summaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2018-06-12 16:55:00 -0400
committerKees Cook <keescook@chromium.org>2018-06-12 19:19:22 -0400
commit6da2ec56059c3c7a7e5f729e6349e74ace1e5c57 (patch)
tree2278b513e904a46e930a856da3ed3ac5bc3fe4a4 /fs
parent1c542f38ab8d30d9c852a16d49ac5a15267bbf1f (diff)
treewide: kmalloc() -> kmalloc_array()
The kmalloc() function has a 2-factor argument form, kmalloc_array(). This patch replaces cases of: kmalloc(a * b, gfp) with: kmalloc_array(a * b, gfp) as well as handling cases of: kmalloc(a * b * c, gfp) with: kmalloc(array3_size(a, b, c), gfp) as it's slightly less ugly than: kmalloc_array(array_size(a, b), c, gfp) This does, however, attempt to ignore constant size factors like: kmalloc(4 * 1024, gfp) though any constants defined via macros get caught up in the conversion. Any factors with a sizeof() of "unsigned char", "char", and "u8" were dropped, since they're redundant. The tools/ directory was manually excluded, since it has its own implementation of kmalloc(). The Coccinelle script used for this was: // Fix redundant parens around sizeof(). @@ type TYPE; expression THING, E; @@ ( kmalloc( - (sizeof(TYPE)) * E + sizeof(TYPE) * E , ...) | kmalloc( - (sizeof(THING)) * E + sizeof(THING) * E , ...) ) // Drop single-byte sizes and redundant parens. @@ expression COUNT; typedef u8; typedef __u8; @@ ( kmalloc( - sizeof(u8) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(__u8) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(char) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(unsigned char) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(u8) * COUNT + COUNT , ...) | kmalloc( - sizeof(__u8) * COUNT + COUNT , ...) | kmalloc( - sizeof(char) * COUNT + COUNT , ...) | kmalloc( - sizeof(unsigned char) * COUNT + COUNT , ...) ) // 2-factor product with sizeof(type/expression) and identifier or constant. @@ type TYPE; expression THING; identifier COUNT_ID; constant COUNT_CONST; @@ ( - kmalloc + kmalloc_array ( - sizeof(TYPE) * (COUNT_ID) + COUNT_ID, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * COUNT_ID + COUNT_ID, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * (COUNT_CONST) + COUNT_CONST, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * COUNT_CONST + COUNT_CONST, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (COUNT_ID) + COUNT_ID, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * COUNT_ID + COUNT_ID, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (COUNT_CONST) + COUNT_CONST, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * COUNT_CONST + COUNT_CONST, sizeof(THING) , ...) ) // 2-factor product, only identifiers. @@ identifier SIZE, COUNT; @@ - kmalloc + kmalloc_array ( - SIZE * COUNT + COUNT, SIZE , ...) // 3-factor product with 1 sizeof(type) or sizeof(expression), with // redundant parens removed. @@ expression THING; identifier STRIDE, COUNT; type TYPE; @@ ( kmalloc( - sizeof(TYPE) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(THING) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) ) // 3-factor product with 2 sizeof(variable), with redundant parens removed. @@ expression THING1, THING2; identifier COUNT; type TYPE1, TYPE2; @@ ( kmalloc( - sizeof(TYPE1) * sizeof(TYPE2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kmalloc( - sizeof(THING1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kmalloc( - sizeof(THING1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) ) // 3-factor product, only identifiers, with redundant parens removed. @@ identifier STRIDE, SIZE, COUNT; @@ ( kmalloc( - (COUNT) * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) ) // Any remaining multi-factor products, first at least 3-factor products, // when they're not all constants... @@ expression E1, E2, E3; constant C1, C2, C3; @@ ( kmalloc(C1 * C2 * C3, ...) | kmalloc( - (E1) * E2 * E3 + array3_size(E1, E2, E3) , ...) | kmalloc( - (E1) * (E2) * E3 + array3_size(E1, E2, E3) , ...) | kmalloc( - (E1) * (E2) * (E3) + array3_size(E1, E2, E3) , ...) | kmalloc( - E1 * E2 * E3 + array3_size(E1, E2, E3) , ...) ) // And then all remaining 2 factors products when they're not all constants, // keeping sizeof() as the second factor argument. @@ expression THING, E1, E2; type TYPE; constant C1, C2, C3; @@ ( kmalloc(sizeof(THING) * C2, ...) | kmalloc(sizeof(TYPE) * C2, ...) | kmalloc(C1 * C2 * C3, ...) | kmalloc(C1 * C2, ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * (E2) + E2, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * E2 + E2, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (E2) + E2, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * E2 + E2, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - (E1) * E2 + E1, E2 , ...) | - kmalloc + kmalloc_array ( - (E1) * (E2) + E1, E2 , ...) | - kmalloc + kmalloc_array ( - E1 * E2 + E1, E2 , ...) ) Signed-off-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/9p/fid.c2
-rw-r--r--fs/adfs/super.c2
-rw-r--r--fs/afs/cmservice.c7
-rw-r--r--fs/binfmt_elf.c2
-rw-r--r--fs/binfmt_elf_fdpic.c3
-rw-r--r--fs/block_dev.c3
-rw-r--r--fs/ceph/addr.c11
-rw-r--r--fs/ceph/mds_client.c5
-rw-r--r--fs/cifs/asn1.c2
-rw-r--r--fs/cifs/cifsacl.c4
-rw-r--r--fs/cifs/inode.c2
-rw-r--r--fs/cifs/smb2pdu.c6
-rw-r--r--fs/cifs/transport.c8
-rw-r--r--fs/exofs/inode.c4
-rw-r--r--fs/ext2/super.c4
-rw-r--r--fs/ext4/resize.c10
-rw-r--r--fs/fat/namei_vfat.c2
-rw-r--r--fs/fuse/dev.c15
-rw-r--r--fs/gfs2/dir.c6
-rw-r--r--fs/gfs2/glock.c3
-rw-r--r--fs/gfs2/quota.c2
-rw-r--r--fs/gfs2/rgrp.c5
-rw-r--r--fs/gfs2/super.c2
-rw-r--r--fs/hpfs/dnode.c3
-rw-r--r--fs/hpfs/map.c2
-rw-r--r--fs/jbd2/revoke.c2
-rw-r--r--fs/jffs2/wbuf.c2
-rw-r--r--fs/jfs/jfs_dmap.c2
-rw-r--r--fs/jfs/jfs_dtree.c9
-rw-r--r--fs/jfs/jfs_unicode.c2
-rw-r--r--fs/mbcache.c5
-rw-r--r--fs/namei.c4
-rw-r--r--fs/nfsd/nfs4recover.c5
-rw-r--r--fs/nfsd/nfs4state.c20
-rw-r--r--fs/ntfs/compress.c2
-rw-r--r--fs/ocfs2/cluster/tcp.c2
-rw-r--r--fs/ocfs2/dlm/dlmdomain.c2
-rw-r--r--fs/proc/base.c3
-rw-r--r--fs/proc/task_mmu.c2
-rw-r--r--fs/read_write.c4
-rw-r--r--fs/reiserfs/journal.c10
-rw-r--r--fs/select.c2
-rw-r--r--fs/splice.c7
-rw-r--r--fs/ubifs/lpt.c16
-rw-r--r--fs/ubifs/super.c3
-rw-r--r--fs/ubifs/tnc.c5
-rw-r--r--fs/ubifs/tnc_commit.c5
-rw-r--r--fs/ufs/super.c4
48 files changed, 134 insertions, 99 deletions
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index ed4f8519b627..a9ef46f02354 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -100,7 +100,7 @@ static int build_path_from_dentry(struct v9fs_session_info *v9ses,
100 for (ds = dentry; !IS_ROOT(ds); ds = ds->d_parent) 100 for (ds = dentry; !IS_ROOT(ds); ds = ds->d_parent)
101 n++; 101 n++;
102 102
103 wnames = kmalloc(sizeof(char *) * n, GFP_KERNEL); 103 wnames = kmalloc_array(n, sizeof(char *), GFP_KERNEL);
104 if (!wnames) 104 if (!wnames)
105 goto err_out; 105 goto err_out;
106 106
diff --git a/fs/adfs/super.c b/fs/adfs/super.c
index cfda2c7caedc..71fa525d63a0 100644
--- a/fs/adfs/super.c
+++ b/fs/adfs/super.c
@@ -313,7 +313,7 @@ static struct adfs_discmap *adfs_read_map(struct super_block *sb, struct adfs_di
313 313
314 asb->s_ids_per_zone = zone_size / (asb->s_idlen + 1); 314 asb->s_ids_per_zone = zone_size / (asb->s_idlen + 1);
315 315
316 dm = kmalloc(nzones * sizeof(*dm), GFP_KERNEL); 316 dm = kmalloc_array(nzones, sizeof(*dm), GFP_KERNEL);
317 if (dm == NULL) { 317 if (dm == NULL) {
318 adfs_error(sb, "not enough memory"); 318 adfs_error(sb, "not enough memory");
319 return ERR_PTR(-ENOMEM); 319 return ERR_PTR(-ENOMEM);
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index c332c95a6940..238fd28cfdd2 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -191,7 +191,8 @@ static int afs_deliver_cb_callback(struct afs_call *call)
191 if (call->count > AFSCBMAX) 191 if (call->count > AFSCBMAX)
192 return afs_protocol_error(call, -EBADMSG); 192 return afs_protocol_error(call, -EBADMSG);
193 193
194 call->buffer = kmalloc(call->count * 3 * 4, GFP_KERNEL); 194 call->buffer = kmalloc(array3_size(call->count, 3, 4),
195 GFP_KERNEL);
195 if (!call->buffer) 196 if (!call->buffer)
196 return -ENOMEM; 197 return -ENOMEM;
197 call->offset = 0; 198 call->offset = 0;
@@ -330,7 +331,7 @@ static int afs_deliver_cb_init_call_back_state3(struct afs_call *call)
330 switch (call->unmarshall) { 331 switch (call->unmarshall) {
331 case 0: 332 case 0:
332 call->offset = 0; 333 call->offset = 0;
333 call->buffer = kmalloc(11 * sizeof(__be32), GFP_KERNEL); 334 call->buffer = kmalloc_array(11, sizeof(__be32), GFP_KERNEL);
334 if (!call->buffer) 335 if (!call->buffer)
335 return -ENOMEM; 336 return -ENOMEM;
336 call->unmarshall++; 337 call->unmarshall++;
@@ -453,7 +454,7 @@ static int afs_deliver_cb_probe_uuid(struct afs_call *call)
453 switch (call->unmarshall) { 454 switch (call->unmarshall) {
454 case 0: 455 case 0:
455 call->offset = 0; 456 call->offset = 0;
456 call->buffer = kmalloc(11 * sizeof(__be32), GFP_KERNEL); 457 call->buffer = kmalloc_array(11, sizeof(__be32), GFP_KERNEL);
457 if (!call->buffer) 458 if (!call->buffer)
458 return -ENOMEM; 459 return -ENOMEM;
459 call->unmarshall++; 460 call->unmarshall++;
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 4ad6f669fe34..bf5ee6f741cd 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -2010,7 +2010,7 @@ static int elf_note_info_init(struct elf_note_info *info)
2010 INIT_LIST_HEAD(&info->thread_list); 2010 INIT_LIST_HEAD(&info->thread_list);
2011 2011
2012 /* Allocate space for ELF notes */ 2012 /* Allocate space for ELF notes */
2013 info->notes = kmalloc(8 * sizeof(struct memelfnote), GFP_KERNEL); 2013 info->notes = kmalloc_array(8, sizeof(struct memelfnote), GFP_KERNEL);
2014 if (!info->notes) 2014 if (!info->notes)
2015 return 0; 2015 return 0;
2016 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL); 2016 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index d90993adeffa..b53bb3729ac1 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -1600,7 +1600,8 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
1600 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); 1600 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1601 if (!psinfo) 1601 if (!psinfo)
1602 goto cleanup; 1602 goto cleanup;
1603 notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote), GFP_KERNEL); 1603 notes = kmalloc_array(NUM_NOTES, sizeof(struct memelfnote),
1604 GFP_KERNEL);
1604 if (!notes) 1605 if (!notes)
1605 goto cleanup; 1606 goto cleanup;
1606 fpu = kmalloc(sizeof(*fpu), GFP_KERNEL); 1607 fpu = kmalloc(sizeof(*fpu), GFP_KERNEL);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 05e12aea2404..0dd87aaeb39a 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -205,7 +205,8 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
205 if (nr_pages <= DIO_INLINE_BIO_VECS) 205 if (nr_pages <= DIO_INLINE_BIO_VECS)
206 vecs = inline_vecs; 206 vecs = inline_vecs;
207 else { 207 else {
208 vecs = kmalloc(nr_pages * sizeof(struct bio_vec), GFP_KERNEL); 208 vecs = kmalloc_array(nr_pages, sizeof(struct bio_vec),
209 GFP_KERNEL);
209 if (!vecs) 210 if (!vecs)
210 return -ENOMEM; 211 return -ENOMEM;
211 } 212 }
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 5f7ad3d0df2e..c9cb2f33a6d6 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -370,7 +370,7 @@ static int start_read(struct inode *inode, struct ceph_rw_context *rw_ctx,
370 370
371 /* build page vector */ 371 /* build page vector */
372 nr_pages = calc_pages_for(0, len); 372 nr_pages = calc_pages_for(0, len);
373 pages = kmalloc(sizeof(*pages) * nr_pages, GFP_KERNEL); 373 pages = kmalloc_array(nr_pages, sizeof(*pages), GFP_KERNEL);
374 if (!pages) { 374 if (!pages) {
375 ret = -ENOMEM; 375 ret = -ENOMEM;
376 goto out_put; 376 goto out_put;
@@ -966,8 +966,9 @@ get_more_pages:
966 966
967 BUG_ON(pages); 967 BUG_ON(pages);
968 max_pages = calc_pages_for(0, (u64)len); 968 max_pages = calc_pages_for(0, (u64)len);
969 pages = kmalloc(max_pages * sizeof (*pages), 969 pages = kmalloc_array(max_pages,
970 GFP_NOFS); 970 sizeof(*pages),
971 GFP_NOFS);
971 if (!pages) { 972 if (!pages) {
972 pool = fsc->wb_pagevec_pool; 973 pool = fsc->wb_pagevec_pool;
973 pages = mempool_alloc(pool, GFP_NOFS); 974 pages = mempool_alloc(pool, GFP_NOFS);
@@ -1113,8 +1114,8 @@ new_request:
1113 1114
1114 /* allocate new pages array for next request */ 1115 /* allocate new pages array for next request */
1115 data_pages = pages; 1116 data_pages = pages;
1116 pages = kmalloc(locked_pages * sizeof (*pages), 1117 pages = kmalloc_array(locked_pages, sizeof(*pages),
1117 GFP_NOFS); 1118 GFP_NOFS);
1118 if (!pages) { 1119 if (!pages) {
1119 pool = fsc->wb_pagevec_pool; 1120 pool = fsc->wb_pagevec_pool;
1120 pages = mempool_alloc(pool, GFP_NOFS); 1121 pages = mempool_alloc(pool, GFP_NOFS);
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 5ece2e6ad154..cf8d24812cc0 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2992,8 +2992,9 @@ encode_again:
2992 num_flock_locks = 0; 2992 num_flock_locks = 0;
2993 } 2993 }
2994 if (num_fcntl_locks + num_flock_locks > 0) { 2994 if (num_fcntl_locks + num_flock_locks > 0) {
2995 flocks = kmalloc((num_fcntl_locks + num_flock_locks) * 2995 flocks = kmalloc_array(num_fcntl_locks + num_flock_locks,
2996 sizeof(struct ceph_filelock), GFP_NOFS); 2996 sizeof(struct ceph_filelock),
2997 GFP_NOFS);
2997 if (!flocks) { 2998 if (!flocks) {
2998 err = -ENOMEM; 2999 err = -ENOMEM;
2999 goto out_free; 3000 goto out_free;
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index a3b56544c21b..3d19595eb352 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -428,7 +428,7 @@ asn1_oid_decode(struct asn1_ctx *ctx,
428 if (size < 2 || size > UINT_MAX/sizeof(unsigned long)) 428 if (size < 2 || size > UINT_MAX/sizeof(unsigned long))
429 return 0; 429 return 0;
430 430
431 *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC); 431 *oid = kmalloc_array(size, sizeof(unsigned long), GFP_ATOMIC);
432 if (*oid == NULL) 432 if (*oid == NULL)
433 return 0; 433 return 0;
434 434
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 13a8a77322c9..1d377b7f2860 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -747,8 +747,8 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
747 747
748 if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *)) 748 if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *))
749 return; 749 return;
750 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *), 750 ppace = kmalloc_array(num_aces, sizeof(struct cifs_ace *),
751 GFP_KERNEL); 751 GFP_KERNEL);
752 if (!ppace) 752 if (!ppace)
753 return; 753 return;
754 754
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 745fd7fe8d0e..a94071c7b408 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1792,7 +1792,7 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
1792 * with unix extensions enabled. 1792 * with unix extensions enabled.
1793 */ 1793 */
1794 info_buf_source = 1794 info_buf_source =
1795 kmalloc(2 * sizeof(FILE_UNIX_BASIC_INFO), 1795 kmalloc_array(2, sizeof(FILE_UNIX_BASIC_INFO),
1796 GFP_KERNEL); 1796 GFP_KERNEL);
1797 if (info_buf_source == NULL) { 1797 if (info_buf_source == NULL) {
1798 rc = -ENOMEM; 1798 rc = -ENOMEM;
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 48e2004c75fb..af032e1a3eac 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3471,7 +3471,7 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
3471 if (!num) 3471 if (!num)
3472 return -EINVAL; 3472 return -EINVAL;
3473 3473
3474 iov = kmalloc(sizeof(struct kvec) * num, GFP_KERNEL); 3474 iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL);
3475 if (!iov) 3475 if (!iov)
3476 return -ENOMEM; 3476 return -ENOMEM;
3477 3477
@@ -3535,7 +3535,7 @@ SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon,
3535 int rc; 3535 int rc;
3536 int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX)); 3536 int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
3537 3537
3538 data = kmalloc(sizeof(void *) * 2, GFP_KERNEL); 3538 data = kmalloc_array(2, sizeof(void *), GFP_KERNEL);
3539 if (!data) 3539 if (!data)
3540 return -ENOMEM; 3540 return -ENOMEM;
3541 3541
@@ -3583,7 +3583,7 @@ SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon,
3583 int rc; 3583 int rc;
3584 int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX)); 3584 int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
3585 3585
3586 data = kmalloc(sizeof(void *) * 2, GFP_KERNEL); 3586 data = kmalloc_array(2, sizeof(void *), GFP_KERNEL);
3587 if (!data) 3587 if (!data)
3588 return -ENOMEM; 3588 return -ENOMEM;
3589 3589
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 24887a0898c0..1f1a68f89110 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -844,8 +844,8 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses,
844 int rc; 844 int rc;
845 845
846 if (n_vec + 1 > CIFS_MAX_IOV_SIZE) { 846 if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
847 new_iov = kmalloc(sizeof(struct kvec) * (n_vec + 1), 847 new_iov = kmalloc_array(n_vec + 1, sizeof(struct kvec),
848 GFP_KERNEL); 848 GFP_KERNEL);
849 if (!new_iov) { 849 if (!new_iov) {
850 /* otherwise cifs_send_recv below sets resp_buf_type */ 850 /* otherwise cifs_send_recv below sets resp_buf_type */
851 *resp_buf_type = CIFS_NO_BUFFER; 851 *resp_buf_type = CIFS_NO_BUFFER;
@@ -886,8 +886,8 @@ smb2_send_recv(const unsigned int xid, struct cifs_ses *ses,
886 __be32 rfc1002_marker; 886 __be32 rfc1002_marker;
887 887
888 if (n_vec + 1 > CIFS_MAX_IOV_SIZE) { 888 if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
889 new_iov = kmalloc(sizeof(struct kvec) * (n_vec + 1), 889 new_iov = kmalloc_array(n_vec + 1, sizeof(struct kvec),
890 GFP_KERNEL); 890 GFP_KERNEL);
891 if (!new_iov) 891 if (!new_iov)
892 return -ENOMEM; 892 return -ENOMEM;
893 } else 893 } else
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 0ac62811b341..5f81fcd383a4 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -110,8 +110,8 @@ static int pcol_try_alloc(struct page_collect *pcol)
110 pages = exofs_max_io_pages(&pcol->sbi->layout, pcol->expected_pages); 110 pages = exofs_max_io_pages(&pcol->sbi->layout, pcol->expected_pages);
111 111
112 for (; pages; pages >>= 1) { 112 for (; pages; pages >>= 1) {
113 pcol->pages = kmalloc(pages * sizeof(struct page *), 113 pcol->pages = kmalloc_array(pages, sizeof(struct page *),
114 GFP_KERNEL); 114 GFP_KERNEL);
115 if (likely(pcol->pages)) { 115 if (likely(pcol->pages)) {
116 pcol->alloc_pages = pages; 116 pcol->alloc_pages = pages;
117 return 0; 117 return 0;
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index c09289a42dc5..25ab1274090f 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1082,7 +1082,9 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
1082 / EXT2_BLOCKS_PER_GROUP(sb)) + 1; 1082 / EXT2_BLOCKS_PER_GROUP(sb)) + 1;
1083 db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) / 1083 db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) /
1084 EXT2_DESC_PER_BLOCK(sb); 1084 EXT2_DESC_PER_BLOCK(sb);
1085 sbi->s_group_desc = kmalloc (db_count * sizeof (struct buffer_head *), GFP_KERNEL); 1085 sbi->s_group_desc = kmalloc_array (db_count,
1086 sizeof(struct buffer_head *),
1087 GFP_KERNEL);
1086 if (sbi->s_group_desc == NULL) { 1088 if (sbi->s_group_desc == NULL) {
1087 ext2_msg(sb, KERN_ERR, "error: not enough memory"); 1089 ext2_msg(sb, KERN_ERR, "error: not enough memory");
1088 goto failed_mount; 1090 goto failed_mount;
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index d792b7689d92..e5fb38451a73 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -204,12 +204,14 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)
204 goto out2; 204 goto out2;
205 flex_gd->count = flexbg_size; 205 flex_gd->count = flexbg_size;
206 206
207 flex_gd->groups = kmalloc(sizeof(struct ext4_new_group_data) * 207 flex_gd->groups = kmalloc_array(flexbg_size,
208 flexbg_size, GFP_NOFS); 208 sizeof(struct ext4_new_group_data),
209 GFP_NOFS);
209 if (flex_gd->groups == NULL) 210 if (flex_gd->groups == NULL)
210 goto out2; 211 goto out2;
211 212
212 flex_gd->bg_flags = kmalloc(flexbg_size * sizeof(__u16), GFP_NOFS); 213 flex_gd->bg_flags = kmalloc_array(flexbg_size, sizeof(__u16),
214 GFP_NOFS);
213 if (flex_gd->bg_flags == NULL) 215 if (flex_gd->bg_flags == NULL)
214 goto out1; 216 goto out1;
215 217
@@ -969,7 +971,7 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
969 int res, i; 971 int res, i;
970 int err; 972 int err;
971 973
972 primary = kmalloc(reserved_gdb * sizeof(*primary), GFP_NOFS); 974 primary = kmalloc_array(reserved_gdb, sizeof(*primary), GFP_NOFS);
973 if (!primary) 975 if (!primary)
974 return -ENOMEM; 976 return -ENOMEM;
975 977
diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
index 4f4362d5a04c..d4e23f8ddcf6 100644
--- a/fs/fat/namei_vfat.c
+++ b/fs/fat/namei_vfat.c
@@ -664,7 +664,7 @@ static int vfat_add_entry(struct inode *dir, const struct qstr *qname,
664 if (len == 0) 664 if (len == 0)
665 return -ENOENT; 665 return -ENOENT;
666 666
667 slots = kmalloc(sizeof(*slots) * MSDOS_SLOTS, GFP_NOFS); 667 slots = kmalloc_array(MSDOS_SLOTS, sizeof(*slots), GFP_NOFS);
668 if (slots == NULL) 668 if (slots == NULL)
669 return -ENOMEM; 669 return -ENOMEM;
670 670
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index e03ca14f40e9..c6b88fa85e2e 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -64,9 +64,12 @@ static struct fuse_req *__fuse_request_alloc(unsigned npages, gfp_t flags)
64 pages = req->inline_pages; 64 pages = req->inline_pages;
65 page_descs = req->inline_page_descs; 65 page_descs = req->inline_page_descs;
66 } else { 66 } else {
67 pages = kmalloc(sizeof(struct page *) * npages, flags); 67 pages = kmalloc_array(npages, sizeof(struct page *),
68 page_descs = kmalloc(sizeof(struct fuse_page_desc) * 68 flags);
69 npages, flags); 69 page_descs =
70 kmalloc_array(npages,
71 sizeof(struct fuse_page_desc),
72 flags);
70 } 73 }
71 74
72 if (!pages || !page_descs) { 75 if (!pages || !page_descs) {
@@ -1359,7 +1362,8 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
1359 if (!fud) 1362 if (!fud)
1360 return -EPERM; 1363 return -EPERM;
1361 1364
1362 bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL); 1365 bufs = kmalloc_array(pipe->buffers, sizeof(struct pipe_buffer),
1366 GFP_KERNEL);
1363 if (!bufs) 1367 if (!bufs)
1364 return -ENOMEM; 1368 return -ENOMEM;
1365 1369
@@ -1940,7 +1944,8 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
1940 if (!fud) 1944 if (!fud)
1941 return -EPERM; 1945 return -EPERM;
1942 1946
1943 bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL); 1947 bufs = kmalloc_array(pipe->buffers, sizeof(struct pipe_buffer),
1948 GFP_KERNEL);
1944 if (!bufs) 1949 if (!bufs)
1945 return -ENOMEM; 1950 return -ENOMEM;
1946 1951
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index d9fb0ad6cc30..3090c445e8fc 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -1055,7 +1055,7 @@ static int dir_split_leaf(struct inode *inode, const struct qstr *name)
1055 /* Change the pointers. 1055 /* Change the pointers.
1056 Don't bother distinguishing stuffed from non-stuffed. 1056 Don't bother distinguishing stuffed from non-stuffed.
1057 This code is complicated enough already. */ 1057 This code is complicated enough already. */
1058 lp = kmalloc(half_len * sizeof(__be64), GFP_NOFS); 1058 lp = kmalloc_array(half_len, sizeof(__be64), GFP_NOFS);
1059 if (!lp) { 1059 if (!lp) {
1060 error = -ENOMEM; 1060 error = -ENOMEM;
1061 goto fail_brelse; 1061 goto fail_brelse;
@@ -1169,7 +1169,7 @@ static int dir_double_exhash(struct gfs2_inode *dip)
1169 if (IS_ERR(hc)) 1169 if (IS_ERR(hc))
1170 return PTR_ERR(hc); 1170 return PTR_ERR(hc);
1171 1171
1172 hc2 = kmalloc(hsize_bytes * 2, GFP_NOFS | __GFP_NOWARN); 1172 hc2 = kmalloc_array(hsize_bytes, 2, GFP_NOFS | __GFP_NOWARN);
1173 if (hc2 == NULL) 1173 if (hc2 == NULL)
1174 hc2 = __vmalloc(hsize_bytes * 2, GFP_NOFS, PAGE_KERNEL); 1174 hc2 = __vmalloc(hsize_bytes * 2, GFP_NOFS, PAGE_KERNEL);
1175 1175
@@ -1596,7 +1596,7 @@ int gfs2_dir_read(struct inode *inode, struct dir_context *ctx,
1596 1596
1597 error = -ENOMEM; 1597 error = -ENOMEM;
1598 /* 96 is max number of dirents which can be stuffed into an inode */ 1598 /* 96 is max number of dirents which can be stuffed into an inode */
1599 darr = kmalloc(96 * sizeof(struct gfs2_dirent *), GFP_NOFS); 1599 darr = kmalloc_array(96, sizeof(struct gfs2_dirent *), GFP_NOFS);
1600 if (darr) { 1600 if (darr) {
1601 g.pdent = (const struct gfs2_dirent **)darr; 1601 g.pdent = (const struct gfs2_dirent **)darr;
1602 g.offset = 0; 1602 g.offset = 0;
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 097bd3c0f270..4614ee25f621 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1303,7 +1303,8 @@ int gfs2_glock_nq_m(unsigned int num_gh, struct gfs2_holder *ghs)
1303 default: 1303 default:
1304 if (num_gh <= 4) 1304 if (num_gh <= 4)
1305 break; 1305 break;
1306 pph = kmalloc(num_gh * sizeof(struct gfs2_holder *), GFP_NOFS); 1306 pph = kmalloc_array(num_gh, sizeof(struct gfs2_holder *),
1307 GFP_NOFS);
1307 if (!pph) 1308 if (!pph)
1308 return -ENOMEM; 1309 return -ENOMEM;
1309 } 1310 }
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index e8585dfd209f..0efae7a0ee80 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -886,7 +886,7 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)
886 gfs2_write_calc_reserv(ip, sizeof(struct gfs2_quota), 886 gfs2_write_calc_reserv(ip, sizeof(struct gfs2_quota),
887 &data_blocks, &ind_blocks); 887 &data_blocks, &ind_blocks);
888 888
889 ghs = kmalloc(num_qd * sizeof(struct gfs2_holder), GFP_NOFS); 889 ghs = kmalloc_array(num_qd, sizeof(struct gfs2_holder), GFP_NOFS);
890 if (!ghs) 890 if (!ghs)
891 return -ENOMEM; 891 return -ENOMEM;
892 892
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 6bc5cfe710d1..33abcf29bc05 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -2605,8 +2605,9 @@ void gfs2_rlist_alloc(struct gfs2_rgrp_list *rlist, unsigned int state)
2605{ 2605{
2606 unsigned int x; 2606 unsigned int x;
2607 2607
2608 rlist->rl_ghs = kmalloc(rlist->rl_rgrps * sizeof(struct gfs2_holder), 2608 rlist->rl_ghs = kmalloc_array(rlist->rl_rgrps,
2609 GFP_NOFS | __GFP_NOFAIL); 2609 sizeof(struct gfs2_holder),
2610 GFP_NOFS | __GFP_NOFAIL);
2610 for (x = 0; x < rlist->rl_rgrps; x++) 2611 for (x = 0; x < rlist->rl_rgrps; x++)
2611 gfs2_holder_init(rlist->rl_rgd[x]->rd_gl, 2612 gfs2_holder_init(rlist->rl_rgd[x]->rd_gl,
2612 state, 0, 2613 state, 0,
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index cf5c7f3080d2..af0d5b01cf0b 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1097,7 +1097,7 @@ static int gfs2_statfs_slow(struct gfs2_sbd *sdp, struct gfs2_statfs_change_host
1097 int error = 0, err; 1097 int error = 0, err;
1098 1098
1099 memset(sc, 0, sizeof(struct gfs2_statfs_change_host)); 1099 memset(sc, 0, sizeof(struct gfs2_statfs_change_host));
1100 gha = kmalloc(slots * sizeof(struct gfs2_holder), GFP_KERNEL); 1100 gha = kmalloc_array(slots, sizeof(struct gfs2_holder), GFP_KERNEL);
1101 if (!gha) 1101 if (!gha)
1102 return -ENOMEM; 1102 return -ENOMEM;
1103 for (x = 0; x < slots; x++) 1103 for (x = 0; x < slots; x++)
diff --git a/fs/hpfs/dnode.c b/fs/hpfs/dnode.c
index a4ad18afbdec..4ada525c5c43 100644
--- a/fs/hpfs/dnode.c
+++ b/fs/hpfs/dnode.c
@@ -33,7 +33,8 @@ int hpfs_add_pos(struct inode *inode, loff_t *pos)
33 if (hpfs_inode->i_rddir_off[i] == pos) 33 if (hpfs_inode->i_rddir_off[i] == pos)
34 return 0; 34 return 0;
35 if (!(i&0x0f)) { 35 if (!(i&0x0f)) {
36 if (!(ppos = kmalloc((i+0x11) * sizeof(loff_t*), GFP_NOFS))) { 36 ppos = kmalloc_array(i + 0x11, sizeof(loff_t *), GFP_NOFS);
37 if (!ppos) {
37 pr_err("out of memory for position list\n"); 38 pr_err("out of memory for position list\n");
38 return -ENOMEM; 39 return -ENOMEM;
39 } 40 }
diff --git a/fs/hpfs/map.c b/fs/hpfs/map.c
index 7c49f1ef0c85..ecd9fccd1663 100644
--- a/fs/hpfs/map.c
+++ b/fs/hpfs/map.c
@@ -115,7 +115,7 @@ __le32 *hpfs_load_bitmap_directory(struct super_block *s, secno bmp)
115 int n = (hpfs_sb(s)->sb_fs_size + 0x200000 - 1) >> 21; 115 int n = (hpfs_sb(s)->sb_fs_size + 0x200000 - 1) >> 21;
116 int i; 116 int i;
117 __le32 *b; 117 __le32 *b;
118 if (!(b = kmalloc(n * 512, GFP_KERNEL))) { 118 if (!(b = kmalloc_array(n, 512, GFP_KERNEL))) {
119 pr_err("can't allocate memory for bitmap directory\n"); 119 pr_err("can't allocate memory for bitmap directory\n");
120 return NULL; 120 return NULL;
121 } 121 }
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index 240779e4689c..a1143e57a718 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -223,7 +223,7 @@ static struct jbd2_revoke_table_s *jbd2_journal_init_revoke_table(int hash_size)
223 table->hash_size = hash_size; 223 table->hash_size = hash_size;
224 table->hash_shift = shift; 224 table->hash_shift = shift;
225 table->hash_table = 225 table->hash_table =
226 kmalloc(hash_size * sizeof(struct list_head), GFP_KERNEL); 226 kmalloc_array(hash_size, sizeof(struct list_head), GFP_KERNEL);
227 if (!table->hash_table) { 227 if (!table->hash_table) {
228 kmem_cache_free(jbd2_revoke_table_cache, table); 228 kmem_cache_free(jbd2_revoke_table_cache, table);
229 table = NULL; 229 table = NULL;
diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
index 2cfe487708e0..c6821a509481 100644
--- a/fs/jffs2/wbuf.c
+++ b/fs/jffs2/wbuf.c
@@ -1208,7 +1208,7 @@ int jffs2_nand_flash_setup(struct jffs2_sb_info *c)
1208 if (!c->wbuf) 1208 if (!c->wbuf)
1209 return -ENOMEM; 1209 return -ENOMEM;
1210 1210
1211 c->oobbuf = kmalloc(NR_OOB_SCAN_PAGES * c->oobavail, GFP_KERNEL); 1211 c->oobbuf = kmalloc_array(NR_OOB_SCAN_PAGES, c->oobavail, GFP_KERNEL);
1212 if (!c->oobbuf) { 1212 if (!c->oobbuf) {
1213 kfree(c->wbuf); 1213 kfree(c->wbuf);
1214 return -ENOMEM; 1214 return -ENOMEM;
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 2d514c7affc2..49263e220dbc 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1641,7 +1641,7 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen)
1641 max_ranges = nblocks; 1641 max_ranges = nblocks;
1642 do_div(max_ranges, minlen); 1642 do_div(max_ranges, minlen);
1643 range_cnt = min_t(u64, max_ranges + 1, 32 * 1024); 1643 range_cnt = min_t(u64, max_ranges + 1, 32 * 1024);
1644 totrim = kmalloc(sizeof(struct range2trim) * range_cnt, GFP_NOFS); 1644 totrim = kmalloc_array(range_cnt, sizeof(struct range2trim), GFP_NOFS);
1645 if (totrim == NULL) { 1645 if (totrim == NULL) {
1646 jfs_error(bmp->db_ipbmap->i_sb, "no memory for trim array\n"); 1646 jfs_error(bmp->db_ipbmap->i_sb, "no memory for trim array\n");
1647 IWRITE_UNLOCK(ipbmap); 1647 IWRITE_UNLOCK(ipbmap);
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index de2bcb36e079..52bae3f5c914 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -594,7 +594,8 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
594 struct component_name ciKey; 594 struct component_name ciKey;
595 struct super_block *sb = ip->i_sb; 595 struct super_block *sb = ip->i_sb;
596 596
597 ciKey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t), GFP_NOFS); 597 ciKey.name = kmalloc_array(JFS_NAME_MAX + 1, sizeof(wchar_t),
598 GFP_NOFS);
598 if (!ciKey.name) { 599 if (!ciKey.name) {
599 rc = -ENOMEM; 600 rc = -ENOMEM;
600 goto dtSearch_Exit2; 601 goto dtSearch_Exit2;
@@ -957,7 +958,7 @@ static int dtSplitUp(tid_t tid,
957 smp = split->mp; 958 smp = split->mp;
958 sp = DT_PAGE(ip, smp); 959 sp = DT_PAGE(ip, smp);
959 960
960 key.name = kmalloc((JFS_NAME_MAX + 2) * sizeof(wchar_t), GFP_NOFS); 961 key.name = kmalloc_array(JFS_NAME_MAX + 2, sizeof(wchar_t), GFP_NOFS);
961 if (!key.name) { 962 if (!key.name) {
962 DT_PUTPAGE(smp); 963 DT_PUTPAGE(smp);
963 rc = -ENOMEM; 964 rc = -ENOMEM;
@@ -3779,12 +3780,12 @@ static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
3779 struct component_name lkey; 3780 struct component_name lkey;
3780 struct component_name rkey; 3781 struct component_name rkey;
3781 3782
3782 lkey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t), 3783 lkey.name = kmalloc_array(JFS_NAME_MAX + 1, sizeof(wchar_t),
3783 GFP_KERNEL); 3784 GFP_KERNEL);
3784 if (lkey.name == NULL) 3785 if (lkey.name == NULL)
3785 return -ENOMEM; 3786 return -ENOMEM;
3786 3787
3787 rkey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t), 3788 rkey.name = kmalloc_array(JFS_NAME_MAX + 1, sizeof(wchar_t),
3788 GFP_KERNEL); 3789 GFP_KERNEL);
3789 if (rkey.name == NULL) { 3790 if (rkey.name == NULL) {
3790 kfree(lkey.name); 3791 kfree(lkey.name);
diff --git a/fs/jfs/jfs_unicode.c b/fs/jfs/jfs_unicode.c
index c7de6f5bbefc..0148e2e4d97a 100644
--- a/fs/jfs/jfs_unicode.c
+++ b/fs/jfs/jfs_unicode.c
@@ -121,7 +121,7 @@ int get_UCSname(struct component_name * uniName, struct dentry *dentry)
121 return -ENAMETOOLONG; 121 return -ENAMETOOLONG;
122 122
123 uniName->name = 123 uniName->name =
124 kmalloc((length + 1) * sizeof(wchar_t), GFP_NOFS); 124 kmalloc_array(length + 1, sizeof(wchar_t), GFP_NOFS);
125 125
126 if (uniName->name == NULL) 126 if (uniName->name == NULL)
127 return -ENOMEM; 127 return -ENOMEM;
diff --git a/fs/mbcache.c b/fs/mbcache.c
index bf41e2e72c18..081ccf0caee3 100644
--- a/fs/mbcache.c
+++ b/fs/mbcache.c
@@ -353,8 +353,9 @@ struct mb_cache *mb_cache_create(int bucket_bits)
353 cache->c_max_entries = bucket_count << 4; 353 cache->c_max_entries = bucket_count << 4;
354 INIT_LIST_HEAD(&cache->c_list); 354 INIT_LIST_HEAD(&cache->c_list);
355 spin_lock_init(&cache->c_list_lock); 355 spin_lock_init(&cache->c_list_lock);
356 cache->c_hash = kmalloc(bucket_count * sizeof(struct hlist_bl_head), 356 cache->c_hash = kmalloc_array(bucket_count,
357 GFP_KERNEL); 357 sizeof(struct hlist_bl_head),
358 GFP_KERNEL);
358 if (!cache->c_hash) { 359 if (!cache->c_hash) {
359 kfree(cache); 360 kfree(cache);
360 goto err_out; 361 goto err_out;
diff --git a/fs/namei.c b/fs/namei.c
index 6df1f61855d6..2490ddb8bc90 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -537,12 +537,12 @@ static int __nd_alloc_stack(struct nameidata *nd)
537 struct saved *p; 537 struct saved *p;
538 538
539 if (nd->flags & LOOKUP_RCU) { 539 if (nd->flags & LOOKUP_RCU) {
540 p= kmalloc(MAXSYMLINKS * sizeof(struct saved), 540 p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
541 GFP_ATOMIC); 541 GFP_ATOMIC);
542 if (unlikely(!p)) 542 if (unlikely(!p))
543 return -ECHILD; 543 return -ECHILD;
544 } else { 544 } else {
545 p= kmalloc(MAXSYMLINKS * sizeof(struct saved), 545 p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
546 GFP_KERNEL); 546 GFP_KERNEL);
547 if (unlikely(!p)) 547 if (unlikely(!p))
548 return -ENOMEM; 548 return -ENOMEM;
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 66eaeb1e8c2c..9c247fa1e959 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -510,8 +510,9 @@ nfs4_legacy_state_init(struct net *net)
510 struct nfsd_net *nn = net_generic(net, nfsd_net_id); 510 struct nfsd_net *nn = net_generic(net, nfsd_net_id);
511 int i; 511 int i;
512 512
513 nn->reclaim_str_hashtbl = kmalloc(sizeof(struct list_head) * 513 nn->reclaim_str_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
514 CLIENT_HASH_SIZE, GFP_KERNEL); 514 sizeof(struct list_head),
515 GFP_KERNEL);
515 if (!nn->reclaim_str_hashtbl) 516 if (!nn->reclaim_str_hashtbl)
516 return -ENOMEM; 517 return -ENOMEM;
517 518
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index fc74d6f46bd5..39370a503a63 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1807,8 +1807,9 @@ static struct nfs4_client *alloc_client(struct xdr_netobj name)
1807 clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL); 1807 clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
1808 if (clp->cl_name.data == NULL) 1808 if (clp->cl_name.data == NULL)
1809 goto err_no_name; 1809 goto err_no_name;
1810 clp->cl_ownerstr_hashtbl = kmalloc(sizeof(struct list_head) * 1810 clp->cl_ownerstr_hashtbl = kmalloc_array(OWNER_HASH_SIZE,
1811 OWNER_HASH_SIZE, GFP_KERNEL); 1811 sizeof(struct list_head),
1812 GFP_KERNEL);
1812 if (!clp->cl_ownerstr_hashtbl) 1813 if (!clp->cl_ownerstr_hashtbl)
1813 goto err_no_hashtbl; 1814 goto err_no_hashtbl;
1814 for (i = 0; i < OWNER_HASH_SIZE; i++) 1815 for (i = 0; i < OWNER_HASH_SIZE; i++)
@@ -7093,16 +7094,19 @@ static int nfs4_state_create_net(struct net *net)
7093 struct nfsd_net *nn = net_generic(net, nfsd_net_id); 7094 struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7094 int i; 7095 int i;
7095 7096
7096 nn->conf_id_hashtbl = kmalloc(sizeof(struct list_head) * 7097 nn->conf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
7097 CLIENT_HASH_SIZE, GFP_KERNEL); 7098 sizeof(struct list_head),
7099 GFP_KERNEL);
7098 if (!nn->conf_id_hashtbl) 7100 if (!nn->conf_id_hashtbl)
7099 goto err; 7101 goto err;
7100 nn->unconf_id_hashtbl = kmalloc(sizeof(struct list_head) * 7102 nn->unconf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
7101 CLIENT_HASH_SIZE, GFP_KERNEL); 7103 sizeof(struct list_head),
7104 GFP_KERNEL);
7102 if (!nn->unconf_id_hashtbl) 7105 if (!nn->unconf_id_hashtbl)
7103 goto err_unconf_id; 7106 goto err_unconf_id;
7104 nn->sessionid_hashtbl = kmalloc(sizeof(struct list_head) * 7107 nn->sessionid_hashtbl = kmalloc_array(SESSION_HASH_SIZE,
7105 SESSION_HASH_SIZE, GFP_KERNEL); 7108 sizeof(struct list_head),
7109 GFP_KERNEL);
7106 if (!nn->sessionid_hashtbl) 7110 if (!nn->sessionid_hashtbl)
7107 goto err_sessionid; 7111 goto err_sessionid;
7108 7112
diff --git a/fs/ntfs/compress.c b/fs/ntfs/compress.c
index f8eb04387ca4..fbd0090d7d0c 100644
--- a/fs/ntfs/compress.c
+++ b/fs/ntfs/compress.c
@@ -527,7 +527,7 @@ int ntfs_read_compressed_block(struct page *page)
527 BUG_ON(ni->type != AT_DATA); 527 BUG_ON(ni->type != AT_DATA);
528 BUG_ON(ni->name_len); 528 BUG_ON(ni->name_len);
529 529
530 pages = kmalloc(nr_pages * sizeof(struct page *), GFP_NOFS); 530 pages = kmalloc_array(nr_pages, sizeof(struct page *), GFP_NOFS);
531 531
532 /* Allocate memory to store the buffer heads we need. */ 532 /* Allocate memory to store the buffer heads we need. */
533 bhs_size = cb_size / block_size * sizeof(struct buffer_head *); 533 bhs_size = cb_size / block_size * sizeof(struct buffer_head *);
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index e5076185cc1e..1296f78ae966 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1078,7 +1078,7 @@ int o2net_send_message_vec(u32 msg_type, u32 key, struct kvec *caller_vec,
1078 o2net_set_nst_sock_container(&nst, sc); 1078 o2net_set_nst_sock_container(&nst, sc);
1079 1079
1080 veclen = caller_veclen + 1; 1080 veclen = caller_veclen + 1;
1081 vec = kmalloc(sizeof(struct kvec) * veclen, GFP_ATOMIC); 1081 vec = kmalloc_array(veclen, sizeof(struct kvec), GFP_ATOMIC);
1082 if (vec == NULL) { 1082 if (vec == NULL) {
1083 mlog(0, "failed to %zu element kvec!\n", veclen); 1083 mlog(0, "failed to %zu element kvec!\n", veclen);
1084 ret = -ENOMEM; 1084 ret = -ENOMEM;
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 425081be6161..2acd58ba9b7b 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -86,7 +86,7 @@ static void dlm_free_pagevec(void **vec, int pages)
86 86
87static void **dlm_alloc_pagevec(int pages) 87static void **dlm_alloc_pagevec(int pages)
88{ 88{
89 void **vec = kmalloc(pages * sizeof(void *), GFP_KERNEL); 89 void **vec = kmalloc_array(pages, sizeof(void *), GFP_KERNEL);
90 int i; 90 int i;
91 91
92 if (!vec) 92 if (!vec)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 4aa9ce5df02f..80aa42506b8b 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -389,7 +389,8 @@ static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns,
389 unsigned long *entries; 389 unsigned long *entries;
390 int err; 390 int err;
391 391
392 entries = kmalloc(MAX_STACK_TRACE_DEPTH * sizeof(*entries), GFP_KERNEL); 392 entries = kmalloc_array(MAX_STACK_TRACE_DEPTH, sizeof(*entries),
393 GFP_KERNEL);
393 if (!entries) 394 if (!entries)
394 return -ENOMEM; 395 return -ENOMEM;
395 396
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 597969db9e90..e9679016271f 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1473,7 +1473,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
1473 pm.show_pfn = file_ns_capable(file, &init_user_ns, CAP_SYS_ADMIN); 1473 pm.show_pfn = file_ns_capable(file, &init_user_ns, CAP_SYS_ADMIN);
1474 1474
1475 pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT); 1475 pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
1476 pm.buffer = kmalloc(pm.len * PM_ENTRY_BYTES, GFP_KERNEL); 1476 pm.buffer = kmalloc_array(pm.len, PM_ENTRY_BYTES, GFP_KERNEL);
1477 ret = -ENOMEM; 1477 ret = -ENOMEM;
1478 if (!pm.buffer) 1478 if (!pm.buffer)
1479 goto out_mm; 1479 goto out_mm;
diff --git a/fs/read_write.c b/fs/read_write.c
index e83bd9744b5d..153f8f690490 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -778,7 +778,7 @@ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,
778 goto out; 778 goto out;
779 } 779 }
780 if (nr_segs > fast_segs) { 780 if (nr_segs > fast_segs) {
781 iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL); 781 iov = kmalloc_array(nr_segs, sizeof(struct iovec), GFP_KERNEL);
782 if (iov == NULL) { 782 if (iov == NULL) {
783 ret = -ENOMEM; 783 ret = -ENOMEM;
784 goto out; 784 goto out;
@@ -849,7 +849,7 @@ ssize_t compat_rw_copy_check_uvector(int type,
849 goto out; 849 goto out;
850 if (nr_segs > fast_segs) { 850 if (nr_segs > fast_segs) {
851 ret = -ENOMEM; 851 ret = -ENOMEM;
852 iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL); 852 iov = kmalloc_array(nr_segs, sizeof(struct iovec), GFP_KERNEL);
853 if (iov == NULL) 853 if (iov == NULL)
854 goto out; 854 goto out;
855 } 855 }
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 23148c3ed675..358ee2a1ce1a 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2192,10 +2192,12 @@ static int journal_read_transaction(struct super_block *sb,
2192 * now we know we've got a good transaction, and it was 2192 * now we know we've got a good transaction, and it was
2193 * inside the valid time ranges 2193 * inside the valid time ranges
2194 */ 2194 */
2195 log_blocks = kmalloc(get_desc_trans_len(desc) * 2195 log_blocks = kmalloc_array(get_desc_trans_len(desc),
2196 sizeof(struct buffer_head *), GFP_NOFS); 2196 sizeof(struct buffer_head *),
2197 real_blocks = kmalloc(get_desc_trans_len(desc) * 2197 GFP_NOFS);
2198 sizeof(struct buffer_head *), GFP_NOFS); 2198 real_blocks = kmalloc_array(get_desc_trans_len(desc),
2199 sizeof(struct buffer_head *),
2200 GFP_NOFS);
2199 if (!log_blocks || !real_blocks) { 2201 if (!log_blocks || !real_blocks) {
2200 brelse(c_bh); 2202 brelse(c_bh);
2201 brelse(d_bh); 2203 brelse(d_bh);
diff --git a/fs/select.c b/fs/select.c
index bc3cc0f98896..317891ff8165 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -1236,7 +1236,7 @@ static int compat_core_sys_select(int n, compat_ulong_t __user *inp,
1236 size = FDS_BYTES(n); 1236 size = FDS_BYTES(n);
1237 bits = stack_fds; 1237 bits = stack_fds;
1238 if (size > sizeof(stack_fds) / 6) { 1238 if (size > sizeof(stack_fds) / 6) {
1239 bits = kmalloc(6 * size, GFP_KERNEL); 1239 bits = kmalloc_array(6, size, GFP_KERNEL);
1240 ret = -ENOMEM; 1240 ret = -ENOMEM;
1241 if (!bits) 1241 if (!bits)
1242 goto out_nofds; 1242 goto out_nofds;
diff --git a/fs/splice.c b/fs/splice.c
index 005d09cf3fa8..2365ab073a27 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -259,8 +259,9 @@ int splice_grow_spd(const struct pipe_inode_info *pipe, struct splice_pipe_desc
259 if (buffers <= PIPE_DEF_BUFFERS) 259 if (buffers <= PIPE_DEF_BUFFERS)
260 return 0; 260 return 0;
261 261
262 spd->pages = kmalloc(buffers * sizeof(struct page *), GFP_KERNEL); 262 spd->pages = kmalloc_array(buffers, sizeof(struct page *), GFP_KERNEL);
263 spd->partial = kmalloc(buffers * sizeof(struct partial_page), GFP_KERNEL); 263 spd->partial = kmalloc_array(buffers, sizeof(struct partial_page),
264 GFP_KERNEL);
264 265
265 if (spd->pages && spd->partial) 266 if (spd->pages && spd->partial)
266 return 0; 267 return 0;
@@ -395,7 +396,7 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
395 396
396 vec = __vec; 397 vec = __vec;
397 if (nr_pages > PIPE_DEF_BUFFERS) { 398 if (nr_pages > PIPE_DEF_BUFFERS) {
398 vec = kmalloc(nr_pages * sizeof(struct kvec), GFP_KERNEL); 399 vec = kmalloc_array(nr_pages, sizeof(struct kvec), GFP_KERNEL);
399 if (unlikely(!vec)) { 400 if (unlikely(!vec)) {
400 res = -ENOMEM; 401 res = -ENOMEM;
401 goto out; 402 goto out;
diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index 9a517109da0f..d4e45adddf1e 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -628,7 +628,7 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
628 /* Needed by 'ubifs_pack_lsave()' */ 628 /* Needed by 'ubifs_pack_lsave()' */
629 c->main_first = c->leb_cnt - *main_lebs; 629 c->main_first = c->leb_cnt - *main_lebs;
630 630
631 lsave = kmalloc(sizeof(int) * c->lsave_cnt, GFP_KERNEL); 631 lsave = kmalloc_array(c->lsave_cnt, sizeof(int), GFP_KERNEL);
632 pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_KERNEL); 632 pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_KERNEL);
633 nnode = kzalloc(sizeof(struct ubifs_nnode), GFP_KERNEL); 633 nnode = kzalloc(sizeof(struct ubifs_nnode), GFP_KERNEL);
634 buf = vmalloc(c->leb_size); 634 buf = vmalloc(c->leb_size);
@@ -1636,15 +1636,17 @@ static int lpt_init_rd(struct ubifs_info *c)
1636 return -ENOMEM; 1636 return -ENOMEM;
1637 1637
1638 for (i = 0; i < LPROPS_HEAP_CNT; i++) { 1638 for (i = 0; i < LPROPS_HEAP_CNT; i++) {
1639 c->lpt_heap[i].arr = kmalloc(sizeof(void *) * LPT_HEAP_SZ, 1639 c->lpt_heap[i].arr = kmalloc_array(LPT_HEAP_SZ,
1640 GFP_KERNEL); 1640 sizeof(void *),
1641 GFP_KERNEL);
1641 if (!c->lpt_heap[i].arr) 1642 if (!c->lpt_heap[i].arr)
1642 return -ENOMEM; 1643 return -ENOMEM;
1643 c->lpt_heap[i].cnt = 0; 1644 c->lpt_heap[i].cnt = 0;
1644 c->lpt_heap[i].max_cnt = LPT_HEAP_SZ; 1645 c->lpt_heap[i].max_cnt = LPT_HEAP_SZ;
1645 } 1646 }
1646 1647
1647 c->dirty_idx.arr = kmalloc(sizeof(void *) * LPT_HEAP_SZ, GFP_KERNEL); 1648 c->dirty_idx.arr = kmalloc_array(LPT_HEAP_SZ, sizeof(void *),
1649 GFP_KERNEL);
1648 if (!c->dirty_idx.arr) 1650 if (!c->dirty_idx.arr)
1649 return -ENOMEM; 1651 return -ENOMEM;
1650 c->dirty_idx.cnt = 0; 1652 c->dirty_idx.cnt = 0;
@@ -1697,7 +1699,7 @@ static int lpt_init_wr(struct ubifs_info *c)
1697 return -ENOMEM; 1699 return -ENOMEM;
1698 1700
1699 if (c->big_lpt) { 1701 if (c->big_lpt) {
1700 c->lsave = kmalloc(sizeof(int) * c->lsave_cnt, GFP_NOFS); 1702 c->lsave = kmalloc_array(c->lsave_cnt, sizeof(int), GFP_NOFS);
1701 if (!c->lsave) 1703 if (!c->lsave)
1702 return -ENOMEM; 1704 return -ENOMEM;
1703 err = read_lsave(c); 1705 err = read_lsave(c);
@@ -1939,8 +1941,8 @@ int ubifs_lpt_scan_nolock(struct ubifs_info *c, int start_lnum, int end_lnum,
1939 return err; 1941 return err;
1940 } 1942 }
1941 1943
1942 path = kmalloc(sizeof(struct lpt_scan_node) * (c->lpt_hght + 1), 1944 path = kmalloc_array(c->lpt_hght + 1, sizeof(struct lpt_scan_node),
1943 GFP_NOFS); 1945 GFP_NOFS);
1944 if (!path) 1946 if (!path)
1945 return -ENOMEM; 1947 return -ENOMEM;
1946 1948
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 6c397a389105..c5466c70d620 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1196,7 +1196,8 @@ static int mount_ubifs(struct ubifs_info *c)
1196 * never exceed 64. 1196 * never exceed 64.
1197 */ 1197 */
1198 err = -ENOMEM; 1198 err = -ENOMEM;
1199 c->bottom_up_buf = kmalloc(BOTTOM_UP_HEIGHT * sizeof(int), GFP_KERNEL); 1199 c->bottom_up_buf = kmalloc_array(BOTTOM_UP_HEIGHT, sizeof(int),
1200 GFP_KERNEL);
1200 if (!c->bottom_up_buf) 1201 if (!c->bottom_up_buf)
1201 goto out_free; 1202 goto out_free;
1202 1203
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index ba3d0e0f8615..4a21e7f75e7a 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -1104,8 +1104,9 @@ static struct ubifs_znode *dirty_cow_bottom_up(struct ubifs_info *c,
1104 ubifs_assert(znode); 1104 ubifs_assert(znode);
1105 if (c->zroot.znode->level > BOTTOM_UP_HEIGHT) { 1105 if (c->zroot.znode->level > BOTTOM_UP_HEIGHT) {
1106 kfree(c->bottom_up_buf); 1106 kfree(c->bottom_up_buf);
1107 c->bottom_up_buf = kmalloc(c->zroot.znode->level * sizeof(int), 1107 c->bottom_up_buf = kmalloc_array(c->zroot.znode->level,
1108 GFP_NOFS); 1108 sizeof(int),
1109 GFP_NOFS);
1109 if (!c->bottom_up_buf) 1110 if (!c->bottom_up_buf)
1110 return ERR_PTR(-ENOMEM); 1111 return ERR_PTR(-ENOMEM);
1111 path = c->bottom_up_buf; 1112 path = c->bottom_up_buf;
diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
index aa31f60220ef..a9df94ad46a3 100644
--- a/fs/ubifs/tnc_commit.c
+++ b/fs/ubifs/tnc_commit.c
@@ -366,7 +366,8 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
366 366
367 dbg_gc("%d znodes to write", cnt); 367 dbg_gc("%d znodes to write", cnt);
368 368
369 c->gap_lebs = kmalloc(sizeof(int) * (c->lst.idx_lebs + 1), GFP_NOFS); 369 c->gap_lebs = kmalloc_array(c->lst.idx_lebs + 1, sizeof(int),
370 GFP_NOFS);
370 if (!c->gap_lebs) 371 if (!c->gap_lebs)
371 return -ENOMEM; 372 return -ENOMEM;
372 373
@@ -674,7 +675,7 @@ static int alloc_idx_lebs(struct ubifs_info *c, int cnt)
674 dbg_cmt("need about %d empty LEBS for TNC commit", leb_cnt); 675 dbg_cmt("need about %d empty LEBS for TNC commit", leb_cnt);
675 if (!leb_cnt) 676 if (!leb_cnt)
676 return 0; 677 return 0;
677 c->ilebs = kmalloc(leb_cnt * sizeof(int), GFP_NOFS); 678 c->ilebs = kmalloc_array(leb_cnt, sizeof(int), GFP_NOFS);
678 if (!c->ilebs) 679 if (!c->ilebs)
679 return -ENOMEM; 680 return -ENOMEM;
680 for (i = 0; i < leb_cnt; i++) { 681 for (i = 0; i < leb_cnt; i++) {
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 8254b8b3690f..488088141451 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -541,7 +541,9 @@ static int ufs_read_cylinder_structures(struct super_block *sb)
541 * Read cylinder group (we read only first fragment from block 541 * Read cylinder group (we read only first fragment from block
542 * at this time) and prepare internal data structures for cg caching. 542 * at this time) and prepare internal data structures for cg caching.
543 */ 543 */
544 if (!(sbi->s_ucg = kmalloc (sizeof(struct buffer_head *) * uspi->s_ncg, GFP_NOFS))) 544 sbi->s_ucg = kmalloc_array(uspi->s_ncg, sizeof(struct buffer_head *),
545 GFP_NOFS);
546 if (!sbi->s_ucg)
545 goto failed; 547 goto failed;
546 for (i = 0; i < uspi->s_ncg; i++) 548 for (i = 0; i < uspi->s_ncg; i++)
547 sbi->s_ucg[i] = NULL; 549 sbi->s_ucg[i] = NULL;
generated by cgit v1.2.2 (git 2.25.0) at 2025-09-16 22:48:59 -0400