlink(struct fcoe_ctlr *fip,
1390 */ 1390 */
1391 num_vlink_desc = rlen / sizeof(*vp); 1391 num_vlink_desc = rlen / sizeof(*vp);
1392 if (num_vlink_desc) 1392 if (num_vlink_desc)
1393 vlink_desc_arr = kmalloc(sizeof(vp) * num_vlink_desc, 1393 vlink_desc_arr = kmalloc_array(num_vlink_desc, sizeof(vp),
1394 GFP_ATOMIC); 1394 GFP_ATOMIC);
1395 if (!vlink_desc_arr) 1395 if (!vlink_desc_arr)
1396 return; 1396 return;
1397 num_vlink_desc = 0; 1397 num_vlink_desc = 0;
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 3a9eca163db8..e6f31fa9ec65 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2177,8 +2177,9 @@ static int hpsa_allocate_ioaccel2_sg_chain_blocks(struct ctlr_info *h)
2177 return -ENOMEM; 2177 return -ENOMEM;
2178 for (i = 0; i < h->nr_cmds; i++) { 2178 for (i = 0; i < h->nr_cmds; i++) {
2179 h->ioaccel2_cmd_sg_list[i] = 2179 h->ioaccel2_cmd_sg_list[i] =
2180 kmalloc(sizeof(*h->ioaccel2_cmd_sg_list[i]) * 2180 kmalloc_array(h->maxsgentries,
2181 h->maxsgentries, GFP_KERNEL); 2181 sizeof(*h->ioaccel2_cmd_sg_list[i]),
2182 GFP_KERNEL);
2182 if (!h->ioaccel2_cmd_sg_list[i]) 2183 if (!h->ioaccel2_cmd_sg_list[i])
2183 goto clean; 2184 goto clean;
2184 } 2185 }
@@ -2216,8 +2217,9 @@ static int hpsa_alloc_sg_chain_blocks(struct ctlr_info *h)
2216 return -ENOMEM; 2217 return -ENOMEM;
2217 2218
2218 for (i = 0; i < h->nr_cmds; i++) { 2219 for (i = 0; i < h->nr_cmds; i++) {
2219 h->cmd_sg_list[i] = kmalloc(sizeof(*h->cmd_sg_list[i]) * 2220 h->cmd_sg_list[i] = kmalloc_array(h->chainsize,
2220 h->chainsize, GFP_KERNEL); 2221 sizeof(*h->cmd_sg_list[i]),
2222 GFP_KERNEL);
2221 if (!h->cmd_sg_list[i]) 2223 if (!h->cmd_sg_list[i])
2222 goto clean; 2224 goto clean;
2223 2225
@@ -6407,7 +6409,7 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp)
6407 status = -ENOMEM; 6409 status = -ENOMEM;
6408 goto cleanup1; 6410 goto cleanup1;
6409 } 6411 }
6410 buff_size = kmalloc(SG_ENTRIES_IN_CMD * sizeof(int), GFP_KERNEL); 6412 buff_size = kmalloc_array(SG_ENTRIES_IN_CMD, sizeof(int), GFP_KERNEL);
6411 if (!buff_size) { 6413 if (!buff_size) {
6412 status = -ENOMEM; 6414 status = -ENOMEM;
6413 goto cleanup1; 6415 goto cleanup1;
@@ -7151,7 +7153,7 @@ static int controller_reset_failed(struct CfgTable __iomem *cfgtable)
7151 char *driver_ver, *old_driver_ver; 7153 char *driver_ver, *old_driver_ver;
7152 int rc, size = sizeof(cfgtable->driver_version); 7154 int rc, size = sizeof(cfgtable->driver_version);
7153 7155
7154 old_driver_ver = kmalloc(2 * size, GFP_KERNEL); 7156 old_driver_ver = kmalloc_array(2, size, GFP_KERNEL);
7155 if (!old_driver_ver) 7157 if (!old_driver_ver)
7156 return -ENOMEM; 7158 return -ENOMEM;
7157 driver_ver = old_driver_ver + size; 7159 driver_ver = old_driver_ver + size;
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 41361662ff08..0758edb9dfe2 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -120,8 +120,9 @@ lpfc_mem_alloc(struct lpfc_hba *phba, int align)
120 if (!phba->lpfc_mbuf_pool) 120 if (!phba->lpfc_mbuf_pool)
121 goto fail_free_dma_buf_pool; 121 goto fail_free_dma_buf_pool;
122 122
123 pool->elements = kmalloc(sizeof(struct lpfc_dmabuf) * 123 pool->elements = kmalloc_array(LPFC_MBUF_POOL_SIZE,
124 LPFC_MBUF_POOL_SIZE, GFP_KERNEL); 124 sizeof(struct lpfc_dmabuf),
125 GFP_KERNEL);
125 if (!pool->elements) 126 if (!pool->elements)
126 goto fail_free_lpfc_mbuf_pool; 127 goto fail_free_lpfc_mbuf_pool;
127 128
diff --git a/drivers/scsi/mac53c94.c b/drivers/scsi/mac53c94.c
index 8c4d3003b68b..177701dfdfcb 100644
--- a/drivers/scsi/mac53c94.c
+++ b/drivers/scsi/mac53c94.c
@@ -464,8 +464,9 @@ static int mac53c94_probe(struct macio_dev *mdev, const struct of_device_id *mat
464 * +1 to allow for aligning. 464 * +1 to allow for aligning.
465 * XXX FIXME: Use DMA consistent routines 465 * XXX FIXME: Use DMA consistent routines
466 */ 466 */
467 dma_cmd_space = kmalloc((host->sg_tablesize + 2) * 467 dma_cmd_space = kmalloc_array(host->sg_tablesize + 2,
468 sizeof(struct dbdma_cmd), GFP_KERNEL); 468 sizeof(struct dbdma_cmd),
469 GFP_KERNEL);
469 if (dma_cmd_space == 0) { 470 if (dma_cmd_space == 0) {
470 printk(KERN_ERR "mac53c94: couldn't allocate dma " 471 printk(KERN_ERR "mac53c94: couldn't allocate dma "
471 "command space for %pOF\n", node); 472 "command space for %pOF\n", node);
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index 3b3767e240d8..8e8cf1145d7f 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -4292,7 +4292,8 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
4292 goto out_host_put; 4292 goto out_host_put;
4293 } 4293 }
4294 4294
4295 adapter->scb_list = kmalloc(sizeof(scb_t) * MAX_COMMANDS, GFP_KERNEL); 4295 adapter->scb_list = kmalloc_array(MAX_COMMANDS, sizeof(scb_t),
4296 GFP_KERNEL);
4296 if (!adapter->scb_list) { 4297 if (!adapter->scb_list) {
4297 dev_warn(&pdev->dev, "out of RAM\n"); 4298 dev_warn(&pdev->dev, "out of RAM\n");
4298 goto out_free_cmd_buffer; 4299 goto out_free_cmd_buffer;
diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c
index bb802b0c12b8..8428247015db 100644
--- a/drivers/scsi/megaraid/megaraid_mm.c
+++ b/drivers/scsi/megaraid/megaraid_mm.c
@@ -935,10 +935,12 @@ mraid_mm_register_adp(mraid_mmadp_t *lld_adp)
935 * Allocate single blocks of memory for all required kiocs, 935 * Allocate single blocks of memory for all required kiocs,
936 * mailboxes and passthru structures. 936 * mailboxes and passthru structures.
937 */ 937 */
938 adapter->kioc_list = kmalloc(sizeof(uioc_t) * lld_adp->max_kioc, 938 adapter->kioc_list = kmalloc_array(lld_adp->max_kioc,
939 GFP_KERNEL); 939 sizeof(uioc_t),
940 adapter->mbox_list = kmalloc(sizeof(mbox64_t) * lld_adp->max_kioc, 940 GFP_KERNEL);
941 GFP_KERNEL); 941 adapter->mbox_list = kmalloc_array(lld_adp->max_kioc,
942 sizeof(mbox64_t),
943 GFP_KERNEL);
942 adapter->pthru_dma_pool = dma_pool_create("megaraid mm pthru pool", 944 adapter->pthru_dma_pool = dma_pool_create("megaraid mm pthru pool",
943 &adapter->pdev->dev, 945 &adapter->pdev->dev,
944 sizeof(mraid_passthru_t), 946 sizeof(mraid_passthru_t),
diff --git a/drivers/scsi/osst.c b/drivers/scsi/osst.c
index 2bbe797f8c3d..773c4bfeb0f8 100644
--- a/drivers/scsi/osst.c
+++ b/drivers/scsi/osst.c
@@ -5856,7 +5856,9 @@ static int osst_probe(struct device *dev)
5856 /* if this is the first attach, build the infrastructure */ 5856 /* if this is the first attach, build the infrastructure */
5857 write_lock(&os_scsi_tapes_lock); 5857 write_lock(&os_scsi_tapes_lock);
5858 if (os_scsi_tapes == NULL) { 5858 if (os_scsi_tapes == NULL) {
5859 os_scsi_tapes = kmalloc(osst_max_dev * sizeof(struct osst_tape *), GFP_ATOMIC); 5859 os_scsi_tapes = kmalloc_array(osst_max_dev,
5860 sizeof(struct osst_tape *),
5861 GFP_ATOMIC);
5860 if (os_scsi_tapes == NULL) { 5862 if (os_scsi_tapes == NULL) {
5861 write_unlock(&os_scsi_tapes_lock); 5863 write_unlock(&os_scsi_tapes_lock);
5862 printk(KERN_ERR "osst :E: Unable to allocate array for OnStream SCSI tapes.\n"); 5864 printk(KERN_ERR "osst :E: Unable to allocate array for OnStream SCSI tapes.\n");
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 872d66dd79cd..de2bc78449e7 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -1230,7 +1230,7 @@ qla82xx_pinit_from_rom(scsi_qla_host_t *vha)
1230 ql_log(ql_log_info, vha, 0x0072, 1230 ql_log(ql_log_info, vha, 0x0072,
1231 "%d CRB init values found in ROM.\n", n); 1231 "%d CRB init values found in ROM.\n", n);
1232 1232
1233 buf = kmalloc(n * sizeof(struct crb_addr_pair), GFP_KERNEL); 1233 buf = kmalloc_array(n, sizeof(struct crb_addr_pair), GFP_KERNEL);
1234 if (buf == NULL) { 1234 if (buf == NULL) {
1235 ql_log(ql_log_fatal, vha, 0x010c, 1235 ql_log(ql_log_fatal, vha, 0x010c,
1236 "Unable to allocate memory.\n"); 1236 "Unable to allocate memory.\n");
diff --git a/drivers/scsi/qla4xxx/ql4_nx.c b/drivers/scsi/qla4xxx/ql4_nx.c
index 43f73583ef5c..d2b333d629be 100644
--- a/drivers/scsi/qla4xxx/ql4_nx.c
+++ b/drivers/scsi/qla4xxx/ql4_nx.c
@@ -1077,7 +1077,7 @@ qla4_82xx_pinit_from_rom(struct scsi_qla_host *ha, int verbose)
1077 ql4_printk(KERN_INFO, ha, 1077 ql4_printk(KERN_INFO, ha,
1078 "%s: %d CRB init values found in ROM.\n", DRIVER_NAME, n); 1078 "%s: %d CRB init values found in ROM.\n", DRIVER_NAME, n);
1079 1079
1080 buf = kmalloc(n * sizeof(struct crb_addr_pair), GFP_KERNEL); 1080 buf = kmalloc_array(n, sizeof(struct crb_addr_pair), GFP_KERNEL);
1081 if (buf == NULL) { 1081 if (buf == NULL) {
1082 ql4_printk(KERN_WARNING, ha, 1082 ql4_printk(KERN_WARNING, ha,
1083 "%s: [ERROR] Unable to malloc memory.\n", DRIVER_NAME); 1083 "%s: [ERROR] Unable to malloc memory.\n", DRIVER_NAME);
diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 592b6dbf8b35..8332f958cc42 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -1820,8 +1820,9 @@ static int pqi_update_scsi_devices(struct pqi_ctrl_info *ctrl_info)
1820 1820
1821 num_new_devices = num_physicals + num_logicals; 1821 num_new_devices = num_physicals + num_logicals;
1822 1822
1823 new_device_list = kmalloc(sizeof(*new_device_list) * 1823 new_device_list = kmalloc_array(num_new_devices,
1824 num_new_devices, GFP_KERNEL); 1824 sizeof(*new_device_list),
1825 GFP_KERNEL);
1825 if (!new_device_list) { 1826 if (!new_device_list) {
1826 dev_warn(&ctrl_info->pci_dev->dev, "%s\n", out_of_memory_msg); 1827 dev_warn(&ctrl_info->pci_dev->dev, "%s\n", out_of_memory_msg);
1827 rc = -ENOMEM; 1828 rc = -ENOMEM;
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index c9e27e752c25..c16e4de3a03f 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4915,7 +4915,8 @@ static int sgl_map_user_pages(struct st_buffer *STbp,
4915 if (count == 0) 4915 if (count == 0)
4916 return 0; 4916 return 0;
4917 4917
4918 if ((pages = kmalloc(max_pages * sizeof(*pages), GFP_KERNEL)) == NULL) 4918 pages = kmalloc_array(max_pages, sizeof(*pages), GFP_KERNEL);
4919 if (pages == NULL)
4919 return -ENOMEM; 4920 return -ENOMEM;
4920 4921
4921 /* Try to fault in all of the necessary pages */ 4922 /* Try to fault in all of the necessary pages */
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 45d04631888a..6dc8891ccb74 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -794,9 +794,10 @@ static int virtscsi_init(struct virtio_device *vdev,
794 struct irq_affinity desc = { .pre_vectors = 2 }; 794 struct irq_affinity desc = { .pre_vectors = 2 };
795 795
796 num_vqs = vscsi->num_queues + VIRTIO_SCSI_VQ_BASE; 796 num_vqs = vscsi->num_queues + VIRTIO_SCSI_VQ_BASE;
797 vqs = kmalloc(num_vqs * sizeof(struct virtqueue *), GFP_KERNEL); 797 vqs = kmalloc_array(num_vqs, sizeof(struct virtqueue *), GFP_KERNEL);
798 callbacks = kmalloc(num_vqs * sizeof(vq_callback_t *), GFP_KERNEL); 798 callbacks = kmalloc_array(num_vqs, sizeof(vq_callback_t *),
799 names = kmalloc(num_vqs * sizeof(char *), GFP_KERNEL); 799 GFP_KERNEL);
800 names = kmalloc_array(num_vqs, sizeof(char *), GFP_KERNEL);
800 801
801 if (!callbacks || !vqs || !names) { 802 if (!callbacks || !vqs || !names) {
802 err = -ENOMEM; 803 err = -ENOMEM;
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index ba3cfa8e279b..a7e94a3decf2 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -1181,7 +1181,7 @@ static int qman_create_portal(struct qman_portal *portal,
1181 qm_dqrr_set_ithresh(p, QMAN_PIRQ_DQRR_ITHRESH); 1181 qm_dqrr_set_ithresh(p, QMAN_PIRQ_DQRR_ITHRESH);
1182 qm_mr_set_ithresh(p, QMAN_PIRQ_MR_ITHRESH); 1182 qm_mr_set_ithresh(p, QMAN_PIRQ_MR_ITHRESH);
1183 qm_out(p, QM_REG_ITPR, QMAN_PIRQ_IPERIOD); 1183 qm_out(p, QM_REG_ITPR, QMAN_PIRQ_IPERIOD);
1184 portal->cgrs = kmalloc(2 * sizeof(*cgrs), GFP_KERNEL); 1184 portal->cgrs = kmalloc_array(2, sizeof(*cgrs), GFP_KERNEL);
1185 if (!portal->cgrs) 1185 if (!portal->cgrs)
1186 goto fail_cgrs; 1186 goto fail_cgrs;
1187 /* initial snapshot is no-depletion */ 1187 /* initial snapshot is no-depletion */
diff --git a/drivers/staging/media/zoran/zoran_driver.c b/drivers/staging/media/zoran/zoran_driver.c
index d2e13fffbc6b..906c3549e2ba 100644
--- a/drivers/staging/media/zoran/zoran_driver.c
+++ b/drivers/staging/media/zoran/zoran_driver.c
@@ -941,7 +941,7 @@ static int zoran_open(struct file *file)
941 /* used to be BUZ_MAX_WIDTH/HEIGHT, but that gives overflows 941 /* used to be BUZ_MAX_WIDTH/HEIGHT, but that gives overflows
942 * on norm-change! */ 942 * on norm-change! */
943 fh->overlay_mask = 943 fh->overlay_mask =
944 kmalloc(((768 + 31) / 32) * 576 * 4, GFP_KERNEL); 944 kmalloc(array3_size((768 + 31) / 32, 576, 4), GFP_KERNEL);
945 if (!fh->overlay_mask) { 945 if (!fh->overlay_mask) {
946 dprintk(1, 946 dprintk(1,
947 KERN_ERR 947 KERN_ERR
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
index 37a610d05ad2..f2cdcc2bcab4 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
@@ -597,8 +597,9 @@ static void RxReorderIndicatePacket(struct ieee80211_device *ieee,
597 bool bMatchWinStart = false, bPktInBuf = false; 597 bool bMatchWinStart = false, bPktInBuf = false;
598 IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): Seq is %d,pTS->RxIndicateSeq is %d, WinSize is %d\n",__func__,SeqNum,pTS->RxIndicateSeq,WinSize); 598 IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): Seq is %d,pTS->RxIndicateSeq is %d, WinSize is %d\n",__func__,SeqNum,pTS->RxIndicateSeq,WinSize);
599 599
600 prxbIndicateArray = kmalloc(sizeof(struct ieee80211_rxb *) * 600 prxbIndicateArray = kmalloc_array(REORDER_WIN_SIZE,
601 REORDER_WIN_SIZE, GFP_KERNEL); 601 sizeof(struct ieee80211_rxb *),
602 GFP_KERNEL);
602 if (!prxbIndicateArray) 603 if (!prxbIndicateArray)
603 return; 604 return;
604 605
diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index a4df95cc7f60..8b17400f6c13 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -1640,8 +1640,8 @@ static short rtl8192_usb_initendpoints(struct net_device *dev)
1640{ 1640{
1641 struct r8192_priv *priv = ieee80211_priv(dev); 1641 struct r8192_priv *priv = ieee80211_priv(dev);
1642 1642
1643 priv->rx_urb = kmalloc(sizeof(struct urb *) * (MAX_RX_URB + 1), 1643 priv->rx_urb = kmalloc_array(MAX_RX_URB + 1, sizeof(struct urb *),
1644 GFP_KERNEL); 1644 GFP_KERNEL);
1645 if (!priv->rx_urb) 1645 if (!priv->rx_urb)
1646 return -ENOMEM; 1646 return -ENOMEM;
1647 1647
diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
index 1db1d97e72e7..cb4db1b3ca3c 100644
--- a/drivers/tty/hvc/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
@@ -1441,7 +1441,8 @@ static int hvcs_alloc_index_list(int n)
1441{ 1441{
1442 int i; 1442 int i;
1443 1443
1444 hvcs_index_list = kmalloc(n * sizeof(hvcs_index_count),GFP_KERNEL); 1444 hvcs_index_list = kmalloc_array(n, sizeof(hvcs_index_count),
1445 GFP_KERNEL);
1445 if (!hvcs_index_list) 1446 if (!hvcs_index_list)
1446 return -ENOMEM; 1447 return -ENOMEM;
1447 hvcs_index_count = n; 1448 hvcs_index_count = n;
diff --git a/drivers/tty/isicom.c b/drivers/tty/isicom.c
index bdd3027ef01b..8d96e86966f1 100644
--- a/drivers/tty/isicom.c
+++ b/drivers/tty/isicom.c
@@ -1477,7 +1477,7 @@ static int load_firmware(struct pci_dev *pdev,
1477 goto errrelfw; 1477 goto errrelfw;
1478 } 1478 }
1479 1479
1480 data = kmalloc(word_count * 2, GFP_KERNEL); 1480 data = kmalloc_array(word_count, 2, GFP_KERNEL);
1481 if (data == NULL) { 1481 if (data == NULL) {
1482 dev_err(&pdev->dev, "Card%d, firmware upload " 1482 dev_err(&pdev->dev, "Card%d, firmware upload "
1483 "failed, not enough memory\n", index + 1); 1483 "failed, not enough memory\n", index + 1);
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index 55b3eff148b1..8e4428725848 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -2738,8 +2738,9 @@ static int atmel_serial_probe(struct platform_device *pdev)
2738 2738
2739 if (!atmel_use_pdc_rx(&atmel_port->uart)) { 2739 if (!atmel_use_pdc_rx(&atmel_port->uart)) {
2740 ret = -ENOMEM; 2740 ret = -ENOMEM;
2741 data = kmalloc(sizeof(struct atmel_uart_char) 2741 data = kmalloc_array(ATMEL_SERIAL_RINGSIZE,
2742 * ATMEL_SERIAL_RINGSIZE, GFP_KERNEL); 2742 sizeof(struct atmel_uart_char),
2743 GFP_KERNEL);
2743 if (!data) 2744 if (!data)
2744 goto err_alloc_ring; 2745 goto err_alloc_ring;
2745 atmel_port->rx_ring.buf = data; 2746 atmel_port->rx_ring.buf = data;
diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
index 722a6690c70d..7c7ada0b3ea0 100644
--- a/drivers/tty/vt/consolemap.c
+++ b/drivers/tty/vt/consolemap.c
@@ -231,7 +231,7 @@ static void set_inverse_trans_unicode(struct vc_data *conp,
231 q = p->inverse_trans_unicode; 231 q = p->inverse_trans_unicode;
232 if (!q) { 232 if (!q) {
233 q = p->inverse_trans_unicode = 233 q = p->inverse_trans_unicode =
234 kmalloc(MAX_GLYPH * sizeof(u16), GFP_KERNEL); 234 kmalloc_array(MAX_GLYPH, sizeof(u16), GFP_KERNEL);
235 if (!q) 235 if (!q)
236 return; 236 return;
237 } 237 }
@@ -479,7 +479,8 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos)
479 479
480 p1 = p->uni_pgdir[n = unicode >> 11]; 480 p1 = p->uni_pgdir[n = unicode >> 11];
481 if (!p1) { 481 if (!p1) {
482 p1 = p->uni_pgdir[n] = kmalloc(32*sizeof(u16 *), GFP_KERNEL); 482 p1 = p->uni_pgdir[n] = kmalloc_array(32, sizeof(u16 *),
483 GFP_KERNEL);
483 if (!p1) return -ENOMEM; 484 if (!p1) return -ENOMEM;
484 for (i = 0; i < 32; i++) 485 for (i = 0; i < 32; i++)
485 p1[i] = NULL; 486 p1[i] = NULL;
@@ -487,7 +488,7 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos)
487 488
488 p2 = p1[n = (unicode >> 6) & 0x1f]; 489 p2 = p1[n = (unicode >> 6) & 0x1f];
489 if (!p2) { 490 if (!p2) {
490 p2 = p1[n] = kmalloc(64*sizeof(u16), GFP_KERNEL); 491 p2 = p1[n] = kmalloc_array(64, sizeof(u16), GFP_KERNEL);
491 if (!p2) return -ENOMEM; 492 if (!p2) return -ENOMEM;
492 memset(p2, 0xff, 64*sizeof(u16)); /* No glyphs for the characters (yet) */ 493 memset(p2, 0xff, 64*sizeof(u16)); /* No glyphs for the characters (yet) */
493 } 494 }
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 5d412df8e943..d5b4a2b44ab8 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -1624,7 +1624,7 @@ int vt_do_diacrit(unsigned int cmd, void __user *udp, int perm)
1624 struct kbdiacr *dia; 1624 struct kbdiacr *dia;
1625 int i; 1625 int i;
1626 1626
1627 dia = kmalloc(MAX_DIACR * sizeof(struct kbdiacr), 1627 dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr),
1628 GFP_KERNEL); 1628 GFP_KERNEL);
1629 if (!dia) 1629 if (!dia)
1630 return -ENOMEM; 1630 return -ENOMEM;
@@ -1657,7 +1657,7 @@ int vt_do_diacrit(unsigned int cmd, void __user *udp, int perm)
1657 struct kbdiacrsuc __user *a = udp; 1657 struct kbdiacrsuc __user *a = udp;
1658 void *buf; 1658 void *buf;
1659 1659
1660 buf = kmalloc(MAX_DIACR * sizeof(struct kbdiacruc), 1660 buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc),
1661 GFP_KERNEL); 1661 GFP_KERNEL);
1662 if (buf == NULL) 1662 if (buf == NULL)
1663 return -ENOMEM; 1663 return -ENOMEM;
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index 7851383fbd6c..90ea1cc52b7a 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -280,7 +280,8 @@ int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *t
280 280
281 /* Allocate a new buffer before freeing the old one ... */ 281 /* Allocate a new buffer before freeing the old one ... */
282 multiplier = use_unicode ? 3 : 1; /* chars can take up to 3 bytes */ 282 multiplier = use_unicode ? 3 : 1; /* chars can take up to 3 bytes */
283 bp = kmalloc(((sel_end-sel_start)/2+1)*multiplier, GFP_KERNEL); 283 bp = kmalloc_array((sel_end - sel_start) / 2 + 1, multiplier,
284 GFP_KERNEL);
284 if (!bp) { 285 if (!bp) {
285 printk(KERN_WARNING "selection: kmalloc() failed\n"); 286 printk(KERN_WARNING "selection: kmalloc() failed\n");
286 clear_selection(); 287 clear_selection();
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 76e16c5251b9..476dcc5f2da3 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -897,7 +897,7 @@ static int parse_usbdevfs_streams(struct usb_dev_state *ps,
897 if (num_streams_ret && (num_streams < 2 || num_streams > 65536)) 897 if (num_streams_ret && (num_streams < 2 || num_streams > 65536))
898 return -EINVAL; 898 return -EINVAL;
899 899
900 eps = kmalloc(num_eps * sizeof(*eps), GFP_KERNEL); 900 eps = kmalloc_array(num_eps, sizeof(*eps), GFP_KERNEL);
901 if (!eps) 901 if (!eps)
902 return -ENOMEM; 902 return -ENOMEM;
903 903
@@ -1602,8 +1602,9 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
1602 as->mem_usage = u; 1602 as->mem_usage = u;
1603 1603
1604 if (num_sgs) { 1604 if (num_sgs) {
1605 as->urb->sg = kmalloc(num_sgs * sizeof(struct scatterlist), 1605 as->urb->sg = kmalloc_array(num_sgs,
1606 GFP_KERNEL); 1606 sizeof(struct scatterlist),
1607 GFP_KERNEL);
1607 if (!as->urb->sg) { 1608 if (!as->urb->sg) {
1608 ret = -ENOMEM; 1609 ret = -ENOMEM;
1609 goto error; 1610 goto error;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 7b137003c2be..1a15392326fc 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -390,7 +390,7 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
390 } 390 }
391 391
392 /* initialize all the urbs we'll use */ 392 /* initialize all the urbs we'll use */
393 io->urbs = kmalloc(io->entries * sizeof(*io->urbs), mem_flags); 393 io->urbs = kmalloc_array(io->entries, sizeof(*io->urbs), mem_flags);
394 if (!io->urbs) 394 if (!io->urbs)
395 goto nomem; 395 goto nomem;
396 396
@@ -1824,8 +1824,8 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
1824 n = nintf = 0; 1824 n = nintf = 0;
1825 if (cp) { 1825 if (cp) {
1826 nintf = cp->desc.bNumInterfaces; 1826 nintf = cp->desc.bNumInterfaces;
1827 new_interfaces = kmalloc(nintf * sizeof(*new_interfaces), 1827 new_interfaces = kmalloc_array(nintf, sizeof(*new_interfaces),
1828 GFP_NOIO); 1828 GFP_NOIO);
1829 if (!new_interfaces) 1829 if (!new_interfaces)
1830 return -ENOMEM; 1830 return -ENOMEM;
1831 1831
diff --git a/drivers/usb/host/fhci-tds.c b/drivers/usb/host/fhci-tds.c
index 3a4e8f616751..f3308ce25043 100644
--- a/drivers/usb/host/fhci-tds.c
+++ b/drivers/usb/host/fhci-tds.c
@@ -189,7 +189,7 @@ u32 fhci_create_ep(struct fhci_usb *usb, enum fhci_mem_alloc data_mem,
189 goto err; 189 goto err;
190 } 190 }
191 191
192 buff = kmalloc(1028 * sizeof(*buff), GFP_KERNEL); 192 buff = kmalloc_array(1028, sizeof(*buff), GFP_KERNEL);
193 if (!buff) { 193 if (!buff) {
194 kfree(pkt); 194 kfree(pkt);
195 err_for = "buffer"; 195 err_for = "buffer";
diff --git a/drivers/usb/host/ohci-dbg.c b/drivers/usb/host/ohci-dbg.c
index d3ee1f52aaab..4f267dc93882 100644
--- a/drivers/usb/host/ohci-dbg.c
+++ b/drivers/usb/host/ohci-dbg.c
@@ -492,7 +492,7 @@ static ssize_t fill_periodic_buffer(struct debug_buffer *buf)
492 char *next; 492 char *next;
493 unsigned i; 493 unsigned i;
494 494
495 seen = kmalloc(DBG_SCHED_LIMIT * sizeof *seen, GFP_ATOMIC); 495 seen = kmalloc_array(DBG_SCHED_LIMIT, sizeof(*seen), GFP_ATOMIC);
496 if (!seen) 496 if (!seen)
497 return 0; 497 return 0;
498 seen_count = 0; 498 seen_count = 0;
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index 236a60f53099..c2e255f02a72 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -695,7 +695,10 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
695 dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n"); 695 dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n");
696 696
697 dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint); 697 dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
698 dev->ring_buffer = kmalloc(ring_buffer_size*(sizeof(size_t)+dev->interrupt_in_endpoint_size), GFP_KERNEL); 698 dev->ring_buffer =
699 kmalloc_array(ring_buffer_size,
700 sizeof(size_t) + dev->interrupt_in_endpoint_size,
701 GFP_KERNEL);
699 if (!dev->ring_buffer) 702 if (!dev->ring_buffer)
700 goto error; 703 goto error;
701 dev->interrupt_in_buffer = kmalloc(dev->interrupt_in_endpoint_size, GFP_KERNEL); 704 dev->interrupt_in_buffer = kmalloc(dev->interrupt_in_endpoint_size, GFP_KERNEL);
@@ -706,7 +709,9 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
706 goto error; 709 goto error;
707 dev->interrupt_out_endpoint_size = dev->interrupt_out_endpoint ? usb_endpoint_maxp(dev->interrupt_out_endpoint) : 710 dev->interrupt_out_endpoint_size = dev->interrupt_out_endpoint ? usb_endpoint_maxp(dev->interrupt_out_endpoint) :
708 udev->descriptor.bMaxPacketSize0; 711 udev->descriptor.bMaxPacketSize0;
709 dev->interrupt_out_buffer = kmalloc(write_buffer_size*dev->interrupt_out_endpoint_size, GFP_KERNEL); 712 dev->interrupt_out_buffer =
713 kmalloc_array(write_buffer_size,
714 dev->interrupt_out_endpoint_size, GFP_KERNEL);
710 if (!dev->interrupt_out_buffer) 715 if (!dev->interrupt_out_buffer)
711 goto error; 716 goto error;
712 dev->interrupt_out_urb = usb_alloc_urb(0, GFP_KERNEL); 717 dev->interrupt_out_urb = usb_alloc_urb(0, GFP_KERNEL);
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 62c91e360baf..2fb71303ec3a 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -736,7 +736,7 @@ static int iuu_uart_on(struct usb_serial_port *port)
736 int status; 736 int status;
737 u8 *buf; 737 u8 *buf;
738 738
739 buf = kmalloc(sizeof(u8) * 4, GFP_KERNEL); 739 buf = kmalloc(4, GFP_KERNEL);
740 740
741 if (!buf) 741 if (!buf)
742 return -ENOMEM; 742 return -ENOMEM;
@@ -790,7 +790,7 @@ static int iuu_uart_baud(struct usb_serial_port *port, u32 baud_base,
790 unsigned int T1FrekvensHZ = 0; 790 unsigned int T1FrekvensHZ = 0;
791 791
792 dev_dbg(&port->dev, "%s - enter baud_base=%d\n", __func__, baud_base); 792 dev_dbg(&port->dev, "%s - enter baud_base=%d\n", __func__, baud_base);
793 dataout = kmalloc(sizeof(u8) * 5, GFP_KERNEL); 793 dataout = kmalloc(5, GFP_KERNEL);
794 794
795 if (!dataout) 795 if (!dataout)
796 return -ENOMEM; 796 return -ENOMEM;
diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
index 900591df8bb2..6b8edf6178df 100644
--- a/drivers/usb/storage/alauda.c
+++ b/drivers/usb/storage/alauda.c
@@ -1025,7 +1025,7 @@ static int alauda_write_data(struct us_data *us, unsigned long address,
1025 * We also need a temporary block buffer, where we read in the old data, 1025 * We also need a temporary block buffer, where we read in the old data,
1026 * overwrite parts with the new data, and manipulate the redundancy data 1026 * overwrite parts with the new data, and manipulate the redundancy data
1027 */ 1027 */
1028 blockbuffer = kmalloc((pagesize + 64) * blocksize, GFP_NOIO); 1028 blockbuffer = kmalloc_array(pagesize + 64, blocksize, GFP_NOIO);
1029 if (!blockbuffer) { 1029 if (!blockbuffer) {
1030 kfree(buffer); 1030 kfree(buffer);
1031 return USB_STOR_TRANSPORT_ERROR; 1031 return USB_STOR_TRANSPORT_ERROR;
diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index 93cf57ac47d6..4d261e4de9ad 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -807,8 +807,12 @@ static int ms_lib_alloc_logicalmap(struct us_data *us)
807 u32 i; 807 u32 i;
808 struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; 808 struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
809 809
810 info->MS_Lib.Phy2LogMap = kmalloc(info->MS_Lib.NumberOfPhyBlock * sizeof(u16), GFP_KERNEL); 810 info->MS_Lib.Phy2LogMap = kmalloc_array(info->MS_Lib.NumberOfPhyBlock,
811 info->MS_Lib.Log2PhyMap = kmalloc(info->MS_Lib.NumberOfLogBlock * sizeof(u16), GFP_KERNEL); 811 sizeof(u16),
812 GFP_KERNEL);
813 info->MS_Lib.Log2PhyMap = kmalloc_array(info->MS_Lib.NumberOfLogBlock,
814 sizeof(u16),
815 GFP_KERNEL);
812 816
813 if ((info->MS_Lib.Phy2LogMap == NULL) || (info->MS_Lib.Log2PhyMap == NULL)) { 817 if ((info->MS_Lib.Phy2LogMap == NULL) || (info->MS_Lib.Log2PhyMap == NULL)) {
814 ms_lib_free_logicalmap(us); 818 ms_lib_free_logicalmap(us);
@@ -1113,8 +1117,12 @@ static int ms_lib_alloc_writebuf(struct us_data *us)
1113 1117
1114 info->MS_Lib.wrtblk = (u16)-1; 1118 info->MS_Lib.wrtblk = (u16)-1;
1115 1119
1116 info->MS_Lib.blkpag = kmalloc(info->MS_Lib.PagesPerBlock * info->MS_Lib.BytesPerSector, GFP_KERNEL); 1120 info->MS_Lib.blkpag = kmalloc_array(info->MS_Lib.PagesPerBlock,
1117 info->MS_Lib.blkext = kmalloc(info->MS_Lib.PagesPerBlock * sizeof(struct ms_lib_type_extdat), GFP_KERNEL); 1121 info->MS_Lib.BytesPerSector,
1122 GFP_KERNEL);
1123 info->MS_Lib.blkext = kmalloc_array(info->MS_Lib.PagesPerBlock,
1124 sizeof(struct ms_lib_type_extdat),
1125 GFP_KERNEL);
1118 1126
1119 if ((info->MS_Lib.blkpag == NULL) || (info->MS_Lib.blkext == NULL)) { 1127 if ((info->MS_Lib.blkpag == NULL) || (info->MS_Lib.blkext == NULL)) {
1120 ms_lib_free_writebuf(us); 1128 ms_lib_free_writebuf(us);
diff --git a/drivers/usb/storage/sddr09.c b/drivers/usb/storage/sddr09.c
index 1cf7dbfe277c..bc9da736bdfc 100644
--- a/drivers/usb/storage/sddr09.c
+++ b/drivers/usb/storage/sddr09.c
@@ -1231,8 +1231,8 @@ sddr09_read_map(struct us_data *us) {
1231 1231
1232 kfree(info->lba_to_pba); 1232 kfree(info->lba_to_pba);
1233 kfree(info->pba_to_lba); 1233 kfree(info->pba_to_lba);
1234 info->lba_to_pba = kmalloc(numblocks*sizeof(int), GFP_NOIO); 1234 info->lba_to_pba = kmalloc_array(numblocks, sizeof(int), GFP_NOIO);
1235 info->pba_to_lba = kmalloc(numblocks*sizeof(int), GFP_NOIO); 1235 info->pba_to_lba = kmalloc_array(numblocks, sizeof(int), GFP_NOIO);
1236 1236
1237 if (info->lba_to_pba == NULL || info->pba_to_lba == NULL) { 1237 if (info->lba_to_pba == NULL || info->pba_to_lba == NULL) {
1238 printk(KERN_WARNING "sddr09_read_map: out of memory\n"); 1238 printk(KERN_WARNING "sddr09_read_map: out of memory\n");
diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c
index 8c814b2ec9b2..b8527c55335b 100644
--- a/drivers/usb/storage/sddr55.c
+++ b/drivers/usb/storage/sddr55.c
@@ -651,7 +651,7 @@ static int sddr55_read_map(struct us_data *us) {
651 651
652 numblocks = info->capacity >> (info->blockshift + info->pageshift); 652 numblocks = info->capacity >> (info->blockshift + info->pageshift);
653 653
654 buffer = kmalloc( numblocks * 2, GFP_NOIO ); 654 buffer = kmalloc_array(numblocks, 2, GFP_NOIO );
655 655
656 if (!buffer) 656 if (!buffer)
657 return -1; 657 return -1;
@@ -684,8 +684,8 @@ static int sddr55_read_map(struct us_data *us) {
684 684
685 kfree(info->lba_to_pba); 685 kfree(info->lba_to_pba);
686 kfree(info->pba_to_lba); 686 kfree(info->pba_to_lba);
687 info->lba_to_pba = kmalloc(numblocks*sizeof(int), GFP_NOIO); 687 info->lba_to_pba = kmalloc_array(numblocks, sizeof(int), GFP_NOIO);
688 info->pba_to_lba = kmalloc(numblocks*sizeof(int), GFP_NOIO); 688 info->pba_to_lba = kmalloc_array(numblocks, sizeof(int), GFP_NOIO);
689 689
690 if (info->lba_to_pba == NULL || info->pba_to_lba == NULL) { 690 if (info->lba_to_pba == NULL || info->pba_to_lba == NULL) {
691 kfree(info->lba_to_pba); 691 kfree(info->lba_to_pba);
diff --git a/drivers/uwb/est.c b/drivers/uwb/est.c
index f3e232584284..ad30ddfe30b3 100644
--- a/drivers/uwb/est.c
+++ b/drivers/uwb/est.c
@@ -217,7 +217,7 @@ static
217int uwb_est_grow(void) 217int uwb_est_grow(void)
218{ 218{
219 size_t actual_size = uwb_est_size * sizeof(uwb_est[0]); 219 size_t actual_size = uwb_est_size * sizeof(uwb_est[0]);
220 void *new = kmalloc(2 * actual_size, GFP_ATOMIC); 220 void *new = kmalloc_array(2, actual_size, GFP_ATOMIC);
221 if (new == NULL) 221 if (new == NULL)
222 return -ENOMEM; 222 return -ENOMEM;
223 memcpy(new, uwb_est, actual_size); 223 memcpy(new, uwb_est, actual_size);
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index a50cf45e530f..c0430a41e24b 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -376,7 +376,7 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
376 376
377 i1480 = &i1480_usb->i1480; 377 i1480 = &i1480_usb->i1480;
378 i1480->buf_size = 512; 378 i1480->buf_size = 512;
379 i1480->cmd_buf = kmalloc(2 * i1480->buf_size, GFP_KERNEL); 379 i1480->cmd_buf = kmalloc_array(2, i1480->buf_size, GFP_KERNEL);
380 if (i1480->cmd_buf == NULL) { 380 if (i1480->cmd_buf == NULL) {
381 dev_err(dev, "Cannot allocate transfer buffers\n"); 381 dev_err(dev, "Cannot allocate transfer buffers\n");
382 result = -ENOMEM; 382 result = -ENOMEM;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index e7cf7d21cfb5..686dc670fd29 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -274,8 +274,10 @@ static int vhost_net_set_ubuf_info(struct vhost_net *n)
274 zcopy = vhost_net_zcopy_mask & (0x1 << i); 274 zcopy = vhost_net_zcopy_mask & (0x1 << i);
275 if (!zcopy) 275 if (!zcopy)
276 continue; 276 continue;
277 n->vqs[i].ubuf_info = kmalloc(sizeof(*n->vqs[i].ubuf_info) * 277 n->vqs[i].ubuf_info =
278 UIO_MAXIOV, GFP_KERNEL); 278 kmalloc_array(UIO_MAXIOV,
279 sizeof(*n->vqs[i].ubuf_info),
280 GFP_KERNEL);
279 if (!n->vqs[i].ubuf_info) 281 if (!n->vqs[i].ubuf_info)
280 goto err; 282 goto err;
281 } 283 }
@@ -943,7 +945,7 @@ static int vhost_net_open(struct inode *inode, struct file *f)
943 n = kvmalloc(sizeof *n, GFP_KERNEL | __GFP_RETRY_MAYFAIL); 945 n = kvmalloc(sizeof *n, GFP_KERNEL | __GFP_RETRY_MAYFAIL);
944 if (!n) 946 if (!n)
945 return -ENOMEM; 947 return -ENOMEM;
946 vqs = kmalloc(VHOST_NET_VQ_MAX * sizeof(*vqs), GFP_KERNEL); 948 vqs = kmalloc_array(VHOST_NET_VQ_MAX, sizeof(*vqs), GFP_KERNEL);
947 if (!vqs) { 949 if (!vqs) {
948 kvfree(n); 950 kvfree(n);
949 return -ENOMEM; 951 return -ENOMEM;
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 7ad57094d736..ce10eb75b042 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1378,7 +1378,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
1378 goto err_vs; 1378 goto err_vs;
1379 } 1379 }
1380 1380
1381 vqs = kmalloc(VHOST_SCSI_MAX_VQ * sizeof(*vqs), GFP_KERNEL); 1381 vqs = kmalloc_array(VHOST_SCSI_MAX_VQ, sizeof(*vqs), GFP_KERNEL);
1382 if (!vqs) 1382 if (!vqs)
1383 goto err_vqs; 1383 goto err_vqs;
1384 1384
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index 906b8f0f19f7..40589850eb33 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -107,7 +107,7 @@ static int vhost_test_open(struct inode *inode, struct file *f)
107 107
108 if (!n) 108 if (!n)
109 return -ENOMEM; 109 return -ENOMEM;
110 vqs = kmalloc(VHOST_TEST_VQ_MAX * sizeof(*vqs), GFP_KERNEL); 110 vqs = kmalloc_array(VHOST_TEST_VQ_MAX, sizeof(*vqs), GFP_KERNEL);
111 if (!vqs) { 111 if (!vqs) {
112 kfree(n); 112 kfree(n);
113 return -ENOMEM; 113 return -ENOMEM;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index f9bce818da11..ce8c95b6365b 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -385,10 +385,13 @@ static long vhost_dev_alloc_iovecs(struct vhost_dev *dev)
385 385
386 for (i = 0; i < dev->nvqs; ++i) { 386 for (i = 0; i < dev->nvqs; ++i) {
387 vq = dev->vqs[i]; 387 vq = dev->vqs[i];
388 vq->indirect = kmalloc(sizeof *vq->indirect * UIO_MAXIOV, 388 vq->indirect = kmalloc_array(UIO_MAXIOV,
389 GFP_KERNEL); 389 sizeof(*vq->indirect),
390 vq->log = kmalloc(sizeof *vq->log * UIO_MAXIOV, GFP_KERNEL); 390 GFP_KERNEL);
391 vq->heads = kmalloc(sizeof *vq->heads * UIO_MAXIOV, GFP_KERNEL); 391 vq->log = kmalloc_array(UIO_MAXIOV, sizeof(*vq->log),
392 GFP_KERNEL);
393 vq->heads = kmalloc_array(UIO_MAXIOV, sizeof(*vq->heads),
394 GFP_KERNEL);
392 if (!vq->indirect || !vq->log || !vq->heads) 395 if (!vq->indirect || !vq->log || !vq->heads)
393 goto err_nomem; 396 goto err_nomem;
394 } 397 }
diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index bb8971f2a634..a94d700a4503 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -191,7 +191,7 @@ static int resize_iovec(struct vringh_kiov *iov, gfp_t gfp)
191 if (flag) 191 if (flag)
192 new = krealloc(iov->iov, new_num * sizeof(struct iovec), gfp); 192 new = krealloc(iov->iov, new_num * sizeof(struct iovec), gfp);
193 else { 193 else {
194 new = kmalloc(new_num * sizeof(struct iovec), gfp); 194 new = kmalloc_array(new_num, sizeof(struct iovec), gfp);
195 if (new) { 195 if (new) {
196 memcpy(new, iov->iov, 196 memcpy(new, iov->iov,
197 iov->max_num * sizeof(struct iovec)); 197 iov->max_num * sizeof(struct iovec));
diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index 790900d646c0..ca935c09a261 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -269,7 +269,7 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
269 if (attribute) { 269 if (attribute) {
270 u8 *dst; 270 u8 *dst;
271 271
272 dst = kmalloc(w * vc->vc_font.height, GFP_ATOMIC); 272 dst = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
273 if (!dst) 273 if (!dst)
274 return; 274 return;
275 kfree(ops->cursor_data); 275 kfree(ops->cursor_data);
@@ -312,7 +312,7 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
312 vc->vc_cursor_type != ops->p->cursor_shape || 312 vc->vc_cursor_type != ops->p->cursor_shape ||
313 ops->cursor_state.mask == NULL || 313 ops->cursor_state.mask == NULL ||
314 ops->cursor_reset) { 314 ops->cursor_reset) {
315 char *mask = kmalloc(w*vc->vc_font.height, GFP_ATOMIC); 315 char *mask = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
316 int cur_height, size, i = 0; 316 int cur_height, size, i = 0;
317 u8 msk = 0xff; 317 u8 msk = 0xff;
318 318
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 3e330e0f56ed..c910e74d46ff 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -591,7 +591,8 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info,
591 if (scr_readw(r) != vc->vc_video_erase_char) 591 if (scr_readw(r) != vc->vc_video_erase_char)
592 break; 592 break;
593 if (r != q && new_rows >= rows + logo_lines) { 593 if (r != q && new_rows >= rows + logo_lines) {
594 save = kmalloc(logo_lines * new_cols * 2, GFP_KERNEL); 594 save = kmalloc(array3_size(logo_lines, new_cols, 2),
595 GFP_KERNEL);
595 if (save) { 596 if (save) {
596 int i = cols < new_cols ? cols : new_cols; 597 int i = cols < new_cols ? cols : new_cols;
597 scr_memsetw(save, erase, logo_lines * new_cols * 2); 598 scr_memsetw(save, erase, logo_lines * new_cols * 2);
diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c
index 37a8b0b22566..dfa9a8aa4509 100644
--- a/drivers/video/fbdev/core/fbcon_ccw.c
+++ b/drivers/video/fbdev/core/fbcon_ccw.c
@@ -258,7 +258,7 @@ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
258 if (attribute) { 258 if (attribute) {
259 u8 *dst; 259 u8 *dst;
260 260
261 dst = kmalloc(w * vc->vc_font.width, GFP_ATOMIC); 261 dst = kmalloc_array(w, vc->vc_font.width, GFP_ATOMIC);
262 if (!dst) 262 if (!dst)
263 return; 263 return;
264 kfree(ops->cursor_data); 264 kfree(ops->cursor_data);
@@ -304,14 +304,15 @@ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
304 vc->vc_cursor_type != ops->p->cursor_shape || 304 vc->vc_cursor_type != ops->p->cursor_shape ||
305 ops->cursor_state.mask == NULL || 305 ops->cursor_state.mask == NULL ||
306 ops->cursor_reset) { 306 ops->cursor_reset) {
307 char *tmp, *mask = kmalloc(w*vc->vc_font.width, GFP_ATOMIC); 307 char *tmp, *mask = kmalloc_array(w, vc->vc_font.width,
308 GFP_ATOMIC);
308 int cur_height, size, i = 0; 309 int cur_height, size, i = 0;
309 int width = (vc->vc_font.width + 7)/8; 310 int width = (vc->vc_font.width + 7)/8;
310 311
311 if (!mask) 312 if (!mask)
312 return; 313 return;
313 314
314 tmp = kmalloc(width * vc->vc_font.height, GFP_ATOMIC); 315 tmp = kmalloc_array(width, vc->vc_font.height, GFP_ATOMIC);
315 316
316 if (!tmp) { 317 if (!tmp) {
317 kfree(mask); 318 kfree(mask);
diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c
index 1888f8c866e8..ce08251bfd38 100644
--- a/drivers/video/fbdev/core/fbcon_cw.c
+++ b/drivers/video/fbdev/core/fbcon_cw.c
@@ -241,7 +241,7 @@ static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
241 if (attribute) { 241 if (attribute) {
242 u8 *dst; 242 u8 *dst;
243 243
244 dst = kmalloc(w * vc->vc_font.width, GFP_ATOMIC); 244 dst = kmalloc_array(w, vc->vc_font.width, GFP_ATOMIC);
245 if (!dst) 245 if (!dst)
246 return; 246 return;
247 kfree(ops->cursor_data); 247 kfree(ops->cursor_data);
@@ -287,14 +287,15 @@ static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
287 vc->vc_cursor_type != ops->p->cursor_shape || 287 vc->vc_cursor_type != ops->p->cursor_shape ||
288 ops->cursor_state.mask == NULL || 288 ops->cursor_state.mask == NULL ||
289 ops->cursor_reset) { 289 ops->cursor_reset) {
290 char *tmp, *mask = kmalloc(w*vc->vc_font.width, GFP_ATOMIC); 290 char *tmp, *mask = kmalloc_array(w, vc->vc_font.width,
291 GFP_ATOMIC);
291 int cur_height, size, i = 0; 292 int cur_height, size, i = 0;
292 int width = (vc->vc_font.width + 7)/8; 293 int width = (vc->vc_font.width + 7)/8;
293 294
294 if (!mask) 295 if (!mask)
295 return; 296 return;
296 297
297 tmp = kmalloc(width * vc->vc_font.height, GFP_ATOMIC); 298 tmp = kmalloc_array(width, vc->vc_font.height, GFP_ATOMIC);
298 299
299 if (!tmp) { 300 if (!tmp) {
300 kfree(mask); 301 kfree(mask);
diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c
index 8a51e4d95cc5..c0d445294aa7 100644
--- a/drivers/video/fbdev/core/fbcon_rotate.c
+++ b/drivers/video/fbdev/core/fbcon_rotate.c
@@ -46,7 +46,7 @@ static int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc)
46 info->fbops->fb_sync(info); 46 info->fbops->fb_sync(info);
47 47
48 if (ops->fd_size < d_cellsize * len) { 48 if (ops->fd_size < d_cellsize * len) {
49 dst = kmalloc(d_cellsize * len, GFP_KERNEL); 49 dst = kmalloc_array(len, d_cellsize, GFP_KERNEL);
50 50
51 if (dst == NULL) { 51 if (dst == NULL) {
52 err = -ENOMEM; 52 err = -ENOMEM;
diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c
index f98eee263597..1936afc78fec 100644
--- a/drivers/video/fbdev/core/fbcon_ud.c
+++ b/drivers/video/fbdev/core/fbcon_ud.c
@@ -289,7 +289,7 @@ static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode,
289 if (attribute) { 289 if (attribute) {
290 u8 *dst; 290 u8 *dst;
291 291
292 dst = kmalloc(w * vc->vc_font.height, GFP_ATOMIC); 292 dst = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
293 if (!dst) 293 if (!dst)
294 return; 294 return;
295 kfree(ops->cursor_data); 295 kfree(ops->cursor_data);
@@ -335,7 +335,7 @@ static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode,
335 vc->vc_cursor_type != ops->p->cursor_shape || 335 vc->vc_cursor_type != ops->p->cursor_shape ||
336 ops->cursor_state.mask == NULL || 336 ops->cursor_state.mask == NULL ||
337 ops->cursor_reset) { 337 ops->cursor_reset) {
338 char *mask = kmalloc(w*vc->vc_font.height, GFP_ATOMIC); 338 char *mask = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
339 int cur_height, size, i = 0; 339 int cur_height, size, i = 0;
340 u8 msk = 0xff; 340 u8 msk = 0xff;
341 341
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 924d0730ffe2..609438d2465b 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -489,7 +489,8 @@ static int fb_show_logo_line(struct fb_info *info, int rotate,
489 } 489 }
490 490
491 if (fb_logo.depth <= 4) { 491 if (fb_logo.depth <= 4) {
492 logo_new = kmalloc(logo->width * logo->height, GFP_KERNEL); 492 logo_new = kmalloc_array(logo->width, logo->height,
493 GFP_KERNEL);
493 if (logo_new == NULL) { 494 if (logo_new == NULL) {
494 kfree(palette); 495 kfree(palette);
495 if (saved_pseudo_palette) 496 if (saved_pseudo_palette)
@@ -506,8 +507,8 @@ static int fb_show_logo_line(struct fb_info *info, int rotate,
506 image.height = logo->height; 507 image.height = logo->height;
507 508
508 if (rotate) { 509 if (rotate) {
509 logo_rotate = kmalloc(logo->width * 510 logo_rotate = kmalloc_array(logo->width, logo->height,
510 logo->height, GFP_KERNEL); 511 GFP_KERNEL);
511 if (logo_rotate) 512 if (logo_rotate)
512 fb_rotate_logo(info, logo_rotate, &image, rotate); 513 fb_rotate_logo(info, logo_rotate, &image, rotate);
513 } 514 }
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index 2b2d67328514..522cf441842c 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -671,7 +671,7 @@ static struct fb_videomode *fb_create_modedb(unsigned char *edid, int *dbsize,
671 } 671 }
672 672
673 *dbsize = num; 673 *dbsize = num;
674 m = kmalloc(num * sizeof(struct fb_videomode), GFP_KERNEL); 674 m = kmalloc_array(num, sizeof(struct fb_videomode), GFP_KERNEL);
675 if (!m) 675 if (!m)
676 return mode; 676 return mode;
677 memmove(m, mode, num * sizeof(struct fb_videomode)); 677 memmove(m, mode, num * sizeof(struct fb_videomode));
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index ba82f97fb42b..c4eb8661f751 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -662,7 +662,7 @@ static int imxfb_init_fbinfo(struct platform_device *pdev)
662 662
663 pr_debug("%s\n",__func__); 663 pr_debug("%s\n",__func__);
664 664
665 info->pseudo_palette = kmalloc(sizeof(u32) * 16, GFP_KERNEL); 665 info->pseudo_palette = kmalloc_array(16, sizeof(u32), GFP_KERNEL);
666 if (!info->pseudo_palette) 666 if (!info->pseudo_palette)
667 return -ENOMEM; 667 return -ENOMEM;
668 668
diff --git a/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
index fe92eed6da70..8dd296d257dd 100644
--- a/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
+++ b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
@@ -245,7 +245,7 @@ static void mb86290fb_imageblit(struct fb_info *info,
245 return; 245 return;
246 } 246 }
247 247
248 cmd = kmalloc(cmdlen * 4, GFP_DMA); 248 cmd = kmalloc_array(cmdlen, 4, GFP_DMA);
249 if (!cmd) 249 if (!cmd)
250 return cfb_imageblit(info, image); 250 return cfb_imageblit(info, image);
251 cmdfn(cmd, step, dx, dy, width, height, fgcolor, bgcolor, image, info); 251 cmdfn(cmd, step, dx, dy, width, height, fgcolor, bgcolor, image, info);
diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
index 418a2d0d06a9..2e50120bcfae 100644
--- a/drivers/video/fbdev/nvidia/nvidia.c
+++ b/drivers/video/fbdev/nvidia/nvidia.c
@@ -566,7 +566,7 @@ static int nvidiafb_cursor(struct fb_info *info, struct fb_cursor *cursor)
566 u8 *msk = (u8 *) cursor->mask; 566 u8 *msk = (u8 *) cursor->mask;
567 u8 *src; 567 u8 *src;
568 568
569 src = kmalloc(s_pitch * cursor->image.height, GFP_ATOMIC); 569 src = kmalloc_array(s_pitch, cursor->image.height, GFP_ATOMIC);
570 570
571 if (src) { 571 if (src) {
572 switch (cursor->rop) { 572 switch (cursor->rop) {
diff --git a/drivers/video/fbdev/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c
index a582d3ae7ac1..8a53d1de611d 100644
--- a/drivers/video/fbdev/pvr2fb.c
+++ b/drivers/video/fbdev/pvr2fb.c
@@ -682,7 +682,7 @@ static ssize_t pvr2fb_write(struct fb_info *info, const char *buf,
682 682
683 nr_pages = (count + PAGE_SIZE - 1) >> PAGE_SHIFT; 683 nr_pages = (count + PAGE_SIZE - 1) >> PAGE_SHIFT;
684 684
685 pages = kmalloc(nr_pages * sizeof(struct page *), GFP_KERNEL); 685 pages = kmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL);
686 if (!pages) 686 if (!pages)
687 return -ENOMEM; 687 return -ENOMEM;
688 688
diff --git a/drivers/video/fbdev/riva/fbdev.c b/drivers/video/fbdev/riva/fbdev.c
index ff8282374f37..cc242ba057d3 100644
--- a/drivers/video/fbdev/riva/fbdev.c
+++ b/drivers/video/fbdev/riva/fbdev.c
@@ -1615,7 +1615,7 @@ static int rivafb_cursor(struct fb_info *info, struct fb_cursor *cursor)
1615 u8 *msk = (u8 *) cursor->mask; 1615 u8 *msk = (u8 *) cursor->mask;
1616 u8 *src; 1616 u8 *src;
1617 1617
1618 src = kmalloc(s_pitch * cursor->image.height, GFP_ATOMIC); 1618 src = kmalloc_array(s_pitch, cursor->image.height, GFP_ATOMIC);
1619 1619
1620 if (src) { 1620 if (src) {
1621 switch (cursor->rop) { 1621 switch (cursor->rop) {
diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
index 9b45125988fb..52f577b0669b 100644
--- a/drivers/video/fbdev/via/viafbdev.c
+++ b/drivers/video/fbdev/via/viafbdev.c
@@ -596,7 +596,8 @@ static int viafb_ioctl(struct fb_info *info, u_int cmd, u_long arg)
596 break; 596 break;
597 597
598 case VIAFB_GET_GAMMA_LUT: 598 case VIAFB_GET_GAMMA_LUT:
599 viafb_gamma_table = kmalloc(256 * sizeof(u32), GFP_KERNEL); 599 viafb_gamma_table = kmalloc_array(256, sizeof(u32),
600 GFP_KERNEL);
600 if (!viafb_gamma_table) 601 if (!viafb_gamma_table)
601 return -ENOMEM; 602 return -ENOMEM;
602 viafb_get_gamma_table(viafb_gamma_table); 603 viafb_get_gamma_table(viafb_gamma_table);
diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c
index 035ff6e02894..696106ecdff0 100644
--- a/drivers/video/fbdev/w100fb.c
+++ b/drivers/video/fbdev/w100fb.c
@@ -693,7 +693,8 @@ int w100fb_probe(struct platform_device *pdev)
693 goto out; 693 goto out;
694 } 694 }
695 695
696 info->pseudo_palette = kmalloc(sizeof (u32) * MAX_PALETTES, GFP_KERNEL); 696 info->pseudo_palette = kmalloc_array(MAX_PALETTES, sizeof(u32),
697 GFP_KERNEL);
697 if (!info->pseudo_palette) { 698 if (!info->pseudo_palette) {
698 err = -ENOMEM; 699 err = -ENOMEM;
699 goto out; 700 goto out;
diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
index 2f3856a95856..3093655c7b92 100644
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -69,7 +69,7 @@ static void vbg_guest_mappings_init(struct vbg_dev *gdev)
69 /* Add 4M so that we can align the vmap to 4MiB as the host requires. */ 69 /* Add 4M so that we can align the vmap to 4MiB as the host requires. */
70 size = PAGE_ALIGN(req->hypervisor_size) + SZ_4M; 70 size = PAGE_ALIGN(req->hypervisor_size) + SZ_4M;
71 71
72 pages = kmalloc(sizeof(*pages) * (size >> PAGE_SHIFT), GFP_KERNEL); 72 pages = kmalloc_array(size >> PAGE_SHIFT, sizeof(*pages), GFP_KERNEL);
73 if (!pages) 73 if (!pages)
74 goto out; 74 goto out;
75 75
@@ -262,8 +262,9 @@ static int vbg_balloon_inflate(struct vbg_dev *gdev, u32 chunk_idx)
262 struct page **pages; 262 struct page **pages;
263 int i, rc, ret; 263 int i, rc, ret;
264 264
265 pages = kmalloc(sizeof(*pages) * VMMDEV_MEMORY_BALLOON_CHUNK_PAGES, 265 pages = kmalloc_array(VMMDEV_MEMORY_BALLOON_CHUNK_PAGES,
266 GFP_KERNEL | __GFP_NOWARN); 266 sizeof(*pages),
267 GFP_KERNEL | __GFP_NOWARN);
267 if (!pages) 268 if (!pages)
268 return -ENOMEM; 269 return -ENOMEM;
269 270
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 48d4d1cf1cb6..a491d0ed3f16 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -113,8 +113,9 @@ static int vp_request_msix_vectors(struct virtio_device *vdev, int nvectors,
113 113
114 vp_dev->msix_vectors = nvectors; 114 vp_dev->msix_vectors = nvectors;
115 115
116 vp_dev->msix_names = kmalloc(nvectors * sizeof *vp_dev->msix_names, 116 vp_dev->msix_names = kmalloc_array(nvectors,
117 GFP_KERNEL); 117 sizeof(*vp_dev->msix_names),
118 GFP_KERNEL);
118 if (!vp_dev->msix_names) 119 if (!vp_dev->msix_names)
119 goto error; 120 goto error;
120 vp_dev->msix_affinity_masks 121 vp_dev->msix_affinity_masks
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 21d464a29cf8..814b395007b2 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -247,7 +247,7 @@ static struct vring_desc *alloc_indirect(struct virtqueue *_vq,
247 */ 247 */
248 gfp &= ~__GFP_HIGHMEM; 248 gfp &= ~__GFP_HIGHMEM;
249 249
250 desc = kmalloc(total_sg * sizeof(struct vring_desc), gfp); 250 desc = kmalloc_array(total_sg, sizeof(struct vring_desc), gfp);
251 if (!desc) 251 if (!desc)
252 return NULL; 252 return NULL;
253 253
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 27be107d6480..2473b0a9e6e4 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1137,7 +1137,7 @@ static int gnttab_map(unsigned int start_idx, unsigned int end_idx)
1137 /* No need for kzalloc as it is initialized in following hypercall 1137 /* No need for kzalloc as it is initialized in following hypercall
1138 * GNTTABOP_setup_table. 1138 * GNTTABOP_setup_table.
1139 */ 1139 */
1140 frames = kmalloc(nr_gframes * sizeof(unsigned long), GFP_ATOMIC); 1140 frames = kmalloc_array(nr_gframes, sizeof(unsigned long), GFP_ATOMIC);
1141 if (!frames) 1141 if (!frames)
1142 return -ENOMEM; 1142 return -ENOMEM;
1143 1143
@@ -1300,8 +1300,9 @@ int gnttab_init(void)
1300 max_nr_glist_frames = (max_nr_grant_frames * 1300 max_nr_glist_frames = (max_nr_grant_frames *
1301 gnttab_interface->grefs_per_grant_frame / RPP); 1301 gnttab_interface->grefs_per_grant_frame / RPP);
1302 1302
1303 gnttab_list = kmalloc(max_nr_glist_frames * sizeof(grant_ref_t *), 1303 gnttab_list = kmalloc_array(max_nr_glist_frames,
1304 GFP_KERNEL); 1304 sizeof(grant_ref_t *),
1305 GFP_KERNEL);
1305 if (gnttab_list == NULL) 1306 if (gnttab_list == NULL)
1306 return -ENOMEM; 1307 return -ENOMEM;
1307 1308
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index ee2c891b55c6..ea4a08b83fa0 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -234,7 +234,7 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
234 if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY)) 234 if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY))
235 return -ENXIO; 235 return -ENXIO;
236 236
237 entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL); 237 entries = kmalloc_array(op->value, sizeof(*entries), GFP_KERNEL);
238 if (entries == NULL) 238 if (entries == NULL)
239 return -ENOMEM; 239 return -ENOMEM;
240 240
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index ed4f8519b627..a9ef46f02354 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -100,7 +100,7 @@ static int build_path_from_dentry(struct v9fs_session_info *v9ses,
100 for (ds = dentry; !IS_ROOT(ds); ds = ds->d_parent) 100 for (ds = dentry; !IS_ROOT(ds); ds = ds->d_parent)
101 n++; 101 n++;
102 102
103 wnames = kmalloc(sizeof(char *) * n, GFP_KERNEL); 103 wnames = kmalloc_array(n, sizeof(char *), GFP_KERNEL);
104 if (!wnames) 104 if (!wnames)
105 goto err_out; 105 goto err_out;
106 106
diff --git a/fs/adfs/super.c b/fs/adfs/super.c
index cfda2c7caedc..71fa525d63a0 100644
--- a/fs/adfs/super.c
+++ b/fs/adfs/super.c
@@ -313,7 +313,7 @@ static struct adfs_discmap *adfs_read_map(struct super_block *sb, struct adfs_di
313 313
314 asb->s_ids_per_zone = zone_size / (asb->s_idlen + 1); 314 asb->s_ids_per_zone = zone_size / (asb->s_idlen + 1);
315 315
316 dm = kmalloc(nzones * sizeof(*dm), GFP_KERNEL); 316 dm = kmalloc_array(nzones, sizeof(*dm), GFP_KERNEL);
317 if (dm == NULL) { 317 if (dm == NULL) {
318 adfs_error(sb, "not enough memory"); 318 adfs_error(sb, "not enough memory");
319 return ERR_PTR(-ENOMEM); 319 return ERR_PTR(-ENOMEM);
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index c332c95a6940..238fd28cfdd2 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -191,7 +191,8 @@ static int afs_deliver_cb_callback(struct afs_call *call)
191 if (call->count > AFSCBMAX) 191 if (call->count > AFSCBMAX)
192 return afs_protocol_error(call, -EBADMSG); 192 return afs_protocol_error(call, -EBADMSG);
193 193
194 call->buffer = kmalloc(call->count * 3 * 4, GFP_KERNEL); 194 call->buffer = kmalloc(array3_size(call->count, 3, 4),
195 GFP_KERNEL);
195 if (!call->buffer) 196 if (!call->buffer)
196 return -ENOMEM; 197 return -ENOMEM;
197 call->offset = 0; 198 call->offset = 0;
@@ -330,7 +331,7 @@ static int afs_deliver_cb_init_call_back_state3(struct afs_call *call)
330 switch (call->unmarshall) { 331 switch (call->unmarshall) {
331 case 0: 332 case 0:
332 call->offset = 0; 333 call->offset = 0;
333 call->buffer = kmalloc(11 * sizeof(__be32), GFP_KERNEL); 334 call->buffer = kmalloc_array(11, sizeof(__be32), GFP_KERNEL);
334 if (!call->buffer) 335 if (!call->buffer)
335 return -ENOMEM; 336 return -ENOMEM;
336 call->unmarshall++; 337 call->unmarshall++;
@@ -453,7 +454,7 @@ static int afs_deliver_cb_probe_uuid(struct afs_call *call)
453 switch (call->unmarshall) { 454 switch (call->unmarshall) {
454 case 0: 455 case 0:
455 call->offset = 0; 456 call->offset = 0;
456 call->buffer = kmalloc(11 * sizeof(__be32), GFP_KERNEL); 457 call->buffer = kmalloc_array(11, sizeof(__be32), GFP_KERNEL);
457 if (!call->buffer) 458 if (!call->buffer)
458 return -ENOMEM; 459 return -ENOMEM;
459 call->unmarshall++; 460 call->unmarshall++;
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 4ad6f669fe34..bf5ee6f741cd 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -2010,7 +2010,7 @@ static int elf_note_info_init(struct elf_note_info *info)
2010 INIT_LIST_HEAD(&info->thread_list); 2010 INIT_LIST_HEAD(&info->thread_list);
2011 2011
2012 /* Allocate space for ELF notes */ 2012 /* Allocate space for ELF notes */
2013 info->notes = kmalloc(8 * sizeof(struct memelfnote), GFP_KERNEL); 2013 info->notes = kmalloc_array(8, sizeof(struct memelfnote), GFP_KERNEL);
2014 if (!info->notes) 2014 if (!info->notes)
2015 return 0; 2015 return 0;
2016 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL); 2016 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index d90993adeffa..b53bb3729ac1 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -1600,7 +1600,8 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
1600 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); 1600 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1601 if (!psinfo) 1601 if (!psinfo)
1602 goto cleanup; 1602 goto cleanup;
1603 notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote), GFP_KERNEL); 1603 notes = kmalloc_array(NUM_NOTES, sizeof(struct memelfnote),
1604 GFP_KERNEL);
1604 if (!notes) 1605 if (!notes)
1605 goto cleanup; 1606 goto cleanup;
1606 fpu = kmalloc(sizeof(*fpu), GFP_KERNEL); 1607 fpu = kmalloc(sizeof(*fpu), GFP_KERNEL);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 05e12aea2404..0dd87aaeb39a 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -205,7 +205,8 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
205 if (nr_pages <= DIO_INLINE_BIO_VECS) 205 if (nr_pages <= DIO_INLINE_BIO_VECS)
206 vecs = inline_vecs; 206 vecs = inline_vecs;
207 else { 207 else {
208 vecs = kmalloc(nr_pages * sizeof(struct bio_vec), GFP_KERNEL); 208 vecs = kmalloc_array(nr_pages, sizeof(struct bio_vec),
209 GFP_KERNEL);
209 if (!vecs) 210 if (!vecs)
210 return -ENOMEM; 211 return -ENOMEM;
211 } 212 }
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 5f7ad3d0df2e..c9cb2f33a6d6 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -370,7 +370,7 @@ static int start_read(struct inode *inode, struct ceph_rw_context *rw_ctx,
370 370
371 /* build page vector */ 371 /* build page vector */
372 nr_pages = calc_pages_for(0, len); 372 nr_pages = calc_pages_for(0, len);
373 pages = kmalloc(sizeof(*pages) * nr_pages, GFP_KERNEL); 373 pages = kmalloc_array(nr_pages, sizeof(*pages), GFP_KERNEL);
374 if (!pages) { 374 if (!pages) {
375 ret = -ENOMEM; 375 ret = -ENOMEM;
376 goto out_put; 376 goto out_put;
@@ -966,8 +966,9 @@ get_more_pages:
966 966
967 BUG_ON(pages); 967 BUG_ON(pages);
968 max_pages = calc_pages_for(0, (u64)len); 968 max_pages = calc_pages_for(0, (u64)len);
969 pages = kmalloc(max_pages * sizeof (*pages), 969 pages = kmalloc_array(max_pages,
970 GFP_NOFS); 970 sizeof(*pages),
971 GFP_NOFS);
971 if (!pages) { 972 if (!pages) {
972 pool = fsc->wb_pagevec_pool; 973 pool = fsc->wb_pagevec_pool;
973 pages = mempool_alloc(pool, GFP_NOFS); 974 pages = mempool_alloc(pool, GFP_NOFS);
@@ -1113,8 +1114,8 @@ new_request:
1113 1114
1114 /* allocate new pages array for next request */ 1115 /* allocate new pages array for next request */
1115 data_pages = pages; 1116 data_pages = pages;
1116 pages = kmalloc(locked_pages * sizeof (*pages), 1117 pages = kmalloc_array(locked_pages, sizeof(*pages),
1117 GFP_NOFS); 1118 GFP_NOFS);
1118 if (!pages) { 1119 if (!pages) {
1119 pool = fsc->wb_pagevec_pool; 1120 pool = fsc->wb_pagevec_pool;
1120 pages = mempool_alloc(pool, GFP_NOFS); 1121 pages = mempool_alloc(pool, GFP_NOFS);
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 5ece2e6ad154..cf8d24812cc0 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2992,8 +2992,9 @@ encode_again:
2992 num_flock_locks = 0; 2992 num_flock_locks = 0;
2993 } 2993 }
2994 if (num_fcntl_locks + num_flock_locks > 0) { 2994 if (num_fcntl_locks + num_flock_locks > 0) {
2995 flocks = kmalloc((num_fcntl_locks + num_flock_locks) * 2995 flocks = kmalloc_array(num_fcntl_locks + num_flock_locks,
2996 sizeof(struct ceph_filelock), GFP_NOFS); 2996 sizeof(struct ceph_filelock),
2997 GFP_NOFS);
2997 if (!flocks) { 2998 if (!flocks) {
2998 err = -ENOMEM; 2999 err = -ENOMEM;
2999 goto out_free; 3000 goto out_free;
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index a3b56544c21b..3d19595eb352 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -428,7 +428,7 @@ asn1_oid_decode(struct asn1_ctx *ctx,
428 if (size < 2 || size > UINT_MAX/sizeof(unsigned long)) 428 if (size < 2 || size > UINT_MAX/sizeof(unsigned long))
429 return 0; 429 return 0;
430 430
431 *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC); 431 *oid = kmalloc_array(size, sizeof(unsigned long), GFP_ATOMIC);
432 if (*oid == NULL) 432 if (*oid == NULL)
433 return 0; 433 return 0;
434 434
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 13a8a77322c9..1d377b7f2860 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -747,8 +747,8 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
747 747
748 if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *)) 748 if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *))
749 return; 749 return;
750 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *), 750 ppace = kmalloc_array(num_aces, sizeof(struct cifs_ace *),
751 GFP_KERNEL); 751 GFP_KERNEL);
752 if (!ppace) 752 if (!ppace)
753 return; 753 return;
754 754
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 745fd7fe8d0e..a94071c7b408 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1792,7 +1792,7 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
1792 * with unix extensions enabled. 1792 * with unix extensions enabled.
1793 */ 1793 */
1794 info_buf_source = 1794 info_buf_source =
1795 kmalloc(2 * sizeof(FILE_UNIX_BASIC_INFO), 1795 kmalloc_array(2, sizeof(FILE_UNIX_BASIC_INFO),
1796 GFP_KERNEL); 1796 GFP_KERNEL);
1797 if (info_buf_source == NULL) { 1797 if (info_buf_source == NULL) {
1798 rc = -ENOMEM; 1798 rc = -ENOMEM;
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 48e2004c75fb..af032e1a3eac 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3471,7 +3471,7 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
3471 if (!num) 3471 if (!num)
3472 return -EINVAL; 3472 return -EINVAL;
3473 3473
3474 iov = kmalloc(sizeof(struct kvec) * num, GFP_KERNEL); 3474 iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL);
3475 if (!iov) 3475 if (!iov)
3476 return -ENOMEM; 3476 return -ENOMEM;
3477 3477
@@ -3535,7 +3535,7 @@ SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon,
3535 int rc; 3535 int rc;
3536 int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX)); 3536 int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
3537 3537
3538 data = kmalloc(sizeof(void *) * 2, GFP_KERNEL); 3538 data = kmalloc_array(2, sizeof(void *), GFP_KERNEL);
3539 if (!data) 3539 if (!data)
3540 return -ENOMEM; 3540 return -ENOMEM;
3541 3541
@@ -3583,7 +3583,7 @@ SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon,
3583 int rc; 3583 int rc;
3584 int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX)); 3584 int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
3585 3585
3586 data = kmalloc(sizeof(void *) * 2, GFP_KERNEL); 3586 data = kmalloc_array(2, sizeof(void *), GFP_KERNEL);
3587 if (!data) 3587 if (!data)
3588 return -ENOMEM; 3588 return -ENOMEM;
3589 3589
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 24887a0898c0..1f1a68f89110 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -844,8 +844,8 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses,
844 int rc; 844 int rc;
845 845
846 if (n_vec + 1 > CIFS_MAX_IOV_SIZE) { 846 if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
847 new_iov = kmalloc(sizeof(struct kvec) * (n_vec + 1), 847 new_iov = kmalloc_array(n_vec + 1, sizeof(struct kvec),
848 GFP_KERNEL); 848 GFP_KERNEL);
849 if (!new_iov) { 849 if (!new_iov) {
850 /* otherwise cifs_send_recv below sets resp_buf_type */ 850 /* otherwise cifs_send_recv below sets resp_buf_type */
851 *resp_buf_type = CIFS_NO_BUFFER; 851 *resp_buf_type = CIFS_NO_BUFFER;
@@ -886,8 +886,8 @@ smb2_send_recv(const unsigned int xid, struct cifs_ses *ses,
886 __be32 rfc1002_marker; 886 __be32 rfc1002_marker;
887 887
888 if (n_vec + 1 > CIFS_MAX_IOV_SIZE) { 888 if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
889 new_iov = kmalloc(sizeof(struct kvec) * (n_vec + 1), 889 new_iov = kmalloc_array(n_vec + 1, sizeof(struct kvec),
890 GFP_KERNEL); 890 GFP_KERNEL);
891 if (!new_iov) 891 if (!new_iov)
892 return -ENOMEM; 892 return -ENOMEM;
893 } else 893 } else
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 0ac62811b341..5f81fcd383a4 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -110,8 +110,8 @@ static int pcol_try_alloc(struct page_collect *pcol)
110 pages = exofs_max_io_pages(&pcol->sbi->layout, pcol->expected_pages); 110 pages = exofs_max_io_pages(&pcol->sbi->layout, pcol->expected_pages);
111 111
112 for (; pages; pages >>= 1) { 112 for (; pages; pages >>= 1) {
113 pcol->pages = kmalloc(pages * sizeof(struct page *), 113 pcol->pages = kmalloc_array(pages, sizeof(struct page *),
114 GFP_KERNEL); 114 GFP_KERNEL);
115 if (likely(pcol->pages)) { 115 if (likely(pcol->pages)) {
116 pcol->alloc_pages = pages; 116 pcol->alloc_pages = pages;
117 return 0; 117 return 0;
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index c09289a42dc5..25ab1274090f 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1082,7 +1082,9 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
1082 / EXT2_BLOCKS_PER_GROUP(sb)) + 1; 1082 / EXT2_BLOCKS_PER_GROUP(sb)) + 1;
1083 db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) / 1083 db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) /
1084 EXT2_DESC_PER_BLOCK(sb); 1084 EXT2_DESC_PER_BLOCK(sb);
1085 sbi->s_group_desc = kmalloc (db_count * sizeof (struct buffer_head *), GFP_KERNEL); 1085 sbi->s_group_desc = kmalloc_array (db_count,
1086 sizeof(struct buffer_head *),
1087 GFP_KERNEL);
1086 if (sbi->s_group_desc == NULL) { 1088 if (sbi->s_group_desc == NULL) {
1087 ext2_msg(sb, KERN_ERR, "error: not enough memory"); 1089 ext2_msg(sb, KERN_ERR, "error: not enough memory");
1088 goto failed_mount; 1090 goto failed_mount;
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index d792b7689d92..e5fb38451a73 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -204,12 +204,14 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)
204 goto out2; 204 goto out2;
205 flex_gd->count = flexbg_size; 205 flex_gd->count = flexbg_size;
206 206
207 flex_gd->groups = kmalloc(sizeof(struct ext4_new_group_data) * 207 flex_gd->groups = kmalloc_array(flexbg_size,
208 flexbg_size, GFP_NOFS); 208 sizeof(struct ext4_new_group_data),
209 GFP_NOFS);
209 if (flex_gd->groups == NULL) 210 if (flex_gd->groups == NULL)
210 goto out2; 211 goto out2;
211 212
212 flex_gd->bg_flags = kmalloc(flexbg_size * sizeof(__u16), GFP_NOFS); 213 flex_gd->bg_flags = kmalloc_array(flexbg_size, sizeof(__u16),
214 GFP_NOFS);
213 if (flex_gd->bg_flags == NULL) 215 if (flex_gd->bg_flags == NULL)
214 goto out1; 216 goto out1;
215 217
@@ -969,7 +971,7 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
969 int res, i; 971 int res, i;
970 int err; 972 int err;
971 973
972 primary = kmalloc(reserved_gdb * sizeof(*primary), GFP_NOFS); 974 primary = kmalloc_array(reserved_gdb, sizeof(*primary), GFP_NOFS);
973 if (!primary) 975 if (!primary)
974 return -ENOMEM; 976 return -ENOMEM;
975 977
diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
index 4f4362d5a04c..d4e23f8ddcf6 100644
--- a/fs/fat/namei_vfat.c
+++ b/fs/fat/namei_vfat.c
@@ -664,7 +664,7 @@ static int vfat_add_entry(struct inode *dir, const struct qstr *qname,
664 if (len == 0) 664 if (len == 0)
665 return -ENOENT; 665 return -ENOENT;
666 666
667 slots = kmalloc(sizeof(*slots) * MSDOS_SLOTS, GFP_NOFS); 667 slots = kmalloc_array(MSDOS_SLOTS, sizeof(*slots), GFP_NOFS);
668 if (slots == NULL) 668 if (slots == NULL)
669 return -ENOMEM; 669 return -ENOMEM;
670 670
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index e03ca14f40e9..c6b88fa85e2e 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -64,9 +64,12 @@ static struct fuse_req *__fuse_request_alloc(unsigned npages, gfp_t flags)
64 pages = req->inline_pages; 64 pages = req->inline_pages;
65 page_descs = req->inline_page_descs; 65 page_descs = req->inline_page_descs;
66 } else { 66 } else {
67 pages = kmalloc(sizeof(struct page *) * npages, flags); 67 pages = kmalloc_array(npages, sizeof(struct page *),
68 page_descs = kmalloc(sizeof(struct fuse_page_desc) * 68 flags);
69 npages, flags); 69 page_descs =
70 kmalloc_array(npages,
71 sizeof(struct fuse_page_desc),
72 flags);
70 } 73 }
71 74
72 if (!pages || !page_descs) { 75 if (!pages || !page_descs) {
@@ -1359,7 +1362,8 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
1359 if (!fud) 1362 if (!fud)
1360 return -EPERM; 1363 return -EPERM;
1361 1364
1362 bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL); 1365 bufs = kmalloc_array(pipe->buffers, sizeof(struct pipe_buffer),
1366 GFP_KERNEL);
1363 if (!bufs) 1367 if (!bufs)
1364 return -ENOMEM; 1368 return -ENOMEM;
1365 1369
@@ -1940,7 +1944,8 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
1940 if (!fud) 1944 if (!fud)
1941 return -EPERM; 1945 return -EPERM;
1942 1946
1943 bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL); 1947 bufs = kmalloc_array(pipe->buffers, sizeof(struct pipe_buffer),
1948 GFP_KERNEL);
1944 if (!bufs) 1949 if (!bufs)
1945 return -ENOMEM; 1950 return -ENOMEM;
1946 1951
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index d9fb0ad6cc30..3090c445e8fc 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -1055,7 +1055,7 @@ static int dir_split_leaf(struct inode *inode, const struct qstr *name)
1055 /* Change the pointers. 1055 /* Change the pointers.
1056 Don't bother distinguishing stuffed from non-stuffed. 1056 Don't bother distinguishing stuffed from non-stuffed.
1057 This code is complicated enough already. */ 1057 This code is complicated enough already. */
1058 lp = kmalloc(half_len * sizeof(__be64), GFP_NOFS); 1058 lp = kmalloc_array(half_len, sizeof(__be64), GFP_NOFS);
1059 if (!lp) { 1059 if (!lp) {
1060 error = -ENOMEM; 1060 error = -ENOMEM;
1061 goto fail_brelse; 1061 goto fail_brelse;
@@ -1169,7 +1169,7 @@ static int dir_double_exhash(struct gfs2_inode *dip)
1169 if (IS_ERR(hc)) 1169 if (IS_ERR(hc))
1170 return PTR_ERR(hc); 1170 return PTR_ERR(hc);
1171 1171
1172 hc2 = kmalloc(hsize_bytes * 2, GFP_NOFS | __GFP_NOWARN); 1172 hc2 = kmalloc_array(hsize_bytes, 2, GFP_NOFS | __GFP_NOWARN);
1173 if (hc2 == NULL) 1173 if (hc2 == NULL)
1174 hc2 = __vmalloc(hsize_bytes * 2, GFP_NOFS, PAGE_KERNEL); 1174 hc2 = __vmalloc(hsize_bytes * 2, GFP_NOFS, PAGE_KERNEL);
1175 1175
@@ -1596,7 +1596,7 @@ int gfs2_dir_read(struct inode *inode, struct dir_context *ctx,
1596 1596
1597 error = -ENOMEM; 1597 error = -ENOMEM;
1598 /* 96 is max number of dirents which can be stuffed into an inode */ 1598 /* 96 is max number of dirents which can be stuffed into an inode */
1599 darr = kmalloc(96 * sizeof(struct gfs2_dirent *), GFP_NOFS); 1599 darr = kmalloc_array(96, sizeof(struct gfs2_dirent *), GFP_NOFS);
1600 if (darr) { 1600 if (darr) {
1601 g.pdent = (const struct gfs2_dirent **)darr; 1601 g.pdent = (const struct gfs2_dirent **)darr;
1602 g.offset = 0; 1602 g.offset = 0;
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 097bd3c0f270..4614ee25f621 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1303,7 +1303,8 @@ int gfs2_glock_nq_m(unsigned int num_gh, struct gfs2_holder *ghs)
1303 default: 1303 default:
1304 if (num_gh <= 4) 1304 if (num_gh <= 4)
1305 break; 1305 break;
1306 pph = kmalloc(num_gh * sizeof(struct gfs2_holder *), GFP_NOFS); 1306 pph = kmalloc_array(num_gh, sizeof(struct gfs2_holder *),
1307 GFP_NOFS);
1307 if (!pph) 1308 if (!pph)
1308 return -ENOMEM; 1309 return -ENOMEM;
1309 } 1310 }
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index e8585dfd209f..0efae7a0ee80 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -886,7 +886,7 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)
886 gfs2_write_calc_reserv(ip, sizeof(struct gfs2_quota), 886 gfs2_write_calc_reserv(ip, sizeof(struct gfs2_quota),
887 &data_blocks, &ind_blocks); 887 &data_blocks, &ind_blocks);
888 888
889 ghs = kmalloc(num_qd * sizeof(struct gfs2_holder), GFP_NOFS); 889 ghs = kmalloc_array(num_qd, sizeof(struct gfs2_holder), GFP_NOFS);
890 if (!ghs) 890 if (!ghs)
891 return -ENOMEM; 891 return -ENOMEM;
892 892
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 6bc5cfe710d1..33abcf29bc05 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -2605,8 +2605,9 @@ void gfs2_rlist_alloc(struct gfs2_rgrp_list *rlist, unsigned int state)
2605{ 2605{
2606 unsigned int x; 2606 unsigned int x;
2607 2607
2608 rlist->rl_ghs = kmalloc(rlist->rl_rgrps * sizeof(struct gfs2_holder), 2608 rlist->rl_ghs = kmalloc_array(rlist->rl_rgrps,
2609 GFP_NOFS | __GFP_NOFAIL); 2609 sizeof(struct gfs2_holder),
2610 GFP_NOFS | __GFP_NOFAIL);
2610 for (x = 0; x < rlist->rl_rgrps; x++) 2611 for (x = 0; x < rlist->rl_rgrps; x++)
2611 gfs2_holder_init(rlist->rl_rgd[x]->rd_gl, 2612 gfs2_holder_init(rlist->rl_rgd[x]->rd_gl,
2612 state, 0, 2613 state, 0,
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index cf5c7f3080d2..af0d5b01cf0b 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1097,7 +1097,7 @@ static int gfs2_statfs_slow(struct gfs2_sbd *sdp, struct gfs2_statfs_change_host
1097 int error = 0, err; 1097 int error = 0, err;
1098 1098
1099 memset(sc, 0, sizeof(struct gfs2_statfs_change_host)); 1099 memset(sc, 0, sizeof(struct gfs2_statfs_change_host));
1100 gha = kmalloc(slots * sizeof(struct gfs2_holder), GFP_KERNEL); 1100 gha = kmalloc_array(slots, sizeof(struct gfs2_holder), GFP_KERNEL);
1101 if (!gha) 1101 if (!gha)
1102 return -ENOMEM; 1102 return -ENOMEM;
1103 for (x = 0; x < slots; x++) 1103 for (x = 0; x < slots; x++)
diff --git a/fs/hpfs/dnode.c b/fs/hpfs/dnode.c
index a4ad18afbdec..4ada525c5c43 100644
--- a/fs/hpfs/dnode.c
+++ b/fs/hpfs/dnode.c
@@ -33,7 +33,8 @@ int hpfs_add_pos(struct inode *inode, loff_t *pos)
33 if (hpfs_inode->i_rddir_off[i] == pos) 33 if (hpfs_inode->i_rddir_off[i] == pos)
34 return 0; 34 return 0;
35 if (!(i&0x0f)) { 35 if (!(i&0x0f)) {
36 if (!(ppos = kmalloc((i+0x11) * sizeof(loff_t*), GFP_NOFS))) { 36 ppos = kmalloc_array(i + 0x11, sizeof(loff_t *), GFP_NOFS);
37 if (!ppos) {
37 pr_err("out of memory for position list\n"); 38 pr_err("out of memory for position list\n");
38 return -ENOMEM; 39 return -ENOMEM;
39 } 40 }
diff --git a/fs/hpfs/map.c b/fs/hpfs/map.c
index 7c49f1ef0c85..ecd9fccd1663 100644
--- a/fs/hpfs/map.c
+++ b/fs/hpfs/map.c
@@ -115,7 +115,7 @@ __le32 *hpfs_load_bitmap_directory(struct super_block *s, secno bmp)
115 int n = (hpfs_sb(s)->sb_fs_size + 0x200000 - 1) >> 21; 115 int n = (hpfs_sb(s)->sb_fs_size + 0x200000 - 1) >> 21;
116 int i; 116 int i;
117 __le32 *b; 117 __le32 *b;
118 if (!(b = kmalloc(n * 512, GFP_KERNEL))) { 118 if (!(b = kmalloc_array(n, 512, GFP_KERNEL))) {
119 pr_err("can't allocate memory for bitmap directory\n"); 119 pr_err("can't allocate memory for bitmap directory\n");
120 return NULL; 120 return NULL;
121 } 121 }
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index 240779e4689c..a1143e57a718 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -223,7 +223,7 @@ static struct jbd2_revoke_table_s *jbd2_journal_init_revoke_table(int hash_size)
223 table->hash_size = hash_size; 223 table->hash_size = hash_size;
224 table->hash_shift = shift; 224 table->hash_shift = shift;
225 table->hash_table = 225 table->hash_table =
226 kmalloc(hash_size * sizeof(struct list_head), GFP_KERNEL); 226 kmalloc_array(hash_size, sizeof(struct list_head), GFP_KERNEL);
227 if (!table->hash_table) { 227 if (!table->hash_table) {
228 kmem_cache_free(jbd2_revoke_table_cache, table); 228 kmem_cache_free(jbd2_revoke_table_cache, table);
229 table = NULL; 229 table = NULL;
diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
index 2cfe487708e0..c6821a509481 100644
--- a/fs/jffs2/wbuf.c
+++ b/fs/jffs2/wbuf.c
@@ -1208,7 +1208,7 @@ int jffs2_nand_flash_setup(struct jffs2_sb_info *c)
1208 if (!c->wbuf) 1208 if (!c->wbuf)
1209 return -ENOMEM; 1209 return -ENOMEM;
1210 1210
1211 c->oobbuf = kmalloc(NR_OOB_SCAN_PAGES * c->oobavail, GFP_KERNEL); 1211 c->oobbuf = kmalloc_array(NR_OOB_SCAN_PAGES, c->oobavail, GFP_KERNEL);
1212 if (!c->oobbuf) { 1212 if (!c->oobbuf) {
1213 kfree(c->wbuf); 1213 kfree(c->wbuf);
1214 return -ENOMEM; 1214 return -ENOMEM;
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 2d514c7affc2..49263e220dbc 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1641,7 +1641,7 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen)
1641 max_ranges = nblocks; 1641 max_ranges = nblocks;
1642 do_div(max_ranges, minlen); 1642 do_div(max_ranges, minlen);
1643 range_cnt = min_t(u64, max_ranges + 1, 32 * 1024); 1643 range_cnt = min_t(u64, max_ranges + 1, 32 * 1024);
1644 totrim = kmalloc(sizeof(struct range2trim) * range_cnt, GFP_NOFS); 1644 totrim = kmalloc_array(range_cnt, sizeof(struct range2trim), GFP_NOFS);
1645 if (totrim == NULL) { 1645 if (totrim == NULL) {
1646 jfs_error(bmp->db_ipbmap->i_sb, "no memory for trim array\n"); 1646 jfs_error(bmp->db_ipbmap->i_sb, "no memory for trim array\n");
1647 IWRITE_UNLOCK(ipbmap); 1647 IWRITE_UNLOCK(ipbmap);
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index de2bcb36e079..52bae3f5c914 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -594,7 +594,8 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
594 struct component_name ciKey; 594 struct component_name ciKey;
595 struct super_block *sb = ip->i_sb; 595 struct super_block *sb = ip->i_sb;
596 596
597 ciKey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t), GFP_NOFS); 597 ciKey.name = kmalloc_array(JFS_NAME_MAX + 1, sizeof(wchar_t),
598 GFP_NOFS);
598 if (!ciKey.name) { 599 if (!ciKey.name) {
599 rc = -ENOMEM; 600 rc = -ENOMEM;
600 goto dtSearch_Exit2; 601 goto dtSearch_Exit2;
@@ -957,7 +958,7 @@ static int dtSplitUp(tid_t tid,
957 smp = split->mp; 958 smp = split->mp;
958 sp = DT_PAGE(ip, smp); 959 sp = DT_PAGE(ip, smp);
959 960
960 key.name = kmalloc((JFS_NAME_MAX + 2) * sizeof(wchar_t), GFP_NOFS); 961 key.name = kmalloc_array(JFS_NAME_MAX + 2, sizeof(wchar_t), GFP_NOFS);
961 if (!key.name) { 962 if (!key.name) {
962 DT_PUTPAGE(smp); 963 DT_PUTPAGE(smp);
963 rc = -ENOMEM; 964 rc = -ENOMEM;
@@ -3779,12 +3780,12 @@ static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
3779 struct component_name lkey; 3780 struct component_name lkey;
3780 struct component_name rkey; 3781 struct component_name rkey;
3781 3782
3782 lkey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t), 3783 lkey.name = kmalloc_array(JFS_NAME_MAX + 1, sizeof(wchar_t),
3783 GFP_KERNEL); 3784 GFP_KERNEL);
3784 if (lkey.name == NULL) 3785 if (lkey.name == NULL)
3785 return -ENOMEM; 3786 return -ENOMEM;
3786 3787
3787 rkey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t), 3788 rkey.name = kmalloc_array(JFS_NAME_MAX + 1, sizeof(wchar_t),
3788 GFP_KERNEL); 3789 GFP_KERNEL);
3789 if (rkey.name == NULL) { 3790 if (rkey.name == NULL) {
3790 kfree(lkey.name); 3791 kfree(lkey.name);
diff --git a/fs/jfs/jfs_unicode.c b/fs/jfs/jfs_unicode.c
index c7de6f5bbefc..0148e2e4d97a 100644
--- a/fs/jfs/jfs_unicode.c
+++ b/fs/jfs/jfs_unicode.c
@@ -121,7 +121,7 @@ int get_UCSname(struct component_name * uniName, struct dentry *dentry)
121 return -ENAMETOOLONG; 121 return -ENAMETOOLONG;
122 122
123 uniName->name = 123 uniName->name =
124 kmalloc((length + 1) * sizeof(wchar_t), GFP_NOFS); 124 kmalloc_array(length + 1, sizeof(wchar_t), GFP_NOFS);
125 125
126 if (uniName->name == NULL) 126 if (uniName->name == NULL)
127 return -ENOMEM; 127 return -ENOMEM;
diff --git a/fs/mbcache.c b/fs/mbcache.c
index bf41e2e72c18..081ccf0caee3 100644
--- a/fs/mbcache.c
+++ b/fs/mbcache.c
@@ -353,8 +353,9 @@ struct mb_cache *mb_cache_create(int bucket_bits)
353 cache->c_max_entries = bucket_count << 4; 353 cache->c_max_entries = bucket_count << 4;
354 INIT_LIST_HEAD(&cache->c_list); 354 INIT_LIST_HEAD(&cache->c_list);
355 spin_lock_init(&cache->c_list_lock); 355 spin_lock_init(&cache->c_list_lock);
356 cache->c_hash = kmalloc(bucket_count * sizeof(struct hlist_bl_head), 356 cache->c_hash = kmalloc_array(bucket_count,
357 GFP_KERNEL); 357 sizeof(struct hlist_bl_head),
358 GFP_KERNEL);
358 if (!cache->c_hash) { 359 if (!cache->c_hash) {
359 kfree(cache); 360 kfree(cache);
360 goto err_out; 361 goto err_out;
diff --git a/fs/namei.c b/fs/namei.c
index 6df1f61855d6..2490ddb8bc90 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -537,12 +537,12 @@ static int __nd_alloc_stack(struct nameidata *nd)
537 struct saved *p; 537 struct saved *p;
538 538
539 if (nd->flags & LOOKUP_RCU) { 539 if (nd->flags & LOOKUP_RCU) {
540 p= kmalloc(MAXSYMLINKS * sizeof(struct saved), 540 p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
541 GFP_ATOMIC); 541 GFP_ATOMIC);
542 if (unlikely(!p)) 542 if (unlikely(!p))
543 return -ECHILD; 543 return -ECHILD;
544 } else { 544 } else {
545 p= kmalloc(MAXSYMLINKS * sizeof(struct saved), 545 p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
546 GFP_KERNEL); 546 GFP_KERNEL);
547 if (unlikely(!p)) 547 if (unlikely(!p))
548 return -ENOMEM; 548 return -ENOMEM;
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 66eaeb1e8c2c..9c247fa1e959 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -510,8 +510,9 @@ nfs4_legacy_state_init(struct net *net)
510 struct nfsd_net *nn = net_generic(net, nfsd_net_id); 510 struct nfsd_net *nn = net_generic(net, nfsd_net_id);
511 int i; 511 int i;
512 512
513 nn->reclaim_str_hashtbl = kmalloc(sizeof(struct list_head) * 513 nn->reclaim_str_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
514 CLIENT_HASH_SIZE, GFP_KERNEL); 514 sizeof(struct list_head),
515 GFP_KERNEL);
515 if (!nn->reclaim_str_hashtbl) 516 if (!nn->reclaim_str_hashtbl)
516 return -ENOMEM; 517 return -ENOMEM;
517 518
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index fc74d6f46bd5..39370a503a63 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1807,8 +1807,9 @@ static struct nfs4_client *alloc_client(struct xdr_netobj name)
1807 clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL); 1807 clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
1808 if (clp->cl_name.data == NULL) 1808 if (clp->cl_name.data == NULL)
1809 goto err_no_name; 1809 goto err_no_name;
1810 clp->cl_ownerstr_hashtbl = kmalloc(sizeof(struct list_head) * 1810 clp->cl_ownerstr_hashtbl = kmalloc_array(OWNER_HASH_SIZE,
1811 OWNER_HASH_SIZE, GFP_KERNEL); 1811 sizeof(struct list_head),
1812 GFP_KERNEL);
1812 if (!clp->cl_ownerstr_hashtbl) 1813 if (!clp->cl_ownerstr_hashtbl)
1813 goto err_no_hashtbl; 1814 goto err_no_hashtbl;
1814 for (i = 0; i < OWNER_HASH_SIZE; i++) 1815 for (i = 0; i < OWNER_HASH_SIZE; i++)
@@ -7093,16 +7094,19 @@ static int nfs4_state_create_net(struct net *net)
7093 struct nfsd_net *nn = net_generic(net, nfsd_net_id); 7094 struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7094 int i; 7095 int i;
7095 7096
7096 nn->conf_id_hashtbl = kmalloc(sizeof(struct list_head) * 7097 nn->conf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
7097 CLIENT_HASH_SIZE, GFP_KERNEL); 7098 sizeof(struct list_head),
7099 GFP_KERNEL);
7098 if (!nn->conf_id_hashtbl) 7100 if (!nn->conf_id_hashtbl)
7099 goto err; 7101 goto err;
7100 nn->unconf_id_hashtbl = kmalloc(sizeof(struct list_head) * 7102 nn->unconf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
7101 CLIENT_HASH_SIZE, GFP_KERNEL); 7103 sizeof(struct list_head),
7104 GFP_KERNEL);
7102 if (!nn->unconf_id_hashtbl) 7105 if (!nn->unconf_id_hashtbl)
7103 goto err_unconf_id; 7106 goto err_unconf_id;
7104 nn->sessionid_hashtbl = kmalloc(sizeof(struct list_head) * 7107 nn->sessionid_hashtbl = kmalloc_array(SESSION_HASH_SIZE,
7105 SESSION_HASH_SIZE, GFP_KERNEL); 7108 sizeof(struct list_head),
7109 GFP_KERNEL);
7106 if (!nn->sessionid_hashtbl) 7110 if (!nn->sessionid_hashtbl)
7107 goto err_sessionid; 7111 goto err_sessionid;
7108 7112
diff --git a/fs/ntfs/compress.c b/fs/ntfs/compress.c
index f8eb04387ca4..fbd0090d7d0c 100644
--- a/fs/ntfs/compress.c
+++ b/fs/ntfs/compress.c
@@ -527,7 +527,7 @@ int ntfs_read_compressed_block(struct page *page)
527 BUG_ON(ni->type != AT_DATA); 527 BUG_ON(ni->type != AT_DATA);
528 BUG_ON(ni->name_len); 528 BUG_ON(ni->name_len);
529 529
530 pages = kmalloc(nr_pages * sizeof(struct page *), GFP_NOFS); 530 pages = kmalloc_array(nr_pages, sizeof(struct page *), GFP_NOFS);
531 531
532 /* Allocate memory to store the buffer heads we need. */ 532 /* Allocate memory to store the buffer heads we need. */
533 bhs_size = cb_size / block_size * sizeof(struct buffer_head *); 533 bhs_size = cb_size / block_size * sizeof(struct buffer_head *);
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index e5076185cc1e..1296f78ae966 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1078,7 +1078,7 @@ int o2net_send_message_vec(u32 msg_type, u32 key, struct kvec *caller_vec,
1078 o2net_set_nst_sock_container(&nst, sc); 1078 o2net_set_nst_sock_container(&nst, sc);
1079 1079
1080 veclen = caller_veclen + 1; 1080 veclen = caller_veclen + 1;
1081 vec = kmalloc(sizeof(struct kvec) * veclen, GFP_ATOMIC); 1081 vec = kmalloc_array(veclen, sizeof(struct kvec), GFP_ATOMIC);
1082 if (vec == NULL) { 1082 if (vec == NULL) {
1083 mlog(0, "failed to %zu element kvec!\n", veclen); 1083 mlog(0, "failed to %zu element kvec!\n", veclen);
1084 ret = -ENOMEM; 1084 ret = -ENOMEM;
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 425081be6161..2acd58ba9b7b 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -86,7 +86,7 @@ static void dlm_free_pagevec(void **vec, int pages)
86 86
87static void **dlm_alloc_pagevec(int pages) 87static void **dlm_alloc_pagevec(int pages)
88{ 88{
89 void **vec = kmalloc(pages * sizeof(void *), GFP_KERNEL); 89 void **vec = kmalloc_array(pages, sizeof(void *), GFP_KERNEL);
90 int i; 90 int i;
91 91
92 if (!vec) 92 if (!vec)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 4aa9ce5df02f..80aa42506b8b 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -389,7 +389,8 @@ static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns,
389 unsigned long *entries; 389 unsigned long *entries;
390 int err; 390 int err;
391 391
392 entries = kmalloc(MAX_STACK_TRACE_DEPTH * sizeof(*entries), GFP_KERNEL); 392 entries = kmalloc_array(MAX_STACK_TRACE_DEPTH, sizeof(*entries),
393 GFP_KERNEL);
393 if (!entries) 394 if (!entries)
394 return -ENOMEM; 395 return -ENOMEM;
395 396
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 597969db9e90..e9679016271f 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1473,7 +1473,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
1473 pm.show_pfn = file_ns_capable(file, &init_user_ns, CAP_SYS_ADMIN); 1473 pm.show_pfn = file_ns_capable(file, &init_user_ns, CAP_SYS_ADMIN);
1474 1474
1475 pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT); 1475 pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
1476 pm.buffer = kmalloc(pm.len * PM_ENTRY_BYTES, GFP_KERNEL); 1476 pm.buffer = kmalloc_array(pm.len, PM_ENTRY_BYTES, GFP_KERNEL);
1477 ret = -ENOMEM; 1477 ret = -ENOMEM;
1478 if (!pm.buffer) 1478 if (!pm.buffer)
1479 goto out_mm; 1479 goto out_mm;
diff --git a/fs/read_write.c b/fs/read_write.c
index e83bd9744b5d..153f8f690490 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -778,7 +778,7 @@ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,
778 goto out; 778 goto out;
779 } 779 }
780 if (nr_segs > fast_segs) { 780 if (nr_segs > fast_segs) {
781 iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL); 781 iov = kmalloc_array(nr_segs, sizeof(struct iovec), GFP_KERNEL);
782 if (iov == NULL) { 782 if (iov == NULL) {
783 ret = -ENOMEM; 783 ret = -ENOMEM;
784 goto out; 784 goto out;
@@ -849,7 +849,7 @@ ssize_t compat_rw_copy_check_uvector(int type,
849 goto out; 849 goto out;
850 if (nr_segs > fast_segs) { 850 if (nr_segs > fast_segs) {
851 ret = -ENOMEM; 851 ret = -ENOMEM;
852 iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL); 852 iov = kmalloc_array(nr_segs, sizeof(struct iovec), GFP_KERNEL);
853 if (iov == NULL) 853 if (iov == NULL)
854 goto out; 854 goto out;
855 } 855 }
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 23148c3ed675..358ee2a1ce1a 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2192,10 +2192,12 @@ static int journal_read_transaction(struct super_block *sb,
2192 * now we know we've got a good transaction, and it was 2192 * now we know we've got a good transaction, and it was
2193 * inside the valid time ranges 2193 * inside the valid time ranges
2194 */ 2194 */
2195 log_blocks = kmalloc(get_desc_trans_len(desc) * 2195 log_blocks = kmalloc_array(get_desc_trans_len(desc),
2196 sizeof(struct buffer_head *), GFP_NOFS); 2196 sizeof(struct buffer_head *),
2197 real_blocks = kmalloc(get_desc_trans_len(desc) * 2197 GFP_NOFS);
2198 sizeof(struct buffer_head *), GFP_NOFS); 2198 real_blocks = kmalloc_array(get_desc_trans_len(desc),
2199 sizeof(struct buffer_head *),
2200 GFP_NOFS);
2199 if (!log_blocks || !real_blocks) { 2201 if (!log_blocks || !real_blocks) {
2200 brelse(c_bh); 2202 brelse(c_bh);
2201 brelse(d_bh); 2203 brelse(d_bh);
diff --git a/fs/select.c b/fs/select.c
index bc3cc0f98896..317891ff8165 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -1236,7 +1236,7 @@ static int compat_core_sys_select(int n, compat_ulong_t __user *inp,
1236 size = FDS_BYTES(n); 1236 size = FDS_BYTES(n);
1237 bits = stack_fds; 1237 bits = stack_fds;
1238 if (size > sizeof(stack_fds) / 6) { 1238 if (size > sizeof(stack_fds) / 6) {
1239 bits = kmalloc(6 * size, GFP_KERNEL); 1239 bits = kmalloc_array(6, size, GFP_KERNEL);
1240 ret = -ENOMEM; 1240 ret = -ENOMEM;
1241 if (!bits) 1241 if (!bits)
1242 goto out_nofds; 1242 goto out_nofds;
diff --git a/fs/splice.c b/fs/splice.c
index 005d09cf3fa8..2365ab073a27 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -259,8 +259,9 @@ int splice_grow_spd(const struct pipe_inode_info *pipe, struct splice_pipe_desc
259 if (buffers <= PIPE_DEF_BUFFERS) 259 if (buffers <= PIPE_DEF_BUFFERS)
260 return 0; 260 return 0;
261 261
262 spd->pages = kmalloc(buffers * sizeof(struct page *), GFP_KERNEL); 262 spd->pages = kmalloc_array(buffers, sizeof(struct page *), GFP_KERNEL);
263 spd->partial = kmalloc(buffers * sizeof(struct partial_page), GFP_KERNEL); 263 spd->partial = kmalloc_array(buffers, sizeof(struct partial_page),
264 GFP_KERNEL);
264 265
265 if (spd->pages && spd->partial) 266 if (spd->pages && spd->partial)
266 return 0; 267 return 0;
@@ -395,7 +396,7 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
395 396
396 vec = __vec; 397 vec = __vec;
397 if (nr_pages > PIPE_DEF_BUFFERS) { 398 if (nr_pages > PIPE_DEF_BUFFERS) {
398 vec = kmalloc(nr_pages * sizeof(struct kvec), GFP_KERNEL); 399 vec = kmalloc_array(nr_pages, sizeof(struct kvec), GFP_KERNEL);
399 if (unlikely(!vec)) { 400 if (unlikely(!vec)) {
400 res = -ENOMEM; 401 res = -ENOMEM;
401 goto out; 402 goto out;
diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index 9a517109da0f..d4e45adddf1e 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -628,7 +628,7 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
628 /* Needed by 'ubifs_pack_lsave()' */ 628 /* Needed by 'ubifs_pack_lsave()' */
629 c->main_first = c->leb_cnt - *main_lebs; 629 c->main_first = c->leb_cnt - *main_lebs;
630 630
631 lsave = kmalloc(sizeof(int) * c->lsave_cnt, GFP_KERNEL); 631 lsave = kmalloc_array(c->lsave_cnt, sizeof(int), GFP_KERNEL);
632 pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_KERNEL); 632 pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_KERNEL);
633 nnode = kzalloc(sizeof(struct ubifs_nnode), GFP_KERNEL); 633 nnode = kzalloc(sizeof(struct ubifs_nnode), GFP_KERNEL);
634 buf = vmalloc(c->leb_size); 634 buf = vmalloc(c->leb_size);
@@ -1636,15 +1636,17 @@ static int lpt_init_rd(struct ubifs_info *c)
1636 return -ENOMEM; 1636 return -ENOMEM;
1637 1637
1638 for (i = 0; i < LPROPS_HEAP_CNT; i++) { 1638 for (i = 0; i < LPROPS_HEAP_CNT; i++) {
1639 c->lpt_heap[i].arr = kmalloc(sizeof(void *) * LPT_HEAP_SZ, 1639 c->lpt_heap[i].arr = kmalloc_array(LPT_HEAP_SZ,
1640 GFP_KERNEL); 1640 sizeof(void *),
1641 GFP_KERNEL);
1641 if (!c->lpt_heap[i].arr) 1642 if (!c->lpt_heap[i].arr)
1642 return -ENOMEM; 1643 return -ENOMEM;
1643 c->lpt_heap[i].cnt = 0; 1644 c->lpt_heap[i].cnt = 0;
1644 c->lpt_heap[i].max_cnt = LPT_HEAP_SZ; 1645 c->lpt_heap[i].max_cnt = LPT_HEAP_SZ;
1645 } 1646 }
1646 1647
1647 c->dirty_idx.arr = kmalloc(sizeof(void *) * LPT_HEAP_SZ, GFP_KERNEL); 1648 c->dirty_idx.arr = kmalloc_array(LPT_HEAP_SZ, sizeof(void *),
1649 GFP_KERNEL);
1648 if (!c->dirty_idx.arr) 1650 if (!c->dirty_idx.arr)
1649 return -ENOMEM; 1651 return -ENOMEM;
1650 c->dirty_idx.cnt = 0; 1652 c->dirty_idx.cnt = 0;
@@ -1697,7 +1699,7 @@ static int lpt_init_wr(struct ubifs_info *c)
1697 return -ENOMEM; 1699 return -ENOMEM;
1698 1700
1699 if (c->big_lpt) { 1701 if (c->big_lpt) {
1700 c->lsave = kmalloc(sizeof(int) * c->lsave_cnt, GFP_NOFS); 1702 c->lsave = kmalloc_array(c->lsave_cnt, sizeof(int), GFP_NOFS);
1701 if (!c->lsave) 1703 if (!c->lsave)
1702 return -ENOMEM; 1704 return -ENOMEM;
1703 err = read_lsave(c); 1705 err = read_lsave(c);
@@ -1939,8 +1941,8 @@ int ubifs_lpt_scan_nolock(struct ubifs_info *c, int start_lnum, int end_lnum,
1939 return err; 1941 return err;
1940 } 1942 }
1941 1943
1942 path = kmalloc(sizeof(struct lpt_scan_node) * (c->lpt_hght + 1), 1944 path = kmalloc_array(c->lpt_hght + 1, sizeof(struct lpt_scan_node),
1943 GFP_NOFS); 1945 GFP_NOFS);
1944 if (!path) 1946 if (!path)
1945 return -ENOMEM; 1947 return -ENOMEM;
1946 1948
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 6c397a389105..c5466c70d620 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1196,7 +1196,8 @@ static int mount_ubifs(struct ubifs_info *c)
1196 * never exceed 64. 1196 * never exceed 64.
1197 */ 1197 */
1198 err = -ENOMEM; 1198 err = -ENOMEM;
1199 c->bottom_up_buf = kmalloc(BOTTOM_UP_HEIGHT * sizeof(int), GFP_KERNEL); 1199 c->bottom_up_buf = kmalloc_array(BOTTOM_UP_HEIGHT, sizeof(int),
1200 GFP_KERNEL);
1200 if (!c->bottom_up_buf) 1201 if (!c->bottom_up_buf)
1201 goto out_free; 1202 goto out_free;
1202 1203
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index ba3d0e0f8615..4a21e7f75e7a 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -1104,8 +1104,9 @@ static struct ubifs_znode *dirty_cow_bottom_up(struct ubifs_info *c,
1104 ubifs_assert(znode); 1104 ubifs_assert(znode);
1105 if (c->zroot.znode->level > BOTTOM_UP_HEIGHT) { 1105 if (c->zroot.znode->level > BOTTOM_UP_HEIGHT) {
1106 kfree(c->bottom_up_buf); 1106 kfree(c->bottom_up_buf);
1107 c->bottom_up_buf = kmalloc(c->zroot.znode->level * sizeof(int), 1107 c->bottom_up_buf = kmalloc_array(c->zroot.znode->level,
1108 GFP_NOFS); 1108 sizeof(int),
1109 GFP_NOFS);
1109 if (!c->bottom_up_buf) 1110 if (!c->bottom_up_buf)
1110 return ERR_PTR(-ENOMEM); 1111 return ERR_PTR(-ENOMEM);
1111 path = c->bottom_up_buf; 1112 path = c->bottom_up_buf;
diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
index aa31f60220ef..a9df94ad46a3 100644
--- a/fs/ubifs/tnc_commit.c
+++ b/fs/ubifs/tnc_commit.c
@@ -366,7 +366,8 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
366 366
367 dbg_gc("%d znodes to write", cnt); 367 dbg_gc("%d znodes to write", cnt);
368 368
369 c->gap_lebs = kmalloc(sizeof(int) * (c->lst.idx_lebs + 1), GFP_NOFS); 369 c->gap_lebs = kmalloc_array(c->lst.idx_lebs + 1, sizeof(int),
370 GFP_NOFS);
370 if (!c->gap_lebs) 371 if (!c->gap_lebs)
371 return -ENOMEM; 372 return -ENOMEM;
372 373
@@ -674,7 +675,7 @@ static int alloc_idx_lebs(struct ubifs_info *c, int cnt)
674 dbg_cmt("need about %d empty LEBS for TNC commit", leb_cnt); 675 dbg_cmt("need about %d empty LEBS for TNC commit", leb_cnt);
675 if (!leb_cnt) 676 if (!leb_cnt)
676 return 0; 677 return 0;
677 c->ilebs = kmalloc(leb_cnt * sizeof(int), GFP_NOFS); 678 c->ilebs = kmalloc_array(leb_cnt, sizeof(int), GFP_NOFS);
678 if (!c->ilebs) 679 if (!c->ilebs)
679 return -ENOMEM; 680 return -ENOMEM;
680 for (i = 0; i < leb_cnt; i++) { 681 for (i = 0; i < leb_cnt; i++) {
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 8254b8b3690f..488088141451 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -541,7 +541,9 @@ static int ufs_read_cylinder_structures(struct super_block *sb)
541 * Read cylinder group (we read only first fragment from block 541 * Read cylinder group (we read only first fragment from block
542 * at this time) and prepare internal data structures for cg caching. 542 * at this time) and prepare internal data structures for cg caching.
543 */ 543 */
544 if (!(sbi->s_ucg = kmalloc (sizeof(struct buffer_head *) * uspi->s_ncg, GFP_NOFS))) 544 sbi->s_ucg = kmalloc_array(uspi->s_ncg, sizeof(struct buffer_head *),
545 GFP_NOFS);
546 if (!sbi->s_ucg)
545 goto failed; 547 goto failed;
546 for (i = 0; i < uspi->s_ncg; i++) 548 for (i = 0; i < uspi->s_ncg; i++)
547 sbi->s_ucg[i] = NULL; 549 sbi->s_ucg[i] = NULL;
diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index b4b5b81e7251..1603492c9cc7 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -623,8 +623,9 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key)
623 if (!key || key->prefixlen > trie->max_prefixlen) 623 if (!key || key->prefixlen > trie->max_prefixlen)
624 goto find_leftmost; 624 goto find_leftmost;
625 625
626 node_stack = kmalloc(trie->max_prefixlen * sizeof(struct lpm_trie_node *), 626 node_stack = kmalloc_array(trie->max_prefixlen,
627 GFP_ATOMIC | __GFP_NOWARN); 627 sizeof(struct lpm_trie_node *),
628 GFP_ATOMIC | __GFP_NOWARN);
628 if (!node_stack) 629 if (!node_stack)
629 return -ENOMEM; 630 return -ENOMEM;
630 631
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index e06c97f3ed1a..9b3f9b04f817 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -197,7 +197,7 @@ static void *pidlist_allocate(int count)
197 if (PIDLIST_TOO_LARGE(count)) 197 if (PIDLIST_TOO_LARGE(count))
198 return vmalloc(count * sizeof(pid_t)); 198 return vmalloc(count * sizeof(pid_t));
199 else 199 else
200 return kmalloc(count * sizeof(pid_t), GFP_KERNEL); 200 return kmalloc_array(count, sizeof(pid_t), GFP_KERNEL);
201} 201}
202 202
203static void pidlist_free(void *p) 203static void pidlist_free(void *p)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index b42037e6e81d..d8b12e0d39cd 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -683,7 +683,7 @@ static int generate_sched_domains(cpumask_var_t **domains,
683 goto done; 683 goto done;
684 } 684 }
685 685
686 csa = kmalloc(nr_cpusets() * sizeof(cp), GFP_KERNEL); 686 csa = kmalloc_array(nr_cpusets(), sizeof(cp), GFP_KERNEL);
687 if (!csa) 687 if (!csa)
688 goto done; 688 goto done;
689 csn = 0; 689 csn = 0;
@@ -753,7 +753,8 @@ restart:
753 * The rest of the code, including the scheduler, can deal with 753 * The rest of the code, including the scheduler, can deal with
754 * dattr==NULL case. No need to abort if alloc fails. 754 * dattr==NULL case. No need to abort if alloc fails.
755 */ 755 */
756 dattr = kmalloc(ndoms * sizeof(struct sched_domain_attr), GFP_KERNEL); 756 dattr = kmalloc_array(ndoms, sizeof(struct sched_domain_attr),
757 GFP_KERNEL);
757 758
758 for (nslot = 0, i = 0; i < csn; i++) { 759 for (nslot = 0, i = 0; i < csn; i++) {
759 struct cpuset *a = csa[i]; 760 struct cpuset *a = csa[i];
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index e405677ee08d..aaa69531fae2 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -729,8 +729,8 @@ static int kdb_defcmd(int argc, const char **argv)
729 kdb_printf("Command only available during kdb_init()\n"); 729 kdb_printf("Command only available during kdb_init()\n");
730 return KDB_NOTIMP; 730 return KDB_NOTIMP;
731 } 731 }
732 defcmd_set = kmalloc((defcmd_set_count + 1) * sizeof(*defcmd_set), 732 defcmd_set = kmalloc_array(defcmd_set_count + 1, sizeof(*defcmd_set),
733 GFP_KDB); 733 GFP_KDB);
734 if (!defcmd_set) 734 if (!defcmd_set)
735 goto fail_defcmd; 735 goto fail_defcmd;
736 memcpy(defcmd_set, save_defcmd_set, 736 memcpy(defcmd_set, save_defcmd_set,
@@ -2706,8 +2706,11 @@ int kdb_register_flags(char *cmd,
2706 } 2706 }
2707 2707
2708 if (i >= kdb_max_commands) { 2708 if (i >= kdb_max_commands) {
2709 kdbtab_t *new = kmalloc((kdb_max_commands - KDB_BASE_CMD_MAX + 2709 kdbtab_t *new = kmalloc_array(kdb_max_commands -
2710 kdb_command_extend) * sizeof(*new), GFP_KDB); 2710 KDB_BASE_CMD_MAX +
2711 kdb_command_extend,
2712 sizeof(*new),
2713 GFP_KDB);
2711 if (!new) { 2714 if (!new) {
2712 kdb_printf("Could not allocate new kdb_command " 2715 kdb_printf("Could not allocate new kdb_command "
2713 "table\n"); 2716 "table\n");
diff --git a/kernel/fail_function.c b/kernel/fail_function.c
index 1d5632d8bbcc..5349c91c2298 100644
--- a/kernel/fail_function.c
+++ b/kernel/fail_function.c
@@ -258,7 +258,7 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
258 /* cut off if it is too long */ 258 /* cut off if it is too long */
259 if (count > KSYM_NAME_LEN) 259 if (count > KSYM_NAME_LEN)
260 count = KSYM_NAME_LEN; 260 count = KSYM_NAME_LEN;
261 buf = kmalloc(sizeof(char) * (count + 1), GFP_KERNEL); 261 buf = kmalloc(count + 1, GFP_KERNEL);
262 if (!buf) 262 if (!buf)
263 return -ENOMEM; 263 return -ENOMEM;
264 264
diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c
index 6850ffd69125..4ceeb13a74ed 100644
--- a/kernel/locking/locktorture.c
+++ b/kernel/locking/locktorture.c
@@ -913,7 +913,9 @@ static int __init lock_torture_init(void)
913 /* Initialize the statistics so that each run gets its own numbers. */ 913 /* Initialize the statistics so that each run gets its own numbers. */
914 if (nwriters_stress) { 914 if (nwriters_stress) {
915 lock_is_write_held = 0; 915 lock_is_write_held = 0;
916 cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL); 916 cxt.lwsa = kmalloc_array(cxt.nrealwriters_stress,
917 sizeof(*cxt.lwsa),
918 GFP_KERNEL);
917 if (cxt.lwsa == NULL) { 919 if (cxt.lwsa == NULL) {
918 VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory"); 920 VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory");
919 firsterr = -ENOMEM; 921 firsterr = -ENOMEM;
@@ -942,7 +944,9 @@ static int __init lock_torture_init(void)
942 944
943 if (nreaders_stress) { 945 if (nreaders_stress) {
944 lock_is_read_held = 0; 946 lock_is_read_held = 0;
945 cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL); 947 cxt.lrsa = kmalloc_array(cxt.nrealreaders_stress,
948 sizeof(*cxt.lrsa),
949 GFP_KERNEL);
946 if (cxt.lrsa == NULL) { 950 if (cxt.lrsa == NULL) {
947 VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory"); 951 VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory");
948 firsterr = -ENOMEM; 952 firsterr = -ENOMEM;
diff --git a/kernel/relay.c b/kernel/relay.c
index c955b10c973c..9f5326e8a036 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -169,7 +169,8 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan)
169 buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL); 169 buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
170 if (!buf) 170 if (!buf)
171 return NULL; 171 return NULL;
172 buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL); 172 buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t *),
173 GFP_KERNEL);
173 if (!buf->padding) 174 if (!buf->padding)
174 goto free_buf; 175 goto free_buf;
175 176
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 61a1125c1ae4..05a831427bc7 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -1750,7 +1750,7 @@ cpumask_var_t *alloc_sched_domains(unsigned int ndoms)
1750 int i; 1750 int i;
1751 cpumask_var_t *doms; 1751 cpumask_var_t *doms;
1752 1752
1753 doms = kmalloc(sizeof(*doms) * ndoms, GFP_KERNEL); 1753 doms = kmalloc_array(ndoms, sizeof(*doms), GFP_KERNEL);
1754 if (!doms) 1754 if (!doms)
1755 return NULL; 1755 return NULL;
1756 for (i = 0; i < ndoms; i++) { 1756 for (i = 0; i < ndoms; i++) {
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 8d83bcf9ef69..df4b6254f986 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -6830,9 +6830,10 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
6830 struct task_struct *g, *t; 6830 struct task_struct *g, *t;
6831 6831
6832 for (i = 0; i < FTRACE_RETSTACK_ALLOC_SIZE; i++) { 6832 for (i = 0; i < FTRACE_RETSTACK_ALLOC_SIZE; i++) {
6833 ret_stack_list[i] = kmalloc(FTRACE_RETFUNC_DEPTH 6833 ret_stack_list[i] =
6834 * sizeof(struct ftrace_ret_stack), 6834 kmalloc_array(FTRACE_RETFUNC_DEPTH,
6835 GFP_KERNEL); 6835 sizeof(struct ftrace_ret_stack),
6836 GFP_KERNEL);
6836 if (!ret_stack_list[i]) { 6837 if (!ret_stack_list[i]) {
6837 start = 0; 6838 start = 0;
6838 end = i; 6839 end = i;
@@ -6904,9 +6905,9 @@ static int start_graph_tracing(void)
6904 struct ftrace_ret_stack **ret_stack_list; 6905 struct ftrace_ret_stack **ret_stack_list;
6905 int ret, cpu; 6906 int ret, cpu;
6906 6907
6907 ret_stack_list = kmalloc(FTRACE_RETSTACK_ALLOC_SIZE * 6908 ret_stack_list = kmalloc_array(FTRACE_RETSTACK_ALLOC_SIZE,
6908 sizeof(struct ftrace_ret_stack *), 6909 sizeof(struct ftrace_ret_stack *),
6909 GFP_KERNEL); 6910 GFP_KERNEL);
6910 6911
6911 if (!ret_stack_list) 6912 if (!ret_stack_list)
6912 return -ENOMEM; 6913 return -ENOMEM;
@@ -7088,9 +7089,10 @@ void ftrace_graph_init_idle_task(struct task_struct *t, int cpu)
7088 7089
7089 ret_stack = per_cpu(idle_ret_stack, cpu); 7090 ret_stack = per_cpu(idle_ret_stack, cpu);
7090 if (!ret_stack) { 7091 if (!ret_stack) {
7091 ret_stack = kmalloc(FTRACE_RETFUNC_DEPTH 7092 ret_stack =
7092 * sizeof(struct ftrace_ret_stack), 7093 kmalloc_array(FTRACE_RETFUNC_DEPTH,
7093 GFP_KERNEL); 7094 sizeof(struct ftrace_ret_stack),
7095 GFP_KERNEL);
7094 if (!ret_stack) 7096 if (!ret_stack)
7095 return; 7097 return;
7096 per_cpu(idle_ret_stack, cpu) = ret_stack; 7098 per_cpu(idle_ret_stack, cpu) = ret_stack;
@@ -7109,9 +7111,9 @@ void ftrace_graph_init_task(struct task_struct *t)
7109 if (ftrace_graph_active) { 7111 if (ftrace_graph_active) {
7110 struct ftrace_ret_stack *ret_stack; 7112 struct ftrace_ret_stack *ret_stack;
7111 7113
7112 ret_stack = kmalloc(FTRACE_RETFUNC_DEPTH 7114 ret_stack = kmalloc_array(FTRACE_RETFUNC_DEPTH,
7113 * sizeof(struct ftrace_ret_stack), 7115 sizeof(struct ftrace_ret_stack),
7114 GFP_KERNEL); 7116 GFP_KERNEL);
7115 if (!ret_stack) 7117 if (!ret_stack)
7116 return; 7118 return;
7117 graph_init_task(t, ret_stack); 7119 graph_init_task(t, ret_stack);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 108ce3e1dc13..8ea855015613 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1751,12 +1751,13 @@ static inline void set_cmdline(int idx, const char *cmdline)
1751static int allocate_cmdlines_buffer(unsigned int val, 1751static int allocate_cmdlines_buffer(unsigned int val,
1752 struct saved_cmdlines_buffer *s) 1752 struct saved_cmdlines_buffer *s)
1753{ 1753{
1754 s->map_cmdline_to_pid = kmalloc(val * sizeof(*s->map_cmdline_to_pid), 1754 s->map_cmdline_to_pid = kmalloc_array(val,
1755 GFP_KERNEL); 1755 sizeof(*s->map_cmdline_to_pid),
1756 GFP_KERNEL);
1756 if (!s->map_cmdline_to_pid) 1757 if (!s->map_cmdline_to_pid)
1757 return -ENOMEM; 1758 return -ENOMEM;
1758 1759
1759 s->saved_cmdlines = kmalloc(val * TASK_COMM_LEN, GFP_KERNEL); 1760 s->saved_cmdlines = kmalloc_array(TASK_COMM_LEN, val, GFP_KERNEL);
1760 if (!s->saved_cmdlines) { 1761 if (!s->saved_cmdlines) {
1761 kfree(s->map_cmdline_to_pid); 1762 kfree(s->map_cmdline_to_pid);
1762 return -ENOMEM; 1763 return -ENOMEM;
@@ -5063,7 +5064,7 @@ trace_insert_eval_map_file(struct module *mod, struct trace_eval_map **start,
5063 * where the head holds the module and length of array, and the 5064 * where the head holds the module and length of array, and the
5064 * tail holds a pointer to the next list. 5065 * tail holds a pointer to the next list.
5065 */ 5066 */
5066 map_array = kmalloc(sizeof(*map_array) * (len + 2), GFP_KERNEL); 5067 map_array = kmalloc_array(len + 2, sizeof(*map_array), GFP_KERNEL);
5067 if (!map_array) { 5068 if (!map_array) {
5068 pr_warn("Unable to allocate trace eval mapping\n"); 5069 pr_warn("Unable to allocate trace eval mapping\n");
5069 return; 5070 return;
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 0171407d231f..e1c818dbc0d7 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -436,15 +436,15 @@ predicate_parse(const char *str, int nr_parens, int nr_preds,
436 436
437 nr_preds += 2; /* For TRUE and FALSE */ 437 nr_preds += 2; /* For TRUE and FALSE */
438 438
439 op_stack = kmalloc(sizeof(*op_stack) * nr_parens, GFP_KERNEL); 439 op_stack = kmalloc_array(nr_parens, sizeof(*op_stack), GFP_KERNEL);
440 if (!op_stack) 440 if (!op_stack)
441 return ERR_PTR(-ENOMEM); 441 return ERR_PTR(-ENOMEM);
442 prog_stack = kmalloc(sizeof(*prog_stack) * nr_preds, GFP_KERNEL); 442 prog_stack = kmalloc_array(nr_preds, sizeof(*prog_stack), GFP_KERNEL);
443 if (!prog_stack) { 443 if (!prog_stack) {
444 parse_error(pe, -ENOMEM, 0); 444 parse_error(pe, -ENOMEM, 0);
445 goto out_free; 445 goto out_free;
446 } 446 }
447 inverts = kmalloc(sizeof(*inverts) * nr_preds, GFP_KERNEL); 447 inverts = kmalloc_array(nr_preds, sizeof(*inverts), GFP_KERNEL);
448 if (!inverts) { 448 if (!inverts) {
449 parse_error(pe, -ENOMEM, 0); 449 parse_error(pe, -ENOMEM, 0);
450 goto out_free; 450 goto out_free;
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 492c255e6c5a..c3d7583fcd21 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -764,8 +764,9 @@ static int insert_extent(struct uid_gid_map *map, struct uid_gid_extent *extent)
764 struct uid_gid_extent *forward; 764 struct uid_gid_extent *forward;
765 765
766 /* Allocate memory for 340 mappings. */ 766 /* Allocate memory for 340 mappings. */
767 forward = kmalloc(sizeof(struct uid_gid_extent) * 767 forward = kmalloc_array(UID_GID_MAP_MAX_EXTENTS,
768 UID_GID_MAP_MAX_EXTENTS, GFP_KERNEL); 768 sizeof(struct uid_gid_extent),
769 GFP_KERNEL);
769 if (!forward) 770 if (!forward)
770 return -ENOMEM; 771 return -ENOMEM;
771 772
diff --git a/lib/argv_split.c b/lib/argv_split.c
index 5c35752a9414..1a19a0a93dc1 100644
--- a/lib/argv_split.c
+++ b/lib/argv_split.c
@@ -69,7 +69,7 @@ char **argv_split(gfp_t gfp, const char *str, int *argcp)
69 return NULL; 69 return NULL;
70 70
71 argc = count_argc(argv_str); 71 argc = count_argc(argv_str);
72 argv = kmalloc(sizeof(*argv) * (argc + 2), gfp); 72 argv = kmalloc_array(argc + 2, sizeof(*argv), gfp);
73 if (!argv) { 73 if (!argv) {
74 kfree(argv_str); 74 kfree(argv_str);
75 return NULL; 75 return NULL;
diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c
index 835242e74aaa..75509a1511a3 100644
--- a/lib/interval_tree_test.c
+++ b/lib/interval_tree_test.c
@@ -64,11 +64,12 @@ static int interval_tree_test_init(void)
64 unsigned long results; 64 unsigned long results;
65 cycles_t time1, time2, time; 65 cycles_t time1, time2, time;
66 66
67 nodes = kmalloc(nnodes * sizeof(struct interval_tree_node), GFP_KERNEL); 67 nodes = kmalloc_array(nnodes, sizeof(struct interval_tree_node),
68 GFP_KERNEL);
68 if (!nodes) 69 if (!nodes)
69 return -ENOMEM; 70 return -ENOMEM;
70 71
71 queries = kmalloc(nsearches * sizeof(int), GFP_KERNEL); 72 queries = kmalloc_array(nsearches, sizeof(int), GFP_KERNEL);
72 if (!queries) { 73 if (!queries) {
73 kfree(nodes); 74 kfree(nodes);
74 return -ENOMEM; 75 return -ENOMEM;
diff --git a/lib/kfifo.c b/lib/kfifo.c
index b0f757bf7213..015656aa8182 100644
--- a/lib/kfifo.c
+++ b/lib/kfifo.c
@@ -54,7 +54,7 @@ int __kfifo_alloc(struct __kfifo *fifo, unsigned int size,
54 return -EINVAL; 54 return -EINVAL;
55 } 55 }
56 56
57 fifo->data = kmalloc(size * esize, gfp_mask); 57 fifo->data = kmalloc_array(esize, size, gfp_mask);
58 58
59 if (!fifo->data) { 59 if (!fifo->data) {
60 fifo->mask = 0; 60 fifo->mask = 0;
diff --git a/lib/mpi/mpiutil.c b/lib/mpi/mpiutil.c
index 314f4dfa603e..2dbfc4c8a237 100644
--- a/lib/mpi/mpiutil.c
+++ b/lib/mpi/mpiutil.c
@@ -91,7 +91,7 @@ int mpi_resize(MPI a, unsigned nlimbs)
91 return 0; /* no need to do it */ 91 return 0; /* no need to do it */
92 92
93 if (a->d) { 93 if (a->d) {
94 p = kmalloc(nlimbs * sizeof(mpi_limb_t), GFP_KERNEL); 94 p = kmalloc_array(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL);
95 if (!p) 95 if (!p)
96 return -ENOMEM; 96 return -ENOMEM;
97 memcpy(p, a->d, a->alloced * sizeof(mpi_limb_t)); 97 memcpy(p, a->d, a->alloced * sizeof(mpi_limb_t));
diff --git a/lib/rbtree_test.c b/lib/rbtree_test.c
index 7d36c1e27ff6..b7055b2a07d3 100644
--- a/lib/rbtree_test.c
+++ b/lib/rbtree_test.c
@@ -247,7 +247,7 @@ static int __init rbtree_test_init(void)
247 cycles_t time1, time2, time; 247 cycles_t time1, time2, time;
248 struct rb_node *node; 248 struct rb_node *node;
249 249
250 nodes = kmalloc(nnodes * sizeof(*nodes), GFP_KERNEL); 250 nodes = kmalloc_array(nnodes, sizeof(*nodes), GFP_KERNEL);
251 if (!nodes) 251 if (!nodes)
252 return -ENOMEM; 252 return -ENOMEM;
253 253
diff --git a/lib/reed_solomon/reed_solomon.c b/lib/reed_solomon/reed_solomon.c
index dfcf54242fb9..d8bb1a1eba72 100644
--- a/lib/reed_solomon/reed_solomon.c
+++ b/lib/reed_solomon/reed_solomon.c
@@ -88,15 +88,15 @@ static struct rs_codec *codec_init(int symsize, int gfpoly, int (*gffunc)(int),
88 rs->gffunc = gffunc; 88 rs->gffunc = gffunc;
89 89
90 /* Allocate the arrays */ 90 /* Allocate the arrays */
91 rs->alpha_to = kmalloc(sizeof(uint16_t) * (rs->nn + 1), gfp); 91 rs->alpha_to = kmalloc_array(rs->nn + 1, sizeof(uint16_t), gfp);
92 if (rs->alpha_to == NULL) 92 if (rs->alpha_to == NULL)
93 goto err; 93 goto err;
94 94
95 rs->index_of = kmalloc(sizeof(uint16_t) * (rs->nn + 1), gfp); 95 rs->index_of = kmalloc_array(rs->nn + 1, sizeof(uint16_t), gfp);
96 if (rs->index_of == NULL) 96 if (rs->index_of == NULL)
97 goto err; 97 goto err;
98 98
99 rs->genpoly = kmalloc(sizeof(uint16_t) * (rs->nroots + 1), gfp); 99 rs->genpoly = kmalloc_array(rs->nroots + 1, sizeof(uint16_t), gfp);
100 if(rs->genpoly == NULL) 100 if(rs->genpoly == NULL)
101 goto err; 101 goto err;
102 102
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index 06dad7a072fd..1642fd507a96 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -170,7 +170,8 @@ static struct scatterlist *sg_kmalloc(unsigned int nents, gfp_t gfp_mask)
170 kmemleak_alloc(ptr, PAGE_SIZE, 1, gfp_mask); 170 kmemleak_alloc(ptr, PAGE_SIZE, 1, gfp_mask);
171 return ptr; 171 return ptr;
172 } else 172 } else
173 return kmalloc(nents * sizeof(struct scatterlist), gfp_mask); 173 return kmalloc_array(nents, sizeof(struct scatterlist),
174 gfp_mask);
174} 175}
175 176
176static void sg_kfree(struct scatterlist *sg, unsigned int nents) 177static void sg_kfree(struct scatterlist *sg, unsigned int nents)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index ba8fdc0b6e7f..1cd7c1a57a14 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1131,8 +1131,8 @@ static int do_huge_pmd_wp_page_fallback(struct vm_fault *vmf, pmd_t orig_pmd,
1131 unsigned long mmun_start; /* For mmu_notifiers */ 1131 unsigned long mmun_start; /* For mmu_notifiers */
1132 unsigned long mmun_end; /* For mmu_notifiers */ 1132 unsigned long mmun_end; /* For mmu_notifiers */
1133 1133
1134 pages = kmalloc(sizeof(struct page *) * HPAGE_PMD_NR, 1134 pages = kmalloc_array(HPAGE_PMD_NR, sizeof(struct page *),
1135 GFP_KERNEL); 1135 GFP_KERNEL);
1136 if (unlikely(!pages)) { 1136 if (unlikely(!pages)) {
1137 ret |= VM_FAULT_OOM; 1137 ret |= VM_FAULT_OOM;
1138 goto out; 1138 goto out;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 696befffe6f7..3612fbb32e9d 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2798,7 +2798,8 @@ static int __init hugetlb_init(void)
2798 num_fault_mutexes = 1; 2798 num_fault_mutexes = 1;
2799#endif 2799#endif
2800 hugetlb_fault_mutex_table = 2800 hugetlb_fault_mutex_table =
2801 kmalloc(sizeof(struct mutex) * num_fault_mutexes, GFP_KERNEL); 2801 kmalloc_array(num_fault_mutexes, sizeof(struct mutex),
2802 GFP_KERNEL);
2802 BUG_ON(!hugetlb_fault_mutex_table); 2803 BUG_ON(!hugetlb_fault_mutex_table);
2803 2804
2804 for (i = 0; i < num_fault_mutexes; i++) 2805 for (i = 0; i < num_fault_mutexes; i++)
diff --git a/mm/slub.c b/mm/slub.c
index 15505479c3ab..faf5dcb7b44f 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -4412,8 +4412,9 @@ static long validate_slab_cache(struct kmem_cache *s)
4412{ 4412{
4413 int node; 4413 int node;
4414 unsigned long count = 0; 4414 unsigned long count = 0;
4415 unsigned long *map = kmalloc(BITS_TO_LONGS(oo_objects(s->max)) * 4415 unsigned long *map = kmalloc_array(BITS_TO_LONGS(oo_objects(s->max)),
4416 sizeof(unsigned long), GFP_KERNEL); 4416 sizeof(unsigned long),
4417 GFP_KERNEL);
4417 struct kmem_cache_node *n; 4418 struct kmem_cache_node *n;
4418 4419
4419 if (!map) 4420 if (!map)
@@ -4573,8 +4574,9 @@ static int list_locations(struct kmem_cache *s, char *buf,
4573 unsigned long i; 4574 unsigned long i;
4574 struct loc_track t = { 0, 0, NULL }; 4575 struct loc_track t = { 0, 0, NULL };
4575 int node; 4576 int node;
4576 unsigned long *map = kmalloc(BITS_TO_LONGS(oo_objects(s->max)) * 4577 unsigned long *map = kmalloc_array(BITS_TO_LONGS(oo_objects(s->max)),
4577 sizeof(unsigned long), GFP_KERNEL); 4578 sizeof(unsigned long),
4579 GFP_KERNEL);
4578 struct kmem_cache_node *n; 4580 struct kmem_cache_node *n;
4579 4581
4580 if (!map || !alloc_loc_track(&t, PAGE_SIZE / sizeof(struct location), 4582 if (!map || !alloc_loc_track(&t, PAGE_SIZE / sizeof(struct location),
@@ -5293,7 +5295,7 @@ static int show_stat(struct kmem_cache *s, char *buf, enum stat_item si)
5293 unsigned long sum = 0; 5295 unsigned long sum = 0;
5294 int cpu; 5296 int cpu;
5295 int len; 5297 int len;
5296 int *data = kmalloc(nr_cpu_ids * sizeof(int), GFP_KERNEL); 5298 int *data = kmalloc_array(nr_cpu_ids, sizeof(int), GFP_KERNEL);
5297 5299
5298 if (!data) 5300 if (!data)
5299 return -ENOMEM; 5301 return -ENOMEM;
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 16e10680518c..931ea00c4fed 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -242,8 +242,9 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
242 "w", nwname); 242 "w", nwname);
243 if (!errcode) { 243 if (!errcode) {
244 *wnames = 244 *wnames =
245 kmalloc(sizeof(char *) * *nwname, 245 kmalloc_array(*nwname,
246 GFP_NOFS); 246 sizeof(char *),
247 GFP_NOFS);
247 if (!*wnames) 248 if (!*wnames)
248 errcode = -ENOMEM; 249 errcode = -ENOMEM;
249 } 250 }
@@ -285,9 +286,9 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
285 p9pdu_readf(pdu, proto_version, "w", nwqid); 286 p9pdu_readf(pdu, proto_version, "w", nwqid);
286 if (!errcode) { 287 if (!errcode) {
287 *wqids = 288 *wqids =
288 kmalloc(*nwqid * 289 kmalloc_array(*nwqid,
289 sizeof(struct p9_qid), 290 sizeof(struct p9_qid),
290 GFP_NOFS); 291 GFP_NOFS);
291 if (*wqids == NULL) 292 if (*wqids == NULL)
292 errcode = -ENOMEM; 293 errcode = -ENOMEM;
293 } 294 }
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 4d0372263e5d..05006cbb3361 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -360,7 +360,8 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
360 nr_pages = DIV_ROUND_UP((unsigned long)p + len, PAGE_SIZE) - 360 nr_pages = DIV_ROUND_UP((unsigned long)p + len, PAGE_SIZE) -
361 (unsigned long)p / PAGE_SIZE; 361 (unsigned long)p / PAGE_SIZE;
362 362
363 *pages = kmalloc(sizeof(struct page *) * nr_pages, GFP_NOFS); 363 *pages = kmalloc_array(nr_pages, sizeof(struct page *),
364 GFP_NOFS);
364 if (!*pages) 365 if (!*pages)
365 return -ENOMEM; 366 return -ENOMEM;
366 367
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 31e0dcb970f8..75620c2f2617 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -472,7 +472,7 @@ static const uint8_t *copy_macs(struct mpoa_client *mpc,
472 if (mpc->number_of_mps_macs != 0) 472 if (mpc->number_of_mps_macs != 0)
473 kfree(mpc->mps_macs); 473 kfree(mpc->mps_macs);
474 mpc->number_of_mps_macs = 0; 474 mpc->number_of_mps_macs = 0;
475 mpc->mps_macs = kmalloc(num_macs * ETH_ALEN, GFP_KERNEL); 475 mpc->mps_macs = kmalloc_array(ETH_ALEN, num_macs, GFP_KERNEL);
476 if (mpc->mps_macs == NULL) { 476 if (mpc->mps_macs == NULL) {
477 pr_info("(%s) out of mem\n", mpc->dev->name); 477 pr_info("(%s) out of mem\n", mpc->dev->name);
478 return NULL; 478 return NULL;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 1dec33790198..ee8ef1228263 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1281,7 +1281,7 @@ int hci_inquiry(void __user *arg)
1281 /* cache_dump can't sleep. Therefore we allocate temp buffer and then 1281 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1282 * copy it to the user space. 1282 * copy it to the user space.
1283 */ 1283 */
1284 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL); 1284 buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
1285 if (!buf) { 1285 if (!buf) {
1286 err = -ENOMEM; 1286 err = -ENOMEM;
1287 goto done; 1287 goto done;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9b7907ebfa01..d17a4736e47c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -331,7 +331,7 @@ static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
331 */ 331 */
332 alloc_size = roundup_pow_of_two(size); 332 alloc_size = roundup_pow_of_two(size);
333 333
334 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL); 334 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
335 if (!seq_list->list) 335 if (!seq_list->list)
336 return -ENOMEM; 336 return -ENOMEM;
337 337
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 97fedff3f0c4..394ff1d2791f 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -923,8 +923,9 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
923 923
924 /* create array for CAN frames and copy the data */ 924 /* create array for CAN frames and copy the data */
925 if (msg_head->nframes > 1) { 925 if (msg_head->nframes > 1) {
926 op->frames = kmalloc(msg_head->nframes * op->cfsiz, 926 op->frames = kmalloc_array(msg_head->nframes,
927 GFP_KERNEL); 927 op->cfsiz,
928 GFP_KERNEL);
928 if (!op->frames) { 929 if (!op->frames) {
929 kfree(op); 930 kfree(op);
930 return -ENOMEM; 931 return -ENOMEM;
@@ -1095,8 +1096,9 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
1095 1096
1096 if (msg_head->nframes > 1) { 1097 if (msg_head->nframes > 1) {
1097 /* create array for CAN frames and copy the data */ 1098 /* create array for CAN frames and copy the data */
1098 op->frames = kmalloc(msg_head->nframes * op->cfsiz, 1099 op->frames = kmalloc_array(msg_head->nframes,
1099 GFP_KERNEL); 1100 op->cfsiz,
1101 GFP_KERNEL);
1100 if (!op->frames) { 1102 if (!op->frames) {
1101 kfree(op); 1103 kfree(op);
1102 return -ENOMEM; 1104 return -ENOMEM;
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 9645ffd6acfb..e22820e24f50 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1299,8 +1299,9 @@ static int set_primary_affinity(struct ceph_osdmap *map, int osd, u32 aff)
1299 if (!map->osd_primary_affinity) { 1299 if (!map->osd_primary_affinity) {
1300 int i; 1300 int i;
1301 1301
1302 map->osd_primary_affinity = kmalloc(map->max_osd*sizeof(u32), 1302 map->osd_primary_affinity = kmalloc_array(map->max_osd,
1303 GFP_NOFS); 1303 sizeof(u32),
1304 GFP_NOFS);
1304 if (!map->osd_primary_affinity) 1305 if (!map->osd_primary_affinity)
1305 return -ENOMEM; 1306 return -ENOMEM;
1306 1307
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
index a3d0adc828e6..e560d3975f41 100644
--- a/net/ceph/pagevec.c
+++ b/net/ceph/pagevec.c
@@ -20,7 +20,7 @@ struct page **ceph_get_direct_page_vector(const void __user *data,
20 int got = 0; 20 int got = 0;
21 int rc = 0; 21 int rc = 0;
22 22
23 pages = kmalloc(sizeof(*pages) * num_pages, GFP_NOFS); 23 pages = kmalloc_array(num_pages, sizeof(*pages), GFP_NOFS);
24 if (!pages) 24 if (!pages)
25 return ERR_PTR(-ENOMEM); 25 return ERR_PTR(-ENOMEM);
26 26
@@ -74,7 +74,7 @@ struct page **ceph_alloc_page_vector(int num_pages, gfp_t flags)
74 struct page **pages; 74 struct page **pages;
75 int i; 75 int i;
76 76
77 pages = kmalloc(sizeof(*pages) * num_pages, flags); 77 pages = kmalloc_array(num_pages, sizeof(*pages), flags);
78 if (!pages) 78 if (!pages)
79 return ERR_PTR(-ENOMEM); 79 return ERR_PTR(-ENOMEM);
80 for (i = 0; i < num_pages; i++) { 80 for (i = 0; i < num_pages; i++) {
diff --git a/net/core/dev.c b/net/core/dev.c
index 6e18242a1cae..57b7bab5f70b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8823,7 +8823,7 @@ static struct hlist_head * __net_init netdev_create_hash(void)
8823 int i; 8823 int i;
8824 struct hlist_head *hash; 8824 struct hlist_head *hash;
8825 8825
8826 hash = kmalloc(sizeof(*hash) * NETDEV_HASHENTRIES, GFP_KERNEL); 8826 hash = kmalloc_array(NETDEV_HASHENTRIES, sizeof(*hash), GFP_KERNEL);
8827 if (hash != NULL) 8827 if (hash != NULL)
8828 for (i = 0; i < NETDEV_HASHENTRIES; i++) 8828 for (i = 0; i < NETDEV_HASHENTRIES; i++)
8829 INIT_HLIST_HEAD(&hash[i]); 8829 INIT_HLIST_HEAD(&hash[i]);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index c15075dc7572..436e4f9cc7f0 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1816,7 +1816,7 @@ static int ethtool_self_test(struct net_device *dev, char __user *useraddr)
1816 return -EFAULT; 1816 return -EFAULT;
1817 1817
1818 test.len = test_len; 1818 test.len = test_len;
1819 data = kmalloc(test_len * sizeof(u64), GFP_USER); 1819 data = kmalloc_array(test_len, sizeof(u64), GFP_USER);
1820 if (!data) 1820 if (!data)
1821 return -ENOMEM; 1821 return -ENOMEM;
1822 1822
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index d2f4e0c1faaf..2589a6b78aa1 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -984,7 +984,8 @@ static int dcbnl_build_peer_app(struct net_device *netdev, struct sk_buff* skb,
984 */ 984 */
985 err = ops->peer_getappinfo(netdev, &info, &app_count); 985 err = ops->peer_getappinfo(netdev, &info, &app_count);
986 if (!err && app_count) { 986 if (!err && app_count) {
987 table = kmalloc(sizeof(struct dcb_app) * app_count, GFP_KERNEL); 987 table = kmalloc_array(app_count, sizeof(struct dcb_app),
988 GFP_KERNEL);
988 if (!table) 989 if (!table)
989 return -ENOMEM; 990 return -ENOMEM;
990 991
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 385f153fe031..2b75df469220 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -46,7 +46,8 @@ static int ccid2_hc_tx_alloc_seq(struct ccid2_hc_tx_sock *hc)
46 return -ENOMEM; 46 return -ENOMEM;
47 47
48 /* allocate buffer and initialize linked list */ 48 /* allocate buffer and initialize linked list */
49 seqp = kmalloc(CCID2_SEQBUF_LEN * sizeof(struct ccid2_seq), gfp_any()); 49 seqp = kmalloc_array(CCID2_SEQBUF_LEN, sizeof(struct ccid2_seq),
50 gfp_any());
50 if (seqp == NULL) 51 if (seqp == NULL)
51 return -ENOMEM; 52 return -ENOMEM;
52 53
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index bf4e4adc2d00..6bcd1eacc1f0 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3146,7 +3146,8 @@ int __init ip_rt_init(void)
3146{ 3146{
3147 int cpu; 3147 int cpu;
3148 3148
3149 ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL); 3149 ip_idents = kmalloc_array(IP_IDENTS_SZ, sizeof(*ip_idents),
3150 GFP_KERNEL);
3150 if (!ip_idents) 3151 if (!ip_idents)
3151 panic("IP: failed to allocate ip_idents\n"); 3152 panic("IP: failed to allocate ip_idents\n");
3152 3153
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 4d2e797e3f16..fb1b1f9e7e5e 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -772,7 +772,7 @@ static int ieee80211_init_cipher_suites(struct ieee80211_local *local)
772 if (have_mfp) 772 if (have_mfp)
773 n_suites += 4; 773 n_suites += 4;
774 774
775 suites = kmalloc(sizeof(u32) * n_suites, GFP_KERNEL); 775 suites = kmalloc_array(n_suites, sizeof(u32), GFP_KERNEL);
776 if (!suites) 776 if (!suites)
777 return -ENOMEM; 777 return -ENOMEM;
778 778
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 8221bc5582ab..7fadfbca9f1b 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -596,7 +596,7 @@ minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
596 if (!mi->r) 596 if (!mi->r)
597 goto error; 597 goto error;
598 598
599 mi->sample_table = kmalloc(SAMPLE_COLUMNS * max_rates, gfp); 599 mi->sample_table = kmalloc_array(max_rates, SAMPLE_COLUMNS, gfp);
600 if (!mi->sample_table) 600 if (!mi->sample_table)
601 goto error1; 601 goto error1;
602 602
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index fb586b6e5d49..267ab9d5137e 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -1317,7 +1317,7 @@ minstrel_ht_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
1317 if (!msp->ratelist) 1317 if (!msp->ratelist)
1318 goto error; 1318 goto error;
1319 1319
1320 msp->sample_table = kmalloc(SAMPLE_COLUMNS * max_rates, gfp); 1320 msp->sample_table = kmalloc_array(max_rates, SAMPLE_COLUMNS, gfp);
1321 if (!msp->sample_table) 1321 if (!msp->sample_table)
1322 goto error1; 1322 goto error1;
1323 1323
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index afdeca53e88b..d88841fbc560 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -402,7 +402,8 @@ int nf_ct_l4proto_register_one(const struct nf_conntrack_l4proto *l4proto)
402 struct nf_conntrack_l4proto __rcu **proto_array; 402 struct nf_conntrack_l4proto __rcu **proto_array;
403 int i; 403 int i;
404 404
405 proto_array = kmalloc(MAX_NF_CT_PROTO * 405 proto_array =
406 kmalloc_array(MAX_NF_CT_PROTO,
406 sizeof(struct nf_conntrack_l4proto *), 407 sizeof(struct nf_conntrack_l4proto *),
407 GFP_KERNEL); 408 GFP_KERNEL);
408 if (proto_array == NULL) { 409 if (proto_array == NULL) {
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index b7df32a56e7e..46f9df99d276 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -691,8 +691,9 @@ int nf_nat_l4proto_register(u8 l3proto, const struct nf_nat_l4proto *l4proto)
691 691
692 mutex_lock(&nf_nat_proto_mutex); 692 mutex_lock(&nf_nat_proto_mutex);
693 if (nf_nat_l4protos[l3proto] == NULL) { 693 if (nf_nat_l4protos[l3proto] == NULL) {
694 l4protos = kmalloc(IPPROTO_MAX * sizeof(struct nf_nat_l4proto *), 694 l4protos = kmalloc_array(IPPROTO_MAX,
695 GFP_KERNEL); 695 sizeof(struct nf_nat_l4proto *),
696 GFP_KERNEL);
696 if (l4protos == NULL) { 697 if (l4protos == NULL) {
697 ret = -ENOMEM; 698 ret = -ENOMEM;
698 goto out; 699 goto out;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ca4c4d994ddb..cae4a026859d 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -7164,8 +7164,8 @@ static int __init nf_tables_module_init(void)
7164 7164
7165 nft_chain_filter_init(); 7165 nft_chain_filter_init();
7166 7166
7167 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS, 7167 info = kmalloc_array(NFT_RULE_MAXEXPRS, sizeof(struct nft_expr_info),
7168 GFP_KERNEL); 7168 GFP_KERNEL);
7169 if (info == NULL) { 7169 if (info == NULL) {
7170 err = -ENOMEM; 7170 err = -ENOMEM;
7171 goto err1; 7171 goto err1;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index df9ab71b0ed9..d0d8397c9588 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1904,7 +1904,7 @@ static int __init xt_init(void)
1904 seqcount_init(&per_cpu(xt_recseq, i)); 1904 seqcount_init(&per_cpu(xt_recseq, i));
1905 } 1905 }
1906 1906
1907 xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL); 1907 xt = kmalloc_array(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
1908 if (!xt) 1908 if (!xt)
1909 return -ENOMEM; 1909 return -ENOMEM;
1910 1910
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index b9ce82c9440f..25eeb6d2a75a 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -352,8 +352,9 @@ int genl_register_family(struct genl_family *family)
352 } 352 }
353 353
354 if (family->maxattr && !family->parallel_ops) { 354 if (family->maxattr && !family->parallel_ops) {
355 family->attrbuf = kmalloc((family->maxattr+1) * 355 family->attrbuf = kmalloc_array(family->maxattr + 1,
356 sizeof(struct nlattr *), GFP_KERNEL); 356 sizeof(struct nlattr *),
357 GFP_KERNEL);
357 if (family->attrbuf == NULL) { 358 if (family->attrbuf == NULL) {
358 err = -ENOMEM; 359 err = -ENOMEM;
359 goto errout_locked; 360 goto errout_locked;
@@ -566,8 +567,9 @@ static int genl_family_rcv_msg(const struct genl_family *family,
566 return -EOPNOTSUPP; 567 return -EOPNOTSUPP;
567 568
568 if (family->maxattr && family->parallel_ops) { 569 if (family->maxattr && family->parallel_ops) {
569 attrbuf = kmalloc((family->maxattr+1) * 570 attrbuf = kmalloc_array(family->maxattr + 1,
570 sizeof(struct nlattr *), GFP_KERNEL); 571 sizeof(struct nlattr *),
572 GFP_KERNEL);
571 if (attrbuf == NULL) 573 if (attrbuf == NULL)
572 return -ENOMEM; 574 return -ENOMEM;
573 } else 575 } else
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index a61818e94396..0f5ce77460d4 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1578,8 +1578,9 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
1578 goto err_destroy_table; 1578 goto err_destroy_table;
1579 } 1579 }
1580 1580
1581 dp->ports = kmalloc(DP_VPORT_HASH_BUCKETS * sizeof(struct hlist_head), 1581 dp->ports = kmalloc_array(DP_VPORT_HASH_BUCKETS,
1582 GFP_KERNEL); 1582 sizeof(struct hlist_head),
1583 GFP_KERNEL);
1583 if (!dp->ports) { 1584 if (!dp->ports) {
1584 err = -ENOMEM; 1585 err = -ENOMEM;
1585 goto err_destroy_percpu; 1586 goto err_destroy_percpu;
diff --git a/net/rds/info.c b/net/rds/info.c
index 140a44a5f7b7..e367a97a18c8 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -188,7 +188,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
188 nr_pages = (PAGE_ALIGN(start + len) - (start & PAGE_MASK)) 188 nr_pages = (PAGE_ALIGN(start + len) - (start & PAGE_MASK))
189 >> PAGE_SHIFT; 189 >> PAGE_SHIFT;
190 190
191 pages = kmalloc(nr_pages * sizeof(struct page *), GFP_KERNEL); 191 pages = kmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL);
192 if (!pages) { 192 if (!pages) {
193 ret = -ENOMEM; 193 ret = -ENOMEM;
194 goto out; 194 goto out;
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 6c0ae27fff84..278ac0807a60 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -432,7 +432,7 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
432 432
433 sg = _sg; 433 sg = _sg;
434 if (unlikely(nsg > 4)) { 434 if (unlikely(nsg > 4)) {
435 sg = kmalloc(sizeof(*sg) * nsg, GFP_NOIO); 435 sg = kmalloc_array(nsg, sizeof(*sg), GFP_NOIO);
436 if (!sg) 436 if (!sg)
437 goto nomem; 437 goto nomem;
438 } 438 }
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 11d93377ba5e..5dffbc493008 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1438,7 +1438,7 @@ static __init int sctp_init(void)
1438 /* Allocate and initialize the endpoint hash table. */ 1438 /* Allocate and initialize the endpoint hash table. */
1439 sctp_ep_hashsize = 64; 1439 sctp_ep_hashsize = 64;
1440 sctp_ep_hashtable = 1440 sctp_ep_hashtable =
1441 kmalloc(64 * sizeof(struct sctp_hashbucket), GFP_KERNEL); 1441 kmalloc_array(64, sizeof(struct sctp_hashbucket), GFP_KERNEL);
1442 if (!sctp_ep_hashtable) { 1442 if (!sctp_ep_hashtable) {
1443 pr_err("Failed endpoint_hash alloc\n"); 1443 pr_err("Failed endpoint_hash alloc\n");
1444 status = -ENOMEM; 1444 status = -ENOMEM;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 9463af4b32e8..be8f103d22fd 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1753,7 +1753,8 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
1753 last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT; 1753 last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT;
1754 rqstp->rq_enc_pages_num = last - first + 1 + 1; 1754 rqstp->rq_enc_pages_num = last - first + 1 + 1;
1755 rqstp->rq_enc_pages 1755 rqstp->rq_enc_pages
1756 = kmalloc(rqstp->rq_enc_pages_num * sizeof(struct page *), 1756 = kmalloc_array(rqstp->rq_enc_pages_num,
1757 sizeof(struct page *),
1757 GFP_NOFS); 1758 GFP_NOFS);
1758 if (!rqstp->rq_enc_pages) 1759 if (!rqstp->rq_enc_pages)
1759 goto out; 1760 goto out;
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 4492cda45566..a2f76743c73a 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -285,8 +285,9 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
285 if (!trans_buf) 285 if (!trans_buf)
286 return -ENOMEM; 286 return -ENOMEM;
287 287
288 attrbuf = kmalloc((tipc_genl_family.maxattr + 1) * 288 attrbuf = kmalloc_array(tipc_genl_family.maxattr + 1,
289 sizeof(struct nlattr *), GFP_KERNEL); 289 sizeof(struct nlattr *),
290 GFP_KERNEL);
290 if (!attrbuf) { 291 if (!attrbuf) {
291 err = -ENOMEM; 292 err = -ENOMEM;
292 goto trans_out; 293 goto trans_out;
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 423776682025..b69d3b1777c2 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1148,7 +1148,7 @@ static long trusted_read(const struct key *key, char __user *buffer,
1148 return -EINVAL; 1148 return -EINVAL;
1149 1149
1150 if (buffer && buflen >= 2 * p->blob_len) { 1150 if (buffer && buflen >= 2 * p->blob_len) {
1151 ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL); 1151 ascii_buf = kmalloc_array(2, p->blob_len, GFP_KERNEL);
1152 if (!ascii_buf) 1152 if (!ascii_buf)
1153 return -ENOMEM; 1153 return -ENOMEM;
1154 1154
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index 39d853bfa5ac..946ab080ac00 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -426,7 +426,7 @@ static int snd_pcm_ioctl_xfern_compat(struct snd_pcm_substream *substream,
426 get_user(frames, &data32->frames)) 426 get_user(frames, &data32->frames))
427 return -EFAULT; 427 return -EFAULT;
428 bufptr = compat_ptr(buf); 428 bufptr = compat_ptr(buf);
429 bufs = kmalloc(sizeof(void __user *) * ch, GFP_KERNEL); 429 bufs = kmalloc_array(ch, sizeof(void __user *), GFP_KERNEL);
430 if (bufs == NULL) 430 if (bufs == NULL)
431 return -ENOMEM; 431 return -ENOMEM;
432 for (i = 0; i < ch; i++) { 432 for (i = 0; i < ch; i++) {
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 04c6301394d0..cecc79772c94 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3072,7 +3072,7 @@ static ssize_t snd_pcm_readv(struct kiocb *iocb, struct iov_iter *to)
3072 if (!frame_aligned(runtime, to->iov->iov_len)) 3072 if (!frame_aligned(runtime, to->iov->iov_len))
3073 return -EINVAL; 3073 return -EINVAL;
3074 frames = bytes_to_samples(runtime, to->iov->iov_len); 3074 frames = bytes_to_samples(runtime, to->iov->iov_len);
3075 bufs = kmalloc(sizeof(void *) * to->nr_segs, GFP_KERNEL); 3075 bufs = kmalloc_array(to->nr_segs, sizeof(void *), GFP_KERNEL);
3076 if (bufs == NULL) 3076 if (bufs == NULL)
3077 return -ENOMEM; 3077 return -ENOMEM;
3078 for (i = 0; i < to->nr_segs; ++i) 3078 for (i = 0; i < to->nr_segs; ++i)
@@ -3107,7 +3107,7 @@ static ssize_t snd_pcm_writev(struct kiocb *iocb, struct iov_iter *from)
3107 !frame_aligned(runtime, from->iov->iov_len)) 3107 !frame_aligned(runtime, from->iov->iov_len))
3108 return -EINVAL; 3108 return -EINVAL;
3109 frames = bytes_to_samples(runtime, from->iov->iov_len); 3109 frames = bytes_to_samples(runtime, from->iov->iov_len);
3110 bufs = kmalloc(sizeof(void *) * from->nr_segs, GFP_KERNEL); 3110 bufs = kmalloc_array(from->nr_segs, sizeof(void *), GFP_KERNEL);
3111 if (bufs == NULL) 3111 if (bufs == NULL)
3112 return -ENOMEM; 3112 return -ENOMEM;
3113 for (i = 0; i < from->nr_segs; ++i) 3113 for (i = 0; i < from->nr_segs; ++i)
diff --git a/sound/core/seq/seq_midi_emul.c b/sound/core/seq/seq_midi_emul.c
index 9e2912e3e80f..288f839a554b 100644
--- a/sound/core/seq/seq_midi_emul.c
+++ b/sound/core/seq/seq_midi_emul.c
@@ -657,7 +657,7 @@ static struct snd_midi_channel *snd_midi_channel_init_set(int n)
657 struct snd_midi_channel *chan; 657 struct snd_midi_channel *chan;
658 int i; 658 int i;
659 659
660 chan = kmalloc(n * sizeof(struct snd_midi_channel), GFP_KERNEL); 660 chan = kmalloc_array(n, sizeof(struct snd_midi_channel), GFP_KERNEL);
661 if (chan) { 661 if (chan) {
662 for (i = 0; i < n; i++) 662 for (i = 0; i < n; i++)
663 snd_midi_channel_init(chan+i, i); 663 snd_midi_channel_init(chan+i, i);
diff --git a/sound/firewire/packets-buffer.c b/sound/firewire/packets-buffer.c
index ea1506679c66..1ebf00c83409 100644
--- a/sound/firewire/packets-buffer.c
+++ b/sound/firewire/packets-buffer.c
@@ -27,7 +27,7 @@ int iso_packets_buffer_init(struct iso_packets_buffer *b, struct fw_unit *unit,
27 void *p; 27 void *p;
28 int err; 28 int err;
29 29
30 b->packets = kmalloc(count * sizeof(*b->packets), GFP_KERNEL); 30 b->packets = kmalloc_array(count, sizeof(*b->packets), GFP_KERNEL);
31 if (!b->packets) { 31 if (!b->packets) {
32 err = -ENOMEM; 32 err = -ENOMEM;
33 goto error; 33 goto error;
diff --git a/sound/oss/dmasound/dmasound_core.c b/sound/oss/dmasound/dmasound_core.c
index 8c0f8a9ee0ba..fc9bcd47d6a4 100644
--- a/sound/oss/dmasound/dmasound_core.c
+++ b/sound/oss/dmasound/dmasound_core.c
@@ -420,7 +420,7 @@ static int sq_allocate_buffers(struct sound_queue *sq, int num, int size)
420 return 0; 420 return 0;
421 sq->numBufs = num; 421 sq->numBufs = num;
422 sq->bufSize = size; 422 sq->bufSize = size;
423 sq->buffers = kmalloc (num * sizeof(char *), GFP_KERNEL); 423 sq->buffers = kmalloc_array (num, sizeof(char *), GFP_KERNEL);
424 if (!sq->buffers) 424 if (!sq->buffers)
425 return -ENOMEM; 425 return -ENOMEM;
426 for (i = 0; i < num; i++) { 426 for (i = 0; i < num; i++) {
diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c
index ed1251c5f449..146e1a3498c7 100644
--- a/sound/pci/cs46xx/cs46xx_lib.c
+++ b/sound/pci/cs46xx/cs46xx_lib.c
@@ -460,7 +460,7 @@ static int load_firmware(struct snd_cs46xx *chip,
460 entry->size = le32_to_cpu(fwdat[fwlen++]); 460 entry->size = le32_to_cpu(fwdat[fwlen++]);
461 if (fwlen + entry->size > fwsize) 461 if (fwlen + entry->size > fwsize)
462 goto error_inval; 462 goto error_inval;
463 entry->data = kmalloc(entry->size * 4, GFP_KERNEL); 463 entry->data = kmalloc_array(entry->size, 4, GFP_KERNEL);
464 if (!entry->data) 464 if (!entry->data)
465 goto error; 465 goto error;
466 memcpy_le32(entry->data, &fwdat[fwlen], entry->size * 4); 466 memcpy_le32(entry->data, &fwdat[fwlen], entry->size * 4);
@@ -4036,8 +4036,9 @@ int snd_cs46xx_create(struct snd_card *card,
4036 snd_cs46xx_proc_init(card, chip); 4036 snd_cs46xx_proc_init(card, chip);
4037 4037
4038#ifdef CONFIG_PM_SLEEP 4038#ifdef CONFIG_PM_SLEEP
4039 chip->saved_regs = kmalloc(sizeof(*chip->saved_regs) * 4039 chip->saved_regs = kmalloc_array(ARRAY_SIZE(saved_regs),
4040 ARRAY_SIZE(saved_regs), GFP_KERNEL); 4040 sizeof(*chip->saved_regs),
4041 GFP_KERNEL);
4041 if (!chip->saved_regs) { 4042 if (!chip->saved_regs) {
4042 snd_cs46xx_free(chip); 4043 snd_cs46xx_free(chip);
4043 return -ENOMEM; 4044 return -ENOMEM;
diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c
index c44eadef64ae..99d5a02f9169 100644
--- a/sound/pci/cs46xx/dsp_spos.c
+++ b/sound/pci/cs46xx/dsp_spos.c
@@ -243,7 +243,9 @@ struct dsp_spos_instance *cs46xx_dsp_spos_create (struct snd_cs46xx * chip)
243 ins->symbol_table.symbols = vmalloc(sizeof(struct dsp_symbol_entry) * 243 ins->symbol_table.symbols = vmalloc(sizeof(struct dsp_symbol_entry) *
244 DSP_MAX_SYMBOLS); 244 DSP_MAX_SYMBOLS);
245 ins->code.data = kmalloc(DSP_CODE_BYTE_SIZE, GFP_KERNEL); 245 ins->code.data = kmalloc(DSP_CODE_BYTE_SIZE, GFP_KERNEL);
246 ins->modules = kmalloc(sizeof(struct dsp_module_desc) * DSP_MAX_MODULES, GFP_KERNEL); 246 ins->modules = kmalloc_array(DSP_MAX_MODULES,
247 sizeof(struct dsp_module_desc),
248 GFP_KERNEL);
247 if (!ins->symbol_table.symbols || !ins->code.data || !ins->modules) { 249 if (!ins->symbol_table.symbols || !ins->code.data || !ins->modules) {
248 cs46xx_dsp_spos_destroy(chip); 250 cs46xx_dsp_spos_destroy(chip);
249 goto error; 251 goto error;
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index b45a01bb73e5..af1085d946ec 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -2683,12 +2683,12 @@ int snd_emu10k1_efx_alloc_pm_buffer(struct snd_emu10k1 *emu)
2683 int len; 2683 int len;
2684 2684
2685 len = emu->audigy ? 0x200 : 0x100; 2685 len = emu->audigy ? 0x200 : 0x100;
2686 emu->saved_gpr = kmalloc(len * 4, GFP_KERNEL); 2686 emu->saved_gpr = kmalloc_array(len, 4, GFP_KERNEL);
2687 if (! emu->saved_gpr) 2687 if (! emu->saved_gpr)
2688 return -ENOMEM; 2688 return -ENOMEM;
2689 len = emu->audigy ? 0x100 : 0xa0; 2689 len = emu->audigy ? 0x100 : 0xa0;
2690 emu->tram_val_saved = kmalloc(len * 4, GFP_KERNEL); 2690 emu->tram_val_saved = kmalloc_array(len, 4, GFP_KERNEL);
2691 emu->tram_addr_saved = kmalloc(len * 4, GFP_KERNEL); 2691 emu->tram_addr_saved = kmalloc_array(len, 4, GFP_KERNEL);
2692 if (! emu->tram_val_saved || ! emu->tram_addr_saved) 2692 if (! emu->tram_val_saved || ! emu->tram_addr_saved)
2693 return -ENOMEM; 2693 return -ENOMEM;
2694 len = emu->audigy ? 2 * 1024 : 2 * 512; 2694 len = emu->audigy ? 2 * 1024 : 2 * 512;
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 08151f3c0b13..d91c87e41756 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -158,7 +158,7 @@ static int read_and_add_raw_conns(struct hda_codec *codec, hda_nid_t nid)
158 len = snd_hda_get_raw_connections(codec, nid, list, ARRAY_SIZE(list)); 158 len = snd_hda_get_raw_connections(codec, nid, list, ARRAY_SIZE(list));
159 if (len == -ENOSPC) { 159 if (len == -ENOSPC) {
160 len = snd_hda_get_num_raw_conns(codec, nid); 160 len = snd_hda_get_num_raw_conns(codec, nid);
161 result = kmalloc(sizeof(hda_nid_t) * len, GFP_KERNEL); 161 result = kmalloc_array(len, sizeof(hda_nid_t), GFP_KERNEL);
162 if (!result) 162 if (!result)
163 return -ENOMEM; 163 return -ENOMEM;
164 len = snd_hda_get_raw_connections(codec, nid, result, len); 164 len = snd_hda_get_raw_connections(codec, nid, result, len);
@@ -438,7 +438,7 @@ static int read_widget_caps(struct hda_codec *codec, hda_nid_t fg_node)
438 int i; 438 int i;
439 hda_nid_t nid; 439 hda_nid_t nid;
440 440
441 codec->wcaps = kmalloc(codec->core.num_nodes * 4, GFP_KERNEL); 441 codec->wcaps = kmalloc_array(codec->core.num_nodes, 4, GFP_KERNEL);
442 if (!codec->wcaps) 442 if (!codec->wcaps)
443 return -ENOMEM; 443 return -ENOMEM;
444 nid = codec->core.start_nid; 444 nid = codec->core.start_nid;
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
index 033aa84365b9..c6b778b2580c 100644
--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -825,8 +825,9 @@ static void print_codec_info(struct snd_info_entry *entry,
825 if (wid_caps & AC_WCAP_CONN_LIST) { 825 if (wid_caps & AC_WCAP_CONN_LIST) {
826 conn_len = snd_hda_get_num_raw_conns(codec, nid); 826 conn_len = snd_hda_get_num_raw_conns(codec, nid);
827 if (conn_len > 0) { 827 if (conn_len > 0) {
828 conn = kmalloc(sizeof(hda_nid_t) * conn_len, 828 conn = kmalloc_array(conn_len,
829 GFP_KERNEL); 829 sizeof(hda_nid_t),
830 GFP_KERNEL);
830 if (!conn) 831 if (!conn)
831 return; 832 return;
832 if (snd_hda_get_raw_connections(codec, nid, conn, 833 if (snd_hda_get_raw_connections(codec, nid, conn,
diff --git a/sound/pci/via82xx.c b/sound/pci/via82xx.c
index 3a1c0b8b4ea2..c488c5afa195 100644
--- a/sound/pci/via82xx.c
+++ b/sound/pci/via82xx.c
@@ -439,7 +439,9 @@ static int build_via_table(struct viadev *dev, struct snd_pcm_substream *substre
439 return -ENOMEM; 439 return -ENOMEM;
440 } 440 }
441 if (! dev->idx_table) { 441 if (! dev->idx_table) {
442 dev->idx_table = kmalloc(sizeof(*dev->idx_table) * VIA_TABLE_SIZE, GFP_KERNEL); 442 dev->idx_table = kmalloc_array(VIA_TABLE_SIZE,
443 sizeof(*dev->idx_table),
444 GFP_KERNEL);
443 if (! dev->idx_table) 445 if (! dev->idx_table)
444 return -ENOMEM; 446 return -ENOMEM;
445 } 447 }
diff --git a/sound/pci/via82xx_modem.c b/sound/pci/via82xx_modem.c
index 8a69221c1b86..b13c8688cc8d 100644
--- a/sound/pci/via82xx_modem.c
+++ b/sound/pci/via82xx_modem.c
@@ -292,7 +292,9 @@ static int build_via_table(struct viadev *dev, struct snd_pcm_substream *substre
292 return -ENOMEM; 292 return -ENOMEM;
293 } 293 }
294 if (! dev->idx_table) { 294 if (! dev->idx_table) {
295 dev->idx_table = kmalloc(sizeof(*dev->idx_table) * VIA_TABLE_SIZE, GFP_KERNEL); 295 dev->idx_table = kmalloc_array(VIA_TABLE_SIZE,
296 sizeof(*dev->idx_table),
297 GFP_KERNEL);
296 if (! dev->idx_table) 298 if (! dev->idx_table)
297 return -ENOMEM; 299 return -ENOMEM;
298 } 300 }
diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
index 8ca2e41e5827..6f81396aadc9 100644
--- a/sound/pci/ymfpci/ymfpci_main.c
+++ b/sound/pci/ymfpci/ymfpci_main.c
@@ -2435,8 +2435,8 @@ int snd_ymfpci_create(struct snd_card *card,
2435 goto free_chip; 2435 goto free_chip;
2436 2436
2437#ifdef CONFIG_PM_SLEEP 2437#ifdef CONFIG_PM_SLEEP
2438 chip->saved_regs = kmalloc(YDSXGR_NUM_SAVED_REGS * sizeof(u32), 2438 chip->saved_regs = kmalloc_array(YDSXGR_NUM_SAVED_REGS, sizeof(u32),
2439 GFP_KERNEL); 2439 GFP_KERNEL);
2440 if (chip->saved_regs == NULL) { 2440 if (chip->saved_regs == NULL) {
2441 err = -ENOMEM; 2441 err = -ENOMEM;
2442 goto free_chip; 2442 goto free_chip;
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index f13ef334c0d7..9037a35b931d 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -2023,8 +2023,9 @@ static void wm8904_handle_pdata(struct snd_soc_component *component)
2023 wm8904_get_drc_enum, wm8904_put_drc_enum); 2023 wm8904_get_drc_enum, wm8904_put_drc_enum);
2024 2024
2025 /* We need an array of texts for the enum API */ 2025 /* We need an array of texts for the enum API */
2026 wm8904->drc_texts = kmalloc(sizeof(char *) 2026 wm8904->drc_texts = kmalloc_array(pdata->num_drc_cfgs,
2027 * pdata->num_drc_cfgs, GFP_KERNEL); 2027 sizeof(char *),
2028 GFP_KERNEL);
2028 if (!wm8904->drc_texts) 2029 if (!wm8904->drc_texts)
2029 return; 2030 return;
2030 2031
diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c
index 8d495220fa25..108e8bf42a34 100644
--- a/sound/soc/codecs/wm8958-dsp2.c
+++ b/sound/soc/codecs/wm8958-dsp2.c
@@ -932,8 +932,9 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
932 }; 932 };
933 933
934 /* We need an array of texts for the enum API */ 934 /* We need an array of texts for the enum API */
935 wm8994->mbc_texts = kmalloc(sizeof(char *) 935 wm8994->mbc_texts = kmalloc_array(pdata->num_mbc_cfgs,
936 * pdata->num_mbc_cfgs, GFP_KERNEL); 936 sizeof(char *),
937 GFP_KERNEL);
937 if (!wm8994->mbc_texts) 938 if (!wm8994->mbc_texts)
938 return; 939 return;
939 940
@@ -957,8 +958,9 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
957 }; 958 };
958 959
959 /* We need an array of texts for the enum API */ 960 /* We need an array of texts for the enum API */
960 wm8994->vss_texts = kmalloc(sizeof(char *) 961 wm8994->vss_texts = kmalloc_array(pdata->num_vss_cfgs,
961 * pdata->num_vss_cfgs, GFP_KERNEL); 962 sizeof(char *),
963 GFP_KERNEL);
962 if (!wm8994->vss_texts) 964 if (!wm8994->vss_texts)
963 return; 965 return;
964 966
@@ -983,8 +985,9 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
983 }; 985 };
984 986
985 /* We need an array of texts for the enum API */ 987 /* We need an array of texts for the enum API */
986 wm8994->vss_hpf_texts = kmalloc(sizeof(char *) 988 wm8994->vss_hpf_texts = kmalloc_array(pdata->num_vss_hpf_cfgs,
987 * pdata->num_vss_hpf_cfgs, GFP_KERNEL); 989 sizeof(char *),
990 GFP_KERNEL);
988 if (!wm8994->vss_hpf_texts) 991 if (!wm8994->vss_hpf_texts)
989 return; 992 return;
990 993
@@ -1010,8 +1013,9 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
1010 }; 1013 };
1011 1014
1012 /* We need an array of texts for the enum API */ 1015 /* We need an array of texts for the enum API */
1013 wm8994->enh_eq_texts = kmalloc(sizeof(char *) 1016 wm8994->enh_eq_texts = kmalloc_array(pdata->num_enh_eq_cfgs,
1014 * pdata->num_enh_eq_cfgs, GFP_KERNEL); 1017 sizeof(char *),
1018 GFP_KERNEL);
1015 if (!wm8994->enh_eq_texts) 1019 if (!wm8994->enh_eq_texts)
1016 return; 1020 return;
1017 1021
diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
index fb1c1eac0b5e..f35d29f49ffe 100644
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -728,7 +728,7 @@ static struct urb **alloc_urbs(struct snd_usb_caiaqdev *cdev, int dir, int *ret)
728 usb_sndisocpipe(usb_dev, ENDPOINT_PLAYBACK) : 728 usb_sndisocpipe(usb_dev, ENDPOINT_PLAYBACK) :
729 usb_rcvisocpipe(usb_dev, ENDPOINT_CAPTURE); 729 usb_rcvisocpipe(usb_dev, ENDPOINT_CAPTURE);
730 730
731 urbs = kmalloc(N_URBS * sizeof(*urbs), GFP_KERNEL); 731 urbs = kmalloc_array(N_URBS, sizeof(*urbs), GFP_KERNEL);
732 if (!urbs) { 732 if (!urbs) {
733 *ret = -ENOMEM; 733 *ret = -ENOMEM;
734 return NULL; 734 return NULL;
@@ -742,7 +742,8 @@ static struct urb **alloc_urbs(struct snd_usb_caiaqdev *cdev, int dir, int *ret)
742 } 742 }
743 743
744 urbs[i]->transfer_buffer = 744 urbs[i]->transfer_buffer =
745 kmalloc(FRAMES_PER_URB * BYTES_PER_FRAME, GFP_KERNEL); 745 kmalloc_array(BYTES_PER_FRAME, FRAMES_PER_URB,
746 GFP_KERNEL);
746 if (!urbs[i]->transfer_buffer) { 747 if (!urbs[i]->transfer_buffer) {
747 *ret = -ENOMEM; 748 *ret = -ENOMEM;
748 return urbs; 749 return urbs;
@@ -857,7 +858,7 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev)
857 &snd_usb_caiaq_ops); 858 &snd_usb_caiaq_ops);
858 859
859 cdev->data_cb_info = 860 cdev->data_cb_info =
860 kmalloc(sizeof(struct snd_usb_caiaq_cb_info) * N_URBS, 861 kmalloc_array(N_URBS, sizeof(struct snd_usb_caiaq_cb_info),
861 GFP_KERNEL); 862 GFP_KERNEL);
862 863
863 if (!cdev->data_cb_info) 864 if (!cdev->data_cb_info)
diff --git a/sound/usb/format.c b/sound/usb/format.c
index 49e7ec6d2399..1f7a74a77ea3 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -188,7 +188,8 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof
188 */ 188 */
189 int r, idx; 189 int r, idx;
190 190
191 fp->rate_table = kmalloc(sizeof(int) * nr_rates, GFP_KERNEL); 191 fp->rate_table = kmalloc_array(nr_rates, sizeof(int),
192 GFP_KERNEL);
192 if (fp->rate_table == NULL) 193 if (fp->rate_table == NULL)
193 return -ENOMEM; 194 return -ENOMEM;
194 195
@@ -362,7 +363,7 @@ static int parse_audio_format_rates_v2v3(struct snd_usb_audio *chip,
362 goto err_free; 363 goto err_free;
363 } 364 }
364 365
365 fp->rate_table = kmalloc(sizeof(int) * fp->nr_rates, GFP_KERNEL); 366 fp->rate_table = kmalloc_array(fp->nr_rates, sizeof(int), GFP_KERNEL);
366 if (!fp->rate_table) { 367 if (!fp->rate_table) {
367 ret = -ENOMEM; 368 ret = -ENOMEM;
368 goto err_free; 369 goto err_free;
diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index b3854f8c0c67..72c6f8e82a7e 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -158,8 +158,10 @@ static int line6_buffer_acquire(struct snd_line6_pcm *line6pcm,
158 158
159 /* Invoked multiple times in a row so allocate once only */ 159 /* Invoked multiple times in a row so allocate once only */
160 if (!test_and_set_bit(type, &pstr->opened) && !pstr->buffer) { 160 if (!test_and_set_bit(type, &pstr->opened) && !pstr->buffer) {
161 pstr->buffer = kmalloc(line6pcm->line6->iso_buffers * 161 pstr->buffer =
162 LINE6_ISO_PACKETS * pkt_size, GFP_KERNEL); 162 kmalloc(array3_size(line6pcm->line6->iso_buffers,
163 LINE6_ISO_PACKETS, pkt_size),
164 GFP_KERNEL);
163 if (!pstr->buffer) 165 if (!pstr->buffer)
164 return -ENOMEM; 166 return -ENOMEM;
165 } 167 }
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 898afd3001ea..8c3568d8d03b 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2515,7 +2515,7 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
2515 cval->control = (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR) ? 2515 cval->control = (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR) ?
2516 UAC2_CX_CLOCK_SELECTOR : UAC2_SU_SELECTOR; 2516 UAC2_CX_CLOCK_SELECTOR : UAC2_SU_SELECTOR;
2517 2517
2518 namelist = kmalloc(sizeof(char *) * desc->bNrInPins, GFP_KERNEL); 2518 namelist = kmalloc_array(desc->bNrInPins, sizeof(char *), GFP_KERNEL);
2519 if (!namelist) { 2519 if (!namelist) {
2520 kfree(cval); 2520 kfree(cval);
2521 return -ENOMEM; 2521 return -ENOMEM;
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 78d1cad08a0a..160f52c4871b 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1123,7 +1123,7 @@ static int snd_usb_pcm_check_knot(struct snd_pcm_runtime *runtime,
1123 return 0; 1123 return 0;
1124 1124
1125 subs->rate_list.list = rate_list = 1125 subs->rate_list.list = rate_list =
1126 kmalloc(sizeof(int) * count, GFP_KERNEL); 1126 kmalloc_array(count, sizeof(int), GFP_KERNEL);
1127 if (!subs->rate_list.list) 1127 if (!subs->rate_list.list)
1128 return -ENOMEM; 1128 return -ENOMEM;
1129 subs->rate_list.count = count; 1129 subs->rate_list.count = count;
diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
index 0ddf29267d70..da4a5a541512 100644
--- a/sound/usb/usx2y/usbusx2y.c
+++ b/sound/usb/usx2y/usbusx2y.c
@@ -266,7 +266,9 @@ int usX2Y_AsyncSeq04_init(struct usX2Ydev *usX2Y)
266 int err = 0, 266 int err = 0,
267 i; 267 i;
268 268
269 if (NULL == (usX2Y->AS04.buffer = kmalloc(URB_DataLen_AsyncSeq*URBS_AsyncSeq, GFP_KERNEL))) { 269 usX2Y->AS04.buffer = kmalloc_array(URBS_AsyncSeq,
270 URB_DataLen_AsyncSeq, GFP_KERNEL);
271 if (NULL == usX2Y->AS04.buffer) {
270 err = -ENOMEM; 272 err = -ENOMEM;
271 } else 273 } else
272 for (i = 0; i < URBS_AsyncSeq; ++i) { 274 for (i = 0; i < URBS_AsyncSeq; ++i) {
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index 345e439aa95b..2b833054e3b0 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -436,7 +436,9 @@ static int usX2Y_urbs_allocate(struct snd_usX2Y_substream *subs)
436 } 436 }
437 if (!is_playback && !(*purb)->transfer_buffer) { 437 if (!is_playback && !(*purb)->transfer_buffer) {
438 /* allocate a capture buffer per urb */ 438 /* allocate a capture buffer per urb */
439 (*purb)->transfer_buffer = kmalloc(subs->maxpacksize * nr_of_packs(), GFP_KERNEL); 439 (*purb)->transfer_buffer =
440 kmalloc_array(subs->maxpacksize,
441 nr_of_packs(), GFP_KERNEL);
440 if (NULL == (*purb)->transfer_buffer) { 442 if (NULL == (*purb)->transfer_buffer) {
441 usX2Y_urbs_release(subs); 443 usX2Y_urbs_release(subs);
442 return -ENOMEM; 444 return -ENOMEM;
@@ -662,7 +664,8 @@ static int usX2Y_rate_set(struct usX2Ydev *usX2Y, int rate)
662 err = -ENOMEM; 664 err = -ENOMEM;
663 goto cleanup; 665 goto cleanup;
664 } 666 }
665 usbdata = kmalloc(sizeof(int) * NOOF_SETRATE_URBS, GFP_KERNEL); 667 usbdata = kmalloc_array(NOOF_SETRATE_URBS, sizeof(int),
668 GFP_KERNEL);
666 if (NULL == usbdata) { 669 if (NULL == usbdata) {
667 err = -ENOMEM; 670 err = -ENOMEM;
668 goto cleanup; 671 goto cleanup;