Merge tag 'overflow-v4.18-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull more overflow updates from Kees Cook:
 "The rest of the overflow changes for v4.18-rc1.

  This includes the explicit overflow fixes from Silvio, further
  struct_size() conversions from Matthew, and a bug fix from Dan.

  But the bulk of it is the treewide conversions to use either the
  2-factor argument allocators (e.g. kmalloc(a * b, ...) into
  kmalloc_array(a, b, ...) or the array_size() macros (e.g. vmalloc(a *
  b) into vmalloc(array_size(a, b)).

  Coccinelle was fighting me on several fronts, so I've done a bunch of
  manual whitespace updates in the patches as well.

  Summary:

   - Error path bug fix for overflow tests (Dan)

   - Additional struct_size() conversions (Matthew, Kees)

   - Explicitly reported overflow fixes (Silvio, Kees)

   - Add missing kvcalloc() function (Kees)

   - Treewide conversions of allocators to use either 2-factor argument
     variant when available, or array_size() and array3_size() as needed
     (Kees)"

* tag 'overflow-v4.18-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (26 commits)
  treewide: Use array_size in f2fs_kvzalloc()
  treewide: Use array_size() in f2fs_kzalloc()
  treewide: Use array_size() in f2fs_kmalloc()
  treewide: Use array_size() in sock_kmalloc()
  treewide: Use array_size() in kvzalloc_node()
  treewide: Use array_size() in vzalloc_node()
  treewide: Use array_size() in vzalloc()
  treewide: Use array_size() in vmalloc()
  treewide: devm_kzalloc() -> devm_kcalloc()
  treewide: devm_kmalloc() -> devm_kmalloc_array()
  treewide: kvzalloc() -> kvcalloc()
  treewide: kvmalloc() -> kvmalloc_array()
  treewide: kzalloc_node() -> kcalloc_node()
  treewide: kzalloc() -> kcalloc()
  treewide: kmalloc() -> kmalloc_array()
  mm: Introduce kvcalloc()
  video: uvesafb: Fix integer overflow in allocation
  UBIFS: Fix potential integer overflow in allocation
  leds: Use struct_size() in allocation
  Convert intel uncore to struct_size
  ...

1201 files changed, 3586 insertions, 2796 deletions

diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index b9786f491873..1df21a61e379 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -286,7 +286,7 @@ asmlinkage long sys_oabi_epoll_wait(int epfd,
                 return -EINVAL;
         if (!access_ok(VERIFY_WRITE, events, sizeof(*events) * maxevents))
                 return -EFAULT;
-        kbuf = kmalloc(sizeof(*kbuf) * maxevents, GFP_KERNEL);
+        kbuf = kmalloc_array(maxevents, sizeof(*kbuf), GFP_KERNEL);
         if (!kbuf)
                 return -ENOMEM;
         fs = get_fs();
@@ -324,7 +324,7 @@ asmlinkage long sys_oabi_semtimedop(int semid,
                 return -EINVAL;
         if (!access_ok(VERIFY_READ, tsops, sizeof(*tsops) * nsops))
                 return -EFAULT;
-        sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
+        sops = kmalloc_array(nsops, sizeof(*sops), GFP_KERNEL);
         if (!sops)
                 return -ENOMEM;
         err = 0;
diff --git a/arch/arm/mach-footbridge/dc21285.c b/arch/arm/mach-footbridge/dc21285.c
index e7b350f18f5f..16d71bac0061 100644
--- a/arch/arm/mach-footbridge/dc21285.c
+++ b/arch/arm/mach-footbridge/dc21285.c
@@ -252,7 +252,7 @@ int __init dc21285_setup(int nr, struct pci_sys_data *sys)
         if (nr || !footbridge_cfn_mode())
                 return 0;
 
-        res = kzalloc(sizeof(struct resource) * 2, GFP_KERNEL);
+        res = kcalloc(2, sizeof(struct resource), GFP_KERNEL);
         if (!res) {
                 printk("out of memory for root bus resources");
                 return 0;
diff --git a/arch/arm/mach-ixp4xx/common-pci.c b/arch/arm/mach-ixp4xx/common-pci.c
index bcf3df59f71b..6835b17113e5 100644
--- a/arch/arm/mach-ixp4xx/common-pci.c
+++ b/arch/arm/mach-ixp4xx/common-pci.c
@@ -421,7 +421,7 @@ int ixp4xx_setup(int nr, struct pci_sys_data *sys)
         if (nr >= 1)
                 return 0;
 
-        res = kzalloc(sizeof(*res) * 2, GFP_KERNEL);
+        res = kcalloc(2, sizeof(*res), GFP_KERNEL);
         if (res == NULL) {
                 /* 
                  * If we're out of memory this early, something is wrong,
diff --git a/arch/arm/mach-omap1/mcbsp.c b/arch/arm/mach-omap1/mcbsp.c
index 8ed67f8d1762..27e22e702f96 100644
--- a/arch/arm/mach-omap1/mcbsp.c
+++ b/arch/arm/mach-omap1/mcbsp.c
@@ -389,7 +389,7 @@ static void omap_mcbsp_register_board_cfg(struct resource *res, int res_count,
 {
         int i;
 
-        omap_mcbsp_devices = kzalloc(size * sizeof(struct platform_device *),
+        omap_mcbsp_devices = kcalloc(size, sizeof(struct platform_device *),
                                      GFP_KERNEL);
         if (!omap_mcbsp_devices) {
                 printk(KERN_ERR "Could not register McBSP devices\n");
diff --git a/arch/arm/mach-omap2/hsmmc.c b/arch/arm/mach-omap2/hsmmc.c
index 0103548b0b15..af545193f673 100644
--- a/arch/arm/mach-omap2/hsmmc.c
+++ b/arch/arm/mach-omap2/hsmmc.c
@@ -34,7 +34,7 @@ static int __init omap_hsmmc_pdata_init(struct omap2_hsmmc_info *c,
 {
         char *hc_name;
 
-        hc_name = kzalloc(sizeof(char) * (HSMMC_NAME_LEN + 1), GFP_KERNEL);
+        hc_name = kzalloc(HSMMC_NAME_LEN + 1, GFP_KERNEL);
         if (!hc_name) {
                 kfree(hc_name);
                 return -ENOMEM;
diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
index ac219b9e6a4c..41c7b905980a 100644
--- a/arch/arm/mach-omap2/omap_device.c
+++ b/arch/arm/mach-omap2/omap_device.c
@@ -162,7 +162,7 @@ static int omap_device_build_from_dt(struct platform_device *pdev)
             !omap_hwmod_parse_module_range(NULL, node, &res))
                 return -ENODEV;
 
-        hwmods = kzalloc(sizeof(struct omap_hwmod *) * oh_cnt, GFP_KERNEL);
+        hwmods = kcalloc(oh_cnt, sizeof(struct omap_hwmod *), GFP_KERNEL);
         if (!hwmods) {
                 ret = -ENOMEM;
                 goto odbfd_exit;
@@ -413,7 +413,7 @@ omap_device_copy_resources(struct omap_hwmod *oh,
                 goto error;
         }
 
-        res = kzalloc(sizeof(*res) * 2, GFP_KERNEL);
+        res = kcalloc(2, sizeof(*res), GFP_KERNEL);
         if (!res)
                 return -ENOMEM;
 
diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c
index 021b5a8b9c0a..058a37e6d11c 100644
--- a/arch/arm/mach-omap2/prm_common.c
+++ b/arch/arm/mach-omap2/prm_common.c
@@ -285,10 +285,11 @@ int omap_prcm_register_chain_handler(struct omap_prcm_irq_setup *irq_setup)
 
         prcm_irq_setup = irq_setup;
 
-        prcm_irq_chips = kzalloc(sizeof(void *) * nr_regs, GFP_KERNEL);
-        prcm_irq_setup->saved_mask = kzalloc(sizeof(u32) * nr_regs, GFP_KERNEL);
-        prcm_irq_setup->priority_mask = kzalloc(sizeof(u32) * nr_regs,
-                GFP_KERNEL);
+        prcm_irq_chips = kcalloc(nr_regs, sizeof(void *), GFP_KERNEL);
+        prcm_irq_setup->saved_mask = kcalloc(nr_regs, sizeof(u32),
+                                             GFP_KERNEL);
+        prcm_irq_setup->priority_mask = kcalloc(nr_regs, sizeof(u32),
+                                                GFP_KERNEL);
 
         if (!prcm_irq_chips || !prcm_irq_setup->saved_mask ||
             !prcm_irq_setup->priority_mask)
diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c
index 21c064267af5..0f5381d13494 100644
--- a/arch/arm/mach-vexpress/spc.c
+++ b/arch/arm/mach-vexpress/spc.c
@@ -403,7 +403,7 @@ static int ve_spc_populate_opps(uint32_t cluster)
         uint32_t data = 0, off, ret, idx;
         struct ve_spc_opp *opps;
 
-        opps = kzalloc(sizeof(*opps) * MAX_OPPS, GFP_KERNEL);
+        opps = kcalloc(MAX_OPPS, sizeof(*opps), GFP_KERNEL);
         if (!opps)
                 return -ENOMEM;
 
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index af27f1c22d93..be0fa7e39c26 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -2162,8 +2162,8 @@ arm_iommu_create_mapping(struct bus_type *bus, dma_addr_t base, u64 size)
                 goto err;
 
         mapping->bitmap_size = bitmap_size;
-        mapping->bitmaps = kzalloc(extensions * sizeof(unsigned long *),
-                                GFP_KERNEL);
+        mapping->bitmaps = kcalloc(extensions, sizeof(unsigned long *),
+                                   GFP_KERNEL);
         if (!mapping->bitmaps)
                 goto err2;
 
diff --git a/arch/arm/mm/pgd.c b/arch/arm/mm/pgd.c
index 61e281cb29fb..a1606d950251 100644
--- a/arch/arm/mm/pgd.c
+++ b/arch/arm/mm/pgd.c
@@ -20,7 +20,7 @@
 #include "mm.h"
 
 #ifdef CONFIG_ARM_LPAE
-#define __pgd_alloc()   kmalloc(PTRS_PER_PGD * sizeof(pgd_t), GFP_KERNEL)
+#define __pgd_alloc()   kmalloc_array(PTRS_PER_PGD, sizeof(pgd_t), GFP_KERNEL)
 #define __pgd_free(pgd) kfree(pgd)
 #else
 #define __pgd_alloc()   (pgd_t *)__get_free_pages(GFP_KERNEL, 2)
diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c
index 9ed0129bed3c..14db14152909 100644
--- a/arch/arm/probes/kprobes/test-core.c
+++ b/arch/arm/probes/kprobes/test-core.c
@@ -766,8 +766,9 @@ static int coverage_start_fn(const struct decode_header *h, void *args)
 
 static int coverage_start(const union decode_item *table)
 {
-        coverage.base = kmalloc(MAX_COVERAGE_ENTRIES *
-                                sizeof(struct coverage_entry), GFP_KERNEL);
+        coverage.base = kmalloc_array(MAX_COVERAGE_ENTRIES,
+                                      sizeof(struct coverage_entry),
+                                      GFP_KERNEL);
         coverage.num_entries = 0;
         coverage.nesting = 0;
         return table_iter(table, coverage_start_fn, &coverage);
diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index 97d45d5151d4..d4707abb2f16 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -234,8 +234,8 @@ static void __init register_insn_emulation_sysctl(void)
         struct insn_emulation *insn;
         struct ctl_table *insns_sysctl, *sysctl;
 
-        insns_sysctl = kzalloc(sizeof(*sysctl) * (nr_insn_emulated + 1),
-                              GFP_KERNEL);
+        insns_sysctl = kcalloc(nr_insn_emulated + 1, sizeof(*sysctl),
+                               GFP_KERNEL);
 
         raw_spin_lock_irqsave(&insn_emulation_lock, flags);
         list_for_each_entry(insn, &insn_emulation, node) {
diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
index 301417ae2ba8..c127f94da8e2 100644
--- a/arch/arm64/mm/context.c
+++ b/arch/arm64/mm/context.c
@@ -263,7 +263,7 @@ static int asids_init(void)
          */
         WARN_ON(NUM_USER_ASIDS - 1 <= num_possible_cpus());
         atomic64_set(&asid_generation, ASID_FIRST_VERSION);
-        asid_map = kzalloc(BITS_TO_LONGS(NUM_USER_ASIDS) * sizeof(*asid_map),
+        asid_map = kcalloc(BITS_TO_LONGS(NUM_USER_ASIDS), sizeof(*asid_map),
                            GFP_KERNEL);
         if (!asid_map)
                 panic("Failed to allocate bitmap for %lu ASIDs\n",
diff --git a/arch/ia64/kernel/mca_drv.c b/arch/ia64/kernel/mca_drv.c
index 94f8bf777afa..dfe40cbdf3b3 100644
--- a/arch/ia64/kernel/mca_drv.c
+++ b/arch/ia64/kernel/mca_drv.c
@@ -350,7 +350,8 @@ init_record_index_pools(void)
         /* - 3 - */
         slidx_pool.max_idx = (rec_max_size/sect_min_size) * 2 + 1;
         slidx_pool.buffer =
-                kmalloc(slidx_pool.max_idx * sizeof(slidx_list_t), GFP_KERNEL);
+                kmalloc_array(slidx_pool.max_idx, sizeof(slidx_list_t),
+                              GFP_KERNEL);
 
         return slidx_pool.buffer ? 0 : -ENOMEM;
 }
diff --git a/arch/ia64/kernel/topology.c b/arch/ia64/kernel/topology.c
index d76529cbff20..9b820f7a6a98 100644
--- a/arch/ia64/kernel/topology.c
+++ b/arch/ia64/kernel/topology.c
@@ -85,7 +85,7 @@ static int __init topology_init(void)
         }
 #endif
 
-        sysfs_cpus = kzalloc(sizeof(struct ia64_cpu) * NR_CPUS, GFP_KERNEL);
+        sysfs_cpus = kcalloc(NR_CPUS, sizeof(struct ia64_cpu), GFP_KERNEL);
         if (!sysfs_cpus)
                 panic("kzalloc in topology_init failed - NR_CPUS too big?");
 
@@ -319,8 +319,8 @@ static int cpu_cache_sysfs_init(unsigned int cpu)
                 return -1;
         }
 
-        this_cache=kzalloc(sizeof(struct cache_info)*unique_caches,
-                        GFP_KERNEL);
+        this_cache=kcalloc(unique_caches, sizeof(struct cache_info),
+                           GFP_KERNEL);
         if (this_cache == NULL)
                 return -ENOMEM;
 
diff --git a/arch/ia64/mm/tlb.c b/arch/ia64/mm/tlb.c
index 46ecc5d948aa..acf10eb9da15 100644
--- a/arch/ia64/mm/tlb.c
+++ b/arch/ia64/mm/tlb.c
@@ -430,8 +430,9 @@ int ia64_itr_entry(u64 target_mask, u64 va, u64 pte, u64 log_size)
         int cpu = smp_processor_id();
 
         if (!ia64_idtrs[cpu]) {
-                ia64_idtrs[cpu] = kmalloc(2 * IA64_TR_ALLOC_MAX *
-                                sizeof (struct ia64_tr_entry), GFP_KERNEL);
+                ia64_idtrs[cpu] = kmalloc_array(2 * IA64_TR_ALLOC_MAX,
+                                                sizeof(struct ia64_tr_entry),
+                                                GFP_KERNEL);
                 if (!ia64_idtrs[cpu])
                         return -ENOMEM;
         }
diff --git a/arch/ia64/sn/kernel/io_common.c b/arch/ia64/sn/kernel/io_common.c
index 8479e9a7ce16..102aabad6d20 100644
--- a/arch/ia64/sn/kernel/io_common.c
+++ b/arch/ia64/sn/kernel/io_common.c
@@ -132,7 +132,7 @@ static s64 sn_device_fixup_war(u64 nasid, u64 widget, int device,
         printk_once(KERN_WARNING
                 "PROM version < 4.50 -- implementing old PROM flush WAR\n");
 
-        war_list = kzalloc(DEV_PER_WIDGET * sizeof(*war_list), GFP_KERNEL);
+        war_list = kcalloc(DEV_PER_WIDGET, sizeof(*war_list), GFP_KERNEL);
         BUG_ON(!war_list);
 
         SAL_CALL_NOLOCK(isrv, SN_SAL_IOIF_GET_WIDGET_DMAFLUSH_LIST,
diff --git a/arch/ia64/sn/kernel/irq.c b/arch/ia64/sn/kernel/irq.c
index 85d095154902..d9b576df4f82 100644
--- a/arch/ia64/sn/kernel/irq.c
+++ b/arch/ia64/sn/kernel/irq.c
@@ -474,7 +474,8 @@ void __init sn_irq_lh_init(void)
 {
         int i;
 
-        sn_irq_lh = kmalloc(sizeof(struct list_head *) * NR_IRQS, GFP_KERNEL);
+        sn_irq_lh = kmalloc_array(NR_IRQS, sizeof(struct list_head *),
+                                  GFP_KERNEL);
         if (!sn_irq_lh)
                 panic("SN PCI INIT: Failed to allocate memory for PCI init\n");
 
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_provider.c b/arch/ia64/sn/pci/pcibr/pcibr_provider.c
index 8dbbef4a4f47..7195df1da121 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_provider.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_provider.c
@@ -184,7 +184,7 @@ pcibr_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *cont
         /* Setup the PMU ATE map */
         soft->pbi_int_ate_resource.lowest_free_index = 0;
         soft->pbi_int_ate_resource.ate =
-            kzalloc(soft->pbi_int_ate_size * sizeof(u64), GFP_KERNEL);
+            kcalloc(soft->pbi_int_ate_size, sizeof(u64), GFP_KERNEL);
 
         if (!soft->pbi_int_ate_resource.ate) {
                 kfree(soft);
diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
index 6b6f6851df92..d129475fd40d 100644
--- a/arch/mips/alchemy/common/clock.c
+++ b/arch/mips/alchemy/common/clock.c
@@ -985,7 +985,7 @@ static int __init alchemy_clk_setup_imux(int ctype)
                 return -ENODEV;
         }
 
-        a = kzalloc((sizeof(*a)) * 6, GFP_KERNEL);
+        a = kcalloc(6, sizeof(*a), GFP_KERNEL);
         if (!a)
                 return -ENOMEM;
 
diff --git a/arch/mips/alchemy/common/dbdma.c b/arch/mips/alchemy/common/dbdma.c
index fc482d900ddd..4ca2c28878e0 100644
--- a/arch/mips/alchemy/common/dbdma.c
+++ b/arch/mips/alchemy/common/dbdma.c
@@ -411,8 +411,8 @@ u32 au1xxx_dbdma_ring_alloc(u32 chanid, int entries)
          * and if we try that first we are likely to not waste larger
          * slabs of memory.
          */
-        desc_base = (u32)kmalloc(entries * sizeof(au1x_ddma_desc_t),
-                                 GFP_KERNEL|GFP_DMA);
+        desc_base = (u32)kmalloc_array(entries, sizeof(au1x_ddma_desc_t),
+                                       GFP_KERNEL|GFP_DMA);
         if (desc_base == 0)
                 return 0;
 
@@ -1050,7 +1050,7 @@ static int __init dbdma_setup(unsigned int irq, dbdev_tab_t *idtable)
 {
         int ret;
 
-        dbdev_tab = kzalloc(sizeof(dbdev_tab_t) * DBDEV_TAB_SIZE, GFP_KERNEL);
+        dbdev_tab = kcalloc(DBDEV_TAB_SIZE, sizeof(dbdev_tab_t), GFP_KERNEL);
         if (!dbdev_tab)
                 return -ENOMEM;
 
diff --git a/arch/mips/alchemy/common/platform.c b/arch/mips/alchemy/common/platform.c
index d77a64f4c78b..1454d9f6ab2d 100644
--- a/arch/mips/alchemy/common/platform.c
+++ b/arch/mips/alchemy/common/platform.c
@@ -115,7 +115,7 @@ static void __init alchemy_setup_uarts(int ctype)
         uartclk = clk_get_rate(clk);
         clk_put(clk);
 
-        ports = kzalloc(s * (c + 1), GFP_KERNEL);
+        ports = kcalloc(s, (c + 1), GFP_KERNEL);
         if (!ports) {
                 printk(KERN_INFO "Alchemy: no memory for UART data\n");
                 return;
@@ -198,7 +198,7 @@ static unsigned long alchemy_ehci_data[][2] __initdata = {
 
 static int __init _new_usbres(struct resource **r, struct platform_device **d)
 {
-        *r = kzalloc(sizeof(struct resource) * 2, GFP_KERNEL);
+        *r = kcalloc(2, sizeof(struct resource), GFP_KERNEL);
         if (!*r)
                 return -ENOMEM;
         *d = kzalloc(sizeof(struct platform_device), GFP_KERNEL);
diff --git a/arch/mips/alchemy/devboards/platform.c b/arch/mips/alchemy/devboards/platform.c
index 4640edab207c..203854ddd1bb 100644
--- a/arch/mips/alchemy/devboards/platform.c
+++ b/arch/mips/alchemy/devboards/platform.c
@@ -103,7 +103,7 @@ int __init db1x_register_pcmcia_socket(phys_addr_t pcmcia_attr_start,
         if (stschg_irq)
                 cnt++;
 
-        sr = kzalloc(sizeof(struct resource) * cnt, GFP_KERNEL);
+        sr = kcalloc(cnt, sizeof(struct resource), GFP_KERNEL);
         if (!sr)
                 return -ENOMEM;
 
@@ -178,7 +178,7 @@ int __init db1x_register_norflash(unsigned long size, int width,
                 return -EINVAL;
 
         ret = -ENOMEM;
-        parts = kzalloc(sizeof(struct mtd_partition) * 5, GFP_KERNEL);
+        parts = kcalloc(5, sizeof(struct mtd_partition), GFP_KERNEL);
         if (!parts)
                 goto out;
 
diff --git a/arch/mips/bmips/dma.c b/arch/mips/bmips/dma.c
index 04790f4e1805..6dec30842b2f 100644
--- a/arch/mips/bmips/dma.c
+++ b/arch/mips/bmips/dma.c
@@ -94,7 +94,7 @@ static int __init bmips_init_dma_ranges(void)
                 goto out_bad;
 
         /* add a dummy (zero) entry at the end as a sentinel */
-        bmips_dma_ranges = kzalloc(sizeof(struct bmips_dma_range) * (len + 1),
+        bmips_dma_ranges = kcalloc(len + 1, sizeof(struct bmips_dma_range),
                                    GFP_KERNEL);
         if (!bmips_dma_ranges)
                 goto out_bad;
diff --git a/arch/mips/txx9/rbtx4939/setup.c b/arch/mips/txx9/rbtx4939/setup.c
index fd26fadc8617..ef29a9c2ffd6 100644
--- a/arch/mips/txx9/rbtx4939/setup.c
+++ b/arch/mips/txx9/rbtx4939/setup.c
@@ -219,7 +219,7 @@ static int __init rbtx4939_led_probe(struct platform_device *pdev)
                 "nand-disk",
         };
 
-        leds_data = kzalloc(sizeof(*leds_data) * RBTX4939_MAX_7SEGLEDS,
+        leds_data = kcalloc(RBTX4939_MAX_7SEGLEDS, sizeof(*leds_data),
                             GFP_KERNEL);
         if (!leds_data)
                 return -ENOMEM;
diff --git a/arch/powerpc/kernel/rtasd.c b/arch/powerpc/kernel/rtasd.c
index f915db93cd42..44d66c33d59d 100644
--- a/arch/powerpc/kernel/rtasd.c
+++ b/arch/powerpc/kernel/rtasd.c
@@ -559,7 +559,8 @@ static int __init rtas_event_scan_init(void)
         rtas_error_log_max = rtas_get_error_log_max();
         rtas_error_log_buffer_max = rtas_error_log_max + sizeof(int);
 
-        rtas_log_buf = vmalloc(rtas_error_log_buffer_max*LOG_NUMBER);
+        rtas_log_buf = vmalloc(array_size(LOG_NUMBER,
+                                          rtas_error_log_buffer_max));
         if (!rtas_log_buf) {
                 printk(KERN_ERR "rtasd: no memory\n");
                 return -ENOMEM;
diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index b44ec104a5a1..d2205b97628c 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -791,7 +791,7 @@ static int __init vdso_init(void)
 
 #ifdef CONFIG_VDSO32
         /* Make sure pages are in the correct state */
-        vdso32_pagelist = kzalloc(sizeof(struct page *) * (vdso32_pages + 2),
+        vdso32_pagelist = kcalloc(vdso32_pages + 2, sizeof(struct page *),
                                   GFP_KERNEL);
         BUG_ON(vdso32_pagelist == NULL);
         for (i = 0; i < vdso32_pages; i++) {
@@ -805,7 +805,7 @@ static int __init vdso_init(void)
 #endif
 
 #ifdef CONFIG_PPC64
-        vdso64_pagelist = kzalloc(sizeof(struct page *) * (vdso64_pages + 2),
+        vdso64_pagelist = kcalloc(vdso64_pages + 2, sizeof(struct page *),
                                   GFP_KERNEL);
         BUG_ON(vdso64_pagelist == NULL);
         for (i = 0; i < vdso64_pages; i++) {
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index a670fa5fbe50..1b3fcafc685e 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -108,7 +108,7 @@ int kvmppc_allocate_hpt(struct kvm_hpt_info *info, u32 order)
         npte = 1ul << (order - 4);
 
         /* Allocate reverse map array */
-        rev = vmalloc(sizeof(struct revmap_entry) * npte);
+        rev = vmalloc(array_size(npte, sizeof(struct revmap_entry)));
         if (!rev) {
                 if (cma)
                         kvm_free_hpt_cma(page, 1 << (order - PAGE_SHIFT));
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 69895597736a..8858ab8b6ca4 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -3548,7 +3548,7 @@ static void kvmppc_core_free_memslot_hv(struct kvm_memory_slot *free,
 static int kvmppc_core_create_memslot_hv(struct kvm_memory_slot *slot,
                                          unsigned long npages)
 {
-        slot->arch.rmap = vzalloc(npages * sizeof(*slot->arch.rmap));
+        slot->arch.rmap = vzalloc(array_size(npages, sizeof(*slot->arch.rmap)));
         if (!slot->arch.rmap)
                 return -ENOMEM;
 
diff --git a/arch/powerpc/lib/rheap.c b/arch/powerpc/lib/rheap.c
index 94058c21a482..6aa774aa5b16 100644
--- a/arch/powerpc/lib/rheap.c
+++ b/arch/powerpc/lib/rheap.c
@@ -54,7 +54,7 @@ static int grow(rh_info_t * info, int max_blocks)
 
         new_blocks = max_blocks - info->max_blocks;
 
-        block = kmalloc(sizeof(rh_block_t) * max_blocks, GFP_ATOMIC);
+        block = kmalloc_array(max_blocks, sizeof(rh_block_t), GFP_ATOMIC);
         if (block == NULL)
                 return -ENOMEM;
 
diff --git a/arch/powerpc/mm/mmu_context_iommu.c b/arch/powerpc/mm/mmu_context_iommu.c
index 4c615fcb0cf0..abb43646927a 100644
--- a/arch/powerpc/mm/mmu_context_iommu.c
+++ b/arch/powerpc/mm/mmu_context_iommu.c
@@ -159,7 +159,7 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
                 goto unlock_exit;
         }
 
-        mem->hpas = vzalloc(entries * sizeof(mem->hpas[0]));
+        mem->hpas = vzalloc(array_size(entries, sizeof(mem->hpas[0])));
         if (!mem->hpas) {
                 kfree(mem);
                 ret = -ENOMEM;
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 57a5029b4521..0c7e05d89244 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1316,7 +1316,7 @@ int numa_update_cpu_topology(bool cpus_locked)
         if (!weight)
                 return 0;
 
-        updates = kzalloc(weight * (sizeof(*updates)), GFP_KERNEL);
+        updates = kcalloc(weight, sizeof(*updates), GFP_KERNEL);
         if (!updates)
                 return 0;
 
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index a9636d8cba15..5b061fc81df3 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -566,7 +566,7 @@ void bpf_jit_compile(struct bpf_prog *fp)
         if (!bpf_jit_enable)
                 return;
 
-        addrs = kzalloc((flen+1) * sizeof(*addrs), GFP_KERNEL);
+        addrs = kcalloc(flen + 1, sizeof(*addrs), GFP_KERNEL);
         if (addrs == NULL)
                 return;
 
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index f1c95779843b..380cbf9a40d9 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -949,7 +949,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
                 goto skip_init_ctx;
         }
 
-        addrs = kzalloc((flen+1) * sizeof(*addrs), GFP_KERNEL);
+        addrs = kcalloc(flen + 1, sizeof(*addrs), GFP_KERNEL);
         if (addrs == NULL) {
                 fp = org_fp;
                 goto out_addrs;
diff --git a/arch/powerpc/oprofile/cell/spu_profiler.c b/arch/powerpc/oprofile/cell/spu_profiler.c
index 5182f2936af2..4e099e556645 100644
--- a/arch/powerpc/oprofile/cell/spu_profiler.c
+++ b/arch/powerpc/oprofile/cell/spu_profiler.c
@@ -210,8 +210,8 @@ int start_spu_profiling_cycles(unsigned int cycles_reset)
         timer.function = profile_spus;
 
         /* Allocate arrays for collecting SPU PC samples */
-        samples = kzalloc(SPUS_PER_NODE *
-                          TRACE_ARRAY_SIZE * sizeof(u32), GFP_KERNEL);
+        samples = kcalloc(SPUS_PER_NODE * TRACE_ARRAY_SIZE, sizeof(u32),
+                          GFP_KERNEL);
 
         if (!samples)
                 return -ENOMEM;
diff --git a/arch/powerpc/platforms/4xx/hsta_msi.c b/arch/powerpc/platforms/4xx/hsta_msi.c
index 9926ad67af76..1c18f2955f7d 100644
--- a/arch/powerpc/platforms/4xx/hsta_msi.c
+++ b/arch/powerpc/platforms/4xx/hsta_msi.c
@@ -156,7 +156,8 @@ static int hsta_msi_probe(struct platform_device *pdev)
         if (ret)
                 goto out;
 
-        ppc4xx_hsta_msi.irq_map = kmalloc(sizeof(int) * irq_count, GFP_KERNEL);
+        ppc4xx_hsta_msi.irq_map = kmalloc_array(irq_count, sizeof(int),
+                                                GFP_KERNEL);
         if (!ppc4xx_hsta_msi.irq_map) {
                 ret = -ENOMEM;
                 goto out1;
diff --git a/arch/powerpc/platforms/4xx/msi.c b/arch/powerpc/platforms/4xx/msi.c
index 96aaae678928..81b2cbce7df8 100644
--- a/arch/powerpc/platforms/4xx/msi.c
+++ b/arch/powerpc/platforms/4xx/msi.c
@@ -89,7 +89,7 @@ static int ppc4xx_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
         if (type == PCI_CAP_ID_MSIX)
                 pr_debug("ppc4xx msi: MSI-X untested, trying anyway.\n");
 
-        msi_data->msi_virqs = kmalloc((msi_irqs) * sizeof(int), GFP_KERNEL);
+        msi_data->msi_virqs = kmalloc_array(msi_irqs, sizeof(int), GFP_KERNEL);
         if (!msi_data->msi_virqs)
                 return -ENOMEM;
 
diff --git a/arch/powerpc/platforms/4xx/pci.c b/arch/powerpc/platforms/4xx/pci.c
index 73e6b36bcd51..5aca523551ae 100644
--- a/arch/powerpc/platforms/4xx/pci.c
+++ b/arch/powerpc/platforms/4xx/pci.c
@@ -1449,7 +1449,7 @@ static int __init ppc4xx_pciex_check_core_init(struct device_node *np)
         count = ppc4xx_pciex_hwops->core_init(np);
         if (count > 0) {
                 ppc4xx_pciex_ports =
-                       kzalloc(count * sizeof(struct ppc4xx_pciex_port),
+                       kcalloc(count, sizeof(struct ppc4xx_pciex_port),
                                GFP_KERNEL);
                 if (ppc4xx_pciex_ports) {
                         ppc4xx_pciex_port_count = count;
diff --git a/arch/powerpc/platforms/powernv/opal-sysparam.c b/arch/powerpc/platforms/powernv/opal-sysparam.c
index 6fd4092798d5..9aa87df114fd 100644
--- a/arch/powerpc/platforms/powernv/opal-sysparam.c
+++ b/arch/powerpc/platforms/powernv/opal-sysparam.c
@@ -198,21 +198,21 @@ void __init opal_sys_param_init(void)
                 goto out_param_buf;
         }
 
-        id = kzalloc(sizeof(*id) * count, GFP_KERNEL);
+        id = kcalloc(count, sizeof(*id), GFP_KERNEL);
         if (!id) {
                 pr_err("SYSPARAM: Failed to allocate memory to read parameter "
                                 "id\n");
                 goto out_param_buf;
         }
 
-        size = kzalloc(sizeof(*size) * count, GFP_KERNEL);
+        size = kcalloc(count, sizeof(*size), GFP_KERNEL);
         if (!size) {
                 pr_err("SYSPARAM: Failed to allocate memory to read parameter "
                                 "size\n");
                 goto out_free_id;
         }
 
-        perm = kzalloc(sizeof(*perm) * count, GFP_KERNEL);
+        perm = kcalloc(count, sizeof(*perm), GFP_KERNEL);
         if (!perm) {
                 pr_err("SYSPARAM: Failed to allocate memory to read supported "
                                 "action on the parameter");
@@ -235,7 +235,7 @@ void __init opal_sys_param_init(void)
                 goto out_free_perm;
         }
 
-        attr = kzalloc(sizeof(*attr) * count, GFP_KERNEL);
+        attr = kcalloc(count, sizeof(*attr), GFP_KERNEL);
         if (!attr) {
                 pr_err("SYSPARAM: Failed to allocate memory for parameter "
                                 "attributes\n");
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 1d4e0ef658d3..353b43972bbf 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -544,7 +544,7 @@ static void __init mpic_scan_ht_pics(struct mpic *mpic)
         printk(KERN_INFO "mpic: Setting up HT PICs workarounds for U3/U4\n");
 
         /* Allocate fixups array */
-        mpic->fixups = kzalloc(128 * sizeof(*mpic->fixups), GFP_KERNEL);
+        mpic->fixups = kcalloc(128, sizeof(*mpic->fixups), GFP_KERNEL);
         BUG_ON(mpic->fixups == NULL);
 
         /* Init spinlock */
@@ -1324,7 +1324,7 @@ struct mpic * __init mpic_alloc(struct device_node *node,
         if (psrc) {
                 /* Allocate a bitmap with one bit per interrupt */
                 unsigned int mapsize = BITS_TO_LONGS(intvec_top + 1);
-                mpic->protected = kzalloc(mapsize*sizeof(long), GFP_KERNEL);
+                mpic->protected = kcalloc(mapsize, sizeof(long), GFP_KERNEL);
                 BUG_ON(mpic->protected == NULL);
                 for (i = 0; i < psize/sizeof(u32); i++) {
                         if (psrc[i] > intvec_top)
@@ -1639,8 +1639,9 @@ void __init mpic_init(struct mpic *mpic)
 
 #ifdef CONFIG_PM
         /* allocate memory to save mpic state */
-        mpic->save_data = kmalloc(mpic->num_sources * sizeof(*mpic->save_data),
-                                  GFP_KERNEL);
+        mpic->save_data = kmalloc_array(mpic->num_sources,
+                                        sizeof(*mpic->save_data),
+                                        GFP_KERNEL);
         BUG_ON(mpic->save_data == NULL);
 #endif
 
diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
index 83bcd72b21cf..311185b9960a 100644
--- a/arch/powerpc/sysdev/xive/native.c
+++ b/arch/powerpc/sysdev/xive/native.c
@@ -489,7 +489,7 @@ static bool xive_parse_provisioning(struct device_node *np)
         if (rc == 0)
                 return true;
 
-        xive_provision_chips = kzalloc(4 * xive_provision_chip_count,
+        xive_provision_chips = kcalloc(4, xive_provision_chip_count,
                                        GFP_KERNEL);
         if (WARN_ON(!xive_provision_chips))
                 return false;
diff --git a/arch/s390/appldata/appldata_base.c b/arch/s390/appldata/appldata_base.c
index cb6e8066b1ad..ee6a9c387c87 100644
--- a/arch/s390/appldata/appldata_base.c
+++ b/arch/s390/appldata/appldata_base.c
@@ -391,7 +391,7 @@ int appldata_register_ops(struct appldata_ops *ops)
         if (ops->size > APPLDATA_MAX_REC_SIZE)
                 return -EINVAL;
 
-        ops->ctl_table = kzalloc(4 * sizeof(struct ctl_table), GFP_KERNEL);
+        ops->ctl_table = kcalloc(4, sizeof(struct ctl_table), GFP_KERNEL);
         if (!ops->ctl_table)
                 return -ENOMEM;
 
diff --git a/arch/s390/hypfs/hypfs_diag.c b/arch/s390/hypfs/hypfs_diag.c
index be8cc53204b5..a2945b289a29 100644
--- a/arch/s390/hypfs/hypfs_diag.c
+++ b/arch/s390/hypfs/hypfs_diag.c
@@ -239,7 +239,7 @@ static void *page_align_ptr(void *ptr)
 static void *diag204_alloc_vbuf(int pages)
 {
         /* The buffer has to be page aligned! */
-        diag204_buf_vmalloc = vmalloc(PAGE_SIZE * (pages + 1));
+        diag204_buf_vmalloc = vmalloc(array_size(PAGE_SIZE, (pages + 1)));
         if (!diag204_buf_vmalloc)
                 return ERR_PTR(-ENOMEM);
         diag204_buf = page_align_ptr(diag204_buf_vmalloc);
diff --git a/arch/s390/hypfs/hypfs_diag0c.c b/arch/s390/hypfs/hypfs_diag0c.c
index dce87f1bec94..cebf05150cc1 100644
--- a/arch/s390/hypfs/hypfs_diag0c.c
+++ b/arch/s390/hypfs/hypfs_diag0c.c
@@ -49,7 +49,8 @@ static void *diag0c_store(unsigned int *count)
 
         get_online_cpus();
         cpu_count = num_online_cpus();
-        cpu_vec = kmalloc(sizeof(*cpu_vec) * num_possible_cpus(), GFP_KERNEL);
+        cpu_vec = kmalloc_array(num_possible_cpus(), sizeof(*cpu_vec),
+                                GFP_KERNEL);
         if (!cpu_vec)
                 goto fail_put_online_cpus;
         /* Note: Diag 0c needs 8 byte alignment and real storage */
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index 80e974adb9e8..d374f9b218b4 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -194,11 +194,13 @@ static debug_entry_t ***debug_areas_alloc(int pages_per_area, int nr_areas)
         debug_entry_t ***areas;
         int i, j;
 
-        areas = kmalloc(nr_areas * sizeof(debug_entry_t **), GFP_KERNEL);
+        areas = kmalloc_array(nr_areas, sizeof(debug_entry_t **), GFP_KERNEL);
         if (!areas)
                 goto fail_malloc_areas;
         for (i = 0; i < nr_areas; i++) {
-                areas[i] = kmalloc(pages_per_area * sizeof(debug_entry_t *), GFP_KERNEL);
+                areas[i] = kmalloc_array(pages_per_area,
+                                         sizeof(debug_entry_t *),
+                                         GFP_KERNEL);
                 if (!areas[i])
                         goto fail_malloc_areas2;
                 for (j = 0; j < pages_per_area; j++) {
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 0dc8ac8548ee..d298d3cb46d0 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -123,8 +123,8 @@ int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
 
         /* Allocate one syminfo structure per symbol. */
         me->arch.nsyms = symtab->sh_size / sizeof(Elf_Sym);
-        me->arch.syminfo = vmalloc(me->arch.nsyms *
-                                   sizeof(struct mod_arch_syminfo));
+        me->arch.syminfo = vmalloc(array_size(sizeof(struct mod_arch_syminfo),
+                                              me->arch.nsyms));
         if (!me->arch.syminfo)
                 return -ENOMEM;
         symbols = (void *) hdr + symtab->sh_offset;
diff --git a/arch/s390/kernel/perf_cpum_cf_events.c b/arch/s390/kernel/perf_cpum_cf_events.c
index feebb2944882..d63fb3c56b8a 100644
--- a/arch/s390/kernel/perf_cpum_cf_events.c
+++ b/arch/s390/kernel/perf_cpum_cf_events.c
@@ -527,7 +527,7 @@ static __init struct attribute **merge_attr(struct attribute **a,
                 j++;
         j++;
 
-        new = kmalloc(sizeof(struct attribute *) * j, GFP_KERNEL);
+        new = kmalloc_array(j, sizeof(struct attribute *), GFP_KERNEL);
         if (!new)
                 return NULL;
         j = 0;
diff --git a/arch/s390/kernel/sthyi.c b/arch/s390/kernel/sthyi.c
index 80b862e9c53c..0859cde36f75 100644
--- a/arch/s390/kernel/sthyi.c
+++ b/arch/s390/kernel/sthyi.c
@@ -315,7 +315,7 @@ static void fill_diag(struct sthyi_sctns *sctns)
         if (pages <= 0)
                 return;
 
-        diag204_buf = vmalloc(PAGE_SIZE * pages);
+        diag204_buf = vmalloc(array_size(pages, PAGE_SIZE));
         if (!diag204_buf)
                 return;
 
diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
index f3a1c7c6824e..09abae40f917 100644
--- a/arch/s390/kernel/vdso.c
+++ b/arch/s390/kernel/vdso.c
@@ -285,7 +285,7 @@ static int __init vdso_init(void)
                          + PAGE_SIZE - 1) >> PAGE_SHIFT) + 1;
 
         /* Make sure pages are in the correct state */
-        vdso32_pagelist = kzalloc(sizeof(struct page *) * (vdso32_pages + 1),
+        vdso32_pagelist = kcalloc(vdso32_pages + 1, sizeof(struct page *),
                                   GFP_KERNEL);
         BUG_ON(vdso32_pagelist == NULL);
         for (i = 0; i < vdso32_pages - 1; i++) {
@@ -303,7 +303,7 @@ static int __init vdso_init(void)
                          + PAGE_SIZE - 1) >> PAGE_SHIFT) + 1;
 
         /* Make sure pages are in the correct state */
-        vdso64_pagelist = kzalloc(sizeof(struct page *) * (vdso64_pages + 1),
+        vdso64_pagelist = kcalloc(vdso64_pages + 1, sizeof(struct page *),
                                   GFP_KERNEL);
         BUG_ON(vdso64_pagelist == NULL);
         for (i = 0; i < vdso64_pages - 1; i++) {
diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
index 8e2b8647ee12..07d30ffcfa41 100644
--- a/arch/s390/kvm/gaccess.c
+++ b/arch/s390/kvm/gaccess.c
@@ -847,7 +847,7 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data,
         nr_pages = (((ga & ~PAGE_MASK) + len - 1) >> PAGE_SHIFT) + 1;
         pages = pages_array;
         if (nr_pages > ARRAY_SIZE(pages_array))
-                pages = vmalloc(nr_pages * sizeof(unsigned long));
+                pages = vmalloc(array_size(nr_pages, sizeof(unsigned long)));
         if (!pages)
                 return -ENOMEM;
         need_ipte_lock = psw_bits(*psw).dat && !asce.r;
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 7142508ca6e1..3b7a5151b6a5 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -1729,7 +1729,7 @@ static int kvm_s390_set_cmma_bits(struct kvm *kvm,
         if (args->count == 0)
                 return 0;
 
-        bits = vmalloc(sizeof(*bits) * args->count);
+        bits = vmalloc(array_size(sizeof(*bits), args->count));
         if (!bits)
                 return -ENOMEM;
 
diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c
index 920d40894535..6ad15d3fab81 100644
--- a/arch/s390/mm/extmem.c
+++ b/arch/s390/mm/extmem.c
@@ -103,7 +103,7 @@ static int scode_set;
 static int
 dcss_set_subcodes(void)
 {
-        char *name = kmalloc(8 * sizeof(char), GFP_KERNEL | GFP_DMA);
+        char *name = kmalloc(8, GFP_KERNEL | GFP_DMA);
         unsigned long rx, ry;
         int rc;
 
diff --git a/arch/sh/drivers/dma/dmabrg.c b/arch/sh/drivers/dma/dmabrg.c
index c0dd904483c7..e5a57a109d6c 100644
--- a/arch/sh/drivers/dma/dmabrg.c
+++ b/arch/sh/drivers/dma/dmabrg.c
@@ -154,7 +154,7 @@ static int __init dmabrg_init(void)
         unsigned long or;
         int ret;
 
-        dmabrg_handlers = kzalloc(10 * sizeof(struct dmabrg_handler),
+        dmabrg_handlers = kcalloc(10, sizeof(struct dmabrg_handler),
                                   GFP_KERNEL);
         if (!dmabrg_handlers)
                 return -ENOMEM;
diff --git a/arch/sh/drivers/pci/pcie-sh7786.c b/arch/sh/drivers/pci/pcie-sh7786.c
index 382e7ecf4c82..3d81a8b80942 100644
--- a/arch/sh/drivers/pci/pcie-sh7786.c
+++ b/arch/sh/drivers/pci/pcie-sh7786.c
@@ -561,7 +561,7 @@ static int __init sh7786_pcie_init(void)
         if (unlikely(nr_ports == 0))
                 return -ENODEV;
 
-        sh7786_pcie_ports = kzalloc(nr_ports * sizeof(struct sh7786_pcie_port),
+        sh7786_pcie_ports = kcalloc(nr_ports, sizeof(struct sh7786_pcie_port),
                                     GFP_KERNEL);
         if (unlikely(!sh7786_pcie_ports))
                 return -ENOMEM;
diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
index 048ad783ea3f..8babbeb30adf 100644
--- a/arch/sparc/kernel/nmi.c
+++ b/arch/sparc/kernel/nmi.c
@@ -166,7 +166,8 @@ static int __init check_nmi_watchdog(void)
         if (!atomic_read(&nmi_active))
                 return 0;
 
-        prev_nmi_count = kmalloc(nr_cpu_ids * sizeof(unsigned int), GFP_KERNEL);
+        prev_nmi_count = kmalloc_array(nr_cpu_ids, sizeof(unsigned int),
+                                       GFP_KERNEL);
         if (!prev_nmi_count) {
                 err = -ENOMEM;
                 goto error;
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index 7e49bbc925a5..63baa8aa9414 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -565,7 +565,8 @@ SYSCALL_DEFINE5(utrap_install, utrap_entry_t, type,
         }
         if (!current_thread_info()->utraps) {
                 current_thread_info()->utraps =
-                        kzalloc((UT_TRAP_INSTRUCTION_31+1)*sizeof(long), GFP_KERNEL);
+                        kcalloc(UT_TRAP_INSTRUCTION_31 + 1, sizeof(long),
+                                GFP_KERNEL);
                 if (!current_thread_info()->utraps)
                         return -ENOMEM;
                 current_thread_info()->utraps[0] = 1;
@@ -575,8 +576,9 @@ SYSCALL_DEFINE5(utrap_install, utrap_entry_t, type,
                         unsigned long *p = current_thread_info()->utraps;
 
                         current_thread_info()->utraps =
-                                kmalloc((UT_TRAP_INSTRUCTION_31+1)*sizeof(long),
-                                        GFP_KERNEL);
+                                kmalloc_array(UT_TRAP_INSTRUCTION_31 + 1,
+                                              sizeof(long),
+                                              GFP_KERNEL);
                         if (!current_thread_info()->utraps) {
                                 current_thread_info()->utraps = p;
                                 return -ENOMEM;
diff --git a/arch/sparc/net/bpf_jit_comp_32.c b/arch/sparc/net/bpf_jit_comp_32.c
index 3bd8ca95e521..a5ff88643d5c 100644
--- a/arch/sparc/net/bpf_jit_comp_32.c
+++ b/arch/sparc/net/bpf_jit_comp_32.c
@@ -335,7 +335,7 @@ void bpf_jit_compile(struct bpf_prog *fp)
         if (!bpf_jit_enable)
                 return;
 
-        addrs = kmalloc(flen * sizeof(*addrs), GFP_KERNEL);
+        addrs = kmalloc_array(flen, sizeof(*addrs), GFP_KERNEL);
         if (addrs == NULL)
                 return;
 
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index dcf5ea28a281..83c470364dfb 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -1127,9 +1127,9 @@ static int __init ubd_init(void)
                         return -1;
         }
 
-        irq_req_buffer = kmalloc(
-                        sizeof(struct io_thread_req *) * UBD_REQ_BUFFER_SIZE,
-                        GFP_KERNEL
+        irq_req_buffer = kmalloc_array(UBD_REQ_BUFFER_SIZE,
+                                       sizeof(struct io_thread_req *),
+                                       GFP_KERNEL
                 );
         irq_remainder = 0;
 
@@ -1137,9 +1137,9 @@ static int __init ubd_init(void)
                 printk(KERN_ERR "Failed to initialize ubd buffering\n");
                 return -1;
         }
-        io_req_buffer = kmalloc(
-                        sizeof(struct io_thread_req *) * UBD_REQ_BUFFER_SIZE,
-                        GFP_KERNEL
+        io_req_buffer = kmalloc_array(UBD_REQ_BUFFER_SIZE,
+                                      sizeof(struct io_thread_req *),
+                                      GFP_KERNEL
                 );
 
         io_remainder = 0;
diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
index 02168fe25105..627075e6d875 100644
--- a/arch/um/drivers/vector_kern.c
+++ b/arch/um/drivers/vector_kern.c
@@ -527,14 +527,14 @@ static struct vector_queue *create_queue(
         result->max_iov_frags = num_extra_frags;
         for (i = 0; i < max_size; i++) {
                 if (vp->header_size > 0)
-                        iov = kmalloc(
-                                sizeof(struct iovec) * (3 + num_extra_frags),
-                                GFP_KERNEL
+                        iov = kmalloc_array(3 + num_extra_frags,
+                                            sizeof(struct iovec),
+                                            GFP_KERNEL
                         );
                 else
-                        iov = kmalloc(
-                                sizeof(struct iovec) * (2 + num_extra_frags),
-                                GFP_KERNEL
+                        iov = kmalloc_array(2 + num_extra_frags,
+                                            sizeof(struct iovec),
+                                            GFP_KERNEL
                         );
                 if (iov == NULL)
                         goto out_fail;
diff --git a/arch/unicore32/kernel/pm.c b/arch/unicore32/kernel/pm.c
index 784bc2db3b28..6f8164d91dc2 100644
--- a/arch/unicore32/kernel/pm.c
+++ b/arch/unicore32/kernel/pm.c
@@ -109,8 +109,9 @@ static int __init puv3_pm_init(void)
                 return -EINVAL;
         }
 
-        sleep_save = kmalloc(puv3_cpu_pm_fns->save_count
-                                * sizeof(unsigned long), GFP_KERNEL);
+        sleep_save = kmalloc_array(puv3_cpu_pm_fns->save_count,
+                                   sizeof(unsigned long),
+                                   GFP_KERNEL);
         if (!sleep_save) {
                 printk(KERN_ERR "failed to alloc memory for pm save\n");
                 return -ENOMEM;
diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c
index 38b5d41b0c37..3210fee27e7f 100644
--- a/arch/x86/events/amd/iommu.c
+++ b/arch/x86/events/amd/iommu.c
@@ -387,7 +387,7 @@ static __init int _init_events_attrs(void)
         while (amd_iommu_v2_event_descs[i].attr.attr.name)
                 i++;
 
-        attrs = kzalloc(sizeof(struct attribute **) * (i + 1), GFP_KERNEL);
+        attrs = kcalloc(i + 1, sizeof(struct attribute **), GFP_KERNEL);
         if (!attrs)
                 return -ENOMEM;
 
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 6e461fb1e0d4..5f4829f10129 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -1637,7 +1637,7 @@ __init struct attribute **merge_attr(struct attribute **a, struct attribute **b)
                 j++;
         j++;
 
-        new = kmalloc(sizeof(struct attribute *) * j, GFP_KERNEL);
+        new = kmalloc_array(j, sizeof(struct attribute *), GFP_KERNEL);
         if (!new)
                 return NULL;
 
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 15b07379e72d..27a461414b30 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -865,12 +865,10 @@ static void uncore_types_exit(struct intel_uncore_type **types)
 static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
 {
         struct intel_uncore_pmu *pmus;
-        struct attribute_group *attr_group;
-        struct attribute **attrs;
         size_t size;
         int i, j;
 
-        pmus = kzalloc(sizeof(*pmus) * type->num_boxes, GFP_KERNEL);
+        pmus = kcalloc(type->num_boxes, sizeof(*pmus), GFP_KERNEL);
         if (!pmus)
                 return -ENOMEM;
 
@@ -891,21 +889,24 @@ static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
                                 0, type->num_counters, 0, 0);
 
         if (type->event_descs) {
+                struct {
+                        struct attribute_group group;
+                        struct attribute *attrs[];
+                } *attr_group;
                 for (i = 0; type->event_descs[i].attr.attr.name; i++);
 
-                attr_group = kzalloc(sizeof(struct attribute *) * (i + 1) +
-                                        sizeof(*attr_group), GFP_KERNEL);
+                attr_group = kzalloc(struct_size(attr_group, attrs, i + 1),
+                                                                GFP_KERNEL);
                 if (!attr_group)
                         goto err;
 
-                attrs = (struct attribute **)(attr_group + 1);
-                attr_group->name = "events";
-                attr_group->attrs = attrs;
+                attr_group->group.name = "events";
+                attr_group->group.attrs = attr_group->attrs;
 
                 for (j = 0; j < i; j++)
-                        attrs[j] = &type->event_descs[j].attr.attr;
+                        attr_group->attrs[j] = &type->event_descs[j].attr.attr;
 
-                type->events_group = attr_group;
+                type->events_group = &attr_group->group;
         }
 
         type->pmu_group = &uncore_pmu_attr_group;
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index cd76380af79f..e4cf6ff1c2e1 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1457,7 +1457,7 @@ static int __mcheck_cpu_mce_banks_init(void)
         int i;
         u8 num_banks = mca_cfg.banks;
 
-        mce_banks = kzalloc(num_banks * sizeof(struct mce_bank), GFP_KERNEL);
+        mce_banks = kcalloc(num_banks, sizeof(struct mce_bank), GFP_KERNEL);
         if (!mce_banks)
                 return -ENOMEM;
 
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index f591b01930db..dd33c357548f 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -1384,7 +1384,7 @@ int mce_threshold_create_device(unsigned int cpu)
         if (bp)
                 return 0;
 
-        bp = kzalloc(sizeof(struct threshold_bank *) * mca_cfg.banks,
+        bp = kcalloc(mca_cfg.banks, sizeof(struct threshold_bank *),
                      GFP_KERNEL);
         if (!bp)
                 return -ENOMEM;
diff --git a/arch/x86/kernel/cpu/mtrr/if.c b/arch/x86/kernel/cpu/mtrr/if.c
index c610f47373e4..4021d3859499 100644
--- a/arch/x86/kernel/cpu/mtrr/if.c
+++ b/arch/x86/kernel/cpu/mtrr/if.c
@@ -43,7 +43,7 @@ mtrr_file_add(unsigned long base, unsigned long size,
 
         max = num_var_ranges;
         if (fcount == NULL) {
-                fcount = kzalloc(max * sizeof *fcount, GFP_KERNEL);
+                fcount = kcalloc(max, sizeof(*fcount), GFP_KERNEL);
                 if (!fcount)
                         return -ENOMEM;
                 FILE_FCOUNT(file) = fcount;
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index b6be34ee88e9..346b24883911 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -610,7 +610,7 @@ static void hpet_msi_capability_lookup(unsigned int start_timer)
         if (!hpet_domain)
                 return;
 
-        hpet_devs = kzalloc(sizeof(struct hpet_dev) * num_timers, GFP_KERNEL);
+        hpet_devs = kcalloc(num_timers, sizeof(struct hpet_dev), GFP_KERNEL);
         if (!hpet_devs)
                 return;
 
@@ -966,8 +966,8 @@ int __init hpet_enable(void)
 #endif
 
         cfg = hpet_readl(HPET_CFG);
-        hpet_boot_cfg = kmalloc((last + 2) * sizeof(*hpet_boot_cfg),
-                                GFP_KERNEL);
+        hpet_boot_cfg = kmalloc_array(last + 2, sizeof(*hpet_boot_cfg),
+                                      GFP_KERNEL);
         if (hpet_boot_cfg)
                 *hpet_boot_cfg = cfg;
         else
diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c
index 8c1cc08f514f..163ae706a0d4 100644
--- a/arch/x86/kernel/ksysfs.c
+++ b/arch/x86/kernel/ksysfs.c
@@ -283,7 +283,7 @@ static int __init create_setup_data_nodes(struct kobject *parent)
         if (ret)
                 goto out_setup_data_kobj;
 
-        kobjp = kmalloc(sizeof(*kobjp) * nr, GFP_KERNEL);
+        kobjp = kmalloc_array(nr, sizeof(*kobjp), GFP_KERNEL);
         if (!kobjp) {
                 ret = -ENOMEM;
                 goto out_setup_data_kobj;
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 5720e78b2f7b..7e042e3d47fd 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -203,8 +203,9 @@ int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu,
                 goto out;
         r = -ENOMEM;
         if (cpuid->nent) {
-                cpuid_entries = vmalloc(sizeof(struct kvm_cpuid_entry) *
-                                        cpuid->nent);
+                cpuid_entries =
+                        vmalloc(array_size(sizeof(struct kvm_cpuid_entry),
+                                           cpuid->nent));
                 if (!cpuid_entries)
                         goto out;
                 r = -EFAULT;
@@ -785,7 +786,8 @@ int kvm_dev_ioctl_get_cpuid(struct kvm_cpuid2 *cpuid,
                 return -EINVAL;
 
         r = -ENOMEM;
-        cpuid_entries = vzalloc(sizeof(struct kvm_cpuid_entry2) * cpuid->nent);
+        cpuid_entries = vzalloc(array_size(sizeof(struct kvm_cpuid_entry2),
+                                           cpuid->nent));
         if (!cpuid_entries)
                 goto out;
 
diff --git a/arch/x86/kvm/page_track.c b/arch/x86/kvm/page_track.c
index 01c1371f39f8..3052a59a3065 100644
--- a/arch/x86/kvm/page_track.c
+++ b/arch/x86/kvm/page_track.c
@@ -40,8 +40,9 @@ int kvm_page_track_create_memslot(struct kvm_memory_slot *slot,
         int  i;
 
         for (i = 0; i < KVM_PAGE_TRACK_MAX; i++) {
-                slot->arch.gfn_track[i] = kvzalloc(npages *
-                                            sizeof(*slot->arch.gfn_track[i]), GFP_KERNEL);
+                slot->arch.gfn_track[i] =
+                        kvcalloc(npages, sizeof(*slot->arch.gfn_track[i]),
+                                 GFP_KERNEL);
                 if (!slot->arch.gfn_track[i])
                         goto track_free;
         }
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 695b0bd02220..f059a73f0fd0 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1001,7 +1001,9 @@ static int svm_cpu_init(int cpu)
 
         if (svm_sev_enabled()) {
                 r = -ENOMEM;
-                sd->sev_vmcbs = kmalloc((max_sev_asid + 1) * sizeof(void *), GFP_KERNEL);
+                sd->sev_vmcbs = kmalloc_array(max_sev_asid + 1,
+                                              sizeof(void *),
+                                              GFP_KERNEL);
                 if (!sd->sev_vmcbs)
                         goto err_1;
         }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index cc8c8be1e92d..6bcecc325e7e 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -8900,13 +8900,14 @@ int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot,
                                       slot->base_gfn, level) + 1;
 
                 slot->arch.rmap[i] =
-                        kvzalloc(lpages * sizeof(*slot->arch.rmap[i]), GFP_KERNEL);
+                        kvcalloc(lpages, sizeof(*slot->arch.rmap[i]),
+                                 GFP_KERNEL);
                 if (!slot->arch.rmap[i])
                         goto out_free;
                 if (i == 0)
                         continue;
 
-                linfo = kvzalloc(lpages * sizeof(*linfo), GFP_KERNEL);
+                linfo = kvcalloc(lpages, sizeof(*linfo), GFP_KERNEL);
                 if (!linfo)
                         goto out_free;
 
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 8fca446aaef6..2580cd2e98b1 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1107,7 +1107,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
                 extra_pass = true;
                 goto skip_init_addrs;
         }
-        addrs = kmalloc(prog->len * sizeof(*addrs), GFP_KERNEL);
+        addrs = kmalloc_array(prog->len, sizeof(*addrs), GFP_KERNEL);
         if (!addrs) {
                 prog = orig_prog;
                 goto out_addrs;
diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
index 0cc04e30adc1..55799873ebe5 100644
--- a/arch/x86/net/bpf_jit_comp32.c
+++ b/arch/x86/net/bpf_jit_comp32.c
@@ -2345,7 +2345,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
                 prog = tmp;
         }
 
-        addrs = kmalloc(prog->len * sizeof(*addrs), GFP_KERNEL);
+        addrs = kmalloc_array(prog->len, sizeof(*addrs), GFP_KERNEL);
         if (!addrs) {
                 prog = orig_prog;
                 goto out;
diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
index 9542a746dc50..9112d1cb397b 100644
--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
@@ -168,7 +168,7 @@ static int xen_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
         if (type == PCI_CAP_ID_MSI && nvec > 1)
                 return 1;
 
-        v = kzalloc(sizeof(int) * max(1, nvec), GFP_KERNEL);
+        v = kcalloc(max(1, nvec), sizeof(int), GFP_KERNEL);
         if (!v)
                 return -ENOMEM;
 
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index b96d38288c60..ca446da48fd2 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -2142,7 +2142,7 @@ static int __init init_per_cpu(int nuvhubs, int base_part_pnode)
         if (is_uv3_hub() || is_uv2_hub() || is_uv1_hub())
                 timeout_us = calculate_destination_timeout();
 
-        vp = kmalloc(nuvhubs * sizeof(struct uvhub_desc), GFP_KERNEL);
+        vp = kmalloc_array(nuvhubs, sizeof(struct uvhub_desc), GFP_KERNEL);
         uvhub_descs = (struct uvhub_desc *)vp;
         memset(uvhub_descs, 0, nuvhubs * sizeof(struct uvhub_desc));
         uvhub_mask = kzalloc((nuvhubs+7)/8, GFP_KERNEL);
diff --git a/arch/x86/platform/uv/uv_time.c b/arch/x86/platform/uv/uv_time.c
index b082d71b08ee..a36b368eea08 100644
--- a/arch/x86/platform/uv/uv_time.c
+++ b/arch/x86/platform/uv/uv_time.c
@@ -158,7 +158,7 @@ static __init int uv_rtc_allocate_timers(void)
 {
         int cpu;
 
-        blade_info = kzalloc(uv_possible_blades * sizeof(void *), GFP_KERNEL);
+        blade_info = kcalloc(uv_possible_blades, sizeof(void *), GFP_KERNEL);
         if (!blade_info)
                 return -ENOMEM;
 
diff --git a/block/bio.c b/block/bio.c
index db9a40e9a136..9710e275f230 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -2091,7 +2091,8 @@ static int __init init_bio(void)
 {
         bio_slab_max = 2;
         bio_slab_nr = 0;
-        bio_slabs = kzalloc(bio_slab_max * sizeof(struct bio_slab), GFP_KERNEL);
+        bio_slabs = kcalloc(bio_slab_max, sizeof(struct bio_slab),
+                            GFP_KERNEL);
         if (!bio_slabs)
                 panic("bio: can't allocate bios\n");
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index d2de0a719ab8..e9da5e6a8526 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1903,7 +1903,7 @@ struct blk_mq_tags *blk_mq_alloc_rq_map(struct blk_mq_tag_set *set,
         if (!tags)
                 return NULL;
 
-        tags->rqs = kzalloc_node(nr_tags * sizeof(struct request *),
+        tags->rqs = kcalloc_node(nr_tags, sizeof(struct request *),
                                  GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY,
                                  node);
         if (!tags->rqs) {
@@ -1911,9 +1911,9 @@ struct blk_mq_tags *blk_mq_alloc_rq_map(struct blk_mq_tag_set *set,
                 return NULL;
         }
 
-        tags->static_rqs = kzalloc_node(nr_tags * sizeof(struct request *),
-                                 GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY,
-                                 node);
+        tags->static_rqs = kcalloc_node(nr_tags, sizeof(struct request *),
+                                        GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY,
+                                        node);
         if (!tags->static_rqs) {
                 kfree(tags->rqs);
                 blk_mq_free_tags(tags);
@@ -2522,7 +2522,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
         /* init q->mq_kobj and sw queues' kobjects */
         blk_mq_sysfs_init(q);
 
-        q->queue_hw_ctx = kzalloc_node(nr_cpu_ids * sizeof(*(q->queue_hw_ctx)),
+        q->queue_hw_ctx = kcalloc_node(nr_cpu_ids, sizeof(*(q->queue_hw_ctx)),
                                                 GFP_KERNEL, set->numa_node);
         if (!q->queue_hw_ctx)
                 goto err_percpu;
@@ -2741,14 +2741,14 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set)
         if (set->nr_hw_queues > nr_cpu_ids)
                 set->nr_hw_queues = nr_cpu_ids;
 
-        set->tags = kzalloc_node(nr_cpu_ids * sizeof(struct blk_mq_tags *),
+        set->tags = kcalloc_node(nr_cpu_ids, sizeof(struct blk_mq_tags *),
                                  GFP_KERNEL, set->numa_node);
         if (!set->tags)
                 return -ENOMEM;
 
         ret = -ENOMEM;
-        set->mq_map = kzalloc_node(sizeof(*set->mq_map) * nr_cpu_ids,
-                        GFP_KERNEL, set->numa_node);
+        set->mq_map = kcalloc_node(nr_cpu_ids, sizeof(*set->mq_map),
+                                   GFP_KERNEL, set->numa_node);
         if (!set->mq_map)
                 goto out_free_tags;
 
diff --git a/block/blk-tag.c b/block/blk-tag.c
index 09f19c6c52ce..24b20d86bcbc 100644
--- a/block/blk-tag.c
+++ b/block/blk-tag.c
@@ -99,12 +99,12 @@ init_tag_map(struct request_queue *q, struct blk_queue_tag *tags, int depth)
                        __func__, depth);
         }
 
-        tag_index = kzalloc(depth * sizeof(struct request *), GFP_ATOMIC);
+        tag_index = kcalloc(depth, sizeof(struct request *), GFP_ATOMIC);
         if (!tag_index)
                 goto fail;
 
         nr_ulongs = ALIGN(depth, BITS_PER_LONG) / BITS_PER_LONG;
-        tag_map = kzalloc(nr_ulongs * sizeof(unsigned long), GFP_ATOMIC);
+        tag_map = kcalloc(nr_ulongs, sizeof(unsigned long), GFP_ATOMIC);
         if (!tag_map)
                 goto fail;
 
diff --git a/block/blk-zoned.c b/block/blk-zoned.c
index 3d08dc84db16..51000914e23f 100644
--- a/block/blk-zoned.c
+++ b/block/blk-zoned.c
@@ -331,8 +331,8 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, fmode_t mode,
         if (rep.nr_zones > INT_MAX / sizeof(struct blk_zone))
                 return -ERANGE;
 
-        zones = kvmalloc(rep.nr_zones * sizeof(struct blk_zone),
-                        GFP_KERNEL | __GFP_ZERO);
+        zones = kvmalloc_array(rep.nr_zones, sizeof(struct blk_zone),
+                               GFP_KERNEL | __GFP_ZERO);
         if (!zones)
                 return -ENOMEM;
 
diff --git a/block/partitions/check.c b/block/partitions/check.c
index 720145c49066..ffe408fead0c 100644
--- a/block/partitions/check.c
+++ b/block/partitions/check.c
@@ -122,7 +122,7 @@ static struct parsed_partitions *allocate_partitions(struct gendisk *hd)
                 return NULL;
 
         nr = disk_max_parts(hd);
-        state->parts = vzalloc(nr * sizeof(state->parts[0]));
+        state->parts = vzalloc(array_size(nr, sizeof(state->parts[0])));
         if (!state->parts) {
                 kfree(state);
                 return NULL;
diff --git a/block/partitions/ldm.c b/block/partitions/ldm.c
index 2a365c756648..0417937dfe99 100644
--- a/block/partitions/ldm.c
+++ b/block/partitions/ldm.c
@@ -378,7 +378,7 @@ static bool ldm_validate_tocblocks(struct parsed_partitions *state,
         BUG_ON(!state || !ldb);
         ph = &ldb->ph;
         tb[0] = &ldb->toc;
-        tb[1] = kmalloc(sizeof(*tb[1]) * 3, GFP_KERNEL);
+        tb[1] = kmalloc_array(3, sizeof(*tb[1]), GFP_KERNEL);
         if (!tb[1]) {
                 ldm_crit("Out of memory.");
                 goto err;
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 330cf9f2b767..825524f27438 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -255,8 +255,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
                                                        processed - as);
                 if (!areq->tsgl_entries)
                         areq->tsgl_entries = 1;
-                areq->tsgl = sock_kmalloc(sk, sizeof(*areq->tsgl) *
-                                              areq->tsgl_entries,
+                areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
+                                                         areq->tsgl_entries),
                                           GFP_KERNEL);
                 if (!areq->tsgl) {
                         err = -ENOMEM;
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 15cf3c5222e0..4c04eb9888ad 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -100,7 +100,8 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
         areq->tsgl_entries = af_alg_count_tsgl(sk, len, 0);
         if (!areq->tsgl_entries)
                 areq->tsgl_entries = 1;
-        areq->tsgl = sock_kmalloc(sk, sizeof(*areq->tsgl) * areq->tsgl_entries,
+        areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl),
+                                                 areq->tsgl_entries),
                                   GFP_KERNEL);
         if (!areq->tsgl) {
                 err = -ENOMEM;
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index d1d99843cce4..11e45352fd0b 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -603,7 +603,8 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
                 goto out_nooutbuf;
 
         /* avoid "the frame size is larger than 1024 bytes" compiler warning */
-        sg = kmalloc(sizeof(*sg) * 8 * (diff_dst ? 4 : 2), GFP_KERNEL);
+        sg = kmalloc(array3_size(sizeof(*sg), 8, (diff_dst ? 4 : 2)),
+                     GFP_KERNEL);
         if (!sg)
                 goto out_nosg;
         sgout = &sg[16];
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index 88cd949003f3..eaa60c94205a 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -82,7 +82,7 @@ struct platform_device *acpi_create_platform_device(struct acpi_device *adev,
         if (count < 0) {
                 return NULL;
         } else if (count > 0) {
-                resources = kzalloc(count * sizeof(struct resource),
+                resources = kcalloc(count, sizeof(struct resource),
                                     GFP_KERNEL);
                 if (!resources) {
                         dev_err(&adev->dev, "No memory for resources\n");
diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index 2f2e737be0f8..f0b52266b3ac 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -832,8 +832,9 @@ int acpi_video_get_levels(struct acpi_device *device,
          * in order to account for buggy BIOS which don't export the first two
          * special levels (see below)
          */
-        br->levels = kmalloc((obj->package.count + ACPI_VIDEO_FIRST_LEVEL) *
-                             sizeof(*br->levels), GFP_KERNEL);
+        br->levels = kmalloc_array(obj->package.count + ACPI_VIDEO_FIRST_LEVEL,
+                                   sizeof(*br->levels),
+                                   GFP_KERNEL);
         if (!br->levels) {
                 result = -ENOMEM;
                 goto out_free;
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 9bff853e85f3..3c5ea7cb693e 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -524,7 +524,8 @@ retry:
                                 pr_warn(FW_WARN "too many record IDs!\n");
                         return 0;
                 }
-                new_entries = kvmalloc(new_size * sizeof(entries[0]), GFP_KERNEL);
+                new_entries = kvmalloc_array(new_size, sizeof(entries[0]),
+                                             GFP_KERNEL);
                 if (!new_entries)
                         return -ENOMEM;
                 memcpy(new_entries, entries,
diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
index 9cb74115a43d..b1e9f81ebeea 100644
--- a/drivers/acpi/apei/hest.c
+++ b/drivers/acpi/apei/hest.c
@@ -195,7 +195,8 @@ static int __init hest_ghes_dev_register(unsigned int ghes_count)
         struct ghes_arr ghes_arr;
 
         ghes_arr.count = 0;
-        ghes_arr.ghes_devs = kmalloc(sizeof(void *) * ghes_count, GFP_KERNEL);
+        ghes_arr.ghes_devs = kmalloc_array(ghes_count, sizeof(void *),
+                                           GFP_KERNEL);
         if (!ghes_arr.ghes_devs)
                 return -ENOMEM;
 
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index 3563103590c6..fe0183d48dcd 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -298,8 +298,8 @@ static int acpi_fan_get_fps(struct acpi_device *device)
         }
 
         fan->fps_count = obj->package.count - 1; /* minus revision field */
-        fan->fps = devm_kzalloc(&device->dev,
-                                fan->fps_count * sizeof(struct acpi_fan_fps),
+        fan->fps = devm_kcalloc(&device->dev,
+                                fan->fps_count, sizeof(struct acpi_fan_fps),
                                 GFP_KERNEL);
         if (!fan->fps) {
                 dev_err(&device->dev, "Not enough memory\n");
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index b87252bf4571..d15814e1727f 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -1082,9 +1082,10 @@ static int __nfit_mem_init(struct acpi_nfit_desc *acpi_desc,
                                 continue;
                         nfit_mem->nfit_flush = nfit_flush;
                         flush = nfit_flush->flush;
-                        nfit_mem->flush_wpq = devm_kzalloc(acpi_desc->dev,
-                                        flush->hint_count
-                                        * sizeof(struct resource), GFP_KERNEL);
+                        nfit_mem->flush_wpq = devm_kcalloc(acpi_desc->dev,
+                                        flush->hint_count,
+                                        sizeof(struct resource),
+                                        GFP_KERNEL);
                         if (!nfit_mem->flush_wpq)
                                 return -ENOMEM;
                         for (i = 0; i < flush->hint_count; i++) {
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index a651ab3490d8..a303fd0e108c 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -343,8 +343,9 @@ static int acpi_processor_get_performance_states(struct acpi_processor *pr)
 
         pr->performance->state_count = pss->package.count;
         pr->performance->states =
-            kmalloc(sizeof(struct acpi_processor_px) * pss->package.count,
-                    GFP_KERNEL);
+            kmalloc_array(pss->package.count,
+                          sizeof(struct acpi_processor_px),
+                          GFP_KERNEL);
         if (!pr->performance->states) {
                 result = -ENOMEM;
                 goto end;
diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
index 7f9aff4b8d62..fbc936cf2025 100644
--- a/drivers/acpi/processor_throttling.c
+++ b/drivers/acpi/processor_throttling.c
@@ -534,8 +534,9 @@ static int acpi_processor_get_throttling_states(struct acpi_processor *pr)
 
         pr->throttling.state_count = tss->package.count;
         pr->throttling.states_tss =
-            kmalloc(sizeof(struct acpi_processor_tx_tss) * tss->package.count,
-                    GFP_KERNEL);
+            kmalloc_array(tss->package.count,
+                          sizeof(struct acpi_processor_tx_tss),
+                          GFP_KERNEL);
         if (!pr->throttling.states_tss) {
                 result = -ENOMEM;
                 goto end;
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 4fc59c3bc673..41324f0b1bee 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -857,12 +857,12 @@ void acpi_irq_stats_init(void)
         num_gpes = acpi_current_gpe_count;
         num_counters = num_gpes + ACPI_NUM_FIXED_EVENTS + NUM_COUNTERS_EXTRA;
 
-        all_attrs = kzalloc(sizeof(struct attribute *) * (num_counters + 1),
+        all_attrs = kcalloc(num_counters + 1, sizeof(struct attribute *),
                             GFP_KERNEL);
         if (all_attrs == NULL)
                 return;
 
-        all_counters = kzalloc(sizeof(struct event_counter) * (num_counters),
+        all_counters = kcalloc(num_counters, sizeof(struct event_counter),
                                GFP_KERNEL);
         if (all_counters == NULL)
                 goto fail;
@@ -871,7 +871,7 @@ void acpi_irq_stats_init(void)
         if (ACPI_FAILURE(status))
                 goto fail;
 
-        counter_attrs = kzalloc(sizeof(struct kobj_attribute) * (num_counters),
+        counter_attrs = kcalloc(num_counters, sizeof(struct kobj_attribute),
                                 GFP_KERNEL);
         if (counter_attrs == NULL)
                 goto fail;
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 4f382d51def1..2628806c64a2 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -692,8 +692,8 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
                 }
         }
 #endif
-        alloc->pages = kzalloc(sizeof(alloc->pages[0]) *
-                                   ((vma->vm_end - vma->vm_start) / PAGE_SIZE),
+        alloc->pages = kcalloc((vma->vm_end - vma->vm_start) / PAGE_SIZE,
+                               sizeof(alloc->pages[0]),
                                GFP_KERNEL);
         if (alloc->pages == NULL) {
                 ret = -ENOMEM;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index c41b9eeabe7c..27d15ed7fa3d 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6987,7 +6987,7 @@ static void __init ata_parse_force_param(void)
                 if (*p == ',')
                         size++;
 
-        ata_force_tbl = kzalloc(sizeof(ata_force_tbl[0]) * size, GFP_KERNEL);
+        ata_force_tbl = kcalloc(size, sizeof(ata_force_tbl[0]), GFP_KERNEL);
         if (!ata_force_tbl) {
                 printk(KERN_WARNING "ata: failed to extend force table, "
                        "libata.force ignored\n");
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 85aa76116a30..2ae1799f4992 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -340,7 +340,7 @@ static int sata_pmp_init_links (struct ata_port *ap, int nr_ports)
         int i, err;
 
         if (!pmp_link) {
-                pmp_link = kzalloc(sizeof(pmp_link[0]) * SATA_PMP_MAX_PORTS,
+                pmp_link = kcalloc(SATA_PMP_MAX_PORTS, sizeof(pmp_link[0]),
                                    GFP_NOIO);
                 if (!pmp_link)
                         return -ENOMEM;
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index cddf96f6e431..73ba8e134ca9 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4114,13 +4114,13 @@ static int mv_platform_probe(struct platform_device *pdev)
 
         if (!host || !hpriv)
                 return -ENOMEM;
-        hpriv->port_clks = devm_kzalloc(&pdev->dev,
-                                        sizeof(struct clk *) * n_ports,
+        hpriv->port_clks = devm_kcalloc(&pdev->dev,
+                                        n_ports, sizeof(struct clk *),
                                         GFP_KERNEL);
         if (!hpriv->port_clks)
                 return -ENOMEM;
-        hpriv->port_phys = devm_kzalloc(&pdev->dev,
-                                        sizeof(struct phy *) * n_ports,
+        hpriv->port_phys = devm_kcalloc(&pdev->dev,
+                                        n_ports, sizeof(struct phy *),
                                         GFP_KERNEL);
         if (!hpriv->port_phys)
                 return -ENOMEM;
diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index 6ebc4e4820fc..99a38115b0a8 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -2094,7 +2094,8 @@ static int fore200e_alloc_rx_buf(struct fore200e *fore200e)
             DPRINTK(2, "rx buffers %d / %d are being allocated\n", scheme, magn);
 
             /* allocate the array of receive buffers */
-            buffer = bsq->buffer = kzalloc(nbr * sizeof(struct buffer), GFP_KERNEL);
+            buffer = bsq->buffer = kcalloc(nbr, sizeof(struct buffer),
+                                           GFP_KERNEL);
 
             if (buffer == NULL)
                 return -ENOMEM;
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index be076606d30e..ff81a576347e 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -1618,7 +1618,7 @@ static int rx_init(struct atm_dev *dev)
         skb_queue_head_init(&iadev->rx_dma_q);  
         iadev->rx_free_desc_qhead = NULL;   
 
-        iadev->rx_open = kzalloc(4 * iadev->num_vc, GFP_KERNEL);
+        iadev->rx_open = kcalloc(4, iadev->num_vc, GFP_KERNEL);
         if (!iadev->rx_open) {
                 printk(KERN_ERR DEV_LABEL "itf %d couldn't get free page\n",
                 dev->number);  
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 0df1a1c80b00..17283018269f 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1291,7 +1291,8 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
                 card->using_dma = 1;
                 if (1) { /* All known FPGA versions so far */
                         card->dma_alignment = 3;
-                        card->dma_bounce = kmalloc(card->nr_ports * BUF_SIZE, GFP_KERNEL);
+                        card->dma_bounce = kmalloc_array(card->nr_ports,
+                                                         BUF_SIZE, GFP_KERNEL);
                         if (!card->dma_bounce) {
                                 dev_warn(&card->dev->dev, "Failed to allocate DMA bounce buffers\n");
                                 err = -ENOMEM;
diff --git a/drivers/auxdisplay/cfag12864b.c b/drivers/auxdisplay/cfag12864b.c
index 6bd2f65e116a..7eebae7e322c 100644
--- a/drivers/auxdisplay/cfag12864b.c
+++ b/drivers/auxdisplay/cfag12864b.c
@@ -333,8 +333,8 @@ static int __init cfag12864b_init(void)
                 goto none;
         }
 
-        cfag12864b_cache = kmalloc(sizeof(unsigned char) *
-                CFAG12864B_SIZE, GFP_KERNEL);
+        cfag12864b_cache = kmalloc(CFAG12864B_SIZE,
+                                   GFP_KERNEL);
         if (cfag12864b_cache == NULL) {
                 printk(KERN_ERR CFAG12864B_NAME ": ERROR: "
                         "can't alloc cache buffer (%i bytes)\n",
diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
index b676a99c469c..7f732744f0d3 100644
--- a/drivers/base/firmware_loader/fallback.c
+++ b/drivers/base/firmware_loader/fallback.c
@@ -403,7 +403,7 @@ static int fw_realloc_pages(struct fw_sysfs *fw_sysfs, int min_size)
                                          fw_priv->page_array_size * 2);
                 struct page **new_pages;
 
-                new_pages = vmalloc(new_array_size * sizeof(void *));
+                new_pages = vmalloc(array_size(new_array_size, sizeof(void *)));
                 if (!new_pages) {
                         fw_load_abort(fw_sysfs);
                         return -ENOMEM;
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 6ca77d6047d6..f6518067aa7d 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -5719,8 +5719,8 @@ static bool DAC960_CheckStatusBuffer(DAC960_Controller_T *Controller,
       Controller->CombinedStatusBufferLength = NewStatusBufferLength;
       return true;
     }
-  NewStatusBuffer = kmalloc(2 * Controller->CombinedStatusBufferLength,
-                             GFP_ATOMIC);
+  NewStatusBuffer = kmalloc_array(2, Controller->CombinedStatusBufferLength,
+                                  GFP_ATOMIC);
   if (NewStatusBuffer == NULL)
     {
       DAC960_Warning("Unable to expand Combined Status Buffer - Truncating\n",
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 7655d6133139..a80809bd3057 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -511,7 +511,8 @@ static void drbd_calc_cpu_mask(cpumask_var_t *cpu_mask)
 {
         unsigned int *resources_per_cpu, min_index = ~0;
 
-        resources_per_cpu = kzalloc(nr_cpu_ids * sizeof(*resources_per_cpu), GFP_KERNEL);
+        resources_per_cpu = kcalloc(nr_cpu_ids, sizeof(*resources_per_cpu),
+                                    GFP_KERNEL);
         if (resources_per_cpu) {
                 struct drbd_resource *resource;
                 unsigned int cpu, min = ~0;
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 21e6d1b3b393..d6b6f434fd4b 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -524,7 +524,8 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
 
                 __rq_for_each_bio(bio, rq)
                         segments += bio_segments(bio);
-                bvec = kmalloc(sizeof(struct bio_vec) * segments, GFP_NOIO);
+                bvec = kmalloc_array(segments, sizeof(struct bio_vec),
+                                     GFP_NOIO);
                 if (!bvec)
                         return -EIO;
                 cmd->bvec = bvec;
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 2bdadd7f1454..7948049f6c43 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -1575,12 +1575,12 @@ static int setup_commands(struct nullb_queue *nq)
         struct nullb_cmd *cmd;
         int i, tag_size;
 
-        nq->cmds = kzalloc(nq->queue_depth * sizeof(*cmd), GFP_KERNEL);
+        nq->cmds = kcalloc(nq->queue_depth, sizeof(*cmd), GFP_KERNEL);
         if (!nq->cmds)
                 return -ENOMEM;
 
         tag_size = ALIGN(nq->queue_depth, BITS_PER_LONG) / BITS_PER_LONG;
-        nq->tag_map = kzalloc(tag_size * sizeof(unsigned long), GFP_KERNEL);
+        nq->tag_map = kcalloc(tag_size, sizeof(unsigned long), GFP_KERNEL);
         if (!nq->tag_map) {
                 kfree(nq->cmds);
                 return -ENOMEM;
@@ -1598,8 +1598,9 @@ static int setup_commands(struct nullb_queue *nq)
 
 static int setup_queues(struct nullb *nullb)
 {
-        nullb->queues = kzalloc(nullb->dev->submit_queues *
-                sizeof(struct nullb_queue), GFP_KERNEL);
+        nullb->queues = kcalloc(nullb->dev->submit_queues,
+                                sizeof(struct nullb_queue),
+                                GFP_KERNEL);
         if (!nullb->queues)
                 return -ENOMEM;
 
diff --git a/drivers/block/ps3vram.c b/drivers/block/ps3vram.c
index 8fa4533a1249..1e3d5de9d838 100644
--- a/drivers/block/ps3vram.c
+++ b/drivers/block/ps3vram.c
@@ -407,8 +407,9 @@ static int ps3vram_cache_init(struct ps3_system_bus_device *dev)
 
         priv->cache.page_count = CACHE_PAGE_COUNT;
         priv->cache.page_size = CACHE_PAGE_SIZE;
-        priv->cache.tags = kzalloc(sizeof(struct ps3vram_tag) *
-                                   CACHE_PAGE_COUNT, GFP_KERNEL);
+        priv->cache.tags = kcalloc(CACHE_PAGE_COUNT,
+                                   sizeof(struct ps3vram_tag),
+                                   GFP_KERNEL);
         if (!priv->cache.tags)
                 return -ENOMEM;
 
diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
index 09537bee387f..b7d71914a32a 100644
--- a/drivers/block/rsxx/core.c
+++ b/drivers/block/rsxx/core.c
@@ -873,7 +873,8 @@ static int rsxx_pci_probe(struct pci_dev *dev,
                 dev_info(CARD_TO_DEV(card),
                         "Failed reading the number of DMA targets\n");
 
-        card->ctrl = kzalloc(card->n_targets * sizeof(*card->ctrl), GFP_KERNEL);
+        card->ctrl = kcalloc(card->n_targets, sizeof(*card->ctrl),
+                             GFP_KERNEL);
         if (!card->ctrl) {
                 st = -ENOMEM;
                 goto failed_dma_setup;
diff --git a/drivers/block/rsxx/dma.c b/drivers/block/rsxx/dma.c
index beaccf197a5a..8fbc1bf6db3d 100644
--- a/drivers/block/rsxx/dma.c
+++ b/drivers/block/rsxx/dma.c
@@ -1038,7 +1038,7 @@ int rsxx_eeh_save_issued_dmas(struct rsxx_cardinfo *card)
         struct rsxx_dma *dma;
         struct list_head *issued_dmas;
 
-        issued_dmas = kzalloc(sizeof(*issued_dmas) * card->n_targets,
+        issued_dmas = kcalloc(card->n_targets, sizeof(*issued_dmas),
                               GFP_KERNEL);
         if (!issued_dmas)
                 return -ENOMEM;
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 66412eededda..a4bc74e72c39 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -139,7 +139,8 @@ static int xen_blkif_alloc_rings(struct xen_blkif *blkif)
 {
         unsigned int r;
 
-        blkif->rings = kzalloc(blkif->nr_rings * sizeof(struct xen_blkif_ring), GFP_KERNEL);
+        blkif->rings = kcalloc(blkif->nr_rings, sizeof(struct xen_blkif_ring),
+                               GFP_KERNEL);
         if (!blkif->rings)
                 return -ENOMEM;
 
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index ae00a82f350b..b5cedccb5d7d 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1906,7 +1906,9 @@ static int negotiate_mq(struct blkfront_info *info)
         if (!info->nr_rings)
                 info->nr_rings = 1;
 
-        info->rinfo = kzalloc(sizeof(struct blkfront_ring_info) * info->nr_rings, GFP_KERNEL);
+        info->rinfo = kcalloc(info->nr_rings,
+                              sizeof(struct blkfront_ring_info),
+                              GFP_KERNEL);
         if (!info->rinfo) {
                 xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
                 return -ENOMEM;
@@ -2216,15 +2218,18 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo)
         }
 
         for (i = 0; i < BLK_RING_SIZE(info); i++) {
-                rinfo->shadow[i].grants_used = kzalloc(
-                        sizeof(rinfo->shadow[i].grants_used[0]) * grants,
-                        GFP_NOIO);
-                rinfo->shadow[i].sg = kzalloc(sizeof(rinfo->shadow[i].sg[0]) * psegs, GFP_NOIO);
-                if (info->max_indirect_segments)
-                        rinfo->shadow[i].indirect_grants = kzalloc(
-                                sizeof(rinfo->shadow[i].indirect_grants[0]) *
-                                INDIRECT_GREFS(grants),
+                rinfo->shadow[i].grants_used =
+                        kcalloc(grants,
+                                sizeof(rinfo->shadow[i].grants_used[0]),
                                 GFP_NOIO);
+                rinfo->shadow[i].sg = kcalloc(psegs,
+                                              sizeof(rinfo->shadow[i].sg[0]),
+                                              GFP_NOIO);
+                if (info->max_indirect_segments)
+                        rinfo->shadow[i].indirect_grants =
+                                kcalloc(INDIRECT_GREFS(grants),
+                                        sizeof(rinfo->shadow[i].indirect_grants[0]),
+                                        GFP_NOIO);
                 if ((rinfo->shadow[i].grants_used == NULL) ||
                         (rinfo->shadow[i].sg == NULL) ||
                      (info->max_indirect_segments &&
diff --git a/drivers/block/z2ram.c b/drivers/block/z2ram.c
index 8f9130ab5887..d0c5bc4e0703 100644
--- a/drivers/block/z2ram.c
+++ b/drivers/block/z2ram.c
@@ -197,8 +197,9 @@ static int z2_open(struct block_device *bdev, fmode_t mode)
                 vaddr = (unsigned long)z_remap_nocache_nonser(paddr, size);
 #endif
                 z2ram_map = 
-                        kmalloc((size/Z2RAM_CHUNKSIZE)*sizeof(z2ram_map[0]),
-                                GFP_KERNEL);
+                        kmalloc_array(size / Z2RAM_CHUNKSIZE,
+                                      sizeof(z2ram_map[0]),
+                                      GFP_KERNEL);
                 if ( z2ram_map == NULL )
                 {
                     printk( KERN_ERR DEVICE_NAME
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index da51293e7c03..7436b2d27fa3 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -898,7 +898,7 @@ static bool zram_meta_alloc(struct zram *zram, u64 disksize)
         size_t num_pages;
 
         num_pages = disksize >> PAGE_SHIFT;
-        zram->table = vzalloc(num_pages * sizeof(*zram->table));
+        zram->table = vzalloc(array_size(num_pages, sizeof(*zram->table)));
         if (!zram->table)
                 return false;
 
diff --git a/drivers/bus/fsl-mc/fsl-mc-allocator.c b/drivers/bus/fsl-mc/fsl-mc-allocator.c
index fb1442b08962..e906ecfe23dd 100644
--- a/drivers/bus/fsl-mc/fsl-mc-allocator.c
+++ b/drivers/bus/fsl-mc/fsl-mc-allocator.c
@@ -354,8 +354,8 @@ int fsl_mc_populate_irq_pool(struct fsl_mc_bus *mc_bus,
         if (error < 0)
                 return error;
 
-        irq_resources = devm_kzalloc(&mc_bus_dev->dev,
-                                     sizeof(*irq_resources) * irq_count,
+        irq_resources = devm_kcalloc(&mc_bus_dev->dev,
+                                     irq_count, sizeof(*irq_resources),
                                      GFP_KERNEL);
         if (!irq_resources) {
                 error = -ENOMEM;
@@ -455,7 +455,7 @@ int __must_check fsl_mc_allocate_irqs(struct fsl_mc_device *mc_dev)
                 return -ENOSPC;
         }
 
-        irqs = devm_kzalloc(&mc_dev->dev, irq_count * sizeof(irqs[0]),
+        irqs = devm_kcalloc(&mc_dev->dev, irq_count, sizeof(irqs[0]),
                             GFP_KERNEL);
         if (!irqs)
                 return -ENOMEM;
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 9adc8c3eb0fa..a78b8e7085e9 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2132,7 +2132,7 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
          */
         nr = nframes;
         do {
-                cgc.buffer = kmalloc(CD_FRAMESIZE_RAW * nr, GFP_KERNEL);
+                cgc.buffer = kmalloc_array(nr, CD_FRAMESIZE_RAW, GFP_KERNEL);
                 if (cgc.buffer)
                         break;
 
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index b450544dcaf0..6914e4f0ce98 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -85,7 +85,8 @@ static int amd_create_gatt_pages(int nr_tables)
         int retval = 0;
         int i;
 
-        tables = kzalloc((nr_tables + 1) * sizeof(struct amd_page_map *),GFP_KERNEL);
+        tables = kcalloc(nr_tables + 1, sizeof(struct amd_page_map *),
+                         GFP_KERNEL);
         if (tables == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index 88b4cbee4dac..20bf5f78a362 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -108,7 +108,8 @@ static int ati_create_gatt_pages(int nr_tables)
         int retval = 0;
         int i;
 
-        tables = kzalloc((nr_tables + 1) * sizeof(struct ati_page_map *),GFP_KERNEL);
+        tables = kcalloc(nr_tables + 1, sizeof(struct ati_page_map *),
+                         GFP_KERNEL);
         if (tables == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/char/agp/compat_ioctl.c b/drivers/char/agp/compat_ioctl.c
index 2053f70ef66b..52ffe1706ce0 100644
--- a/drivers/char/agp/compat_ioctl.c
+++ b/drivers/char/agp/compat_ioctl.c
@@ -98,11 +98,15 @@ static int compat_agpioc_reserve_wrap(struct agp_file_private *priv, void __user
                 if (ureserve.seg_count >= 16384)
                         return -EINVAL;
 
-                usegment = kmalloc(sizeof(*usegment) * ureserve.seg_count, GFP_KERNEL);
+                usegment = kmalloc_array(ureserve.seg_count,
+                                         sizeof(*usegment),
+                                         GFP_KERNEL);
                 if (!usegment)
                         return -ENOMEM;
 
-                ksegment = kmalloc(sizeof(*ksegment) * kreserve.seg_count, GFP_KERNEL);
+                ksegment = kmalloc_array(kreserve.seg_count,
+                                         sizeof(*ksegment),
+                                         GFP_KERNEL);
                 if (!ksegment) {
                         kfree(usegment);
                         return -ENOMEM;
diff --git a/drivers/char/agp/isoch.c b/drivers/char/agp/isoch.c
index fc8e1bc3347d..31c374b1b91b 100644
--- a/drivers/char/agp/isoch.c
+++ b/drivers/char/agp/isoch.c
@@ -93,7 +93,8 @@ static int agp_3_5_isochronous_node_enable(struct agp_bridge_data *bridge,
          * We'll work with an array of isoch_data's (one for each
          * device in dev_list) throughout this function.
          */
-        if ((master = kmalloc(ndevs * sizeof(*master), GFP_KERNEL)) == NULL) {
+        master = kmalloc_array(ndevs, sizeof(*master), GFP_KERNEL);
+        if (master == NULL) {
                 ret = -ENOMEM;
                 goto get_out;
         }
diff --git a/drivers/char/agp/sgi-agp.c b/drivers/char/agp/sgi-agp.c
index 3051c73bc383..e7d5bdc02d93 100644
--- a/drivers/char/agp/sgi-agp.c
+++ b/drivers/char/agp/sgi-agp.c
@@ -280,9 +280,9 @@ static int agp_sgi_init(void)
         else
                 return 0;
 
-        sgi_tioca_agp_bridges = kmalloc(tioca_gart_found *
-                                        sizeof(struct agp_bridge_data *),
-                                        GFP_KERNEL);
+        sgi_tioca_agp_bridges = kmalloc_array(tioca_gart_found,
+                                              sizeof(struct agp_bridge_data *),
+                                              GFP_KERNEL);
         if (!sgi_tioca_agp_bridges)
                 return -ENOMEM;
 
diff --git a/drivers/char/agp/sworks-agp.c b/drivers/char/agp/sworks-agp.c
index 4dbdd3bc9bb8..7729414100ff 100644
--- a/drivers/char/agp/sworks-agp.c
+++ b/drivers/char/agp/sworks-agp.c
@@ -96,7 +96,7 @@ static int serverworks_create_gatt_pages(int nr_tables)
         int retval = 0;
         int i;
 
-        tables = kzalloc((nr_tables + 1) * sizeof(struct serverworks_page_map *),
+        tables = kcalloc(nr_tables + 1, sizeof(struct serverworks_page_map *),
                          GFP_KERNEL);
         if (tables == NULL)
                 return -ENOMEM;
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index 79d8c84693a1..31fcd0430426 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -402,7 +402,9 @@ static int uninorth_create_gatt_table(struct agp_bridge_data *bridge)
         if (table == NULL)
                 return -ENOMEM;
 
-        uninorth_priv.pages_arr = kmalloc((1 << page_order) * sizeof(struct page*), GFP_KERNEL);
+        uninorth_priv.pages_arr = kmalloc_array(1 << page_order,
+                                                sizeof(struct page *),
+                                                GFP_KERNEL);
         if (uninorth_priv.pages_arr == NULL)
                 goto enomem;
 
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index 22f634eb09fd..18e4650c233b 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -1757,7 +1757,8 @@ static unsigned short *ssif_address_list(void)
         list_for_each_entry(info, &ssif_infos, link)
                 count++;
 
-        address_list = kzalloc(sizeof(*address_list) * (count + 1), GFP_KERNEL);
+        address_list = kcalloc(count + 1, sizeof(*address_list),
+                               GFP_KERNEL);
         if (!address_list)
                 return NULL;
 
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index 293167c6e254..fd6eec8085b4 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -321,7 +321,8 @@ static int __init raw_init(void)
                 max_raw_minors = MAX_RAW_MINORS;
         }
 
-        raw_devices = vzalloc(sizeof(struct raw_device_data) * max_raw_minors);
+        raw_devices = vzalloc(array_size(max_raw_minors,
+                                         sizeof(struct raw_device_data)));
         if (!raw_devices) {
                 printk(KERN_ERR "Not enough memory for raw device structures\n");
                 ret = -ENOMEM;
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 96c77c8e7f40..d31b09099216 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -980,7 +980,7 @@ static int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip)
                 goto out;
         }
 
-        chip->cc_attrs_tbl = devm_kzalloc(&chip->dev, 4 * nr_commands,
+        chip->cc_attrs_tbl = devm_kcalloc(&chip->dev, 4, nr_commands,
                                           GFP_KERNEL);
 
         rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 21085515814f..17084cfcf53e 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -433,8 +433,7 @@ static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size
          * Allocate buffer and the sg list. The sg list array is allocated
          * directly after the port_buffer struct.
          */
-        buf = kmalloc(sizeof(*buf) + sizeof(struct scatterlist) * pages,
-                      GFP_KERNEL);
+        buf = kmalloc(struct_size(buf, sg, pages), GFP_KERNEL);
         if (!buf)
                 goto fail;
 
@@ -1892,13 +1891,14 @@ static int init_vqs(struct ports_device *portdev)
         nr_ports = portdev->max_nr_ports;
         nr_queues = use_multiport(portdev) ? (nr_ports + 1) * 2 : 2;
 
-        vqs = kmalloc(nr_queues * sizeof(struct virtqueue *), GFP_KERNEL);
-        io_callbacks = kmalloc(nr_queues * sizeof(vq_callback_t *), GFP_KERNEL);
-        io_names = kmalloc(nr_queues * sizeof(char *), GFP_KERNEL);
-        portdev->in_vqs = kmalloc(nr_ports * sizeof(struct virtqueue *),
-                                  GFP_KERNEL);
-        portdev->out_vqs = kmalloc(nr_ports * sizeof(struct virtqueue *),
-                                   GFP_KERNEL);
+        vqs = kmalloc_array(nr_queues, sizeof(struct virtqueue *), GFP_KERNEL);
+        io_callbacks = kmalloc_array(nr_queues, sizeof(vq_callback_t *),
+                                     GFP_KERNEL);
+        io_names = kmalloc_array(nr_queues, sizeof(char *), GFP_KERNEL);
+        portdev->in_vqs = kmalloc_array(nr_ports, sizeof(struct virtqueue *),
+                                        GFP_KERNEL);
+        portdev->out_vqs = kmalloc_array(nr_ports, sizeof(struct virtqueue *),
+                                         GFP_KERNEL);
         if (!vqs || !io_callbacks || !io_names || !portdev->in_vqs ||
             !portdev->out_vqs) {
                 err = -ENOMEM;
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 9e0b2f2b48e7..7bef0666ae7e 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -734,7 +734,7 @@ static void bcm2835_pll_debug_init(struct clk_hw *hw,
         const struct bcm2835_pll_data *data = pll->data;
         struct debugfs_reg32 *regs;
 
-        regs = devm_kzalloc(cprman->dev, 7 * sizeof(*regs), GFP_KERNEL);
+        regs = devm_kcalloc(cprman->dev, 7, sizeof(*regs), GFP_KERNEL);
         if (!regs)
                 return;
 
@@ -865,7 +865,7 @@ static void bcm2835_pll_divider_debug_init(struct clk_hw *hw,
         const struct bcm2835_pll_divider_data *data = divider->data;
         struct debugfs_reg32 *regs;
 
-        regs = devm_kzalloc(cprman->dev, 7 * sizeof(*regs), GFP_KERNEL);
+        regs = devm_kcalloc(cprman->dev, 7, sizeof(*regs), GFP_KERNEL);
         if (!regs)
                 return;
 
diff --git a/drivers/clk/renesas/clk-r8a7740.c b/drivers/clk/renesas/clk-r8a7740.c
index d074f8e982d0..a7a30d2eca41 100644
--- a/drivers/clk/renesas/clk-r8a7740.c
+++ b/drivers/clk/renesas/clk-r8a7740.c
@@ -161,7 +161,7 @@ static void __init r8a7740_cpg_clocks_init(struct device_node *np)
         }
 
         cpg = kzalloc(sizeof(*cpg), GFP_KERNEL);
-        clks = kzalloc(num_clks * sizeof(*clks), GFP_KERNEL);
+        clks = kcalloc(num_clks, sizeof(*clks), GFP_KERNEL);
         if (cpg == NULL || clks == NULL) {
                 /* We're leaking memory on purpose, there's no point in cleaning
                  * up as the system won't boot anyway.
diff --git a/drivers/clk/renesas/clk-r8a7779.c b/drivers/clk/renesas/clk-r8a7779.c
index 27fbfafaf2cd..5adcca4656c3 100644
--- a/drivers/clk/renesas/clk-r8a7779.c
+++ b/drivers/clk/renesas/clk-r8a7779.c
@@ -138,7 +138,7 @@ static void __init r8a7779_cpg_clocks_init(struct device_node *np)
         }
 
         cpg = kzalloc(sizeof(*cpg), GFP_KERNEL);
-        clks = kzalloc(CPG_NUM_CLOCKS * sizeof(*clks), GFP_KERNEL);
+        clks = kcalloc(CPG_NUM_CLOCKS, sizeof(*clks), GFP_KERNEL);
         if (cpg == NULL || clks == NULL) {
                 /* We're leaking memory on purpose, there's no point in cleaning
                  * up as the system won't boot anyway.
diff --git a/drivers/clk/renesas/clk-rcar-gen2.c b/drivers/clk/renesas/clk-rcar-gen2.c
index ee32a022e6da..bccd62f2cb09 100644
--- a/drivers/clk/renesas/clk-rcar-gen2.c
+++ b/drivers/clk/renesas/clk-rcar-gen2.c
@@ -417,7 +417,7 @@ static void __init rcar_gen2_cpg_clocks_init(struct device_node *np)
         }
 
         cpg = kzalloc(sizeof(*cpg), GFP_KERNEL);
-        clks = kzalloc(num_clks * sizeof(*clks), GFP_KERNEL);
+        clks = kcalloc(num_clks, sizeof(*clks), GFP_KERNEL);
         if (cpg == NULL || clks == NULL) {
                 /* We're leaking memory on purpose, there's no point in cleaning
                  * up as the system won't boot anyway.
diff --git a/drivers/clk/renesas/clk-rz.c b/drivers/clk/renesas/clk-rz.c
index 67dd712aa723..ac2f86d626b6 100644
--- a/drivers/clk/renesas/clk-rz.c
+++ b/drivers/clk/renesas/clk-rz.c
@@ -97,7 +97,7 @@ static void __init rz_cpg_clocks_init(struct device_node *np)
                 return;
 
         cpg = kzalloc(sizeof(*cpg), GFP_KERNEL);
-        clks = kzalloc(num_clks * sizeof(*clks), GFP_KERNEL);
+        clks = kcalloc(num_clks, sizeof(*clks), GFP_KERNEL);
         BUG_ON(!cpg || !clks);
 
         cpg->data.clks = clks;
diff --git a/drivers/clk/st/clkgen-fsyn.c b/drivers/clk/st/clkgen-fsyn.c
index 14819d919df1..a79d81985c4e 100644
--- a/drivers/clk/st/clkgen-fsyn.c
+++ b/drivers/clk/st/clkgen-fsyn.c
@@ -874,7 +874,7 @@ static void __init st_of_create_quadfs_fsynths(
                 return;
 
         clk_data->clk_num = QUADFS_MAX_CHAN;
-        clk_data->clks = kzalloc(QUADFS_MAX_CHAN * sizeof(struct clk *),
+        clk_data->clks = kcalloc(QUADFS_MAX_CHAN, sizeof(struct clk *),
                                  GFP_KERNEL);
 
         if (!clk_data->clks) {
diff --git a/drivers/clk/st/clkgen-pll.c b/drivers/clk/st/clkgen-pll.c
index 25bda48a5d35..7a7106dc80bf 100644
--- a/drivers/clk/st/clkgen-pll.c
+++ b/drivers/clk/st/clkgen-pll.c
@@ -738,7 +738,7 @@ static void __init clkgen_c32_pll_setup(struct device_node *np,
                 return;
 
         clk_data->clk_num = num_odfs;
-        clk_data->clks = kzalloc(clk_data->clk_num * sizeof(struct clk *),
+        clk_data->clks = kcalloc(clk_data->clk_num, sizeof(struct clk *),
                                  GFP_KERNEL);
 
         if (!clk_data->clks)
diff --git a/drivers/clk/sunxi/clk-usb.c b/drivers/clk/sunxi/clk-usb.c
index fe0c3d169377..917fc27a33dd 100644
--- a/drivers/clk/sunxi/clk-usb.c
+++ b/drivers/clk/sunxi/clk-usb.c
@@ -122,7 +122,7 @@ static void __init sunxi_usb_clk_setup(struct device_node *node,
         if (!clk_data)
                 return;
 
-        clk_data->clks = kzalloc((qty+1) * sizeof(struct clk *), GFP_KERNEL);
+        clk_data->clks = kcalloc(qty + 1, sizeof(struct clk *), GFP_KERNEL);
         if (!clk_data->clks) {
                 kfree(clk_data);
                 return;
diff --git a/drivers/clk/tegra/clk.c b/drivers/clk/tegra/clk.c
index 593d76a114f9..ffaf17f71860 100644
--- a/drivers/clk/tegra/clk.c
+++ b/drivers/clk/tegra/clk.c
@@ -216,14 +216,15 @@ struct clk ** __init tegra_clk_init(void __iomem *regs, int num, int banks)
         if (WARN_ON(banks > ARRAY_SIZE(periph_regs)))
                 return NULL;
 
-        periph_clk_enb_refcnt = kzalloc(32 * banks *
-                                sizeof(*periph_clk_enb_refcnt), GFP_KERNEL);
+        periph_clk_enb_refcnt = kcalloc(32 * banks,
+                                        sizeof(*periph_clk_enb_refcnt),
+                                        GFP_KERNEL);
         if (!periph_clk_enb_refcnt)
                 return NULL;
 
         periph_banks = banks;
 
-        clks = kzalloc(num * sizeof(struct clk *), GFP_KERNEL);
+        clks = kcalloc(num, sizeof(struct clk *), GFP_KERNEL);
         if (!clks)
                 kfree(periph_clk_enb_refcnt);
 
diff --git a/drivers/clk/ti/adpll.c b/drivers/clk/ti/adpll.c
index d6036c788fab..688e403333b9 100644
--- a/drivers/clk/ti/adpll.c
+++ b/drivers/clk/ti/adpll.c
@@ -501,8 +501,9 @@ static int ti_adpll_init_dco(struct ti_adpll_data *d)
         const char *postfix;
         int width, err;
 
-        d->outputs.clks = devm_kzalloc(d->dev, sizeof(struct clk *) *
+        d->outputs.clks = devm_kcalloc(d->dev,
                                        MAX_ADPLL_OUTPUTS,
+                                       sizeof(struct clk *),
                                        GFP_KERNEL);
         if (!d->outputs.clks)
                 return -ENOMEM;
@@ -915,8 +916,9 @@ static int ti_adpll_probe(struct platform_device *pdev)
         if (err)
                 return err;
 
-        d->clocks = devm_kzalloc(d->dev, sizeof(struct ti_adpll_clock) *
+        d->clocks = devm_kcalloc(d->dev,
                                  TI_ADPLL_NR_CLOCKS,
+                                 sizeof(struct ti_adpll_clock),
                                  GFP_KERNEL);
         if (!d->clocks)
                 return -ENOMEM;
diff --git a/drivers/clk/ti/apll.c b/drivers/clk/ti/apll.c
index 9498e9363b57..61c126a5d26a 100644
--- a/drivers/clk/ti/apll.c
+++ b/drivers/clk/ti/apll.c
@@ -206,7 +206,7 @@ static void __init of_dra7_apll_setup(struct device_node *node)
                 goto cleanup;
         }
 
-        parent_names = kzalloc(sizeof(char *) * init->num_parents, GFP_KERNEL);
+        parent_names = kcalloc(init->num_parents, sizeof(char *), GFP_KERNEL);
         if (!parent_names)
                 goto cleanup;
 
diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index aaa277dd6d99..ccfb4d9a152a 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -366,7 +366,7 @@ int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div,
 
         num_dividers = i;
 
-        tmp = kzalloc(sizeof(*tmp) * (valid_div + 1), GFP_KERNEL);
+        tmp = kcalloc(valid_div + 1, sizeof(*tmp), GFP_KERNEL);
         if (!tmp)
                 return -ENOMEM;
 
@@ -496,7 +496,7 @@ __init ti_clk_get_div_table(struct device_node *node)
                 return ERR_PTR(-EINVAL);
         }
 
-        table = kzalloc(sizeof(*table) * (valid_div + 1), GFP_KERNEL);
+        table = kcalloc(valid_div + 1, sizeof(*table), GFP_KERNEL);
 
         if (!table)
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/clk/ti/dpll.c b/drivers/clk/ti/dpll.c
index 7d33ca9042cb..dc86d07d0921 100644
--- a/drivers/clk/ti/dpll.c
+++ b/drivers/clk/ti/dpll.c
@@ -309,7 +309,7 @@ static void __init of_ti_dpll_setup(struct device_node *node,
                 goto cleanup;
         }
 
-        parent_names = kzalloc(sizeof(char *) * init->num_parents, GFP_KERNEL);
+        parent_names = kcalloc(init->num_parents, sizeof(char *), GFP_KERNEL);
         if (!parent_names)
                 goto cleanup;
 
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 70b3cf8e23d0..bbbf37c471a3 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -1000,7 +1000,7 @@ static int sh_cmt_setup(struct sh_cmt_device *cmt, struct platform_device *pdev)
 
         /* Allocate and setup the channels. */
         cmt->num_channels = hweight8(cmt->hw_channels);
-        cmt->channels = kzalloc(cmt->num_channels * sizeof(*cmt->channels),
+        cmt->channels = kcalloc(cmt->num_channels, sizeof(*cmt->channels),
                                 GFP_KERNEL);
         if (cmt->channels == NULL) {
                 ret = -ENOMEM;
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index 53aa7e92a7d7..6812e099b6a3 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -418,7 +418,7 @@ static int sh_mtu2_setup(struct sh_mtu2_device *mtu,
         /* Allocate and setup the channels. */
         mtu->num_channels = 3;
 
-        mtu->channels = kzalloc(sizeof(*mtu->channels) * mtu->num_channels,
+        mtu->channels = kcalloc(mtu->num_channels, sizeof(*mtu->channels),
                                 GFP_KERNEL);
         if (mtu->channels == NULL) {
                 ret = -ENOMEM;
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 31d881621e41..c74a6c543ca2 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -569,7 +569,7 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev)
         }
 
         /* Allocate and setup the channels. */
-        tmu->channels = kzalloc(sizeof(*tmu->channels) * tmu->num_channels,
+        tmu->channels = kcalloc(tmu->num_channels, sizeof(*tmu->channels),
                                 GFP_KERNEL);
         if (tmu->channels == NULL) {
                 ret = -ENOMEM;
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index 9449657d72f0..8ff1c9123834 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -759,8 +759,8 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
                 goto err_unreg;
         }
 
-        freq_table = kzalloc(sizeof(*freq_table) *
-                    (perf->state_count+1), GFP_KERNEL);
+        freq_table = kcalloc(perf->state_count + 1, sizeof(*freq_table),
+                             GFP_KERNEL);
         if (!freq_table) {
                 result = -ENOMEM;
                 goto err_unreg;
diff --git a/drivers/cpufreq/arm_big_little.c b/drivers/cpufreq/arm_big_little.c
index 1d7ef5fc1977..cf62a1f64dd7 100644
--- a/drivers/cpufreq/arm_big_little.c
+++ b/drivers/cpufreq/arm_big_little.c
@@ -280,7 +280,7 @@ static int merge_cluster_tables(void)
         for (i = 0; i < MAX_CLUSTERS; i++)
                 count += get_table_count(freq_table[i]);
 
-        table = kzalloc(sizeof(*table) * count, GFP_KERNEL);
+        table = kcalloc(count, sizeof(*table), GFP_KERNEL);
         if (!table)
                 return -ENOMEM;
 
diff --git a/drivers/cpufreq/bmips-cpufreq.c b/drivers/cpufreq/bmips-cpufreq.c
index 1653151b77df..56a4ebbf00e0 100644
--- a/drivers/cpufreq/bmips-cpufreq.c
+++ b/drivers/cpufreq/bmips-cpufreq.c
@@ -71,7 +71,7 @@ bmips_cpufreq_get_freq_table(const struct cpufreq_policy *policy)
 
         cpu_freq = htp_freq_to_cpu_freq(priv->clk_mult);
 
-        table = kmalloc((priv->max_freqs + 1) * sizeof(*table), GFP_KERNEL);
+        table = kmalloc_array(priv->max_freqs + 1, sizeof(*table), GFP_KERNEL);
         if (!table)
                 return ERR_PTR(-ENOMEM);
 
diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
index b07559b9ed99..e6f9cbe5835f 100644
--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -410,7 +410,7 @@ brcm_avs_get_freq_table(struct device *dev, struct private_data *priv)
         if (ret)
                 return ERR_PTR(ret);
 
-        table = devm_kzalloc(dev, (AVS_PSTATE_MAX + 1) * sizeof(*table),
+        table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1, sizeof(*table),
                              GFP_KERNEL);
         if (!table)
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
index 3464580ac3ca..a9d3eec32795 100644
--- a/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -313,7 +313,8 @@ static int __init cppc_cpufreq_init(void)
         if (acpi_disabled)
                 return -ENODEV;
 
-        all_cpu_data = kzalloc(sizeof(void *) * num_possible_cpus(), GFP_KERNEL);
+        all_cpu_data = kcalloc(num_possible_cpus(), sizeof(void *),
+                               GFP_KERNEL);
         if (!all_cpu_data)
                 return -ENOMEM;
 
diff --git a/drivers/cpufreq/ia64-acpi-cpufreq.c b/drivers/cpufreq/ia64-acpi-cpufreq.c
index 7974a2fdb760..dd5440d3372d 100644
--- a/drivers/cpufreq/ia64-acpi-cpufreq.c
+++ b/drivers/cpufreq/ia64-acpi-cpufreq.c
@@ -241,8 +241,8 @@ acpi_cpufreq_cpu_init (
         }
 
         /* alloc freq_table */
-        freq_table = kzalloc(sizeof(*freq_table) *
-                                   (data->acpi_data.state_count + 1),
+        freq_table = kcalloc(data->acpi_data.state_count + 1,
+                                   sizeof(*freq_table),
                                    GFP_KERNEL);
         if (!freq_table) {
                 result = -ENOMEM;
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 83cf631fc9bc..70912104a199 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -377,7 +377,8 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
         }
 
         /* Make imx6_soc_volt array's size same as arm opp number */
-        imx6_soc_volt = devm_kzalloc(cpu_dev, sizeof(*imx6_soc_volt) * num, GFP_KERNEL);
+        imx6_soc_volt = devm_kcalloc(cpu_dev, num, sizeof(*imx6_soc_volt),
+                                     GFP_KERNEL);
         if (imx6_soc_volt == NULL) {
                 ret = -ENOMEM;
                 goto free_freq_table;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 08960a55eb27..b6575408f279 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -2339,7 +2339,7 @@ hwp_cpu_matched:
 
         pr_info("Intel P-state driver initializing\n");
 
-        all_cpu_data = vzalloc(sizeof(void *) * num_possible_cpus());
+        all_cpu_data = vzalloc(array_size(sizeof(void *), num_possible_cpus()));
         if (!all_cpu_data)
                 return -ENOMEM;
 
diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
index 61a4c5b08219..279bd9e9fa95 100644
--- a/drivers/cpufreq/longhaul.c
+++ b/drivers/cpufreq/longhaul.c
@@ -474,8 +474,8 @@ static int longhaul_get_ranges(void)
                 return -EINVAL;
         }
 
-        longhaul_table = kzalloc((numscales + 1) * sizeof(*longhaul_table),
-                        GFP_KERNEL);
+        longhaul_table = kcalloc(numscales + 1, sizeof(*longhaul_table),
+                                 GFP_KERNEL);
         if (!longhaul_table)
                 return -ENOMEM;
 
diff --git a/drivers/cpufreq/pxa3xx-cpufreq.c b/drivers/cpufreq/pxa3xx-cpufreq.c
index 7acc7fa4536d..9daa2cc318bb 100644
--- a/drivers/cpufreq/pxa3xx-cpufreq.c
+++ b/drivers/cpufreq/pxa3xx-cpufreq.c
@@ -93,7 +93,7 @@ static int setup_freqs_table(struct cpufreq_policy *policy,
         struct cpufreq_frequency_table *table;
         int i;
 
-        table = kzalloc((num + 1) * sizeof(*table), GFP_KERNEL);
+        table = kcalloc(num + 1, sizeof(*table), GFP_KERNEL);
         if (table == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/cpufreq/s3c24xx-cpufreq.c b/drivers/cpufreq/s3c24xx-cpufreq.c
index 909bd6e27639..3b291a2b0cb3 100644
--- a/drivers/cpufreq/s3c24xx-cpufreq.c
+++ b/drivers/cpufreq/s3c24xx-cpufreq.c
@@ -562,7 +562,7 @@ static int s3c_cpufreq_build_freq(void)
         size = cpu_cur.info->calc_freqtable(&cpu_cur, NULL, 0);
         size++;
 
-        ftab = kzalloc(sizeof(*ftab) * size, GFP_KERNEL);
+        ftab = kcalloc(size, sizeof(*ftab), GFP_KERNEL);
         if (!ftab)
                 return -ENOMEM;
 
diff --git a/drivers/cpufreq/sfi-cpufreq.c b/drivers/cpufreq/sfi-cpufreq.c
index 9767afe05da2..978770432b13 100644
--- a/drivers/cpufreq/sfi-cpufreq.c
+++ b/drivers/cpufreq/sfi-cpufreq.c
@@ -95,8 +95,8 @@ static int __init sfi_cpufreq_init(void)
         if (ret)
                 return ret;
 
-        freq_table = kzalloc(sizeof(*freq_table) *
-                        (num_freq_table_entries + 1), GFP_KERNEL);
+        freq_table = kcalloc(num_freq_table_entries + 1, sizeof(*freq_table),
+                             GFP_KERNEL);
         if (!freq_table) {
                 ret = -ENOMEM;
                 goto err_free_array;
diff --git a/drivers/cpufreq/spear-cpufreq.c b/drivers/cpufreq/spear-cpufreq.c
index 195f27f9c1cb..4074e2615522 100644
--- a/drivers/cpufreq/spear-cpufreq.c
+++ b/drivers/cpufreq/spear-cpufreq.c
@@ -195,7 +195,7 @@ static int spear_cpufreq_probe(struct platform_device *pdev)
         cnt = prop->length / sizeof(u32);
         val = prop->value;
 
-        freq_tbl = kzalloc(sizeof(*freq_tbl) * (cnt + 1), GFP_KERNEL);
+        freq_tbl = kcalloc(cnt + 1, sizeof(*freq_tbl), GFP_KERNEL);
         if (!freq_tbl) {
                 ret = -ENOMEM;
                 goto out_put_node;
diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index 9cb234c72549..05981ccd9901 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -141,11 +141,11 @@ static void crypto4xx_hw_init(struct crypto4xx_device *dev)
 
 int crypto4xx_alloc_sa(struct crypto4xx_ctx *ctx, u32 size)
 {
-        ctx->sa_in = kzalloc(size * 4, GFP_ATOMIC);
+        ctx->sa_in = kcalloc(size, 4, GFP_ATOMIC);
         if (ctx->sa_in == NULL)
                 return -ENOMEM;
 
-        ctx->sa_out = kzalloc(size * 4, GFP_ATOMIC);
+        ctx->sa_out = kcalloc(size, 4, GFP_ATOMIC);
         if (ctx->sa_out == NULL) {
                 kfree(ctx->sa_in);
                 ctx->sa_in = NULL;
@@ -180,8 +180,8 @@ static u32 crypto4xx_build_pdr(struct crypto4xx_device *dev)
         if (!dev->pdr)
                 return -ENOMEM;
 
-        dev->pdr_uinfo = kzalloc(sizeof(struct pd_uinfo) * PPC4XX_NUM_PD,
-                                GFP_KERNEL);
+        dev->pdr_uinfo = kcalloc(PPC4XX_NUM_PD, sizeof(struct pd_uinfo),
+                                 GFP_KERNEL);
         if (!dev->pdr_uinfo) {
                 dma_free_coherent(dev->core_dev->device,
                                   sizeof(struct ce_pd) * PPC4XX_NUM_PD,
diff --git a/drivers/crypto/cavium/nitrox/nitrox_isr.c b/drivers/crypto/cavium/nitrox/nitrox_isr.c
index dbead5f45df3..ee0d70ba25d5 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_isr.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_isr.c
@@ -254,7 +254,7 @@ static int nitrox_enable_msix(struct nitrox_device *ndev)
          * Entry 192: NPS_CORE_INT_ACTIVE
          */
         nr_entries = (ndev->nr_queues * NR_RING_VECTORS) + 1;
-        entries = kzalloc_node(nr_entries * sizeof(struct msix_entry),
+        entries = kcalloc_node(nr_entries, sizeof(struct msix_entry),
                                GFP_KERNEL, ndev->node);
         if (!entries)
                 return -ENOMEM;
diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c
index 51fc6821cbbf..00c7aab8e7d0 100644
--- a/drivers/crypto/chelsio/chtls/chtls_io.c
+++ b/drivers/crypto/chelsio/chtls/chtls_io.c
@@ -240,7 +240,7 @@ static int tls_copy_ivs(struct sock *sk, struct sk_buff *skb)
         }
 
         /* generate the  IVs */
-        ivs = kmalloc(number_of_ivs * CIPHER_BLOCK_SIZE, GFP_ATOMIC);
+        ivs = kmalloc_array(CIPHER_BLOCK_SIZE, number_of_ivs, GFP_ATOMIC);
         if (!ivs)
                 return -ENOMEM;
         get_random_bytes(ivs, number_of_ivs * CIPHER_BLOCK_SIZE);
diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
index d138d6b8fec5..c77b0e1655a8 100644
--- a/drivers/crypto/inside-secure/safexcel_hash.c
+++ b/drivers/crypto/inside-secure/safexcel_hash.c
@@ -922,7 +922,7 @@ int safexcel_hmac_setkey(const char *alg, const u8 *key, unsigned int keylen,
         crypto_ahash_clear_flags(tfm, ~0);
         blocksize = crypto_tfm_alg_blocksize(crypto_ahash_tfm(tfm));
 
-        ipad = kzalloc(2 * blocksize, GFP_KERNEL);
+        ipad = kcalloc(2, blocksize, GFP_KERNEL);
         if (!ipad) {
                 ret = -ENOMEM;
                 goto free_request;
diff --git a/drivers/crypto/marvell/cesa.c b/drivers/crypto/marvell/cesa.c
index f81fa4a3e66b..a4aa6813de4b 100644
--- a/drivers/crypto/marvell/cesa.c
+++ b/drivers/crypto/marvell/cesa.c
@@ -471,7 +471,7 @@ static int mv_cesa_probe(struct platform_device *pdev)
                 sram_size = CESA_SA_MIN_SRAM_SIZE;
 
         cesa->sram_size = sram_size;
-        cesa->engines = devm_kzalloc(dev, caps->nengines * sizeof(*engines),
+        cesa->engines = devm_kcalloc(dev, caps->nengines, sizeof(*engines),
                                      GFP_KERNEL);
         if (!cesa->engines)
                 return -ENOMEM;
diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
index e61b08566093..e34d80b6b7e5 100644
--- a/drivers/crypto/marvell/hash.c
+++ b/drivers/crypto/marvell/hash.c
@@ -1198,7 +1198,7 @@ static int mv_cesa_ahmac_setkey(const char *hash_alg_name,
 
         blocksize = crypto_tfm_alg_blocksize(crypto_ahash_tfm(tfm));
 
-        ipad = kzalloc(2 * blocksize, GFP_KERNEL);
+        ipad = kcalloc(2, blocksize, GFP_KERNEL);
         if (!ipad) {
                 ret = -ENOMEM;
                 goto free_req;
diff --git a/drivers/crypto/n2_core.c b/drivers/crypto/n2_core.c
index 80e9c842aad4..ab6235b7ff22 100644
--- a/drivers/crypto/n2_core.c
+++ b/drivers/crypto/n2_core.c
@@ -1919,12 +1919,12 @@ static int grab_global_resources(void)
                 goto out_hvapi_release;
 
         err = -ENOMEM;
-        cpu_to_cwq = kzalloc(sizeof(struct spu_queue *) * NR_CPUS,
+        cpu_to_cwq = kcalloc(NR_CPUS, sizeof(struct spu_queue *),
                              GFP_KERNEL);
         if (!cpu_to_cwq)
                 goto out_queue_cache_destroy;
 
-        cpu_to_mau = kzalloc(sizeof(struct spu_queue *) * NR_CPUS,
+        cpu_to_mau = kcalloc(NR_CPUS, sizeof(struct spu_queue *),
                              GFP_KERNEL);
         if (!cpu_to_mau)
                 goto out_free_cwq_table;
diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c
index 06d49017a52b..cd1cdf5305bc 100644
--- a/drivers/crypto/qat/qat_common/adf_isr.c
+++ b/drivers/crypto/qat/qat_common/adf_isr.c
@@ -238,7 +238,7 @@ static int adf_isr_alloc_msix_entry_table(struct adf_accel_dev *accel_dev)
         if (!accel_dev->pf.vf_info)
                 msix_num_entries += hw_data->num_banks;
 
-        entries = kzalloc_node(msix_num_entries * sizeof(*entries),
+        entries = kcalloc_node(msix_num_entries, sizeof(*entries),
                                GFP_KERNEL, dev_to_node(&GET_DEV(accel_dev)));
         if (!entries)
                 return -ENOMEM;
diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c
index 98d22c2096e3..6bd8f6a2a24f 100644
--- a/drivers/crypto/qat/qat_common/qat_uclo.c
+++ b/drivers/crypto/qat/qat_common/qat_uclo.c
@@ -1162,8 +1162,9 @@ static int qat_uclo_map_suof(struct icp_qat_fw_loader_handle *handle,
         suof_handle->img_table.num_simgs = suof_ptr->num_chunks - 1;
 
         if (suof_handle->img_table.num_simgs != 0) {
-                suof_img_hdr = kzalloc(suof_handle->img_table.num_simgs *
-                                       sizeof(img_header), GFP_KERNEL);
+                suof_img_hdr = kcalloc(suof_handle->img_table.num_simgs,
+                                       sizeof(img_header),
+                                       GFP_KERNEL);
                 if (!suof_img_hdr)
                         return -ENOMEM;
                 suof_handle->img_table.simg_hdr = suof_img_hdr;
diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c
index 981e45692695..cdc96f1bb917 100644
--- a/drivers/crypto/stm32/stm32-hash.c
+++ b/drivers/crypto/stm32/stm32-hash.c
@@ -970,8 +970,9 @@ static int stm32_hash_export(struct ahash_request *req, void *out)
         while (!(stm32_hash_read(hdev, HASH_SR) & HASH_SR_DATA_INPUT_READY))
                 cpu_relax();
 
-        rctx->hw_context = kmalloc(sizeof(u32) * (3 + HASH_CSR_REGISTER_NUMBER),
-                                   GFP_KERNEL);
+        rctx->hw_context = kmalloc_array(3 + HASH_CSR_REGISTER_NUMBER,
+                                         sizeof(u32),
+                                         GFP_KERNEL);
 
         preg = rctx->hw_context;
 
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 7cebf0a6ffbc..cf14f099ce4a 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -3393,8 +3393,10 @@ static int talitos_probe(struct platform_device *ofdev)
                 }
         }
 
-        priv->chan = devm_kzalloc(dev, sizeof(struct talitos_channel) *
-                                       priv->num_channels, GFP_KERNEL);
+        priv->chan = devm_kcalloc(dev,
+                                  priv->num_channels,
+                                  sizeof(struct talitos_channel),
+                                  GFP_KERNEL);
         if (!priv->chan) {
                 dev_err(dev, "failed to allocate channel management space\n");
                 err = -ENOMEM;
@@ -3411,9 +3413,10 @@ static int talitos_probe(struct platform_device *ofdev)
                 spin_lock_init(&priv->chan[i].head_lock);
                 spin_lock_init(&priv->chan[i].tail_lock);
 
-                priv->chan[i].fifo = devm_kzalloc(dev,
-                                                sizeof(struct talitos_request) *
-                                                priv->fifo_len, GFP_KERNEL);
+                priv->chan[i].fifo = devm_kcalloc(dev,
+                                                priv->fifo_len,
+                                                sizeof(struct talitos_request),
+                                                GFP_KERNEL);
                 if (!priv->chan[i].fifo) {
                         dev_err(dev, "failed to allocate request fifo %d\n", i);
                         err = -ENOMEM;
diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c
index ba190cfa7aa1..af6a908dfa7a 100644
--- a/drivers/crypto/virtio/virtio_crypto_algs.c
+++ b/drivers/crypto/virtio/virtio_crypto_algs.c
@@ -371,7 +371,7 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req,
 
         /* Why 3?  outhdr + iv + inhdr */
         sg_total = src_nents + dst_nents + 3;
-        sgs = kzalloc_node(sg_total * sizeof(*sgs), GFP_ATOMIC,
+        sgs = kcalloc_node(sg_total, sizeof(*sgs), GFP_ATOMIC,
                                 dev_to_node(&vcrypto->vdev->dev));
         if (!sgs)
                 return -ENOMEM;
diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
index fe2af6aa88fc..0b5b3abe054e 100644
--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -628,14 +628,15 @@ struct devfreq *devfreq_add_device(struct device *dev,
                 goto err_dev;
         }
 
-        devfreq->trans_table =  devm_kzalloc(&devfreq->dev,
-                                                sizeof(unsigned int) *
-                                                devfreq->profile->max_state *
-                                                devfreq->profile->max_state,
-                                                GFP_KERNEL);
-        devfreq->time_in_state = devm_kzalloc(&devfreq->dev,
-                                                sizeof(unsigned long) *
+        devfreq->trans_table =
+                devm_kzalloc(&devfreq->dev,
+                             array3_size(sizeof(unsigned int),
+                                         devfreq->profile->max_state,
+                                         devfreq->profile->max_state),
+                             GFP_KERNEL);
+        devfreq->time_in_state = devm_kcalloc(&devfreq->dev,
                                                 devfreq->profile->max_state,
+                                                sizeof(unsigned long),
                                                 GFP_KERNEL);
         devfreq->last_stat_updated = jiffies;
 
diff --git a/drivers/devfreq/event/exynos-ppmu.c b/drivers/devfreq/event/exynos-ppmu.c
index d96e3dc71cf8..3cd6a184fe7c 100644
--- a/drivers/devfreq/event/exynos-ppmu.c
+++ b/drivers/devfreq/event/exynos-ppmu.c
@@ -518,7 +518,7 @@ static int of_get_devfreq_events(struct device_node *np,
         event_ops = exynos_bus_get_ops(np);
 
         count = of_get_child_count(events_np);
-        desc = devm_kzalloc(dev, sizeof(*desc) * count, GFP_KERNEL);
+        desc = devm_kcalloc(dev, count, sizeof(*desc), GFP_KERNEL);
         if (!desc)
                 return -ENOMEM;
         info->num_events = count;
diff --git a/drivers/dma/bestcomm/bestcomm.c b/drivers/dma/bestcomm/bestcomm.c
index 7a67b8345092..d91cbbe7a48f 100644
--- a/drivers/dma/bestcomm/bestcomm.c
+++ b/drivers/dma/bestcomm/bestcomm.c
@@ -87,7 +87,8 @@ bcom_task_alloc(int bd_count, int bd_size, int priv_size)
 
         /* Init the BDs, if needed */
         if (bd_count) {
-                tsk->cookie = kmalloc(sizeof(void*) * bd_count, GFP_KERNEL);
+                tsk->cookie = kmalloc_array(bd_count, sizeof(void *),
+                                            GFP_KERNEL);
                 if (!tsk->cookie)
                         goto error;
 
diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
index 7792a9186f9c..4fa4c06c9edb 100644
--- a/drivers/dma/ioat/init.c
+++ b/drivers/dma/ioat/init.c
@@ -322,10 +322,10 @@ static int ioat_dma_self_test(struct ioatdma_device *ioat_dma)
         unsigned long tmo;
         unsigned long flags;
 
-        src = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
+        src = kzalloc(IOAT_TEST_SIZE, GFP_KERNEL);
         if (!src)
                 return -ENOMEM;
-        dest = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
+        dest = kzalloc(IOAT_TEST_SIZE, GFP_KERNEL);
         if (!dest) {
                 kfree(src);
                 return -ENOMEM;
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
index ed76044ce4b9..bbff52be4f0f 100644
--- a/drivers/dma/ipu/ipu_idmac.c
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -910,7 +910,8 @@ out:
 /* Called with ichan->chan_mutex held */
 static int idmac_desc_alloc(struct idmac_channel *ichan, int n)
 {
-        struct idmac_tx_desc *desc = vmalloc(n * sizeof(struct idmac_tx_desc));
+        struct idmac_tx_desc *desc =
+                vmalloc(array_size(n, sizeof(struct idmac_tx_desc)));
         struct idmac *idmac = to_idmac(ichan->dma_chan.device);
 
         if (!desc)
diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c
index 26b67455208f..fa31cccbe04f 100644
--- a/drivers/dma/k3dma.c
+++ b/drivers/dma/k3dma.c
@@ -848,8 +848,8 @@ static int k3_dma_probe(struct platform_device *op)
                 return -ENOMEM;
 
         /* init phy channel */
-        d->phy = devm_kzalloc(&op->dev,
-                d->dma_channels * sizeof(struct k3_dma_phy), GFP_KERNEL);
+        d->phy = devm_kcalloc(&op->dev,
+                d->dma_channels, sizeof(struct k3_dma_phy), GFP_KERNEL);
         if (d->phy == NULL)
                 return -ENOMEM;
 
@@ -879,8 +879,8 @@ static int k3_dma_probe(struct platform_device *op)
         d->slave.copy_align = DMAENGINE_ALIGN_8_BYTES;
 
         /* init virtual channel */
-        d->chans = devm_kzalloc(&op->dev,
-                d->dma_requests * sizeof(struct k3_dma_chan), GFP_KERNEL);
+        d->chans = devm_kcalloc(&op->dev,
+                d->dma_requests, sizeof(struct k3_dma_chan), GFP_KERNEL);
         if (d->chans == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/dma/mic_x100_dma.c b/drivers/dma/mic_x100_dma.c
index 94d7bd7d2880..68dd79783b54 100644
--- a/drivers/dma/mic_x100_dma.c
+++ b/drivers/dma/mic_x100_dma.c
@@ -385,7 +385,8 @@ static int mic_dma_alloc_desc_ring(struct mic_dma_chan *ch)
         if (dma_mapping_error(dev, ch->desc_ring_micpa))
                 goto map_error;
 
-        ch->tx_array = vzalloc(MIC_DMA_DESC_RX_SIZE * sizeof(*ch->tx_array));
+        ch->tx_array = vzalloc(array_size(MIC_DMA_DESC_RX_SIZE,
+                                          sizeof(*ch->tx_array)));
         if (!ch->tx_array)
                 goto tx_error;
         return 0;
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 1993889003fd..969534c1a6c6 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -777,11 +777,11 @@ static int mv_chan_memcpy_self_test(struct mv_xor_chan *mv_chan)
         struct dmaengine_unmap_data *unmap;
         int err = 0;
 
-        src = kmalloc(sizeof(u8) * PAGE_SIZE, GFP_KERNEL);
+        src = kmalloc(PAGE_SIZE, GFP_KERNEL);
         if (!src)
                 return -ENOMEM;
 
-        dest = kzalloc(sizeof(u8) * PAGE_SIZE, GFP_KERNEL);
+        dest = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!dest) {
                 kfree(src);
                 return -ENOMEM;
diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
index 3548caa9e933..c6589ccf1b9a 100644
--- a/drivers/dma/mv_xor_v2.c
+++ b/drivers/dma/mv_xor_v2.c
@@ -809,8 +809,9 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
         }
 
         /* alloc memory for the SW descriptors */
-        xor_dev->sw_desq = devm_kzalloc(&pdev->dev, sizeof(*sw_desc) *
-                                        MV_XOR_V2_DESC_NUM, GFP_KERNEL);
+        xor_dev->sw_desq = devm_kcalloc(&pdev->dev,
+                                        MV_XOR_V2_DESC_NUM, sizeof(*sw_desc),
+                                        GFP_KERNEL);
         if (!xor_dev->sw_desq) {
                 ret = -ENOMEM;
                 goto free_hw_desq;
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 6237069001c4..defcdde4d358 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -1866,7 +1866,7 @@ static int dmac_alloc_threads(struct pl330_dmac *pl330)
         int i;
 
         /* Allocate 1 Manager and 'chans' Channel threads */
-        pl330->channels = kzalloc((1 + chans) * sizeof(*thrd),
+        pl330->channels = kcalloc(1 + chans, sizeof(*thrd),
                                         GFP_KERNEL);
         if (!pl330->channels)
                 return -ENOMEM;
@@ -2990,7 +2990,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
 
         pl330->num_peripherals = num_chan;
 
-        pl330->peripherals = kzalloc(num_chan * sizeof(*pch), GFP_KERNEL);
+        pl330->peripherals = kcalloc(num_chan, sizeof(*pch), GFP_KERNEL);
         if (!pl330->peripherals) {
                 ret = -ENOMEM;
                 goto probe_err2;
diff --git a/drivers/dma/s3c24xx-dma.c b/drivers/dma/s3c24xx-dma.c
index cd92d696bcf9..7056fe7513b4 100644
--- a/drivers/dma/s3c24xx-dma.c
+++ b/drivers/dma/s3c24xx-dma.c
@@ -1223,9 +1223,9 @@ static int s3c24xx_dma_probe(struct platform_device *pdev)
         if (IS_ERR(s3cdma->base))
                 return PTR_ERR(s3cdma->base);
 
-        s3cdma->phy_chans = devm_kzalloc(&pdev->dev,
-                                              sizeof(struct s3c24xx_dma_phy) *
-                                                        pdata->num_phy_channels,
+        s3cdma->phy_chans = devm_kcalloc(&pdev->dev,
+                                              pdata->num_phy_channels,
+                                              sizeof(struct s3c24xx_dma_phy),
                                               GFP_KERNEL);
         if (!s3cdma->phy_chans)
                 return -ENOMEM;
diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
index 12fa48e380cf..6b5626e299b2 100644
--- a/drivers/dma/sh/shdma-base.c
+++ b/drivers/dma/sh/shdma-base.c
@@ -1045,8 +1045,9 @@ EXPORT_SYMBOL(shdma_cleanup);
 
 static int __init shdma_enter(void)
 {
-        shdma_slave_used = kzalloc(DIV_ROUND_UP(slave_num, BITS_PER_LONG) *
-                                    sizeof(long), GFP_KERNEL);
+        shdma_slave_used = kcalloc(DIV_ROUND_UP(slave_num, BITS_PER_LONG),
+                                   sizeof(long),
+                                   GFP_KERNEL);
         if (!shdma_slave_used)
                 return -ENOMEM;
         return 0;
diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
index f14645817ed8..c74a88b65039 100644
--- a/drivers/dma/xilinx/zynqmp_dma.c
+++ b/drivers/dma/xilinx/zynqmp_dma.c
@@ -471,7 +471,7 @@ static int zynqmp_dma_alloc_chan_resources(struct dma_chan *dchan)
         if (ret < 0)
                 return ret;
 
-        chan->sw_desc_pool = kzalloc(sizeof(*desc) * ZYNQMP_DMA_NUM_DESCS,
+        chan->sw_desc_pool = kcalloc(ZYNQMP_DMA_NUM_DESCS, sizeof(*desc),
                                      GFP_KERNEL);
         if (!chan->sw_desc_pool)
                 return -ENOMEM;
diff --git a/drivers/dma/zx_dma.c b/drivers/dma/zx_dma.c
index 2bb695315300..2571bc7693df 100644
--- a/drivers/dma/zx_dma.c
+++ b/drivers/dma/zx_dma.c
@@ -798,8 +798,8 @@ static int zx_dma_probe(struct platform_device *op)
                 return -ENOMEM;
 
         /* init phy channel */
-        d->phy = devm_kzalloc(&op->dev,
-                d->dma_channels * sizeof(struct zx_dma_phy), GFP_KERNEL);
+        d->phy = devm_kcalloc(&op->dev,
+                d->dma_channels, sizeof(struct zx_dma_phy), GFP_KERNEL);
         if (!d->phy)
                 return -ENOMEM;
 
@@ -834,8 +834,8 @@ static int zx_dma_probe(struct platform_device *op)
         d->slave.residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
 
         /* init virtual channel */
-        d->chans = devm_kzalloc(&op->dev,
-                d->dma_requests * sizeof(struct zx_dma_chan), GFP_KERNEL);
+        d->chans = devm_kcalloc(&op->dev,
+                d->dma_requests, sizeof(struct zx_dma_chan), GFP_KERNEL);
         if (!d->chans)
                 return -ENOMEM;
 
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 329cb96f886f..18aeabb1d5ee 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -3451,7 +3451,7 @@ static int __init amd64_edac_init(void)
         opstate_init();
 
         err = -ENOMEM;
-        ecc_stngs = kzalloc(amd_nb_num() * sizeof(ecc_stngs[0]), GFP_KERNEL);
+        ecc_stngs = kcalloc(amd_nb_num(), sizeof(ecc_stngs[0]), GFP_KERNEL);
         if (!ecc_stngs)
                 goto err_free;
 
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index 4d0ea3563d47..8ed4dd9c571b 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -461,7 +461,7 @@ static struct i7core_dev *alloc_i7core_dev(u8 socket,
         if (!i7core_dev)
                 return NULL;
 
-        i7core_dev->pdev = kzalloc(sizeof(*i7core_dev->pdev) * table->n_devs,
+        i7core_dev->pdev = kcalloc(table->n_devs, sizeof(*i7core_dev->pdev),
                                    GFP_KERNEL);
         if (!i7core_dev->pdev) {
                 kfree(i7core_dev);
diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
index 8bff5fd18185..af83ad58819c 100644
--- a/drivers/extcon/extcon.c
+++ b/drivers/extcon/extcon.c
@@ -1126,8 +1126,9 @@ int extcon_dev_register(struct extcon_dev *edev)
                 char *str;
                 struct extcon_cable *cable;
 
-                edev->cables = kzalloc(sizeof(struct extcon_cable) *
-                                       edev->max_supported, GFP_KERNEL);
+                edev->cables = kcalloc(edev->max_supported,
+                                       sizeof(struct extcon_cable),
+                                       GFP_KERNEL);
                 if (!edev->cables) {
                         ret = -ENOMEM;
                         goto err_sysfs_alloc;
@@ -1136,7 +1137,7 @@ int extcon_dev_register(struct extcon_dev *edev)
                         cable = &edev->cables[index];
 
                         snprintf(buf, 10, "cable.%d", index);
-                        str = kzalloc(sizeof(char) * (strlen(buf) + 1),
+                        str = kzalloc(strlen(buf) + 1,
                                       GFP_KERNEL);
                         if (!str) {
                                 for (index--; index >= 0; index--) {
@@ -1177,15 +1178,17 @@ int extcon_dev_register(struct extcon_dev *edev)
                 for (index = 0; edev->mutually_exclusive[index]; index++)
                         ;
 
-                edev->attrs_muex = kzalloc(sizeof(struct attribute *) *
-                                           (index + 1), GFP_KERNEL);
+                edev->attrs_muex = kcalloc(index + 1,
+                                           sizeof(struct attribute *),
+                                           GFP_KERNEL);
                 if (!edev->attrs_muex) {
                         ret = -ENOMEM;
                         goto err_muex;
                 }
 
-                edev->d_attrs_muex = kzalloc(sizeof(struct device_attribute) *
-                                             index, GFP_KERNEL);
+                edev->d_attrs_muex = kcalloc(index,
+                                             sizeof(struct device_attribute),
+                                             GFP_KERNEL);
                 if (!edev->d_attrs_muex) {
                         ret = -ENOMEM;
                         kfree(edev->attrs_muex);
@@ -1194,7 +1197,7 @@ int extcon_dev_register(struct extcon_dev *edev)
 
                 for (index = 0; edev->mutually_exclusive[index]; index++) {
                         sprintf(buf, "0x%x", edev->mutually_exclusive[index]);
-                        name = kzalloc(sizeof(char) * (strlen(buf) + 1),
+                        name = kzalloc(strlen(buf) + 1,
                                        GFP_KERNEL);
                         if (!name) {
                                 for (index--; index >= 0; index--) {
@@ -1220,8 +1223,9 @@ int extcon_dev_register(struct extcon_dev *edev)
 
         if (edev->max_supported) {
                 edev->extcon_dev_type.groups =
-                        kzalloc(sizeof(struct attribute_group *) *
-                                (edev->max_supported + 2), GFP_KERNEL);
+                        kcalloc(edev->max_supported + 2,
+                                sizeof(struct attribute_group *),
+                                GFP_KERNEL);
                 if (!edev->extcon_dev_type.groups) {
                         ret = -ENOMEM;
                         goto err_alloc_groups;
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c
index 38c0aa60b2cb..051327a951b1 100644
--- a/drivers/firewire/core-iso.c
+++ b/drivers/firewire/core-iso.c
@@ -45,8 +45,8 @@ int fw_iso_buffer_alloc(struct fw_iso_buffer *buffer, int page_count)
 
         buffer->page_count = 0;
         buffer->page_count_mapped = 0;
-        buffer->pages = kmalloc(page_count * sizeof(buffer->pages[0]),
-                                GFP_KERNEL);
+        buffer->pages = kmalloc_array(page_count, sizeof(buffer->pages[0]),
+                                      GFP_KERNEL);
         if (buffer->pages == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 60e75e6d9104..82ba110d9d1a 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -1121,7 +1121,7 @@ static int fwnet_broadcast_start(struct fwnet_device *dev)
         max_receive = 1U << (dev->card->max_receive + 1);
         num_packets = (FWNET_ISO_PAGE_COUNT * PAGE_SIZE) / max_receive;
 
-        ptrptr = kmalloc(sizeof(void *) * num_packets, GFP_KERNEL);
+        ptrptr = kmalloc_array(num_packets, sizeof(void *), GFP_KERNEL);
         if (!ptrptr) {
                 retval = -ENOMEM;
                 goto failed;
diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
index 6d7a6c0a5e07..c7d06a36b23a 100644
--- a/drivers/firmware/arm_scpi.c
+++ b/drivers/firmware/arm_scpi.c
@@ -890,7 +890,7 @@ static int scpi_alloc_xfer_list(struct device *dev, struct scpi_chan *ch)
         int i;
         struct scpi_xfer *xfers;
 
-        xfers = devm_kzalloc(dev, MAX_SCPI_XFERS * sizeof(*xfers), GFP_KERNEL);
+        xfers = devm_kcalloc(dev, MAX_SCPI_XFERS, sizeof(*xfers), GFP_KERNEL);
         if (!xfers)
                 return -ENOMEM;
 
diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
index 2f452f1f7c8a..fb8af5cb7c9b 100644
--- a/drivers/firmware/dell_rbu.c
+++ b/drivers/firmware/dell_rbu.c
@@ -146,7 +146,7 @@ static int create_packet(void *data, size_t length)
         packet_array_size = max(
                         (unsigned int)(allocation_floor / rbu_data.packetsize),
                         (unsigned int)1);
-        invalid_addr_packet_array = kzalloc(packet_array_size * sizeof(void*),
+        invalid_addr_packet_array = kcalloc(packet_array_size, sizeof(void *),
                                                 GFP_KERNEL);
 
         if (!invalid_addr_packet_array) {
diff --git a/drivers/firmware/efi/capsule.c b/drivers/firmware/efi/capsule.c
index 901b9306bf94..4938c29b7c5d 100644
--- a/drivers/firmware/efi/capsule.c
+++ b/drivers/firmware/efi/capsule.c
@@ -231,7 +231,7 @@ int efi_capsule_update(efi_capsule_header_t *capsule, phys_addr_t *pages)
         count = DIV_ROUND_UP(imagesize, PAGE_SIZE);
         sg_count = sg_pages_num(count);
 
-        sg_pages = kzalloc(sg_count * sizeof(*sg_pages), GFP_KERNEL);
+        sg_pages = kcalloc(sg_count, sizeof(*sg_pages), GFP_KERNEL);
         if (!sg_pages)
                 return -ENOMEM;
 
diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c
index f377609ff141..84a11d0a8023 100644
--- a/drivers/firmware/efi/runtime-map.c
+++ b/drivers/firmware/efi/runtime-map.c
@@ -166,7 +166,7 @@ int __init efi_runtime_map_init(struct kobject *efi_kobj)
         if (!efi_enabled(EFI_MEMMAP))
                 return 0;
 
-        map_entries = kzalloc(efi.memmap.nr_map * sizeof(entry), GFP_KERNEL);
+        map_entries = kcalloc(efi.memmap.nr_map, sizeof(entry), GFP_KERNEL);
         if (!map_entries) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
index b74a533ef35b..7fa744793bc5 100644
--- a/drivers/firmware/ti_sci.c
+++ b/drivers/firmware/ti_sci.c
@@ -1854,9 +1854,9 @@ static int ti_sci_probe(struct platform_device *pdev)
         if (!minfo->xfer_block)
                 return -ENOMEM;
 
-        minfo->xfer_alloc_table = devm_kzalloc(dev,
-                                               BITS_TO_LONGS(desc->max_msgs)
-                                               * sizeof(unsigned long),
+        minfo->xfer_alloc_table = devm_kcalloc(dev,
+                                               BITS_TO_LONGS(desc->max_msgs),
+                                               sizeof(unsigned long),
                                                GFP_KERNEL);
         if (!minfo->xfer_alloc_table)
                 return -ENOMEM;
diff --git a/drivers/fmc/fmc-sdb.c b/drivers/fmc/fmc-sdb.c
index ffdc1762b580..d0e65b86dc22 100644
--- a/drivers/fmc/fmc-sdb.c
+++ b/drivers/fmc/fmc-sdb.c
@@ -48,8 +48,8 @@ static struct sdb_array *__fmc_scan_sdb_tree(struct fmc_device *fmc,
         arr = kzalloc(sizeof(*arr), GFP_KERNEL);
         if (!arr)
                 return ERR_PTR(-ENOMEM);
-        arr->record = kzalloc(sizeof(arr->record[0]) * n, GFP_KERNEL);
-        arr->subtree = kzalloc(sizeof(arr->subtree[0]) * n, GFP_KERNEL);
+        arr->record = kcalloc(n, sizeof(arr->record[0]), GFP_KERNEL);
+        arr->subtree = kcalloc(n, sizeof(arr->subtree[0]), GFP_KERNEL);
         if (!arr->record || !arr->subtree) {
                 kfree(arr->record);
                 kfree(arr->subtree);
diff --git a/drivers/gpio/gpio-adnp.c b/drivers/gpio/gpio-adnp.c
index 44c09904daa6..91b90c0cea73 100644
--- a/drivers/gpio/gpio-adnp.c
+++ b/drivers/gpio/gpio-adnp.c
@@ -427,7 +427,7 @@ static int adnp_irq_setup(struct adnp *adnp)
          * is chosen to match the register layout of the hardware in that
          * each segment contains the corresponding bits for all interrupts.
          */
-        adnp->irq_enable = devm_kzalloc(chip->parent, num_regs * 6,
+        adnp->irq_enable = devm_kcalloc(chip->parent, num_regs, 6,
                                         GFP_KERNEL);
         if (!adnp->irq_enable)
                 return -ENOMEM;
diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
index 5e89f1c74a33..b31ae16170e7 100644
--- a/drivers/gpio/gpio-aspeed.c
+++ b/drivers/gpio/gpio-aspeed.c
@@ -897,8 +897,8 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev)
 
         /* Allocate a cache of the output registers */
         banks = gpio->config->nr_gpios >> 5;
-        gpio->dcache = devm_kzalloc(&pdev->dev,
-                                    sizeof(u32) * banks, GFP_KERNEL);
+        gpio->dcache = devm_kcalloc(&pdev->dev,
+                                    banks, sizeof(u32), GFP_KERNEL);
         if (!gpio->dcache)
                 return -ENOMEM;
 
diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c
index eb8369b21e90..00272fa7cc4f 100644
--- a/drivers/gpio/gpio-bcm-kona.c
+++ b/drivers/gpio/gpio-bcm-kona.c
@@ -601,9 +601,10 @@ static int bcm_kona_gpio_probe(struct platform_device *pdev)
                         GPIO_MAX_BANK_NUM);
                 return -ENXIO;
         }
-        kona_gpio->banks = devm_kzalloc(dev,
-                                        kona_gpio->num_bank *
-                                        sizeof(*kona_gpio->banks), GFP_KERNEL);
+        kona_gpio->banks = devm_kcalloc(dev,
+                                        kona_gpio->num_bank,
+                                        sizeof(*kona_gpio->banks),
+                                        GFP_KERNEL);
         if (!kona_gpio->banks)
                 return -ENOMEM;
 
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index b574ecff7761..035a454eca43 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -198,8 +198,8 @@ static int davinci_gpio_probe(struct platform_device *pdev)
                 ngpio = ARCH_NR_GPIOS;
 
         nbank = DIV_ROUND_UP(ngpio, 32);
-        chips = devm_kzalloc(dev,
-                             nbank * sizeof(struct davinci_gpio_controller),
+        chips = devm_kcalloc(dev,
+                             nbank, sizeof(struct davinci_gpio_controller),
                              GFP_KERNEL);
         if (!chips)
                 return -ENOMEM;
diff --git a/drivers/gpio/gpio-htc-egpio.c b/drivers/gpio/gpio-htc-egpio.c
index 516383934945..ad6e5b518669 100644
--- a/drivers/gpio/gpio-htc-egpio.c
+++ b/drivers/gpio/gpio-htc-egpio.c
@@ -321,8 +321,8 @@ static int __init egpio_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, ei);
 
         ei->nchips = pdata->num_chips;
-        ei->chip = devm_kzalloc(&pdev->dev,
-                                sizeof(struct egpio_chip) * ei->nchips,
+        ei->chip = devm_kcalloc(&pdev->dev,
+                                ei->nchips, sizeof(struct egpio_chip),
                                 GFP_KERNEL);
         if (!ei->chip) {
                 ret = -ENOMEM;
diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c
index e2bee27eb526..b23d9a36be1f 100644
--- a/drivers/gpio/gpio-ml-ioh.c
+++ b/drivers/gpio/gpio-ml-ioh.c
@@ -443,7 +443,7 @@ static int ioh_gpio_probe(struct pci_dev *pdev,
                 goto err_iomap;
         }
 
-        chip_save = kzalloc(sizeof(*chip) * 8, GFP_KERNEL);
+        chip_save = kcalloc(8, sizeof(*chip), GFP_KERNEL);
         if (chip_save == NULL) {
                 ret = -ENOMEM;
                 goto err_kzalloc;
diff --git a/drivers/gpio/gpio-thunderx.c b/drivers/gpio/gpio-thunderx.c
index d16e9d4a129b..1306722faa5a 100644
--- a/drivers/gpio/gpio-thunderx.c
+++ b/drivers/gpio/gpio-thunderx.c
@@ -504,16 +504,17 @@ static int thunderx_gpio_probe(struct pci_dev *pdev,
                 txgpio->base_msi = (c >> 8) & 0xff;
         }
 
-        txgpio->msix_entries = devm_kzalloc(dev,
-                                          sizeof(struct msix_entry) * ngpio,
+        txgpio->msix_entries = devm_kcalloc(dev,
+                                          ngpio, sizeof(struct msix_entry),
                                           GFP_KERNEL);
         if (!txgpio->msix_entries) {
                 err = -ENOMEM;
                 goto out;
         }
 
-        txgpio->line_entries = devm_kzalloc(dev,
-                                            sizeof(struct thunderx_line) * ngpio,
+        txgpio->line_entries = devm_kcalloc(dev,
+                                            ngpio,
+                                            sizeof(struct thunderx_line),
                                             GFP_KERNEL);
         if (!txgpio->line_entries) {
                 err = -ENOMEM;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
index 428e5eb3444f..f4c474a95875 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
@@ -310,20 +310,20 @@ static int acp_hw_init(void *handle)
                 pm_genpd_init(&adev->acp.acp_genpd->gpd, NULL, false);
         }
 
-        adev->acp.acp_cell = kzalloc(sizeof(struct mfd_cell) * ACP_DEVS,
+        adev->acp.acp_cell = kcalloc(ACP_DEVS, sizeof(struct mfd_cell),
                                                         GFP_KERNEL);
 
         if (adev->acp.acp_cell == NULL)
                 return -ENOMEM;
 
-        adev->acp.acp_res = kzalloc(sizeof(struct resource) * 4, GFP_KERNEL);
+        adev->acp.acp_res = kcalloc(4, sizeof(struct resource), GFP_KERNEL);
 
         if (adev->acp.acp_res == NULL) {
                 kfree(adev->acp.acp_cell);
                 return -ENOMEM;
         }
 
-        i2s_pdata = kzalloc(sizeof(struct i2s_platform_data) * 2, GFP_KERNEL);
+        i2s_pdata = kcalloc(2, sizeof(struct i2s_platform_data), GFP_KERNEL);
         if (i2s_pdata == NULL) {
                 kfree(adev->acp.acp_res);
                 kfree(adev->acp.acp_cell);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
index 0ff36d45a597..ea79908dac4c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
@@ -407,7 +407,7 @@ static int kgd_hqd_dump(struct kgd_dev *kgd,
                 (*dump)[i++][1] = RREG32(addr);         \
         } while (0)
 
-        *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL);
+        *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
         if (*dump == NULL)
                 return -ENOMEM;
 
@@ -504,7 +504,7 @@ static int kgd_hqd_sdma_dump(struct kgd_dev *kgd,
 #undef HQD_N_REGS
 #define HQD_N_REGS (19+4)
 
-        *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL);
+        *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
         if (*dump == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c
index 6ef9762b4b00..19dd665e7307 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c
@@ -395,7 +395,7 @@ static int kgd_hqd_dump(struct kgd_dev *kgd,
                 (*dump)[i++][1] = RREG32(addr);         \
         } while (0)
 
-        *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL);
+        *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
         if (*dump == NULL)
                 return -ENOMEM;
 
@@ -491,7 +491,7 @@ static int kgd_hqd_sdma_dump(struct kgd_dev *kgd,
 #undef HQD_N_REGS
 #define HQD_N_REGS (19+4+2+3+7)
 
-        *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL);
+        *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
         if (*dump == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c
index f0c0d3953f69..1db60aa5b7f0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c
@@ -504,7 +504,7 @@ static int kgd_hqd_dump(struct kgd_dev *kgd,
                 (*dump)[i++][1] = RREG32(addr);         \
         } while (0)
 
-        *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL);
+        *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
         if (*dump == NULL)
                 return -ENOMEM;
 
@@ -606,7 +606,7 @@ static int kgd_hqd_sdma_dump(struct kgd_dev *kgd,
 #undef HQD_N_REGS
 #define HQD_N_REGS (19+6+7+10)
 
-        *dump = kmalloc(HQD_N_REGS*2*sizeof(uint32_t), GFP_KERNEL);
+        *dump = kmalloc_array(HQD_N_REGS * 2, sizeof(uint32_t), GFP_KERNEL);
         if (*dump == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
index def1010ac05e..77ad59ade85c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
@@ -452,7 +452,7 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
                         ATOM_PPLIB_PhaseSheddingLimits_Record *entry;
 
                         adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries =
-                                kzalloc(psl->ucNumEntries *
+                                kcalloc(psl->ucNumEntries,
                                         sizeof(struct amdgpu_phase_shedding_limits_entry),
                                         GFP_KERNEL);
                         if (!adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
index 17d6b9fb6d77..dd11b7313ca0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
@@ -369,7 +369,8 @@ int amdgpu_gart_init(struct amdgpu_device *adev)
 
 #ifdef CONFIG_DRM_AMDGPU_GART_DEBUGFS
         /* Allocate pages table */
-        adev->gart.pages = vzalloc(sizeof(void *) * adev->gart.num_cpu_pages);
+        adev->gart.pages = vzalloc(array_size(sizeof(void *),
+                                              adev->gart.num_cpu_pages));
         if (adev->gart.pages == NULL)
                 return -ENOMEM;
 #endif
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
index d167e8ab76d3..e3878256743a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
@@ -53,7 +53,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev)
                 n -= adev->irq.ih.ring_size;
         n /= size;
 
-        gtt_obj = kzalloc(n * sizeof(*gtt_obj), GFP_KERNEL);
+        gtt_obj = kcalloc(n, sizeof(*gtt_obj), GFP_KERNEL);
         if (!gtt_obj) {
                 DRM_ERROR("Failed to allocate %d pointers\n", n);
                 r = 1;
diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
index 69500a8b4e2d..e9934de1b9cf 100644
--- a/drivers/gpu/drm/amd/amdgpu/atom.c
+++ b/drivers/gpu/drm/amd/amdgpu/atom.c
@@ -1221,7 +1221,7 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index,
         ectx.abort = false;
         ectx.last_jump = 0;
         if (ws)
-                ectx.ws = kzalloc(4 * ws, GFP_KERNEL);
+                ectx.ws = kcalloc(4, ws, GFP_KERNEL);
         else
                 ectx.ws = NULL;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index a266dcf5daed..7fbad2f5f0bd 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -5679,8 +5679,9 @@ static int ci_parse_power_table(struct amdgpu_device *adev)
                 (mode_info->atom_context->bios + data_offset +
                  le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
 
-        adev->pm.dpm.ps = kzalloc(sizeof(struct amdgpu_ps) *
-                                  state_array->ucNumEntries, GFP_KERNEL);
+        adev->pm.dpm.ps = kcalloc(state_array->ucNumEntries,
+                                  sizeof(struct amdgpu_ps),
+                                  GFP_KERNEL);
         if (!adev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
@@ -5927,7 +5928,9 @@ static int ci_dpm_init(struct amdgpu_device *adev)
         ci_set_private_data_variables_based_on_pptable(adev);
 
         adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries =
-                kzalloc(4 * sizeof(struct amdgpu_clock_voltage_dependency_entry), GFP_KERNEL);
+                kcalloc(4,
+                        sizeof(struct amdgpu_clock_voltage_dependency_entry),
+                        GFP_KERNEL);
         if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) {
                 ci_dpm_fini(adev);
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index 17f7f074cedc..7a1e77c93bf1 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -2727,8 +2727,9 @@ static int kv_parse_power_table(struct amdgpu_device *adev)
                 (mode_info->atom_context->bios + data_offset +
                  le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
 
-        adev->pm.dpm.ps = kzalloc(sizeof(struct amdgpu_ps) *
-                                  state_array->ucNumEntries, GFP_KERNEL);
+        adev->pm.dpm.ps = kcalloc(state_array->ucNumEntries,
+                                  sizeof(struct amdgpu_ps),
+                                  GFP_KERNEL);
         if (!adev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index b12d7c9d42a0..5c97a3671726 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -7242,8 +7242,9 @@ static int si_parse_power_table(struct amdgpu_device *adev)
                 (mode_info->atom_context->bios + data_offset +
                  le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
 
-        adev->pm.dpm.ps = kzalloc(sizeof(struct amdgpu_ps) *
-                                  state_array->ucNumEntries, GFP_KERNEL);
+        adev->pm.dpm.ps = kcalloc(state_array->ucNumEntries,
+                                  sizeof(struct amdgpu_ps),
+                                  GFP_KERNEL);
         if (!adev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
@@ -7346,7 +7347,9 @@ static int si_dpm_init(struct amdgpu_device *adev)
                 return ret;
 
         adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries =
-                kzalloc(4 * sizeof(struct amdgpu_clock_voltage_dependency_entry), GFP_KERNEL);
+                kcalloc(4,
+                        sizeof(struct amdgpu_clock_voltage_dependency_entry),
+                        GFP_KERNEL);
         if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) {
                 amdgpu_free_extended_power_table(adev);
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
index bd449351803f..ec304b1a5973 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -435,7 +435,7 @@ bool dm_helpers_submit_i2c(
                 return false;
         }
 
-        msgs = kzalloc(num * sizeof(struct i2c_msg), GFP_KERNEL);
+        msgs = kcalloc(num, sizeof(struct i2c_msg), GFP_KERNEL);
 
         if (!msgs)
                 return false;
diff --git a/drivers/gpu/drm/amd/display/dc/basics/logger.c b/drivers/gpu/drm/amd/display/dc/basics/logger.c
index 738a818d58d1..0866874ae8c6 100644
--- a/drivers/gpu/drm/amd/display/dc/basics/logger.c
+++ b/drivers/gpu/drm/amd/display/dc/basics/logger.c
@@ -364,7 +364,7 @@ void dm_logger_open(
         entry->type = log_type;
         entry->logger = logger;
 
-        entry->buf = kzalloc(DAL_LOGGER_BUFFER_MAX_SIZE * sizeof(char),
+        entry->buf = kzalloc(DAL_LOGGER_BUFFER_MAX_SIZE,
                              GFP_KERNEL);
 
         entry->buf_offset = 0;
diff --git a/drivers/gpu/drm/amd/display/dc/basics/vector.c b/drivers/gpu/drm/amd/display/dc/basics/vector.c
index 217b8f1f7bf6..d28e9cf0e961 100644
--- a/drivers/gpu/drm/amd/display/dc/basics/vector.c
+++ b/drivers/gpu/drm/amd/display/dc/basics/vector.c
@@ -40,7 +40,7 @@ bool dal_vector_construct(
                 return false;
         }
 
-        vector->container = kzalloc(struct_size * capacity, GFP_KERNEL);
+        vector->container = kcalloc(capacity, struct_size, GFP_KERNEL);
         if (vector->container == NULL)
                 return false;
         vector->capacity = capacity;
@@ -67,7 +67,7 @@ bool dal_vector_presized_costruct(
                 return false;
         }
 
-        vector->container = kzalloc(struct_size * count, GFP_KERNEL);
+        vector->container = kcalloc(count, struct_size, GFP_KERNEL);
 
         if (vector->container == NULL)
                 return false;
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
index 599c7ab6befe..88b09dd758ba 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
@@ -1079,13 +1079,15 @@ static void get_ss_info_from_atombios(
         if (*ss_entries_num == 0)
                 return;
 
-        ss_info = kzalloc(sizeof(struct spread_spectrum_info) * (*ss_entries_num),
+        ss_info = kcalloc(*ss_entries_num,
+                          sizeof(struct spread_spectrum_info),
                           GFP_KERNEL);
         ss_info_cur = ss_info;
         if (ss_info == NULL)
                 return;
 
-        ss_data = kzalloc(sizeof(struct spread_spectrum_data) * (*ss_entries_num),
+        ss_data = kcalloc(*ss_entries_num,
+                          sizeof(struct spread_spectrum_data),
                           GFP_KERNEL);
         if (ss_data == NULL)
                 goto out_free_info;
diff --git a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c
index 80038e0e610f..ab5483c0c502 100644
--- a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c
+++ b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c
@@ -98,7 +98,8 @@ struct gpio_service *dal_gpio_service_create(
                         if (number_of_bits) {
                                 uint32_t index_of_uint = 0;
 
-                                slot = kzalloc(number_of_uints * sizeof(uint32_t),
+                                slot = kcalloc(number_of_uints,
+                                               sizeof(uint32_t),
                                                GFP_KERNEL);
 
                                 if (!slot) {
diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
index 0cd111d59018..eee0dfad6962 100644
--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
@@ -1274,19 +1274,22 @@ bool mod_color_calculate_regamma_params(struct dc_transfer_func *output_tf,
 
         output_tf->type = TF_TYPE_DISTRIBUTED_POINTS;
 
-        rgb_user = kvzalloc(sizeof(*rgb_user) * (ramp->num_entries + _EXTRA_POINTS),
+        rgb_user = kvcalloc(ramp->num_entries + _EXTRA_POINTS,
+                            sizeof(*rgb_user),
                             GFP_KERNEL);
         if (!rgb_user)
                 goto rgb_user_alloc_fail;
-        rgb_regamma = kvzalloc(sizeof(*rgb_regamma) * (MAX_HW_POINTS + _EXTRA_POINTS),
+        rgb_regamma = kvcalloc(MAX_HW_POINTS + _EXTRA_POINTS,
+                               sizeof(*rgb_regamma),
                                GFP_KERNEL);
         if (!rgb_regamma)
                 goto rgb_regamma_alloc_fail;
-        axix_x = kvzalloc(sizeof(*axix_x) * (ramp->num_entries + 3),
+        axix_x = kvcalloc(ramp->num_entries + 3, sizeof(*axix_x),
                           GFP_KERNEL);
         if (!axix_x)
                 goto axix_x_alloc_fail;
-        coeff = kvzalloc(sizeof(*coeff) * (MAX_HW_POINTS + _EXTRA_POINTS), GFP_KERNEL);
+        coeff = kvcalloc(MAX_HW_POINTS + _EXTRA_POINTS, sizeof(*coeff),
+                         GFP_KERNEL);
         if (!coeff)
                 goto coeff_alloc_fail;
 
@@ -1413,13 +1416,15 @@ bool calculate_user_regamma_ramp(struct dc_transfer_func *output_tf,
 
         output_tf->type = TF_TYPE_DISTRIBUTED_POINTS;
 
-        rgb_user = kzalloc(sizeof(*rgb_user) * (GAMMA_RGB_256_ENTRIES + _EXTRA_POINTS),
-                        GFP_KERNEL);
+        rgb_user = kcalloc(GAMMA_RGB_256_ENTRIES + _EXTRA_POINTS,
+                           sizeof(*rgb_user),
+                           GFP_KERNEL);
         if (!rgb_user)
                 goto rgb_user_alloc_fail;
 
-        rgb_regamma = kzalloc(sizeof(*rgb_regamma) * (MAX_HW_POINTS + _EXTRA_POINTS),
-                        GFP_KERNEL);
+        rgb_regamma = kcalloc(MAX_HW_POINTS + _EXTRA_POINTS,
+                              sizeof(*rgb_regamma),
+                              GFP_KERNEL);
         if (!rgb_regamma)
                 goto rgb_regamma_alloc_fail;
 
@@ -1480,19 +1485,21 @@ bool mod_color_calculate_degamma_params(struct dc_transfer_func *input_tf,
 
         input_tf->type = TF_TYPE_DISTRIBUTED_POINTS;
 
-        rgb_user = kvzalloc(sizeof(*rgb_user) * (ramp->num_entries + _EXTRA_POINTS),
+        rgb_user = kvcalloc(ramp->num_entries + _EXTRA_POINTS,
+                            sizeof(*rgb_user),
                             GFP_KERNEL);
         if (!rgb_user)
                 goto rgb_user_alloc_fail;
-        curve = kvzalloc(sizeof(*curve) * (MAX_HW_POINTS + _EXTRA_POINTS),
+        curve = kvcalloc(MAX_HW_POINTS + _EXTRA_POINTS, sizeof(*curve),
                          GFP_KERNEL);
         if (!curve)
                 goto curve_alloc_fail;
-        axix_x = kvzalloc(sizeof(*axix_x) * (ramp->num_entries + _EXTRA_POINTS),
+        axix_x = kvcalloc(ramp->num_entries + _EXTRA_POINTS, sizeof(*axix_x),
                           GFP_KERNEL);
         if (!axix_x)
                 goto axix_x_alloc_fail;
-        coeff = kvzalloc(sizeof(*coeff) * (MAX_HW_POINTS + _EXTRA_POINTS), GFP_KERNEL);
+        coeff = kvcalloc(MAX_HW_POINTS + _EXTRA_POINTS, sizeof(*coeff),
+                         GFP_KERNEL);
         if (!coeff)
                 goto coeff_alloc_fail;
 
@@ -1569,8 +1576,8 @@ bool  mod_color_calculate_curve(enum dc_transfer_func_predefined trans,
                 }
                 ret = true;
         } else if (trans == TRANSFER_FUNCTION_PQ) {
-                rgb_regamma = kvzalloc(sizeof(*rgb_regamma) *
-                                       (MAX_HW_POINTS + _EXTRA_POINTS),
+                rgb_regamma = kvcalloc(MAX_HW_POINTS + _EXTRA_POINTS,
+                                       sizeof(*rgb_regamma),
                                        GFP_KERNEL);
                 if (!rgb_regamma)
                         goto rgb_regamma_alloc_fail;
@@ -1594,8 +1601,8 @@ bool  mod_color_calculate_curve(enum dc_transfer_func_predefined trans,
                 kvfree(rgb_regamma);
         } else if (trans == TRANSFER_FUNCTION_SRGB ||
                           trans == TRANSFER_FUNCTION_BT709) {
-                rgb_regamma = kvzalloc(sizeof(*rgb_regamma) *
-                                       (MAX_HW_POINTS + _EXTRA_POINTS),
+                rgb_regamma = kvcalloc(MAX_HW_POINTS + _EXTRA_POINTS,
+                                       sizeof(*rgb_regamma),
                                        GFP_KERNEL);
                 if (!rgb_regamma)
                         goto rgb_regamma_alloc_fail;
@@ -1638,8 +1645,8 @@ bool  mod_color_calculate_degamma_curve(enum dc_transfer_func_predefined trans,
                 }
                 ret = true;
         } else if (trans == TRANSFER_FUNCTION_PQ) {
-                rgb_degamma = kvzalloc(sizeof(*rgb_degamma) *
-                                       (MAX_HW_POINTS + _EXTRA_POINTS),
+                rgb_degamma = kvcalloc(MAX_HW_POINTS + _EXTRA_POINTS,
+                                       sizeof(*rgb_degamma),
                                        GFP_KERNEL);
                 if (!rgb_degamma)
                         goto rgb_degamma_alloc_fail;
@@ -1658,8 +1665,8 @@ bool  mod_color_calculate_degamma_curve(enum dc_transfer_func_predefined trans,
                 kvfree(rgb_degamma);
         } else if (trans == TRANSFER_FUNCTION_SRGB ||
                           trans == TRANSFER_FUNCTION_BT709) {
-                rgb_degamma = kvzalloc(sizeof(*rgb_degamma) *
-                                       (MAX_HW_POINTS + _EXTRA_POINTS),
+                rgb_degamma = kvcalloc(MAX_HW_POINTS + _EXTRA_POINTS,
+                                       sizeof(*rgb_degamma),
                                        GFP_KERNEL);
                 if (!rgb_degamma)
                         goto rgb_degamma_alloc_fail;
diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
index 27d4003aa2c7..fa344ceafc17 100644
--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
@@ -155,7 +155,8 @@ struct mod_freesync *mod_freesync_create(struct dc *dc)
         if (core_freesync == NULL)
                 goto fail_alloc_context;
 
-        core_freesync->map = kzalloc(sizeof(struct freesync_entity) * MOD_FREESYNC_MAX_CONCURRENT_STREAMS,
+        core_freesync->map = kcalloc(MOD_FREESYNC_MAX_CONCURRENT_STREAMS,
+                                        sizeof(struct freesync_entity),
                                         GFP_KERNEL);
 
         if (core_freesync->map == NULL)
diff --git a/drivers/gpu/drm/amd/display/modules/stats/stats.c b/drivers/gpu/drm/amd/display/modules/stats/stats.c
index 3f7d47fdc367..710852ad03f3 100644
--- a/drivers/gpu/drm/amd/display/modules/stats/stats.c
+++ b/drivers/gpu/drm/amd/display/modules/stats/stats.c
@@ -141,19 +141,17 @@ struct mod_stats *mod_stats_create(struct dc *dc)
                         else
                                 core_stats->entries = reg_data;
                 }
-                core_stats->time = kzalloc(
-                        sizeof(struct stats_time_cache) *
-                                core_stats->entries,
+                core_stats->time = kcalloc(core_stats->entries,
+                                                sizeof(struct stats_time_cache),
                                                 GFP_KERNEL);
 
                 if (core_stats->time == NULL)
                         goto fail_construct_time;
 
                 core_stats->event_entries = DAL_STATS_EVENT_ENTRIES_DEFAULT;
-                core_stats->events = kzalloc(
-                        sizeof(struct stats_event_cache) *
-                                core_stats->event_entries,
-                                                GFP_KERNEL);
+                core_stats->events = kcalloc(core_stats->event_entries,
+                                             sizeof(struct stats_event_cache),
+                                             GFP_KERNEL);
 
                 if (core_stats->events == NULL)
                         goto fail_construct_events;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
index 0af13c154328..e45a1fcc7f08 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
@@ -50,7 +50,7 @@ int psm_init_power_state_table(struct pp_hwmgr *hwmgr)
                 return 0;
         }
 
-        hwmgr->ps = kzalloc(size * table_entries, GFP_KERNEL);
+        hwmgr->ps = kcalloc(table_entries, size, GFP_KERNEL);
         if (hwmgr->ps == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 40e1e24f2ff0..a5808382bdf0 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1633,7 +1633,8 @@ struct edid *drm_do_get_edid(struct drm_connector *connector,
                 edid[EDID_LENGTH-1] += edid[0x7e] - valid_extensions;
                 edid[0x7e] = valid_extensions;
 
-                new = kmalloc((valid_extensions + 1) * EDID_LENGTH, GFP_KERNEL);
+                new = kmalloc_array(valid_extensions + 1, EDID_LENGTH,
+                                    GFP_KERNEL);
                 if (!new)
                         goto out;
 
diff --git a/drivers/gpu/drm/drm_hashtab.c b/drivers/gpu/drm/drm_hashtab.c
index dae18e58e79b..c92b00d42ece 100644
--- a/drivers/gpu/drm/drm_hashtab.c
+++ b/drivers/gpu/drm/drm_hashtab.c
@@ -47,7 +47,7 @@ int drm_ht_create(struct drm_open_hash *ht, unsigned int order)
         if (size <= PAGE_SIZE / sizeof(*ht->table))
                 ht->table = kcalloc(size, sizeof(*ht->table), GFP_KERNEL);
         else
-                ht->table = vzalloc(size*sizeof(*ht->table));
+                ht->table = vzalloc(array_size(size, sizeof(*ht->table)));
         if (!ht->table) {
                 DRM_ERROR("Out of memory for hash table\n");
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/drm_memory.c b/drivers/gpu/drm/drm_memory.c
index 3c54044214db..d69e4fc1ee77 100644
--- a/drivers/gpu/drm/drm_memory.c
+++ b/drivers/gpu/drm/drm_memory.c
@@ -80,7 +80,7 @@ static void *agp_remap(unsigned long offset, unsigned long size,
          * page-table instead (that's probably faster anyhow...).
          */
         /* note: use vmalloc() because num_pages could be large... */
-        page_map = vmalloc(num_pages * sizeof(struct page *));
+        page_map = vmalloc(array_size(num_pages, sizeof(struct page *)));
         if (!page_map)
                 return NULL;
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index 7c3030b7e586..6d29777884f9 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -1723,8 +1723,8 @@ static int exynos_dsi_probe(struct platform_device *pdev)
                 return -EPROBE_DEFER;
         }
 
-        dsi->clks = devm_kzalloc(dev,
-                        sizeof(*dsi->clks) * dsi->driver_data->num_clks,
+        dsi->clks = devm_kcalloc(dev,
+                        dsi->driver_data->num_clks, sizeof(*dsi->clks),
                         GFP_KERNEL);
         if (!dsi->clks)
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index 5ce84025d1cb..6127ef25acd6 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -1271,7 +1271,8 @@ static int fimc_probe(struct platform_device *pdev)
 
         /* construct formats/limits array */
         num_formats = ARRAY_SIZE(fimc_formats) + ARRAY_SIZE(fimc_tiled_formats);
-        formats = devm_kzalloc(dev, sizeof(*formats) * num_formats, GFP_KERNEL);
+        formats = devm_kcalloc(dev, num_formats, sizeof(*formats),
+                               GFP_KERNEL);
         if (!formats)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index e99dd1e4ba65..35ac66730563 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -1202,8 +1202,9 @@ static int gsc_probe(struct platform_device *pdev)
         if (!ctx)
                 return -ENOMEM;
 
-        formats = devm_kzalloc(dev, sizeof(*formats) *
-                               (ARRAY_SIZE(gsc_formats)), GFP_KERNEL);
+        formats = devm_kcalloc(dev,
+                               ARRAY_SIZE(gsc_formats), sizeof(*formats),
+                               GFP_KERNEL);
         if (!formats)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 09c4bc0b1859..db91932550cf 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -1692,7 +1692,7 @@ static int hdmi_clk_init(struct hdmi_context *hdata)
         if (!count)
                 return 0;
 
-        clks = devm_kzalloc(dev, sizeof(*clks) * count, GFP_KERNEL);
+        clks = devm_kcalloc(dev, count, sizeof(*clks), GFP_KERNEL);
         if (!clks)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/gma500/mid_bios.c b/drivers/gpu/drm/gma500/mid_bios.c
index 7171b7475f58..237041a37532 100644
--- a/drivers/gpu/drm/gma500/mid_bios.c
+++ b/drivers/gpu/drm/gma500/mid_bios.c
@@ -239,7 +239,7 @@ static int mid_get_vbt_data_r10(struct drm_psb_private *dev_priv, u32 addr)
         if (read_vbt_r10(addr, &vbt))
                 return -1;
 
-        gct = kmalloc(sizeof(*gct) * vbt.panel_count, GFP_KERNEL);
+        gct = kmalloc_array(vbt.panel_count, sizeof(*gct), GFP_KERNEL);
         if (!gct)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 78e55aafc8bc..23296547da95 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -1585,8 +1585,9 @@ static struct intel_vgpu_mm *intel_vgpu_create_ggtt_mm(struct intel_vgpu *vgpu)
         mm->type = INTEL_GVT_MM_GGTT;
 
         nr_entries = gvt_ggtt_gm_sz(vgpu->gvt) >> I915_GTT_PAGE_SHIFT;
-        mm->ggtt_mm.virtual_ggtt = vzalloc(nr_entries *
-                                        vgpu->gvt->device_info.gtt_entry_size);
+        mm->ggtt_mm.virtual_ggtt =
+                vzalloc(array_size(nr_entries,
+                                   vgpu->gvt->device_info.gtt_entry_size));
         if (!mm->ggtt_mm.virtual_ggtt) {
                 vgpu_free_mm(mm);
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/gpu/drm/i915/gvt/mmio.c b/drivers/gpu/drm/i915/gvt/mmio.c
index e4960aff68bd..b31eb36fc102 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.c
+++ b/drivers/gpu/drm/i915/gvt/mmio.c
@@ -267,7 +267,7 @@ int intel_vgpu_init_mmio(struct intel_vgpu *vgpu)
 {
         const struct intel_gvt_device_info *info = &vgpu->gvt->device_info;
 
-        vgpu->mmio.vreg = vzalloc(info->mmio_size * 2);
+        vgpu->mmio.vreg = vzalloc(array_size(info->mmio_size, 2));
         if (!vgpu->mmio.vreg)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index 2e0a02a80fe4..572a18c2bfb5 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -121,7 +121,7 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
         high_avail = gvt_hidden_sz(gvt) - HOST_HIGH_GM_SIZE;
         num_types = sizeof(vgpu_types) / sizeof(vgpu_types[0]);
 
-        gvt->types = kzalloc(num_types * sizeof(struct intel_vgpu_type),
+        gvt->types = kcalloc(num_types, sizeof(struct intel_vgpu_type),
                              GFP_KERNEL);
         if (!gvt->types)
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/i915/intel_hdcp.c b/drivers/gpu/drm/i915/intel_hdcp.c
index 2db5da550a1c..0cc6a861bcf8 100644
--- a/drivers/gpu/drm/i915/intel_hdcp.c
+++ b/drivers/gpu/drm/i915/intel_hdcp.c
@@ -429,7 +429,7 @@ int intel_hdcp_auth_downstream(struct intel_digital_port *intel_dig_port,
         if (num_downstream == 0)
                 return -EINVAL;
 
-        ksv_fifo = kzalloc(num_downstream * DRM_HDCP_KSV_LEN, GFP_KERNEL);
+        ksv_fifo = kcalloc(DRM_HDCP_KSV_LEN, num_downstream, GFP_KERNEL);
         if (!ksv_fifo)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/i915/selftests/intel_uncore.c b/drivers/gpu/drm/i915/selftests/intel_uncore.c
index f76f2597df5c..47bc5b2ddb56 100644
--- a/drivers/gpu/drm/i915/selftests/intel_uncore.c
+++ b/drivers/gpu/drm/i915/selftests/intel_uncore.c
@@ -137,7 +137,7 @@ static int intel_uncore_check_forcewake_domains(struct drm_i915_private *dev_pri
         if (!IS_ENABLED(CONFIG_DRM_I915_SELFTEST_BROKEN))
                 return 0;
 
-        valid = kzalloc(BITS_TO_LONGS(FW_RANGE) * sizeof(*valid),
+        valid = kcalloc(BITS_TO_LONGS(FW_RANGE), sizeof(*valid),
                         GFP_KERNEL);
         if (!valid)
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
index e63dc0fb55f8..c79659ca5706 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
@@ -157,8 +157,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev)
                 hdmi->qfprom_mmio = NULL;
         }
 
-        hdmi->hpd_regs = devm_kzalloc(&pdev->dev, sizeof(hdmi->hpd_regs[0]) *
-                        config->hpd_reg_cnt, GFP_KERNEL);
+        hdmi->hpd_regs = devm_kcalloc(&pdev->dev,
+                                      config->hpd_reg_cnt,
+                                      sizeof(hdmi->hpd_regs[0]),
+                                      GFP_KERNEL);
         if (!hdmi->hpd_regs) {
                 ret = -ENOMEM;
                 goto fail;
@@ -178,8 +180,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev)
                 hdmi->hpd_regs[i] = reg;
         }
 
-        hdmi->pwr_regs = devm_kzalloc(&pdev->dev, sizeof(hdmi->pwr_regs[0]) *
-                        config->pwr_reg_cnt, GFP_KERNEL);
+        hdmi->pwr_regs = devm_kcalloc(&pdev->dev,
+                                      config->pwr_reg_cnt,
+                                      sizeof(hdmi->pwr_regs[0]),
+                                      GFP_KERNEL);
         if (!hdmi->pwr_regs) {
                 ret = -ENOMEM;
                 goto fail;
@@ -199,8 +203,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev)
                 hdmi->pwr_regs[i] = reg;
         }
 
-        hdmi->hpd_clks = devm_kzalloc(&pdev->dev, sizeof(hdmi->hpd_clks[0]) *
-                        config->hpd_clk_cnt, GFP_KERNEL);
+        hdmi->hpd_clks = devm_kcalloc(&pdev->dev,
+                                      config->hpd_clk_cnt,
+                                      sizeof(hdmi->hpd_clks[0]),
+                                      GFP_KERNEL);
         if (!hdmi->hpd_clks) {
                 ret = -ENOMEM;
                 goto fail;
@@ -219,8 +225,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev)
                 hdmi->hpd_clks[i] = clk;
         }
 
-        hdmi->pwr_clks = devm_kzalloc(&pdev->dev, sizeof(hdmi->pwr_clks[0]) *
-                        config->pwr_clk_cnt, GFP_KERNEL);
+        hdmi->pwr_clks = devm_kcalloc(&pdev->dev,
+                                      config->pwr_clk_cnt,
+                                      sizeof(hdmi->pwr_clks[0]),
+                                      GFP_KERNEL);
         if (!hdmi->pwr_clks) {
                 ret = -ENOMEM;
                 goto fail;
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_phy.c b/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
index 5e631392dc85..4157722d6b4d 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
@@ -21,12 +21,12 @@ static int msm_hdmi_phy_resource_init(struct hdmi_phy *phy)
         struct device *dev = &phy->pdev->dev;
         int i, ret;
 
-        phy->regs = devm_kzalloc(dev, sizeof(phy->regs[0]) * cfg->num_regs,
+        phy->regs = devm_kcalloc(dev, cfg->num_regs, sizeof(phy->regs[0]),
                                  GFP_KERNEL);
         if (!phy->regs)
                 return -ENOMEM;
 
-        phy->clks = devm_kzalloc(dev, sizeof(phy->clks[0]) * cfg->num_clks,
+        phy->clks = devm_kcalloc(dev, cfg->num_clks, sizeof(phy->clks[0]),
                                  GFP_KERNEL);
         if (!phy->clks)
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/nouveau/nv84_fence.c b/drivers/gpu/drm/nouveau/nv84_fence.c
index 090664899247..e721bb2163a0 100644
--- a/drivers/gpu/drm/nouveau/nv84_fence.c
+++ b/drivers/gpu/drm/nouveau/nv84_fence.c
@@ -141,7 +141,7 @@ nv84_fence_suspend(struct nouveau_drm *drm)
         struct nv84_fence_priv *priv = drm->fence;
         int i;
 
-        priv->suspend = vmalloc(drm->chan.nr * sizeof(u32));
+        priv->suspend = vmalloc(array_size(sizeof(u32), drm->chan.nr));
         if (priv->suspend) {
                 for (i = 0; i < drm->chan.nr; i++)
                         priv->suspend[i] = nouveau_bo_rd32(priv->bo, i*4);
diff --git a/drivers/gpu/drm/nouveau/nvif/fifo.c b/drivers/gpu/drm/nouveau/nvif/fifo.c
index 99d4fd17543c..e84a2e2ff043 100644
--- a/drivers/gpu/drm/nouveau/nvif/fifo.c
+++ b/drivers/gpu/drm/nouveau/nvif/fifo.c
@@ -50,8 +50,8 @@ nvif_fifo_runlists(struct nvif_device *device)
                 goto done;
 
         device->runlists = fls64(a->v.runlists.data);
-        device->runlist = kzalloc(sizeof(*device->runlist) *
-                                  device->runlists, GFP_KERNEL);
+        device->runlist = kcalloc(device->runlists, sizeof(*device->runlist),
+                                  GFP_KERNEL);
         if (!device->runlist) {
                 ret = -ENOMEM;
                 goto done;
diff --git a/drivers/gpu/drm/nouveau/nvif/mmu.c b/drivers/gpu/drm/nouveau/nvif/mmu.c
index 358ac4f3cf91..ae08a1ca8044 100644
--- a/drivers/gpu/drm/nouveau/nvif/mmu.c
+++ b/drivers/gpu/drm/nouveau/nvif/mmu.c
@@ -65,12 +65,15 @@ nvif_mmu_init(struct nvif_object *parent, s32 oclass, struct nvif_mmu *mmu)
                 goto done;
         mmu->mem = mems[ret].oclass;
 
-        mmu->heap = kmalloc(sizeof(*mmu->heap) * mmu->heap_nr, GFP_KERNEL);
-        mmu->type = kmalloc(sizeof(*mmu->type) * mmu->type_nr, GFP_KERNEL);
+        mmu->heap = kmalloc_array(mmu->heap_nr, sizeof(*mmu->heap),
+                                  GFP_KERNEL);
+        mmu->type = kmalloc_array(mmu->type_nr, sizeof(*mmu->type),
+                                  GFP_KERNEL);
         if (ret = -ENOMEM, !mmu->heap || !mmu->type)
                 goto done;
 
-        mmu->kind = kmalloc(sizeof(*mmu->kind) * mmu->kind_nr, GFP_KERNEL);
+        mmu->kind = kmalloc_array(mmu->kind_nr, sizeof(*mmu->kind),
+                                  GFP_KERNEL);
         if (!mmu->kind && mmu->kind_nr)
                 goto done;
 
diff --git a/drivers/gpu/drm/nouveau/nvif/object.c b/drivers/gpu/drm/nouveau/nvif/object.c
index 40adfe9b334b..ef3f62840e83 100644
--- a/drivers/gpu/drm/nouveau/nvif/object.c
+++ b/drivers/gpu/drm/nouveau/nvif/object.c
@@ -83,7 +83,7 @@ nvif_object_sclass_get(struct nvif_object *object, struct nvif_sclass **psclass)
                         return ret;
         }
 
-        *psclass = kzalloc(sizeof(**psclass) * args->sclass.count, GFP_KERNEL);
+        *psclass = kcalloc(args->sclass.count, sizeof(**psclass), GFP_KERNEL);
         if (*psclass) {
                 for (i = 0; i < args->sclass.count; i++) {
                         (*psclass)[i].oclass = args->sclass.oclass[i].oclass;
diff --git a/drivers/gpu/drm/nouveau/nvif/vmm.c b/drivers/gpu/drm/nouveau/nvif/vmm.c
index 191832be6c65..6b9c5776547f 100644
--- a/drivers/gpu/drm/nouveau/nvif/vmm.c
+++ b/drivers/gpu/drm/nouveau/nvif/vmm.c
@@ -138,7 +138,8 @@ nvif_vmm_init(struct nvif_mmu *mmu, s32 oclass, u64 addr, u64 size,
         vmm->limit = args->size;
 
         vmm->page_nr = args->page_nr;
-        vmm->page = kmalloc(sizeof(*vmm->page) * vmm->page_nr, GFP_KERNEL);
+        vmm->page = kmalloc_array(vmm->page_nr, sizeof(*vmm->page),
+                                  GFP_KERNEL);
         if (!vmm->page) {
                 ret = -ENOMEM;
                 goto done;
diff --git a/drivers/gpu/drm/nouveau/nvkm/core/event.c b/drivers/gpu/drm/nouveau/nvkm/core/event.c
index 4e8d3fa042df..006618d77aa4 100644
--- a/drivers/gpu/drm/nouveau/nvkm/core/event.c
+++ b/drivers/gpu/drm/nouveau/nvkm/core/event.c
@@ -84,7 +84,8 @@ int
 nvkm_event_init(const struct nvkm_event_func *func, int types_nr, int index_nr,
                 struct nvkm_event *event)
 {
-        event->refs = kzalloc(sizeof(*event->refs) * index_nr * types_nr,
+        event->refs = kzalloc(array3_size(index_nr, types_nr,
+                                          sizeof(*event->refs)),
                               GFP_KERNEL);
         if (!event->refs)
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
index a99046414a18..afccf9721cf0 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
@@ -910,7 +910,7 @@ gk104_fifo_oneinit(struct nvkm_fifo *base)
         nvkm_debug(subdev, "%d PBDMA(s)\n", fifo->pbdma_nr);
 
         /* Read PBDMA->runlist(s) mapping from HW. */
-        if (!(map = kzalloc(sizeof(*map) * fifo->pbdma_nr, GFP_KERNEL)))
+        if (!(map = kcalloc(fifo->pbdma_nr, sizeof(*map), GFP_KERNEL)))
                 return -ENOMEM;
 
         for (i = 0; i < fifo->pbdma_nr; i++)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/iccsense.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/iccsense.c
index 73e463ed55c3..dea444d48f94 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/iccsense.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/iccsense.c
@@ -73,7 +73,8 @@ nvbios_iccsense_parse(struct nvkm_bios *bios, struct nvbios_iccsense *iccsense)
         }
 
         iccsense->nr_entry = cnt;
-        iccsense->rail = kmalloc(sizeof(struct pwr_rail_t) * cnt, GFP_KERNEL);
+        iccsense->rail = kmalloc_array(cnt, sizeof(struct pwr_rail_t),
+                                       GFP_KERNEL);
         if (!iccsense->rail)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c
index 920b3d347803..bbfde1cb3a17 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c
@@ -171,7 +171,7 @@ gt215_link_train(struct gt215_ram *ram)
                 return -ENOSYS;
 
         /* XXX: Multiple partitions? */
-        result = kmalloc(64 * sizeof(u32), GFP_KERNEL);
+        result = kmalloc_array(64, sizeof(u32), GFP_KERNEL);
         if (!result)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/mem.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/mem.c
index 39808489f21d..92e363dbbc5a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/mem.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/mem.c
@@ -191,9 +191,9 @@ nvkm_mem_new_host(struct nvkm_mmu *mmu, int type, u8 page, u64 size,
         nvkm_memory_ctor(&nvkm_mem_dma, &mem->memory);
         size = ALIGN(size, PAGE_SIZE) >> PAGE_SHIFT;
 
-        if (!(mem->mem = kvmalloc(sizeof(*mem->mem) * size, GFP_KERNEL)))
+        if (!(mem->mem = kvmalloc_array(size, sizeof(*mem->mem), GFP_KERNEL)))
                 return -ENOMEM;
-        if (!(mem->dma = kvmalloc(sizeof(*mem->dma) * size, GFP_KERNEL)))
+        if (!(mem->dma = kvmalloc_array(size, sizeof(*mem->dma), GFP_KERNEL)))
                 return -ENOMEM;
 
         if (mmu->dma_bits > 32)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
index 1c12e58f44c2..de269eb482dd 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
@@ -59,7 +59,7 @@ nvkm_vmm_pt_new(const struct nvkm_vmm_desc *desc, bool sparse,
         pgt->sparse = sparse;
 
         if (desc->type == PGD) {
-                pgt->pde = kvzalloc(sizeof(*pgt->pde) * pten, GFP_KERNEL);
+                pgt->pde = kvcalloc(pten, sizeof(*pgt->pde), GFP_KERNEL);
                 if (!pgt->pde) {
                         kfree(pgt);
                         return NULL;
diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
index 401c02e9e6b2..f92fe205550b 100644
--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
@@ -940,8 +940,8 @@ int tiler_map_show(struct seq_file *s, void *arg)
         h_adj = omap_dmm->container_height / ydiv;
         w_adj = omap_dmm->container_width / xdiv;
 
-        map = kmalloc(h_adj * sizeof(*map), GFP_KERNEL);
-        global_map = kmalloc((w_adj + 1) * h_adj, GFP_KERNEL);
+        map = kmalloc_array(h_adj, sizeof(*map), GFP_KERNEL);
+        global_map = kmalloc_array(w_adj + 1, h_adj, GFP_KERNEL);
 
         if (!map || !global_map)
                 goto error;
diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapdrm/omap_gem.c
index 0faf042b82e1..17a53d207978 100644
--- a/drivers/gpu/drm/omapdrm/omap_gem.c
+++ b/drivers/gpu/drm/omapdrm/omap_gem.c
@@ -244,7 +244,7 @@ static int omap_gem_attach_pages(struct drm_gem_object *obj)
          * DSS, GPU, etc. are not cache coherent:
          */
         if (omap_obj->flags & (OMAP_BO_WC|OMAP_BO_UNCACHED)) {
-                addrs = kmalloc(npages * sizeof(*addrs), GFP_KERNEL);
+                addrs = kmalloc_array(npages, sizeof(*addrs), GFP_KERNEL);
                 if (!addrs) {
                         ret = -ENOMEM;
                         goto free_pages;
@@ -268,7 +268,7 @@ static int omap_gem_attach_pages(struct drm_gem_object *obj)
                         }
                 }
         } else {
-                addrs = kzalloc(npages * sizeof(*addrs), GFP_KERNEL);
+                addrs = kcalloc(npages, sizeof(*addrs), GFP_KERNEL);
                 if (!addrs) {
                         ret = -ENOMEM;
                         goto free_pages;
diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
index 9a6752606079..ca465c0d49fa 100644
--- a/drivers/gpu/drm/qxl/qxl_fb.c
+++ b/drivers/gpu/drm/qxl/qxl_fb.c
@@ -241,7 +241,7 @@ static int qxlfb_create(struct qxl_fbdev *qfbdev,
         DRM_DEBUG_DRIVER("%dx%d %d\n", mode_cmd.width,
                          mode_cmd.height, mode_cmd.pitches[0]);
 
-        shadow = vmalloc(mode_cmd.pitches[0] * mode_cmd.height);
+        shadow = vmalloc(array_size(mode_cmd.pitches[0], mode_cmd.height));
         /* TODO: what's the usual response to memory allocation errors? */
         BUG_ON(!shadow);
         DRM_DEBUG_DRIVER("surface0 at gpu offset %lld, mmap_offset %lld (virt %p, shadow %p)\n",
diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c
index c5716a0ca3b8..771250aed78d 100644
--- a/drivers/gpu/drm/qxl/qxl_kms.c
+++ b/drivers/gpu/drm/qxl/qxl_kms.c
@@ -200,8 +200,8 @@ int qxl_device_init(struct qxl_device *qdev,
                 (~(uint64_t)0) >> (qdev->slot_id_bits + qdev->slot_gen_bits);
 
         qdev->mem_slots =
-                kmalloc(qdev->n_mem_slots * sizeof(struct qxl_memslot),
-                        GFP_KERNEL);
+                kmalloc_array(qdev->n_mem_slots, sizeof(struct qxl_memslot),
+                              GFP_KERNEL);
 
         idr_init(&qdev->release_idr);
         spin_lock_init(&qdev->release_idr_lock);
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 6a2e091aa7b6..e55cbeee7a53 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -1176,7 +1176,7 @@ static int atom_execute_table_locked(struct atom_context *ctx, int index, uint32
         ectx.abort = false;
         ectx.last_jump = 0;
         if (ws)
-                ectx.ws = kzalloc(4 * ws, GFP_KERNEL);
+                ectx.ws = kcalloc(4, ws, GFP_KERNEL);
         else
                 ectx.ws = NULL;
 
diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c
index 95652e643da1..0aef4937c901 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.c
+++ b/drivers/gpu/drm/radeon/btc_dpm.c
@@ -2581,7 +2581,9 @@ int btc_dpm_init(struct radeon_device *rdev)
                 return ret;
 
         rdev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries =
-                kzalloc(4 * sizeof(struct radeon_clock_voltage_dependency_entry), GFP_KERNEL);
+                kcalloc(4,
+                        sizeof(struct radeon_clock_voltage_dependency_entry),
+                        GFP_KERNEL);
         if (!rdev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) {
                 r600_free_extended_power_table(rdev);
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 7e1b04dc5593..b9302c918271 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -5568,8 +5568,9 @@ static int ci_parse_power_table(struct radeon_device *rdev)
                 (mode_info->atom_context->bios + data_offset +
                  le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
 
-        rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
-                                  state_array->ucNumEntries, GFP_KERNEL);
+        rdev->pm.dpm.ps = kcalloc(state_array->ucNumEntries,
+                                  sizeof(struct radeon_ps),
+                                  GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
@@ -5770,7 +5771,9 @@ int ci_dpm_init(struct radeon_device *rdev)
         ci_set_private_data_variables_based_on_pptable(rdev);
 
         rdev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries =
-                kzalloc(4 * sizeof(struct radeon_clock_voltage_dependency_entry), GFP_KERNEL);
+                kcalloc(4,
+                        sizeof(struct radeon_clock_voltage_dependency_entry),
+                        GFP_KERNEL);
         if (!rdev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) {
                 ci_dpm_fini(rdev);
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index ae1529b0ef6f..f055d6ea3522 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2660,8 +2660,9 @@ static int kv_parse_power_table(struct radeon_device *rdev)
                 (mode_info->atom_context->bios + data_offset +
                  le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
 
-        rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
-                                  state_array->ucNumEntries, GFP_KERNEL);
+        rdev->pm.dpm.ps = kcalloc(state_array->ucNumEntries,
+                                  sizeof(struct radeon_ps),
+                                  GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 9416e72f86aa..0fd8d6ba9828 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -3998,8 +3998,9 @@ static int ni_parse_power_table(struct radeon_device *rdev)
                 return -EINVAL;
         power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
 
-        rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
-                                  power_info->pplib.ucNumStates, GFP_KERNEL);
+        rdev->pm.dpm.ps = kcalloc(power_info->pplib.ucNumStates,
+                                  sizeof(struct radeon_ps),
+                                  GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
 
@@ -4075,7 +4076,9 @@ int ni_dpm_init(struct radeon_device *rdev)
                 return ret;
 
         rdev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries =
-                kzalloc(4 * sizeof(struct radeon_clock_voltage_dependency_entry), GFP_KERNEL);
+                kcalloc(4,
+                        sizeof(struct radeon_clock_voltage_dependency_entry),
+                        GFP_KERNEL);
         if (!rdev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) {
                 r600_free_extended_power_table(rdev);
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index 31d1b4710844..73d4c5348116 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -991,7 +991,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
                         ATOM_PPLIB_PhaseSheddingLimits_Record *entry;
 
                         rdev->pm.dpm.dyn_state.phase_shedding_limits_table.entries =
-                                kzalloc(psl->ucNumEntries *
+                                kcalloc(psl->ucNumEntries,
                                         sizeof(struct radeon_phase_shedding_limits_entry),
                                         GFP_KERNEL);
                         if (!rdev->pm.dpm.dyn_state.phase_shedding_limits_table.entries) {
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 4134759a6823..f422a8d6aec4 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2126,13 +2126,16 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev)
                 num_modes = ATOM_MAX_NUMBEROF_POWER_BLOCK;
         if (num_modes == 0)
                 return state_index;
-        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) * num_modes, GFP_KERNEL);
+        rdev->pm.power_state = kcalloc(num_modes,
+                                       sizeof(struct radeon_power_state),
+                                       GFP_KERNEL);
         if (!rdev->pm.power_state)
                 return state_index;
         /* last mode is usually default, array is low to high */
         for (i = 0; i < num_modes; i++) {
                 rdev->pm.power_state[state_index].clock_info =
-                        kzalloc(sizeof(struct radeon_pm_clock_info) * 1, GFP_KERNEL);
+                        kcalloc(1, sizeof(struct radeon_pm_clock_info),
+                                GFP_KERNEL);
                 if (!rdev->pm.power_state[state_index].clock_info)
                         return state_index;
                 rdev->pm.power_state[state_index].num_clock_modes = 1;
@@ -2587,8 +2590,9 @@ static int radeon_atombios_parse_power_table_4_5(struct radeon_device *rdev)
         radeon_atombios_add_pplib_thermal_controller(rdev, &power_info->pplib.sThermalController);
         if (power_info->pplib.ucNumStates == 0)
                 return state_index;
-        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) *
-                                       power_info->pplib.ucNumStates, GFP_KERNEL);
+        rdev->pm.power_state = kcalloc(power_info->pplib.ucNumStates,
+                                       sizeof(struct radeon_power_state),
+                                       GFP_KERNEL);
         if (!rdev->pm.power_state)
                 return state_index;
         /* first mode is usually default, followed by low to high */
@@ -2603,10 +2607,11 @@ static int radeon_atombios_parse_power_table_4_5(struct radeon_device *rdev)
                          le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset) +
                          (power_state->v1.ucNonClockStateIndex *
                           power_info->pplib.ucNonClockSize));
-                rdev->pm.power_state[i].clock_info = kzalloc(sizeof(struct radeon_pm_clock_info) *
-                                                             ((power_info->pplib.ucStateEntrySize - 1) ?
-                                                              (power_info->pplib.ucStateEntrySize - 1) : 1),
-                                                             GFP_KERNEL);
+                rdev->pm.power_state[i].clock_info =
+                        kcalloc((power_info->pplib.ucStateEntrySize - 1) ?
+                                (power_info->pplib.ucStateEntrySize - 1) : 1,
+                                sizeof(struct radeon_pm_clock_info),
+                                GFP_KERNEL);
                 if (!rdev->pm.power_state[i].clock_info)
                         return state_index;
                 if (power_info->pplib.ucStateEntrySize - 1) {
@@ -2688,8 +2693,9 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
                  le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
         if (state_array->ucNumEntries == 0)
                 return state_index;
-        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) *
-                                       state_array->ucNumEntries, GFP_KERNEL);
+        rdev->pm.power_state = kcalloc(state_array->ucNumEntries,
+                                       sizeof(struct radeon_power_state),
+                                       GFP_KERNEL);
         if (!rdev->pm.power_state)
                 return state_index;
         power_state_offset = (u8 *)state_array->states;
@@ -2699,10 +2705,11 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
                 non_clock_array_index = power_state->v2.nonClockInfoIndex;
                 non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
                         &non_clock_info_array->nonClockInfo[non_clock_array_index];
-                rdev->pm.power_state[i].clock_info = kzalloc(sizeof(struct radeon_pm_clock_info) *
-                                                             (power_state->v2.ucNumDPMLevels ?
-                                                              power_state->v2.ucNumDPMLevels : 1),
-                                                             GFP_KERNEL);
+                rdev->pm.power_state[i].clock_info =
+                        kcalloc(power_state->v2.ucNumDPMLevels ?
+                                power_state->v2.ucNumDPMLevels : 1,
+                                sizeof(struct radeon_pm_clock_info),
+                                GFP_KERNEL);
                 if (!rdev->pm.power_state[i].clock_info)
                         return state_index;
                 if (power_state->v2.ucNumDPMLevels) {
@@ -2782,7 +2789,9 @@ void radeon_atombios_get_power_modes(struct radeon_device *rdev)
                 rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state), GFP_KERNEL);
                 if (rdev->pm.power_state) {
                         rdev->pm.power_state[0].clock_info =
-                                kzalloc(sizeof(struct radeon_pm_clock_info) * 1, GFP_KERNEL);
+                                kcalloc(1,
+                                        sizeof(struct radeon_pm_clock_info),
+                                        GFP_KERNEL);
                         if (rdev->pm.power_state[0].clock_info) {
                                 /* add the default mode */
                                 rdev->pm.power_state[state_index].type =
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 3178ba0c537c..60a61d33f607 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -2642,13 +2642,16 @@ void radeon_combios_get_power_modes(struct radeon_device *rdev)
         rdev->pm.default_power_state_index = -1;
 
         /* allocate 2 power states */
-        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) * 2, GFP_KERNEL);
+        rdev->pm.power_state = kcalloc(2, sizeof(struct radeon_power_state),
+                                       GFP_KERNEL);
         if (rdev->pm.power_state) {
                 /* allocate 1 clock mode per state */
                 rdev->pm.power_state[0].clock_info =
-                        kzalloc(sizeof(struct radeon_pm_clock_info) * 1, GFP_KERNEL);
+                        kcalloc(1, sizeof(struct radeon_pm_clock_info),
+                                GFP_KERNEL);
                 rdev->pm.power_state[1].clock_info =
-                        kzalloc(sizeof(struct radeon_pm_clock_info) * 1, GFP_KERNEL);
+                        kcalloc(1, sizeof(struct radeon_pm_clock_info),
+                                GFP_KERNEL);
                 if (!rdev->pm.power_state[0].clock_info ||
                     !rdev->pm.power_state[1].clock_info)
                         goto pm_failed;
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 0b3ec35515f3..1cef155cc933 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -347,13 +347,14 @@ int radeon_gart_init(struct radeon_device *rdev)
         DRM_INFO("GART: num cpu pages %u, num gpu pages %u\n",
                  rdev->gart.num_cpu_pages, rdev->gart.num_gpu_pages);
         /* Allocate pages table */
-        rdev->gart.pages = vzalloc(sizeof(void *) * rdev->gart.num_cpu_pages);
+        rdev->gart.pages = vzalloc(array_size(sizeof(void *),
+                                   rdev->gart.num_cpu_pages));
         if (rdev->gart.pages == NULL) {
                 radeon_gart_fini(rdev);
                 return -ENOMEM;
         }
-        rdev->gart.pages_entry = vmalloc(sizeof(uint64_t) *
-                                         rdev->gart.num_gpu_pages);
+        rdev->gart.pages_entry = vmalloc(array_size(sizeof(uint64_t),
+                                                    rdev->gart.num_gpu_pages));
         if (rdev->gart.pages_entry == NULL) {
                 radeon_gart_fini(rdev);
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
index f5e9abfadb56..48f4b273e316 100644
--- a/drivers/gpu/drm/radeon/radeon_test.c
+++ b/drivers/gpu/drm/radeon/radeon_test.c
@@ -59,7 +59,7 @@ static void radeon_do_test_moves(struct radeon_device *rdev, int flag)
         n = rdev->mc.gtt_size - rdev->gart_pin_size;
         n /= size;
 
-        gtt_obj = kzalloc(n * sizeof(*gtt_obj), GFP_KERNEL);
+        gtt_obj = kcalloc(n, sizeof(*gtt_obj), GFP_KERNEL);
         if (!gtt_obj) {
                 DRM_ERROR("Failed to allocate %d pointers\n", n);
                 r = 1;
diff --git a/drivers/gpu/drm/radeon/rs780_dpm.c b/drivers/gpu/drm/radeon/rs780_dpm.c
index b5e4e09a8996..694b7b3e9799 100644
--- a/drivers/gpu/drm/radeon/rs780_dpm.c
+++ b/drivers/gpu/drm/radeon/rs780_dpm.c
@@ -804,8 +804,9 @@ static int rs780_parse_power_table(struct radeon_device *rdev)
                 return -EINVAL;
         power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
 
-        rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
-                                  power_info->pplib.ucNumStates, GFP_KERNEL);
+        rdev->pm.dpm.ps = kcalloc(power_info->pplib.ucNumStates,
+                                  sizeof(struct radeon_ps),
+                                  GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/radeon/rv6xx_dpm.c b/drivers/gpu/drm/radeon/rv6xx_dpm.c
index d91aa3944593..6986051fbb89 100644
--- a/drivers/gpu/drm/radeon/rv6xx_dpm.c
+++ b/drivers/gpu/drm/radeon/rv6xx_dpm.c
@@ -1888,8 +1888,9 @@ static int rv6xx_parse_power_table(struct radeon_device *rdev)
                 return -EINVAL;
         power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
 
-        rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
-                                  power_info->pplib.ucNumStates, GFP_KERNEL);
+        rdev->pm.dpm.ps = kcalloc(power_info->pplib.ucNumStates,
+                                  sizeof(struct radeon_ps),
+                                  GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index cb2a7ec4e217..c765ae7ea806 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2282,8 +2282,9 @@ int rv7xx_parse_power_table(struct radeon_device *rdev)
                 return -EINVAL;
         power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
 
-        rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
-                                  power_info->pplib.ucNumStates, GFP_KERNEL);
+        rdev->pm.dpm.ps = kcalloc(power_info->pplib.ucNumStates,
+                                  sizeof(struct radeon_ps),
+                                  GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 90d5b41007bf..fea88078cf8e 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -6832,8 +6832,9 @@ static int si_parse_power_table(struct radeon_device *rdev)
                 (mode_info->atom_context->bios + data_offset +
                  le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
 
-        rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
-                                  state_array->ucNumEntries, GFP_KERNEL);
+        rdev->pm.dpm.ps = kcalloc(state_array->ucNumEntries,
+                                  sizeof(struct radeon_ps),
+                                  GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
@@ -6941,7 +6942,9 @@ int si_dpm_init(struct radeon_device *rdev)
                 return ret;
 
         rdev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries =
-                kzalloc(4 * sizeof(struct radeon_clock_voltage_dependency_entry), GFP_KERNEL);
+                kcalloc(4,
+                        sizeof(struct radeon_clock_voltage_dependency_entry),
+                        GFP_KERNEL);
         if (!rdev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) {
                 r600_free_extended_power_table(rdev);
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
index fd4804829e46..1e4975f3374c 100644
--- a/drivers/gpu/drm/radeon/sumo_dpm.c
+++ b/drivers/gpu/drm/radeon/sumo_dpm.c
@@ -1482,8 +1482,9 @@ static int sumo_parse_power_table(struct radeon_device *rdev)
                 (mode_info->atom_context->bios + data_offset +
                  le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
 
-        rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
-                                  state_array->ucNumEntries, GFP_KERNEL);
+        rdev->pm.dpm.ps = kcalloc(state_array->ucNumEntries,
+                                  sizeof(struct radeon_ps),
+                                  GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 2ef7c4e5e495..5d317f763eea 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1757,8 +1757,9 @@ static int trinity_parse_power_table(struct radeon_device *rdev)
                 (mode_info->atom_context->bios + data_offset +
                  le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
 
-        rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) *
-                                  state_array->ucNumEntries, GFP_KERNEL);
+        rdev->pm.dpm.ps = kcalloc(state_array->ucNumEntries,
+                                  sizeof(struct radeon_ps),
+                                  GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
diff --git a/drivers/gpu/drm/savage/savage_bci.c b/drivers/gpu/drm/savage/savage_bci.c
index 2a5b8466d806..35dc74883f83 100644
--- a/drivers/gpu/drm/savage/savage_bci.c
+++ b/drivers/gpu/drm/savage/savage_bci.c
@@ -298,8 +298,9 @@ static int savage_dma_init(drm_savage_private_t * dev_priv)
 
         dev_priv->nr_dma_pages = dev_priv->cmd_dma->size /
             (SAVAGE_DMA_PAGE_SIZE * 4);
-        dev_priv->dma_pages = kmalloc(sizeof(drm_savage_dma_page_t) *
-                                      dev_priv->nr_dma_pages, GFP_KERNEL);
+        dev_priv->dma_pages = kmalloc_array(dev_priv->nr_dma_pages,
+                                            sizeof(drm_savage_dma_page_t),
+                                            GFP_KERNEL);
         if (dev_priv->dma_pages == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/selftests/test-drm_mm.c b/drivers/gpu/drm/selftests/test-drm_mm.c
index 7cc935d7b7aa..933af1c25387 100644
--- a/drivers/gpu/drm/selftests/test-drm_mm.c
+++ b/drivers/gpu/drm/selftests/test-drm_mm.c
@@ -389,7 +389,7 @@ static int __igt_reserve(unsigned int count, u64 size)
         if (!order)
                 goto err;
 
-        nodes = vzalloc(sizeof(*nodes) * count);
+        nodes = vzalloc(array_size(count, sizeof(*nodes)));
         if (!nodes)
                 goto err_order;
 
@@ -579,7 +579,7 @@ static int __igt_insert(unsigned int count, u64 size, bool replace)
         DRM_MM_BUG_ON(!size);
 
         ret = -ENOMEM;
-        nodes = vmalloc(count * sizeof(*nodes));
+        nodes = vmalloc(array_size(count, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -889,7 +889,7 @@ static int __igt_insert_range(unsigned int count, u64 size, u64 start, u64 end)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(count * sizeof(*nodes));
+        nodes = vzalloc(array_size(count, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -1046,7 +1046,7 @@ static int igt_align(void *ignored)
          * meets our requirements.
          */
 
-        nodes = vzalloc(max_count * sizeof(*nodes));
+        nodes = vzalloc(array_size(max_count, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -1416,7 +1416,7 @@ static int igt_evict(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(size * sizeof(*nodes));
+        nodes = vzalloc(array_size(size, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -1526,7 +1526,7 @@ static int igt_evict_range(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(size * sizeof(*nodes));
+        nodes = vzalloc(array_size(size, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -1627,11 +1627,11 @@ static int igt_topdown(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(count * sizeof(*nodes));
+        nodes = vzalloc(array_size(count, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
-        bitmap = kzalloc(count / BITS_PER_LONG * sizeof(unsigned long),
+        bitmap = kcalloc(count / BITS_PER_LONG, sizeof(unsigned long),
                          GFP_KERNEL);
         if (!bitmap)
                 goto err_nodes;
@@ -1741,11 +1741,11 @@ static int igt_bottomup(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(count * sizeof(*nodes));
+        nodes = vzalloc(array_size(count, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
-        bitmap = kzalloc(count / BITS_PER_LONG * sizeof(unsigned long),
+        bitmap = kcalloc(count / BITS_PER_LONG, sizeof(unsigned long),
                          GFP_KERNEL);
         if (!bitmap)
                 goto err_nodes;
@@ -2098,7 +2098,7 @@ static int igt_color_evict(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(total_size * sizeof(*nodes));
+        nodes = vzalloc(array_size(total_size, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -2199,7 +2199,7 @@ static int igt_color_evict_range(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(total_size * sizeof(*nodes));
+        nodes = vzalloc(array_size(total_size, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
diff --git a/drivers/gpu/drm/tinydrm/repaper.c b/drivers/gpu/drm/tinydrm/repaper.c
index 1ee6855212a0..50a1d4216ce7 100644
--- a/drivers/gpu/drm/tinydrm/repaper.c
+++ b/drivers/gpu/drm/tinydrm/repaper.c
@@ -548,7 +548,7 @@ static int repaper_fb_dirty(struct drm_framebuffer *fb,
         DRM_DEBUG("Flushing [FB:%d] st=%ums\n", fb->base.id,
                   epd->factored_stage_time);
 
-        buf = kmalloc(fb->width * fb->height, GFP_KERNEL);
+        buf = kmalloc_array(fb->width, fb->height, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index 06c94e3a5f15..6e2d1300b457 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -348,8 +348,9 @@ static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free,
         if (use_static)
                 pages_to_free = static_buf;
         else
-                pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
-                                        GFP_KERNEL);
+                pages_to_free = kmalloc_array(npages_to_free,
+                                              sizeof(struct page *),
+                                              GFP_KERNEL);
         if (!pages_to_free) {
                 pr_debug("Failed to allocate memory for pool free operation\n");
                 return 0;
@@ -547,7 +548,8 @@ static int ttm_alloc_new_pages(struct list_head *pages, gfp_t gfp_flags,
         unsigned max_cpages = min(count << order, (unsigned)NUM_PAGES_TO_ALLOC);
 
         /* allocate array for page caching change */
-        caching_array = kmalloc(max_cpages*sizeof(struct page *), GFP_KERNEL);
+        caching_array = kmalloc_array(max_cpages, sizeof(struct page *),
+                                      GFP_KERNEL);
 
         if (!caching_array) {
                 pr_debug("Unable to allocate table for new pages\n");
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
index f63d99c302e4..3f14c1cc0789 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -463,8 +463,9 @@ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
         if (use_static)
                 pages_to_free = static_buf;
         else
-                pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
-                                        GFP_KERNEL);
+                pages_to_free = kmalloc_array(npages_to_free,
+                                              sizeof(struct page *),
+                                              GFP_KERNEL);
 
         if (!pages_to_free) {
                 pr_debug("%s: Failed to allocate memory for pool free operation\n",
@@ -753,7 +754,8 @@ static int ttm_dma_pool_alloc_new_pages(struct dma_pool *pool,
                         (unsigned)(PAGE_SIZE/sizeof(struct page *)));
 
         /* allocate array for page caching change */
-        caching_array = kmalloc(max_cpages*sizeof(struct page *), GFP_KERNEL);
+        caching_array = kmalloc_array(max_cpages, sizeof(struct page *),
+                                      GFP_KERNEL);
 
         if (!caching_array) {
                 pr_debug("%s: Unable to allocate table for new pages\n",
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 71d44c357d35..1d34619eb3fe 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -209,7 +209,7 @@ static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val)
 {
         if (vc4_state->dlist_count == vc4_state->dlist_size) {
                 u32 new_size = max(4u, vc4_state->dlist_count * 2);
-                u32 *new_dlist = kmalloc(new_size * 4, GFP_KERNEL);
+                u32 *new_dlist = kmalloc_array(new_size, 4, GFP_KERNEL);
 
                 if (!new_dlist)
                         return;
diff --git a/drivers/gpu/drm/via/via_dmablit.c b/drivers/gpu/drm/via/via_dmablit.c
index d6e84a589ef1..345bda4494e1 100644
--- a/drivers/gpu/drm/via/via_dmablit.c
+++ b/drivers/gpu/drm/via/via_dmablit.c
@@ -235,7 +235,7 @@ via_lock_all_dma_pages(drm_via_sg_info_t *vsg,  drm_via_dmablit_t *xfer)
         vsg->num_pages = VIA_PFN(xfer->mem_addr + (xfer->num_lines * xfer->mem_stride - 1)) -
                 first_pfn + 1;
 
-        vsg->pages = vzalloc(sizeof(struct page *) * vsg->num_pages);
+        vsg->pages = vzalloc(array_size(sizeof(struct page *), vsg->num_pages));
         if (NULL == vsg->pages)
                 return -ENOMEM;
         ret = get_user_pages_fast((unsigned long)xfer->mem_addr,
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 355dc7e49562..f858cc72011d 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -134,8 +134,11 @@ static int open_collection(struct hid_parser *parser, unsigned type)
         }
 
         if (parser->device->maxcollection == parser->device->collection_size) {
-                collection = kmalloc(sizeof(struct hid_collection) *
-                                parser->device->collection_size * 2, GFP_KERNEL);
+                collection = kmalloc(
+                                array3_size(sizeof(struct hid_collection),
+                                            parser->device->collection_size,
+                                            2),
+                                GFP_KERNEL);
                 if (collection == NULL) {
                         hid_err(parser->device, "failed to reallocate collection array\n");
                         return -ENOMEM;
@@ -1278,7 +1281,7 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field,
         __s32 max = field->logical_maximum;
         __s32 *value;
 
-        value = kmalloc(sizeof(__s32) * count, GFP_ATOMIC);
+        value = kmalloc_array(count, sizeof(__s32), GFP_ATOMIC);
         if (!value)
                 return;
 
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index 4f4e7a08a07b..8469b6964ff6 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -457,7 +457,7 @@ static char *resolv_usage_page(unsigned page, struct seq_file *f) {
         char *buf = NULL;
 
         if (!f) {
-                buf = kzalloc(sizeof(char) * HID_DEBUG_BUFSIZE, GFP_ATOMIC);
+                buf = kzalloc(HID_DEBUG_BUFSIZE, GFP_ATOMIC);
                 if (!buf)
                         return ERR_PTR(-ENOMEM);
         }
@@ -685,7 +685,7 @@ void hid_dump_report(struct hid_device *hid, int type, u8 *data,
         char *buf;
         unsigned int i;
 
-        buf = kmalloc(sizeof(char) * HID_DEBUG_BUFSIZE, GFP_ATOMIC);
+        buf = kmalloc(HID_DEBUG_BUFSIZE, GFP_ATOMIC);
 
         if (!buf)
                 return;
@@ -1088,7 +1088,7 @@ static int hid_debug_events_open(struct inode *inode, struct file *file)
                 goto out;
         }
 
-        if (!(list->hid_debug_buf = kzalloc(sizeof(char) * HID_DEBUG_BUFSIZE, GFP_KERNEL))) {
+        if (!(list->hid_debug_buf = kzalloc(HID_DEBUG_BUFSIZE, GFP_KERNEL))) {
                 err = -ENOMEM;
                 kfree(list);
                 goto out;
diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
index 7f965e231433..864a084b6cba 100644
--- a/drivers/hid/hid-picolcd_fb.c
+++ b/drivers/hid/hid-picolcd_fb.c
@@ -394,7 +394,8 @@ static int picolcd_set_par(struct fb_info *info)
                 return -EINVAL;
 
         o_fb   = fbdata->bitmap;
-        tmp_fb = kmalloc(PICOLCDFB_SIZE*info->var.bits_per_pixel, GFP_KERNEL);
+        tmp_fb = kmalloc_array(PICOLCDFB_SIZE, info->var.bits_per_pixel,
+                               GFP_KERNEL);
         if (!tmp_fb)
                 return -ENOMEM;
 
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 25363fc571bc..50af72baa5ca 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -624,7 +624,8 @@ static int sensor_hub_probe(struct hid_device *hdev,
                 ret = -EINVAL;
                 goto err_stop_hw;
         }
-        sd->hid_sensor_hub_client_devs = devm_kzalloc(&hdev->dev, dev_cnt *
+        sd->hid_sensor_hub_client_devs = devm_kcalloc(&hdev->dev,
+                                                      dev_cnt,
                                                       sizeof(struct mfd_cell),
                                                       GFP_KERNEL);
         if (sd->hid_sensor_hub_client_devs == NULL) {
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index b39844adea47..4a44e48e08b2 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -218,7 +218,7 @@ static ssize_t hidraw_get_report(struct file *file, char __user *buffer, size_t
                 goto out;
         }
 
-        buf = kmalloc(count * sizeof(__u8), GFP_KERNEL);
+        buf = kmalloc(count, GFP_KERNEL);
         if (!buf) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index acc2536c8094..2d28cffc1404 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -121,9 +121,9 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
                         }
                         client_data->hid_dev_count = (unsigned int)*payload;
                         if (!client_data->hid_devices)
-                                client_data->hid_devices = devm_kzalloc(
+                                client_data->hid_devices = devm_kcalloc(
                                                 &client_data->cl_device->dev,
-                                                client_data->hid_dev_count *
+                                                client_data->hid_dev_count,
                                                 sizeof(struct device_info),
                                                 GFP_KERNEL);
                         if (!client_data->hid_devices) {
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index ee7a37eb159a..c101369b51de 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -1363,7 +1363,7 @@ static int wacom_led_groups_alloc_and_register_one(struct device *dev,
         if (!devres_open_group(dev, &wacom->led.groups[group_id], GFP_KERNEL))
                 return -ENOMEM;
 
-        leds = devm_kzalloc(dev, sizeof(struct wacom_led) * count, GFP_KERNEL);
+        leds = devm_kcalloc(dev, count, sizeof(struct wacom_led), GFP_KERNEL);
         if (!leds) {
                 error = -ENOMEM;
                 goto err;
@@ -1463,7 +1463,7 @@ static int wacom_led_groups_allocate(struct wacom *wacom, int count)
         struct wacom_group_leds *groups;
         int error;
 
-        groups = devm_kzalloc(dev, sizeof(struct wacom_group_leds) * count,
+        groups = devm_kcalloc(dev, count, sizeof(struct wacom_group_leds),
                               GFP_KERNEL);
         if (!groups)
                 return -ENOMEM;
diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index 9b82549cbbc8..658dc765753b 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -190,7 +190,7 @@ int hv_synic_alloc(void)
 {
         int cpu;
 
-        hv_context.hv_numa_map = kzalloc(sizeof(struct cpumask) * nr_node_ids,
+        hv_context.hv_numa_map = kcalloc(nr_node_ids, sizeof(struct cpumask),
                                          GFP_KERNEL);
         if (hv_context.hv_numa_map == NULL) {
                 pr_err("Unable to allocate NUMA map\n");
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 3c836c099a8f..be3c8b10b84a 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -202,7 +202,7 @@ int hv_ringbuffer_init(struct hv_ring_buffer_info *ring_info,
          * First page holds struct hv_ring_buffer, do wraparound mapping for
          * the rest.
          */
-        pages_wraparound = kzalloc(sizeof(struct page *) * (page_cnt * 2 - 1),
+        pages_wraparound = kcalloc(page_cnt * 2 - 1, sizeof(struct page *),
                                    GFP_KERNEL);
         if (!pages_wraparound)
                 return -ENOMEM;
diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
index 14a94d90c028..34e45b97629e 100644
--- a/drivers/hwmon/acpi_power_meter.c
+++ b/drivers/hwmon/acpi_power_meter.c
@@ -575,8 +575,9 @@ static int read_domain_devices(struct acpi_power_meter_resource *resource)
         if (!pss->package.count)
                 goto end;
 
-        resource->domain_devices = kzalloc(sizeof(struct acpi_device *) *
-                                           pss->package.count, GFP_KERNEL);
+        resource->domain_devices = kcalloc(pss->package.count,
+                                           sizeof(struct acpi_device *),
+                                           GFP_KERNEL);
         if (!resource->domain_devices) {
                 res = -ENOMEM;
                 goto end;
@@ -796,7 +797,7 @@ static int read_capabilities(struct acpi_power_meter_resource *resource)
                         goto error;
                 }
 
-                *str = kzalloc(sizeof(u8) * (element->string.length + 1),
+                *str = kcalloc(element->string.length + 1, sizeof(u8),
                                GFP_KERNEL);
                 if (!*str) {
                         res = -ENOMEM;
diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c
index 693a3d53cab5..5e449eac788a 100644
--- a/drivers/hwmon/aspeed-pwm-tacho.c
+++ b/drivers/hwmon/aspeed-pwm-tacho.c
@@ -894,7 +894,7 @@ static int aspeed_create_fan(struct device *dev,
         count = of_property_count_u8_elems(child, "aspeed,fan-tach-ch");
         if (count < 1)
                 return -EINVAL;
-        fan_tach_ch = devm_kzalloc(dev, sizeof(*fan_tach_ch) * count,
+        fan_tach_ch = devm_kcalloc(dev, count, sizeof(*fan_tach_ch),
                                    GFP_KERNEL);
         if (!fan_tach_ch)
                 return -ENOMEM;
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 72c338eb5fae..10645c9bb7be 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -742,7 +742,7 @@ static int __init coretemp_init(void)
                 return -ENODEV;
 
         max_packages = topology_max_packages();
-        pkg_devices = kzalloc(max_packages * sizeof(struct platform_device *),
+        pkg_devices = kcalloc(max_packages, sizeof(struct platform_device *),
                               GFP_KERNEL);
         if (!pkg_devices)
                 return -ENOMEM;
diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
index 5c9a52599cf6..a3974cddef07 100644
--- a/drivers/hwmon/gpio-fan.c
+++ b/drivers/hwmon/gpio-fan.c
@@ -441,8 +441,8 @@ static int gpio_fan_get_of_data(struct gpio_fan_data *fan_data)
                 dev_err(dev, "DT properties empty / missing");
                 return -ENODEV;
         }
-        gpios = devm_kzalloc(dev,
-                             fan_data->num_gpios * sizeof(struct gpio_desc *),
+        gpios = devm_kcalloc(dev,
+                             fan_data->num_gpios, sizeof(struct gpio_desc *),
                              GFP_KERNEL);
         if (!gpios)
                 return -ENOMEM;
@@ -471,8 +471,8 @@ static int gpio_fan_get_of_data(struct gpio_fan_data *fan_data)
          * Speed map is in the form <RPM ctrl_val RPM ctrl_val ...>
          * this needs splitting into pairs to create gpio_fan_speed structs
          */
-        speed = devm_kzalloc(dev,
-                        fan_data->num_speed * sizeof(struct gpio_fan_speed),
+        speed = devm_kcalloc(dev,
+                        fan_data->num_speed, sizeof(struct gpio_fan_speed),
                         GFP_KERNEL);
         if (!speed)
                 return -ENOMEM;
diff --git a/drivers/hwmon/i5k_amb.c b/drivers/hwmon/i5k_amb.c
index 9397d2f0e79a..a4edc43dd060 100644
--- a/drivers/hwmon/i5k_amb.c
+++ b/drivers/hwmon/i5k_amb.c
@@ -274,8 +274,9 @@ static int i5k_amb_hwmon_init(struct platform_device *pdev)
                 num_ambs += hweight16(data->amb_present[i] & 0x7fff);
 
         /* Set up sysfs stuff */
-        data->attrs = kzalloc(sizeof(*data->attrs) * num_ambs * KNOBS_PER_AMB,
-                                GFP_KERNEL);
+        data->attrs = kzalloc(array3_size(num_ambs, KNOBS_PER_AMB,
+                                          sizeof(*data->attrs)),
+                              GFP_KERNEL);
         if (!data->attrs)
                 return -ENOMEM;
         data->num_attrs = 0;
diff --git a/drivers/hwmon/ibmpex.c b/drivers/hwmon/ibmpex.c
index 21b9c72f16bd..ab72cabf5a95 100644
--- a/drivers/hwmon/ibmpex.c
+++ b/drivers/hwmon/ibmpex.c
@@ -387,7 +387,7 @@ static int ibmpex_find_sensors(struct ibmpex_bmc_data *data)
                 return -ENOENT;
         data->num_sensors = err;
 
-        data->sensors = kzalloc(data->num_sensors * sizeof(*data->sensors),
+        data->sensors = kcalloc(data->num_sensors, sizeof(*data->sensors),
                                 GFP_KERNEL);
         if (!data->sensors)
                 return -ENOMEM;
diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
index 0298745d46e4..f829dadfd5a0 100644
--- a/drivers/hwmon/ibmpowernv.c
+++ b/drivers/hwmon/ibmpowernv.c
@@ -326,9 +326,9 @@ static int populate_attr_groups(struct platform_device *pdev)
         of_node_put(opal);
 
         for (type = 0; type < MAX_SENSOR_TYPE; type++) {
-                sensor_groups[type].group.attrs = devm_kzalloc(&pdev->dev,
-                                        sizeof(struct attribute *) *
-                                        (sensor_groups[type].attr_count + 1),
+                sensor_groups[type].group.attrs = devm_kcalloc(&pdev->dev,
+                                        sensor_groups[type].attr_count + 1,
+                                        sizeof(struct attribute *),
                                         GFP_KERNEL);
                 if (!sensor_groups[type].group.attrs)
                         return -ENOMEM;
@@ -409,7 +409,8 @@ static int create_device_attrs(struct platform_device *pdev)
         int err = 0;
 
         opal = of_find_node_by_path("/ibm,opal/sensors");
-        sdata = devm_kzalloc(&pdev->dev, pdata->sensors_count * sizeof(*sdata),
+        sdata = devm_kcalloc(&pdev->dev,
+                             pdata->sensors_count, sizeof(*sdata),
                              GFP_KERNEL);
         if (!sdata) {
                 err = -ENOMEM;
diff --git a/drivers/hwmon/iio_hwmon.c b/drivers/hwmon/iio_hwmon.c
index 5e5b32a1ec4b..69031a0f7ed2 100644
--- a/drivers/hwmon/iio_hwmon.c
+++ b/drivers/hwmon/iio_hwmon.c
@@ -92,8 +92,8 @@ static int iio_hwmon_probe(struct platform_device *pdev)
         while (st->channels[st->num_channels].indio_dev)
                 st->num_channels++;
 
-        st->attrs = devm_kzalloc(dev,
-                                 sizeof(*st->attrs) * (st->num_channels + 1),
+        st->attrs = devm_kcalloc(dev,
+                                 st->num_channels + 1, sizeof(*st->attrs),
                                  GFP_KERNEL);
         if (st->attrs == NULL) {
                 ret = -ENOMEM;
diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c
index b0bc77bf2cd9..a753464a1a33 100644
--- a/drivers/hwmon/nct6683.c
+++ b/drivers/hwmon/nct6683.c
@@ -426,12 +426,12 @@ nct6683_create_attr_group(struct device *dev,
         if (group == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        attrs = devm_kzalloc(dev, sizeof(*attrs) * (repeat * count + 1),
+        attrs = devm_kcalloc(dev, repeat * count + 1, sizeof(*attrs),
                              GFP_KERNEL);
         if (attrs == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        su = devm_kzalloc(dev, sizeof(*su) * repeat * count,
+        su = devm_kzalloc(dev, array3_size(repeat, count, sizeof(*su)),
                           GFP_KERNEL);
         if (su == NULL)
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index aebce560bfaf..155d4d1d1585 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -1190,12 +1190,12 @@ nct6775_create_attr_group(struct device *dev,
         if (group == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        attrs = devm_kzalloc(dev, sizeof(*attrs) * (repeat * count + 1),
+        attrs = devm_kcalloc(dev, repeat * count + 1, sizeof(*attrs),
                              GFP_KERNEL);
         if (attrs == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        su = devm_kzalloc(dev, sizeof(*su) * repeat * count,
+        su = devm_kzalloc(dev, array3_size(repeat, count, sizeof(*su)),
                                GFP_KERNEL);
         if (su == NULL)
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index f7c47d7994e7..82c3754e21e3 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -2176,8 +2176,8 @@ static int pmbus_init_debugfs(struct i2c_client *client,
         }
 
         /* Allocate the max possible entries we need. */
-        entries = devm_kzalloc(data->dev,
-                               sizeof(*entries) * (data->info->pages * 10),
+        entries = devm_kcalloc(data->dev,
+                               data->info->pages * 10, sizeof(*entries),
                                GFP_KERNEL);
         if (!entries)
                 return -ENOMEM;
diff --git a/drivers/hwmon/pmbus/ucd9000.c b/drivers/hwmon/pmbus/ucd9000.c
index 70cecb06f93c..ae93885fccd8 100644
--- a/drivers/hwmon/pmbus/ucd9000.c
+++ b/drivers/hwmon/pmbus/ucd9000.c
@@ -454,8 +454,8 @@ static int ucd9000_init_debugfs(struct i2c_client *client,
          */
         if (mid->driver_data == ucd9090 || mid->driver_data == ucd90160 ||
             mid->driver_data == ucd90910) {
-                entries = devm_kzalloc(&client->dev,
-                                       sizeof(*entries) * UCD9000_GPI_COUNT,
+                entries = devm_kcalloc(&client->dev,
+                                       UCD9000_GPI_COUNT, sizeof(*entries),
                                        GFP_KERNEL);
                 if (!entries)
                         return -ENOMEM;
diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
index 70cc0d134f3c..7838af58f92d 100644
--- a/drivers/hwmon/pwm-fan.c
+++ b/drivers/hwmon/pwm-fan.c
@@ -180,7 +180,7 @@ static int pwm_fan_of_get_cooling_data(struct device *dev,
         }
 
         num = ret;
-        ctx->pwm_fan_cooling_levels = devm_kzalloc(dev, num * sizeof(u32),
+        ctx->pwm_fan_cooling_levels = devm_kcalloc(dev, num, sizeof(u32),
                                                    GFP_KERNEL);
         if (!ctx->pwm_fan_cooling_levels)
                 return -ENOMEM;
diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
index 9b6c55523c58..320d29df17e1 100644
--- a/drivers/hwtracing/coresight/coresight-etb10.c
+++ b/drivers/hwtracing/coresight/coresight-etb10.c
@@ -683,8 +683,8 @@ static int etb_probe(struct amba_device *adev, const struct amba_id *id)
         if (drvdata->buffer_depth & 0x80000000)
                 return -EINVAL;
 
-        drvdata->buf = devm_kzalloc(dev,
-                                    drvdata->buffer_depth * 4, GFP_KERNEL);
+        drvdata->buf = devm_kcalloc(dev,
+                                    drvdata->buffer_depth, 4, GFP_KERNEL);
         if (!drvdata->buf)
                 return -ENOMEM;
 
diff --git a/drivers/hwtracing/coresight/of_coresight.c b/drivers/hwtracing/coresight/of_coresight.c
index a33a92ebe74b..6880bee195c8 100644
--- a/drivers/hwtracing/coresight/of_coresight.c
+++ b/drivers/hwtracing/coresight/of_coresight.c
@@ -71,21 +71,24 @@ static int of_coresight_alloc_memory(struct device *dev,
                         struct coresight_platform_data *pdata)
 {
         /* List of output port on this component */
-        pdata->outports = devm_kzalloc(dev, pdata->nr_outport *
+        pdata->outports = devm_kcalloc(dev,
+                                       pdata->nr_outport,
                                        sizeof(*pdata->outports),
                                        GFP_KERNEL);
         if (!pdata->outports)
                 return -ENOMEM;
 
         /* Children connected to this component via @outports */
-        pdata->child_names = devm_kzalloc(dev, pdata->nr_outport *
+        pdata->child_names = devm_kcalloc(dev,
+                                          pdata->nr_outport,
                                           sizeof(*pdata->child_names),
                                           GFP_KERNEL);
         if (!pdata->child_names)
                 return -ENOMEM;
 
         /* Port number on the child this component is connected to */
-        pdata->child_ports = devm_kzalloc(dev, pdata->nr_outport *
+        pdata->child_ports = devm_kcalloc(dev,
+                                          pdata->nr_outport,
                                           sizeof(*pdata->child_ports),
                                           GFP_KERNEL);
         if (!pdata->child_ports)
diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
index 65e324054970..a2f5f992af7a 100644
--- a/drivers/i2c/busses/i2c-amd756-s4882.c
+++ b/drivers/i2c/busses/i2c-amd756-s4882.c
@@ -169,12 +169,12 @@ static int __init amd756_s4882_init(void)
 
         printk(KERN_INFO "Enabling SMBus multiplexing for Tyan S4882\n");
         /* Define the 5 virtual adapters and algorithms structures */
-        if (!(s4882_adapter = kzalloc(5 * sizeof(struct i2c_adapter),
+        if (!(s4882_adapter = kcalloc(5, sizeof(struct i2c_adapter),
                                       GFP_KERNEL))) {
                 error = -ENOMEM;
                 goto ERROR1;
         }
-        if (!(s4882_algo = kzalloc(5 * sizeof(struct i2c_algorithm),
+        if (!(s4882_algo = kcalloc(5, sizeof(struct i2c_algorithm),
                                    GFP_KERNEL))) {
                 error = -ENOMEM;
                 goto ERROR2;
diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
index 88eda09e73c0..58a0fbf0e074 100644
--- a/drivers/i2c/busses/i2c-nforce2-s4985.c
+++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
@@ -164,12 +164,12 @@ static int __init nforce2_s4985_init(void)
 
         printk(KERN_INFO "Enabling SMBus multiplexing for Tyan S4985\n");
         /* Define the 5 virtual adapters and algorithms structures */
-        s4985_adapter = kzalloc(5 * sizeof(struct i2c_adapter), GFP_KERNEL);
+        s4985_adapter = kcalloc(5, sizeof(struct i2c_adapter), GFP_KERNEL);
         if (!s4985_adapter) {
                 error = -ENOMEM;
                 goto ERROR1;
         }
-        s4985_algo = kzalloc(5 * sizeof(struct i2c_algorithm), GFP_KERNEL);
+        s4985_algo = kcalloc(5, sizeof(struct i2c_algorithm), GFP_KERNEL);
         if (!s4985_algo) {
                 error = -ENOMEM;
                 goto ERROR2;
diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
index 3241bb9d6c18..f6a1272c5854 100644
--- a/drivers/i2c/busses/i2c-nforce2.c
+++ b/drivers/i2c/busses/i2c-nforce2.c
@@ -381,7 +381,7 @@ static int nforce2_probe(struct pci_dev *dev, const struct pci_device_id *id)
         int res1, res2;
 
         /* we support 2 SMBus adapters */
-        smbuses = kzalloc(2 * sizeof(struct nforce2_smbus), GFP_KERNEL);
+        smbuses = kcalloc(2, sizeof(struct nforce2_smbus), GFP_KERNEL);
         if (!smbuses)
                 return -ENOMEM;
         pci_set_drvdata(dev, smbuses);
diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
index 904dfec7ab96..ebbf9cdec86b 100644
--- a/drivers/i2c/busses/i2c-qup.c
+++ b/drivers/i2c/busses/i2c-qup.c
@@ -1691,8 +1691,8 @@ static int qup_i2c_probe(struct platform_device *pdev)
 
                 qup->max_xfer_sg_len = (MX_BLOCKS << 1);
                 blocks = (MX_DMA_BLOCKS << 1) + 1;
-                qup->btx.sg = devm_kzalloc(&pdev->dev,
-                                           sizeof(*qup->btx.sg) * blocks,
+                qup->btx.sg = devm_kcalloc(&pdev->dev,
+                                           blocks, sizeof(*qup->btx.sg),
                                            GFP_KERNEL);
                 if (!qup->btx.sg) {
                         ret = -ENOMEM;
@@ -1700,8 +1700,8 @@ static int qup_i2c_probe(struct platform_device *pdev)
                 }
                 sg_init_table(qup->btx.sg, blocks);
 
-                qup->brx.sg = devm_kzalloc(&pdev->dev,
-                                           sizeof(*qup->brx.sg) * blocks,
+                qup->brx.sg = devm_kcalloc(&pdev->dev,
+                                           blocks, sizeof(*qup->brx.sg),
                                            GFP_KERNEL);
                 if (!qup->brx.sg) {
                         ret = -ENOMEM;
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 1667b6e7674f..1aca742fde4a 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -244,7 +244,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,
         u8 __user **data_ptrs;
         int i, res;
 
-        data_ptrs = kmalloc(nmsgs * sizeof(u8 __user *), GFP_KERNEL);
+        data_ptrs = kmalloc_array(nmsgs, sizeof(u8 __user *), GFP_KERNEL);
         if (data_ptrs == NULL) {
                 kfree(msgs);
                 return -ENOMEM;
diff --git a/drivers/i2c/i2c-stub.c b/drivers/i2c/i2c-stub.c
index 4a9ad91c5ba3..f31ec0861979 100644
--- a/drivers/i2c/i2c-stub.c
+++ b/drivers/i2c/i2c-stub.c
@@ -338,8 +338,9 @@ static int __init i2c_stub_allocate_banks(int i)
                 chip->bank_mask >>= 1;
         }
 
-        chip->bank_words = kzalloc(chip->bank_mask * chip->bank_size *
-                                   sizeof(u16), GFP_KERNEL);
+        chip->bank_words = kcalloc(chip->bank_mask * chip->bank_size,
+                                   sizeof(u16),
+                                   GFP_KERNEL);
         if (!chip->bank_words)
                 return -ENOMEM;
 
diff --git a/drivers/i2c/muxes/i2c-mux-gpio.c b/drivers/i2c/muxes/i2c-mux-gpio.c
index 1a9973ede443..ddc4bd4ca13b 100644
--- a/drivers/i2c/muxes/i2c-mux-gpio.c
+++ b/drivers/i2c/muxes/i2c-mux-gpio.c
@@ -88,8 +88,8 @@ static int i2c_mux_gpio_probe_dt(struct gpiomux *mux,
 
         mux->data.n_values = of_get_child_count(np);
 
-        values = devm_kzalloc(&pdev->dev,
-                              sizeof(*mux->data.values) * mux->data.n_values,
+        values = devm_kcalloc(&pdev->dev,
+                              mux->data.n_values, sizeof(*mux->data.values),
                               GFP_KERNEL);
         if (!values) {
                 dev_err(&pdev->dev, "Cannot allocate values array");
@@ -111,8 +111,9 @@ static int i2c_mux_gpio_probe_dt(struct gpiomux *mux,
                 return -EINVAL;
         }
 
-        gpios = devm_kzalloc(&pdev->dev,
-                             sizeof(*mux->data.gpios) * mux->data.n_gpios, GFP_KERNEL);
+        gpios = devm_kcalloc(&pdev->dev,
+                             mux->data.n_gpios, sizeof(*mux->data.gpios),
+                             GFP_KERNEL);
         if (!gpios) {
                 dev_err(&pdev->dev, "Cannot allocate gpios array");
                 return -ENOMEM;
diff --git a/drivers/i2c/muxes/i2c-mux-reg.c b/drivers/i2c/muxes/i2c-mux-reg.c
index c948e5a4cb04..f583f805fee9 100644
--- a/drivers/i2c/muxes/i2c-mux-reg.c
+++ b/drivers/i2c/muxes/i2c-mux-reg.c
@@ -124,8 +124,8 @@ static int i2c_mux_reg_probe_dt(struct regmux *mux,
         }
         mux->data.write_only = of_property_read_bool(np, "write-only");
 
-        values = devm_kzalloc(&pdev->dev,
-                              sizeof(*mux->data.values) * mux->data.n_values,
+        values = devm_kcalloc(&pdev->dev,
+                              mux->data.n_values, sizeof(*mux->data.values),
                               GFP_KERNEL);
         if (!values) {
                 dev_err(&pdev->dev, "Cannot allocate values array");
diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
index 4b5dc0162e67..e52c58c29d9a 100644
--- a/drivers/ide/hpt366.c
+++ b/drivers/ide/hpt366.c
@@ -1455,7 +1455,7 @@ static int hpt366_init_one(struct pci_dev *dev, const struct pci_device_id *id)
         if (info == &hpt36x || info == &hpt374)
                 dev2 = pci_get_slot(dev->bus, dev->devfn + 1);
 
-        dyn_info = kzalloc(sizeof(*dyn_info) * (dev2 ? 2 : 1), GFP_KERNEL);
+        dyn_info = kcalloc(dev2 ? 2 : 1, sizeof(*dyn_info), GFP_KERNEL);
         if (dyn_info == NULL) {
                 printk(KERN_ERR "%s %s: out of memory!\n",
                         d.name, pci_name(dev));
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 56d7bc228cb3..416a2f353071 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -985,8 +985,9 @@ static int hwif_init(ide_hwif_t *hwif)
         if (!hwif->sg_max_nents)
                 hwif->sg_max_nents = PRD_ENTRIES;
 
-        hwif->sg_table = kmalloc(sizeof(struct scatterlist)*hwif->sg_max_nents,
-                                 GFP_KERNEL);
+        hwif->sg_table = kmalloc_array(hwif->sg_max_nents,
+                                       sizeof(struct scatterlist),
+                                       GFP_KERNEL);
         if (!hwif->sg_table) {
                 printk(KERN_ERR "%s: unable to allocate SG table.\n", hwif->name);
                 goto out;
diff --git a/drivers/ide/it821x.c b/drivers/ide/it821x.c
index 04029d18a696..36a64c8ea575 100644
--- a/drivers/ide/it821x.c
+++ b/drivers/ide/it821x.c
@@ -652,7 +652,7 @@ static int it821x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
         struct it821x_dev *itdevs;
         int rc;
 
-        itdevs = kzalloc(2 * sizeof(*itdevs), GFP_KERNEL);
+        itdevs = kcalloc(2, sizeof(*itdevs), GFP_KERNEL);
         if (itdevs == NULL) {
                 printk(KERN_ERR DRV_NAME " %s: out of memory\n", pci_name(dev));
                 return -ENOMEM;
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 71a5ee652b79..44b516863c9d 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -624,8 +624,8 @@ static int at91_adc_trigger_init(struct iio_dev *idev)
         struct at91_adc_state *st = iio_priv(idev);
         int i, ret;
 
-        st->trig = devm_kzalloc(&idev->dev,
-                                st->trigger_number * sizeof(*st->trig),
+        st->trig = devm_kcalloc(&idev->dev,
+                                st->trigger_number, sizeof(*st->trig),
                                 GFP_KERNEL);
 
         if (st->trig == NULL) {
@@ -908,7 +908,8 @@ static int at91_adc_probe_dt(struct at91_adc_state *st,
         st->registers = &st->caps->registers;
         st->num_channels = st->caps->num_channels;
         st->trigger_number = of_get_child_count(node);
-        st->trigger_list = devm_kzalloc(&idev->dev, st->trigger_number *
+        st->trigger_list = devm_kcalloc(&idev->dev,
+                                        st->trigger_number,
                                         sizeof(struct at91_adc_trigger),
                                         GFP_KERNEL);
         if (!st->trigger_list) {
diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c
index 375da6491499..311c1a89c329 100644
--- a/drivers/iio/adc/max1027.c
+++ b/drivers/iio/adc/max1027.c
@@ -422,8 +422,8 @@ static int max1027_probe(struct spi_device *spi)
         indio_dev->num_channels = st->info->num_channels;
         indio_dev->available_scan_masks = st->info->available_scan_masks;
 
-        st->buffer = devm_kmalloc(&indio_dev->dev,
-                                  indio_dev->num_channels * 2,
+        st->buffer = devm_kmalloc_array(&indio_dev->dev,
+                                  indio_dev->num_channels, 2,
                                   GFP_KERNEL);
         if (st->buffer == NULL) {
                 dev_err(&indio_dev->dev, "Can't allocate buffer\n");
diff --git a/drivers/iio/adc/max1363.c b/drivers/iio/adc/max1363.c
index 7f1848dac9bf..7fb4f525714a 100644
--- a/drivers/iio/adc/max1363.c
+++ b/drivers/iio/adc/max1363.c
@@ -1453,8 +1453,10 @@ static int max1363_alloc_scan_masks(struct iio_dev *indio_dev)
         int i;
 
         masks = devm_kzalloc(&indio_dev->dev,
-                        BITS_TO_LONGS(MAX1363_MAX_CHANNELS) * sizeof(long) *
-                        (st->chip_info->num_modes + 1), GFP_KERNEL);
+                        array3_size(BITS_TO_LONGS(MAX1363_MAX_CHANNELS),
+                                    sizeof(long),
+                                    st->chip_info->num_modes + 1),
+                        GFP_KERNEL);
         if (!masks)
                 return -ENOMEM;
 
diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c
index dc83f8f6c3d3..e470510e76ea 100644
--- a/drivers/iio/adc/twl6030-gpadc.c
+++ b/drivers/iio/adc/twl6030-gpadc.c
@@ -898,9 +898,10 @@ static int twl6030_gpadc_probe(struct platform_device *pdev)
 
         gpadc = iio_priv(indio_dev);
 
-        gpadc->twl6030_cal_tbl = devm_kzalloc(dev,
-                                        sizeof(*gpadc->twl6030_cal_tbl) *
-                                        pdata->nchannels, GFP_KERNEL);
+        gpadc->twl6030_cal_tbl = devm_kcalloc(dev,
+                                        pdata->nchannels,
+                                        sizeof(*gpadc->twl6030_cal_tbl),
+                                        GFP_KERNEL);
         if (!gpadc->twl6030_cal_tbl)
                 return -ENOMEM;
 
diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c
index 9234c6a09a93..095530c233e4 100644
--- a/drivers/iio/dac/ad5592r-base.c
+++ b/drivers/iio/dac/ad5592r-base.c
@@ -536,8 +536,9 @@ static int ad5592r_alloc_channels(struct ad5592r_state *st)
                         st->channel_offstate[reg] = tmp;
         }
 
-        channels = devm_kzalloc(st->dev,
-                        (1 + 2 * num_channels) * sizeof(*channels), GFP_KERNEL);
+        channels = devm_kcalloc(st->dev,
+                        1 + 2 * num_channels, sizeof(*channels),
+                        GFP_KERNEL);
         if (!channels)
                 return -ENOMEM;
 
diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c
index 36607d52fee0..76643c5571aa 100644
--- a/drivers/iio/imu/adis_buffer.c
+++ b/drivers/iio/imu/adis_buffer.c
@@ -38,7 +38,7 @@ int adis_update_scan_mode(struct iio_dev *indio_dev,
         if (!adis->xfer)
                 return -ENOMEM;
 
-        adis->buffer = kzalloc(indio_dev->scan_bytes * 2, GFP_KERNEL);
+        adis->buffer = kcalloc(indio_dev->scan_bytes, 2, GFP_KERNEL);
         if (!adis->buffer)
                 return -ENOMEM;
 
diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index ec98790e2a28..06ca3f7fcc44 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -436,7 +436,7 @@ struct iio_channel *iio_channel_get_all(struct device *dev)
         }
 
         /* NULL terminated array to save passing size */
-        chans = kzalloc(sizeof(*chans)*(nummaps + 1), GFP_KERNEL);
+        chans = kcalloc(nummaps + 1, sizeof(*chans), GFP_KERNEL);
         if (chans == NULL) {
                 ret = -ENOMEM;
                 goto error_ret;
diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
index 60621ccd67e4..e1f44cecdef4 100644
--- a/drivers/iio/multiplexer/iio-mux.c
+++ b/drivers/iio/multiplexer/iio-mux.c
@@ -281,9 +281,10 @@ static int mux_configure_channel(struct device *dev, struct mux *mux,
                 if (!page)
                         return -ENOMEM;
         }
-        child->ext_info_cache = devm_kzalloc(dev,
-                                             sizeof(*child->ext_info_cache) *
-                                             num_ext_info, GFP_KERNEL);
+        child->ext_info_cache = devm_kcalloc(dev,
+                                             num_ext_info,
+                                             sizeof(*child->ext_info_cache),
+                                             GFP_KERNEL);
         if (!child->ext_info_cache)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 71a34bee453d..81d66f56e38f 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -1245,8 +1245,9 @@ int ib_cache_setup_one(struct ib_device *device)
         rwlock_init(&device->cache.lock);
 
         device->cache.ports =
-                kzalloc(sizeof(*device->cache.ports) *
-                        (rdma_end_port(device) - rdma_start_port(device) + 1), GFP_KERNEL);
+                kcalloc(rdma_end_port(device) - rdma_start_port(device) + 1,
+                        sizeof(*device->cache.ports),
+                        GFP_KERNEL);
         if (!device->cache.ports)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 6813ee717a38..bff10ab141b0 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1855,8 +1855,8 @@ static struct rdma_id_private *cma_new_conn_id(struct rdma_cm_id *listen_id,
 
         rt = &id->route;
         rt->num_paths = ib_event->param.req_rcvd.alternate_path ? 2 : 1;
-        rt->path_rec = kmalloc(sizeof *rt->path_rec * rt->num_paths,
-                               GFP_KERNEL);
+        rt->path_rec = kmalloc_array(rt->num_paths, sizeof(*rt->path_rec),
+                                     GFP_KERNEL);
         if (!rt->path_rec)
                 goto err;
 
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 84f51386e1e3..6fa4c59dc7a7 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -336,8 +336,8 @@ static int read_port_immutable(struct ib_device *device)
          * Therefore port_immutable is declared as a 1 based array with
          * potential empty slots at the beginning.
          */
-        device->port_immutable = kzalloc(sizeof(*device->port_immutable)
-                                         * (end_port + 1),
+        device->port_immutable = kcalloc(end_port + 1,
+                                         sizeof(*device->port_immutable),
                                          GFP_KERNEL);
         if (!device->port_immutable)
                 return -ENOMEM;
diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
index a0a9ed719031..a077500f7f32 100644
--- a/drivers/infiniband/core/fmr_pool.c
+++ b/drivers/infiniband/core/fmr_pool.c
@@ -235,8 +235,9 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd             *pd,
 
         if (params->cache) {
                 pool->cache_bucket =
-                        kmalloc(IB_FMR_HASH_SIZE * sizeof *pool->cache_bucket,
-                                GFP_KERNEL);
+                        kmalloc_array(IB_FMR_HASH_SIZE,
+                                      sizeof(*pool->cache_bucket),
+                                      GFP_KERNEL);
                 if (!pool->cache_bucket) {
                         ret = -ENOMEM;
                         goto out_free_pool;
diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index da12da1c36f6..cdb63f3f4de7 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -56,14 +56,16 @@ int iwpm_init(u8 nl_client)
         int ret = 0;
         mutex_lock(&iwpm_admin_lock);
         if (atomic_read(&iwpm_admin.refcount) == 0) {
-                iwpm_hash_bucket = kzalloc(IWPM_MAPINFO_HASH_SIZE *
-                                        sizeof(struct hlist_head), GFP_KERNEL);
+                iwpm_hash_bucket = kcalloc(IWPM_MAPINFO_HASH_SIZE,
+                                           sizeof(struct hlist_head),
+                                           GFP_KERNEL);
                 if (!iwpm_hash_bucket) {
                         ret = -ENOMEM;
                         goto init_exit;
                 }
-                iwpm_reminfo_bucket = kzalloc(IWPM_REMINFO_HASH_SIZE *
-                                        sizeof(struct hlist_head), GFP_KERNEL);
+                iwpm_reminfo_bucket = kcalloc(IWPM_REMINFO_HASH_SIZE,
+                                              sizeof(struct hlist_head),
+                                              GFP_KERNEL);
                 if (!iwpm_reminfo_bucket) {
                         kfree(iwpm_hash_bucket);
                         ret = -ENOMEM;
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 2aadf5813a40..182436b92ba9 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -285,13 +285,15 @@ struct ib_umem *ib_alloc_odp_umem(struct ib_ucontext *context,
         mutex_init(&odp_data->umem_mutex);
         init_completion(&odp_data->notifier_completion);
 
-        odp_data->page_list = vzalloc(pages * sizeof(*odp_data->page_list));
+        odp_data->page_list =
+                vzalloc(array_size(pages, sizeof(*odp_data->page_list)));
         if (!odp_data->page_list) {
                 ret = -ENOMEM;
                 goto out_odp_data;
         }
 
-        odp_data->dma_list = vzalloc(pages * sizeof(*odp_data->dma_list));
+        odp_data->dma_list =
+                vzalloc(array_size(pages, sizeof(*odp_data->dma_list)));
         if (!odp_data->dma_list) {
                 ret = -ENOMEM;
                 goto out_page_list;
@@ -371,15 +373,17 @@ int ib_umem_odp_get(struct ib_ucontext *context, struct ib_umem *umem,
         init_completion(&umem->odp_data->notifier_completion);
 
         if (ib_umem_num_pages(umem)) {
-                umem->odp_data->page_list = vzalloc(ib_umem_num_pages(umem) *
-                                            sizeof(*umem->odp_data->page_list));
+                umem->odp_data->page_list =
+                        vzalloc(array_size(sizeof(*umem->odp_data->page_list),
+                                           ib_umem_num_pages(umem)));
                 if (!umem->odp_data->page_list) {
                         ret_val = -ENOMEM;
                         goto out_odp_data;
                 }
 
-                umem->odp_data->dma_list = vzalloc(ib_umem_num_pages(umem) *
-                                          sizeof(*umem->odp_data->dma_list));
+                umem->odp_data->dma_list =
+                        vzalloc(array_size(sizeof(*umem->odp_data->dma_list),
+                                           ib_umem_num_pages(umem)));
                 if (!umem->odp_data->dma_list) {
                         ret_val = -ENOMEM;
                         goto out_page_list;
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 3179a95c6f5e..3e90b6a1d9d2 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -3559,8 +3559,8 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
                 goto err_uobj;
         }
 
-        flow_attr = kzalloc(sizeof(*flow_attr) + cmd.flow_attr.num_of_specs *
-                            sizeof(union ib_flow_spec), GFP_KERNEL);
+        flow_attr = kzalloc(struct_size(flow_attr, flows,
+                                cmd.flow_attr.num_of_specs), GFP_KERNEL);
         if (!flow_attr) {
                 err = -ENOMEM;
                 goto err_put;
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 3328acc53c2a..dcb4bba522ba 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -279,7 +279,7 @@ int cxio_create_qp(struct cxio_rdev *rdev_p, u32 kernel_domain,
         if (!wq->qpid)
                 return -ENOMEM;
 
-        wq->rq = kzalloc(depth * sizeof(struct t3_swrq), GFP_KERNEL);
+        wq->rq = kcalloc(depth, sizeof(struct t3_swrq), GFP_KERNEL);
         if (!wq->rq)
                 goto err1;
 
@@ -287,7 +287,7 @@ int cxio_create_qp(struct cxio_rdev *rdev_p, u32 kernel_domain,
         if (!wq->rq_addr)
                 goto err2;
 
-        wq->sq = kzalloc(depth * sizeof(struct t3_swsq), GFP_KERNEL);
+        wq->sq = kcalloc(depth, sizeof(struct t3_swsq), GFP_KERNEL);
         if (!wq->sq)
                 goto err3;
 
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 44161ca4d2a8..a3c3418afd73 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -859,8 +859,9 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
         rdev->status_page->cq_size = rdev->lldi.vr->cq.size;
 
         if (c4iw_wr_log) {
-                rdev->wr_log = kzalloc((1 << c4iw_wr_log_size_order) *
-                                       sizeof(*rdev->wr_log), GFP_KERNEL);
+                rdev->wr_log = kcalloc(1 << c4iw_wr_log_size_order,
+                                       sizeof(*rdev->wr_log),
+                                       GFP_KERNEL);
                 if (rdev->wr_log) {
                         rdev->wr_log_size = 1 << c4iw_wr_log_size_order;
                         atomic_set(&rdev->wr_log_idx, 0);
@@ -1445,7 +1446,7 @@ static void recover_queues(struct uld_ctx *ctx)
         ctx->dev->db_state = RECOVERY;
         idr_for_each(&ctx->dev->qpidr, count_qps, &count);
 
-        qp_list.qps = kzalloc(count * sizeof *qp_list.qps, GFP_ATOMIC);
+        qp_list.qps = kcalloc(count, sizeof(*qp_list.qps), GFP_ATOMIC);
         if (!qp_list.qps) {
                 spin_unlock_irq(&ctx->dev->lock);
                 return;
diff --git a/drivers/infiniband/hw/cxgb4/id_table.c b/drivers/infiniband/hw/cxgb4/id_table.c
index 5c2cfdea06ad..724d23297b35 100644
--- a/drivers/infiniband/hw/cxgb4/id_table.c
+++ b/drivers/infiniband/hw/cxgb4/id_table.c
@@ -92,8 +92,8 @@ int c4iw_id_table_alloc(struct c4iw_id_table *alloc, u32 start, u32 num,
                 alloc->last = 0;
         alloc->max  = num;
         spin_lock_init(&alloc->lock);
-        alloc->table = kmalloc(BITS_TO_LONGS(num) * sizeof(long),
-                                GFP_KERNEL);
+        alloc->table = kmalloc_array(BITS_TO_LONGS(num), sizeof(long),
+                                     GFP_KERNEL);
         if (!alloc->table)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 4106eed1b8fb..aef53305f1c3 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -216,15 +216,15 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
         }
 
         if (!user) {
-                wq->sq.sw_sq = kzalloc(wq->sq.size * sizeof *wq->sq.sw_sq,
-                                 GFP_KERNEL);
+                wq->sq.sw_sq = kcalloc(wq->sq.size, sizeof(*wq->sq.sw_sq),
+                                       GFP_KERNEL);
                 if (!wq->sq.sw_sq) {
                         ret = -ENOMEM;
                         goto free_rq_qid;
                 }
 
-                wq->rq.sw_rq = kzalloc(wq->rq.size * sizeof *wq->rq.sw_rq,
-                                 GFP_KERNEL);
+                wq->rq.sw_rq = kcalloc(wq->rq.size, sizeof(*wq->rq.sw_rq),
+                                       GFP_KERNEL);
                 if (!wq->rq.sw_rq) {
                         ret = -ENOMEM;
                         goto free_sw_sq;
diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
index 298e0e3fc0c9..7fb350b87b49 100644
--- a/drivers/infiniband/hw/hfi1/sdma.c
+++ b/drivers/infiniband/hw/hfi1/sdma.c
@@ -1461,7 +1461,8 @@ int sdma_init(struct hfi1_devdata *dd, u8 port)
                 if (!sde->descq)
                         goto bail;
                 sde->tx_ring =
-                        kvzalloc_node(sizeof(struct sdma_txreq *) * descq_cnt,
+                        kvzalloc_node(array_size(descq_cnt,
+                                                 sizeof(struct sdma_txreq *)),
                                       GFP_KERNEL, dd->node);
                 if (!sde->tx_ring)
                         goto bail;
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 0e8dad68910a..a6e11be0ea0f 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -3177,7 +3177,7 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
         struct device *dev = hr_dev->dev;
         int ret = -EINVAL;
 
-        context = kzalloc(2 * sizeof(*context), GFP_KERNEL);
+        context = kcalloc(2, sizeof(*context), GFP_KERNEL);
         if (!context)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
index d1fe0e7957e3..eb26a5f6fc58 100644
--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
+++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
@@ -144,7 +144,7 @@ static int hns_roce_buddy_init(struct hns_roce_buddy *buddy, int max_order)
                 buddy->bits[i] = kcalloc(s, sizeof(long), GFP_KERNEL |
                                          __GFP_NOWARN);
                 if (!buddy->bits[i]) {
-                        buddy->bits[i] = vzalloc(s * sizeof(long));
+                        buddy->bits[i] = vzalloc(array_size(s, sizeof(long)));
                         if (!buddy->bits[i])
                                 goto err_out_free;
                 }
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index d604b3d5aa3e..90a3e2642c2e 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1613,7 +1613,8 @@ static int mlx4_ib_alloc_pv_bufs(struct mlx4_ib_demux_pv_ctx *ctx,
 
         tun_qp = &ctx->qp[qp_type];
 
-        tun_qp->ring = kzalloc(sizeof (struct mlx4_ib_buf) * MLX4_NUM_TUNNEL_BUFS,
+        tun_qp->ring = kcalloc(MLX4_NUM_TUNNEL_BUFS,
+                               sizeof(struct mlx4_ib_buf),
                                GFP_KERNEL);
         if (!tun_qp->ring)
                 return -ENOMEM;
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index f839bf3b1497..4ec519afc45b 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -302,7 +302,8 @@ static int mlx4_ib_add_gid(const union ib_gid *gid,
                 ctx->refcount++;
         }
         if (!ret && hw_update) {
-                gids = kmalloc(sizeof(*gids) * MLX4_MAX_PORT_GIDS, GFP_ATOMIC);
+                gids = kmalloc_array(MLX4_MAX_PORT_GIDS, sizeof(*gids),
+                                     GFP_ATOMIC);
                 if (!gids) {
                         ret = -ENOMEM;
                 } else {
@@ -355,7 +356,8 @@ static int mlx4_ib_del_gid(const struct ib_gid_attr *attr, void **context)
         if (!ret && hw_update) {
                 int i;
 
-                gids = kmalloc(sizeof(*gids) * MLX4_MAX_PORT_GIDS, GFP_ATOMIC);
+                gids = kmalloc_array(MLX4_MAX_PORT_GIDS, sizeof(*gids),
+                                     GFP_ATOMIC);
                 if (!gids) {
                         ret = -ENOMEM;
                 } else {
@@ -2872,9 +2874,9 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                         goto err_counter;
 
                 ibdev->ib_uc_qpns_bitmap =
-                        kmalloc(BITS_TO_LONGS(ibdev->steer_qpn_count) *
-                                sizeof(long),
-                                GFP_KERNEL);
+                        kmalloc_array(BITS_TO_LONGS(ibdev->steer_qpn_count),
+                                      sizeof(long),
+                                      GFP_KERNEL);
                 if (!ibdev->ib_uc_qpns_bitmap)
                         goto err_steer_qp_release;
 
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index cd2c08c45334..3b8045fd23ed 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -573,8 +573,8 @@ static int alloc_proxy_bufs(struct ib_device *dev, struct mlx4_ib_qp *qp)
         int i;
 
         qp->sqp_proxy_rcv =
-                kmalloc(sizeof (struct mlx4_ib_buf) * qp->rq.wqe_cnt,
-                        GFP_KERNEL);
+                kmalloc_array(qp->rq.wqe_cnt, sizeof(struct mlx4_ib_buf),
+                              GFP_KERNEL);
         if (!qp->sqp_proxy_rcv)
                 return -ENOMEM;
         for (i = 0; i < qp->rq.wqe_cnt; i++) {
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index 3c7522d025f2..0af7b7905550 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -127,7 +127,7 @@ static int create_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq,
                 goto err_umem;
         }
 
-        in->pas = kvzalloc(sizeof(*in->pas) * ncont, GFP_KERNEL);
+        in->pas = kvcalloc(ncont, sizeof(*in->pas), GFP_KERNEL);
         if (!in->pas) {
                 err = -ENOMEM;
                 goto err_umem;
@@ -189,7 +189,7 @@ static int create_srq_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_srq *srq,
         }
 
         mlx5_ib_dbg(dev, "srq->buf.page_shift = %d\n", srq->buf.page_shift);
-        in->pas = kvzalloc(sizeof(*in->pas) * srq->buf.npages, GFP_KERNEL);
+        in->pas = kvcalloc(srq->buf.npages, sizeof(*in->pas), GFP_KERNEL);
         if (!in->pas) {
                 err = -ENOMEM;
                 goto err_buf;
diff --git a/drivers/infiniband/hw/mthca/mthca_allocator.c b/drivers/infiniband/hw/mthca/mthca_allocator.c
index b4e0cf4e95cd..aaf10dd5364d 100644
--- a/drivers/infiniband/hw/mthca/mthca_allocator.c
+++ b/drivers/infiniband/hw/mthca/mthca_allocator.c
@@ -90,8 +90,8 @@ int mthca_alloc_init(struct mthca_alloc *alloc, u32 num, u32 mask,
         alloc->max  = num;
         alloc->mask = mask;
         spin_lock_init(&alloc->lock);
-        alloc->table = kmalloc(BITS_TO_LONGS(num) * sizeof (long),
-                               GFP_KERNEL);
+        alloc->table = kmalloc_array(BITS_TO_LONGS(num), sizeof(long),
+                                     GFP_KERNEL);
         if (!alloc->table)
                 return -ENOMEM;
 
@@ -162,7 +162,8 @@ int mthca_array_init(struct mthca_array *array, int nent)
         int npage = (nent * sizeof (void *) + PAGE_SIZE - 1) / PAGE_SIZE;
         int i;
 
-        array->page_list = kmalloc(npage * sizeof *array->page_list, GFP_KERNEL);
+        array->page_list = kmalloc_array(npage, sizeof(*array->page_list),
+                                         GFP_KERNEL);
         if (!array->page_list)
                 return -ENOMEM;
 
@@ -220,7 +221,8 @@ int mthca_buf_alloc(struct mthca_dev *dev, int size, int max_direct,
                         npages *= 2;
                 }
 
-                dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL);
+                dma_list = kmalloc_array(npages, sizeof(*dma_list),
+                                         GFP_KERNEL);
                 if (!dma_list)
                         goto err_free;
 
@@ -231,12 +233,14 @@ int mthca_buf_alloc(struct mthca_dev *dev, int size, int max_direct,
                 npages     = (size + PAGE_SIZE - 1) / PAGE_SIZE;
                 shift      = PAGE_SHIFT;
 
-                dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL);
+                dma_list = kmalloc_array(npages, sizeof(*dma_list),
+                                         GFP_KERNEL);
                 if (!dma_list)
                         return -ENOMEM;
 
-                buf->page_list = kmalloc(npages * sizeof *buf->page_list,
-                                         GFP_KERNEL);
+                buf->page_list = kmalloc_array(npages,
+                                               sizeof(*buf->page_list),
+                                               GFP_KERNEL);
                 if (!buf->page_list)
                         goto err_out;
 
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 419a2a20c047..83aa47eb81a9 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -565,9 +565,9 @@ int mthca_cmd_use_events(struct mthca_dev *dev)
 {
         int i;
 
-        dev->cmd.context = kmalloc(dev->cmd.max_cmds *
-                                   sizeof (struct mthca_cmd_context),
-                                   GFP_KERNEL);
+        dev->cmd.context = kmalloc_array(dev->cmd.max_cmds,
+                                         sizeof(struct mthca_cmd_context),
+                                         GFP_KERNEL);
         if (!dev->cmd.context)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 690201738993..30400ea4808b 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -479,15 +479,15 @@ static int mthca_create_eq(struct mthca_dev *dev,
         eq->nent = roundup_pow_of_two(max(nent, 2));
         npages = ALIGN(eq->nent * MTHCA_EQ_ENTRY_SIZE, PAGE_SIZE) / PAGE_SIZE;
 
-        eq->page_list = kmalloc(npages * sizeof *eq->page_list,
-                                GFP_KERNEL);
+        eq->page_list = kmalloc_array(npages, sizeof(*eq->page_list),
+                                      GFP_KERNEL);
         if (!eq->page_list)
                 goto err_out;
 
         for (i = 0; i < npages; ++i)
                 eq->page_list[i].buf = NULL;
 
-        dma_list = kmalloc(npages * sizeof *dma_list, GFP_KERNEL);
+        dma_list = kmalloc_array(npages, sizeof(*dma_list), GFP_KERNEL);
         if (!dma_list)
                 goto err_out_free;
 
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 7a31be3c3e73..cc9c0c8ccba3 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -712,9 +712,9 @@ int mthca_init_db_tab(struct mthca_dev *dev)
         dev->db_tab->max_group1 = 0;
         dev->db_tab->min_group2 = dev->db_tab->npages - 1;
 
-        dev->db_tab->page = kmalloc(dev->db_tab->npages *
-                                    sizeof *dev->db_tab->page,
-                                    GFP_KERNEL);
+        dev->db_tab->page = kmalloc_array(dev->db_tab->npages,
+                                          sizeof(*dev->db_tab->page),
+                                          GFP_KERNEL);
         if (!dev->db_tab->page) {
                 kfree(dev->db_tab);
                 return -ENOMEM;
diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index ed9a989e501b..6686042aafb4 100644
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -144,7 +144,7 @@ static int mthca_buddy_init(struct mthca_buddy *buddy, int max_order)
         buddy->max_order = max_order;
         spin_lock_init(&buddy->lock);
 
-        buddy->bits = kzalloc((buddy->max_order + 1) * sizeof (long *),
+        buddy->bits = kcalloc(buddy->max_order + 1, sizeof(long *),
                               GFP_KERNEL);
         buddy->num_free = kcalloc((buddy->max_order + 1), sizeof *buddy->num_free,
                                   GFP_KERNEL);
@@ -153,7 +153,7 @@ static int mthca_buddy_init(struct mthca_buddy *buddy, int max_order)
 
         for (i = 0; i <= buddy->max_order; ++i) {
                 s = BITS_TO_LONGS(1 << (buddy->max_order - i));
-                buddy->bits[i] = kmalloc(s * sizeof (long), GFP_KERNEL);
+                buddy->bits[i] = kmalloc_array(s, sizeof(long), GFP_KERNEL);
                 if (!buddy->bits[i])
                         goto err_out_free;
                 bitmap_zero(buddy->bits[i],
diff --git a/drivers/infiniband/hw/mthca/mthca_profile.c b/drivers/infiniband/hw/mthca/mthca_profile.c
index 15d064479ef6..7ea970774839 100644
--- a/drivers/infiniband/hw/mthca/mthca_profile.c
+++ b/drivers/infiniband/hw/mthca/mthca_profile.c
@@ -79,7 +79,7 @@ s64 mthca_make_profile(struct mthca_dev *dev,
         struct mthca_resource *profile;
         int i, j;
 
-        profile = kzalloc(MTHCA_RES_NUM * sizeof *profile, GFP_KERNEL);
+        profile = kcalloc(MTHCA_RES_NUM, sizeof(*profile), GFP_KERNEL);
         if (!profile)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index d21960cd9a49..af1c49d70b89 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -1054,8 +1054,8 @@ static int mthca_alloc_wqe_buf(struct mthca_dev *dev,
         size = PAGE_ALIGN(qp->send_wqe_offset +
                           (qp->sq.max << qp->sq.wqe_shift));
 
-        qp->wrid = kmalloc((qp->rq.max + qp->sq.max) * sizeof (u64),
-                           GFP_KERNEL);
+        qp->wrid = kmalloc_array(qp->rq.max + qp->sq.max, sizeof(u64),
+                                 GFP_KERNEL);
         if (!qp->wrid)
                 goto err_out;
 
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index d22f970480c0..f79732bc73b4 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -155,7 +155,7 @@ static int mthca_alloc_srq_buf(struct mthca_dev *dev, struct mthca_pd *pd,
         if (pd->ibpd.uobject)
                 return 0;
 
-        srq->wrid = kmalloc(srq->max * sizeof (u64), GFP_KERNEL);
+        srq->wrid = kmalloc_array(srq->max, sizeof(u64), GFP_KERNEL);
         if (!srq->wrid)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/hw/nes/nes_mgt.c b/drivers/infiniband/hw/nes/nes_mgt.c
index 21e0ebd39a05..9bdb84dc225c 100644
--- a/drivers/infiniband/hw/nes/nes_mgt.c
+++ b/drivers/infiniband/hw/nes/nes_mgt.c
@@ -878,7 +878,8 @@ int nes_init_mgt_qp(struct nes_device *nesdev, struct net_device *netdev, struct
         int ret;
 
         /* Allocate space the all mgt QPs once */
-        mgtvnic = kzalloc(NES_MGT_QP_COUNT * sizeof(struct nes_vnic_mgt), GFP_KERNEL);
+        mgtvnic = kcalloc(NES_MGT_QP_COUNT, sizeof(struct nes_vnic_mgt),
+                          GFP_KERNEL);
         if (!mgtvnic)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index 007d5e8a0121..61014e251555 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -904,7 +904,7 @@ static void nes_netdev_set_multicast_list(struct net_device *netdev)
                 int i;
                 struct netdev_hw_addr *ha;
 
-                addrs = kmalloc(ETH_ALEN * mc_count, GFP_ATOMIC);
+                addrs = kmalloc_array(mc_count, ETH_ALEN, GFP_ATOMIC);
                 if (!addrs) {
                         set_allmulti(nesdev, nic_active_bit);
                         goto unlock;
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 1040a6e34230..32f26556c808 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -2254,8 +2254,9 @@ static struct ib_mr *nes_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
                                                                 ibmr = ERR_PTR(-ENOMEM);
                                                                 goto reg_user_mr_err;
                                                         }
-                                                        root_vpbl.leaf_vpbl = kzalloc(sizeof(*root_vpbl.leaf_vpbl)*1024,
-                                                                        GFP_KERNEL);
+                                                        root_vpbl.leaf_vpbl = kcalloc(1024,
+                                                                                      sizeof(*root_vpbl.leaf_vpbl),
+                                                                                      GFP_KERNEL);
                                                         if (!root_vpbl.leaf_vpbl) {
                                                                 ib_umem_release(region);
                                                                 pci_free_consistent(nesdev->pcidev, 8192, root_vpbl.pbl_vbase,
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 2c260e1c29d1..6c136e5017fe 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -3096,7 +3096,7 @@ static int ocrdma_create_eqs(struct ocrdma_dev *dev)
         if (!num_eq)
                 return -EINVAL;
 
-        dev->eq_tbl = kzalloc(sizeof(struct ocrdma_eq) * num_eq, GFP_KERNEL);
+        dev->eq_tbl = kcalloc(num_eq, sizeof(struct ocrdma_eq), GFP_KERNEL);
         if (!dev->eq_tbl)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index eb8b6a935016..5962c0ed9847 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -221,19 +221,20 @@ static int ocrdma_register_device(struct ocrdma_dev *dev)
 static int ocrdma_alloc_resources(struct ocrdma_dev *dev)
 {
         mutex_init(&dev->dev_lock);
-        dev->cq_tbl = kzalloc(sizeof(struct ocrdma_cq *) *
-                              OCRDMA_MAX_CQ, GFP_KERNEL);
+        dev->cq_tbl = kcalloc(OCRDMA_MAX_CQ, sizeof(struct ocrdma_cq *),
+                              GFP_KERNEL);
         if (!dev->cq_tbl)
                 goto alloc_err;
 
         if (dev->attr.max_qp) {
-                dev->qp_tbl = kzalloc(sizeof(struct ocrdma_qp *) *
-                                      OCRDMA_MAX_QP, GFP_KERNEL);
+                dev->qp_tbl = kcalloc(OCRDMA_MAX_QP,
+                                      sizeof(struct ocrdma_qp *),
+                                      GFP_KERNEL);
                 if (!dev->qp_tbl)
                         goto alloc_err;
         }
 
-        dev->stag_arr = kzalloc(sizeof(u64) * OCRDMA_MAX_STAG, GFP_KERNEL);
+        dev->stag_arr = kcalloc(OCRDMA_MAX_STAG, sizeof(u64), GFP_KERNEL);
         if (dev->stag_arr == NULL)
                 goto alloc_err;
 
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 784ed6b09a46..82e20fc32890 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -843,8 +843,8 @@ static int ocrdma_build_pbl_tbl(struct ocrdma_dev *dev, struct ocrdma_hw_mr *mr)
         void *va;
         dma_addr_t pa;
 
-        mr->pbl_table = kzalloc(sizeof(struct ocrdma_pbl) *
-                                mr->num_pbls, GFP_KERNEL);
+        mr->pbl_table = kcalloc(mr->num_pbls, sizeof(struct ocrdma_pbl),
+                                GFP_KERNEL);
 
         if (!mr->pbl_table)
                 return -ENOMEM;
@@ -1323,12 +1323,12 @@ static void ocrdma_set_qp_db(struct ocrdma_dev *dev, struct ocrdma_qp *qp,
 static int ocrdma_alloc_wr_id_tbl(struct ocrdma_qp *qp)
 {
         qp->wqe_wr_id_tbl =
-            kzalloc(sizeof(*(qp->wqe_wr_id_tbl)) * qp->sq.max_cnt,
+            kcalloc(qp->sq.max_cnt, sizeof(*(qp->wqe_wr_id_tbl)),
                     GFP_KERNEL);
         if (qp->wqe_wr_id_tbl == NULL)
                 return -ENOMEM;
         qp->rqe_wr_id_tbl =
-            kzalloc(sizeof(u64) * qp->rq.max_cnt, GFP_KERNEL);
+            kcalloc(qp->rq.max_cnt, sizeof(u64), GFP_KERNEL);
         if (qp->rqe_wr_id_tbl == NULL)
                 return -ENOMEM;
 
@@ -1865,15 +1865,16 @@ struct ib_srq *ocrdma_create_srq(struct ib_pd *ibpd,
 
         if (udata == NULL) {
                 status = -ENOMEM;
-                srq->rqe_wr_id_tbl = kzalloc(sizeof(u64) * srq->rq.max_cnt,
-                            GFP_KERNEL);
+                srq->rqe_wr_id_tbl = kcalloc(srq->rq.max_cnt, sizeof(u64),
+                                             GFP_KERNEL);
                 if (srq->rqe_wr_id_tbl == NULL)
                         goto arm_err;
 
                 srq->bit_fields_len = (srq->rq.max_cnt / 32) +
                     (srq->rq.max_cnt % 32 ? 1 : 0);
                 srq->idx_bit_fields =
-                    kmalloc(srq->bit_fields_len * sizeof(u32), GFP_KERNEL);
+                    kmalloc_array(srq->bit_fields_len, sizeof(u32),
+                                  GFP_KERNEL);
                 if (srq->idx_bit_fields == NULL)
                         goto arm_err;
                 memset(srq->idx_bit_fields, 0xff,
diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
index f4cb60b658ea..ad22b32bbd9c 100644
--- a/drivers/infiniband/hw/qedr/main.c
+++ b/drivers/infiniband/hw/qedr/main.c
@@ -317,8 +317,8 @@ static int qedr_alloc_resources(struct qedr_dev *dev)
         u16 n_entries;
         int i, rc;
 
-        dev->sgid_tbl = kzalloc(sizeof(union ib_gid) *
-                                QEDR_MAX_SGID, GFP_KERNEL);
+        dev->sgid_tbl = kcalloc(QEDR_MAX_SGID, sizeof(union ib_gid),
+                                GFP_KERNEL);
         if (!dev->sgid_tbl)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 710032f1fad7..f7ac8fc9b531 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -1614,7 +1614,7 @@ static int qedr_create_kernel_qp(struct qedr_dev *dev,
         qp->sq.max_wr = min_t(u32, attrs->cap.max_send_wr * dev->wq_multiplier,
                               dev->attr.max_sqe);
 
-        qp->wqe_wr_id = kzalloc(qp->sq.max_wr * sizeof(*qp->wqe_wr_id),
+        qp->wqe_wr_id = kcalloc(qp->sq.max_wr, sizeof(*qp->wqe_wr_id),
                                 GFP_KERNEL);
         if (!qp->wqe_wr_id) {
                 DP_ERR(dev, "create qp: failed SQ shadow memory allocation\n");
@@ -1632,7 +1632,7 @@ static int qedr_create_kernel_qp(struct qedr_dev *dev,
         qp->rq.max_wr = (u16) max_t(u32, attrs->cap.max_recv_wr, 1);
 
         /* Allocate driver internal RQ array */
-        qp->rqe_wr_id = kzalloc(qp->rq.max_wr * sizeof(*qp->rqe_wr_id),
+        qp->rqe_wr_id = kcalloc(qp->rq.max_wr, sizeof(*qp->rqe_wr_id),
                                 GFP_KERNEL);
         if (!qp->rqe_wr_id) {
                 DP_ERR(dev,
diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
index 8a15e5c7dd91..fb1ff59f40bd 100644
--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
@@ -2496,15 +2496,16 @@ static void init_6120_cntrnames(struct qib_devdata *dd)
                 dd->cspec->cntrnamelen = sizeof(cntr6120names) - 1;
         else
                 dd->cspec->cntrnamelen = 1 + s - cntr6120names;
-        dd->cspec->cntrs = kmalloc(dd->cspec->ncntrs
-                * sizeof(u64), GFP_KERNEL);
+        dd->cspec->cntrs = kmalloc_array(dd->cspec->ncntrs, sizeof(u64),
+                                         GFP_KERNEL);
 
         for (i = 0, s = (char *)portcntr6120names; s; i++)
                 s = strchr(s + 1, '\n');
         dd->cspec->nportcntrs = i - 1;
         dd->cspec->portcntrnamelen = sizeof(portcntr6120names) - 1;
-        dd->cspec->portcntrs = kmalloc(dd->cspec->nportcntrs
-                * sizeof(u64), GFP_KERNEL);
+        dd->cspec->portcntrs = kmalloc_array(dd->cspec->nportcntrs,
+                                             sizeof(u64),
+                                             GFP_KERNEL);
 }
 
 static u32 qib_read_6120cntrs(struct qib_devdata *dd, loff_t pos, char **namep,
diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
index bdff2326731e..163a57a88742 100644
--- a/drivers/infiniband/hw/qib/qib_iba7220.c
+++ b/drivers/infiniband/hw/qib/qib_iba7220.c
@@ -3147,15 +3147,16 @@ static void init_7220_cntrnames(struct qib_devdata *dd)
                 dd->cspec->cntrnamelen = sizeof(cntr7220names) - 1;
         else
                 dd->cspec->cntrnamelen = 1 + s - cntr7220names;
-        dd->cspec->cntrs = kmalloc(dd->cspec->ncntrs
-                * sizeof(u64), GFP_KERNEL);
+        dd->cspec->cntrs = kmalloc_array(dd->cspec->ncntrs, sizeof(u64),
+                                         GFP_KERNEL);
 
         for (i = 0, s = (char *)portcntr7220names; s; i++)
                 s = strchr(s + 1, '\n');
         dd->cspec->nportcntrs = i - 1;
         dd->cspec->portcntrnamelen = sizeof(portcntr7220names) - 1;
-        dd->cspec->portcntrs = kmalloc(dd->cspec->nportcntrs
-                * sizeof(u64), GFP_KERNEL);
+        dd->cspec->portcntrs = kmalloc_array(dd->cspec->nportcntrs,
+                                             sizeof(u64),
+                                             GFP_KERNEL);
 }
 
 static u32 qib_read_7220cntrs(struct qib_devdata *dd, loff_t pos, char **namep,
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 8414ae44a518..bf5e222eed8e 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -3648,8 +3648,9 @@ static int qib_do_7322_reset(struct qib_devdata *dd)
 
         if (msix_entries) {
                 /* can be up to 512 bytes, too big for stack */
-                msix_vecsave = kmalloc(2 * dd->cspec->num_msix_entries *
-                        sizeof(u64), GFP_KERNEL);
+                msix_vecsave = kmalloc_array(2 * dd->cspec->num_msix_entries,
+                                             sizeof(u64),
+                                             GFP_KERNEL);
         }
 
         /*
@@ -5009,16 +5010,17 @@ static void init_7322_cntrnames(struct qib_devdata *dd)
                 dd->cspec->cntrnamelen = sizeof(cntr7322names) - 1;
         else
                 dd->cspec->cntrnamelen = 1 + s - cntr7322names;
-        dd->cspec->cntrs = kmalloc(dd->cspec->ncntrs
-                * sizeof(u64), GFP_KERNEL);
+        dd->cspec->cntrs = kmalloc_array(dd->cspec->ncntrs, sizeof(u64),
+                                         GFP_KERNEL);
 
         for (i = 0, s = (char *)portcntr7322names; s; i++)
                 s = strchr(s + 1, '\n');
         dd->cspec->nportcntrs = i - 1;
         dd->cspec->portcntrnamelen = sizeof(portcntr7322names) - 1;
         for (i = 0; i < dd->num_pports; ++i) {
-                dd->pport[i].cpspec->portcntrs = kmalloc(dd->cspec->nportcntrs
-                        * sizeof(u64), GFP_KERNEL);
+                dd->pport[i].cpspec->portcntrs =
+                        kmalloc_array(dd->cspec->nportcntrs, sizeof(u64),
+                                      GFP_KERNEL);
         }
 }
 
@@ -6412,12 +6414,15 @@ static int qib_init_7322_variables(struct qib_devdata *dd)
         sbufcnt = dd->piobcnt2k + dd->piobcnt4k +
                 NUM_VL15_BUFS + BITS_PER_LONG - 1;
         sbufcnt /= BITS_PER_LONG;
-        dd->cspec->sendchkenable = kmalloc(sbufcnt *
-                sizeof(*dd->cspec->sendchkenable), GFP_KERNEL);
-        dd->cspec->sendgrhchk = kmalloc(sbufcnt *
-                sizeof(*dd->cspec->sendgrhchk), GFP_KERNEL);
-        dd->cspec->sendibchk = kmalloc(sbufcnt *
-                sizeof(*dd->cspec->sendibchk), GFP_KERNEL);
+        dd->cspec->sendchkenable =
+                kmalloc_array(sbufcnt, sizeof(*dd->cspec->sendchkenable),
+                              GFP_KERNEL);
+        dd->cspec->sendgrhchk =
+                kmalloc_array(sbufcnt, sizeof(*dd->cspec->sendgrhchk),
+                              GFP_KERNEL);
+        dd->cspec->sendibchk =
+                kmalloc_array(sbufcnt, sizeof(*dd->cspec->sendibchk),
+                              GFP_KERNEL);
         if (!dd->cspec->sendchkenable || !dd->cspec->sendgrhchk ||
                 !dd->cspec->sendibchk) {
                 ret = -ENOMEM;
@@ -7290,8 +7295,9 @@ struct qib_devdata *qib_init_iba7322_funcs(struct pci_dev *pdev,
                 actual_cnt -= dd->num_pports;
 
         tabsize = actual_cnt;
-        dd->cspec->msix_entries = kzalloc(tabsize *
-                        sizeof(struct qib_msix_entry), GFP_KERNEL);
+        dd->cspec->msix_entries = kcalloc(tabsize,
+                                          sizeof(struct qib_msix_entry),
+                                          GFP_KERNEL);
         if (!dd->cspec->msix_entries)
                 tabsize = 0;
 
diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c
index 015520289735..d7cdc77d6306 100644
--- a/drivers/infiniband/hw/qib/qib_init.c
+++ b/drivers/infiniband/hw/qib/qib_init.c
@@ -369,11 +369,13 @@ static void init_shadow_tids(struct qib_devdata *dd)
         struct page **pages;
         dma_addr_t *addrs;
 
-        pages = vzalloc(dd->cfgctxts * dd->rcvtidcnt * sizeof(struct page *));
+        pages = vzalloc(array_size(sizeof(struct page *),
+                                   dd->cfgctxts * dd->rcvtidcnt));
         if (!pages)
                 goto bail;
 
-        addrs = vzalloc(dd->cfgctxts * dd->rcvtidcnt * sizeof(dma_addr_t));
+        addrs = vzalloc(array_size(sizeof(dma_addr_t),
+                                   dd->cfgctxts * dd->rcvtidcnt));
         if (!addrs)
                 goto bail_free;
 
@@ -1134,8 +1136,8 @@ struct qib_devdata *qib_alloc_devdata(struct pci_dev *pdev, size_t extra)
         if (!qib_cpulist_count) {
                 u32 count = num_online_cpus();
 
-                qib_cpulist = kzalloc(BITS_TO_LONGS(count) *
-                                      sizeof(long), GFP_KERNEL);
+                qib_cpulist = kcalloc(BITS_TO_LONGS(count), sizeof(long),
+                                      GFP_KERNEL);
                 if (qib_cpulist)
                         qib_cpulist_count = count;
         }
@@ -1673,8 +1675,8 @@ int qib_setup_eagerbufs(struct qib_ctxtdata *rcd)
         size = rcd->rcvegrbuf_size;
         if (!rcd->rcvegrbuf) {
                 rcd->rcvegrbuf =
-                        kzalloc_node(chunk * sizeof(rcd->rcvegrbuf[0]),
-                                GFP_KERNEL, rcd->node_id);
+                        kcalloc_node(chunk, sizeof(rcd->rcvegrbuf[0]),
+                                     GFP_KERNEL, rcd->node_id);
                 if (!rcd->rcvegrbuf)
                         goto bail;
         }
diff --git a/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c b/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c
index 912d8ef04352..bf5136533d49 100644
--- a/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c
+++ b/drivers/infiniband/hw/usnic/usnic_ib_qp_grp.c
@@ -543,7 +543,7 @@ alloc_res_chunk_list(struct usnic_vnic *vnic,
                 /* Do Nothing */
         }
 
-        res_chunk_list = kzalloc(sizeof(*res_chunk_list)*(res_lst_sz+1),
+        res_chunk_list = kcalloc(res_lst_sz + 1, sizeof(*res_chunk_list),
                                         GFP_ATOMIC);
         if (!res_chunk_list)
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/infiniband/hw/usnic/usnic_vnic.c b/drivers/infiniband/hw/usnic/usnic_vnic.c
index e7b0030254da..ebe08f348453 100644
--- a/drivers/infiniband/hw/usnic/usnic_vnic.c
+++ b/drivers/infiniband/hw/usnic/usnic_vnic.c
@@ -312,7 +312,7 @@ static int usnic_vnic_alloc_res_chunk(struct usnic_vnic *vnic,
         }
 
         chunk->cnt = chunk->free_cnt = cnt;
-        chunk->res = kzalloc(sizeof(*(chunk->res))*cnt, GFP_KERNEL);
+        chunk->res = kcalloc(cnt, sizeof(*(chunk->res)), GFP_KERNEL);
         if (!chunk->res)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index 40046135c509..41183bd665ca 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -813,7 +813,7 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
                 sz = sizeof(struct rvt_sge) *
                         init_attr->cap.max_send_sge +
                         sizeof(struct rvt_swqe);
-                swq = vzalloc_node(sqsize * sz, rdi->dparms.node);
+                swq = vzalloc_node(array_size(sz, sqsize), rdi->dparms.node);
                 if (!swq)
                         return ERR_PTR(-ENOMEM);
 
@@ -836,11 +836,10 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
                 RCU_INIT_POINTER(qp->next, NULL);
                 if (init_attr->qp_type == IB_QPT_RC) {
                         qp->s_ack_queue =
-                                kzalloc_node(
-                                        sizeof(*qp->s_ack_queue) *
-                                         rvt_max_atomic(rdi),
-                                        GFP_KERNEL,
-                                        rdi->dparms.node);
+                                kcalloc_node(rvt_max_atomic(rdi),
+                                             sizeof(*qp->s_ack_queue),
+                                             GFP_KERNEL,
+                                             rdi->dparms.node);
                         if (!qp->s_ack_queue)
                                 goto bail_qp;
                 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 962fbcb57dc7..6535d9beb24d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -358,7 +358,8 @@ static int ipoib_cm_nonsrq_init_rx(struct net_device *dev, struct ib_cm_id *cm_i
         int ret;
         int i;
 
-        rx->rx_ring = vzalloc(ipoib_recvq_size * sizeof *rx->rx_ring);
+        rx->rx_ring = vzalloc(array_size(ipoib_recvq_size,
+                                         sizeof(*rx->rx_ring)));
         if (!rx->rx_ring)
                 return -ENOMEM;
 
@@ -1145,7 +1146,7 @@ static int ipoib_cm_tx_init(struct ipoib_cm_tx *p, u32 qpn,
         int ret;
 
         noio_flag = memalloc_noio_save();
-        p->tx_ring = vzalloc(ipoib_sendq_size * sizeof(*p->tx_ring));
+        p->tx_ring = vzalloc(array_size(ipoib_sendq_size, sizeof(*p->tx_ring)));
         if (!p->tx_ring) {
                 memalloc_noio_restore(noio_flag);
                 ret = -ENOMEM;
@@ -1570,7 +1571,8 @@ static void ipoib_cm_create_srq(struct net_device *dev, int max_sge)
                 return;
         }
 
-        priv->cm.srq_ring = vzalloc(ipoib_recvq_size * sizeof *priv->cm.srq_ring);
+        priv->cm.srq_ring = vzalloc(array_size(ipoib_recvq_size,
+                                               sizeof(*priv->cm.srq_ring)));
         if (!priv->cm.srq_ring) {
                 ib_destroy_srq(priv->cm.srq);
                 priv->cm.srq = NULL;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 2ce40a7ff604..26cde95bc0f3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1526,7 +1526,7 @@ static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
                 return -ENOMEM;
         set_bit(IPOIB_STOP_NEIGH_GC, &priv->flags);
         size = roundup_pow_of_two(arp_tbl.gc_thresh3);
-        buckets = kzalloc(size * sizeof(*buckets), GFP_KERNEL);
+        buckets = kcalloc(size, sizeof(*buckets), GFP_KERNEL);
         if (!buckets) {
                 kfree(htbl);
                 return -ENOMEM;
@@ -1704,12 +1704,14 @@ static int ipoib_dev_init_default(struct net_device *dev)
         ipoib_napi_add(dev);
 
         /* Allocate RX/TX "rings" to hold queued skbs */
-        priv->rx_ring = kzalloc(ipoib_recvq_size * sizeof *priv->rx_ring,
-                                GFP_KERNEL);
+        priv->rx_ring = kcalloc(ipoib_recvq_size,
+                                       sizeof(*priv->rx_ring),
+                                       GFP_KERNEL);
         if (!priv->rx_ring)
                 goto out;
 
-        priv->tx_ring = vzalloc(ipoib_sendq_size * sizeof *priv->tx_ring);
+        priv->tx_ring = vzalloc(array_size(ipoib_sendq_size,
+                                           sizeof(*priv->tx_ring)));
         if (!priv->tx_ring) {
                 pr_warn("%s: failed to allocate TX ring (%d entries)\n",
                         priv->ca->name, ipoib_sendq_size);
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index ca858d6bd37a..2f6388596f88 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -258,8 +258,9 @@ int iser_alloc_rx_descriptors(struct iser_conn *iser_conn,
                 goto alloc_login_buf_fail;
 
         iser_conn->num_rx_descs = session->cmds_max;
-        iser_conn->rx_descs = kmalloc(iser_conn->num_rx_descs *
-                                sizeof(struct iser_rx_desc), GFP_KERNEL);
+        iser_conn->rx_descs = kmalloc_array(iser_conn->num_rx_descs,
+                                            sizeof(struct iser_rx_desc),
+                                            GFP_KERNEL);
         if (!iser_conn->rx_descs)
                 goto rx_desc_alloc_fail;
 
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index f2f9318e1f49..cccbcf0eb035 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -181,8 +181,9 @@ isert_alloc_rx_descriptors(struct isert_conn *isert_conn)
         u64 dma_addr;
         int i, j;
 
-        isert_conn->rx_descs = kzalloc(ISERT_QP_MAX_RECV_DTOS *
-                                sizeof(struct iser_rx_desc), GFP_KERNEL);
+        isert_conn->rx_descs = kcalloc(ISERT_QP_MAX_RECV_DTOS,
+                                       sizeof(struct iser_rx_desc),
+                                       GFP_KERNEL);
         if (!isert_conn->rx_descs)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index c35d2cd37d70..9786b24b956f 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1035,16 +1035,17 @@ static int srp_alloc_req_data(struct srp_rdma_ch *ch)
 
         for (i = 0; i < target->req_ring_size; ++i) {
                 req = &ch->req_ring[i];
-                mr_list = kmalloc(target->mr_per_cmd * sizeof(void *),
-                                  GFP_KERNEL);
+                mr_list = kmalloc_array(target->mr_per_cmd, sizeof(void *),
+                                        GFP_KERNEL);
                 if (!mr_list)
                         goto out;
                 if (srp_dev->use_fast_reg) {
                         req->fr_list = mr_list;
                 } else {
                         req->fmr_list = mr_list;
-                        req->map_page = kmalloc(srp_dev->max_pages_per_mr *
-                                                sizeof(void *), GFP_KERNEL);
+                        req->map_page = kmalloc_array(srp_dev->max_pages_per_mr,
+                                                      sizeof(void *),
+                                                      GFP_KERNEL);
                         if (!req->map_page)
                                 goto out;
                 }
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index dfec0e1fac29..3081c629a7f7 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -720,7 +720,7 @@ static struct srpt_ioctx **srpt_alloc_ioctx_ring(struct srpt_device *sdev,
         WARN_ON(ioctx_size != sizeof(struct srpt_recv_ioctx)
                 && ioctx_size != sizeof(struct srpt_send_ioctx));
 
-        ring = kmalloc(ring_size * sizeof(ring[0]), GFP_KERNEL);
+        ring = kmalloc_array(ring_size, sizeof(ring[0]), GFP_KERNEL);
         if (!ring)
                 goto out;
         for (i = 0; i < ring_size; ++i) {
diff --git a/drivers/input/joystick/joydump.c b/drivers/input/joystick/joydump.c
index d1c6e4846a4a..7f4dff9a566f 100644
--- a/drivers/input/joystick/joydump.c
+++ b/drivers/input/joystick/joydump.c
@@ -80,7 +80,7 @@ static int joydump_connect(struct gameport *gameport, struct gameport_driver *dr
 
         timeout = gameport_time(gameport, 10000); /* 10 ms */
 
-        buf = kmalloc(BUF_SIZE * sizeof(struct joydump), GFP_KERNEL);
+        buf = kmalloc_array(BUF_SIZE, sizeof(struct joydump), GFP_KERNEL);
         if (!buf) {
                 printk(KERN_INFO "joydump: no memory for testing\n");
                 goto jd_end;
diff --git a/drivers/input/keyboard/clps711x-keypad.c b/drivers/input/keyboard/clps711x-keypad.c
index 997e3e97f573..e319f745771a 100644
--- a/drivers/input/keyboard/clps711x-keypad.c
+++ b/drivers/input/keyboard/clps711x-keypad.c
@@ -109,8 +109,8 @@ static int clps711x_keypad_probe(struct platform_device *pdev)
         if (priv->row_count < 1)
                 return -EINVAL;
 
-        priv->gpio_data = devm_kzalloc(dev,
-                                sizeof(*priv->gpio_data) * priv->row_count,
+        priv->gpio_data = devm_kcalloc(dev,
+                                priv->row_count, sizeof(*priv->gpio_data),
                                 GFP_KERNEL);
         if (!priv->gpio_data)
                 return -ENOMEM;
diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index 41614c185918..f51ae09596ef 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -443,9 +443,9 @@ matrix_keypad_parse_dt(struct device *dev)
         of_property_read_u32(np, "col-scan-delay-us",
                                                 &pdata->col_scan_delay_us);
 
-        gpios = devm_kzalloc(dev,
-                             sizeof(unsigned int) *
-                                (pdata->num_row_gpios + pdata->num_col_gpios),
+        gpios = devm_kcalloc(dev,
+                             pdata->num_row_gpios + pdata->num_col_gpios,
+                             sizeof(unsigned int),
                              GFP_KERNEL);
         if (!gpios) {
                 dev_err(dev, "could not allocate memory for gpios\n");
diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
index 940d38b08e6b..46406345742b 100644
--- a/drivers/input/keyboard/omap4-keypad.c
+++ b/drivers/input/keyboard/omap4-keypad.c
@@ -337,7 +337,8 @@ static int omap4_keypad_probe(struct platform_device *pdev)
 
         keypad_data->row_shift = get_count_order(keypad_data->cols);
         max_keys = keypad_data->rows << keypad_data->row_shift;
-        keypad_data->keymap = kzalloc(max_keys * sizeof(keypad_data->keymap[0]),
+        keypad_data->keymap = kcalloc(max_keys,
+                                      sizeof(keypad_data->keymap[0]),
                                       GFP_KERNEL);
         if (!keypad_data->keymap) {
                 dev_err(&pdev->dev, "Not enough memory for keymap\n");
diff --git a/drivers/input/keyboard/samsung-keypad.c b/drivers/input/keyboard/samsung-keypad.c
index 316414465c77..1fe1aa2adf85 100644
--- a/drivers/input/keyboard/samsung-keypad.c
+++ b/drivers/input/keyboard/samsung-keypad.c
@@ -281,7 +281,7 @@ samsung_keypad_parse_dt(struct device *dev)
 
         key_count = of_get_child_count(np);
         keymap_data->keymap_size = key_count;
-        keymap = devm_kzalloc(dev, sizeof(uint32_t) * key_count, GFP_KERNEL);
+        keymap = devm_kcalloc(dev, key_count, sizeof(uint32_t), GFP_KERNEL);
         if (!keymap) {
                 dev_err(dev, "could not allocate memory for keymap\n");
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/input/matrix-keymap.c b/drivers/input/matrix-keymap.c
index 8ccefc15c7a4..8b3a5758451e 100644
--- a/drivers/input/matrix-keymap.c
+++ b/drivers/input/matrix-keymap.c
@@ -170,8 +170,8 @@ int matrix_keypad_build_keymap(const struct matrix_keymap_data *keymap_data,
                 return -EINVAL;
 
         if (!keymap) {
-                keymap = devm_kzalloc(input_dev->dev.parent,
-                                      max_keys * sizeof(*keymap),
+                keymap = devm_kcalloc(input_dev->dev.parent,
+                                      max_keys, sizeof(*keymap),
                                       GFP_KERNEL);
                 if (!keymap) {
                         dev_err(input_dev->dev.parent,
diff --git a/drivers/input/misc/rotary_encoder.c b/drivers/input/misc/rotary_encoder.c
index 1588aecafff7..6d304381fc30 100644
--- a/drivers/input/misc/rotary_encoder.c
+++ b/drivers/input/misc/rotary_encoder.c
@@ -283,8 +283,8 @@ static int rotary_encoder_probe(struct platform_device *pdev)
         }
 
         encoder->irq =
-                devm_kzalloc(dev,
-                             sizeof(*encoder->irq) * encoder->gpios->ndescs,
+                devm_kcalloc(dev,
+                             encoder->gpios->ndescs, sizeof(*encoder->irq),
                              GFP_KERNEL);
         if (!encoder->irq)
                 return -ENOMEM;
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index f5954981e9ee..7d29053dfb0f 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -636,9 +636,10 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
         rdesc->num_registers = bitmap_weight(rdesc->presense_map,
                                                 RMI_REG_DESC_PRESENSE_BITS);
 
-        rdesc->registers = devm_kzalloc(&d->dev, rdesc->num_registers *
-                                sizeof(struct rmi_register_desc_item),
-                                GFP_KERNEL);
+        rdesc->registers = devm_kcalloc(&d->dev,
+                                        rdesc->num_registers,
+                                        sizeof(struct rmi_register_desc_item),
+                                        GFP_KERNEL);
         if (!rdesc->registers)
                 return -ENOMEM;
 
@@ -1061,7 +1062,7 @@ int rmi_probe_interrupts(struct rmi_driver_data *data)
         data->num_of_irq_regs = (data->irq_count + 7) / 8;
 
         size = BITS_TO_LONGS(data->irq_count) * sizeof(unsigned long);
-        data->irq_memory = devm_kzalloc(dev, size * 4, GFP_KERNEL);
+        data->irq_memory = devm_kcalloc(dev, size, 4, GFP_KERNEL);
         if (!data->irq_memory) {
                 dev_err(dev, "Failed to allocate memory for irq masks.\n");
                 return -ENOMEM;
diff --git a/drivers/input/rmi4/rmi_f11.c b/drivers/input/rmi4/rmi_f11.c
index bc5e37f30ac1..12a233251793 100644
--- a/drivers/input/rmi4/rmi_f11.c
+++ b/drivers/input/rmi4/rmi_f11.c
@@ -1190,14 +1190,15 @@ static int rmi_f11_initialize(struct rmi_function *fn)
                 f11->sensor.attn_size += f11->sensor.nbr_fingers * 2;
 
         /* allocate the in-kernel tracking buffers */
-        sensor->tracking_pos = devm_kzalloc(&fn->dev,
-                        sizeof(struct input_mt_pos) * sensor->nbr_fingers,
+        sensor->tracking_pos = devm_kcalloc(&fn->dev,
+                        sensor->nbr_fingers, sizeof(struct input_mt_pos),
+                        GFP_KERNEL);
+        sensor->tracking_slots = devm_kcalloc(&fn->dev,
+                        sensor->nbr_fingers, sizeof(int), GFP_KERNEL);
+        sensor->objs = devm_kcalloc(&fn->dev,
+                        sensor->nbr_fingers,
+                        sizeof(struct rmi_2d_sensor_abs_object),
                         GFP_KERNEL);
-        sensor->tracking_slots = devm_kzalloc(&fn->dev,
-                        sizeof(int) * sensor->nbr_fingers, GFP_KERNEL);
-        sensor->objs = devm_kzalloc(&fn->dev,
-                        sizeof(struct rmi_2d_sensor_abs_object)
-                        * sensor->nbr_fingers, GFP_KERNEL);
         if (!sensor->tracking_pos || !sensor->tracking_slots || !sensor->objs)
                 return -ENOMEM;
 
diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index 8b0db086d68a..a3d1aa88f2a9 100644
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -502,14 +502,15 @@ static int rmi_f12_probe(struct rmi_function *fn)
         }
 
         /* allocate the in-kernel tracking buffers */
-        sensor->tracking_pos = devm_kzalloc(&fn->dev,
-                        sizeof(struct input_mt_pos) * sensor->nbr_fingers,
+        sensor->tracking_pos = devm_kcalloc(&fn->dev,
+                        sensor->nbr_fingers, sizeof(struct input_mt_pos),
+                        GFP_KERNEL);
+        sensor->tracking_slots = devm_kcalloc(&fn->dev,
+                        sensor->nbr_fingers, sizeof(int), GFP_KERNEL);
+        sensor->objs = devm_kcalloc(&fn->dev,
+                        sensor->nbr_fingers,
+                        sizeof(struct rmi_2d_sensor_abs_object),
                         GFP_KERNEL);
-        sensor->tracking_slots = devm_kzalloc(&fn->dev,
-                        sizeof(int) * sensor->nbr_fingers, GFP_KERNEL);
-        sensor->objs = devm_kzalloc(&fn->dev,
-                        sizeof(struct rmi_2d_sensor_abs_object)
-                        * sensor->nbr_fingers, GFP_KERNEL);
         if (!sensor->tracking_pos || !sensor->tracking_slots || !sensor->objs)
                 return -ENOMEM;
 
diff --git a/drivers/input/rmi4/rmi_f54.c b/drivers/input/rmi4/rmi_f54.c
index 5343f2c08f15..e8a59d164019 100644
--- a/drivers/input/rmi4/rmi_f54.c
+++ b/drivers/input/rmi4/rmi_f54.c
@@ -685,7 +685,7 @@ static int rmi_f54_probe(struct rmi_function *fn)
         rx = f54->num_rx_electrodes;
         tx = f54->num_tx_electrodes;
         f54->report_data = devm_kzalloc(&fn->dev,
-                                        sizeof(u16) * tx * rx,
+                                        array3_size(tx, rx, sizeof(u16)),
                                         GFP_KERNEL);
         if (f54->report_data == NULL)
                 return -ENOMEM;
diff --git a/drivers/input/rmi4/rmi_spi.c b/drivers/input/rmi4/rmi_spi.c
index 082defc329a8..33b8c6e7ac0a 100644
--- a/drivers/input/rmi4/rmi_spi.c
+++ b/drivers/input/rmi4/rmi_spi.c
@@ -69,7 +69,7 @@ static int rmi_spi_manage_pools(struct rmi_spi_xport *rmi_spi, int len)
                 buf_size = RMI_SPI_XFER_SIZE_LIMIT;
 
         tmp = rmi_spi->rx_buf;
-        buf = devm_kzalloc(&spi->dev, buf_size * 2,
+        buf = devm_kcalloc(&spi->dev, buf_size, 2,
                                 GFP_KERNEL | GFP_DMA);
         if (!buf)
                 return -ENOMEM;
@@ -96,9 +96,10 @@ static int rmi_spi_manage_pools(struct rmi_spi_xport *rmi_spi, int len)
          * per byte delays.
          */
         tmp = rmi_spi->rx_xfers;
-        xfer_buf = devm_kzalloc(&spi->dev,
-                (rmi_spi->rx_xfer_count + rmi_spi->tx_xfer_count)
-                * sizeof(struct spi_transfer), GFP_KERNEL);
+        xfer_buf = devm_kcalloc(&spi->dev,
+                rmi_spi->rx_xfer_count + rmi_spi->tx_xfer_count,
+                sizeof(struct spi_transfer),
+                GFP_KERNEL);
         if (!xfer_buf)
                 return -ENOMEM;
 
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 69e7c60792a8..f7a96bcf94a6 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -2082,7 +2082,7 @@ static int arm_smmu_device_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        smmu->irqs = devm_kzalloc(dev, sizeof(*smmu->irqs) * num_irqs,
+        smmu->irqs = devm_kcalloc(dev, num_irqs, sizeof(*smmu->irqs),
                                   GFP_KERNEL);
         if (!smmu->irqs) {
                 dev_err(dev, "failed to allocate %d irqs\n", num_irqs);
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 4321f7704b23..75456b5aa825 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -1458,7 +1458,7 @@ int dmar_enable_qi(struct intel_iommu *iommu)
 
         qi->desc = page_address(desc_page);
 
-        qi->desc_status = kzalloc(QI_LENGTH * sizeof(int), GFP_ATOMIC);
+        qi->desc_status = kcalloc(QI_LENGTH, sizeof(int), GFP_ATOMIC);
         if (!qi->desc_status) {
                 free_page((unsigned long) qi->desc);
                 kfree(qi);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 89e49a429c57..14e4b3722428 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3189,7 +3189,7 @@ static int copy_translation_tables(struct intel_iommu *iommu)
         /* This is too big for the stack - allocate it from slab */
         ctxt_table_entries = ext ? 512 : 256;
         ret = -ENOMEM;
-        ctxt_tbls = kzalloc(ctxt_table_entries * sizeof(void *), GFP_KERNEL);
+        ctxt_tbls = kcalloc(ctxt_table_entries, sizeof(void *), GFP_KERNEL);
         if (!ctxt_tbls)
                 goto out_unmap;
 
@@ -4032,7 +4032,7 @@ static int iommu_suspend(void)
         unsigned long flag;
 
         for_each_active_iommu(iommu, drhd) {
-                iommu->iommu_state = kzalloc(sizeof(u32) * MAX_SR_DMAR_REGS,
+                iommu->iommu_state = kcalloc(MAX_SR_DMAR_REGS, sizeof(u32),
                                                  GFP_ATOMIC);
                 if (!iommu->iommu_state)
                         goto nomem;
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index c33b7b104e72..af4a8e7fcd27 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1455,7 +1455,7 @@ static int omap_iommu_add_device(struct device *dev)
         if (num_iommus < 0)
                 return 0;
 
-        arch_data = kzalloc((num_iommus + 1) * sizeof(*arch_data), GFP_KERNEL);
+        arch_data = kcalloc(num_iommus + 1, sizeof(*arch_data), GFP_KERNEL);
         if (!arch_data)
                 return -ENOMEM;
 
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 0468acfa131f..054cd2c8e9c8 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1135,7 +1135,7 @@ static int rk_iommu_probe(struct platform_device *pdev)
         iommu->dev = dev;
         iommu->num_mmu = 0;
 
-        iommu->bases = devm_kzalloc(dev, sizeof(*iommu->bases) * num_res,
+        iommu->bases = devm_kcalloc(dev, num_res, sizeof(*iommu->bases),
                                     GFP_KERNEL);
         if (!iommu->bases)
                 return -ENOMEM;
diff --git a/drivers/iommu/tegra-gart.c b/drivers/iommu/tegra-gart.c
index 89ec24c6952c..a004f6da35f2 100644
--- a/drivers/iommu/tegra-gart.c
+++ b/drivers/iommu/tegra-gart.c
@@ -465,7 +465,7 @@ static int tegra_gart_probe(struct platform_device *pdev)
         gart->iovmm_base = (dma_addr_t)res_remap->start;
         gart->page_count = (resource_size(res_remap) >> GART_PAGE_SHIFT);
 
-        gart->savedata = vmalloc(sizeof(u32) * gart->page_count);
+        gart->savedata = vmalloc(array_size(sizeof(u32), gart->page_count));
         if (!gart->savedata) {
                 dev_err(dev, "failed to allocate context save area\n");
                 return -ENOMEM;
diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c
index 9b23843dcad4..a16b320739b4 100644
--- a/drivers/ipack/carriers/tpci200.c
+++ b/drivers/ipack/carriers/tpci200.c
@@ -457,8 +457,8 @@ static int tpci200_install(struct tpci200_board *tpci200)
 {
         int res;
 
-        tpci200->slots = kzalloc(
-                TPCI200_NB_SLOT * sizeof(struct tpci200_slot), GFP_KERNEL);
+        tpci200->slots = kcalloc(TPCI200_NB_SLOT, sizeof(struct tpci200_slot),
+                                 GFP_KERNEL);
         if (tpci200->slots == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
index 63d980995d17..23a3b877f7f1 100644
--- a/drivers/irqchip/irq-alpine-msi.c
+++ b/drivers/irqchip/irq-alpine-msi.c
@@ -268,7 +268,8 @@ static int alpine_msix_init(struct device_node *node,
                 goto err_priv;
         }
 
-        priv->msi_map = kzalloc(sizeof(*priv->msi_map) * BITS_TO_LONGS(priv->num_spis),
+        priv->msi_map = kcalloc(BITS_TO_LONGS(priv->num_spis),
+                                sizeof(*priv->msi_map),
                                 GFP_KERNEL);
         if (!priv->msi_map) {
                 ret = -ENOMEM;
diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
index 1ff38aff9f29..0f52d44b3f69 100644
--- a/drivers/irqchip/irq-gic-v2m.c
+++ b/drivers/irqchip/irq-gic-v2m.c
@@ -361,7 +361,7 @@ static int __init gicv2m_init_one(struct fwnode_handle *fwnode,
                 break;
         }
 
-        v2m->bm = kzalloc(sizeof(long) * BITS_TO_LONGS(v2m->nr_spis),
+        v2m->bm = kcalloc(BITS_TO_LONGS(v2m->nr_spis), sizeof(long),
                           GFP_KERNEL);
         if (!v2m->bm) {
                 ret = -ENOMEM;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 5416f2b2ac21..5377d7e2afba 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1239,7 +1239,7 @@ static int its_vlpi_map(struct irq_data *d, struct its_cmd_info *info)
         if (!its_dev->event_map.vm) {
                 struct its_vlpi_map *maps;
 
-                maps = kzalloc(sizeof(*maps) * its_dev->event_map.nr_lpis,
+                maps = kcalloc(its_dev->event_map.nr_lpis, sizeof(*maps),
                                GFP_KERNEL);
                 if (!maps) {
                         ret = -ENOMEM;
@@ -1437,7 +1437,7 @@ static int __init its_lpi_init(u32 id_bits)
 {
         lpi_chunks = its_lpi_to_chunk(1UL << id_bits);
 
-        lpi_bitmap = kzalloc(BITS_TO_LONGS(lpi_chunks) * sizeof(long),
+        lpi_bitmap = kcalloc(BITS_TO_LONGS(lpi_chunks), sizeof(long),
                              GFP_KERNEL);
         if (!lpi_bitmap) {
                 lpi_chunks = 0;
@@ -1471,7 +1471,8 @@ static unsigned long *its_lpi_alloc_chunks(int nr_irqs, int *base, int *nr_ids)
         if (!nr_chunks)
                 goto out;
 
-        bitmap = kzalloc(BITS_TO_LONGS(nr_chunks * IRQS_PER_CHUNK) * sizeof (long),
+        bitmap = kcalloc(BITS_TO_LONGS(nr_chunks * IRQS_PER_CHUNK),
+                         sizeof(long),
                          GFP_ATOMIC);
         if (!bitmap)
                 goto out;
@@ -1823,7 +1824,7 @@ static int its_alloc_tables(struct its_node *its)
 
 static int its_alloc_collections(struct its_node *its)
 {
-        its->collections = kzalloc(nr_cpu_ids * sizeof(*its->collections),
+        its->collections = kcalloc(nr_cpu_ids, sizeof(*its->collections),
                                    GFP_KERNEL);
         if (!its->collections)
                 return -ENOMEM;
@@ -2124,10 +2125,10 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         if (alloc_lpis) {
                 lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
                 if (lpi_map)
-                        col_map = kzalloc(sizeof(*col_map) * nr_lpis,
+                        col_map = kcalloc(nr_lpis, sizeof(*col_map),
                                           GFP_KERNEL);
         } else {
-                col_map = kzalloc(sizeof(*col_map) * nr_ites, GFP_KERNEL);
+                col_map = kcalloc(nr_ites, sizeof(*col_map), GFP_KERNEL);
                 nr_lpis = 0;
                 lpi_base = 0;
         }
@@ -3183,7 +3184,7 @@ static int its_init_vpe_domain(void)
         its = list_first_entry(&its_nodes, struct its_node, entry);
 
         entries = roundup_pow_of_two(nr_cpu_ids);
-        vpe_proxy.vpes = kzalloc(sizeof(*vpe_proxy.vpes) * entries,
+        vpe_proxy.vpes = kcalloc(entries, sizeof(*vpe_proxy.vpes),
                                  GFP_KERNEL);
         if (!vpe_proxy.vpes) {
                 pr_err("ITS: Can't allocate GICv4 proxy device array\n");
@@ -3567,8 +3568,8 @@ static void __init acpi_table_parse_srat_its(void)
         if (count <= 0)
                 return;
 
-        its_srat_maps = kmalloc(count * sizeof(struct its_srat_map),
-                                GFP_KERNEL);
+        its_srat_maps = kmalloc_array(count, sizeof(struct its_srat_map),
+                                      GFP_KERNEL);
         if (!its_srat_maps) {
                 pr_warn("SRAT: Failed to allocate memory for its_srat_maps!\n");
                 return;
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 5a67ec084588..76ea56d779a1 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -1167,7 +1167,7 @@ static void __init gic_populate_ppi_partitions(struct device_node *gic_node)
         if (!nr_parts)
                 goto out_put_node;
 
-        parts = kzalloc(sizeof(*parts) * nr_parts, GFP_KERNEL);
+        parts = kcalloc(nr_parts, sizeof(*parts), GFP_KERNEL);
         if (WARN_ON(!parts))
                 goto out_put_node;
 
@@ -1289,7 +1289,8 @@ static int __init gic_of_init(struct device_node *node, struct device_node *pare
         if (of_property_read_u32(node, "#redistributor-regions", &nr_redist_regions))
                 nr_redist_regions = 1;
 
-        rdist_regs = kzalloc(sizeof(*rdist_regs) * nr_redist_regions, GFP_KERNEL);
+        rdist_regs = kcalloc(nr_redist_regions, sizeof(*rdist_regs),
+                             GFP_KERNEL);
         if (!rdist_regs) {
                 err = -ENOMEM;
                 goto out_unmap_dist;
diff --git a/drivers/irqchip/irq-imgpdc.c b/drivers/irqchip/irq-imgpdc.c
index e80263e16c4c..d00489a4b54f 100644
--- a/drivers/irqchip/irq-imgpdc.c
+++ b/drivers/irqchip/irq-imgpdc.c
@@ -354,7 +354,7 @@ static int pdc_intc_probe(struct platform_device *pdev)
         priv->nr_syswakes = val;
 
         /* Get peripheral IRQ numbers */
-        priv->perip_irqs = devm_kzalloc(&pdev->dev, 4 * priv->nr_perips,
+        priv->perip_irqs = devm_kcalloc(&pdev->dev, 4, priv->nr_perips,
                                         GFP_KERNEL);
         if (!priv->perip_irqs) {
                 dev_err(&pdev->dev, "cannot allocate perip IRQ list\n");
diff --git a/drivers/irqchip/irq-mvebu-gicp.c b/drivers/irqchip/irq-mvebu-gicp.c
index 4e17f7081efc..3be5c5dba1da 100644
--- a/drivers/irqchip/irq-mvebu-gicp.c
+++ b/drivers/irqchip/irq-mvebu-gicp.c
@@ -191,8 +191,8 @@ static int mvebu_gicp_probe(struct platform_device *pdev)
         gicp->spi_ranges_cnt = ret / 2;
 
         gicp->spi_ranges =
-                devm_kzalloc(&pdev->dev,
-                             gicp->spi_ranges_cnt *
+                devm_kcalloc(&pdev->dev,
+                             gicp->spi_ranges_cnt,
                              sizeof(struct mvebu_gicp_spi_range),
                              GFP_KERNEL);
         if (!gicp->spi_ranges)
@@ -210,8 +210,8 @@ static int mvebu_gicp_probe(struct platform_device *pdev)
                 gicp->spi_cnt += gicp->spi_ranges[i].count;
         }
 
-        gicp->spi_bitmap = devm_kzalloc(&pdev->dev,
-                                BITS_TO_LONGS(gicp->spi_cnt) * sizeof(long),
+        gicp->spi_bitmap = devm_kcalloc(&pdev->dev,
+                                BITS_TO_LONGS(gicp->spi_cnt), sizeof(long),
                                 GFP_KERNEL);
         if (!gicp->spi_bitmap)
                 return -ENOMEM;
diff --git a/drivers/irqchip/irq-partition-percpu.c b/drivers/irqchip/irq-partition-percpu.c
index ccd72c2cbc23..1f7cc5933cd5 100644
--- a/drivers/irqchip/irq-partition-percpu.c
+++ b/drivers/irqchip/irq-partition-percpu.c
@@ -229,7 +229,7 @@ struct partition_desc *partition_create_desc(struct fwnode_handle *fwnode,
                 goto out;
         desc->domain = d;
 
-        desc->bitmap = kzalloc(sizeof(long) * BITS_TO_LONGS(nr_parts),
+        desc->bitmap = kcalloc(BITS_TO_LONGS(nr_parts), sizeof(long),
                                GFP_KERNEL);
         if (WARN_ON(!desc->bitmap))
                 goto out;
diff --git a/drivers/irqchip/irq-s3c24xx.c b/drivers/irqchip/irq-s3c24xx.c
index ec0e6a8cdb75..f6fd57ebe6e6 100644
--- a/drivers/irqchip/irq-s3c24xx.c
+++ b/drivers/irqchip/irq-s3c24xx.c
@@ -1261,7 +1261,7 @@ static int __init s3c_init_intc_of(struct device_node *np,
                         return -ENOMEM;
 
                 intc->domain = domain;
-                intc->irqs = kzalloc(sizeof(struct s3c_irq_data) * 32,
+                intc->irqs = kcalloc(32, sizeof(struct s3c_irq_data),
                                      GFP_KERNEL);
                 if (!intc->irqs) {
                         kfree(intc);
diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index baa1ee2bc2ac..6e0c2814d032 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -1260,7 +1260,7 @@ static int __init capinc_tty_init(void)
         if (capi_ttyminors <= 0)
                 capi_ttyminors = CAPINC_NR_PORTS;
 
-        capiminors = kzalloc(sizeof(struct capiminor *) * capi_ttyminors,
+        capiminors = kcalloc(capi_ttyminors, sizeof(struct capiminor *),
                              GFP_KERNEL);
         if (!capiminors)
                 return -ENOMEM;
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index 7ac51798949d..ee510f901720 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -2268,7 +2268,8 @@ static int capidrv_addcontr(u16 contr, struct capi_profile *profp)
         strcpy(card->name, id);
         card->contrnr = contr;
         card->nbchan = profp->nbchannel;
-        card->bchans = kmalloc(sizeof(capidrv_bchan) * card->nbchan, GFP_ATOMIC);
+        card->bchans = kmalloc_array(card->nbchan, sizeof(capidrv_bchan),
+                                     GFP_ATOMIC);
         if (!card->bchans) {
                 printk(KERN_WARNING
                        "capidrv: (%s) Could not allocate bchan-structs.\n", id);
diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index 56748af78c04..9cb2ab57fa4a 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -252,7 +252,7 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
                 return;
         if (l > 64)
                 l = 64; /* arbitrary limit */
-        dbgline = kmalloc(3 * l, GFP_ATOMIC);
+        dbgline = kmalloc_array(3, l, GFP_ATOMIC);
         if (!dbgline)
                 return;
         for (i = 0; i < l; i++) {
@@ -272,7 +272,7 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
                         return;
                 if (l > 64)
                         l = 64; /* arbitrary limit */
-                dbgline = kmalloc(3 * l, GFP_ATOMIC);
+                dbgline = kmalloc_array(3, l, GFP_ATOMIC);
                 if (!dbgline)
                         return;
                 data += CAPIMSG_LEN(data);
@@ -1370,7 +1370,7 @@ static void do_connect_req(struct gigaset_capi_ctr *iif,
         cmsg->adr.adrPLCI |= (bcs->channel + 1) << 8;
 
         /* build command table */
-        commands = kzalloc(AT_NUM * (sizeof *commands), GFP_KERNEL);
+        commands = kcalloc(AT_NUM, sizeof(*commands), GFP_KERNEL);
         if (!commands)
                 goto oom;
 
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 15482c5de33c..76b5407b5277 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -710,7 +710,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
         cs->mode = M_UNKNOWN;
         cs->mstate = MS_UNINITIALIZED;
 
-        cs->bcs = kmalloc(channels * sizeof(struct bc_state), GFP_KERNEL);
+        cs->bcs = kmalloc_array(channels, sizeof(struct bc_state), GFP_KERNEL);
         cs->inbuf = kmalloc(sizeof(struct inbuf_t), GFP_KERNEL);
         if (!cs->bcs || !cs->inbuf) {
                 pr_err("out of memory\n");
@@ -1089,7 +1089,7 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
         drv->owner = owner;
         INIT_LIST_HEAD(&drv->list);
 
-        drv->cs = kmalloc(minors * sizeof *drv->cs, GFP_KERNEL);
+        drv->cs = kmalloc_array(minors, sizeof(*drv->cs), GFP_KERNEL);
         if (!drv->cs)
                 goto error;
 
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index 2d75329007f1..b5b389e95edd 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -243,7 +243,7 @@ static int command_from_LL(isdn_ctrl *cntrl)
                 dev_kfree_skb(bcs->rx_skb);
                 gigaset_new_rx_skb(bcs);
 
-                commands = kzalloc(AT_NUM * (sizeof *commands), GFP_ATOMIC);
+                commands = kcalloc(AT_NUM, sizeof(*commands), GFP_ATOMIC);
                 if (!commands) {
                         gigaset_free_channel(bcs);
                         dev_err(cs->dev, "ISDN_CMD_DIAL: out of memory\n");
diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
index 5ee5489d3f15..4ac378e48902 100644
--- a/drivers/isdn/hardware/avm/b1.c
+++ b/drivers/isdn/hardware/avm/b1.c
@@ -72,7 +72,7 @@ avmcard *b1_alloc_card(int nr_controllers)
         if (!card)
                 return NULL;
 
-        cinfo = kzalloc(sizeof(*cinfo) * nr_controllers, GFP_KERNEL);
+        cinfo = kcalloc(nr_controllers, sizeof(*cinfo), GFP_KERNEL);
         if (!cinfo) {
                 kfree(card);
                 return NULL;
diff --git a/drivers/isdn/hisax/fsm.c b/drivers/isdn/hisax/fsm.c
index 3e020ec0f65e..80ba82f77c63 100644
--- a/drivers/isdn/hisax/fsm.c
+++ b/drivers/isdn/hisax/fsm.c
@@ -27,7 +27,9 @@ FsmNew(struct Fsm *fsm, struct FsmNode *fnlist, int fncount)
         int i;
 
         fsm->jumpmatrix =
-                kzalloc(sizeof(FSMFNPTR) * fsm->state_count * fsm->event_count, GFP_KERNEL);
+                kzalloc(array3_size(sizeof(FSMFNPTR), fsm->state_count,
+                                    fsm->event_count),
+                        GFP_KERNEL);
         if (!fsm->jumpmatrix)
                 return -ENOMEM;
 
diff --git a/drivers/isdn/hisax/hfc_2bds0.c b/drivers/isdn/hisax/hfc_2bds0.c
index 86b82172e992..3715fa0343db 100644
--- a/drivers/isdn/hisax/hfc_2bds0.c
+++ b/drivers/isdn/hisax/hfc_2bds0.c
@@ -1024,7 +1024,7 @@ static unsigned int
         int i;
         unsigned *send;
 
-        if (!(send = kmalloc(cnt * sizeof(unsigned int), GFP_ATOMIC))) {
+        if (!(send = kmalloc_array(cnt, sizeof(unsigned int), GFP_ATOMIC))) {
                 printk(KERN_WARNING
                        "HiSax: No memory for hfcd.send\n");
                 return (NULL);
diff --git a/drivers/isdn/hisax/hfc_2bs0.c b/drivers/isdn/hisax/hfc_2bs0.c
index 14dada42874e..34d59992839a 100644
--- a/drivers/isdn/hisax/hfc_2bs0.c
+++ b/drivers/isdn/hisax/hfc_2bs0.c
@@ -557,7 +557,8 @@ init_send(struct BCState *bcs)
 {
         int i;
 
-        if (!(bcs->hw.hfc.send = kmalloc(32 * sizeof(unsigned int), GFP_ATOMIC))) {
+        bcs->hw.hfc.send = kmalloc_array(32, sizeof(unsigned int), GFP_ATOMIC);
+        if (!bcs->hw.hfc.send) {
                 printk(KERN_WARNING
                        "HiSax: No memory for hfc.send\n");
                 return;
diff --git a/drivers/isdn/hisax/netjet.c b/drivers/isdn/hisax/netjet.c
index b7f54fa29228..e932a152c405 100644
--- a/drivers/isdn/hisax/netjet.c
+++ b/drivers/isdn/hisax/netjet.c
@@ -912,8 +912,10 @@ setstack_tiger(struct PStack *st, struct BCState *bcs)
 void
 inittiger(struct IsdnCardState *cs)
 {
-        if (!(cs->bcs[0].hw.tiger.send = kmalloc(NETJET_DMA_TXSIZE * sizeof(unsigned int),
-                                                 GFP_KERNEL | GFP_DMA))) {
+        cs->bcs[0].hw.tiger.send = kmalloc_array(NETJET_DMA_TXSIZE,
+                                                 sizeof(unsigned int),
+                                                 GFP_KERNEL | GFP_DMA);
+        if (!cs->bcs[0].hw.tiger.send) {
                 printk(KERN_WARNING
                        "HiSax: No memory for tiger.send\n");
                 return;
@@ -933,8 +935,10 @@ inittiger(struct IsdnCardState *cs)
              cs->hw.njet.base + NETJET_DMA_READ_IRQ);
         outl(virt_to_bus(cs->bcs[0].hw.tiger.s_end),
              cs->hw.njet.base + NETJET_DMA_READ_END);
-        if (!(cs->bcs[0].hw.tiger.rec = kmalloc(NETJET_DMA_RXSIZE * sizeof(unsigned int),
-                                                GFP_KERNEL | GFP_DMA))) {
+        cs->bcs[0].hw.tiger.rec = kmalloc_array(NETJET_DMA_RXSIZE,
+                                                sizeof(unsigned int),
+                                                GFP_KERNEL | GFP_DMA);
+        if (!cs->bcs[0].hw.tiger.rec) {
                 printk(KERN_WARNING
                        "HiSax: No memory for tiger.rec\n");
                 return;
diff --git a/drivers/isdn/i4l/isdn_bsdcomp.c b/drivers/isdn/i4l/isdn_bsdcomp.c
index 99012c047751..7f28b967ed19 100644
--- a/drivers/isdn/i4l/isdn_bsdcomp.c
+++ b/drivers/isdn/i4l/isdn_bsdcomp.c
@@ -340,7 +340,7 @@ static void *bsd_alloc(struct isdn_ppp_comp_data *data)
          * Allocate space for the dictionary. This may be more than one page in
          * length.
          */
-        db->dict = vmalloc(hsize * sizeof(struct bsd_dict));
+        db->dict = vmalloc(array_size(hsize, sizeof(struct bsd_dict)));
         if (!db->dict) {
                 bsd_free(db);
                 return NULL;
@@ -353,7 +353,8 @@ static void *bsd_alloc(struct isdn_ppp_comp_data *data)
         if (!decomp)
                 db->lens = NULL;
         else {
-                db->lens = vmalloc((maxmaxcode + 1) * sizeof(db->lens[0]));
+                db->lens = vmalloc(array_size(sizeof(db->lens[0]),
+                                              maxmaxcode + 1));
                 if (!db->lens) {
                         bsd_free(db);
                         return (NULL);
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 7c6f3f5d9d9a..7a501dbe7123 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -2070,14 +2070,14 @@ isdn_add_channels(isdn_driver_t *d, int drvidx, int n, int adding)
 
         if ((adding) && (d->rcverr))
                 kfree(d->rcverr);
-        if (!(d->rcverr = kzalloc(sizeof(int) * m, GFP_ATOMIC))) {
+        if (!(d->rcverr = kcalloc(m, sizeof(int), GFP_ATOMIC))) {
                 printk(KERN_WARNING "register_isdn: Could not alloc rcverr\n");
                 return -1;
         }
 
         if ((adding) && (d->rcvcount))
                 kfree(d->rcvcount);
-        if (!(d->rcvcount = kzalloc(sizeof(int) * m, GFP_ATOMIC))) {
+        if (!(d->rcvcount = kcalloc(m, sizeof(int), GFP_ATOMIC))) {
                 printk(KERN_WARNING "register_isdn: Could not alloc rcvcount\n");
                 if (!adding)
                         kfree(d->rcverr);
@@ -2089,7 +2089,8 @@ isdn_add_channels(isdn_driver_t *d, int drvidx, int n, int adding)
                         skb_queue_purge(&d->rpqueue[j]);
                 kfree(d->rpqueue);
         }
-        if (!(d->rpqueue = kmalloc(sizeof(struct sk_buff_head) * m, GFP_ATOMIC))) {
+        d->rpqueue = kmalloc_array(m, sizeof(struct sk_buff_head), GFP_ATOMIC);
+        if (!d->rpqueue) {
                 printk(KERN_WARNING "register_isdn: Could not alloc rpqueue\n");
                 if (!adding) {
                         kfree(d->rcvcount);
@@ -2103,7 +2104,8 @@ isdn_add_channels(isdn_driver_t *d, int drvidx, int n, int adding)
 
         if ((adding) && (d->rcv_waitq))
                 kfree(d->rcv_waitq);
-        d->rcv_waitq = kmalloc(sizeof(wait_queue_head_t) * 2 * m, GFP_ATOMIC);
+        d->rcv_waitq = kmalloc(array3_size(sizeof(wait_queue_head_t), 2, m),
+                               GFP_ATOMIC);
         if (!d->rcv_waitq) {
                 printk(KERN_WARNING "register_isdn: Could not alloc rcv_waitq\n");
                 if (!adding) {
diff --git a/drivers/isdn/mISDN/fsm.c b/drivers/isdn/mISDN/fsm.c
index cabcb906e0b5..9a8d08d677a4 100644
--- a/drivers/isdn/mISDN/fsm.c
+++ b/drivers/isdn/mISDN/fsm.c
@@ -32,8 +32,10 @@ mISDN_FsmNew(struct Fsm *fsm,
 {
         int i;
 
-        fsm->jumpmatrix = kzalloc(sizeof(FSMFNPTR) * fsm->state_count *
-                                  fsm->event_count, GFP_KERNEL);
+        fsm->jumpmatrix =
+                kzalloc(array3_size(sizeof(FSMFNPTR), fsm->state_count,
+                                    fsm->event_count),
+                        GFP_KERNEL);
         if (fsm->jumpmatrix == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/leds/leds-adp5520.c b/drivers/leds/leds-adp5520.c
index 853b2d3bdb17..7ecf080f73ad 100644
--- a/drivers/leds/leds-adp5520.c
+++ b/drivers/leds/leds-adp5520.c
@@ -108,7 +108,7 @@ static int adp5520_led_probe(struct platform_device *pdev)
                 return -EFAULT;
         }
 
-        led = devm_kzalloc(&pdev->dev, sizeof(*led) * pdata->num_leds,
+        led = devm_kcalloc(&pdev->dev, pdata->num_leds, sizeof(*led),
                                 GFP_KERNEL);
         if (!led)
                 return -ENOMEM;
diff --git a/drivers/leds/leds-apu.c b/drivers/leds/leds-apu.c
index 90eeedcbf371..8c93d68964c7 100644
--- a/drivers/leds/leds-apu.c
+++ b/drivers/leds/leds-apu.c
@@ -171,8 +171,8 @@ static int apu_led_config(struct device *dev, struct apu_led_pdata *apuld)
         int i;
         int err;
 
-        apu_led->pled = devm_kzalloc(dev,
-                sizeof(struct apu_led_priv) * apu_led->num_led_instances,
+        apu_led->pled = devm_kcalloc(dev,
+                apu_led->num_led_instances, sizeof(struct apu_led_priv),
                 GFP_KERNEL);
 
         if (!apu_led->pled)
diff --git a/drivers/leds/leds-cr0014114.c b/drivers/leds/leds-cr0014114.c
index a4b1c1dcce7f..0e4262462cb9 100644
--- a/drivers/leds/leds-cr0014114.c
+++ b/drivers/leds/leds-cr0014114.c
@@ -237,8 +237,7 @@ static int cr0014114_probe(struct spi_device *spi)
                 return -ENODEV;
         }
 
-        priv = devm_kzalloc(&spi->dev,
-                            sizeof(*priv) + sizeof(*priv->leds) * count,
+        priv = devm_kzalloc(&spi->dev, struct_size(priv, leds, count),
                             GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
diff --git a/drivers/leds/leds-da9052.c b/drivers/leds/leds-da9052.c
index f8c7d82c2652..31d4c94e6fd8 100644
--- a/drivers/leds/leds-da9052.c
+++ b/drivers/leds/leds-da9052.c
@@ -113,8 +113,8 @@ static int da9052_led_probe(struct platform_device *pdev)
                 goto err;
         }
 
-        led = devm_kzalloc(&pdev->dev,
-                           sizeof(struct da9052_led) * pled->num_leds,
+        led = devm_kcalloc(&pdev->dev,
+                           pled->num_leds, sizeof(struct da9052_led),
                            GFP_KERNEL);
         if (!led) {
                 error = -ENOMEM;
diff --git a/drivers/leds/leds-lp5521.c b/drivers/leds/leds-lp5521.c
index 55c0517fbe03..99689b51a73d 100644
--- a/drivers/leds/leds-lp5521.c
+++ b/drivers/leds/leds-lp5521.c
@@ -533,8 +533,8 @@ static int lp5521_probe(struct i2c_client *client,
         if (!chip)
                 return -ENOMEM;
 
-        led = devm_kzalloc(&client->dev,
-                        sizeof(*led) * pdata->num_channels, GFP_KERNEL);
+        led = devm_kcalloc(&client->dev,
+                        pdata->num_channels, sizeof(*led), GFP_KERNEL);
         if (!led)
                 return -ENOMEM;
 
diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
index 52b6f529e278..a2e74feee2b2 100644
--- a/drivers/leds/leds-lp5523.c
+++ b/drivers/leds/leds-lp5523.c
@@ -898,8 +898,8 @@ static int lp5523_probe(struct i2c_client *client,
         if (!chip)
                 return -ENOMEM;
 
-        led = devm_kzalloc(&client->dev,
-                        sizeof(*led) * pdata->num_channels, GFP_KERNEL);
+        led = devm_kcalloc(&client->dev,
+                        pdata->num_channels, sizeof(*led), GFP_KERNEL);
         if (!led)
                 return -ENOMEM;
 
diff --git a/drivers/leds/leds-lp5562.c b/drivers/leds/leds-lp5562.c
index 05ffa34fb6ad..2a9009fe5545 100644
--- a/drivers/leds/leds-lp5562.c
+++ b/drivers/leds/leds-lp5562.c
@@ -534,8 +534,8 @@ static int lp5562_probe(struct i2c_client *client,
         if (!chip)
                 return -ENOMEM;
 
-        led = devm_kzalloc(&client->dev,
-                        sizeof(*led) * pdata->num_channels, GFP_KERNEL);
+        led = devm_kcalloc(&client->dev,
+                        pdata->num_channels, sizeof(*led), GFP_KERNEL);
         if (!led)
                 return -ENOMEM;
 
diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c
index 5377f22ff994..3d79a6380761 100644
--- a/drivers/leds/leds-lp55xx-common.c
+++ b/drivers/leds/leds-lp55xx-common.c
@@ -560,7 +560,7 @@ struct lp55xx_platform_data *lp55xx_of_populate_pdata(struct device *dev,
                 return ERR_PTR(-EINVAL);
         }
 
-        cfg = devm_kzalloc(dev, sizeof(*cfg) * num_channels, GFP_KERNEL);
+        cfg = devm_kcalloc(dev, num_channels, sizeof(*cfg), GFP_KERNEL);
         if (!cfg)
                 return ERR_PTR(-ENOMEM);
 
diff --git a/drivers/leds/leds-lp8501.c b/drivers/leds/leds-lp8501.c
index 3adb113cf02e..4c800b5989a9 100644
--- a/drivers/leds/leds-lp8501.c
+++ b/drivers/leds/leds-lp8501.c
@@ -327,8 +327,8 @@ static int lp8501_probe(struct i2c_client *client,
         if (!chip)
                 return -ENOMEM;
 
-        led = devm_kzalloc(&client->dev,
-                        sizeof(*led) * pdata->num_channels, GFP_KERNEL);
+        led = devm_kcalloc(&client->dev,
+                        pdata->num_channels, sizeof(*led), GFP_KERNEL);
         if (!led)
                 return -ENOMEM;
 
diff --git a/drivers/leds/leds-lt3593.c b/drivers/leds/leds-lt3593.c
index a7ff510cbdd0..5ec730a31b65 100644
--- a/drivers/leds/leds-lt3593.c
+++ b/drivers/leds/leds-lt3593.c
@@ -128,8 +128,8 @@ static int lt3593_led_probe(struct platform_device *pdev)
         if (!pdata)
                 return -EBUSY;
 
-        leds_data = devm_kzalloc(&pdev->dev,
-                        sizeof(struct lt3593_led_data) * pdata->num_leds,
+        leds_data = devm_kcalloc(&pdev->dev,
+                        pdata->num_leds, sizeof(struct lt3593_led_data),
                         GFP_KERNEL);
         if (!leds_data)
                 return -ENOMEM;
diff --git a/drivers/leds/leds-mc13783.c b/drivers/leds/leds-mc13783.c
index 2421cf104991..47ad7de9553c 100644
--- a/drivers/leds/leds-mc13783.c
+++ b/drivers/leds/leds-mc13783.c
@@ -136,7 +136,7 @@ static struct mc13xxx_leds_platform_data __init *mc13xxx_led_probe_dt(
 
         pdata->num_leds = of_get_child_count(parent);
 
-        pdata->led = devm_kzalloc(dev, pdata->num_leds * sizeof(*pdata->led),
+        pdata->led = devm_kcalloc(dev, pdata->num_leds, sizeof(*pdata->led),
                                   GFP_KERNEL);
         if (!pdata->led) {
                 ret = -ENOMEM;
@@ -210,7 +210,7 @@ static int __init mc13xxx_led_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        leds->led = devm_kzalloc(dev, leds->num_leds * sizeof(*leds->led),
+        leds->led = devm_kcalloc(dev, leds->num_leds, sizeof(*leds->led),
                                  GFP_KERNEL);
         if (!leds->led)
                 return -ENOMEM;
diff --git a/drivers/leds/leds-mlxcpld.c b/drivers/leds/leds-mlxcpld.c
index 281482e1d50f..f4721f8065f0 100644
--- a/drivers/leds/leds-mlxcpld.c
+++ b/drivers/leds/leds-mlxcpld.c
@@ -329,8 +329,10 @@ static int mlxcpld_led_config(struct device *dev,
         int i;
         int err;
 
-        cpld->pled = devm_kzalloc(dev, sizeof(struct mlxcpld_led_priv) *
-                                  cpld->num_led_instances, GFP_KERNEL);
+        cpld->pled = devm_kcalloc(dev,
+                                  cpld->num_led_instances,
+                                  sizeof(struct mlxcpld_led_priv),
+                                  GFP_KERNEL);
         if (!cpld->pled)
                 return -ENOMEM;
 
diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
index f48b1aed9b4e..62fa0de526ee 100644
--- a/drivers/leds/leds-netxbig.c
+++ b/drivers/leds/leds-netxbig.c
@@ -335,7 +335,7 @@ static int gpio_ext_get_of_pdata(struct device *dev, struct device_node *np,
                 return ret;
         }
         num_addr = ret;
-        addr = devm_kzalloc(dev, num_addr * sizeof(*addr), GFP_KERNEL);
+        addr = devm_kcalloc(dev, num_addr, sizeof(*addr), GFP_KERNEL);
         if (!addr)
                 return -ENOMEM;
 
@@ -355,7 +355,7 @@ static int gpio_ext_get_of_pdata(struct device *dev, struct device_node *np,
                 return ret;
         }
         num_data = ret;
-        data = devm_kzalloc(dev, num_data * sizeof(*data), GFP_KERNEL);
+        data = devm_kcalloc(dev, num_data, sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
@@ -415,7 +415,7 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
                 if (ret % 3)
                         return -EINVAL;
                 num_timers = ret / 3;
-                timers = devm_kzalloc(dev, num_timers * sizeof(*timers),
+                timers = devm_kcalloc(dev, num_timers, sizeof(*timers),
                                       GFP_KERNEL);
                 if (!timers)
                         return -ENOMEM;
@@ -444,7 +444,7 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
                 return -ENODEV;
         }
 
-        leds = devm_kzalloc(dev, num_leds * sizeof(*leds), GFP_KERNEL);
+        leds = devm_kcalloc(dev, num_leds, sizeof(*leds), GFP_KERNEL);
         if (!leds)
                 return -ENOMEM;
 
@@ -470,8 +470,8 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
                         goto err_node_put;
 
                 mode_val =
-                        devm_kzalloc(dev,
-                                     NETXBIG_LED_MODE_NUM * sizeof(*mode_val),
+                        devm_kcalloc(dev,
+                                     NETXBIG_LED_MODE_NUM, sizeof(*mode_val),
                                      GFP_KERNEL);
                 if (!mode_val) {
                         ret = -ENOMEM;
@@ -560,8 +560,8 @@ static int netxbig_led_probe(struct platform_device *pdev)
                         return ret;
         }
 
-        leds_data = devm_kzalloc(&pdev->dev,
-                                 pdata->num_leds * sizeof(*leds_data),
+        leds_data = devm_kcalloc(&pdev->dev,
+                                 pdata->num_leds, sizeof(*leds_data),
                                  GFP_KERNEL);
         if (!leds_data)
                 return -ENOMEM;
diff --git a/drivers/leds/leds-ns2.c b/drivers/leds/leds-ns2.c
index 506b75b190e7..14fe5cd43232 100644
--- a/drivers/leds/leds-ns2.c
+++ b/drivers/leds/leds-ns2.c
@@ -264,7 +264,7 @@ ns2_leds_get_of_pdata(struct device *dev, struct ns2_led_platform_data *pdata)
         if (!num_leds)
                 return -ENODEV;
 
-        leds = devm_kzalloc(dev, num_leds * sizeof(struct ns2_led),
+        leds = devm_kcalloc(dev, num_leds, sizeof(struct ns2_led),
                             GFP_KERNEL);
         if (!leds)
                 return -ENOMEM;
@@ -298,8 +298,9 @@ ns2_leds_get_of_pdata(struct device *dev, struct ns2_led_platform_data *pdata)
                 }
 
                 num_modes = ret / 3;
-                modval = devm_kzalloc(dev,
-                                      num_modes * sizeof(struct ns2_led_modval),
+                modval = devm_kcalloc(dev,
+                                      num_modes,
+                                      sizeof(struct ns2_led_modval),
                                       GFP_KERNEL);
                 if (!modval)
                         return -ENOMEM;
diff --git a/drivers/leds/leds-pca955x.c b/drivers/leds/leds-pca955x.c
index 78183f90820e..f51b356d4426 100644
--- a/drivers/leds/leds-pca955x.c
+++ b/drivers/leds/leds-pca955x.c
@@ -390,8 +390,8 @@ pca955x_pdata_of_init(struct i2c_client *client, struct pca955x_chipdef *chip)
         if (!pdata)
                 return ERR_PTR(-ENOMEM);
 
-        pdata->leds = devm_kzalloc(&client->dev,
-                                   sizeof(struct pca955x_led) * chip->bits,
+        pdata->leds = devm_kcalloc(&client->dev,
+                                   chip->bits, sizeof(struct pca955x_led),
                                    GFP_KERNEL);
         if (!pdata->leds)
                 return ERR_PTR(-ENOMEM);
@@ -494,8 +494,8 @@ static int pca955x_probe(struct i2c_client *client,
         if (!pca955x)
                 return -ENOMEM;
 
-        pca955x->leds = devm_kzalloc(&client->dev,
-                        sizeof(*pca955x_led) * chip->bits, GFP_KERNEL);
+        pca955x->leds = devm_kcalloc(&client->dev,
+                        chip->bits, sizeof(*pca955x_led), GFP_KERNEL);
         if (!pca955x->leds)
                 return -ENOMEM;
 
diff --git a/drivers/leds/leds-pca963x.c b/drivers/leds/leds-pca963x.c
index 3bf9a1271819..5c0908113e38 100644
--- a/drivers/leds/leds-pca963x.c
+++ b/drivers/leds/leds-pca963x.c
@@ -300,8 +300,8 @@ pca963x_dt_init(struct i2c_client *client, struct pca963x_chipdef *chip)
         if (!count || count > chip->n_leds)
                 return ERR_PTR(-ENODEV);
 
-        pca963x_leds = devm_kzalloc(&client->dev,
-                        sizeof(struct led_info) * chip->n_leds, GFP_KERNEL);
+        pca963x_leds = devm_kcalloc(&client->dev,
+                        chip->n_leds, sizeof(struct led_info), GFP_KERNEL);
         if (!pca963x_leds)
                 return ERR_PTR(-ENOMEM);
 
@@ -407,7 +407,7 @@ static int pca963x_probe(struct i2c_client *client,
                                                                 GFP_KERNEL);
         if (!pca963x_chip)
                 return -ENOMEM;
-        pca963x = devm_kzalloc(&client->dev, chip->n_leds * sizeof(*pca963x),
+        pca963x = devm_kcalloc(&client->dev, chip->n_leds, sizeof(*pca963x),
                                                                 GFP_KERNEL);
         if (!pca963x)
                 return -ENOMEM;
diff --git a/drivers/leds/leds-tca6507.c b/drivers/leds/leds-tca6507.c
index c12c16fb1b9c..8f343afa4787 100644
--- a/drivers/leds/leds-tca6507.c
+++ b/drivers/leds/leds-tca6507.c
@@ -697,8 +697,8 @@ tca6507_led_dt_init(struct i2c_client *client)
         if (!count || count > NUM_LEDS)
                 return ERR_PTR(-ENODEV);
 
-        tca_leds = devm_kzalloc(&client->dev,
-                        sizeof(struct led_info) * NUM_LEDS, GFP_KERNEL);
+        tca_leds = devm_kcalloc(&client->dev,
+                        NUM_LEDS, sizeof(struct led_info), GFP_KERNEL);
         if (!tca_leds)
                 return ERR_PTR(-ENOMEM);
 
diff --git a/drivers/lightnvm/pblk-gc.c b/drivers/lightnvm/pblk-gc.c
index 6a4883e40cc0..080469d90b40 100644
--- a/drivers/lightnvm/pblk-gc.c
+++ b/drivers/lightnvm/pblk-gc.c
@@ -88,7 +88,7 @@ static void pblk_gc_line_ws(struct work_struct *work)
 
         up(&gc->gc_sem);
 
-        gc_rq->data = vmalloc(gc_rq->nr_secs * geo->csecs);
+        gc_rq->data = vmalloc(array_size(gc_rq->nr_secs, geo->csecs));
         if (!gc_rq->data) {
                 pr_err("pblk: could not GC line:%d (%d/%d)\n",
                                         line->id, *line->vsc, gc_rq->nr_secs);
diff --git a/drivers/lightnvm/pblk-init.c b/drivers/lightnvm/pblk-init.c
index 491df0fa0835..b57f764d6a16 100644
--- a/drivers/lightnvm/pblk-init.c
+++ b/drivers/lightnvm/pblk-init.c
@@ -187,7 +187,7 @@ static int pblk_rwb_init(struct pblk *pblk)
 
         nr_entries = pblk_rb_calculate_size(buffer_size);
 
-        entries = vzalloc(nr_entries * sizeof(struct pblk_rb_entry));
+        entries = vzalloc(array_size(nr_entries, sizeof(struct pblk_rb_entry)));
         if (!entries)
                 return -ENOMEM;
 
@@ -379,7 +379,7 @@ static int pblk_core_init(struct pblk *pblk)
                 return -EINVAL;
         }
 
-        pblk->pad_dist = kzalloc((pblk->min_write_pgs - 1) * sizeof(atomic64_t),
+        pblk->pad_dist = kcalloc(pblk->min_write_pgs - 1, sizeof(atomic64_t),
                                                                 GFP_KERNEL);
         if (!pblk->pad_dist)
                 return -ENOMEM;
@@ -833,8 +833,8 @@ static int pblk_alloc_line_meta(struct pblk *pblk, struct pblk_line *line)
                 goto free_blk_bitmap;
 
 
-        line->chks = kmalloc(lm->blk_per_line * sizeof(struct nvm_chk_meta),
-                                                                GFP_KERNEL);
+        line->chks = kmalloc_array(lm->blk_per_line,
+                                   sizeof(struct nvm_chk_meta), GFP_KERNEL);
         if (!line->chks)
                 goto free_erase_bitmap;
 
diff --git a/drivers/lightnvm/pblk-recovery.c b/drivers/lightnvm/pblk-recovery.c
index 598342833d0d..3a5069183859 100644
--- a/drivers/lightnvm/pblk-recovery.c
+++ b/drivers/lightnvm/pblk-recovery.c
@@ -260,7 +260,7 @@ static int pblk_recov_pad_oob(struct pblk *pblk, struct pblk_line *line,
         if (!pad_rq)
                 return -ENOMEM;
 
-        data = vzalloc(pblk->max_write_pgs * geo->csecs);
+        data = vzalloc(array_size(pblk->max_write_pgs, geo->csecs));
         if (!data) {
                 ret = -ENOMEM;
                 goto free_rq;
diff --git a/drivers/mailbox/hi6220-mailbox.c b/drivers/mailbox/hi6220-mailbox.c
index 519376d3534c..4fa9803cd204 100644
--- a/drivers/mailbox/hi6220-mailbox.c
+++ b/drivers/mailbox/hi6220-mailbox.c
@@ -282,13 +282,13 @@ static int hi6220_mbox_probe(struct platform_device *pdev)
 
         mbox->dev = dev;
         mbox->chan_num = MBOX_CHAN_MAX;
-        mbox->mchan = devm_kzalloc(dev,
-                mbox->chan_num * sizeof(*mbox->mchan), GFP_KERNEL);
+        mbox->mchan = devm_kcalloc(dev,
+                mbox->chan_num, sizeof(*mbox->mchan), GFP_KERNEL);
         if (!mbox->mchan)
                 return -ENOMEM;
 
-        mbox->chan = devm_kzalloc(dev,
-                mbox->chan_num * sizeof(*mbox->chan), GFP_KERNEL);
+        mbox->chan = devm_kcalloc(dev,
+                mbox->chan_num, sizeof(*mbox->chan), GFP_KERNEL);
         if (!mbox->chan)
                 return -ENOMEM;
 
diff --git a/drivers/mailbox/mailbox-sti.c b/drivers/mailbox/mailbox-sti.c
index 41bcd339b68a..779d41262ef0 100644
--- a/drivers/mailbox/mailbox-sti.c
+++ b/drivers/mailbox/mailbox-sti.c
@@ -442,8 +442,8 @@ static int sti_mbox_probe(struct platform_device *pdev)
         if (!mbox)
                 return -ENOMEM;
 
-        chans = devm_kzalloc(&pdev->dev,
-                             sizeof(*chans) * STI_MBOX_CHAN_MAX, GFP_KERNEL);
+        chans = devm_kcalloc(&pdev->dev,
+                             STI_MBOX_CHAN_MAX, sizeof(*chans), GFP_KERNEL);
         if (!chans)
                 return -ENOMEM;
 
diff --git a/drivers/mailbox/omap-mailbox.c b/drivers/mailbox/omap-mailbox.c
index 2517038a8452..e1e2c085e68e 100644
--- a/drivers/mailbox/omap-mailbox.c
+++ b/drivers/mailbox/omap-mailbox.c
@@ -729,7 +729,7 @@ static int omap_mbox_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        finfoblk = devm_kzalloc(&pdev->dev, info_count * sizeof(*finfoblk),
+        finfoblk = devm_kcalloc(&pdev->dev, info_count, sizeof(*finfoblk),
                                 GFP_KERNEL);
         if (!finfoblk)
                 return -ENOMEM;
@@ -773,23 +773,23 @@ static int omap_mbox_probe(struct platform_device *pdev)
         if (IS_ERR(mdev->mbox_base))
                 return PTR_ERR(mdev->mbox_base);
 
-        mdev->irq_ctx = devm_kzalloc(&pdev->dev, num_users * sizeof(u32),
+        mdev->irq_ctx = devm_kcalloc(&pdev->dev, num_users, sizeof(u32),
                                      GFP_KERNEL);
         if (!mdev->irq_ctx)
                 return -ENOMEM;
 
         /* allocate one extra for marking end of list */
-        list = devm_kzalloc(&pdev->dev, (info_count + 1) * sizeof(*list),
+        list = devm_kcalloc(&pdev->dev, info_count + 1, sizeof(*list),
                             GFP_KERNEL);
         if (!list)
                 return -ENOMEM;
 
-        chnls = devm_kzalloc(&pdev->dev, (info_count + 1) * sizeof(*chnls),
+        chnls = devm_kcalloc(&pdev->dev, info_count + 1, sizeof(*chnls),
                              GFP_KERNEL);
         if (!chnls)
                 return -ENOMEM;
 
-        mboxblk = devm_kzalloc(&pdev->dev, info_count * sizeof(*mbox),
+        mboxblk = devm_kcalloc(&pdev->dev, info_count, sizeof(*mbox),
                                GFP_KERNEL);
         if (!mboxblk)
                 return -ENOMEM;
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index fc3c237daef2..311e91b1a14f 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -466,7 +466,8 @@ static int __init acpi_pcc_probe(void)
                 return -EINVAL;
         }
 
-        pcc_mbox_channels = kzalloc(sizeof(struct mbox_chan) * count, GFP_KERNEL);
+        pcc_mbox_channels = kcalloc(count, sizeof(struct mbox_chan),
+                                    GFP_KERNEL);
         if (!pcc_mbox_channels) {
                 pr_err("Could not allocate space for PCC mbox channels\n");
                 return -ENOMEM;
diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c
index 78753a87ba4d..5d04738c3c8a 100644
--- a/drivers/mailbox/ti-msgmgr.c
+++ b/drivers/mailbox/ti-msgmgr.c
@@ -568,12 +568,12 @@ static int ti_msgmgr_probe(struct platform_device *pdev)
         }
         inst->num_valid_queues = queue_count;
 
-        qinst = devm_kzalloc(dev, sizeof(*qinst) * queue_count, GFP_KERNEL);
+        qinst = devm_kcalloc(dev, queue_count, sizeof(*qinst), GFP_KERNEL);
         if (!qinst)
                 return -ENOMEM;
         inst->qinsts = qinst;
 
-        chans = devm_kzalloc(dev, sizeof(*chans) * queue_count, GFP_KERNEL);
+        chans = devm_kcalloc(dev, queue_count, sizeof(*chans), GFP_KERNEL);
         if (!chans)
                 return -ENOMEM;
         inst->chans = chans;
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index a31e55bcc4e5..fa4058e43202 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1715,7 +1715,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
         iter_size = (sb->bucket_size / sb->block_size + 1) *
                 sizeof(struct btree_iter_set);
 
-        if (!(c->devices = kzalloc(c->nr_uuids * sizeof(void *), GFP_KERNEL)) ||
+        if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) ||
             mempool_init_slab_pool(&c->search, 32, bch_search_cache) ||
             mempool_init_kmalloc_pool(&c->bio_meta, 2,
                                       sizeof(struct bbio) + sizeof(struct bio_vec) *
@@ -2041,10 +2041,11 @@ static int cache_alloc(struct cache *ca)
             !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
             !init_fifo(&ca->free_inc,   free << 2, GFP_KERNEL) ||
             !init_heap(&ca->heap,       free << 3, GFP_KERNEL) ||
-            !(ca->buckets       = vzalloc(sizeof(struct bucket) *
-                                          ca->sb.nbuckets)) ||
-            !(ca->prio_buckets  = kzalloc(sizeof(uint64_t) * prio_buckets(ca) *
-                                          2, GFP_KERNEL)) ||
+            !(ca->buckets       = vzalloc(array_size(sizeof(struct bucket),
+                                                     ca->sb.nbuckets))) ||
+            !(ca->prio_buckets  = kzalloc(array3_size(sizeof(uint64_t),
+                                                      prio_buckets(ca), 2),
+                                          GFP_KERNEL)) ||
             !(ca->disk_buckets  = alloc_bucket_pages(GFP_KERNEL, ca)))
                 return -ENOMEM;
 
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 8ccbc8f3b3af..225b15aa0340 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -881,7 +881,8 @@ SHOW(__bch_cache)
                 uint16_t q[31], *p, *cached;
                 ssize_t ret;
 
-                cached = p = vmalloc(ca->sb.nbuckets * sizeof(uint16_t));
+                cached = p = vmalloc(array_size(sizeof(uint16_t),
+                                                ca->sb.nbuckets));
                 if (!p)
                         return -ENOMEM;
 
diff --git a/drivers/md/dm-cache-policy-smq.c b/drivers/md/dm-cache-policy-smq.c
index 4ab23d0075f6..1b5b9ad9e492 100644
--- a/drivers/md/dm-cache-policy-smq.c
+++ b/drivers/md/dm-cache-policy-smq.c
@@ -69,7 +69,7 @@ static int space_init(struct entry_space *es, unsigned nr_entries)
                 return 0;
         }
 
-        es->begin = vzalloc(sizeof(struct entry) * nr_entries);
+        es->begin = vzalloc(array_size(nr_entries, sizeof(struct entry)));
         if (!es->begin)
                 return -ENOMEM;
 
@@ -588,7 +588,7 @@ static int h_init(struct smq_hash_table *ht, struct entry_space *es, unsigned nr
         nr_buckets = roundup_pow_of_two(max(nr_entries / 4u, 16u));
         ht->hash_bits = __ffs(nr_buckets);
 
-        ht->buckets = vmalloc(sizeof(*ht->buckets) * nr_buckets);
+        ht->buckets = vmalloc(array_size(nr_buckets, sizeof(*ht->buckets)));
         if (!ht->buckets)
                 return -ENOMEM;
 
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 4939fbc34ff2..b61b069c33af 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1878,8 +1878,9 @@ static int crypt_alloc_tfms_skcipher(struct crypt_config *cc, char *ciphermode)
         unsigned i;
         int err;
 
-        cc->cipher_tfm.tfms = kzalloc(cc->tfms_count *
-                                      sizeof(struct crypto_skcipher *), GFP_KERNEL);
+        cc->cipher_tfm.tfms = kcalloc(cc->tfms_count,
+                                      sizeof(struct crypto_skcipher *),
+                                      GFP_KERNEL);
         if (!cc->cipher_tfm.tfms)
                 return -ENOMEM;
 
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index fc68c7aaef8e..86438b2f10dd 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -2448,7 +2448,9 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int
         struct scatterlist **sl;
         unsigned i;
 
-        sl = kvmalloc(ic->journal_sections * sizeof(struct scatterlist *), GFP_KERNEL | __GFP_ZERO);
+        sl = kvmalloc_array(ic->journal_sections,
+                            sizeof(struct scatterlist *),
+                            GFP_KERNEL | __GFP_ZERO);
         if (!sl)
                 return NULL;
 
@@ -2464,7 +2466,8 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int
 
                 n_pages = (end_index - start_index + 1);
 
-                s = kvmalloc(n_pages * sizeof(struct scatterlist), GFP_KERNEL);
+                s = kvmalloc_array(n_pages, sizeof(struct scatterlist),
+                                   GFP_KERNEL);
                 if (!s) {
                         dm_integrity_free_journal_scatterlist(ic, sl);
                         return NULL;
@@ -2643,7 +2646,9 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                 goto bad;
                         }
 
-                        sg = kvmalloc((ic->journal_pages + 1) * sizeof(struct scatterlist), GFP_KERNEL);
+                        sg = kvmalloc_array(ic->journal_pages + 1,
+                                            sizeof(struct scatterlist),
+                                            GFP_KERNEL);
                         if (!sg) {
                                 *error = "Unable to allocate sg list";
                                 r = -ENOMEM;
@@ -2709,7 +2714,9 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                 r = -ENOMEM;
                                 goto bad;
                         }
-                        ic->sk_requests = kvmalloc(ic->journal_sections * sizeof(struct skcipher_request *), GFP_KERNEL | __GFP_ZERO);
+                        ic->sk_requests = kvmalloc_array(ic->journal_sections,
+                                                         sizeof(struct skcipher_request *),
+                                                         GFP_KERNEL | __GFP_ZERO);
                         if (!ic->sk_requests) {
                                 *error = "Unable to allocate sk requests";
                                 r = -ENOMEM;
@@ -2743,7 +2750,8 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                         r = -ENOMEM;
                                         goto bad;
                                 }
-                                section_req->iv = kmalloc(ivsize * 2, GFP_KERNEL);
+                                section_req->iv = kmalloc_array(ivsize, 2,
+                                                                GFP_KERNEL);
                                 if (!section_req->iv) {
                                         skcipher_request_free(section_req);
                                         *error = "Unable to allocate iv";
diff --git a/drivers/md/dm-region-hash.c b/drivers/md/dm-region-hash.c
index c832ec398f02..1f760451e6f4 100644
--- a/drivers/md/dm-region-hash.c
+++ b/drivers/md/dm-region-hash.c
@@ -203,7 +203,7 @@ struct dm_region_hash *dm_region_hash_create(
         rh->shift = RH_HASH_SHIFT;
         rh->prime = RH_HASH_MULT;
 
-        rh->buckets = vmalloc(nr_buckets * sizeof(*rh->buckets));
+        rh->buckets = vmalloc(array_size(nr_buckets, sizeof(*rh->buckets)));
         if (!rh->buckets) {
                 DMERR("unable to allocate region hash bucket memory");
                 kfree(rh);
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index f745404da721..97de7a7334d4 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -326,8 +326,8 @@ static int init_origin_hash(void)
 {
         int i;
 
-        _origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
-                           GFP_KERNEL);
+        _origins = kmalloc_array(ORIGIN_HASH_SIZE, sizeof(struct list_head),
+                                 GFP_KERNEL);
         if (!_origins) {
                 DMERR("unable to allocate memory for _origins");
                 return -ENOMEM;
@@ -335,8 +335,9 @@ static int init_origin_hash(void)
         for (i = 0; i < ORIGIN_HASH_SIZE; i++)
                 INIT_LIST_HEAD(_origins + i);
 
-        _dm_origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
-                              GFP_KERNEL);
+        _dm_origins = kmalloc_array(ORIGIN_HASH_SIZE,
+                                    sizeof(struct list_head),
+                                    GFP_KERNEL);
         if (!_dm_origins) {
                 DMERR("unable to allocate memory for _dm_origins");
                 kfree(_origins);
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
index 56059fb56e2d..21de30b4e2a1 100644
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -915,7 +915,9 @@ static int parse_histogram(const char *h, unsigned *n_histogram_entries,
                 if (*q == ',')
                         (*n_histogram_entries)++;
 
-        *histogram_boundaries = kmalloc(*n_histogram_entries * sizeof(unsigned long long), GFP_KERNEL);
+        *histogram_boundaries = kmalloc_array(*n_histogram_entries,
+                                              sizeof(unsigned long long),
+                                              GFP_KERNEL);
         if (!*histogram_boundaries)
                 return -ENOMEM;
 
diff --git a/drivers/md/dm-switch.c b/drivers/md/dm-switch.c
index 7924a6a33ddc..fae35caf3672 100644
--- a/drivers/md/dm-switch.c
+++ b/drivers/md/dm-switch.c
@@ -114,7 +114,8 @@ static int alloc_region_table(struct dm_target *ti, unsigned nr_paths)
                 return -EINVAL;
         }
 
-        sctx->region_table = vmalloc(nr_slots * sizeof(region_table_slot_t));
+        sctx->region_table = vmalloc(array_size(nr_slots,
+                                                sizeof(region_table_slot_t)));
         if (!sctx->region_table) {
                 ti->error = "Cannot allocate region table";
                 return -ENOMEM;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index caa51dd351b6..938766794c2e 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -561,7 +561,7 @@ static char **realloc_argv(unsigned *size, char **old_argv)
                 new_size = 8;
                 gfp = GFP_NOIO;
         }
-        argv = kmalloc(new_size * sizeof(*argv), gfp);
+        argv = kmalloc_array(new_size, sizeof(*argv), gfp);
         if (argv) {
                 memcpy(argv, old_argv, *size * sizeof(*argv));
                 *size = new_size;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 6cf9c9364103..7945238df1c0 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2940,7 +2940,9 @@ static struct pool *pool_create(struct mapped_device *pool_md,
                 goto bad_mapping_pool;
         }
 
-        pool->cell_sort_array = vmalloc(sizeof(*pool->cell_sort_array) * CELL_SORT_ARRAY_SIZE);
+        pool->cell_sort_array =
+                vmalloc(array_size(CELL_SORT_ARRAY_SIZE,
+                                   sizeof(*pool->cell_sort_array)));
         if (!pool->cell_sort_array) {
                 *error = "Error allocating cell sort array";
                 err_p = ERR_PTR(-ENOMEM);
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index fc893f636a98..12decdbd722d 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -797,8 +797,9 @@ static int verity_alloc_most_once(struct dm_verity *v)
                 return -E2BIG;
         }
 
-        v->validated_blocks = kvzalloc(BITS_TO_LONGS(v->data_blocks) *
-                                       sizeof(unsigned long), GFP_KERNEL);
+        v->validated_blocks = kvcalloc(BITS_TO_LONGS(v->data_blocks),
+                                       sizeof(unsigned long),
+                                       GFP_KERNEL);
         if (!v->validated_blocks) {
                 ti->error = "failed to allocate bitset for check_at_most_once";
                 return -ENOMEM;
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index 239c7bb3929b..f983c3fdf204 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -789,8 +789,8 @@ static int bitmap_storage_alloc(struct bitmap_storage *store,
         num_pages = DIV_ROUND_UP(bytes, PAGE_SIZE);
         offset = slot_number * num_pages;
 
-        store->filemap = kmalloc(sizeof(struct page *)
-                                 * num_pages, GFP_KERNEL);
+        store->filemap = kmalloc_array(num_pages, sizeof(struct page *),
+                                       GFP_KERNEL);
         if (!store->filemap)
                 return -ENOMEM;
 
@@ -2117,7 +2117,7 @@ int bitmap_resize(struct bitmap *bitmap, sector_t blocks,
 
         pages = DIV_ROUND_UP(chunks, PAGE_COUNTER_RATIO);
 
-        new_bp = kzalloc(pages * sizeof(*new_bp), GFP_KERNEL);
+        new_bp = kcalloc(pages, sizeof(*new_bp), GFP_KERNEL);
         ret = -ENOMEM;
         if (!new_bp) {
                 bitmap_file_unmap(&store);
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 79bfbc840385..021cbf9ef1bf 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -1380,9 +1380,9 @@ static int lock_all_bitmaps(struct mddev *mddev)
         char str[64];
         struct md_cluster_info *cinfo = mddev->cluster_info;
 
-        cinfo->other_bitmap_lockres = kzalloc((mddev->bitmap_info.nodes - 1) *
-                                             sizeof(struct dlm_lock_resource *),
-                                             GFP_KERNEL);
+        cinfo->other_bitmap_lockres =
+                kcalloc(mddev->bitmap_info.nodes - 1,
+                        sizeof(struct dlm_lock_resource *), GFP_KERNEL);
         if (!cinfo->other_bitmap_lockres) {
                 pr_err("md: can't alloc mem for other bitmap locks\n");
                 return 0;
diff --git a/drivers/md/md-multipath.c b/drivers/md/md-multipath.c
index f71fcdb9b39c..881487de1e25 100644
--- a/drivers/md/md-multipath.c
+++ b/drivers/md/md-multipath.c
@@ -399,7 +399,8 @@ static int multipath_run (struct mddev *mddev)
         if (!conf)
                 goto out;
 
-        conf->multipaths = kzalloc(sizeof(struct multipath_info)*mddev->raid_disks,
+        conf->multipaths = kcalloc(mddev->raid_disks,
+                                   sizeof(struct multipath_info),
                                    GFP_KERNEL);
         if (!conf->multipaths)
                 goto out_free_conf;
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 65ae47a02218..ac1cffd2a09b 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -159,12 +159,14 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
         }
 
         err = -ENOMEM;
-        conf->strip_zone = kzalloc(sizeof(struct strip_zone)*
-                                conf->nr_strip_zones, GFP_KERNEL);
+        conf->strip_zone = kcalloc(conf->nr_strip_zones,
+                                   sizeof(struct strip_zone),
+                                   GFP_KERNEL);
         if (!conf->strip_zone)
                 goto abort;
-        conf->devlist = kzalloc(sizeof(struct md_rdev*)*
-                                conf->nr_strip_zones*mddev->raid_disks,
+        conf->devlist = kzalloc(array3_size(sizeof(struct md_rdev *),
+                                            conf->nr_strip_zones,
+                                            mddev->raid_disks),
                                 GFP_KERNEL);
         if (!conf->devlist)
                 goto abort;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 0b344d087581..8e05c1092aef 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -126,8 +126,8 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
         if (!r1_bio)
                 return NULL;
 
-        rps = kmalloc(sizeof(struct resync_pages) * pi->raid_disks,
-                      gfp_flags);
+        rps = kmalloc_array(pi->raid_disks, sizeof(struct resync_pages),
+                            gfp_flags);
         if (!rps)
                 goto out_free_r1bio;
 
@@ -2936,9 +2936,9 @@ static struct r1conf *setup_conf(struct mddev *mddev)
         if (!conf->barrier)
                 goto abort;
 
-        conf->mirrors = kzalloc(sizeof(struct raid1_info)
-                                * mddev->raid_disks * 2,
-                                 GFP_KERNEL);
+        conf->mirrors = kzalloc(array3_size(sizeof(struct raid1_info),
+                                            mddev->raid_disks, 2),
+                                GFP_KERNEL);
         if (!conf->mirrors)
                 goto abort;
 
@@ -3241,7 +3241,8 @@ static int raid1_reshape(struct mddev *mddev)
                 kfree(newpoolinfo);
                 return ret;
         }
-        newmirrors = kzalloc(sizeof(struct raid1_info) * raid_disks * 2,
+        newmirrors = kzalloc(array3_size(sizeof(struct raid1_info),
+                                         raid_disks, 2),
                              GFP_KERNEL);
         if (!newmirrors) {
                 kfree(newpoolinfo);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1147ae59e3b6..478cf446827f 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -175,7 +175,7 @@ static void * r10buf_pool_alloc(gfp_t gfp_flags, void *data)
                 nalloc_rp = nalloc;
         else
                 nalloc_rp = nalloc * 2;
-        rps = kmalloc(sizeof(struct resync_pages) * nalloc_rp, gfp_flags);
+        rps = kmalloc_array(nalloc_rp, sizeof(struct resync_pages), gfp_flags);
         if (!rps)
                 goto out_free_r10bio;
 
@@ -3688,8 +3688,8 @@ static struct r10conf *setup_conf(struct mddev *mddev)
                 goto out;
 
         /* FIXME calc properly */
-        conf->mirrors = kzalloc(sizeof(struct raid10_info)*(mddev->raid_disks +
-                                                            max(0,-mddev->delta_disks)),
+        conf->mirrors = kcalloc(mddev->raid_disks + max(0, -mddev->delta_disks),
+                                sizeof(struct raid10_info),
                                 GFP_KERNEL);
         if (!conf->mirrors)
                 goto out;
@@ -4129,11 +4129,10 @@ static int raid10_check_reshape(struct mddev *mddev)
         conf->mirrors_new = NULL;
         if (mddev->delta_disks > 0) {
                 /* allocate new 'mirrors' list */
-                conf->mirrors_new = kzalloc(
-                        sizeof(struct raid10_info)
-                        *(mddev->raid_disks +
-                          mddev->delta_disks),
-                        GFP_KERNEL);
+                conf->mirrors_new =
+                        kcalloc(mddev->raid_disks + mddev->delta_disks,
+                                sizeof(struct raid10_info),
+                                GFP_KERNEL);
                 if (!conf->mirrors_new)
                         return -ENOMEM;
         }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 73489446bbcb..2031506a0ecd 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2396,7 +2396,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
          * is completely stalled, so now is a good time to resize
          * conf->disks and the scribble region
          */
-        ndisks = kzalloc(newsize * sizeof(struct disk_info), GFP_NOIO);
+        ndisks = kcalloc(newsize, sizeof(struct disk_info), GFP_NOIO);
         if (ndisks) {
                 for (i = 0; i < conf->pool_size; i++)
                         ndisks[i] = conf->disks[i];
@@ -6664,9 +6664,9 @@ static int alloc_thread_groups(struct r5conf *conf, int cnt,
         }
         *group_cnt = num_possible_nodes();
         size = sizeof(struct r5worker) * cnt;
-        workers = kzalloc(size * *group_cnt, GFP_NOIO);
-        *worker_groups = kzalloc(sizeof(struct r5worker_group) *
-                                *group_cnt, GFP_NOIO);
+        workers = kcalloc(size, *group_cnt, GFP_NOIO);
+        *worker_groups = kcalloc(*group_cnt, sizeof(struct r5worker_group),
+                                 GFP_NOIO);
         if (!*worker_groups || !workers) {
                 kfree(workers);
                 kfree(*worker_groups);
@@ -6894,8 +6894,9 @@ static struct r5conf *setup_conf(struct mddev *mddev)
                 goto abort;
         INIT_LIST_HEAD(&conf->free_list);
         INIT_LIST_HEAD(&conf->pending_list);
-        conf->pending_data = kzalloc(sizeof(struct r5pending_data) *
-                PENDING_IO_MAX, GFP_KERNEL);
+        conf->pending_data = kcalloc(PENDING_IO_MAX,
+                                     sizeof(struct r5pending_data),
+                                     GFP_KERNEL);
         if (!conf->pending_data)
                 goto abort;
         for (i = 0; i < PENDING_IO_MAX; i++)
@@ -6944,7 +6945,7 @@ static struct r5conf *setup_conf(struct mddev *mddev)
                 conf->previous_raid_disks = mddev->raid_disks - mddev->delta_disks;
         max_disks = max(conf->raid_disks, conf->previous_raid_disks);
 
-        conf->disks = kzalloc(max_disks * sizeof(struct disk_info),
+        conf->disks = kcalloc(max_disks, sizeof(struct disk_info),
                               GFP_KERNEL);
 
         if (!conf->disks)
diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
index 9b64f4f354bf..abd4c788dffd 100644
--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
@@ -119,12 +119,14 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
                 for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
                         unsigned pixelsz = plane ? 2 : 4;
 
-                        tpg->lines[pat][plane] = vzalloc(max_w * 2 * pixelsz);
+                        tpg->lines[pat][plane] =
+                                vzalloc(array3_size(max_w, 2, pixelsz));
                         if (!tpg->lines[pat][plane])
                                 return -ENOMEM;
                         if (plane == 0)
                                 continue;
-                        tpg->downsampled_lines[pat][plane] = vzalloc(max_w * 2 * pixelsz);
+                        tpg->downsampled_lines[pat][plane] =
+                                vzalloc(array3_size(max_w, 2, pixelsz));
                         if (!tpg->downsampled_lines[pat][plane])
                                 return -ENOMEM;
                 }
@@ -132,13 +134,16 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
         for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
                 unsigned pixelsz = plane ? 2 : 4;
 
-                tpg->contrast_line[plane] = vzalloc(max_w * pixelsz);
+                tpg->contrast_line[plane] =
+                        vzalloc(array_size(pixelsz, max_w));
                 if (!tpg->contrast_line[plane])
                         return -ENOMEM;
-                tpg->black_line[plane] = vzalloc(max_w * pixelsz);
+                tpg->black_line[plane] =
+                        vzalloc(array_size(pixelsz, max_w));
                 if (!tpg->black_line[plane])
                         return -ENOMEM;
-                tpg->random_line[plane] = vzalloc(max_w * 2 * pixelsz);
+                tpg->random_line[plane] =
+                        vzalloc(array3_size(max_w, 2, pixelsz));
                 if (!tpg->random_line[plane])
                         return -ENOMEM;
         }
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index cb078d688c70..d548f98c7a67 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -1417,7 +1417,8 @@ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter)
         if (dmxdev->demux->open(dmxdev->demux) < 0)
                 return -EUSERS;
 
-        dmxdev->filter = vmalloc(dmxdev->filternum * sizeof(struct dmxdev_filter));
+        dmxdev->filter = vmalloc(array_size(sizeof(struct dmxdev_filter),
+                                            dmxdev->filternum));
         if (!dmxdev->filter)
                 return -ENOMEM;
 
diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c
index f45091246bdc..39a2c6ccf31d 100644
--- a/drivers/media/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb-core/dvb_demux.c
@@ -1247,12 +1247,14 @@ int dvb_dmx_init(struct dvb_demux *dvbdemux)
 
         dvbdemux->cnt_storage = NULL;
         dvbdemux->users = 0;
-        dvbdemux->filter = vmalloc(dvbdemux->filternum * sizeof(struct dvb_demux_filter));
+        dvbdemux->filter = vmalloc(array_size(sizeof(struct dvb_demux_filter),
+                                              dvbdemux->filternum));
 
         if (!dvbdemux->filter)
                 return -ENOMEM;
 
-        dvbdemux->feed = vmalloc(dvbdemux->feednum * sizeof(struct dvb_demux_feed));
+        dvbdemux->feed = vmalloc(array_size(sizeof(struct dvb_demux_feed),
+                                            dvbdemux->feednum));
         if (!dvbdemux->feed) {
                 vfree(dvbdemux->filter);
                 dvbdemux->filter = NULL;
diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
index 902af482448e..5a8dbc0b25fb 100644
--- a/drivers/media/dvb-frontends/dib7000p.c
+++ b/drivers/media/dvb-frontends/dib7000p.c
@@ -2018,10 +2018,10 @@ static int dib7000pc_detection(struct i2c_adapter *i2c_adap)
         };
         int ret = 0;
 
-        tx = kzalloc(2*sizeof(u8), GFP_KERNEL);
+        tx = kzalloc(2, GFP_KERNEL);
         if (!tx)
                 return -ENOMEM;
-        rx = kzalloc(2*sizeof(u8), GFP_KERNEL);
+        rx = kzalloc(2, GFP_KERNEL);
         if (!rx) {
                 ret = -ENOMEM;
                 goto rx_memory_error;
diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c
index 6f35173d2968..22eec8f65485 100644
--- a/drivers/media/dvb-frontends/dib8000.c
+++ b/drivers/media/dvb-frontends/dib8000.c
@@ -4271,12 +4271,12 @@ static int dib8000_i2c_enumeration(struct i2c_adapter *host, int no_of_demods,
         u8 new_addr = 0;
         struct i2c_device client = {.adap = host };
 
-        client.i2c_write_buffer = kzalloc(4 * sizeof(u8), GFP_KERNEL);
+        client.i2c_write_buffer = kzalloc(4, GFP_KERNEL);
         if (!client.i2c_write_buffer) {
                 dprintk("%s: not enough memory\n", __func__);
                 return -ENOMEM;
         }
-        client.i2c_read_buffer = kzalloc(4 * sizeof(u8), GFP_KERNEL);
+        client.i2c_read_buffer = kzalloc(4, GFP_KERNEL);
         if (!client.i2c_read_buffer) {
                 dprintk("%s: not enough memory\n", __func__);
                 ret = -ENOMEM;
diff --git a/drivers/media/dvb-frontends/dib9000.c b/drivers/media/dvb-frontends/dib9000.c
index f9289f488de7..b8edb55696bb 100644
--- a/drivers/media/dvb-frontends/dib9000.c
+++ b/drivers/media/dvb-frontends/dib9000.c
@@ -2381,12 +2381,12 @@ int dib9000_i2c_enumeration(struct i2c_adapter *i2c, int no_of_demods, u8 defaul
         u8 new_addr = 0;
         struct i2c_device client = {.i2c_adap = i2c };
 
-        client.i2c_write_buffer = kzalloc(4 * sizeof(u8), GFP_KERNEL);
+        client.i2c_write_buffer = kzalloc(4, GFP_KERNEL);
         if (!client.i2c_write_buffer) {
                 dprintk("%s: not enough memory\n", __func__);
                 return -ENOMEM;
         }
-        client.i2c_read_buffer = kzalloc(4 * sizeof(u8), GFP_KERNEL);
+        client.i2c_read_buffer = kzalloc(4, GFP_KERNEL);
         if (!client.i2c_read_buffer) {
                 dprintk("%s: not enough memory\n", __func__);
                 ret = -ENOMEM;
diff --git a/drivers/media/i2c/s5k5baf.c b/drivers/media/i2c/s5k5baf.c
index ff46d2c96cea..5007c9659342 100644
--- a/drivers/media/i2c/s5k5baf.c
+++ b/drivers/media/i2c/s5k5baf.c
@@ -373,7 +373,7 @@ static int s5k5baf_fw_parse(struct device *dev, struct s5k5baf_fw **fw,
         data += S5K5BAG_FW_TAG_LEN;
         count -= S5K5BAG_FW_TAG_LEN;
 
-        d = devm_kzalloc(dev, count * sizeof(u16), GFP_KERNEL);
+        d = devm_kcalloc(dev, count, sizeof(u16), GFP_KERNEL);
         if (!d)
                 return -ENOMEM;
 
diff --git a/drivers/media/pci/bt8xx/bttv-risc.c b/drivers/media/pci/bt8xx/bttv-risc.c
index 6a6be0b49f70..74aff6877d9c 100644
--- a/drivers/media/pci/bt8xx/bttv-risc.c
+++ b/drivers/media/pci/bt8xx/bttv-risc.c
@@ -256,7 +256,8 @@ bttv_risc_overlay(struct bttv *btv, struct btcx_riscmem *risc,
         u32 addr;
 
         /* skip list for window clipping */
-        if (NULL == (skips = kmalloc(sizeof(*skips) * ov->nclips,GFP_KERNEL)))
+        skips = kmalloc_array(ov->nclips, sizeof(*skips),GFP_KERNEL);
+        if (NULL == skips)
                 return -ENOMEM;
 
         /* estimate risc mem: worst case is (1.5*clip+1) * lines instructions
diff --git a/drivers/media/pci/cx23885/cx23885-alsa.c b/drivers/media/pci/cx23885/cx23885-alsa.c
index 20b3cb17f97f..db1e8ff35474 100644
--- a/drivers/media/pci/cx23885/cx23885-alsa.c
+++ b/drivers/media/pci/cx23885/cx23885-alsa.c
@@ -95,7 +95,7 @@ static int cx23885_alsa_dma_init(struct cx23885_audio_dev *chip, int nr_pages)
         memset(buf->vaddr, 0, nr_pages << PAGE_SHIFT);
         buf->nr_pages = nr_pages;
 
-        buf->sglist = vzalloc(buf->nr_pages * sizeof(*buf->sglist));
+        buf->sglist = vzalloc(array_size(sizeof(*buf->sglist), buf->nr_pages));
         if (NULL == buf->sglist)
                 goto vzalloc_err;
 
diff --git a/drivers/media/pci/cx25821/cx25821-alsa.c b/drivers/media/pci/cx25821/cx25821-alsa.c
index a45bf0331eeb..ef6380651c10 100644
--- a/drivers/media/pci/cx25821/cx25821-alsa.c
+++ b/drivers/media/pci/cx25821/cx25821-alsa.c
@@ -159,7 +159,7 @@ static int cx25821_alsa_dma_init(struct cx25821_audio_dev *chip, int nr_pages)
         memset(buf->vaddr, 0, nr_pages << PAGE_SHIFT);
         buf->nr_pages = nr_pages;
 
-        buf->sglist = vzalloc(buf->nr_pages * sizeof(*buf->sglist));
+        buf->sglist = vzalloc(array_size(sizeof(*buf->sglist), buf->nr_pages));
         if (NULL == buf->sglist)
                 goto vzalloc_err;
 
diff --git a/drivers/media/pci/cx88/cx88-alsa.c b/drivers/media/pci/cx88/cx88-alsa.c
index 8a28fda703a2..e5c3387cd1e8 100644
--- a/drivers/media/pci/cx88/cx88-alsa.c
+++ b/drivers/media/pci/cx88/cx88-alsa.c
@@ -298,7 +298,7 @@ static int cx88_alsa_dma_init(struct cx88_audio_dev *chip, int nr_pages)
         memset(buf->vaddr, 0, nr_pages << PAGE_SHIFT);
         buf->nr_pages = nr_pages;
 
-        buf->sglist = vzalloc(buf->nr_pages * sizeof(*buf->sglist));
+        buf->sglist = vzalloc(array_size(sizeof(*buf->sglist), buf->nr_pages));
         if (!buf->sglist)
                 goto vzalloc_err;
 
diff --git a/drivers/media/pci/ivtv/ivtvfb.c b/drivers/media/pci/ivtv/ivtvfb.c
index 8e62b8be6529..b19058e36853 100644
--- a/drivers/media/pci/ivtv/ivtvfb.c
+++ b/drivers/media/pci/ivtv/ivtvfb.c
@@ -1077,7 +1077,7 @@ static int ivtvfb_init_vidmode(struct ivtv *itv)
 
         /* Allocate the pseudo palette */
         oi->ivtvfb_info.pseudo_palette =
-                kmalloc(sizeof(u32) * 16, GFP_KERNEL|__GFP_NOWARN);
+                kmalloc_array(16, sizeof(u32), GFP_KERNEL|__GFP_NOWARN);
 
         if (!oi->ivtvfb_info.pseudo_palette) {
                 IVTVFB_ERR("abort, unable to alloc pseudo palette\n");
diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c
index dedcdb573427..8001d3e9134e 100644
--- a/drivers/media/pci/meye/meye.c
+++ b/drivers/media/pci/meye/meye.c
@@ -1625,7 +1625,7 @@ static int meye_probe(struct pci_dev *pcidev, const struct pci_device_id *ent)
         ret = -ENOMEM;
         meye.mchip_dev = pcidev;
 
-        meye.grab_temp = vmalloc(MCHIP_NB_PAGES_MJPEG * PAGE_SIZE);
+        meye.grab_temp = vmalloc(array_size(PAGE_SIZE, MCHIP_NB_PAGES_MJPEG));
         if (!meye.grab_temp)
                 goto outvmalloc;
 
diff --git a/drivers/media/pci/pt1/pt1.c b/drivers/media/pci/pt1/pt1.c
index 5708f69622cc..fda969a85684 100644
--- a/drivers/media/pci/pt1/pt1.c
+++ b/drivers/media/pci/pt1/pt1.c
@@ -615,7 +615,7 @@ static int pt1_init_tables(struct pt1 *pt1)
         if (!pt1_nr_tables)
                 return 0;
 
-        tables = vmalloc(sizeof(struct pt1_table) * pt1_nr_tables);
+        tables = vmalloc(array_size(pt1_nr_tables, sizeof(struct pt1_table)));
         if (tables == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
index 72311445d13d..b90cfde6e301 100644
--- a/drivers/media/pci/saa7134/saa7134-alsa.c
+++ b/drivers/media/pci/saa7134/saa7134-alsa.c
@@ -279,7 +279,7 @@ static int saa7134_alsa_dma_init(struct saa7134_dev *dev, int nr_pages)
         memset(dma->vaddr, 0, nr_pages << PAGE_SHIFT);
         dma->nr_pages = nr_pages;
 
-        dma->sglist = vzalloc(dma->nr_pages * sizeof(*dma->sglist));
+        dma->sglist = vzalloc(array_size(sizeof(*dma->sglist), dma->nr_pages));
         if (NULL == dma->sglist)
                 goto vzalloc_err;
 
diff --git a/drivers/media/pci/ttpci/av7110_ipack.c b/drivers/media/pci/ttpci/av7110_ipack.c
index 5aff26574fe1..ec528fae7333 100644
--- a/drivers/media/pci/ttpci/av7110_ipack.c
+++ b/drivers/media/pci/ttpci/av7110_ipack.c
@@ -24,7 +24,7 @@ void av7110_ipack_reset(struct ipack *p)
 int av7110_ipack_init(struct ipack *p, int size,
                       void (*func)(u8 *buf, int size, void *priv))
 {
-        if (!(p->buf = vmalloc(size*sizeof(u8)))) {
+        if (!(p->buf = vmalloc(size))) {
                 printk(KERN_WARNING "Couldn't allocate memory for ipack\n");
                 return -ENOMEM;
         }
diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c
index 58ebc2220d0e..b05738a95e55 100644
--- a/drivers/media/platform/am437x/am437x-vpfe.c
+++ b/drivers/media/platform/am437x/am437x-vpfe.c
@@ -2586,8 +2586,10 @@ static int vpfe_probe(struct platform_device *pdev)
 
         pm_runtime_put_sync(&pdev->dev);
 
-        vpfe->sd = devm_kzalloc(&pdev->dev, sizeof(struct v4l2_subdev *) *
-                                ARRAY_SIZE(vpfe->cfg->asd), GFP_KERNEL);
+        vpfe->sd = devm_kcalloc(&pdev->dev,
+                                ARRAY_SIZE(vpfe->cfg->asd),
+                                sizeof(struct v4l2_subdev *),
+                                GFP_KERNEL);
         if (!vpfe->sd) {
                 ret = -ENOMEM;
                 goto probe_out_v4l2_unregister;
diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index 9364cdf62f54..a96f53ce8088 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -1528,8 +1528,10 @@ vpif_capture_get_pdata(struct platform_device *pdev)
         if (!pdata)
                 return NULL;
         pdata->subdev_info =
-                devm_kzalloc(&pdev->dev, sizeof(*pdata->subdev_info) *
-                             VPIF_CAPTURE_NUM_CHANNELS, GFP_KERNEL);
+                devm_kcalloc(&pdev->dev,
+                             VPIF_CAPTURE_NUM_CHANNELS,
+                             sizeof(*pdata->subdev_info),
+                             GFP_KERNEL);
 
         if (!pdata->subdev_info)
                 return NULL;
@@ -1546,9 +1548,9 @@ vpif_capture_get_pdata(struct platform_device *pdev)
 
                 sdinfo = &pdata->subdev_info[i];
                 chan = &pdata->chan_config[i];
-                chan->inputs = devm_kzalloc(&pdev->dev,
-                                            sizeof(*chan->inputs) *
+                chan->inputs = devm_kcalloc(&pdev->dev,
                                             VPIF_CAPTURE_NUM_CHANNELS,
+                                            sizeof(*chan->inputs),
                                             GFP_KERNEL);
                 if (!chan->inputs)
                         return NULL;
diff --git a/drivers/media/platform/qcom/camss-8x16/camss-csid.c b/drivers/media/platform/qcom/camss-8x16/camss-csid.c
index 64df82817de3..226f36ef7419 100644
--- a/drivers/media/platform/qcom/camss-8x16/camss-csid.c
+++ b/drivers/media/platform/qcom/camss-8x16/camss-csid.c
@@ -845,7 +845,7 @@ int msm_csid_subdev_init(struct csid_device *csid,
         while (res->clock[csid->nclocks])
                 csid->nclocks++;
 
-        csid->clock = devm_kzalloc(dev, csid->nclocks * sizeof(*csid->clock),
+        csid->clock = devm_kcalloc(dev, csid->nclocks, sizeof(*csid->clock),
                                     GFP_KERNEL);
         if (!csid->clock)
                 return -ENOMEM;
@@ -868,8 +868,10 @@ int msm_csid_subdev_init(struct csid_device *csid,
                         continue;
                 }
 
-                clock->freq = devm_kzalloc(dev, clock->nfreqs *
-                                           sizeof(*clock->freq), GFP_KERNEL);
+                clock->freq = devm_kcalloc(dev,
+                                           clock->nfreqs,
+                                           sizeof(*clock->freq),
+                                           GFP_KERNEL);
                 if (!clock->freq)
                         return -ENOMEM;
 
diff --git a/drivers/media/platform/qcom/camss-8x16/camss-csiphy.c b/drivers/media/platform/qcom/camss-8x16/camss-csiphy.c
index 072c6cf053f6..7e61caba6a2d 100644
--- a/drivers/media/platform/qcom/camss-8x16/camss-csiphy.c
+++ b/drivers/media/platform/qcom/camss-8x16/camss-csiphy.c
@@ -732,8 +732,9 @@ int msm_csiphy_subdev_init(struct csiphy_device *csiphy,
         while (res->clock[csiphy->nclocks])
                 csiphy->nclocks++;
 
-        csiphy->clock = devm_kzalloc(dev, csiphy->nclocks *
-                                     sizeof(*csiphy->clock), GFP_KERNEL);
+        csiphy->clock = devm_kcalloc(dev,
+                                     csiphy->nclocks, sizeof(*csiphy->clock),
+                                     GFP_KERNEL);
         if (!csiphy->clock)
                 return -ENOMEM;
 
@@ -755,8 +756,10 @@ int msm_csiphy_subdev_init(struct csiphy_device *csiphy,
                         continue;
                 }
 
-                clock->freq = devm_kzalloc(dev, clock->nfreqs *
-                                           sizeof(*clock->freq), GFP_KERNEL);
+                clock->freq = devm_kcalloc(dev,
+                                           clock->nfreqs,
+                                           sizeof(*clock->freq),
+                                           GFP_KERNEL);
                 if (!clock->freq)
                         return -ENOMEM;
 
diff --git a/drivers/media/platform/qcom/camss-8x16/camss-ispif.c b/drivers/media/platform/qcom/camss-8x16/camss-ispif.c
index 24da529397b5..9d1af9353c1d 100644
--- a/drivers/media/platform/qcom/camss-8x16/camss-ispif.c
+++ b/drivers/media/platform/qcom/camss-8x16/camss-ispif.c
@@ -948,7 +948,8 @@ int msm_ispif_subdev_init(struct ispif_device *ispif,
         while (res->clock[ispif->nclocks])
                 ispif->nclocks++;
 
-        ispif->clock = devm_kzalloc(dev, ispif->nclocks * sizeof(*ispif->clock),
+        ispif->clock = devm_kcalloc(dev,
+                                    ispif->nclocks, sizeof(*ispif->clock),
                                     GFP_KERNEL);
         if (!ispif->clock)
                 return -ENOMEM;
@@ -968,8 +969,10 @@ int msm_ispif_subdev_init(struct ispif_device *ispif,
         while (res->clock_for_reset[ispif->nclocks_for_reset])
                 ispif->nclocks_for_reset++;
 
-        ispif->clock_for_reset = devm_kzalloc(dev, ispif->nclocks_for_reset *
-                        sizeof(*ispif->clock_for_reset), GFP_KERNEL);
+        ispif->clock_for_reset = devm_kcalloc(dev,
+                                              ispif->nclocks_for_reset,
+                                              sizeof(*ispif->clock_for_reset),
+                                              GFP_KERNEL);
         if (!ispif->clock_for_reset)
                 return -ENOMEM;
 
diff --git a/drivers/media/platform/qcom/camss-8x16/camss-vfe.c b/drivers/media/platform/qcom/camss-8x16/camss-vfe.c
index 55232a912950..a6329a8a7c4a 100644
--- a/drivers/media/platform/qcom/camss-8x16/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss-8x16/camss-vfe.c
@@ -2794,7 +2794,7 @@ int msm_vfe_subdev_init(struct vfe_device *vfe, const struct resources *res)
         while (res->clock[vfe->nclocks])
                 vfe->nclocks++;
 
-        vfe->clock = devm_kzalloc(dev, vfe->nclocks * sizeof(*vfe->clock),
+        vfe->clock = devm_kcalloc(dev, vfe->nclocks, sizeof(*vfe->clock),
                                   GFP_KERNEL);
         if (!vfe->clock)
                 return -ENOMEM;
@@ -2817,8 +2817,10 @@ int msm_vfe_subdev_init(struct vfe_device *vfe, const struct resources *res)
                         continue;
                 }
 
-                clock->freq = devm_kzalloc(dev, clock->nfreqs *
-                                           sizeof(*clock->freq), GFP_KERNEL);
+                clock->freq = devm_kcalloc(dev,
+                                           clock->nfreqs,
+                                           sizeof(*clock->freq),
+                                           GFP_KERNEL);
                 if (!clock->freq)
                         return -ENOMEM;
 
diff --git a/drivers/media/platform/qcom/camss-8x16/camss.c b/drivers/media/platform/qcom/camss-8x16/camss.c
index 05f06c98aa64..23fda6207a23 100644
--- a/drivers/media/platform/qcom/camss-8x16/camss.c
+++ b/drivers/media/platform/qcom/camss-8x16/camss.c
@@ -271,7 +271,8 @@ static int camss_of_parse_endpoint_node(struct device *dev,
         lncfg->clk.pol = mipi_csi2->lane_polarities[0];
         lncfg->num_data = mipi_csi2->num_data_lanes;
 
-        lncfg->data = devm_kzalloc(dev, lncfg->num_data * sizeof(*lncfg->data),
+        lncfg->data = devm_kcalloc(dev,
+                                   lncfg->num_data, sizeof(*lncfg->data),
                                    GFP_KERNEL);
         if (!lncfg->data)
                 return -ENOMEM;
diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c
index 69f0d8e80bd8..66d613629167 100644
--- a/drivers/media/platform/soc_camera/soc_camera.c
+++ b/drivers/media/platform/soc_camera/soc_camera.c
@@ -481,7 +481,8 @@ static int soc_camera_init_user_formats(struct soc_camera_device *icd)
                 return -ENXIO;
 
         icd->user_formats =
-                vmalloc(fmts * sizeof(struct soc_camera_format_xlate));
+                vmalloc(array_size(fmts,
+                                   sizeof(struct soc_camera_format_xlate)));
         if (!icd->user_formats)
                 return -ENOMEM;
 
diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
index 82ec216f2ad8..31db363602e5 100644
--- a/drivers/media/platform/vivid/vivid-core.c
+++ b/drivers/media/platform/vivid/vivid-core.c
@@ -844,10 +844,10 @@ static int vivid_create_instance(struct platform_device *pdev, int inst)
         tpg_init(&dev->tpg, 640, 360);
         if (tpg_alloc(&dev->tpg, MAX_ZOOM * MAX_WIDTH))
                 goto free_dev;
-        dev->scaled_line = vzalloc(MAX_ZOOM * MAX_WIDTH);
+        dev->scaled_line = vzalloc(array_size(MAX_WIDTH, MAX_ZOOM));
         if (!dev->scaled_line)
                 goto free_dev;
-        dev->blended_line = vzalloc(MAX_ZOOM * MAX_WIDTH);
+        dev->blended_line = vzalloc(array_size(MAX_WIDTH, MAX_ZOOM));
         if (!dev->blended_line)
                 goto free_dev;
 
@@ -859,8 +859,9 @@ static int vivid_create_instance(struct platform_device *pdev, int inst)
         /* create a string array containing the names of all the preset timings */
         while (v4l2_dv_timings_presets[dev->query_dv_timings_size].bt.width)
                 dev->query_dv_timings_size++;
-        dev->query_dv_timings_qmenu = kmalloc(dev->query_dv_timings_size *
-                                           (sizeof(void *) + 32), GFP_KERNEL);
+        dev->query_dv_timings_qmenu = kmalloc_array(dev->query_dv_timings_size,
+                                                    (sizeof(void *) + 32),
+                                                    GFP_KERNEL);
         if (dev->query_dv_timings_qmenu == NULL)
                 goto free_dev;
         for (i = 0; i < dev->query_dv_timings_size; i++) {
diff --git a/drivers/media/platform/vsp1/vsp1_entity.c b/drivers/media/platform/vsp1/vsp1_entity.c
index da276a85aa95..36a29e13109e 100644
--- a/drivers/media/platform/vsp1/vsp1_entity.c
+++ b/drivers/media/platform/vsp1/vsp1_entity.c
@@ -630,7 +630,8 @@ int vsp1_entity_init(struct vsp1_device *vsp1, struct vsp1_entity *entity,
         entity->source_pad = num_pads - 1;
 
         /* Allocate and initialize pads. */
-        entity->pads = devm_kzalloc(vsp1->dev, num_pads * sizeof(*entity->pads),
+        entity->pads = devm_kcalloc(vsp1->dev,
+                                    num_pads, sizeof(*entity->pads),
                                     GFP_KERNEL);
         if (entity->pads == NULL)
                 return -ENOMEM;
diff --git a/drivers/media/platform/xilinx/xilinx-vipp.c b/drivers/media/platform/xilinx/xilinx-vipp.c
index 6bb28cd49dae..6d95ec1e9a6b 100644
--- a/drivers/media/platform/xilinx/xilinx-vipp.c
+++ b/drivers/media/platform/xilinx/xilinx-vipp.c
@@ -532,7 +532,7 @@ static int xvip_graph_init(struct xvip_composite_device *xdev)
 
         /* Register the subdevices notifier. */
         num_subdevs = xdev->num_subdevs;
-        subdevs = devm_kzalloc(xdev->dev, sizeof(*subdevs) * num_subdevs,
+        subdevs = devm_kcalloc(xdev->dev, num_subdevs, sizeof(*subdevs),
                                GFP_KERNEL);
         if (subdevs == NULL) {
                 ret = -ENOMEM;
diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c
index 964cd7bcdd2c..70e187971590 100644
--- a/drivers/media/usb/au0828/au0828-video.c
+++ b/drivers/media/usb/au0828/au0828-video.c
@@ -217,14 +217,14 @@ static int au0828_init_isoc(struct au0828_dev *dev, int max_packets,
         dev->isoc_ctl.isoc_copy = isoc_copy;
         dev->isoc_ctl.num_bufs = num_bufs;
 
-        dev->isoc_ctl.urb = kzalloc(sizeof(void *)*num_bufs,  GFP_KERNEL);
+        dev->isoc_ctl.urb = kcalloc(num_bufs, sizeof(void *),  GFP_KERNEL);
         if (!dev->isoc_ctl.urb) {
                 au0828_isocdbg("cannot alloc memory for usb buffers\n");
                 return -ENOMEM;
         }
 
-        dev->isoc_ctl.transfer_buffer = kzalloc(sizeof(void *)*num_bufs,
-                                              GFP_KERNEL);
+        dev->isoc_ctl.transfer_buffer = kcalloc(num_bufs, sizeof(void *),
+                                                GFP_KERNEL);
         if (!dev->isoc_ctl.transfer_buffer) {
                 au0828_isocdbg("cannot allocate memory for usb transfer\n");
                 kfree(dev->isoc_ctl.urb);
diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
index b51fc372ca25..a771e0a52610 100644
--- a/drivers/media/usb/cpia2/cpia2_usb.c
+++ b/drivers/media/usb/cpia2/cpia2_usb.c
@@ -663,7 +663,8 @@ static int submit_urbs(struct camera_data *cam)
                 if (cam->sbuf[i].data)
                         continue;
                 cam->sbuf[i].data =
-                    kmalloc(FRAMES_PER_DESC * FRAME_SIZE_PER_DESC, GFP_KERNEL);
+                    kmalloc_array(FRAME_SIZE_PER_DESC, FRAMES_PER_DESC,
+                                  GFP_KERNEL);
                 if (!cam->sbuf[i].data) {
                         while (--i >= 0) {
                                 kfree(cam->sbuf[i].data);
diff --git a/drivers/media/usb/cx231xx/cx231xx-audio.c b/drivers/media/usb/cx231xx/cx231xx-audio.c
index d96236d786d1..c4a84fb930b6 100644
--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -710,7 +710,7 @@ static int cx231xx_audio_init(struct cx231xx *dev)
         dev_info(dev->dev,
                 "audio EndPoint Addr 0x%x, Alternate settings: %i\n",
                 adev->end_point_addr, adev->num_alt);
-        adev->alt_max_pkt_size = kmalloc(32 * adev->num_alt, GFP_KERNEL);
+        adev->alt_max_pkt_size = kmalloc_array(32, adev->num_alt, GFP_KERNEL);
         if (!adev->alt_max_pkt_size) {
                 err = -ENOMEM;
                 goto err_free_card;
diff --git a/drivers/media/usb/cx231xx/cx231xx-core.c b/drivers/media/usb/cx231xx/cx231xx-core.c
index 4f43668df15d..53d846dea3d2 100644
--- a/drivers/media/usb/cx231xx/cx231xx-core.c
+++ b/drivers/media/usb/cx231xx/cx231xx-core.c
@@ -1034,7 +1034,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
                 dma_q->partial_buf[i] = 0;
 
         dev->video_mode.isoc_ctl.urb =
-            kzalloc(sizeof(void *) * num_bufs, GFP_KERNEL);
+            kcalloc(num_bufs, sizeof(void *), GFP_KERNEL);
         if (!dev->video_mode.isoc_ctl.urb) {
                 dev_err(dev->dev,
                         "cannot alloc memory for usb buffers\n");
@@ -1042,7 +1042,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
         }
 
         dev->video_mode.isoc_ctl.transfer_buffer =
-            kzalloc(sizeof(void *) * num_bufs, GFP_KERNEL);
+            kcalloc(num_bufs, sizeof(void *), GFP_KERNEL);
         if (!dev->video_mode.isoc_ctl.transfer_buffer) {
                 dev_err(dev->dev,
                         "cannot allocate memory for usbtransfer\n");
@@ -1169,7 +1169,7 @@ int cx231xx_init_bulk(struct cx231xx *dev, int max_packets,
                 dma_q->partial_buf[i] = 0;
 
         dev->video_mode.bulk_ctl.urb =
-            kzalloc(sizeof(void *) * num_bufs, GFP_KERNEL);
+            kcalloc(num_bufs, sizeof(void *), GFP_KERNEL);
         if (!dev->video_mode.bulk_ctl.urb) {
                 dev_err(dev->dev,
                         "cannot alloc memory for usb buffers\n");
@@ -1177,7 +1177,7 @@ int cx231xx_init_bulk(struct cx231xx *dev, int max_packets,
         }
 
         dev->video_mode.bulk_ctl.transfer_buffer =
-            kzalloc(sizeof(void *) * num_bufs, GFP_KERNEL);
+            kcalloc(num_bufs, sizeof(void *), GFP_KERNEL);
         if (!dev->video_mode.bulk_ctl.transfer_buffer) {
                 dev_err(dev->dev,
                         "cannot allocate memory for usbtransfer\n");
diff --git a/drivers/media/usb/cx231xx/cx231xx-vbi.c b/drivers/media/usb/cx231xx/cx231xx-vbi.c
index d3bfe8e23b1f..b621cf1aa96b 100644
--- a/drivers/media/usb/cx231xx/cx231xx-vbi.c
+++ b/drivers/media/usb/cx231xx/cx231xx-vbi.c
@@ -415,7 +415,7 @@ int cx231xx_init_vbi_isoc(struct cx231xx *dev, int max_packets,
         for (i = 0; i < 8; i++)
                 dma_q->partial_buf[i] = 0;
 
-        dev->vbi_mode.bulk_ctl.urb = kzalloc(sizeof(void *) * num_bufs,
+        dev->vbi_mode.bulk_ctl.urb = kcalloc(num_bufs, sizeof(void *),
                                              GFP_KERNEL);
         if (!dev->vbi_mode.bulk_ctl.urb) {
                 dev_err(dev->dev,
@@ -424,7 +424,7 @@ int cx231xx_init_vbi_isoc(struct cx231xx *dev, int max_packets,
         }
 
         dev->vbi_mode.bulk_ctl.transfer_buffer =
-            kzalloc(sizeof(void *) * num_bufs, GFP_KERNEL);
+            kcalloc(num_bufs, sizeof(void *), GFP_KERNEL);
         if (!dev->vbi_mode.bulk_ctl.transfer_buffer) {
                 dev_err(dev->dev,
                         "cannot allocate memory for usbtransfer\n");
diff --git a/drivers/media/usb/go7007/go7007-fw.c b/drivers/media/usb/go7007/go7007-fw.c
index 87b4fc48ef09..24f5b615dc7a 100644
--- a/drivers/media/usb/go7007/go7007-fw.c
+++ b/drivers/media/usb/go7007/go7007-fw.c
@@ -1579,7 +1579,7 @@ int go7007_construct_fw_image(struct go7007 *go, u8 **fw, int *fwlen)
                         GO7007_FW_NAME);
                 return -1;
         }
-        code = kzalloc(codespace * 2, GFP_KERNEL);
+        code = kcalloc(codespace, 2, GFP_KERNEL);
         if (code == NULL)
                 goto fw_failed;
 
diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index ed9bcaf08d5e..19c6a0354ce0 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1143,7 +1143,8 @@ static int go7007_usb_probe(struct usb_interface *intf,
         usb->intr_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (usb->intr_urb == NULL)
                 goto allocfail;
-        usb->intr_urb->transfer_buffer = kmalloc(2*sizeof(u16), GFP_KERNEL);
+        usb->intr_urb->transfer_buffer = kmalloc_array(2, sizeof(u16),
+                                                       GFP_KERNEL);
         if (usb->intr_urb->transfer_buffer == NULL)
                 goto allocfail;
 
diff --git a/drivers/media/usb/gspca/t613.c b/drivers/media/usb/gspca/t613.c
index 0ae557cd15ef..445782919446 100644
--- a/drivers/media/usb/gspca/t613.c
+++ b/drivers/media/usb/gspca/t613.c
@@ -363,7 +363,7 @@ static void reg_w_ixbuf(struct gspca_dev *gspca_dev,
         if (len * 2 <= USB_BUF_SZ) {
                 p = tmpbuf = gspca_dev->usb_buf;
         } else {
-                p = tmpbuf = kmalloc(len * 2, GFP_KERNEL);
+                p = tmpbuf = kmalloc_array(len, 2, GFP_KERNEL);
                 if (!tmpbuf) {
                         pr_err("Out of memory\n");
                         return;
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
index e0353161ccd6..a8519da0020b 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
@@ -2413,7 +2413,7 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
 
         hdw->control_cnt = CTRLDEF_COUNT;
         hdw->control_cnt += MPEGDEF_COUNT;
-        hdw->controls = kzalloc(sizeof(struct pvr2_ctrl) * hdw->control_cnt,
+        hdw->controls = kcalloc(hdw->control_cnt, sizeof(struct pvr2_ctrl),
                                 GFP_KERNEL);
         if (!hdw->controls) goto fail;
         hdw->hdw_desc = hdw_desc;
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-std.c b/drivers/media/usb/pvrusb2/pvrusb2-std.c
index 21bb20dba82c..6b651f8b54df 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-std.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-std.c
@@ -361,7 +361,7 @@ struct v4l2_standard *pvr2_std_create_enum(unsigned int *countptr,
                    std_cnt);
         if (!std_cnt) return NULL; // paranoia
 
-        stddefs = kzalloc(sizeof(struct v4l2_standard) * std_cnt,
+        stddefs = kcalloc(std_cnt, sizeof(struct v4l2_standard),
                           GFP_KERNEL);
         if (!stddefs)
                 return NULL;
diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c
index 72bd893c9659..468f5ccf4ae6 100644
--- a/drivers/media/usb/stk1160/stk1160-core.c
+++ b/drivers/media/usb/stk1160/stk1160-core.c
@@ -290,8 +290,9 @@ static int stk1160_probe(struct usb_interface *interface,
                 return -ENODEV;
 
         /* Alloc an array for all possible max_pkt_size */
-        alt_max_pkt_size = kmalloc(sizeof(alt_max_pkt_size[0]) *
-                        interface->num_altsetting, GFP_KERNEL);
+        alt_max_pkt_size = kmalloc_array(interface->num_altsetting,
+                                         sizeof(alt_max_pkt_size[0]),
+                                         GFP_KERNEL);
         if (alt_max_pkt_size == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/media/usb/stk1160/stk1160-video.c b/drivers/media/usb/stk1160/stk1160-video.c
index 423c03a0638d..2811f612820f 100644
--- a/drivers/media/usb/stk1160/stk1160-video.c
+++ b/drivers/media/usb/stk1160/stk1160-video.c
@@ -439,14 +439,14 @@ int stk1160_alloc_isoc(struct stk1160 *dev)
 
         dev->isoc_ctl.buf = NULL;
         dev->isoc_ctl.max_pkt_size = dev->max_pkt_size;
-        dev->isoc_ctl.urb = kzalloc(sizeof(void *)*num_bufs, GFP_KERNEL);
+        dev->isoc_ctl.urb = kcalloc(num_bufs, sizeof(void *), GFP_KERNEL);
         if (!dev->isoc_ctl.urb) {
                 stk1160_err("out of memory for urb array\n");
                 return -ENOMEM;
         }
 
-        dev->isoc_ctl.transfer_buffer = kzalloc(sizeof(void *)*num_bufs,
-                                              GFP_KERNEL);
+        dev->isoc_ctl.transfer_buffer = kcalloc(num_bufs, sizeof(void *),
+                                                GFP_KERNEL);
         if (!dev->isoc_ctl.transfer_buffer) {
                 stk1160_err("out of memory for usb transfers\n");
                 kfree(dev->isoc_ctl.urb);
diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
index 22389b56ec24..5accb5241072 100644
--- a/drivers/media/usb/stkwebcam/stk-webcam.c
+++ b/drivers/media/usb/stkwebcam/stk-webcam.c
@@ -567,8 +567,9 @@ static int stk_prepare_sio_buffers(struct stk_camera *dev, unsigned n_sbufs)
         if (dev->sio_bufs != NULL)
                 pr_err("sio_bufs already allocated\n");
         else {
-                dev->sio_bufs = kzalloc(n_sbufs * sizeof(struct stk_sio_buffer),
-                                GFP_KERNEL);
+                dev->sio_bufs = kcalloc(n_sbufs,
+                                        sizeof(struct stk_sio_buffer),
+                                        GFP_KERNEL);
                 if (dev->sio_bufs == NULL)
                         return -ENOMEM;
                 for (i = 0; i < n_sbufs; i++) {
diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c
index aa85fe31c835..96055de6e8ce 100644
--- a/drivers/media/usb/tm6000/tm6000-video.c
+++ b/drivers/media/usb/tm6000/tm6000-video.c
@@ -463,11 +463,12 @@ static int tm6000_alloc_urb_buffers(struct tm6000_core *dev)
         if (dev->urb_buffer)
                 return 0;
 
-        dev->urb_buffer = kmalloc(sizeof(void *)*num_bufs, GFP_KERNEL);
+        dev->urb_buffer = kmalloc_array(num_bufs, sizeof(void *), GFP_KERNEL);
         if (!dev->urb_buffer)
                 return -ENOMEM;
 
-        dev->urb_dma = kmalloc(sizeof(dma_addr_t *)*num_bufs, GFP_KERNEL);
+        dev->urb_dma = kmalloc_array(num_bufs, sizeof(dma_addr_t *),
+                                     GFP_KERNEL);
         if (!dev->urb_dma)
                 return -ENOMEM;
 
@@ -583,12 +584,14 @@ static int tm6000_prepare_isoc(struct tm6000_core *dev)
 
         dev->isoc_ctl.num_bufs = num_bufs;
 
-        dev->isoc_ctl.urb = kmalloc(sizeof(void *)*num_bufs, GFP_KERNEL);
+        dev->isoc_ctl.urb = kmalloc_array(num_bufs, sizeof(void *),
+                                          GFP_KERNEL);
         if (!dev->isoc_ctl.urb)
                 return -ENOMEM;
 
-        dev->isoc_ctl.transfer_buffer = kmalloc(sizeof(void *)*num_bufs,
-                                   GFP_KERNEL);
+        dev->isoc_ctl.transfer_buffer = kmalloc_array(num_bufs,
+                                                      sizeof(void *),
+                                                      GFP_KERNEL);
         if (!dev->isoc_ctl.transfer_buffer) {
                 kfree(dev->isoc_ctl.urb);
                 return -ENOMEM;
diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c
index ce79df643c7e..36a9a4017185 100644
--- a/drivers/media/usb/usbtv/usbtv-video.c
+++ b/drivers/media/usb/usbtv/usbtv-video.c
@@ -507,7 +507,7 @@ static struct urb *usbtv_setup_iso_transfer(struct usbtv *usbtv)
         ip->pipe = usb_rcvisocpipe(usbtv->udev, USBTV_VIDEO_ENDP);
         ip->interval = 1;
         ip->transfer_flags = URB_ISO_ASAP;
-        ip->transfer_buffer = kzalloc(size * USBTV_ISOC_PACKETS,
+        ip->transfer_buffer = kcalloc(USBTV_ISOC_PACKETS, size,
                                                 GFP_KERNEL);
         if (!ip->transfer_buffer) {
                 usb_free_urb(ip);
diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
index 0f5954a1fea2..f29d1bef0293 100644
--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -1492,7 +1492,8 @@ static int usbvision_probe(struct usb_interface *intf,
 
         usbvision->num_alt = uif->num_altsetting;
         PDEBUG(DBG_PROBE, "Alternate settings: %i", usbvision->num_alt);
-        usbvision->alt_max_pkt_size = kmalloc(32 * usbvision->num_alt, GFP_KERNEL);
+        usbvision->alt_max_pkt_size = kmalloc_array(32, usbvision->num_alt,
+                                                    GFP_KERNEL);
         if (!usbvision->alt_max_pkt_size) {
                 ret = -ENOMEM;
                 goto err_pkt;
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index b28c997a7ab0..a88b2e51a666 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -513,8 +513,8 @@ static int uvc_video_clock_init(struct uvc_streaming *stream)
         spin_lock_init(&clock->lock);
         clock->size = 32;
 
-        clock->samples = kmalloc(clock->size * sizeof(*clock->samples),
-                                 GFP_KERNEL);
+        clock->samples = kmalloc_array(clock->size, sizeof(*clock->samples),
+                                       GFP_KERNEL);
         if (clock->samples == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
index 968c2eb08b5a..127fe6eb91d9 100644
--- a/drivers/media/v4l2-core/v4l2-event.c
+++ b/drivers/media/v4l2-core/v4l2-event.c
@@ -215,8 +215,7 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
         if (elems < 1)
                 elems = 1;
 
-        sev = kvzalloc(sizeof(*sev) + sizeof(struct v4l2_kevent) * elems,
-                       GFP_KERNEL);
+        sev = kvzalloc(struct_size(sev, events, elems), GFP_KERNEL);
         if (!sev)
                 return -ENOMEM;
         for (i = 0; i < elems; i++)
diff --git a/drivers/media/v4l2-core/v4l2-flash-led-class.c b/drivers/media/v4l2-core/v4l2-flash-led-class.c
index 4ceef217de83..215b4804ada2 100644
--- a/drivers/media/v4l2-core/v4l2-flash-led-class.c
+++ b/drivers/media/v4l2-core/v4l2-flash-led-class.c
@@ -412,9 +412,10 @@ static int v4l2_flash_init_controls(struct v4l2_flash *v4l2_flash,
         struct v4l2_ctrl_config *ctrl_cfg;
         int i, ret, num_ctrls = 0;
 
-        v4l2_flash->ctrls = devm_kzalloc(v4l2_flash->sd.dev,
-                                        sizeof(*v4l2_flash->ctrls) *
-                                        (STROBE_SOURCE + 1), GFP_KERNEL);
+        v4l2_flash->ctrls = devm_kcalloc(v4l2_flash->sd.dev,
+                                        STROBE_SOURCE + 1,
+                                        sizeof(*v4l2_flash->ctrls),
+                                        GFP_KERNEL);
         if (!v4l2_flash->ctrls)
                 return -ENOMEM;
 
diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
index 2e5c346f9c30..08929c087e27 100644
--- a/drivers/media/v4l2-core/videobuf-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
@@ -69,7 +69,7 @@ static struct scatterlist *videobuf_vmalloc_to_sg(unsigned char *virt,
         struct page *pg;
         int i;
 
-        sglist = vzalloc(nr_pages * sizeof(*sglist));
+        sglist = vzalloc(array_size(nr_pages, sizeof(*sglist)));
         if (NULL == sglist)
                 return NULL;
         sg_init_table(sglist, nr_pages);
@@ -100,7 +100,7 @@ static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
 
         if (NULL == pages[0])
                 return NULL;
-        sglist = vmalloc(nr_pages * sizeof(*sglist));
+        sglist = vmalloc(array_size(nr_pages, sizeof(*sglist)));
         if (NULL == sglist)
                 return NULL;
         sg_init_table(sglist, nr_pages);
@@ -175,7 +175,8 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
         dma->offset = data & ~PAGE_MASK;
         dma->size = size;
         dma->nr_pages = last-first+1;
-        dma->pages = kmalloc(dma->nr_pages * sizeof(struct page *), GFP_KERNEL);
+        dma->pages = kmalloc_array(dma->nr_pages, sizeof(struct page *),
+                                   GFP_KERNEL);
         if (NULL == dma->pages)
                 return -ENOMEM;
 
diff --git a/drivers/memory/of_memory.c b/drivers/memory/of_memory.c
index 568f05ed961a..2f5ed7366eec 100644
--- a/drivers/memory/of_memory.c
+++ b/drivers/memory/of_memory.c
@@ -126,8 +126,8 @@ const struct lpddr2_timings *of_get_ddr_timings(struct device_node *np_ddr,
                         arr_sz++;
 
         if (arr_sz)
-                timings = devm_kzalloc(dev, sizeof(*timings) * arr_sz,
-                        GFP_KERNEL);
+                timings = devm_kcalloc(dev, arr_sz, sizeof(*timings),
+                                       GFP_KERNEL);
 
         if (!timings)
                 goto default_timings;
diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index a15181fa45f7..716fc8ed31d3 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -1201,7 +1201,8 @@ static int msb_read_boot_blocks(struct msb_data *msb)
         dbg_verbose("Start of a scan for the boot blocks");
 
         if (!msb->boot_page) {
-                page = kmalloc(sizeof(struct ms_boot_page)*2, GFP_KERNEL);
+                page = kmalloc_array(2, sizeof(struct ms_boot_page),
+                                     GFP_KERNEL);
                 if (!page)
                         return -ENOMEM;
 
@@ -1341,7 +1342,8 @@ static int msb_ftl_initialize(struct msb_data *msb)
         msb->used_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL);
         msb->erased_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL);
         msb->lba_to_pba_table =
-                kmalloc(msb->logical_block_count * sizeof(u16), GFP_KERNEL);
+                kmalloc_array(msb->logical_block_count, sizeof(u16),
+                              GFP_KERNEL);
 
         if (!msb->used_blocks_bitmap || !msb->lba_to_pba_table ||
                                                 !msb->erased_blocks_bitmap) {
diff --git a/drivers/message/fusion/mptlan.c b/drivers/message/fusion/mptlan.c
index 4cbed4d06aa7..ebc00d47abf5 100644
--- a/drivers/message/fusion/mptlan.c
+++ b/drivers/message/fusion/mptlan.c
@@ -394,7 +394,8 @@ mpt_lan_open(struct net_device *dev)
                                 "a moment.\n");
         }
 
-        priv->mpt_txfidx = kmalloc(priv->tx_max_out * sizeof(int), GFP_KERNEL);
+        priv->mpt_txfidx = kmalloc_array(priv->tx_max_out, sizeof(int),
+                                         GFP_KERNEL);
         if (priv->mpt_txfidx == NULL)
                 goto out;
         priv->mpt_txfidx_tail = -1;
@@ -408,8 +409,8 @@ mpt_lan_open(struct net_device *dev)
 
         dlprintk((KERN_INFO MYNAM "@lo: Finished initializing SendCtl\n"));
 
-        priv->mpt_rxfidx = kmalloc(priv->max_buckets_out * sizeof(int),
-                                   GFP_KERNEL);
+        priv->mpt_rxfidx = kmalloc_array(priv->max_buckets_out, sizeof(int),
+                                         GFP_KERNEL);
         if (priv->mpt_rxfidx == NULL)
                 goto out_SendCtl;
         priv->mpt_rxfidx_tail = -1;
diff --git a/drivers/mfd/ab8500-debugfs.c b/drivers/mfd/ab8500-debugfs.c
index 831a1ceb2ed2..8d652b2f9d14 100644
--- a/drivers/mfd/ab8500-debugfs.c
+++ b/drivers/mfd/ab8500-debugfs.c
@@ -2659,18 +2659,18 @@ static int ab8500_debug_probe(struct platform_device *plf)
         ab8500 = dev_get_drvdata(plf->dev.parent);
         num_irqs = ab8500->mask_size;
 
-        irq_count = devm_kzalloc(&plf->dev,
-                                 sizeof(*irq_count)*num_irqs, GFP_KERNEL);
+        irq_count = devm_kcalloc(&plf->dev,
+                                 num_irqs, sizeof(*irq_count), GFP_KERNEL);
         if (!irq_count)
                 return -ENOMEM;
 
-        dev_attr = devm_kzalloc(&plf->dev,
-                                sizeof(*dev_attr)*num_irqs, GFP_KERNEL);
+        dev_attr = devm_kcalloc(&plf->dev,
+                                num_irqs, sizeof(*dev_attr), GFP_KERNEL);
         if (!dev_attr)
                 return -ENOMEM;
 
-        event_name = devm_kzalloc(&plf->dev,
-                                  sizeof(*event_name)*num_irqs, GFP_KERNEL);
+        event_name = devm_kcalloc(&plf->dev,
+                                  num_irqs, sizeof(*event_name), GFP_KERNEL);
         if (!event_name)
                 return -ENOMEM;
 
diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c
index 4199cdd4ff89..306e1fd109bd 100644
--- a/drivers/mfd/cros_ec_dev.c
+++ b/drivers/mfd/cros_ec_dev.c
@@ -299,13 +299,14 @@ static void cros_ec_sensors_register(struct cros_ec_dev *ec)
         resp = (struct ec_response_motion_sense *)msg->data;
         sensor_num = resp->dump.sensor_count;
         /* Allocate 1 extra sensors in FIFO are needed */
-        sensor_cells = kzalloc(sizeof(struct mfd_cell) * (sensor_num + 1),
+        sensor_cells = kcalloc(sensor_num + 1, sizeof(struct mfd_cell),
                                GFP_KERNEL);
         if (sensor_cells == NULL)
                 goto error;
 
-        sensor_platforms = kzalloc(sizeof(struct cros_ec_sensor_platform) *
-                  (sensor_num + 1), GFP_KERNEL);
+        sensor_platforms = kcalloc(sensor_num + 1,
+                                   sizeof(struct cros_ec_sensor_platform),
+                                   GFP_KERNEL);
         if (sensor_platforms == NULL)
                 goto error_platforms;
 
diff --git a/drivers/mfd/htc-i2cpld.c b/drivers/mfd/htc-i2cpld.c
index 4bf8b7781c77..01572b5e79e8 100644
--- a/drivers/mfd/htc-i2cpld.c
+++ b/drivers/mfd/htc-i2cpld.c
@@ -477,7 +477,9 @@ static int htcpld_setup_chips(struct platform_device *pdev)
 
         /* Setup each chip's output GPIOs */
         htcpld->nchips = pdata->num_chip;
-        htcpld->chip = devm_kzalloc(dev, sizeof(struct htcpld_chip) * htcpld->nchips,
+        htcpld->chip = devm_kcalloc(dev,
+                                    htcpld->nchips,
+                                    sizeof(struct htcpld_chip),
                                     GFP_KERNEL);
         if (!htcpld->chip)
                 return -ENOMEM;
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index c57e407020f1..94e3f32ce935 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -158,7 +158,7 @@ static int mfd_add_device(struct device *parent, int id,
         if (!pdev)
                 goto fail_alloc;
 
-        res = kzalloc(sizeof(*res) * cell->num_resources, GFP_KERNEL);
+        res = kcalloc(cell->num_resources, sizeof(*res), GFP_KERNEL);
         if (!res)
                 goto fail_device;
 
diff --git a/drivers/mfd/motorola-cpcap.c b/drivers/mfd/motorola-cpcap.c
index d2cc1eabac05..5276911caaec 100644
--- a/drivers/mfd/motorola-cpcap.c
+++ b/drivers/mfd/motorola-cpcap.c
@@ -173,9 +173,9 @@ static int cpcap_init_irq(struct cpcap_ddata *cpcap)
         int ret;
 
         cpcap->irqs = devm_kzalloc(&cpcap->spi->dev,
-                                   sizeof(*cpcap->irqs) *
-                                   CPCAP_NR_IRQ_REG_BANKS *
-                                   cpcap->regmap_conf->val_bits,
+                                   array3_size(sizeof(*cpcap->irqs),
+                                               CPCAP_NR_IRQ_REG_BANKS,
+                                               cpcap->regmap_conf->val_bits),
                                    GFP_KERNEL);
         if (!cpcap->irqs)
                 return -ENOMEM;
diff --git a/drivers/mfd/sprd-sc27xx-spi.c b/drivers/mfd/sprd-sc27xx-spi.c
index 3460ef07623c..69df27769c21 100644
--- a/drivers/mfd/sprd-sc27xx-spi.c
+++ b/drivers/mfd/sprd-sc27xx-spi.c
@@ -199,8 +199,9 @@ static int sprd_pmic_probe(struct spi_device *spi)
         ddata->irq_chip.num_irqs = pdata->num_irqs;
         ddata->irq_chip.mask_invert = true;
 
-        ddata->irqs = devm_kzalloc(&spi->dev, sizeof(struct regmap_irq) *
-                                   pdata->num_irqs, GFP_KERNEL);
+        ddata->irqs = devm_kcalloc(&spi->dev,
+                                   pdata->num_irqs, sizeof(struct regmap_irq),
+                                   GFP_KERNEL);
         if (!ddata->irqs)
                 return -ENOMEM;
 
diff --git a/drivers/mfd/timberdale.c b/drivers/mfd/timberdale.c
index 7c13d2e7061c..05ecf828b2ab 100644
--- a/drivers/mfd/timberdale.c
+++ b/drivers/mfd/timberdale.c
@@ -707,8 +707,8 @@ static int timb_probe(struct pci_dev *dev,
                 goto err_config;
         }
 
-        msix_entries = kzalloc(TIMBERDALE_NR_IRQS * sizeof(*msix_entries),
-                GFP_KERNEL);
+        msix_entries = kcalloc(TIMBERDALE_NR_IRQS, sizeof(*msix_entries),
+                               GFP_KERNEL);
         if (!msix_entries)
                 goto err_config;
 
diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index c649344fd7f2..4be3d239da9e 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -1139,8 +1139,9 @@ twl_probe(struct i2c_client *client, const struct i2c_device_id *id)
         }
 
         num_slaves = twl_get_num_slaves();
-        twl_priv->twl_modules = devm_kzalloc(&client->dev,
-                                         sizeof(struct twl_client) * num_slaves,
+        twl_priv->twl_modules = devm_kcalloc(&client->dev,
+                                         num_slaves,
+                                         sizeof(struct twl_client),
                                          GFP_KERNEL);
         if (!twl_priv->twl_modules) {
                 status = -ENOMEM;
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index 953d0790ffd5..5d5888ee2966 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -368,9 +368,10 @@ static int wm8994_device_init(struct wm8994 *wm8994, int irq)
                 goto err;
         }
 
-        wm8994->supplies = devm_kzalloc(wm8994->dev,
-                                        sizeof(struct regulator_bulk_data) *
-                                        wm8994->num_supplies, GFP_KERNEL);
+        wm8994->supplies = devm_kcalloc(wm8994->dev,
+                                        wm8994->num_supplies,
+                                        sizeof(struct regulator_bulk_data),
+                                        GFP_KERNEL);
         if (!wm8994->supplies) {
                 ret = -ENOMEM;
                 goto err;
diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c
index f53e217e963f..ef83a9078646 100644
--- a/drivers/misc/altera-stapl/altera.c
+++ b/drivers/misc/altera-stapl/altera.c
@@ -304,13 +304,13 @@ static int altera_execute(struct altera_state *astate,
         if (sym_count <= 0)
                 goto exit_done;
 
-        vars = kzalloc(sym_count * sizeof(long), GFP_KERNEL);
+        vars = kcalloc(sym_count, sizeof(long), GFP_KERNEL);
 
         if (vars == NULL)
                 status = -ENOMEM;
 
         if (status == 0) {
-                var_size = kzalloc(sym_count * sizeof(s32), GFP_KERNEL);
+                var_size = kcalloc(sym_count, sizeof(s32), GFP_KERNEL);
 
                 if (var_size == NULL)
                         status = -ENOMEM;
@@ -1136,7 +1136,7 @@ exit_done:
                                 /* Allocate a writable buffer for this array */
                                 count = var_size[variable_id];
                                 long_tmp = vars[variable_id];
-                                longptr_tmp = kzalloc(count * sizeof(long),
+                                longptr_tmp = kcalloc(count, sizeof(long),
                                                                 GFP_KERNEL);
                                 vars[variable_id] = (long)longptr_tmp;
 
diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c
index f58b4b6c79f2..4644f16606a3 100644
--- a/drivers/misc/cxl/guest.c
+++ b/drivers/misc/cxl/guest.c
@@ -89,7 +89,7 @@ static ssize_t guest_collect_vpd(struct cxl *adapter, struct cxl_afu *afu,
                 mod = 0;
         }
 
-        vpd_buf = kzalloc(entries * sizeof(unsigned long *), GFP_KERNEL);
+        vpd_buf = kcalloc(entries, sizeof(unsigned long *), GFP_KERNEL);
         if (!vpd_buf)
                 return -ENOMEM;
 
diff --git a/drivers/misc/cxl/of.c b/drivers/misc/cxl/of.c
index ec175ea5dfba..aff181cd0bf2 100644
--- a/drivers/misc/cxl/of.c
+++ b/drivers/misc/cxl/of.c
@@ -302,7 +302,7 @@ static int read_adapter_irq_config(struct cxl *adapter, struct device_node *np)
         if (nranges == 0 || (nranges * 2 * sizeof(int)) != len)
                 return -EINVAL;
 
-        adapter->guest->irq_avail = kzalloc(nranges * sizeof(struct irq_avail),
+        adapter->guest->irq_avail = kcalloc(nranges, sizeof(struct irq_avail),
                                             GFP_KERNEL);
         if (adapter->guest->irq_avail == NULL)
                 return -ENOMEM;
diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c
index 34a5a41578d7..59dc24bb70ec 100644
--- a/drivers/misc/eeprom/idt_89hpesx.c
+++ b/drivers/misc/eeprom/idt_89hpesx.c
@@ -964,7 +964,7 @@ static ssize_t idt_dbgfs_csr_write(struct file *filep, const char __user *ubuf,
         if (colon_ch != NULL) {
                 csraddr_len = colon_ch - buf;
                 csraddr_str =
-                        kmalloc(sizeof(char)*(csraddr_len + 1), GFP_KERNEL);
+                        kmalloc(csraddr_len + 1, GFP_KERNEL);
                 if (csraddr_str == NULL) {
                         ret = -ENOMEM;
                         goto free_buf;
diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
index b7f8d35c17a9..656449cb4476 100644
--- a/drivers/misc/genwqe/card_ddcb.c
+++ b/drivers/misc/genwqe/card_ddcb.c
@@ -1048,15 +1048,16 @@ static int setup_ddcb_queue(struct genwqe_dev *cd, struct ddcb_queue *queue)
                         "[%s] **err: could not allocate DDCB **\n", __func__);
                 return -ENOMEM;
         }
-        queue->ddcb_req = kzalloc(sizeof(struct ddcb_requ *) *
-                                  queue->ddcb_max, GFP_KERNEL);
+        queue->ddcb_req = kcalloc(queue->ddcb_max, sizeof(struct ddcb_requ *),
+                                  GFP_KERNEL);
         if (!queue->ddcb_req) {
                 rc = -ENOMEM;
                 goto free_ddcbs;
         }
 
-        queue->ddcb_waitqs = kzalloc(sizeof(wait_queue_head_t) *
-                                     queue->ddcb_max, GFP_KERNEL);
+        queue->ddcb_waitqs = kcalloc(queue->ddcb_max,
+                                     sizeof(wait_queue_head_t),
+                                     GFP_KERNEL);
         if (!queue->ddcb_waitqs) {
                 rc = -ENOMEM;
                 goto free_requs;
diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
index 0c775d6fcf59..83fc748a91a7 100644
--- a/drivers/misc/sgi-xp/xpc_main.c
+++ b/drivers/misc/sgi-xp/xpc_main.c
@@ -416,7 +416,8 @@ xpc_setup_ch_structures(struct xpc_partition *part)
          * memory.
          */
         DBUG_ON(part->channels != NULL);
-        part->channels = kzalloc(sizeof(struct xpc_channel) * XPC_MAX_NCHANNELS,
+        part->channels = kcalloc(XPC_MAX_NCHANNELS,
+                                 sizeof(struct xpc_channel),
                                  GFP_KERNEL);
         if (part->channels == NULL) {
                 dev_err(xpc_chan, "can't get memory for channels\n");
@@ -905,8 +906,9 @@ xpc_setup_partitions(void)
         short partid;
         struct xpc_partition *part;
 
-        xpc_partitions = kzalloc(sizeof(struct xpc_partition) *
-                                 xp_max_npartitions, GFP_KERNEL);
+        xpc_partitions = kcalloc(xp_max_npartitions,
+                                 sizeof(struct xpc_partition),
+                                 GFP_KERNEL);
         if (xpc_partitions == NULL) {
                 dev_err(xpc_part, "can't get memory for partition structure\n");
                 return -ENOMEM;
diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
index 6956f7e7d439..7284413dabfd 100644
--- a/drivers/misc/sgi-xp/xpc_partition.c
+++ b/drivers/misc/sgi-xp/xpc_partition.c
@@ -425,7 +425,7 @@ xpc_discovery(void)
         if (remote_rp == NULL)
                 return;
 
-        discovered_nasids = kzalloc(sizeof(long) * xpc_nasid_mask_nlongs,
+        discovered_nasids = kcalloc(xpc_nasid_mask_nlongs, sizeof(long),
                                     GFP_KERNEL);
         if (discovered_nasids == NULL) {
                 kfree(remote_rp_base);
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index 216d5c756236..44d750d98bc8 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -520,8 +520,9 @@ xpnet_init(void)
 
         dev_info(xpnet, "registering network device %s\n", XPNET_DEVICE_NAME);
 
-        xpnet_broadcast_partitions = kzalloc(BITS_TO_LONGS(xp_max_npartitions) *
-                                             sizeof(long), GFP_KERNEL);
+        xpnet_broadcast_partitions = kcalloc(BITS_TO_LONGS(xp_max_npartitions),
+                                             sizeof(long),
+                                             GFP_KERNEL);
         if (xpnet_broadcast_partitions == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
index fc0415771c00..c5dc6095686a 100644
--- a/drivers/misc/sram.c
+++ b/drivers/misc/sram.c
@@ -185,7 +185,7 @@ static int sram_reserve_regions(struct sram_dev *sram, struct resource *res)
          * after the reserved blocks from the dt are processed.
          */
         nblocks = (np) ? of_get_available_child_count(np) + 1 : 1;
-        rblocks = kzalloc((nblocks) * sizeof(*rblocks), GFP_KERNEL);
+        rblocks = kcalloc(nblocks, sizeof(*rblocks), GFP_KERNEL);
         if (!rblocks)
                 return -ENOMEM;
 
@@ -264,8 +264,8 @@ static int sram_reserve_regions(struct sram_dev *sram, struct resource *res)
         list_sort(NULL, &reserve_list, sram_reserve_cmp);
 
         if (exports) {
-                sram->partition = devm_kzalloc(sram->dev,
-                                       exports * sizeof(*sram->partition),
+                sram->partition = devm_kcalloc(sram->dev,
+                                       exports, sizeof(*sram->partition),
                                        GFP_KERNEL);
                 if (!sram->partition) {
                         ret = -ENOMEM;
diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index 0339538c182d..b4d7774cfe07 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -449,12 +449,14 @@ static int qp_alloc_ppn_set(void *prod_q,
                 return VMCI_ERROR_ALREADY_EXISTS;
 
         produce_ppns =
-            kmalloc(num_produce_pages * sizeof(*produce_ppns), GFP_KERNEL);
+            kmalloc_array(num_produce_pages, sizeof(*produce_ppns),
+                          GFP_KERNEL);
         if (!produce_ppns)
                 return VMCI_ERROR_NO_MEM;
 
         consume_ppns =
-            kmalloc(num_consume_pages * sizeof(*consume_ppns), GFP_KERNEL);
+            kmalloc_array(num_consume_pages, sizeof(*consume_ppns),
+                          GFP_KERNEL);
         if (!consume_ppns) {
                 kfree(produce_ppns);
                 return VMCI_ERROR_NO_MEM;
diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
index f3a7c8ece4be..88347ce78f23 100644
--- a/drivers/mmc/host/sdhci-omap.c
+++ b/drivers/mmc/host/sdhci-omap.c
@@ -797,8 +797,10 @@ static int sdhci_omap_config_iodelay_pinctrl_state(struct sdhci_omap_host
         if (!(omap_host->flags & SDHCI_OMAP_REQUIRE_IODELAY))
                 return 0;
 
-        pinctrl_state = devm_kzalloc(dev, sizeof(*pinctrl_state) *
-                                     (MMC_TIMING_MMC_HS200 + 1), GFP_KERNEL);
+        pinctrl_state = devm_kcalloc(dev,
+                                     MMC_TIMING_MMC_HS200 + 1,
+                                     sizeof(*pinctrl_state),
+                                     GFP_KERNEL);
         if (!pinctrl_state)
                 return -ENOMEM;
 
diff --git a/drivers/mtd/ar7part.c b/drivers/mtd/ar7part.c
index 90575deff0ae..fc15ec58230a 100644
--- a/drivers/mtd/ar7part.c
+++ b/drivers/mtd/ar7part.c
@@ -55,7 +55,7 @@ static int create_mtd_partitions(struct mtd_info *master,
         int retries = 10;
         struct mtd_partition *ar7_parts;
 
-        ar7_parts = kzalloc(sizeof(*ar7_parts) * AR7_PARTS, GFP_KERNEL);
+        ar7_parts = kcalloc(AR7_PARTS, sizeof(*ar7_parts), GFP_KERNEL);
         if (!ar7_parts)
                 return -ENOMEM;
         ar7_parts[0].name = "loader";
diff --git a/drivers/mtd/bcm47xxpart.c b/drivers/mtd/bcm47xxpart.c
index 0f93d2239352..fc424b185b08 100644
--- a/drivers/mtd/bcm47xxpart.c
+++ b/drivers/mtd/bcm47xxpart.c
@@ -110,7 +110,7 @@ static int bcm47xxpart_parse(struct mtd_info *master,
                 blocksize = 0x1000;
 
         /* Alloc */
-        parts = kzalloc(sizeof(struct mtd_partition) * BCM47XXPART_MAX_PARTS,
+        parts = kcalloc(BCM47XXPART_MAX_PARTS, sizeof(struct mtd_partition),
                         GFP_KERNEL);
         if (!parts)
                 return -ENOMEM;
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index f5695be14499..6e8e7b1bb34b 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -608,8 +608,9 @@ static struct mtd_info *cfi_intelext_setup(struct mtd_info *mtd)
         mtd->size = devsize * cfi->numchips;
 
         mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips;
-        mtd->eraseregions = kzalloc(sizeof(struct mtd_erase_region_info)
-                        * mtd->numeraseregions, GFP_KERNEL);
+        mtd->eraseregions = kcalloc(mtd->numeraseregions,
+                                    sizeof(struct mtd_erase_region_info),
+                                    GFP_KERNEL);
         if (!mtd->eraseregions)
                 goto setup_err;
 
@@ -758,7 +759,9 @@ static int cfi_intelext_partition_fixup(struct mtd_info *mtd,
                 newcfi = kmalloc(sizeof(struct cfi_private) + numvirtchips * sizeof(struct flchip), GFP_KERNEL);
                 if (!newcfi)
                         return -ENOMEM;
-                shared = kmalloc(sizeof(struct flchip_shared) * cfi->numchips, GFP_KERNEL);
+                shared = kmalloc_array(cfi->numchips,
+                                       sizeof(struct flchip_shared),
+                                       GFP_KERNEL);
                 if (!shared) {
                         kfree(newcfi);
                         return -ENOMEM;
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 7c889eca9ab0..a0c655628d6d 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -692,8 +692,9 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd)
         mtd->size = devsize * cfi->numchips;
 
         mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips;
-        mtd->eraseregions = kmalloc(sizeof(struct mtd_erase_region_info)
-                                    * mtd->numeraseregions, GFP_KERNEL);
+        mtd->eraseregions = kmalloc_array(mtd->numeraseregions,
+                                          sizeof(struct mtd_erase_region_info),
+                                          GFP_KERNEL);
         if (!mtd->eraseregions)
                 goto setup_err;
 
@@ -2635,7 +2636,7 @@ static int __maybe_unused cfi_ppb_unlock(struct mtd_info *mtd, loff_t ofs,
          * first check the locking status of all sectors and save
          * it for future use.
          */
-        sect = kzalloc(MAX_SECTORS * sizeof(struct ppb_lock), GFP_KERNEL);
+        sect = kcalloc(MAX_SECTORS, sizeof(struct ppb_lock), GFP_KERNEL);
         if (!sect)
                 return -ENOMEM;
 
diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
index 7b7658a05036..35aa72b720a6 100644
--- a/drivers/mtd/chips/cfi_cmdset_0020.c
+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
@@ -184,8 +184,9 @@ static struct mtd_info *cfi_staa_setup(struct map_info *map)
         mtd->size = devsize * cfi->numchips;
 
         mtd->numeraseregions = cfi->cfiq->NumEraseRegions * cfi->numchips;
-        mtd->eraseregions = kmalloc(sizeof(struct mtd_erase_region_info)
-                        * mtd->numeraseregions, GFP_KERNEL);
+        mtd->eraseregions = kmalloc_array(mtd->numeraseregions,
+                                          sizeof(struct mtd_erase_region_info),
+                                          GFP_KERNEL);
         if (!mtd->eraseregions) {
                 kfree(cfi->cmdset_priv);
                 kfree(mtd);
diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
index 802d8f159e90..512bd4c2eec0 100644
--- a/drivers/mtd/devices/docg3.c
+++ b/drivers/mtd/devices/docg3.c
@@ -1827,7 +1827,7 @@ doc_probe_device(struct docg3_cascade *cascade, int floor, struct device *dev)
         mtd->dev.parent = dev;
         bbt_nbpages = DIV_ROUND_UP(docg3->max_block + 1,
                                    8 * DOC_LAYOUT_PAGE_SIZE);
-        docg3->bbt = kzalloc(bbt_nbpages * DOC_LAYOUT_PAGE_SIZE, GFP_KERNEL);
+        docg3->bbt = kcalloc(DOC_LAYOUT_PAGE_SIZE, bbt_nbpages, GFP_KERNEL);
         if (!docg3->bbt)
                 goto nomem3;
 
@@ -1993,7 +1993,7 @@ static int __init docg3_probe(struct platform_device *pdev)
         base = devm_ioremap(dev, ress->start, DOC_IOSPACE_SIZE);
 
         ret = -ENOMEM;
-        cascade = devm_kzalloc(dev, sizeof(*cascade) * DOC_MAX_NBFLOORS,
+        cascade = devm_kcalloc(dev, DOC_MAX_NBFLOORS, sizeof(*cascade),
                                GFP_KERNEL);
         if (!cascade)
                 return ret;
diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
index ef6ad2551d57..2578f27914ef 100644
--- a/drivers/mtd/ftl.c
+++ b/drivers/mtd/ftl.c
@@ -201,15 +201,16 @@ static int build_maps(partition_t *part)
     /* Set up erase unit maps */
     part->DataUnits = le16_to_cpu(part->header.NumEraseUnits) -
         part->header.NumTransferUnits;
-    part->EUNInfo = kmalloc(part->DataUnits * sizeof(struct eun_info_t),
-                            GFP_KERNEL);
+    part->EUNInfo = kmalloc_array(part->DataUnits, sizeof(struct eun_info_t),
+                                  GFP_KERNEL);
     if (!part->EUNInfo)
             goto out;
     for (i = 0; i < part->DataUnits; i++)
         part->EUNInfo[i].Offset = 0xffffffff;
     part->XferInfo =
-        kmalloc(part->header.NumTransferUnits * sizeof(struct xfer_info_t),
-                GFP_KERNEL);
+        kmalloc_array(part->header.NumTransferUnits,
+                      sizeof(struct xfer_info_t),
+                      GFP_KERNEL);
     if (!part->XferInfo)
             goto out_EUNInfo;
 
@@ -262,15 +263,15 @@ static int build_maps(partition_t *part)
 
     /* Set up virtual page map */
     blocks = le32_to_cpu(header.FormattedSize) >> header.BlockSize;
-    part->VirtualBlockMap = vmalloc(blocks * sizeof(uint32_t));
+    part->VirtualBlockMap = vmalloc(array_size(blocks, sizeof(uint32_t)));
     if (!part->VirtualBlockMap)
             goto out_XferInfo;
 
     memset(part->VirtualBlockMap, 0xff, blocks * sizeof(uint32_t));
     part->BlocksPerUnit = (1 << header.EraseUnitSize) >> header.BlockSize;
 
-    part->bam_cache = kmalloc(part->BlocksPerUnit * sizeof(uint32_t),
-                              GFP_KERNEL);
+    part->bam_cache = kmalloc_array(part->BlocksPerUnit, sizeof(uint32_t),
+                                    GFP_KERNEL);
     if (!part->bam_cache)
             goto out_VirtualBlockMap;
 
diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
index 2d598412972d..10d977e9709d 100644
--- a/drivers/mtd/inftlmount.c
+++ b/drivers/mtd/inftlmount.c
@@ -270,7 +270,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
                 inftl->nb_blocks = ip->lastUnit + 1;
 
                 /* Memory alloc */
-                inftl->PUtable = kmalloc(inftl->nb_blocks * sizeof(u16), GFP_KERNEL);
+                inftl->PUtable = kmalloc_array(inftl->nb_blocks, sizeof(u16),
+                                               GFP_KERNEL);
                 if (!inftl->PUtable) {
                         printk(KERN_WARNING "INFTL: allocation of PUtable "
                                 "failed (%zd bytes)\n",
@@ -278,7 +279,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
                         return -ENOMEM;
                 }
 
-                inftl->VUtable = kmalloc(inftl->nb_blocks * sizeof(u16), GFP_KERNEL);
+                inftl->VUtable = kmalloc_array(inftl->nb_blocks, sizeof(u16),
+                                               GFP_KERNEL);
                 if (!inftl->VUtable) {
                         kfree(inftl->PUtable);
                         printk(KERN_WARNING "INFTL: allocation of VUtable "
diff --git a/drivers/mtd/lpddr/lpddr_cmds.c b/drivers/mtd/lpddr/lpddr_cmds.c
index 5c5ba3c7c79d..b13557fe52bd 100644
--- a/drivers/mtd/lpddr/lpddr_cmds.c
+++ b/drivers/mtd/lpddr/lpddr_cmds.c
@@ -78,7 +78,7 @@ struct mtd_info *lpddr_cmdset(struct map_info *map)
         mtd->erasesize = 1 << lpddr->qinfo->UniformBlockSizeShift;
         mtd->writesize = 1 << lpddr->qinfo->BufSizeShift;
 
-        shared = kmalloc(sizeof(struct flchip_shared) * lpddr->numchips,
+        shared = kmalloc_array(lpddr->numchips, sizeof(struct flchip_shared),
                                                 GFP_KERNEL);
         if (!shared) {
                 kfree(lpddr);
diff --git a/drivers/mtd/maps/physmap_of_core.c b/drivers/mtd/maps/physmap_of_core.c
index 527b1682381f..4129535b8e46 100644
--- a/drivers/mtd/maps/physmap_of_core.c
+++ b/drivers/mtd/maps/physmap_of_core.c
@@ -124,7 +124,7 @@ static const char * const *of_get_probes(struct device_node *dp)
         if (count < 0)
                 return part_probe_types_def;
 
-        res = kzalloc((count + 1) * sizeof(*res), GFP_KERNEL);
+        res = kcalloc(count + 1, sizeof(*res), GFP_KERNEL);
         if (!res)
                 return NULL;
 
@@ -197,7 +197,7 @@ static int of_flash_probe(struct platform_device *dev)
 
         dev_set_drvdata(&dev->dev, info);
 
-        mtd_list = kzalloc(sizeof(*mtd_list) * count, GFP_KERNEL);
+        mtd_list = kcalloc(count, sizeof(*mtd_list), GFP_KERNEL);
         if (!mtd_list)
                 goto err_flash_remove;
 
diff --git a/drivers/mtd/maps/vmu-flash.c b/drivers/mtd/maps/vmu-flash.c
index 6b223cfe92b7..c5d4b6589488 100644
--- a/drivers/mtd/maps/vmu-flash.c
+++ b/drivers/mtd/maps/vmu-flash.c
@@ -629,15 +629,15 @@ static int vmu_connect(struct maple_device *mdev)
         * Not sure there are actually any multi-partition devices in the
         * real world, but the hardware supports them, so, so will we
         */
-        card->parts = kmalloc(sizeof(struct vmupart) * card->partitions,
-                GFP_KERNEL);
+        card->parts = kmalloc_array(card->partitions, sizeof(struct vmupart),
+                                    GFP_KERNEL);
         if (!card->parts) {
                 error = -ENOMEM;
                 goto fail_partitions;
         }
 
-        card->mtd = kmalloc(sizeof(struct mtd_info) * card->partitions,
-                GFP_KERNEL);
+        card->mtd = kmalloc_array(card->partitions, sizeof(struct mtd_info),
+                                  GFP_KERNEL);
         if (!card->mtd) {
                 error = -ENOMEM;
                 goto fail_mtd_info;
diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 6b86d1a73cf2..cbc5925e6440 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -778,8 +778,9 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
                 concat->mtd.erasesize = max_erasesize;
                 concat->mtd.numeraseregions = num_erase_region;
                 concat->mtd.eraseregions = erase_region_p =
-                    kmalloc(num_erase_region *
-                            sizeof (struct mtd_erase_region_info), GFP_KERNEL);
+                    kmalloc_array(num_erase_region,
+                                  sizeof(struct mtd_erase_region_info),
+                                  GFP_KERNEL);
                 if (!erase_region_p) {
                         kfree(concat);
                         printk
diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
index 9f25111fd559..e078fc41aa61 100644
--- a/drivers/mtd/mtdoops.c
+++ b/drivers/mtd/mtdoops.c
@@ -330,8 +330,10 @@ static void mtdoops_notify_add(struct mtd_info *mtd)
         }
 
         /* oops_page_used is a bit field */
-        cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages,
-                        BITS_PER_LONG) * sizeof(unsigned long));
+        cxt->oops_page_used =
+                vmalloc(array_size(sizeof(unsigned long),
+                                   DIV_ROUND_UP(mtdoops_pages,
+                                                BITS_PER_LONG)));
         if (!cxt->oops_page_used) {
                 printk(KERN_ERR "mtdoops: could not allocate page array\n");
                 return;
diff --git a/drivers/mtd/mtdswap.c b/drivers/mtd/mtdswap.c
index 7161f8a17f62..d9dcb2d051b4 100644
--- a/drivers/mtd/mtdswap.c
+++ b/drivers/mtd/mtdswap.c
@@ -1317,11 +1317,11 @@ static int mtdswap_init(struct mtdswap_dev *d, unsigned int eblocks,
         for (i = 0; i < MTDSWAP_TREE_CNT; i++)
                 d->trees[i].root = RB_ROOT;
 
-        d->page_data = vmalloc(sizeof(int)*pages);
+        d->page_data = vmalloc(array_size(pages, sizeof(int)));
         if (!d->page_data)
                 goto page_data_fail;
 
-        d->revmap = vmalloc(sizeof(int)*blocks);
+        d->revmap = vmalloc(array_size(blocks, sizeof(int)));
         if (!d->revmap)
                 goto revmap_fail;
 
@@ -1340,7 +1340,7 @@ static int mtdswap_init(struct mtdswap_dev *d, unsigned int eblocks,
         if (!d->page_buf)
                 goto page_buf_fail;
 
-        d->oob_buf = kmalloc(2 * mtd->oobavail, GFP_KERNEL);
+        d->oob_buf = kmalloc_array(2, mtd->oobavail, GFP_KERNEL);
         if (!d->oob_buf)
                 goto oob_buf_fail;
 
diff --git a/drivers/mtd/nand/onenand/onenand_base.c b/drivers/mtd/nand/onenand/onenand_base.c
index b7105192cb12..4ca4b194e7d7 100644
--- a/drivers/mtd/nand/onenand/onenand_base.c
+++ b/drivers/mtd/nand/onenand/onenand_base.c
@@ -3721,8 +3721,10 @@ static int onenand_probe(struct mtd_info *mtd)
                 this->dies = ONENAND_IS_DDP(this) ? 2 : 1;
                 /* Maximum possible erase regions */
                 mtd->numeraseregions = this->dies << 1;
-                mtd->eraseregions = kzalloc(sizeof(struct mtd_erase_region_info)
-                                        * (this->dies << 1), GFP_KERNEL);
+                mtd->eraseregions =
+                        kcalloc(this->dies << 1,
+                                sizeof(struct mtd_erase_region_info),
+                                GFP_KERNEL);
                 if (!mtd->eraseregions)
                         return -ENOMEM;
         }
diff --git a/drivers/mtd/nand/raw/nand_bch.c b/drivers/mtd/nand/raw/nand_bch.c
index 7f11b68f6db1..b7387ace567a 100644
--- a/drivers/mtd/nand/raw/nand_bch.c
+++ b/drivers/mtd/nand/raw/nand_bch.c
@@ -186,7 +186,7 @@ struct nand_bch_control *nand_bch_init(struct mtd_info *mtd)
         }
 
         nbc->eccmask = kmalloc(eccbytes, GFP_KERNEL);
-        nbc->errloc = kmalloc(t*sizeof(*nbc->errloc), GFP_KERNEL);
+        nbc->errloc = kmalloc_array(t, sizeof(*nbc->errloc), GFP_KERNEL);
         if (!nbc->eccmask || !nbc->errloc)
                 goto fail;
         /*
diff --git a/drivers/mtd/nand/raw/nandsim.c b/drivers/mtd/nand/raw/nandsim.c
index e027c6f9d327..f8edacde49ab 100644
--- a/drivers/mtd/nand/raw/nandsim.c
+++ b/drivers/mtd/nand/raw/nandsim.c
@@ -565,8 +565,9 @@ static int __init alloc_device(struct nandsim *ns)
                         err = -EINVAL;
                         goto err_close;
                 }
-                ns->pages_written = vzalloc(BITS_TO_LONGS(ns->geom.pgnum) *
-                                            sizeof(unsigned long));
+                ns->pages_written =
+                        vzalloc(array_size(sizeof(unsigned long),
+                                           BITS_TO_LONGS(ns->geom.pgnum)));
                 if (!ns->pages_written) {
                         NS_ERR("alloc_device: unable to allocate pages written array\n");
                         err = -ENOMEM;
@@ -582,7 +583,7 @@ static int __init alloc_device(struct nandsim *ns)
                 return 0;
         }
 
-        ns->pages = vmalloc(ns->geom.pgnum * sizeof(union ns_mem));
+        ns->pages = vmalloc(array_size(sizeof(union ns_mem), ns->geom.pgnum));
         if (!ns->pages) {
                 NS_ERR("alloc_device: unable to allocate page array\n");
                 return -ENOMEM;
diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
index b554fb6e609c..6a5519f0ff25 100644
--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -2510,8 +2510,8 @@ static int qcom_nandc_alloc(struct qcom_nand_controller *nandc)
         if (!nandc->regs)
                 return -ENOMEM;
 
-        nandc->reg_read_buf = devm_kzalloc(nandc->dev,
-                                MAX_REG_RD * sizeof(*nandc->reg_read_buf),
+        nandc->reg_read_buf = devm_kcalloc(nandc->dev,
+                                MAX_REG_RD, sizeof(*nandc->reg_read_buf),
                                 GFP_KERNEL);
         if (!nandc->reg_read_buf)
                 return -ENOMEM;
diff --git a/drivers/mtd/nand/raw/s3c2410.c b/drivers/mtd/nand/raw/s3c2410.c
index 1bc0458063d8..19661c5d3220 100644
--- a/drivers/mtd/nand/raw/s3c2410.c
+++ b/drivers/mtd/nand/raw/s3c2410.c
@@ -1038,7 +1038,7 @@ static int s3c24xx_nand_probe_dt(struct platform_device *pdev)
         if (!pdata->nr_sets)
                 return 0;
 
-        sets = devm_kzalloc(&pdev->dev, sizeof(*sets) * pdata->nr_sets,
+        sets = devm_kcalloc(&pdev->dev, pdata->nr_sets, sizeof(*sets),
                             GFP_KERNEL);
         if (!sets)
                 return -ENOMEM;
diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
index 6281da3dadac..27184e3874db 100644
--- a/drivers/mtd/nftlmount.c
+++ b/drivers/mtd/nftlmount.c
@@ -199,13 +199,16 @@ device is already correct.
                 nftl->lastEUN = nftl->nb_blocks - 1;
 
                 /* memory alloc */
-                nftl->EUNtable = kmalloc(nftl->nb_blocks * sizeof(u16), GFP_KERNEL);
+                nftl->EUNtable = kmalloc_array(nftl->nb_blocks, sizeof(u16),
+                                               GFP_KERNEL);
                 if (!nftl->EUNtable) {
                         printk(KERN_NOTICE "NFTL: allocation of EUNtable failed\n");
                         return -ENOMEM;
                 }
 
-                nftl->ReplUnitTable = kmalloc(nftl->nb_blocks * sizeof(u16), GFP_KERNEL);
+                nftl->ReplUnitTable = kmalloc_array(nftl->nb_blocks,
+                                                    sizeof(u16),
+                                                    GFP_KERNEL);
                 if (!nftl->ReplUnitTable) {
                         kfree(nftl->EUNtable);
                         printk(KERN_NOTICE "NFTL: allocation of ReplUnitTable failed\n");
diff --git a/drivers/mtd/ofpart.c b/drivers/mtd/ofpart.c
index 615f8c173162..6b21a92d3622 100644
--- a/drivers/mtd/ofpart.c
+++ b/drivers/mtd/ofpart.c
@@ -71,7 +71,7 @@ static int parse_fixed_partitions(struct mtd_info *master,
         if (nr_parts == 0)
                 return 0;
 
-        parts = kzalloc(nr_parts * sizeof(*parts), GFP_KERNEL);
+        parts = kcalloc(nr_parts, sizeof(*parts), GFP_KERNEL);
         if (!parts)
                 return -ENOMEM;
 
@@ -177,7 +177,7 @@ static int parse_ofoldpart_partitions(struct mtd_info *master,
 
         nr_parts = plen / sizeof(part[0]);
 
-        parts = kzalloc(nr_parts * sizeof(*parts), GFP_KERNEL);
+        parts = kcalloc(nr_parts, sizeof(*parts), GFP_KERNEL);
         if (!parts)
                 return -ENOMEM;
 
diff --git a/drivers/mtd/parsers/parser_trx.c b/drivers/mtd/parsers/parser_trx.c
index df360a75e1eb..17ac33599783 100644
--- a/drivers/mtd/parsers/parser_trx.c
+++ b/drivers/mtd/parsers/parser_trx.c
@@ -62,7 +62,7 @@ static int parser_trx_parse(struct mtd_info *mtd,
         uint8_t curr_part = 0, i = 0;
         int err;
 
-        parts = kzalloc(sizeof(struct mtd_partition) * TRX_PARSER_MAX_PARTS,
+        parts = kcalloc(TRX_PARSER_MAX_PARTS, sizeof(struct mtd_partition),
                         GFP_KERNEL);
         if (!parts)
                 return -ENOMEM;
diff --git a/drivers/mtd/parsers/sharpslpart.c b/drivers/mtd/parsers/sharpslpart.c
index 8893dc82a5c8..e5ea6127ab5a 100644
--- a/drivers/mtd/parsers/sharpslpart.c
+++ b/drivers/mtd/parsers/sharpslpart.c
@@ -362,8 +362,9 @@ static int sharpsl_parse_mtd_partitions(struct mtd_info *master,
                 return err;
         }
 
-        sharpsl_nand_parts = kzalloc(sizeof(*sharpsl_nand_parts) *
-                                     SHARPSL_NAND_PARTS, GFP_KERNEL);
+        sharpsl_nand_parts = kcalloc(SHARPSL_NAND_PARTS,
+                                     sizeof(*sharpsl_nand_parts),
+                                     GFP_KERNEL);
         if (!sharpsl_nand_parts)
                 return -ENOMEM;
 
diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c
index df27f24ce0fa..94720f2ca9a8 100644
--- a/drivers/mtd/rfd_ftl.c
+++ b/drivers/mtd/rfd_ftl.c
@@ -189,7 +189,8 @@ static int scan_header(struct partition *part)
         if (!part->blocks)
                 goto err;
 
-        part->sector_map = vmalloc(part->sector_count * sizeof(u_long));
+        part->sector_map = vmalloc(array_size(sizeof(u_long),
+                                              part->sector_count));
         if (!part->sector_map) {
                 printk(KERN_ERR PREFIX "'%s': unable to allocate memory for "
                         "sector map", part->mbd.mtd->name);
diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
index 79636349df96..f3bd86e13603 100644
--- a/drivers/mtd/sm_ftl.c
+++ b/drivers/mtd/sm_ftl.c
@@ -82,7 +82,7 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
 
 
         /* Create array of pointers to the attributes */
-        attributes = kzalloc(sizeof(struct attribute *) * (NUM_ATTRIBUTES + 1),
+        attributes = kcalloc(NUM_ATTRIBUTES + 1, sizeof(struct attribute *),
                                                                 GFP_KERNEL);
         if (!attributes)
                 goto error3;
@@ -750,7 +750,7 @@ static int sm_init_zone(struct sm_ftl *ftl, int zone_num)
         dbg("initializing zone %d", zone_num);
 
         /* Allocate memory for FTL table */
-        zone->lba_to_phys_table = kmalloc(ftl->max_lba * 2, GFP_KERNEL);
+        zone->lba_to_phys_table = kmalloc_array(ftl->max_lba, 2, GFP_KERNEL);
 
         if (!zone->lba_to_phys_table)
                 return -ENOMEM;
@@ -1137,7 +1137,7 @@ static void sm_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
                 goto error2;
 
         /* Allocate zone array, it will be initialized on demand */
-        ftl->zones = kzalloc(sizeof(struct ftl_zone) * ftl->zone_count,
+        ftl->zones = kcalloc(ftl->zone_count, sizeof(struct ftl_zone),
                                                                 GFP_KERNEL);
         if (!ftl->zones)
                 goto error3;
diff --git a/drivers/mtd/ssfdc.c b/drivers/mtd/ssfdc.c
index 95f0bf95f095..7a1e54546f4a 100644
--- a/drivers/mtd/ssfdc.c
+++ b/drivers/mtd/ssfdc.c
@@ -332,8 +332,9 @@ static void ssfdcr_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
                                 (long)ssfdc->sectors;
 
         /* Allocate logical block map */
-        ssfdc->logic_block_map = kmalloc(sizeof(ssfdc->logic_block_map[0]) *
-                                         ssfdc->map_len, GFP_KERNEL);
+        ssfdc->logic_block_map =
+                kmalloc_array(ssfdc->map_len,
+                              sizeof(ssfdc->logic_block_map[0]), GFP_KERNEL);
         if (!ssfdc->logic_block_map)
                 goto out_err;
         memset(ssfdc->logic_block_map, 0xff, sizeof(ssfdc->logic_block_map[0]) *
diff --git a/drivers/mtd/tests/pagetest.c b/drivers/mtd/tests/pagetest.c
index bc303cac9f43..75687369bc20 100644
--- a/drivers/mtd/tests/pagetest.c
+++ b/drivers/mtd/tests/pagetest.c
@@ -127,7 +127,7 @@ static int crosstest(void)
         unsigned char *pp1, *pp2, *pp3, *pp4;
 
         pr_info("crosstest\n");
-        pp1 = kzalloc(pgsize * 4, GFP_KERNEL);
+        pp1 = kcalloc(pgsize, 4, GFP_KERNEL);
         if (!pp1)
                 return -ENOMEM;
         pp2 = pp1 + pgsize;
diff --git a/drivers/mtd/tests/stresstest.c b/drivers/mtd/tests/stresstest.c
index e509f8aa9a7e..0fe1217f94b9 100644
--- a/drivers/mtd/tests/stresstest.c
+++ b/drivers/mtd/tests/stresstest.c
@@ -199,7 +199,7 @@ static int __init mtd_stresstest_init(void)
         err = -ENOMEM;
         readbuf = vmalloc(bufsize);
         writebuf = vmalloc(bufsize);
-        offsets = kmalloc(ebcnt * sizeof(int), GFP_KERNEL);
+        offsets = kmalloc_array(ebcnt, sizeof(int), GFP_KERNEL);
         if (!readbuf || !writebuf || !offsets)
                 goto out;
         for (i = 0; i < ebcnt; i++)
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index edb1c8362faa..b98481b69314 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -1536,11 +1536,11 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
 
         num_volumes = ubi->vtbl_slots + UBI_INT_VOL_COUNT;
 
-        scan_eba = kmalloc(sizeof(*scan_eba) * num_volumes, GFP_KERNEL);
+        scan_eba = kmalloc_array(num_volumes, sizeof(*scan_eba), GFP_KERNEL);
         if (!scan_eba)
                 return -ENOMEM;
 
-        fm_eba = kmalloc(sizeof(*fm_eba) * num_volumes, GFP_KERNEL);
+        fm_eba = kmalloc_array(num_volumes, sizeof(*fm_eba), GFP_KERNEL);
         if (!fm_eba) {
                 kfree(scan_eba);
                 return -ENOMEM;
@@ -1551,15 +1551,17 @@ int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
                 if (!vol)
                         continue;
 
-                scan_eba[i] = kmalloc(vol->reserved_pebs * sizeof(**scan_eba),
-                                      GFP_KERNEL);
+                scan_eba[i] = kmalloc_array(vol->reserved_pebs,
+                                            sizeof(**scan_eba),
+                                            GFP_KERNEL);
                 if (!scan_eba[i]) {
                         ret = -ENOMEM;
                         goto out_free;
                 }
 
-                fm_eba[i] = kmalloc(vol->reserved_pebs * sizeof(**fm_eba),
-                                    GFP_KERNEL);
+                fm_eba[i] = kmalloc_array(vol->reserved_pebs,
+                                          sizeof(**fm_eba),
+                                          GFP_KERNEL);
                 if (!fm_eba[i]) {
                         ret = -ENOMEM;
                         goto out_free;
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index f66b3b22f328..6f2ac865ff05 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -1592,7 +1592,7 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
         sprintf(ubi->bgt_name, UBI_BGT_NAME_PATTERN, ubi->ubi_num);
 
         err = -ENOMEM;
-        ubi->lookuptbl = kzalloc(ubi->peb_count * sizeof(void *), GFP_KERNEL);
+        ubi->lookuptbl = kcalloc(ubi->peb_count, sizeof(void *), GFP_KERNEL);
         if (!ubi->lookuptbl)
                 return err;
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index bd53a71f6b00..63e3844c5bec 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2418,7 +2418,7 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,
         struct list_head  *iter;
 
         if (start_dev == end_dev) {
-                tags = kzalloc(sizeof(*tags) * (level + 1), GFP_ATOMIC);
+                tags = kcalloc(level + 1, sizeof(*tags), GFP_ATOMIC);
                 if (!tags)
                         return ERR_PTR(-ENOMEM);
                 tags[level].vlan_proto = VLAN_N_VID;
diff --git a/drivers/net/can/grcan.c b/drivers/net/can/grcan.c
index 2d3046afa80d..7eec1d9f86a0 100644
--- a/drivers/net/can/grcan.c
+++ b/drivers/net/can/grcan.c
@@ -1057,7 +1057,7 @@ static int grcan_open(struct net_device *dev)
                 return err;
         }
 
-        priv->echo_skb = kzalloc(dma->tx.size * sizeof(*priv->echo_skb),
+        priv->echo_skb = kcalloc(dma->tx.size, sizeof(*priv->echo_skb),
                                  GFP_KERNEL);
         if (!priv->echo_skb) {
                 err = -ENOMEM;
@@ -1066,7 +1066,7 @@ static int grcan_open(struct net_device *dev)
         priv->can.echo_skb_max = dma->tx.size;
         priv->can.echo_skb = priv->echo_skb;
 
-        priv->txdlc = kzalloc(dma->tx.size * sizeof(*priv->txdlc), GFP_KERNEL);
+        priv->txdlc = kcalloc(dma->tx.size, sizeof(*priv->txdlc), GFP_KERNEL);
         if (!priv->txdlc) {
                 err = -ENOMEM;
                 goto exit_free_echo_skb;
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index 89d60d8e467c..aa97dbc797b6 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -703,7 +703,7 @@ static int __init slcan_init(void)
         pr_info("slcan: serial line CAN interface driver\n");
         pr_info("slcan: %d dynamic interface channels.\n", maxdev);
 
-        slcan_devs = kzalloc(sizeof(struct net_device *)*maxdev, GFP_KERNEL);
+        slcan_devs = kcalloc(maxdev, sizeof(struct net_device *), GFP_KERNEL);
         if (!slcan_devs)
                 return -ENOMEM;
 
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 5e010b1592f7..d93c790bfbe8 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -2044,14 +2044,14 @@ static int b53_switch_init(struct b53_device *dev)
                 }
         }
 
-        dev->ports = devm_kzalloc(dev->dev,
-                                  sizeof(struct b53_port) * dev->num_ports,
+        dev->ports = devm_kcalloc(dev->dev,
+                                  dev->num_ports, sizeof(struct b53_port),
                                   GFP_KERNEL);
         if (!dev->ports)
                 return -ENOMEM;
 
-        dev->vlans = devm_kzalloc(dev->dev,
-                                  sizeof(struct b53_vlan) * dev->num_vlans,
+        dev->vlans = devm_kcalloc(dev->dev,
+                                  dev->num_vlans, sizeof(struct b53_vlan),
                                   GFP_KERNEL);
         if (!dev->vlans)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index 060cb18fa659..521607bc4393 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -838,8 +838,8 @@ static void ena_dump_stats_ex(struct ena_adapter *adapter, u8 *buf)
                 return;
         }
 
-        strings_buf = devm_kzalloc(&adapter->pdev->dev,
-                                   strings_num * ETH_GSTRING_LEN,
+        strings_buf = devm_kcalloc(&adapter->pdev->dev,
+                                   ETH_GSTRING_LEN, strings_num,
                                    GFP_ATOMIC);
         if (!strings_buf) {
                 netif_err(adapter, drv, netdev,
@@ -847,8 +847,8 @@ static void ena_dump_stats_ex(struct ena_adapter *adapter, u8 *buf)
                 return;
         }
 
-        data_buf = devm_kzalloc(&adapter->pdev->dev,
-                                strings_num * sizeof(u64),
+        data_buf = devm_kcalloc(&adapter->pdev->dev,
+                                strings_num, sizeof(u64),
                                 GFP_ATOMIC);
         if (!data_buf) {
                 netif_err(adapter, drv, netdev,
diff --git a/drivers/net/ethernet/amd/lance.c b/drivers/net/ethernet/amd/lance.c
index 12a6a93d221b..b56d84c7df46 100644
--- a/drivers/net/ethernet/amd/lance.c
+++ b/drivers/net/ethernet/amd/lance.c
@@ -551,13 +551,13 @@ static int __init lance_probe1(struct net_device *dev, int ioaddr, int irq, int
         if (lance_debug > 6) printk(" (#0x%05lx)", (unsigned long)lp);
         dev->ml_priv = lp;
         lp->name = chipname;
-        lp->rx_buffs = (unsigned long)kmalloc(PKT_BUF_SZ*RX_RING_SIZE,
-                                                  GFP_DMA | GFP_KERNEL);
+        lp->rx_buffs = (unsigned long)kmalloc_array(RX_RING_SIZE, PKT_BUF_SZ,
+                                                    GFP_DMA | GFP_KERNEL);
         if (!lp->rx_buffs)
                 goto out_lp;
         if (lance_need_isa_bounce_buffers) {
-                lp->tx_bounce_buffs = kmalloc(PKT_BUF_SZ*TX_RING_SIZE,
-                                                  GFP_DMA | GFP_KERNEL);
+                lp->tx_bounce_buffs = kmalloc_array(TX_RING_SIZE, PKT_BUF_SZ,
+                                                    GFP_DMA | GFP_KERNEL);
                 if (!lp->tx_bounce_buffs)
                         goto out_rx;
         } else
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c b/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
index cfe86a20c899..28e9ae1a193b 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
@@ -209,8 +209,8 @@ static int atl1c_get_eeprom(struct net_device *netdev,
         first_dword = eeprom->offset >> 2;
         last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
 
-        eeprom_buff = kmalloc(sizeof(u32) *
-                        (last_dword - first_dword + 1), GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_dword - first_dword + 1, sizeof(u32),
+                                    GFP_KERNEL);
         if (eeprom_buff == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c b/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
index cb489e7e8374..282ebdde4769 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
@@ -236,8 +236,8 @@ static int atl1e_get_eeprom(struct net_device *netdev,
         first_dword = eeprom->offset >> 2;
         last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
 
-        eeprom_buff = kmalloc(sizeof(u32) *
-                        (last_dword - first_dword + 1), GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_dword - first_dword + 1, sizeof(u32),
+                                    GFP_KERNEL);
         if (eeprom_buff == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
index db4bcc51023a..bb41becb6609 100644
--- a/drivers/net/ethernet/atheros/atlx/atl2.c
+++ b/drivers/net/ethernet/atheros/atlx/atl2.c
@@ -1941,8 +1941,8 @@ static int atl2_get_eeprom(struct net_device *netdev,
         first_dword = eeprom->offset >> 2;
         last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
 
-        eeprom_buff = kmalloc(sizeof(u32) * (last_dword - first_dword + 1),
-                GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_dword - first_dword + 1, sizeof(u32),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
index 14a59e51db67..897302adc38e 100644
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -2150,7 +2150,7 @@ static int bcm_enetsw_open(struct net_device *dev)
         priv->tx_desc_alloc_size = size;
         priv->tx_desc_cpu = p;
 
-        priv->tx_skb = kzalloc(sizeof(struct sk_buff *) * priv->tx_ring_size,
+        priv->tx_skb = kcalloc(priv->tx_ring_size, sizeof(struct sk_buff *),
                                GFP_KERNEL);
         if (!priv->tx_skb) {
                 dev_err(kdev, "cannot allocate rx skb queue\n");
@@ -2164,7 +2164,7 @@ static int bcm_enetsw_open(struct net_device *dev)
         spin_lock_init(&priv->tx_lock);
 
         /* init & fill rx ring with skbs */
-        priv->rx_skb = kzalloc(sizeof(struct sk_buff *) * priv->rx_ring_size,
+        priv->rx_skb = kcalloc(priv->rx_ring_size, sizeof(struct sk_buff *),
                                GFP_KERNEL);
         if (!priv->rx_skb) {
                 dev_err(kdev, "cannot allocate rx skb queue\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 3853296d78c1..122fdb80a789 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -778,7 +778,7 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
                 int j;
 
                 rxr->rx_buf_ring =
-                        vzalloc(SW_RXBD_RING_SIZE * bp->rx_max_ring);
+                        vzalloc(array_size(SW_RXBD_RING_SIZE, bp->rx_max_ring));
                 if (!rxr->rx_buf_ring)
                         return -ENOMEM;
 
@@ -794,8 +794,9 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
                 }
 
                 if (bp->rx_pg_ring_size) {
-                        rxr->rx_pg_ring = vzalloc(SW_RXPG_RING_SIZE *
-                                                  bp->rx_max_pg_ring);
+                        rxr->rx_pg_ring =
+                                vzalloc(array_size(SW_RXPG_RING_SIZE,
+                                                   bp->rx_max_pg_ring));
                         if (!rxr->rx_pg_ring)
                                 return -ENOMEM;
 
@@ -2666,7 +2667,7 @@ bnx2_alloc_bad_rbuf(struct bnx2 *bp)
         u32 good_mbuf_cnt;
         u32 val;
 
-        good_mbuf = kmalloc(512 * sizeof(u16), GFP_KERNEL);
+        good_mbuf = kmalloc_array(512, sizeof(u16), GFP_KERNEL);
         if (!good_mbuf)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index ffa7959f6b31..dc77bfded865 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -571,7 +571,7 @@ int bnx2x_vf_mcast(struct bnx2x *bp, struct bnx2x_virtf *vf,
         else
                 set_bit(RAMROD_COMP_WAIT, &mcast.ramrod_flags);
         if (mc_num) {
-                mc = kzalloc(mc_num * sizeof(struct bnx2x_mcast_list_elem),
+                mc = kcalloc(mc_num, sizeof(struct bnx2x_mcast_list_elem),
                              GFP_KERNEL);
                 if (!mc) {
                         BNX2X_ERR("Cannot Configure multicasts due to lack of memory\n");
@@ -1253,8 +1253,9 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param,
            num_vfs_param, iov->nr_virtfn);
 
         /* allocate the vf array */
-        bp->vfdb->vfs = kzalloc(sizeof(struct bnx2x_virtf) *
-                                BNX2X_NR_VIRTFN(bp), GFP_KERNEL);
+        bp->vfdb->vfs = kcalloc(BNX2X_NR_VIRTFN(bp),
+                                sizeof(struct bnx2x_virtf),
+                                GFP_KERNEL);
         if (!bp->vfdb->vfs) {
                 BNX2X_ERR("failed to allocate vf array\n");
                 err = -ENOMEM;
@@ -1278,9 +1279,9 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param,
         }
 
         /* allocate the queue arrays for all VFs */
-        bp->vfdb->vfqs = kzalloc(
-                BNX2X_MAX_NUM_VF_QUEUES * sizeof(struct bnx2x_vf_queue),
-                GFP_KERNEL);
+        bp->vfdb->vfqs = kcalloc(BNX2X_MAX_NUM_VF_QUEUES,
+                                 sizeof(struct bnx2x_vf_queue),
+                                 GFP_KERNEL);
 
         if (!bp->vfdb->vfqs) {
                 BNX2X_ERR("failed to allocate vf queue array\n");
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c
index 38f635cf8408..05d405905906 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c
@@ -444,8 +444,8 @@ static int bnxt_vf_reps_create(struct bnxt *bp)
                 return -ENOMEM;
 
         /* storage for cfa_code to vf-idx mapping */
-        cfa_code_map = kmalloc(sizeof(*bp->cfa_code_map) * MAX_CFA_CODE,
-                               GFP_KERNEL);
+        cfa_code_map = kmalloc_array(MAX_CFA_CODE, sizeof(*bp->cfa_code_map),
+                                     GFP_KERNEL);
         if (!cfa_code_map) {
                 rc = -ENOMEM;
                 goto err;
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 8bc126a156e8..30273a7717e2 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -660,7 +660,7 @@ static int cnic_init_id_tbl(struct cnic_id_tbl *id_tbl, u32 size, u32 start_id,
         id_tbl->max = size;
         id_tbl->next = next;
         spin_lock_init(&id_tbl->lock);
-        id_tbl->table = kzalloc(DIV_ROUND_UP(size, 32) * 4, GFP_KERNEL);
+        id_tbl->table = kcalloc(DIV_ROUND_UP(size, 32), 4, GFP_KERNEL);
         if (!id_tbl->table)
                 return -ENOMEM;
 
@@ -1255,13 +1255,13 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
                         cp->fcoe_init_cid = 0x10;
         }
 
-        cp->iscsi_tbl = kzalloc(sizeof(struct cnic_iscsi) * MAX_ISCSI_TBL_SZ,
+        cp->iscsi_tbl = kcalloc(MAX_ISCSI_TBL_SZ, sizeof(struct cnic_iscsi),
                                 GFP_KERNEL);
         if (!cp->iscsi_tbl)
                 goto error;
 
-        cp->ctx_tbl = kzalloc(sizeof(struct cnic_context) *
-                                cp->max_cid_space, GFP_KERNEL);
+        cp->ctx_tbl = kcalloc(cp->max_cid_space, sizeof(struct cnic_context),
+                              GFP_KERNEL);
         if (!cp->ctx_tbl)
                 goto error;
 
@@ -4100,7 +4100,7 @@ static int cnic_cm_alloc_mem(struct cnic_dev *dev)
         struct cnic_local *cp = dev->cnic_priv;
         u32 port_id;
 
-        cp->csk_tbl = kzalloc(sizeof(struct cnic_sock) * MAX_CM_SK_TBL_SZ,
+        cp->csk_tbl = kcalloc(MAX_CM_SK_TBL_SZ, sizeof(struct cnic_sock),
                               GFP_KERNEL);
         if (!cp->csk_tbl)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 9f59b1270a7c..3be87efdc93d 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -8631,8 +8631,9 @@ static int tg3_mem_tx_acquire(struct tg3 *tp)
                 tnapi++;
 
         for (i = 0; i < tp->txq_cnt; i++, tnapi++) {
-                tnapi->tx_buffers = kzalloc(sizeof(struct tg3_tx_ring_info) *
-                                            TG3_TX_RING_SIZE, GFP_KERNEL);
+                tnapi->tx_buffers = kcalloc(TG3_TX_RING_SIZE,
+                                            sizeof(struct tg3_tx_ring_info),
+                                            GFP_KERNEL);
                 if (!tnapi->tx_buffers)
                         goto err_out;
 
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index 69cc3e0119d6..ea5f32ea308a 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -3141,7 +3141,7 @@ bnad_set_rx_ucast_fltr(struct bnad *bnad)
         if (uc_count > bna_attr(&bnad->bna)->num_ucmac)
                 goto mode_default;
 
-        mac_list = kzalloc(uc_count * ETH_ALEN, GFP_ATOMIC);
+        mac_list = kcalloc(ETH_ALEN, uc_count, GFP_ATOMIC);
         if (mac_list == NULL)
                 goto mode_default;
 
@@ -3182,7 +3182,7 @@ bnad_set_rx_mcast_fltr(struct bnad *bnad)
         if (mc_count > bna_attr(&bnad->bna)->num_mcmac)
                 goto mode_allmulti;
 
-        mac_list = kzalloc((mc_count + 1) * ETH_ALEN, GFP_ATOMIC);
+        mac_list = kcalloc(mc_count + 1, ETH_ALEN, GFP_ATOMIC);
 
         if (mac_list == NULL)
                 goto mode_allmulti;
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index 2bd7c638b178..2c63afff1382 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -739,7 +739,7 @@ static int xgmac_dma_desc_rings_init(struct net_device *dev)
 
         netdev_dbg(priv->dev, "mtu [%d] bfsize [%d]\n", dev->mtu, bfsize);
 
-        priv->rx_skbuff = kzalloc(sizeof(struct sk_buff *) * DMA_RX_RING_SZ,
+        priv->rx_skbuff = kcalloc(DMA_RX_RING_SZ, sizeof(struct sk_buff *),
                                   GFP_KERNEL);
         if (!priv->rx_skbuff)
                 return -ENOMEM;
@@ -752,7 +752,7 @@ static int xgmac_dma_desc_rings_init(struct net_device *dev)
         if (!priv->dma_rx)
                 goto err_dma_rx;
 
-        priv->tx_skbuff = kzalloc(sizeof(struct sk_buff *) * DMA_TX_RING_SZ,
+        priv->tx_skbuff = kcalloc(DMA_TX_RING_SZ, sizeof(struct sk_buff *),
                                   GFP_KERNEL);
         if (!priv->tx_skbuff)
                 goto err_tx_skb;
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
index f044718cea52..a71dbb7ab6af 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
@@ -281,13 +281,12 @@ int octeon_init_droq(struct octeon_device *oct,
                 droq->max_count);
 
         droq->recv_buf_list = (struct octeon_recv_buffer *)
-                              vzalloc_node(droq->max_count *
-                                                OCT_DROQ_RECVBUF_SIZE,
-                                                numa_node);
+              vzalloc_node(array_size(droq->max_count, OCT_DROQ_RECVBUF_SIZE),
+                           numa_node);
         if (!droq->recv_buf_list)
                 droq->recv_buf_list = (struct octeon_recv_buffer *)
-                                      vzalloc(droq->max_count *
-                                                OCT_DROQ_RECVBUF_SIZE);
+                      vzalloc(array_size(droq->max_count,
+                                         OCT_DROQ_RECVBUF_SIZE));
         if (!droq->recv_buf_list) {
                 dev_err(&oct->pci_dev->dev, "Output queue recv buf list alloc failed\n");
                 goto init_droq_fail;
diff --git a/drivers/net/ethernet/cavium/liquidio/request_manager.c b/drivers/net/ethernet/cavium/liquidio/request_manager.c
index b1270355b0b1..1f2e75da28f8 100644
--- a/drivers/net/ethernet/cavium/liquidio/request_manager.c
+++ b/drivers/net/ethernet/cavium/liquidio/request_manager.c
@@ -98,8 +98,9 @@ int octeon_init_instr_queue(struct octeon_device *oct,
         iq->request_list = vmalloc_node((sizeof(*iq->request_list) * num_descs),
                                                numa_node);
         if (!iq->request_list)
-                iq->request_list = vmalloc(sizeof(*iq->request_list) *
-                                                  num_descs);
+                iq->request_list =
+                        vmalloc(array_size(num_descs,
+                                           sizeof(*iq->request_list)));
         if (!iq->request_list) {
                 lio_dma_free(oct, q_size, iq->base_addr, iq->base_addr_dma);
                 dev_err(&oct->pci_dev->dev, "Alloc failed for IQ[%d] nr free list\n",
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index d42704d07484..187a249ff2d1 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -292,8 +292,8 @@ static int  nicvf_init_rbdr(struct nicvf *nic, struct rbdr *rbdr,
                 rbdr->is_xdp = true;
         }
         rbdr->pgcnt = roundup_pow_of_two(rbdr->pgcnt);
-        rbdr->pgcache = kzalloc(sizeof(*rbdr->pgcache) *
-                                rbdr->pgcnt, GFP_KERNEL);
+        rbdr->pgcache = kcalloc(rbdr->pgcnt, sizeof(*rbdr->pgcache),
+                                GFP_KERNEL);
         if (!rbdr->pgcache)
                 return -ENOMEM;
         rbdr->pgidx = 0;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
index 290039026ece..5701272aa7f7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
@@ -304,7 +304,7 @@ struct clip_tbl *t4_init_clip_tbl(unsigned int clipt_start,
         for (i = 0; i < ctbl->clipt_size; ++i)
                 INIT_LIST_HEAD(&ctbl->hash_list[i]);
 
-        cl_list = kvzalloc(clipt_size*sizeof(struct clip_entry), GFP_KERNEL);
+        cl_list = kvcalloc(clipt_size, sizeof(struct clip_entry), GFP_KERNEL);
         if (!cl_list) {
                 kvfree(ctbl);
                 return NULL;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
index 251d5bdc972f..c301aaf79d64 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
@@ -873,7 +873,7 @@ static int cctrl_tbl_show(struct seq_file *seq, void *v)
         u16 (*incr)[NCCTRL_WIN];
         struct adapter *adap = seq->private;
 
-        incr = kmalloc(sizeof(*incr) * NMTUS, GFP_KERNEL);
+        incr = kmalloc_array(NMTUS, sizeof(*incr), GFP_KERNEL);
         if (!incr)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 35cb3ae4f7b6..dd04a2f89ce6 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -713,7 +713,7 @@ int cxgb4_write_rss(const struct port_info *pi, const u16 *queues)
         const struct sge_eth_rxq *rxq;
 
         rxq = &adapter->sge.ethrxq[pi->first_qset];
-        rss = kmalloc(pi->rss_size * sizeof(u16), GFP_KERNEL);
+        rss = kmalloc_array(pi->rss_size, sizeof(u16), GFP_KERNEL);
         if (!rss)
                 return -ENOMEM;
 
@@ -4972,8 +4972,8 @@ static int enable_msix(struct adapter *adap)
                 max_ingq += (MAX_OFLD_QSETS * adap->num_uld);
         if (is_offload(adap))
                 max_ingq += (MAX_OFLD_QSETS * adap->num_ofld_uld);
-        entries = kmalloc(sizeof(*entries) * (max_ingq + 1),
-                          GFP_KERNEL);
+        entries = kmalloc_array(max_ingq + 1, sizeof(*entries),
+                                GFP_KERNEL);
         if (!entries)
                 return -ENOMEM;
 
@@ -5646,8 +5646,8 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 adapter->params.offload = 0;
         }
 
-        adapter->mps_encap = kvzalloc(sizeof(struct mps_encap_entry) *
-                                          adapter->params.arch.mps_tcam_size,
+        adapter->mps_encap = kvcalloc(adapter->params.arch.mps_tcam_size,
+                                      sizeof(struct mps_encap_entry),
                                       GFP_KERNEL);
         if (!adapter->mps_encap)
                 dev_warn(&pdev->dev, "could not allocate MPS Encap entries, continuing\n");
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
index ab174bcfbfb0..18eb2aedd4cb 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
@@ -457,7 +457,8 @@ struct cxgb4_tc_u32_table *cxgb4_init_tc_u32(struct adapter *adap)
                 unsigned int bmap_size;
 
                 bmap_size = BITS_TO_LONGS(max_tids);
-                link->tid_map = kvzalloc(sizeof(unsigned long) * bmap_size, GFP_KERNEL);
+                link->tid_map = kvcalloc(bmap_size, sizeof(unsigned long),
+                                         GFP_KERNEL);
                 if (!link->tid_map)
                         goto out_no_mem;
                 bitmap_zero(link->tid_map, max_tids);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
index a95cde0fadf7..4bc211093c98 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
@@ -561,13 +561,13 @@ int t4_uld_mem_alloc(struct adapter *adap)
         if (!adap->uld)
                 return -ENOMEM;
 
-        s->uld_rxq_info = kzalloc(CXGB4_ULD_MAX *
+        s->uld_rxq_info = kcalloc(CXGB4_ULD_MAX,
                                   sizeof(struct sge_uld_rxq_info *),
                                   GFP_KERNEL);
         if (!s->uld_rxq_info)
                 goto err_uld;
 
-        s->uld_txq_info = kzalloc(CXGB4_TX_MAX *
+        s->uld_txq_info = kcalloc(CXGB4_TX_MAX,
                                   sizeof(struct sge_uld_txq_info *),
                                   GFP_KERNEL);
         if (!s->uld_txq_info)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 7a271feec5e7..395e2a0e8d7f 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -699,7 +699,7 @@ static void *alloc_ring(struct device *dev, size_t nelem, size_t elem_size,
         if (!p)
                 return NULL;
         if (sw_size) {
-                s = kzalloc_node(nelem * sw_size, GFP_KERNEL, node);
+                s = kcalloc_node(sw_size, nelem, GFP_KERNEL, node);
 
                 if (!s) {
                         dma_free_coherent(dev, len, p, *phys);
diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index ff9eb45f67f8..6d7404f66f84 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -910,8 +910,8 @@ static int geth_setup_freeq(struct gemini_ethernet *geth)
         }
 
         /* Allocate a mapping to page look-up index */
-        geth->freeq_pages = kzalloc(pages * sizeof(*geth->freeq_pages),
-                                   GFP_KERNEL);
+        geth->freeq_pages = kcalloc(pages, sizeof(*geth->freeq_pages),
+                                    GFP_KERNEL);
         if (!geth->freeq_pages)
                 goto err_freeq;
         geth->num_freeq_pages = pages;
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index 00a57273b753..60da0499ad66 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -1141,7 +1141,8 @@ static int ethoc_probe(struct platform_device *pdev)
         dev_dbg(&pdev->dev, "ethoc: num_tx: %d num_rx: %d\n",
                 priv->num_tx, priv->num_rx);
 
-        priv->vma = devm_kzalloc(&pdev->dev, num_bd*sizeof(void *), GFP_KERNEL);
+        priv->vma = devm_kcalloc(&pdev->dev, num_bd, sizeof(void *),
+                                 GFP_KERNEL);
         if (!priv->vma) {
                 ret = -ENOMEM;
                 goto free;
diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
index fd43f98ddbe7..5f4e1ffa7b95 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -664,7 +664,7 @@ static struct dpaa_fq *dpaa_fq_alloc(struct device *dev,
         struct dpaa_fq *dpaa_fq;
         int i;
 
-        dpaa_fq = devm_kzalloc(dev, sizeof(*dpaa_fq) * count,
+        dpaa_fq = devm_kcalloc(dev, count, sizeof(*dpaa_fq),
                                GFP_KERNEL);
         if (!dpaa_fq)
                 return NULL;
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index a96b838cffce..42fca3208c0b 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -2253,9 +2253,9 @@ static int ucc_geth_alloc_tx(struct ucc_geth_private *ugeth)
         /* Init Tx bds */
         for (j = 0; j < ug_info->numQueuesTx; j++) {
                 /* Setup the skbuff rings */
-                ugeth->tx_skbuff[j] = kmalloc(sizeof(struct sk_buff *) *
-                                              ugeth->ug_info->bdRingLenTx[j],
-                                              GFP_KERNEL);
+                ugeth->tx_skbuff[j] =
+                        kmalloc_array(ugeth->ug_info->bdRingLenTx[j],
+                                      sizeof(struct sk_buff *), GFP_KERNEL);
 
                 if (ugeth->tx_skbuff[j] == NULL) {
                         if (netif_msg_ifup(ugeth))
@@ -2326,9 +2326,9 @@ static int ucc_geth_alloc_rx(struct ucc_geth_private *ugeth)
         /* Init Rx bds */
         for (j = 0; j < ug_info->numQueuesRx; j++) {
                 /* Setup the skbuff rings */
-                ugeth->rx_skbuff[j] = kmalloc(sizeof(struct sk_buff *) *
-                                              ugeth->ug_info->bdRingLenRx[j],
-                                              GFP_KERNEL);
+                ugeth->rx_skbuff[j] =
+                        kmalloc_array(ugeth->ug_info->bdRingLenRx[j],
+                                      sizeof(struct sk_buff *), GFP_KERNEL);
 
                 if (ugeth->rx_skbuff[j] == NULL) {
                         if (netif_msg_ifup(ugeth))
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 85e1d14514fc..0ce07f6eb1e6 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -1406,8 +1406,8 @@ static int hns_dsaf_init(struct dsaf_device *dsaf_dev)
                 return ret;
 
         /* malloc mem for tcam mac key(vlan+mac) */
-        priv->soft_mac_tbl = vzalloc(sizeof(*priv->soft_mac_tbl)
-                  * DSAF_TCAM_SUM);
+        priv->soft_mac_tbl = vzalloc(array_size(DSAF_TCAM_SUM,
+                                                sizeof(*priv->soft_mac_tbl)));
         if (!priv->soft_mac_tbl) {
                 ret = -ENOMEM;
                 goto remove_hw;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 1ccb6443d2ed..ef9ef703d13a 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -2197,7 +2197,8 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv)
                 return -EINVAL;
         }
 
-        priv->ring_data = kzalloc(h->q_num * sizeof(*priv->ring_data) * 2,
+        priv->ring_data = kzalloc(array3_size(h->q_num,
+                                              sizeof(*priv->ring_data), 2),
                                   GFP_KERNEL);
         if (!priv->ring_data)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index f2b31d278bc9..25a73bb2e642 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2846,8 +2846,10 @@ static int hns3_get_ring_config(struct hns3_nic_priv *priv)
         struct pci_dev *pdev = h->pdev;
         int i, ret;
 
-        priv->ring_data =  devm_kzalloc(&pdev->dev, h->kinfo.num_tqps *
-                                        sizeof(*priv->ring_data) * 2,
+        priv->ring_data =  devm_kzalloc(&pdev->dev,
+                                        array3_size(h->kinfo.num_tqps,
+                                                    sizeof(*priv->ring_data),
+                                                    2),
                                         GFP_KERNEL);
         if (!priv->ring_data)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
index 28a81ac97af5..4d09ea786b35 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
@@ -753,11 +753,12 @@ static int init_cmdq(struct hinic_cmdq *cmdq, struct hinic_wq *wq,
 
         spin_lock_init(&cmdq->cmdq_lock);
 
-        cmdq->done = vzalloc(wq->q_depth * sizeof(*cmdq->done));
+        cmdq->done = vzalloc(array_size(sizeof(*cmdq->done), wq->q_depth));
         if (!cmdq->done)
                 return -ENOMEM;
 
-        cmdq->errcode = vzalloc(wq->q_depth * sizeof(*cmdq->errcode));
+        cmdq->errcode = vzalloc(array_size(sizeof(*cmdq->errcode),
+                                           wq->q_depth));
         if (!cmdq->errcode) {
                 err = -ENOMEM;
                 goto err_errcode;
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index c1b51edaaf62..525d8b89187b 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -171,7 +171,7 @@ static int ibmveth_alloc_buffer_pool(struct ibmveth_buff_pool *pool)
 {
         int i;
 
-        pool->free_map = kmalloc(sizeof(u16) * pool->size, GFP_KERNEL);
+        pool->free_map = kmalloc_array(pool->size, sizeof(u16), GFP_KERNEL);
 
         if (!pool->free_map)
                 return -1;
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index 5d365a986bb0..bdb3f8e65ed4 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -435,8 +435,8 @@ static int e1000_get_eeprom(struct net_device *netdev,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) *
-                        (last_word - first_word + 1), GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index e084cb734eb1..02ebf208f48b 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -509,8 +509,8 @@ static int e1000_get_eeprom(struct net_device *netdev,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
-                              GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index acf1e8b52b8e..3ba0c90e7055 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3312,7 +3312,7 @@ static int e1000e_write_mc_addr_list(struct net_device *netdev)
                 return 0;
         }
 
-        mta_list = kzalloc(netdev_mc_count(netdev) * ETH_ALEN, GFP_ATOMIC);
+        mta_list = kcalloc(netdev_mc_count(netdev), ETH_ALEN, GFP_ATOMIC);
         if (!mta_list)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
index 7657daa27298..4895dd83dd08 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
@@ -558,7 +558,7 @@ static int fm10k_set_ringparam(struct net_device *netdev,
 
         /* allocate temporary buffer to store rings in */
         i = max_t(int, interface->num_tx_queues, interface->num_rx_queues);
-        temp_ring = vmalloc(i * sizeof(struct fm10k_ring));
+        temp_ring = vmalloc(array_size(i, sizeof(struct fm10k_ring)));
 
         if (!temp_ring) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 2d798499d35e..f92f7918112d 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -736,8 +736,8 @@ static int igb_get_eeprom(struct net_device *netdev,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) *
-                        (last_word - first_word + 1), GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
@@ -902,11 +902,11 @@ static int igb_set_ringparam(struct net_device *netdev,
         }
 
         if (adapter->num_tx_queues > adapter->num_rx_queues)
-                temp_ring = vmalloc(adapter->num_tx_queues *
-                                    sizeof(struct igb_ring));
+                temp_ring = vmalloc(array_size(sizeof(struct igb_ring),
+                                               adapter->num_tx_queues));
         else
-                temp_ring = vmalloc(adapter->num_rx_queues *
-                                    sizeof(struct igb_ring));
+                temp_ring = vmalloc(array_size(sizeof(struct igb_ring),
+                                               adapter->num_rx_queues));
 
         if (!temp_ring) {
                 err = -ENOMEM;
@@ -3245,8 +3245,8 @@ static int igb_get_module_eeprom(struct net_device *netdev,
         first_word = ee->offset >> 1;
         last_word = (ee->offset + ee->len - 1) >> 1;
 
-        dataword = kmalloc(sizeof(u16) * (last_word - first_word + 1),
-                           GFP_KERNEL);
+        dataword = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                 GFP_KERNEL);
         if (!dataword)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index c33821d2afb3..f707709969ac 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3763,8 +3763,9 @@ static int igb_sw_init(struct igb_adapter *adapter)
         /* Assume MSI-X interrupts, will be checked during IRQ allocation */
         adapter->flags |= IGB_FLAG_HAS_MSIX;
 
-        adapter->mac_table = kzalloc(sizeof(struct igb_mac_addr) *
-                                     hw->mac.rar_entry_count, GFP_ATOMIC);
+        adapter->mac_table = kcalloc(hw->mac.rar_entry_count,
+                                     sizeof(struct igb_mac_addr),
+                                     GFP_ATOMIC);
         if (!adapter->mac_table)
                 return -ENOMEM;
 
@@ -4752,7 +4753,7 @@ static int igb_write_mc_addr_list(struct net_device *netdev)
                 return 0;
         }
 
-        mta_list = kzalloc(netdev_mc_count(netdev) * 6, GFP_ATOMIC);
+        mta_list = kcalloc(netdev_mc_count(netdev), 6, GFP_ATOMIC);
         if (!mta_list)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c b/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
index 43744bf0fc1c..c8c93ac436d4 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
@@ -375,8 +375,9 @@ ixgb_get_eeprom(struct net_device *netdev,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(__le16) *
-                        (last_word - first_word + 1), GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1,
+                                    sizeof(__le16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
index 62f2173bc20e..43664adf7a3c 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
@@ -1093,8 +1093,9 @@ ixgb_set_multi(struct net_device *netdev)
                 rctl |= IXGB_RCTL_MPE;
                 IXGB_WRITE_REG(hw, RCTL, rctl);
         } else {
-                u8 *mta = kmalloc(IXGB_MAX_NUM_MULTICAST_ADDRESSES *
-                              ETH_ALEN, GFP_ATOMIC);
+                u8 *mta = kmalloc_array(ETH_ALEN,
+                                        IXGB_MAX_NUM_MULTICAST_ADDRESSES,
+                                        GFP_ATOMIC);
                 u8 *addr;
                 if (!mta)
                         goto alloc_failed;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index bdd179c29ea4..bd1ba88ec1d5 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -901,7 +901,7 @@ static int ixgbe_get_eeprom(struct net_device *netdev,
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
         eeprom_len = last_word - first_word + 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) * eeprom_len, GFP_KERNEL);
+        eeprom_buff = kmalloc_array(eeprom_len, sizeof(u16), GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
@@ -1063,7 +1063,7 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
         /* allocate temporary buffer to store rings in */
         i = max_t(int, adapter->num_tx_queues + adapter->num_xdp_queues,
                   adapter->num_rx_queues);
-        temp_ring = vmalloc(i * sizeof(struct ixgbe_ring));
+        temp_ring = vmalloc(array_size(i, sizeof(struct ixgbe_ring)));
 
         if (!temp_ring) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 4929f7265598..0b1ba3ae159c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6034,8 +6034,8 @@ static int ixgbe_sw_init(struct ixgbe_adapter *adapter,
         for (i = 1; i < IXGBE_MAX_LINK_HANDLE; i++)
                 adapter->jump_tables[i] = NULL;
 
-        adapter->mac_table = kzalloc(sizeof(struct ixgbe_mac_addr) *
-                                     hw->mac.num_rar_entries,
+        adapter->mac_table = kcalloc(hw->mac.num_rar_entries,
+                                     sizeof(struct ixgbe_mac_addr),
                                      GFP_ATOMIC);
         if (!adapter->mac_table)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/intel/ixgbevf/ethtool.c b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
index e7813d76527c..631c91046f39 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
@@ -282,8 +282,9 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
         }
 
         if (new_tx_count != adapter->tx_ring_count) {
-                tx_ring = vmalloc((adapter->num_tx_queues +
-                                   adapter->num_xdp_queues) * sizeof(*tx_ring));
+                tx_ring = vmalloc(array_size(sizeof(*tx_ring),
+                                             adapter->num_tx_queues +
+                                                adapter->num_xdp_queues));
                 if (!tx_ring) {
                         err = -ENOMEM;
                         goto clear_reset;
@@ -327,7 +328,8 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
         }
 
         if (new_rx_count != adapter->rx_ring_count) {
-                rx_ring = vmalloc(adapter->num_rx_queues * sizeof(*rx_ring));
+                rx_ring = vmalloc(array_size(sizeof(*rx_ring),
+                                             adapter->num_rx_queues));
                 if (!rx_ring) {
                         err = -ENOMEM;
                         goto clear_reset;
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 8a165842fa85..06ff185eb188 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -589,8 +589,9 @@ jme_setup_tx_resources(struct jme_adapter *jme)
         atomic_set(&txring->next_to_clean, 0);
         atomic_set(&txring->nr_free, jme->tx_ring_size);
 
-        txring->bufinf          = kzalloc(sizeof(struct jme_buffer_info) *
-                                        jme->tx_ring_size, GFP_ATOMIC);
+        txring->bufinf          = kcalloc(jme->tx_ring_size,
+                                                sizeof(struct jme_buffer_info),
+                                                GFP_ATOMIC);
         if (unlikely(!(txring->bufinf)))
                 goto err_free_txring;
 
@@ -838,8 +839,9 @@ jme_setup_rx_resources(struct jme_adapter *jme)
         rxring->next_to_use     = 0;
         atomic_set(&rxring->next_to_clean, 0);
 
-        rxring->bufinf          = kzalloc(sizeof(struct jme_buffer_info) *
-                                        jme->rx_ring_size, GFP_ATOMIC);
+        rxring->bufinf          = kcalloc(jme->rx_ring_size,
+                                                sizeof(struct jme_buffer_info),
+                                                GFP_ATOMIC);
         if (unlikely(!(rxring->bufinf)))
                 goto err_free_rxring;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
index 6dabd983e7e0..4bdf25059542 100644
--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
+++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
@@ -185,8 +185,8 @@ int mlx4_bitmap_init(struct mlx4_bitmap *bitmap, u32 num, u32 mask,
         bitmap->avail = num - reserved_top - reserved_bot;
         bitmap->effective_len = bitmap->avail;
         spin_lock_init(&bitmap->lock);
-        bitmap->table = kzalloc(BITS_TO_LONGS(bitmap->max) *
-                                sizeof(long), GFP_KERNEL);
+        bitmap->table = kcalloc(BITS_TO_LONGS(bitmap->max), sizeof(long),
+                                GFP_KERNEL);
         if (!bitmap->table)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index 6a9086dc1e92..e65bc3c95630 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2377,20 +2377,23 @@ int mlx4_multi_func_init(struct mlx4_dev *dev)
                 struct mlx4_vf_admin_state *vf_admin;
 
                 priv->mfunc.master.slave_state =
-                        kzalloc(dev->num_slaves *
-                                sizeof(struct mlx4_slave_state), GFP_KERNEL);
+                        kcalloc(dev->num_slaves,
+                                sizeof(struct mlx4_slave_state),
+                                GFP_KERNEL);
                 if (!priv->mfunc.master.slave_state)
                         goto err_comm;
 
                 priv->mfunc.master.vf_admin =
-                        kzalloc(dev->num_slaves *
-                                sizeof(struct mlx4_vf_admin_state), GFP_KERNEL);
+                        kcalloc(dev->num_slaves,
+                                sizeof(struct mlx4_vf_admin_state),
+                                GFP_KERNEL);
                 if (!priv->mfunc.master.vf_admin)
                         goto err_comm_admin;
 
                 priv->mfunc.master.vf_oper =
-                        kzalloc(dev->num_slaves *
-                                sizeof(struct mlx4_vf_oper_state), GFP_KERNEL);
+                        kcalloc(dev->num_slaves,
+                                sizeof(struct mlx4_vf_oper_state),
+                                GFP_KERNEL);
                 if (!priv->mfunc.master.vf_oper)
                         goto err_comm_oper;
 
@@ -2636,9 +2639,9 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
         int i;
         int err = 0;
 
-        priv->cmd.context = kmalloc(priv->cmd.max_cmds *
-                                   sizeof(struct mlx4_cmd_context),
-                                   GFP_KERNEL);
+        priv->cmd.context = kmalloc_array(priv->cmd.max_cmds,
+                                          sizeof(struct mlx4_cmd_context),
+                                          GFP_KERNEL);
         if (!priv->cmd.context)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 9670b33fc9b1..65eb06e017e4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2229,13 +2229,15 @@ static int mlx4_en_copy_priv(struct mlx4_en_priv *dst,
                 if (!dst->tx_ring_num[t])
                         continue;
 
-                dst->tx_ring[t] = kzalloc(sizeof(struct mlx4_en_tx_ring *) *
-                                          MAX_TX_RINGS, GFP_KERNEL);
+                dst->tx_ring[t] = kcalloc(MAX_TX_RINGS,
+                                          sizeof(struct mlx4_en_tx_ring *),
+                                          GFP_KERNEL);
                 if (!dst->tx_ring[t])
                         goto err_free_tx;
 
-                dst->tx_cq[t] = kzalloc(sizeof(struct mlx4_en_cq *) *
-                                        MAX_TX_RINGS, GFP_KERNEL);
+                dst->tx_cq[t] = kcalloc(MAX_TX_RINGS,
+                                        sizeof(struct mlx4_en_cq *),
+                                        GFP_KERNEL);
                 if (!dst->tx_cq[t]) {
                         kfree(dst->tx_ring[t]);
                         goto err_free_tx;
@@ -3320,14 +3322,16 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                 if (!priv->tx_ring_num[t])
                         continue;
 
-                priv->tx_ring[t] = kzalloc(sizeof(struct mlx4_en_tx_ring *) *
-                                           MAX_TX_RINGS, GFP_KERNEL);
+                priv->tx_ring[t] = kcalloc(MAX_TX_RINGS,
+                                           sizeof(struct mlx4_en_tx_ring *),
+                                           GFP_KERNEL);
                 if (!priv->tx_ring[t]) {
                         err = -ENOMEM;
                         goto out;
                 }
-                priv->tx_cq[t] = kzalloc(sizeof(struct mlx4_en_cq *) *
-                                         MAX_TX_RINGS, GFP_KERNEL);
+                priv->tx_cq[t] = kcalloc(MAX_TX_RINGS,
+                                         sizeof(struct mlx4_en_cq *),
+                                         GFP_KERNEL);
                 if (!priv->tx_cq[t]) {
                         err = -ENOMEM;
                         goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 6f57c052053e..1f3372c1802e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1211,8 +1211,9 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
         }
 
         priv->eq_table.irq_names =
-                kmalloc(MLX4_IRQNAME_SIZE * (dev->caps.num_comp_vectors + 1),
-                        GFP_KERNEL);
+                kmalloc_array(MLX4_IRQNAME_SIZE,
+                              (dev->caps.num_comp_vectors + 1),
+                              GFP_KERNEL);
         if (!priv->eq_table.irq_names) {
                 err = -ENOMEM;
                 goto err_out_clr_int;
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
index 5342bd8a3d0b..7262c6310650 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
@@ -408,7 +408,7 @@ int mlx4_init_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table,
                 return -EINVAL;
         num_icm = (nobj + obj_per_chunk - 1) / obj_per_chunk;
 
-        table->icm      = kvzalloc(num_icm * sizeof(*table->icm), GFP_KERNEL);
+        table->icm      = kvcalloc(num_icm, sizeof(*table->icm), GFP_KERNEL);
         if (!table->icm)
                 return -ENOMEM;
         table->virt     = virt;
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 0a30d81aab3b..872014702fc1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2982,7 +2982,8 @@ static int mlx4_init_steering(struct mlx4_dev *dev)
         int num_entries = dev->caps.num_ports;
         int i, j;
 
-        priv->steer = kzalloc(sizeof(struct mlx4_steer) * num_entries, GFP_KERNEL);
+        priv->steer = kcalloc(num_entries, sizeof(struct mlx4_steer),
+                              GFP_KERNEL);
         if (!priv->steer)
                 return -ENOMEM;
 
@@ -3103,7 +3104,7 @@ static u64 mlx4_enable_sriov(struct mlx4_dev *dev, struct pci_dev *pdev,
                 }
         }
 
-        dev->dev_vfs = kzalloc(total_vfs * sizeof(*dev->dev_vfs), GFP_KERNEL);
+        dev->dev_vfs = kcalloc(total_vfs, sizeof(*dev->dev_vfs), GFP_KERNEL);
         if (NULL == dev->dev_vfs) {
                 mlx4_err(dev, "Failed to allocate memory for VFs\n");
                 goto disable_sriov;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 29e50f787349..7b1b5ac986d0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -487,7 +487,7 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
         int max_vfs_guarantee_counter = get_max_gauranteed_vfs_counter(dev);
 
         priv->mfunc.master.res_tracker.slave_list =
-                kzalloc(dev->num_slaves * sizeof(struct slave_list),
+                kcalloc(dev->num_slaves, sizeof(struct slave_list),
                         GFP_KERNEL);
         if (!priv->mfunc.master.res_tracker.slave_list)
                 return -ENOMEM;
@@ -507,19 +507,21 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
         for (i = 0; i < MLX4_NUM_OF_RESOURCE_TYPE; i++) {
                 struct resource_allocator *res_alloc =
                         &priv->mfunc.master.res_tracker.res_alloc[i];
-                res_alloc->quota = kmalloc((dev->persist->num_vfs + 1) *
-                                           sizeof(int), GFP_KERNEL);
-                res_alloc->guaranteed = kmalloc((dev->persist->num_vfs + 1) *
-                                                sizeof(int), GFP_KERNEL);
+                res_alloc->quota = kmalloc_array(dev->persist->num_vfs + 1,
+                                                 sizeof(int),
+                                                 GFP_KERNEL);
+                res_alloc->guaranteed = kmalloc_array(dev->persist->num_vfs + 1,
+                                                      sizeof(int),
+                                                      GFP_KERNEL);
                 if (i == RES_MAC || i == RES_VLAN)
-                        res_alloc->allocated = kzalloc(MLX4_MAX_PORTS *
-                                                       (dev->persist->num_vfs
-                                                       + 1) *
-                                                       sizeof(int), GFP_KERNEL);
+                        res_alloc->allocated =
+                                kcalloc(MLX4_MAX_PORTS *
+                                                (dev->persist->num_vfs + 1),
+                                        sizeof(int), GFP_KERNEL);
                 else
-                        res_alloc->allocated = kzalloc((dev->persist->
-                                                        num_vfs + 1) *
-                                                       sizeof(int), GFP_KERNEL);
+                        res_alloc->allocated =
+                                kcalloc(dev->persist->num_vfs + 1,
+                                        sizeof(int), GFP_KERNEL);
                 /* Reduce the sink counter */
                 if (i == RES_COUNTER)
                         res_alloc->res_free = dev->caps.max_counters - 1;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 89c96a0f708e..56c1b6f5593e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -352,7 +352,7 @@ static int mlx5e_rq_alloc_mpwqe_info(struct mlx5e_rq *rq,
 {
         int wq_sz = mlx5_wq_ll_get_size(&rq->mpwqe.wq);
 
-        rq->mpwqe.info = kzalloc_node(wq_sz * sizeof(*rq->mpwqe.info),
+        rq->mpwqe.info = kcalloc_node(wq_sz, sizeof(*rq->mpwqe.info),
                                       GFP_KERNEL, cpu_to_node(c->cpu));
         if (!rq->mpwqe.info)
                 return -ENOMEM;
@@ -448,7 +448,7 @@ static int mlx5e_init_di_list(struct mlx5e_rq *rq,
 {
         int len = wq_sz << rq->wqe.info.log_num_frags;
 
-        rq->wqe.di = kvzalloc_node(len * sizeof(*rq->wqe.di),
+        rq->wqe.di = kvzalloc_node(array_size(len, sizeof(*rq->wqe.di)),
                                    GFP_KERNEL, cpu_to_node(cpu));
         if (!rq->wqe.di)
                 return -ENOMEM;
@@ -563,8 +563,8 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
 
                 rq->wqe.info = rqp->frags_info;
                 rq->wqe.frags =
-                        kvzalloc_node((wq_sz << rq->wqe.info.log_num_frags) *
-                                      sizeof(*rq->wqe.frags),
+                        kvzalloc_node(array_size(sizeof(*rq->wqe.frags),
+                                        (wq_sz << rq->wqe.info.log_num_frags)),
                                       GFP_KERNEL, cpu_to_node(c->cpu));
                 if (!rq->wqe.frags) {
                         err = -ENOMEM;
@@ -972,7 +972,7 @@ static int mlx5e_alloc_xdpsq_db(struct mlx5e_xdpsq *sq, int numa)
 {
         int wq_sz = mlx5_wq_cyc_get_size(&sq->wq);
 
-        sq->db.di = kzalloc_node(sizeof(*sq->db.di) * wq_sz,
+        sq->db.di = kcalloc_node(wq_sz, sizeof(*sq->db.di),
                                      GFP_KERNEL, numa);
         if (!sq->db.di) {
                 mlx5e_free_xdpsq_db(sq);
@@ -1031,7 +1031,7 @@ static int mlx5e_alloc_icosq_db(struct mlx5e_icosq *sq, int numa)
 {
         u8 wq_sz = mlx5_wq_cyc_get_size(&sq->wq);
 
-        sq->db.ico_wqe = kzalloc_node(sizeof(*sq->db.ico_wqe) * wq_sz,
+        sq->db.ico_wqe = kcalloc_node(wq_sz, sizeof(*sq->db.ico_wqe),
                                       GFP_KERNEL, numa);
         if (!sq->db.ico_wqe)
                 return -ENOMEM;
@@ -1086,9 +1086,9 @@ static int mlx5e_alloc_txqsq_db(struct mlx5e_txqsq *sq, int numa)
         int wq_sz = mlx5_wq_cyc_get_size(&sq->wq);
         int df_sz = wq_sz * MLX5_SEND_WQEBB_NUM_DS;
 
-        sq->db.dma_fifo = kzalloc_node(df_sz * sizeof(*sq->db.dma_fifo),
+        sq->db.dma_fifo = kcalloc_node(df_sz, sizeof(*sq->db.dma_fifo),
                                            GFP_KERNEL, numa);
-        sq->db.wqe_info = kzalloc_node(wq_sz * sizeof(*sq->db.wqe_info),
+        sq->db.wqe_info = kcalloc_node(wq_sz, sizeof(*sq->db.wqe_info),
                                            GFP_KERNEL, numa);
         if (!sq->db.dma_fifo || !sq->db.wqe_info) {
                 mlx5e_free_txqsq_db(sq);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
index 4138a770ed57..8ca1d1949d93 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
@@ -549,15 +549,17 @@ static int mlx5_fpga_conn_create_qp(struct mlx5_fpga_conn *conn,
         if (err)
                 goto out;
 
-        conn->qp.rq.bufs = kvzalloc(sizeof(conn->qp.rq.bufs[0]) *
-                                    conn->qp.rq.size, GFP_KERNEL);
+        conn->qp.rq.bufs = kvcalloc(conn->qp.rq.size,
+                                    sizeof(conn->qp.rq.bufs[0]),
+                                    GFP_KERNEL);
         if (!conn->qp.rq.bufs) {
                 err = -ENOMEM;
                 goto err_wq;
         }
 
-        conn->qp.sq.bufs = kvzalloc(sizeof(conn->qp.sq.bufs[0]) *
-                                    conn->qp.sq.size, GFP_KERNEL);
+        conn->qp.sq.bufs = kvcalloc(conn->qp.sq.size,
+                                    sizeof(conn->qp.sq.bufs[0]),
+                                    GFP_KERNEL);
         if (!conn->qp.sq.bufs) {
                 err = -ENOMEM;
                 goto err_rq_bufs;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
index a0433b48e833..5645a4facad2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
@@ -381,7 +381,7 @@ int mlx5_fpga_ipsec_counters_read(struct mlx5_core_dev *mdev, u64 *counters,
 
         count = mlx5_fpga_ipsec_counters_count(mdev);
 
-        data = kzalloc(sizeof(*data) * count * 2, GFP_KERNEL);
+        data = kzalloc(array3_size(sizeof(*data), count, 2), GFP_KERNEL);
         if (!data) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index 857035583ccd..1e062e6b2587 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -394,8 +394,9 @@ static int mlx5_init_pin_config(struct mlx5_clock *clock)
         int i;
 
         clock->ptp_info.pin_config =
-                        kzalloc(sizeof(*clock->ptp_info.pin_config) *
-                                clock->ptp_info.n_pins, GFP_KERNEL);
+                        kcalloc(clock->ptp_info.n_pins,
+                                sizeof(*clock->ptp_info.pin_config),
+                                GFP_KERNEL);
         if (!clock->ptp_info.pin_config)
                 return -ENOMEM;
         clock->ptp_info.enable = mlx5_ptp_enable;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
index 91262b0573e3..cad603c35271 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
@@ -740,7 +740,8 @@ int mlxsw_sp_tc_qdisc_init(struct mlxsw_sp_port *mlxsw_sp_port)
         mlxsw_sp_port->root_qdisc->prio_bitmap = 0xff;
         mlxsw_sp_port->root_qdisc->tclass_num = MLXSW_SP_PORT_DEFAULT_TCLASS;
 
-        mlxsw_sp_qdisc = kzalloc(sizeof(*mlxsw_sp_qdisc) * IEEE_8021QAZ_MAX_TCS,
+        mlxsw_sp_qdisc = kcalloc(IEEE_8021QAZ_MAX_TCS,
+                                 sizeof(*mlxsw_sp_qdisc),
                                  GFP_KERNEL);
         if (!mlxsw_sp_qdisc)
                 goto err_tclass_qdiscs_init;
diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
index 52207508744c..b72d1bd11296 100644
--- a/drivers/net/ethernet/micrel/ksz884x.c
+++ b/drivers/net/ethernet/micrel/ksz884x.c
@@ -4372,7 +4372,7 @@ static void ksz_update_timer(struct ksz_timer_info *info)
  */
 static int ksz_alloc_soft_desc(struct ksz_desc_info *desc_info, int transmit)
 {
-        desc_info->ring = kzalloc(sizeof(struct ksz_desc) * desc_info->alloc,
+        desc_info->ring = kcalloc(desc_info->alloc, sizeof(struct ksz_desc),
                                   GFP_KERNEL);
         if (!desc_info->ring)
                 return 1;
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 2e4effa9fe45..b34055ac476f 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -507,15 +507,15 @@ static int moxart_mac_probe(struct platform_device *pdev)
                 goto init_fail;
         }
 
-        priv->tx_buf_base = kmalloc(priv->tx_buf_size * TX_DESC_NUM,
-                                    GFP_ATOMIC);
+        priv->tx_buf_base = kmalloc_array(priv->tx_buf_size, TX_DESC_NUM,
+                                          GFP_ATOMIC);
         if (!priv->tx_buf_base) {
                 ret = -ENOMEM;
                 goto init_fail;
         }
 
-        priv->rx_buf_base = kmalloc(priv->rx_buf_size * RX_DESC_NUM,
-                                    GFP_ATOMIC);
+        priv->rx_buf_base = kmalloc_array(priv->rx_buf_size, RX_DESC_NUM,
+                                          GFP_ATOMIC);
         if (!priv->rx_buf_base) {
                 ret = -ENOMEM;
                 goto init_fail;
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
index c60da9e8bf14..358ed6118881 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
@@ -2220,22 +2220,22 @@ __vxge_hw_channel_allocate(struct __vxge_hw_vpath_handle *vph,
         channel->length = length;
         channel->vp_id = vp_id;
 
-        channel->work_arr = kzalloc(sizeof(void *)*length, GFP_KERNEL);
+        channel->work_arr = kcalloc(length, sizeof(void *), GFP_KERNEL);
         if (channel->work_arr == NULL)
                 goto exit1;
 
-        channel->free_arr = kzalloc(sizeof(void *)*length, GFP_KERNEL);
+        channel->free_arr = kcalloc(length, sizeof(void *), GFP_KERNEL);
         if (channel->free_arr == NULL)
                 goto exit1;
         channel->free_ptr = length;
 
-        channel->reserve_arr = kzalloc(sizeof(void *)*length, GFP_KERNEL);
+        channel->reserve_arr = kcalloc(length, sizeof(void *), GFP_KERNEL);
         if (channel->reserve_arr == NULL)
                 goto exit1;
         channel->reserve_ptr = length;
         channel->reserve_top = 0;
 
-        channel->orig_arr = kzalloc(sizeof(void *)*length, GFP_KERNEL);
+        channel->orig_arr = kcalloc(length, sizeof(void *), GFP_KERNEL);
         if (channel->orig_arr == NULL)
                 goto exit1;
 
@@ -2565,7 +2565,7 @@ __vxge_hw_mempool_grow(struct vxge_hw_mempool *mempool, u32 num_allocate,
                  * allocate new memblock and its private part at once.
                  * This helps to minimize memory usage a lot. */
                 mempool->memblocks_priv_arr[i] =
-                                vzalloc(mempool->items_priv_size * n_items);
+                        vzalloc(array_size(mempool->items_priv_size, n_items));
                 if (mempool->memblocks_priv_arr[i] == NULL) {
                         status = VXGE_HW_ERR_OUT_OF_MEMORY;
                         goto exit;
@@ -2665,7 +2665,7 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
 
         /* allocate array of memblocks */
         mempool->memblocks_arr =
-                vzalloc(sizeof(void *) * mempool->memblocks_max);
+                vzalloc(array_size(sizeof(void *), mempool->memblocks_max));
         if (mempool->memblocks_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
@@ -2675,7 +2675,7 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
 
         /* allocate array of private parts of items per memblocks */
         mempool->memblocks_priv_arr =
-                vzalloc(sizeof(void *) * mempool->memblocks_max);
+                vzalloc(array_size(sizeof(void *), mempool->memblocks_max));
         if (mempool->memblocks_priv_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
@@ -2685,8 +2685,8 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
 
         /* allocate array of memblocks DMA objects */
         mempool->memblocks_dma_arr =
-                vzalloc(sizeof(struct vxge_hw_mempool_dma) *
-                        mempool->memblocks_max);
+                vzalloc(array_size(sizeof(struct vxge_hw_mempool_dma),
+                                   mempool->memblocks_max));
         if (mempool->memblocks_dma_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
@@ -2695,7 +2695,8 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
         }
 
         /* allocate hash array of items */
-        mempool->items_arr = vzalloc(sizeof(void *) * mempool->items_max);
+        mempool->items_arr = vzalloc(array_size(sizeof(void *),
+                                                mempool->items_max));
         if (mempool->items_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c
index a8918bb7c802..5ae3fa82909f 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c
@@ -3429,8 +3429,8 @@ static int vxge_device_register(struct __vxge_hw_device *hldev,
         vxge_initialize_ethtool_ops(ndev);
 
         /* Allocate memory for vpath */
-        vdev->vpaths = kzalloc((sizeof(struct vxge_vpath)) *
-                                no_of_vpath, GFP_KERNEL);
+        vdev->vpaths = kcalloc(no_of_vpath, sizeof(struct vxge_vpath),
+                               GFP_KERNEL);
         if (!vdev->vpaths) {
                 vxge_debug_init(VXGE_ERR,
                         "%s: vpath memory allocation failed",
diff --git a/drivers/net/ethernet/netronome/nfp/abm/main.c b/drivers/net/ethernet/netronome/nfp/abm/main.c
index 1561c2724c26..b84a6c2d387b 100644
--- a/drivers/net/ethernet/netronome/nfp/abm/main.c
+++ b/drivers/net/ethernet/netronome/nfp/abm/main.c
@@ -590,7 +590,7 @@ nfp_abm_vnic_alloc(struct nfp_app *app, struct nfp_net *nn, unsigned int id)
         alink->id = id;
         alink->parent = TC_H_ROOT;
         alink->total_queues = alink->vnic->max_rx_rings;
-        alink->qdiscs = kvzalloc(sizeof(*alink->qdiscs) * alink->total_queues,
+        alink->qdiscs = kvcalloc(alink->total_queues, sizeof(*alink->qdiscs),
                                  GFP_KERNEL);
         if (!alink->qdiscs) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
index 21668aa435e8..93fb809f50d1 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
@@ -417,7 +417,8 @@ int nfp_flower_metadata_init(struct nfp_app *app)
 
         /* Init ring buffer and unallocated stats_ids. */
         priv->stats_ids.free_list.buf =
-                vmalloc(NFP_FL_STATS_ENTRY_RS * NFP_FL_STATS_ELEM_RS);
+                vmalloc(array_size(NFP_FL_STATS_ELEM_RS,
+                                   NFP_FL_STATS_ENTRY_RS));
         if (!priv->stats_ids.free_list.buf)
                 goto err_free_last_used;
 
diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
index b092894dd128..09f674ec0f9e 100644
--- a/drivers/net/ethernet/ni/nixge.c
+++ b/drivers/net/ethernet/ni/nixge.c
@@ -247,9 +247,8 @@ static int nixge_hw_dma_bd_init(struct net_device *ndev)
         if (!priv->tx_bd_v)
                 goto out;
 
-        priv->tx_skb = devm_kzalloc(ndev->dev.parent,
-                                    sizeof(*priv->tx_skb) *
-                                    TX_BD_NUM,
+        priv->tx_skb = devm_kcalloc(ndev->dev.parent,
+                                    TX_BD_NUM, sizeof(*priv->tx_skb),
                                     GFP_KERNEL);
         if (!priv->tx_skb)
                 goto out;
diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
index 66c665d0b926..7cbd0174459c 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -4630,8 +4630,10 @@ static int nv_set_ringparam(struct net_device *dev, struct ethtool_ringparam* ri
                                                ring->tx_pending),
                                                &ring_addr, GFP_ATOMIC);
         }
-        rx_skbuff = kmalloc(sizeof(struct nv_skb_map) * ring->rx_pending, GFP_KERNEL);
-        tx_skbuff = kmalloc(sizeof(struct nv_skb_map) * ring->tx_pending, GFP_KERNEL);
+        rx_skbuff = kmalloc_array(ring->rx_pending, sizeof(struct nv_skb_map),
+                                  GFP_KERNEL);
+        tx_skbuff = kmalloc_array(ring->tx_pending, sizeof(struct nv_skb_map),
+                                  GFP_KERNEL);
         if (!rxtx_ring || !rx_skbuff || !tx_skbuff) {
                 /* fall back to old rings */
                 if (!nv_optimized(np)) {
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 7cd494611a74..34a1581eda95 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -2178,7 +2178,7 @@ static void pch_gbe_set_multi(struct net_device *netdev)
 
         if (mc_count >= PCH_GBE_MAR_ENTRIES)
                 return;
-        mta_list = kmalloc(mc_count * ETH_ALEN, GFP_ATOMIC);
+        mta_list = kmalloc_array(ETH_ALEN, mc_count, GFP_ATOMIC);
         if (!mta_list)
                 return;
 
diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index 07a2eb3781b1..8a31a02c9f47 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -390,8 +390,9 @@ static int pasemi_mac_setup_rx_resources(const struct net_device *dev)
         spin_lock_init(&ring->lock);
 
         ring->size = RX_RING_SIZE;
-        ring->ring_info = kzalloc(sizeof(struct pasemi_mac_buffer) *
-                                  RX_RING_SIZE, GFP_KERNEL);
+        ring->ring_info = kcalloc(RX_RING_SIZE,
+                                  sizeof(struct pasemi_mac_buffer),
+                                  GFP_KERNEL);
 
         if (!ring->ring_info)
                 goto out_ring_info;
@@ -473,8 +474,9 @@ pasemi_mac_setup_tx_resources(const struct net_device *dev)
         spin_lock_init(&ring->lock);
 
         ring->size = TX_RING_SIZE;
-        ring->ring_info = kzalloc(sizeof(struct pasemi_mac_buffer) *
-                                  TX_RING_SIZE, GFP_KERNEL);
+        ring->ring_info = kcalloc(TX_RING_SIZE,
+                                  sizeof(struct pasemi_mac_buffer),
+                                  GFP_KERNEL);
         if (!ring->ring_info)
                 goto out_ring_info;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index b9ec460dd996..a14e48489029 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -6617,7 +6617,8 @@ static enum dbg_status qed_mcp_trace_alloc_meta(struct qed_hwfn *p_hwfn,
 
         /* Read no. of modules and allocate memory for their pointers */
         meta->modules_num = qed_read_byte_from_buf(meta_buf_bytes, &offset);
-        meta->modules = kzalloc(meta->modules_num * sizeof(char *), GFP_KERNEL);
+        meta->modules = kcalloc(meta->modules_num, sizeof(char *),
+                                GFP_KERNEL);
         if (!meta->modules)
                 return DBG_STATUS_VIRT_MEM_ALLOC_FAILED;
 
@@ -6645,7 +6646,7 @@ static enum dbg_status qed_mcp_trace_alloc_meta(struct qed_hwfn *p_hwfn,
 
         /* Read number of formats and allocate memory for all formats */
         meta->formats_num = qed_read_dword_from_buf(meta_buf_bytes, &offset);
-        meta->formats = kzalloc(meta->formats_num *
+        meta->formats = kcalloc(meta->formats_num,
                                 sizeof(struct mcp_trace_format),
                                 GFP_KERNEL);
         if (!meta->formats)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index b285edc8d6a1..329781cda77f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -814,26 +814,26 @@ static int qed_alloc_qm_data(struct qed_hwfn *p_hwfn)
         if (rc)
                 goto alloc_err;
 
-        qm_info->qm_pq_params = kzalloc(sizeof(*qm_info->qm_pq_params) *
-                                        qed_init_qm_get_num_pqs(p_hwfn),
+        qm_info->qm_pq_params = kcalloc(qed_init_qm_get_num_pqs(p_hwfn),
+                                        sizeof(*qm_info->qm_pq_params),
                                         GFP_KERNEL);
         if (!qm_info->qm_pq_params)
                 goto alloc_err;
 
-        qm_info->qm_vport_params = kzalloc(sizeof(*qm_info->qm_vport_params) *
-                                           qed_init_qm_get_num_vports(p_hwfn),
+        qm_info->qm_vport_params = kcalloc(qed_init_qm_get_num_vports(p_hwfn),
+                                           sizeof(*qm_info->qm_vport_params),
                                            GFP_KERNEL);
         if (!qm_info->qm_vport_params)
                 goto alloc_err;
 
-        qm_info->qm_port_params = kzalloc(sizeof(*qm_info->qm_port_params) *
-                                          p_hwfn->cdev->num_ports_in_engine,
+        qm_info->qm_port_params = kcalloc(p_hwfn->cdev->num_ports_in_engine,
+                                          sizeof(*qm_info->qm_port_params),
                                           GFP_KERNEL);
         if (!qm_info->qm_port_params)
                 goto alloc_err;
 
-        qm_info->wfq_data = kzalloc(sizeof(*qm_info->wfq_data) *
-                                    qed_init_qm_get_num_vports(p_hwfn),
+        qm_info->wfq_data = kcalloc(qed_init_qm_get_num_vports(p_hwfn),
+                                    sizeof(*qm_info->wfq_data),
                                     GFP_KERNEL);
         if (!qm_info->wfq_data)
                 goto alloc_err;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_init_ops.c b/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
index 3bb76da6baa2..d9ab5add27a8 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
@@ -149,12 +149,12 @@ int qed_init_alloc(struct qed_hwfn *p_hwfn)
         if (IS_VF(p_hwfn->cdev))
                 return 0;
 
-        rt_data->b_valid = kzalloc(sizeof(bool) * RUNTIME_ARRAY_SIZE,
+        rt_data->b_valid = kcalloc(RUNTIME_ARRAY_SIZE, sizeof(bool),
                                    GFP_KERNEL);
         if (!rt_data->b_valid)
                 return -ENOMEM;
 
-        rt_data->init_val = kzalloc(sizeof(u32) * RUNTIME_ARRAY_SIZE,
+        rt_data->init_val = kcalloc(RUNTIME_ARRAY_SIZE, sizeof(u32),
                                     GFP_KERNEL);
         if (!rt_data->init_val) {
                 kfree(rt_data->b_valid);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 1f6ac848109d..99973e10b179 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -98,7 +98,7 @@ int qed_l2_alloc(struct qed_hwfn *p_hwfn)
                 p_l2_info->queues = max_t(u8, rx, tx);
         }
 
-        pp_qids = kzalloc(sizeof(unsigned long *) * p_l2_info->queues,
+        pp_qids = kcalloc(p_l2_info->queues, sizeof(unsigned long *),
                           GFP_KERNEL);
         if (!pp_qids)
                 return -ENOMEM;
@@ -2435,7 +2435,7 @@ static int qed_update_vport(struct qed_dev *cdev,
         if (!cdev)
                 return -ENODEV;
 
-        rss = vzalloc(sizeof(*rss) * cdev->num_hwfns);
+        rss = vzalloc(array_size(sizeof(*rss), cdev->num_hwfns));
         if (!rss)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index 6f9927d1a501..4e0b443c9519 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -2578,9 +2578,9 @@ int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
                 goto err0;
         }
 
-        nvm_info->image_att = kmalloc(nvm_info->num_images *
-                                      sizeof(struct bist_nvm_image_att),
-                                      GFP_KERNEL);
+        nvm_info->image_att = kmalloc_array(nvm_info->num_images,
+                                            sizeof(struct bist_nvm_image_att),
+                                            GFP_KERNEL);
         if (!nvm_info->image_att) {
                 rc = -ENOMEM;
                 goto err0;
diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c
index e9e088d9c815..b823bfe2ea4d 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c
@@ -342,8 +342,9 @@ int qede_alloc_arfs(struct qede_dev *edev)
         for (i = 0; i <= QEDE_RFS_FLW_MASK; i++)
                 INIT_HLIST_HEAD(QEDE_ARFS_BUCKET_HEAD(edev, i));
 
-        edev->arfs->arfs_fltr_bmap = vzalloc(BITS_TO_LONGS(QEDE_RFS_MAX_FLTR) *
-                                             sizeof(long));
+        edev->arfs->arfs_fltr_bmap =
+                vzalloc(array_size(sizeof(long),
+                                   BITS_TO_LONGS(QEDE_RFS_MAX_FLTR)));
         if (!edev->arfs->arfs_fltr_bmap) {
                 vfree(edev->arfs);
                 edev->arfs = NULL;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 97c146e7698a..569d54ededec 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -386,8 +386,9 @@ int qlcnic_83xx_setup_intr(struct qlcnic_adapter *adapter)
         }
 
         /* setup interrupt mapping table for fw */
-        ahw->intr_tbl = vzalloc(num_msix *
-                                sizeof(struct qlcnic_intrpt_config));
+        ahw->intr_tbl =
+                vzalloc(array_size(num_msix,
+                                   sizeof(struct qlcnic_intrpt_config)));
         if (!ahw->intr_tbl)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 1b5f7d57b6f8..2d38d1ac2aae 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -916,8 +916,9 @@ int qlcnic_82xx_mq_intrpt(struct qlcnic_adapter *adapter, int op_type)
         if (qlcnic_check_multi_tx(adapter) &&
             !ahw->diag_test &&
             (adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                ahw->intr_tbl = vzalloc(ahw->num_msix *
-                                        sizeof(struct qlcnic_intrpt_config));
+                ahw->intr_tbl =
+                        vzalloc(array_size(sizeof(struct qlcnic_intrpt_config),
+                                           ahw->num_msix));
                 if (!ahw->intr_tbl)
                         return -ENOMEM;
 
@@ -1025,15 +1026,17 @@ int qlcnic_init_pci_info(struct qlcnic_adapter *adapter)
 
         act_pci_func = ahw->total_nic_func;
 
-        adapter->npars = kzalloc(sizeof(struct qlcnic_npar_info) *
-                                 act_pci_func, GFP_KERNEL);
+        adapter->npars = kcalloc(act_pci_func,
+                                 sizeof(struct qlcnic_npar_info),
+                                 GFP_KERNEL);
         if (!adapter->npars) {
                 ret = -ENOMEM;
                 goto err_pci_info;
         }
 
-        adapter->eswitch = kzalloc(sizeof(struct qlcnic_eswitch) *
-                                QLCNIC_NIU_MAX_XG_PORTS, GFP_KERNEL);
+        adapter->eswitch = kcalloc(QLCNIC_NIU_MAX_XG_PORTS,
+                                   sizeof(struct qlcnic_eswitch),
+                                   GFP_KERNEL);
         if (!adapter->eswitch) {
                 ret = -ENOMEM;
                 goto err_npars;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index c58180f40844..0c744b9c6e0a 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -157,8 +157,8 @@ int qlcnic_sriov_init(struct qlcnic_adapter *adapter, int num_vfs)
         adapter->ahw->sriov = sriov;
         sriov->num_vfs = num_vfs;
         bc = &sriov->bc;
-        sriov->vf_info = kzalloc(sizeof(struct qlcnic_vf_info) *
-                                 num_vfs, GFP_KERNEL);
+        sriov->vf_info = kcalloc(num_vfs, sizeof(struct qlcnic_vf_info),
+                                 GFP_KERNEL);
         if (!sriov->vf_info) {
                 err = -ENOMEM;
                 goto qlcnic_free_sriov;
@@ -450,7 +450,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
                 return 0;
 
         num_vlans = sriov->num_allowed_vlans;
-        sriov->allowed_vlans = kzalloc(sizeof(u16) * num_vlans, GFP_KERNEL);
+        sriov->allowed_vlans = kcalloc(num_vlans, sizeof(u16), GFP_KERNEL);
         if (!sriov->allowed_vlans)
                 return -ENOMEM;
 
@@ -706,7 +706,7 @@ static inline int qlcnic_sriov_alloc_bc_trans(struct qlcnic_bc_trans **trans)
 static inline int qlcnic_sriov_alloc_bc_msg(struct qlcnic_bc_hdr **hdr,
                                             u32 size)
 {
-        *hdr = kzalloc(sizeof(struct qlcnic_bc_hdr) * size, GFP_ATOMIC);
+        *hdr = kcalloc(size, sizeof(struct qlcnic_bc_hdr), GFP_ATOMIC);
         if (!*hdr)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 70de062b72a1..353f1c129af1 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -2810,7 +2810,8 @@ static int ql_alloc_tx_resources(struct ql_adapter *qdev,
                 goto pci_alloc_err;
 
         tx_ring->q =
-            kmalloc(tx_ring->wq_len * sizeof(struct tx_ring_desc), GFP_KERNEL);
+            kmalloc_array(tx_ring->wq_len, sizeof(struct tx_ring_desc),
+                          GFP_KERNEL);
         if (tx_ring->q == NULL)
                 goto err;
 
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index d90a7b1f4088..23f0785c0573 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4984,7 +4984,8 @@ static int efx_ef10_filter_table_probe(struct efx_nic *efx)
                 net_dev->hw_features &= ~NETIF_F_HW_VLAN_CTAG_FILTER;
         }
 
-        table->entry = vzalloc(HUNT_FILTER_TBL_ROWS * sizeof(*table->entry));
+        table->entry = vzalloc(array_size(HUNT_FILTER_TBL_ROWS,
+                                          sizeof(*table->entry)));
         if (!table->entry) {
                 rc = -ENOMEM;
                 goto fail;
diff --git a/drivers/net/ethernet/sfc/falcon/farch.c b/drivers/net/ethernet/sfc/falcon/farch.c
index 494884f6af4a..411a2f419447 100644
--- a/drivers/net/ethernet/sfc/falcon/farch.c
+++ b/drivers/net/ethernet/sfc/falcon/farch.c
@@ -2755,7 +2755,8 @@ int ef4_farch_filter_table_probe(struct ef4_nic *efx)
                                              GFP_KERNEL);
                 if (!table->used_bitmap)
                         goto fail;
-                table->spec = vzalloc(table->size * sizeof(*table->spec));
+                table->spec = vzalloc(array_size(sizeof(*table->spec),
+                                                 table->size));
                 if (!table->spec)
                         goto fail;
         }
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index c72adf8b52ea..8edf20967c82 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -2826,7 +2826,8 @@ int efx_farch_filter_table_probe(struct efx_nic *efx)
                                              GFP_KERNEL);
                 if (!table->used_bitmap)
                         goto fail;
-                table->spec = vzalloc(table->size * sizeof(*table->spec));
+                table->spec = vzalloc(array_size(sizeof(*table->spec),
+                                                 table->size));
                 if (!table->spec)
                         goto fail;
         }
diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
index ce8071fc90c4..e080d3e7c582 100644
--- a/drivers/net/ethernet/socionext/netsec.c
+++ b/drivers/net/ethernet/socionext/netsec.c
@@ -973,7 +973,7 @@ static int netsec_alloc_dring(struct netsec_priv *priv, enum ring_id id)
                 goto err;
         }
 
-        dring->desc = kzalloc(DESC_NUM * sizeof(*dring->desc), GFP_KERNEL);
+        dring->desc = kcalloc(DESC_NUM, sizeof(*dring->desc), GFP_KERNEL);
         if (!dring->desc) {
                 ret = -ENOMEM;
                 goto err;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
index 881c94b73e2f..2258cd8cc844 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
@@ -277,8 +277,8 @@ static int tc_init(struct stmmac_priv *priv)
 
         /* Reserve one last filter which lets all pass */
         priv->tc_entries_max = count;
-        priv->tc_entries = devm_kzalloc(priv->device,
-                        sizeof(*priv->tc_entries) * count, GFP_KERNEL);
+        priv->tc_entries = devm_kcalloc(priv->device,
+                        count, sizeof(*priv->tc_entries), GFP_KERNEL);
         if (!priv->tc_entries)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 534596ce00d3..358edab9e72e 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2740,8 +2740,9 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
         }
         data->active_slave = prop;
 
-        data->slave_data = devm_kzalloc(&pdev->dev, data->slaves
-                                        * sizeof(struct cpsw_slave_data),
+        data->slave_data = devm_kcalloc(&pdev->dev,
+                                        data->slaves,
+                                        sizeof(struct cpsw_slave_data),
                                         GFP_KERNEL);
         if (!data->slave_data)
                 return -ENOMEM;
@@ -3045,8 +3046,8 @@ static int cpsw_probe(struct platform_device *pdev)
 
         memcpy(ndev->dev_addr, priv->mac_addr, ETH_ALEN);
 
-        cpsw->slaves = devm_kzalloc(&pdev->dev,
-                                    sizeof(struct cpsw_slave) * data->slaves,
+        cpsw->slaves = devm_kcalloc(&pdev->dev,
+                                    data->slaves, sizeof(struct cpsw_slave),
                                     GFP_KERNEL);
         if (!cpsw->slaves) {
                 ret = -ENOMEM;
diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c
index 6e455a27a8de..72b98e27c992 100644
--- a/drivers/net/ethernet/ti/netcp_ethss.c
+++ b/drivers/net/ethernet/ti/netcp_ethss.c
@@ -3285,8 +3285,8 @@ static int set_xgbe_ethss10_priv(struct gbe_priv *gbe_dev,
         gbe_dev->et_stats = xgbe10_et_stats;
         gbe_dev->num_et_stats = ARRAY_SIZE(xgbe10_et_stats);
 
-        gbe_dev->hw_stats = devm_kzalloc(gbe_dev->dev,
-                                         gbe_dev->num_et_stats * sizeof(u64),
+        gbe_dev->hw_stats = devm_kcalloc(gbe_dev->dev,
+                                         gbe_dev->num_et_stats, sizeof(u64),
                                          GFP_KERNEL);
         if (!gbe_dev->hw_stats) {
                 dev_err(gbe_dev->dev, "hw_stats memory allocation failed\n");
@@ -3294,8 +3294,8 @@ static int set_xgbe_ethss10_priv(struct gbe_priv *gbe_dev,
         }
 
         gbe_dev->hw_stats_prev =
-                devm_kzalloc(gbe_dev->dev,
-                             gbe_dev->num_et_stats * sizeof(u32),
+                devm_kcalloc(gbe_dev->dev,
+                             gbe_dev->num_et_stats, sizeof(u32),
                              GFP_KERNEL);
         if (!gbe_dev->hw_stats_prev) {
                 dev_err(gbe_dev->dev,
@@ -3405,8 +3405,8 @@ static int set_gbe_ethss14_priv(struct gbe_priv *gbe_dev,
         gbe_dev->et_stats = gbe13_et_stats;
         gbe_dev->num_et_stats = ARRAY_SIZE(gbe13_et_stats);
 
-        gbe_dev->hw_stats = devm_kzalloc(gbe_dev->dev,
-                                         gbe_dev->num_et_stats * sizeof(u64),
+        gbe_dev->hw_stats = devm_kcalloc(gbe_dev->dev,
+                                         gbe_dev->num_et_stats, sizeof(u64),
                                          GFP_KERNEL);
         if (!gbe_dev->hw_stats) {
                 dev_err(gbe_dev->dev, "hw_stats memory allocation failed\n");
@@ -3414,8 +3414,8 @@ static int set_gbe_ethss14_priv(struct gbe_priv *gbe_dev,
         }
 
         gbe_dev->hw_stats_prev =
-                devm_kzalloc(gbe_dev->dev,
-                             gbe_dev->num_et_stats * sizeof(u32),
+                devm_kcalloc(gbe_dev->dev,
+                             gbe_dev->num_et_stats, sizeof(u32),
                              GFP_KERNEL);
         if (!gbe_dev->hw_stats_prev) {
                 dev_err(gbe_dev->dev,
@@ -3477,8 +3477,8 @@ static int set_gbenu_ethss_priv(struct gbe_priv *gbe_dev,
                 gbe_dev->num_et_stats = GBENU_ET_STATS_HOST_SIZE +
                                         GBENU_ET_STATS_PORT_SIZE;
 
-        gbe_dev->hw_stats = devm_kzalloc(gbe_dev->dev,
-                                         gbe_dev->num_et_stats * sizeof(u64),
+        gbe_dev->hw_stats = devm_kcalloc(gbe_dev->dev,
+                                         gbe_dev->num_et_stats, sizeof(u64),
                                          GFP_KERNEL);
         if (!gbe_dev->hw_stats) {
                 dev_err(gbe_dev->dev, "hw_stats memory allocation failed\n");
@@ -3486,8 +3486,8 @@ static int set_gbenu_ethss_priv(struct gbe_priv *gbe_dev,
         }
 
         gbe_dev->hw_stats_prev =
-                devm_kzalloc(gbe_dev->dev,
-                             gbe_dev->num_et_stats * sizeof(u32),
+                devm_kcalloc(gbe_dev->dev,
+                             gbe_dev->num_et_stats, sizeof(u32),
                              GFP_KERNEL);
         if (!gbe_dev->hw_stats_prev) {
                 dev_err(gbe_dev->dev,
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
index eed18f88bdff..302079e22b06 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
@@ -2320,8 +2320,9 @@ static struct net_device *gelic_wl_alloc(struct gelic_card *card)
         pr_debug("%s: wl=%p port=%p\n", __func__, wl, port);
 
         /* allocate scan list */
-        wl->networks = kzalloc(sizeof(struct gelic_wl_scan_info) *
-                               GELIC_WL_BSS_MAX_ENT, GFP_KERNEL);
+        wl->networks = kcalloc(GELIC_WL_BSS_MAX_ENT,
+                               sizeof(struct gelic_wl_scan_info),
+                               GFP_KERNEL);
 
         if (!wl->networks)
                 goto fail_bss;
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index f38e32a7ec9c..ec629a730005 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -742,11 +742,13 @@ static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize)
 {
         int i;
 
-        gtp->addr_hash = kmalloc(sizeof(struct hlist_head) * hsize, GFP_KERNEL);
+        gtp->addr_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
+                                       GFP_KERNEL);
         if (gtp->addr_hash == NULL)
                 return -ENOMEM;
 
-        gtp->tid_hash = kmalloc(sizeof(struct hlist_head) * hsize, GFP_KERNEL);
+        gtp->tid_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
+                                      GFP_KERNEL);
         if (gtp->tid_hash == NULL)
                 goto err1;
 
diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
index f41116488079..029206e4da3b 100644
--- a/drivers/net/hippi/rrunner.c
+++ b/drivers/net/hippi/rrunner.c
@@ -1583,7 +1583,7 @@ static int rr_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                         return -EPERM;
                 }
 
-                image = kmalloc(EEPROM_WORDS * sizeof(u32), GFP_KERNEL);
+                image = kmalloc_array(EEPROM_WORDS, sizeof(u32), GFP_KERNEL);
                 if (!image)
                         return -ENOMEM;
 
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index a6c87793d899..79e9b103188b 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -1097,8 +1097,9 @@ static struct dp83640_clock *dp83640_clock_get_bus(struct mii_bus *bus)
         if (!clock)
                 goto out;
 
-        clock->caps.pin_config = kzalloc(sizeof(struct ptp_pin_desc) *
-                                         DP83640_N_PINS, GFP_KERNEL);
+        clock->caps.pin_config = kcalloc(DP83640_N_PINS,
+                                         sizeof(struct ptp_pin_desc),
+                                         GFP_KERNEL);
         if (!clock->caps.pin_config) {
                 kfree(clock);
                 clock = NULL;
diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c
index 39ecad25b201..491efc1bf5c4 100644
--- a/drivers/net/phy/phy_led_triggers.c
+++ b/drivers/net/phy/phy_led_triggers.c
@@ -128,9 +128,9 @@ int phy_led_triggers_register(struct phy_device *phy)
         if (err)
                 goto out_free_link;
 
-        phy->phy_led_triggers = devm_kzalloc(&phy->mdio.dev,
-                                            sizeof(struct phy_led_trigger) *
-                                                   phy->phy_num_led_triggers,
+        phy->phy_led_triggers = devm_kcalloc(&phy->mdio.dev,
+                                            phy->phy_num_led_triggers,
+                                            sizeof(struct phy_led_trigger),
                                             GFP_KERNEL);
         if (!phy->phy_led_triggers) {
                 err = -ENOMEM;
diff --git a/drivers/net/ppp/bsd_comp.c b/drivers/net/ppp/bsd_comp.c
index a9b759add187..61fedb23d3cf 100644
--- a/drivers/net/ppp/bsd_comp.c
+++ b/drivers/net/ppp/bsd_comp.c
@@ -406,7 +406,7 @@ static void *bsd_alloc (unsigned char *options, int opt_len, int decomp)
  * Allocate space for the dictionary. This may be more than one page in
  * length.
  */
-    db->dict = vmalloc(hsize * sizeof(struct bsd_dict));
+    db->dict = vmalloc(array_size(hsize, sizeof(struct bsd_dict)));
     if (!db->dict)
       {
         bsd_free (db);
@@ -425,7 +425,7 @@ static void *bsd_alloc (unsigned char *options, int opt_len, int decomp)
  */
     else
       {
-        db->lens = vmalloc((maxmaxcode + 1) * sizeof(db->lens[0]));
+        db->lens = vmalloc(array_size(sizeof(db->lens[0]), (maxmaxcode + 1)));
         if (!db->lens)
           {
             bsd_free (db);
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 157b67c1bf8e..67ffe74747a1 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -648,7 +648,7 @@ static int __init pptp_init_module(void)
         int err = 0;
         pr_info("PPTP driver version " PPTP_DRIVER_VERSION "\n");
 
-        callid_sock = vzalloc((MAX_CALLID + 1) * sizeof(void *));
+        callid_sock = vzalloc(array_size(sizeof(void *), (MAX_CALLID + 1)));
         if (!callid_sock)
                 return -ENOMEM;
 
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index 8940417c30e5..b008266e91ea 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -1307,7 +1307,7 @@ static int __init slip_init(void)
         printk(KERN_INFO "SLIP linefill/keepalive option.\n");
 #endif
 
-        slip_devs = kzalloc(sizeof(struct net_device *)*slip_maxdev,
+        slip_devs = kcalloc(slip_maxdev, sizeof(struct net_device *),
                                                                 GFP_KERNEL);
         if (!slip_devs)
                 return -ENOMEM;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 8863fa023500..b070959737ff 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -280,7 +280,7 @@ static int __team_options_register(struct team *team,
         struct team_option **dst_opts;
         int err;
 
-        dst_opts = kzalloc(sizeof(struct team_option *) * option_count,
+        dst_opts = kcalloc(option_count, sizeof(struct team_option *),
                            GFP_KERNEL);
         if (!dst_opts)
                 return -ENOMEM;
@@ -791,7 +791,8 @@ static int team_queue_override_init(struct team *team)
 
         if (!queue_cnt)
                 return 0;
-        listarr = kmalloc(sizeof(struct list_head) * queue_cnt, GFP_KERNEL);
+        listarr = kmalloc_array(queue_cnt, sizeof(struct list_head),
+                                GFP_KERNEL);
         if (!listarr)
                 return -ENOMEM;
         team->qom_lists = listarr;
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index f4d7362eb325..e95dd12edec4 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -640,8 +640,8 @@ int asix_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
-                              GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
@@ -680,8 +680,8 @@ int asix_set_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
-                              GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index a6ef75907ae9..9e8ad372f419 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -599,8 +599,8 @@ ax88179_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
 
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
-        eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
-                              GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 309b88acd3d0..06b4d290784d 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1661,7 +1661,7 @@ static int smsc95xx_suspend(struct usb_interface *intf, pm_message_t message)
         }
 
         if (pdata->wolopts & (WAKE_BCAST | WAKE_MCAST | WAKE_ARP | WAKE_UCAST)) {
-                u32 *filter_mask = kzalloc(sizeof(u32) * 32, GFP_KERNEL);
+                u32 *filter_mask = kcalloc(32, sizeof(u32), GFP_KERNEL);
                 u32 command[2];
                 u32 offset[2];
                 u32 crc[4];
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index d9eea8cfe6cb..770aa624147f 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1323,8 +1323,8 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb)
                 return 0;
 
         /* reserve one for zero packet */
-        urb->sg = kmalloc((num_sgs + 1) * sizeof(struct scatterlist),
-                          GFP_ATOMIC);
+        urb->sg = kmalloc_array(num_sgs + 1, sizeof(struct scatterlist),
+                                GFP_ATOMIC);
         if (!urb->sg)
                 return -ENOMEM;
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 1619ee3070b6..b6c9a2af3732 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2552,17 +2552,17 @@ static int virtnet_find_vqs(struct virtnet_info *vi)
                     virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ);
 
         /* Allocate space for find_vqs parameters */
-        vqs = kzalloc(total_vqs * sizeof(*vqs), GFP_KERNEL);
+        vqs = kcalloc(total_vqs, sizeof(*vqs), GFP_KERNEL);
         if (!vqs)
                 goto err_vq;
-        callbacks = kmalloc(total_vqs * sizeof(*callbacks), GFP_KERNEL);
+        callbacks = kmalloc_array(total_vqs, sizeof(*callbacks), GFP_KERNEL);
         if (!callbacks)
                 goto err_callback;
-        names = kmalloc(total_vqs * sizeof(*names), GFP_KERNEL);
+        names = kmalloc_array(total_vqs, sizeof(*names), GFP_KERNEL);
         if (!names)
                 goto err_names;
         if (!vi->big_packets || vi->mergeable_rx_bufs) {
-                ctx = kzalloc(total_vqs * sizeof(*ctx), GFP_KERNEL);
+                ctx = kcalloc(total_vqs, sizeof(*ctx), GFP_KERNEL);
                 if (!ctx)
                         goto err_ctx;
         } else {
@@ -2626,10 +2626,10 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
         vi->ctrl = kzalloc(sizeof(*vi->ctrl), GFP_KERNEL);
         if (!vi->ctrl)
                 goto err_ctrl;
-        vi->sq = kzalloc(sizeof(*vi->sq) * vi->max_queue_pairs, GFP_KERNEL);
+        vi->sq = kcalloc(vi->max_queue_pairs, sizeof(*vi->sq), GFP_KERNEL);
         if (!vi->sq)
                 goto err_sq;
-        vi->rq = kzalloc(sizeof(*vi->rq) * vi->max_queue_pairs, GFP_KERNEL);
+        vi->rq = kcalloc(vi->max_queue_pairs, sizeof(*vi->rq), GFP_KERNEL);
         if (!vi->rq)
                 goto err_rq;
 
diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 4205dfd19da3..9b09c9d0d0fb 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -198,12 +198,14 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
                 goto free_tx_bd;
         }
 
-        priv->rx_skbuff = kzalloc(priv->rx_ring_size * sizeof(*priv->rx_skbuff),
+        priv->rx_skbuff = kcalloc(priv->rx_ring_size,
+                                  sizeof(*priv->rx_skbuff),
                                   GFP_KERNEL);
         if (!priv->rx_skbuff)
                 goto free_ucc_pram;
 
-        priv->tx_skbuff = kzalloc(priv->tx_ring_size * sizeof(*priv->tx_skbuff),
+        priv->tx_skbuff = kcalloc(priv->tx_ring_size,
+                                  sizeof(*priv->tx_skbuff),
                                   GFP_KERNEL);
         if (!priv->tx_skbuff)
                 goto free_rx_skbuff;
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index bd23f6940488..c72d8af122a2 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -582,7 +582,7 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
         }
 
         htt->rx_ring.netbufs_ring =
-                kzalloc(htt->rx_ring.size * sizeof(struct sk_buff *),
+                kcalloc(htt->rx_ring.size, sizeof(struct sk_buff *),
                         GFP_KERNEL);
         if (!htt->rx_ring.netbufs_ring)
                 goto err_netbuf;
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
index 2e34a1fc5ba6..8c49a26fc571 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -155,7 +155,7 @@ ath10k_wmi_tlv_parse_alloc(struct ath10k *ar, const void *ptr,
         const void **tb;
         int ret;
 
-        tb = kzalloc(sizeof(*tb) * WMI_TLV_TAG_MAX, gfp);
+        tb = kcalloc(WMI_TLV_TAG_MAX, sizeof(*tb), gfp);
         if (!tb)
                 return ERR_PTR(-ENOMEM);
 
diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
index 3513bbec4639..e01faf641288 100644
--- a/drivers/net/wireless/ath/ath5k/debug.c
+++ b/drivers/net/wireless/ath/ath5k/debug.c
@@ -931,7 +931,7 @@ static int open_file_eeprom(struct inode *inode, struct file *file)
 
         /* Create buffer and read in eeprom */
 
-        buf = vmalloc(eesize * 2);
+        buf = vmalloc(array_size(eesize, 2));
         if (!buf) {
                 ret = -ENOMEM;
                 goto err;
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 641b13a279e1..b1b8bc326830 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -890,7 +890,8 @@ ath5k_hw_rfregs_init(struct ath5k_hw *ah,
          * ah->ah_rf_banks based on ah->ah_rf_banks_size
          * we set above */
         if (ah->ah_rf_banks == NULL) {
-                ah->ah_rf_banks = kmalloc(sizeof(u32) * ah->ah_rf_banks_size,
+                ah->ah_rf_banks = kmalloc_array(ah->ah_rf_banks_size,
+                                                                sizeof(u32),
                                                                 GFP_KERNEL);
                 if (ah->ah_rf_banks == NULL) {
                         ATH5K_ERR(ah, "out of memory\n");
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 2ba8cf3f38af..0687697d5e2d 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -1041,7 +1041,7 @@ static int ath6kl_cfg80211_scan(struct wiphy *wiphy,
 
                 n_channels = request->n_channels;
 
-                channels = kzalloc(n_channels * sizeof(u16), GFP_KERNEL);
+                channels = kcalloc(n_channels, sizeof(u16), GFP_KERNEL);
                 if (channels == NULL) {
                         ath6kl_warn("failed to set scan channels, scan all channels");
                         n_channels = 0;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 6343cc91953e..34e100940284 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -925,7 +925,7 @@ int ar9003_paprd_create_curve(struct ath_hw *ah,
 
         memset(caldata->pa_table[chain], 0, sizeof(caldata->pa_table[chain]));
 
-        buf = kmalloc(2 * 48 * sizeof(u32), GFP_KERNEL);
+        buf = kmalloc_array(2 * 48, sizeof(u32), GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 6b37036b2d36..e60bea4604e4 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -127,13 +127,13 @@ void ath9k_hw_read_array(struct ath_hw *ah, u32 array[][2], int size)
         u32 *tmp_reg_list, *tmp_data;
         int i;
 
-        tmp_reg_list = kmalloc(size * sizeof(u32), GFP_KERNEL);
+        tmp_reg_list = kmalloc_array(size, sizeof(u32), GFP_KERNEL);
         if (!tmp_reg_list) {
                 dev_err(ah->dev, "%s: tmp_reg_list: alloc filed\n", __func__);
                 return;
         }
 
-        tmp_data = kmalloc(size * sizeof(u32), GFP_KERNEL);
+        tmp_data = kmalloc_array(size, sizeof(u32), GFP_KERNEL);
         if (!tmp_data) {
                 dev_err(ah->dev, "%s tmp_data: alloc filed\n", __func__);
                 goto error_tmp_data;
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 29e93c953d93..7f1bdea742b8 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1958,7 +1958,7 @@ static int carl9170_parse_eeprom(struct ar9170 *ar)
         if (!bands)
                 return -EINVAL;
 
-        ar->survey = kzalloc(sizeof(struct survey_info) * chans, GFP_KERNEL);
+        ar->survey = kcalloc(chans, sizeof(struct survey_info), GFP_KERNEL);
         if (!ar->survey)
                 return -ENOMEM;
         ar->num_channels = chans;
@@ -1988,8 +1988,9 @@ int carl9170_register(struct ar9170 *ar)
         if (WARN_ON(ar->mem_bitmap))
                 return -EINVAL;
 
-        ar->mem_bitmap = kzalloc(roundup(ar->fw.mem_blocks, BITS_PER_LONG) *
-                                 sizeof(unsigned long), GFP_KERNEL);
+        ar->mem_bitmap = kcalloc(roundup(ar->fw.mem_blocks, BITS_PER_LONG),
+                                 sizeof(unsigned long),
+                                 GFP_KERNEL);
 
         if (!ar->mem_bitmap)
                 return -ENOMEM;
diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c
index f2a2f41e3c96..44ab080d6518 100644
--- a/drivers/net/wireless/broadcom/b43/phy_n.c
+++ b/drivers/net/wireless/broadcom/b43/phy_n.c
@@ -1518,7 +1518,7 @@ static int b43_nphy_load_samples(struct b43_wldev *dev,
         u16 i;
         u32 *data;
 
-        data = kzalloc(len * sizeof(u32), GFP_KERNEL);
+        data = kcalloc(len, sizeof(u32), GFP_KERNEL);
         if (!data) {
                 b43err(dev->wl, "allocation for samples loading failed\n");
                 return -ENOMEM;
diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c
index f1e3dad57629..55f411925960 100644
--- a/drivers/net/wireless/broadcom/b43legacy/main.c
+++ b/drivers/net/wireless/broadcom/b43legacy/main.c
@@ -3300,8 +3300,8 @@ static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev)
 
         if ((phy->type == B43legacy_PHYTYPE_B) ||
             (phy->type == B43legacy_PHYTYPE_G)) {
-                phy->_lo_pairs = kzalloc(sizeof(struct b43legacy_lopair)
-                                         * B43legacy_LO_COUNT,
+                phy->_lo_pairs = kcalloc(B43legacy_LO_COUNT,
+                                         sizeof(struct b43legacy_lopair),
                                          GFP_KERNEL);
                 if (!phy->_lo_pairs)
                         return -ENOMEM;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index 49d37ad96958..c40ba8855cd5 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -1486,8 +1486,9 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
                 (struct brcmf_commonring **)if_msgbuf->commonrings;
         msgbuf->flowrings = (struct brcmf_commonring **)if_msgbuf->flowrings;
         msgbuf->max_flowrings = if_msgbuf->max_flowrings;
-        msgbuf->flowring_dma_handle = kzalloc(msgbuf->max_flowrings *
-                sizeof(*msgbuf->flowring_dma_handle), GFP_KERNEL);
+        msgbuf->flowring_dma_handle =
+                kcalloc(msgbuf->max_flowrings,
+                        sizeof(*msgbuf->flowring_dma_handle), GFP_KERNEL);
         if (!msgbuf->flowring_dma_handle)
                 goto fail;
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 4b2149b48362..3e9c4f2f5dd1 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -1058,7 +1058,7 @@ static s32 brcmf_p2p_act_frm_search(struct brcmf_p2p_info *p2p, u16 channel)
                 channel_cnt = AF_PEER_SEARCH_CNT;
         else
                 channel_cnt = SOCIAL_CHAN_CNT;
-        default_chan_list = kzalloc(channel_cnt * sizeof(*default_chan_list),
+        default_chan_list = kcalloc(channel_cnt, sizeof(*default_chan_list),
                                     GFP_KERNEL);
         if (default_chan_list == NULL) {
                 brcmf_err("channel list allocation failed\n");
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.c
index 0a14942b8216..7d4e8f589fdc 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.c
@@ -507,7 +507,7 @@ brcms_c_attach_malloc(uint unit, uint *err, uint devid)
         wlc->hw->wlc = wlc;
 
         wlc->hw->bandstate[0] =
-                kzalloc(sizeof(struct brcms_hw_band) * MAXBANDS, GFP_ATOMIC);
+                kcalloc(MAXBANDS, sizeof(struct brcms_hw_band), GFP_ATOMIC);
         if (wlc->hw->bandstate[0] == NULL) {
                 *err = 1006;
                 goto fail;
@@ -521,7 +521,8 @@ brcms_c_attach_malloc(uint unit, uint *err, uint devid)
         }
 
         wlc->modulecb =
-                kzalloc(sizeof(struct modulecb) * BRCMS_MAXMODULES, GFP_ATOMIC);
+                kcalloc(BRCMS_MAXMODULES, sizeof(struct modulecb),
+                        GFP_ATOMIC);
         if (wlc->modulecb == NULL) {
                 *err = 1009;
                 goto fail;
@@ -553,7 +554,7 @@ brcms_c_attach_malloc(uint unit, uint *err, uint devid)
         }
 
         wlc->bandstate[0] =
-                kzalloc(sizeof(struct brcms_band)*MAXBANDS, GFP_ATOMIC);
+                kcalloc(MAXBANDS, sizeof(struct brcms_band), GFP_ATOMIC);
         if (wlc->bandstate[0] == NULL) {
                 *err = 1025;
                 goto fail;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
index 9d830d27b229..9fb0d9fbd939 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -1387,7 +1387,7 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
         s16 *ptr;
         struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy;
 
-        ptr = kmalloc(sizeof(s16) * 131, GFP_ATOMIC);
+        ptr = kmalloc_array(131, sizeof(s16), GFP_ATOMIC);
         if (NULL == ptr)
                 return false;
         if (module == 2) {
@@ -2670,7 +2670,7 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi,
         u16 *values_to_save;
         struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy;
 
-        values_to_save = kmalloc(sizeof(u16) * 20, GFP_ATOMIC);
+        values_to_save = kmalloc_array(20, sizeof(u16), GFP_ATOMIC);
         if (NULL == values_to_save)
                 return;
 
@@ -3678,11 +3678,11 @@ wlc_lcnphy_a1(struct brcms_phy *pi, int cal_type, int num_levels,
         u16 *phy_c32;
         phy_c21 = 0;
         phy_c10 = phy_c13 = phy_c14 = phy_c8 = 0;
-        ptr = kmalloc(sizeof(s16) * 131, GFP_ATOMIC);
+        ptr = kmalloc_array(131, sizeof(s16), GFP_ATOMIC);
         if (NULL == ptr)
                 return;
 
-        phy_c32 = kmalloc(sizeof(u16) * 20, GFP_ATOMIC);
+        phy_c32 = kmalloc_array(20, sizeof(u16), GFP_ATOMIC);
         if (NULL == phy_c32) {
                 kfree(ptr);
                 return;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
index 7e01981bc5c8..1a187557982e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
@@ -23032,7 +23032,7 @@ wlc_phy_loadsampletable_nphy(struct brcms_phy *pi, struct cordic_iq *tone_buf,
         u16 t;
         u32 *data_buf = NULL;
 
-        data_buf = kmalloc(sizeof(u32) * num_samps, GFP_ATOMIC);
+        data_buf = kmalloc_array(num_samps, sizeof(u32), GFP_ATOMIC);
         if (data_buf == NULL)
                 return;
 
@@ -23074,7 +23074,8 @@ wlc_phy_gen_load_samples_nphy(struct brcms_phy *pi, u32 f_kHz, u16 max_val,
                 tbl_len = (phy_bw << 1);
         }
 
-        tone_buf = kmalloc(sizeof(struct cordic_iq) * tbl_len, GFP_ATOMIC);
+        tone_buf = kmalloc_array(tbl_len, sizeof(struct cordic_iq),
+                                 GFP_ATOMIC);
         if (tone_buf == NULL)
                 return 0;
 
diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
index ce0fbf83285f..72046e182745 100644
--- a/drivers/net/wireless/cisco/airo.c
+++ b/drivers/net/wireless/cisco/airo.c
@@ -7127,7 +7127,7 @@ static int airo_get_aplist(struct net_device *dev,
         int i;
         int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
 
-        qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
+        qual = kmalloc_array(IW_MAX_AP, sizeof(*qual), GFP_KERNEL);
         if (!qual)
                 return -ENOMEM;
 
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
index 7c4f550a1475..b8fd3cc90634 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
@@ -3445,8 +3445,9 @@ static int ipw2100_msg_allocate(struct ipw2100_priv *priv)
         dma_addr_t p;
 
         priv->msg_buffers =
-            kmalloc(IPW_COMMAND_POOL_SIZE * sizeof(struct ipw2100_tx_packet),
-                    GFP_KERNEL);
+            kmalloc_array(IPW_COMMAND_POOL_SIZE,
+                          sizeof(struct ipw2100_tx_packet),
+                          GFP_KERNEL);
         if (!priv->msg_buffers)
                 return -ENOMEM;
 
@@ -4587,9 +4588,9 @@ static int ipw2100_rx_allocate(struct ipw2100_priv *priv)
         /*
          * allocate packets
          */
-        priv->rx_buffers = kmalloc(RX_QUEUE_LENGTH *
-                                   sizeof(struct ipw2100_rx_packet),
-                                   GFP_KERNEL);
+        priv->rx_buffers = kmalloc_array(RX_QUEUE_LENGTH,
+                                         sizeof(struct ipw2100_rx_packet),
+                                         GFP_KERNEL);
         if (!priv->rx_buffers) {
                 IPW_DEBUG_INFO("can't allocate rx packet buffer table\n");
 
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
index f26beeb6c5ff..8a858f7e36f4 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
@@ -3208,13 +3208,13 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
 
         IPW_DEBUG_TRACE("<< :\n");
 
-        virts = kmalloc(sizeof(void *) * CB_NUMBER_OF_ELEMENTS_SMALL,
-                        GFP_KERNEL);
+        virts = kmalloc_array(CB_NUMBER_OF_ELEMENTS_SMALL, sizeof(void *),
+                              GFP_KERNEL);
         if (!virts)
                 return -ENOMEM;
 
-        phys = kmalloc(sizeof(dma_addr_t) * CB_NUMBER_OF_ELEMENTS_SMALL,
-                        GFP_KERNEL);
+        phys = kmalloc_array(CB_NUMBER_OF_ELEMENTS_SMALL, sizeof(dma_addr_t),
+                             GFP_KERNEL);
         if (!phys) {
                 kfree(virts);
                 return -ENOMEM;
@@ -3782,7 +3782,7 @@ static int ipw_queue_tx_init(struct ipw_priv *priv,
 {
         struct pci_dev *dev = priv->pci_dev;
 
-        q->txb = kmalloc(sizeof(q->txb[0]) * count, GFP_KERNEL);
+        q->txb = kmalloc_array(count, sizeof(q->txb[0]), GFP_KERNEL);
         if (!q->txb) {
                 IPW_ERROR("vmalloc for auxiliary BD structures failed\n");
                 return -ENOMEM;
diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
index 063e19ced7c8..6514baf799fe 100644
--- a/drivers/net/wireless/intel/iwlegacy/common.c
+++ b/drivers/net/wireless/intel/iwlegacy/common.c
@@ -922,7 +922,7 @@ il_init_channel_map(struct il_priv *il)
         D_EEPROM("Parsing data for %d channels.\n", il->channel_count);
 
         il->channel_info =
-            kzalloc(sizeof(struct il_channel_info) * il->channel_count,
+            kcalloc(il->channel_count, sizeof(struct il_channel_info),
                     GFP_KERNEL);
         if (!il->channel_info) {
                 IL_ERR("Could not allocate channel_info\n");
@@ -3041,9 +3041,9 @@ il_tx_queue_init(struct il_priv *il, u32 txq_id)
         }
 
         txq->meta =
-            kzalloc(sizeof(struct il_cmd_meta) * actual_slots, GFP_KERNEL);
+            kcalloc(actual_slots, sizeof(struct il_cmd_meta), GFP_KERNEL);
         txq->cmd =
-            kzalloc(sizeof(struct il_device_cmd *) * actual_slots, GFP_KERNEL);
+            kcalloc(actual_slots, sizeof(struct il_device_cmd *), GFP_KERNEL);
 
         if (!txq->meta || !txq->cmd)
                 goto out_free_arrays;
@@ -3455,7 +3455,7 @@ il_init_geos(struct il_priv *il)
         }
 
         channels =
-            kzalloc(sizeof(struct ieee80211_channel) * il->channel_count,
+            kcalloc(il->channel_count, sizeof(struct ieee80211_channel),
                     GFP_KERNEL);
         if (!channels)
                 return -ENOMEM;
@@ -4654,8 +4654,9 @@ il_alloc_txq_mem(struct il_priv *il)
 {
         if (!il->txq)
                 il->txq =
-                    kzalloc(sizeof(struct il_tx_queue) *
-                            il->cfg->num_of_queues, GFP_KERNEL);
+                    kcalloc(il->cfg->num_of_queues,
+                            sizeof(struct il_tx_queue),
+                            GFP_KERNEL);
         if (!il->txq) {
                 IL_ERR("Not enough memory for txq\n");
                 return -ENOMEM;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 4b3753d78d03..11ecdf63b732 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -564,7 +564,7 @@ iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
         else
                 blacklist_len = IWL_SCAN_MAX_BLACKLIST_LEN;
 
-        blacklist = kzalloc(sizeof(*blacklist) * blacklist_len, GFP_KERNEL);
+        blacklist = kcalloc(blacklist_len, sizeof(*blacklist), GFP_KERNEL);
         if (!blacklist)
                 return -ENOMEM;
 
diff --git a/drivers/net/wireless/intersil/hostap/hostap_info.c b/drivers/net/wireless/intersil/hostap/hostap_info.c
index de8a099a9386..da8c30f10d92 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_info.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_info.c
@@ -271,8 +271,9 @@ static void prism2_info_scanresults(local_info_t *local, unsigned char *buf,
         left -= 4;
 
         new_count = left / sizeof(struct hfa384x_scan_result);
-        results = kmalloc(new_count * sizeof(struct hfa384x_hostscan_result),
-                          GFP_ATOMIC);
+        results = kmalloc_array(new_count,
+                                sizeof(struct hfa384x_hostscan_result),
+                                GFP_ATOMIC);
         if (results == NULL)
                 return;
 
diff --git a/drivers/net/wireless/intersil/hostap/hostap_ioctl.c b/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
index c1bc0a6ef300..1ca9731d9b14 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
@@ -513,8 +513,8 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
                 return -EOPNOTSUPP;
         }
 
-        addr = kmalloc(sizeof(struct sockaddr) * IW_MAX_AP, GFP_KERNEL);
-        qual = kmalloc(sizeof(struct iw_quality) * IW_MAX_AP, GFP_KERNEL);
+        addr = kmalloc_array(IW_MAX_AP, sizeof(struct sockaddr), GFP_KERNEL);
+        qual = kmalloc_array(IW_MAX_AP, sizeof(struct iw_quality), GFP_KERNEL);
         if (addr == NULL || qual == NULL) {
                 kfree(addr);
                 kfree(qual);
diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wireless/intersil/p54/eeprom.c
index d4c73d39336f..de2ef95c386c 100644
--- a/drivers/net/wireless/intersil/p54/eeprom.c
+++ b/drivers/net/wireless/intersil/p54/eeprom.c
@@ -161,8 +161,9 @@ static int p54_generate_band(struct ieee80211_hw *dev,
         if (!tmp)
                 goto err_out;
 
-        tmp->channels = kzalloc(sizeof(struct ieee80211_channel) *
-                                list->band_channel_num[band], GFP_KERNEL);
+        tmp->channels = kcalloc(list->band_channel_num[band],
+                                sizeof(struct ieee80211_channel),
+                                GFP_KERNEL);
         if (!tmp->channels)
                 goto err_out;
 
@@ -344,7 +345,7 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
                 goto free;
         }
         priv->chan_num = max_channel_num;
-        priv->survey = kzalloc(sizeof(struct survey_info) * max_channel_num,
+        priv->survey = kcalloc(max_channel_num, sizeof(struct survey_info),
                                GFP_KERNEL);
         if (!priv->survey) {
                 ret = -ENOMEM;
@@ -352,8 +353,9 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
         }
 
         list->max_entries = max_channel_num;
-        list->channels = kzalloc(sizeof(struct p54_channel_entry) *
-                                 max_channel_num, GFP_KERNEL);
+        list->channels = kcalloc(max_channel_num,
+                                 sizeof(struct p54_channel_entry),
+                                 GFP_KERNEL);
         if (!list->channels) {
                 ret = -ENOMEM;
                 goto free;
diff --git a/drivers/net/wireless/intersil/prism54/oid_mgt.c b/drivers/net/wireless/intersil/prism54/oid_mgt.c
index 6528ed5b9b1d..6d57e1cbcc07 100644
--- a/drivers/net/wireless/intersil/prism54/oid_mgt.c
+++ b/drivers/net/wireless/intersil/prism54/oid_mgt.c
@@ -244,7 +244,7 @@ mgt_init(islpci_private *priv)
         /* Alloc the cache */
         for (i = 0; i < OID_NUM_LAST; i++) {
                 if (isl_oid[i].flags & OID_FLAG_CACHED) {
-                        priv->mib[i] = kzalloc(isl_oid[i].size *
+                        priv->mib[i] = kcalloc(isl_oid[i].size,
                                                (isl_oid[i].range + 1),
                                                GFP_KERNEL);
                         if (!priv->mib[i])
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index 1edcddaf7b4b..7ab44cd32a9d 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -399,8 +399,8 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 
         new_node->win_size = win_size;
 
-        new_node->rx_reorder_ptr = kzalloc(sizeof(void *) * win_size,
-                                        GFP_KERNEL);
+        new_node->rx_reorder_ptr = kcalloc(win_size, sizeof(void *),
+                                           GFP_KERNEL);
         if (!new_node->rx_reorder_ptr) {
                 kfree((u8 *) new_node);
                 mwifiex_dbg(priv->adapter, ERROR,
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index a67e2d66ac9d..4b5ae9098504 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -4242,8 +4242,8 @@ int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter)
          * additional active scan request for hidden SSIDs on passive channels.
          */
         adapter->num_in_chan_stats = 2 * (n_channels_bg + n_channels_a);
-        adapter->chan_stats = vmalloc(sizeof(*adapter->chan_stats) *
-                                      adapter->num_in_chan_stats);
+        adapter->chan_stats = vmalloc(array_size(sizeof(*adapter->chan_stats),
+                                                 adapter->num_in_chan_stats));
 
         if (!adapter->chan_stats)
                 return -ENOMEM;
diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
index 47d2dcc3f28f..dfdcbc4f141a 100644
--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
+++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
@@ -2106,15 +2106,16 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
                 return -ENOMEM;
 
         /* Allocate skb pointer buffers */
-        card->mpa_rx.skb_arr = kzalloc((sizeof(void *)) *
-                                       card->mp_agg_pkt_limit, GFP_KERNEL);
+        card->mpa_rx.skb_arr = kcalloc(card->mp_agg_pkt_limit, sizeof(void *),
+                                       GFP_KERNEL);
         if (!card->mpa_rx.skb_arr) {
                 kfree(card->mp_regs);
                 return -ENOMEM;
         }
 
-        card->mpa_rx.len_arr = kzalloc(sizeof(*card->mpa_rx.len_arr) *
-                                       card->mp_agg_pkt_limit, GFP_KERNEL);
+        card->mpa_rx.len_arr = kcalloc(card->mp_agg_pkt_limit,
+                                       sizeof(*card->mpa_rx.len_arr),
+                                       GFP_KERNEL);
         if (!card->mpa_rx.len_arr) {
                 kfree(card->mp_regs);
                 kfree(card->mpa_rx.skb_arr);
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index fcd079a96782..d62e34e7eadf 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -181,7 +181,7 @@ mt76_init_sband(struct mt76_dev *dev, struct mt76_sband *msband,
         if (!chanlist)
                 return -ENOMEM;
 
-        msband->chan = devm_kzalloc(dev->dev, n_chan * sizeof(*msband->chan),
+        msband->chan = devm_kcalloc(dev->dev, n_chan, sizeof(*msband->chan),
                                     GFP_KERNEL);
         if (!msband->chan)
                 return -ENOMEM;
diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c
index 5eb143667539..c5d94a95e21a 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c
@@ -1216,7 +1216,7 @@ static int qtnf_parse_variable_mac_info(struct qtnf_wmac *mac,
                                 return -EINVAL;
                         }
 
-                        limits = kzalloc(sizeof(*limits) * rec->n_limits,
+                        limits = kcalloc(rec->n_limits, sizeof(*limits),
                                          GFP_KERNEL);
                         if (!limits)
                                 return -ENOMEM;
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
index 0eee479583b8..acc399b5574e 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
@@ -397,7 +397,7 @@ static ssize_t rt2x00debug_read_crypto_stats(struct file *file,
         if (*offset)
                 return 0;
 
-        data = kzalloc((1 + CIPHER_MAX) * MAX_LINE_LENGTH, GFP_KERNEL);
+        data = kcalloc(1 + CIPHER_MAX, MAX_LINE_LENGTH, GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/efuse.c b/drivers/net/wireless/realtek/rtlwifi/efuse.c
index fd13d4ef53b8..9729e51fce38 100644
--- a/drivers/net/wireless/realtek/rtlwifi/efuse.c
+++ b/drivers/net/wireless/realtek/rtlwifi/efuse.c
@@ -258,8 +258,8 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
         }
 
         /* allocate memory for efuse_tbl and efuse_word */
-        efuse_tbl = kzalloc(rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE] *
-                            sizeof(u8), GFP_ATOMIC);
+        efuse_tbl = kzalloc(rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE],
+                            GFP_ATOMIC);
         if (!efuse_tbl)
                 return;
         efuse_word = kcalloc(EFUSE_MAX_WORD_UNIT, sizeof(u16 *), GFP_ATOMIC);
diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index ce3103bb8ebb..f9faffc498bc 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -1048,7 +1048,7 @@ int rtl_usb_probe(struct usb_interface *intf,
         }
         rtlpriv = hw->priv;
         rtlpriv->hw = hw;
-        rtlpriv->usb_data = kzalloc(RTL_USB_MAX_RX_COUNT * sizeof(u32),
+        rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32),
                                     GFP_KERNEL);
         if (!rtlpriv->usb_data)
                 return -ENOMEM;
diff --git a/drivers/net/wireless/st/cw1200/queue.c b/drivers/net/wireless/st/cw1200/queue.c
index 5153d2cfd991..7c31b63b8258 100644
--- a/drivers/net/wireless/st/cw1200/queue.c
+++ b/drivers/net/wireless/st/cw1200/queue.c
@@ -154,7 +154,7 @@ int cw1200_queue_stats_init(struct cw1200_queue_stats *stats,
         spin_lock_init(&stats->lock);
         init_waitqueue_head(&stats->wait_link_id_empty);
 
-        stats->link_map_cache = kzalloc(sizeof(int) * map_capacity,
+        stats->link_map_cache = kcalloc(map_capacity, sizeof(int),
                                         GFP_KERNEL);
         if (!stats->link_map_cache)
                 return -ENOMEM;
@@ -181,13 +181,13 @@ int cw1200_queue_init(struct cw1200_queue *queue,
         spin_lock_init(&queue->lock);
         timer_setup(&queue->gc, cw1200_queue_gc, 0);
 
-        queue->pool = kzalloc(sizeof(struct cw1200_queue_item) * capacity,
-                        GFP_KERNEL);
+        queue->pool = kcalloc(capacity, sizeof(struct cw1200_queue_item),
+                              GFP_KERNEL);
         if (!queue->pool)
                 return -ENOMEM;
 
-        queue->link_map_cache = kzalloc(sizeof(int) * stats->map_capacity,
-                        GFP_KERNEL);
+        queue->link_map_cache = kcalloc(stats->map_capacity, sizeof(int),
+                                        GFP_KERNEL);
         if (!queue->link_map_cache) {
                 kfree(queue->pool);
                 queue->pool = NULL;
diff --git a/drivers/net/wireless/st/cw1200/scan.c b/drivers/net/wireless/st/cw1200/scan.c
index cc2ce60f4f09..67213f11acbd 100644
--- a/drivers/net/wireless/st/cw1200/scan.c
+++ b/drivers/net/wireless/st/cw1200/scan.c
@@ -230,9 +230,9 @@ void cw1200_scan_work(struct work_struct *work)
                         scan.type = WSM_SCAN_TYPE_BACKGROUND;
                         scan.flags = WSM_SCAN_FLAG_FORCE_BACKGROUND;
                 }
-                scan.ch = kzalloc(
-                        sizeof(struct wsm_scan_ch) * (it - priv->scan.curr),
-                        GFP_KERNEL);
+                scan.ch = kcalloc(it - priv->scan.curr,
+                                  sizeof(struct wsm_scan_ch),
+                                  GFP_KERNEL);
                 if (!scan.ch) {
                         priv->scan.status = -ENOMEM;
                         goto fail;
diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
index b01b44a5d16e..1f6d9f357e57 100644
--- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
@@ -732,7 +732,8 @@ static int zd_mac_config_beacon(struct ieee80211_hw *hw, struct sk_buff *beacon,
 
         /* Alloc memory for full beacon write at once. */
         num_cmds = 1 + zd_chip_is_zd1211b(&mac->chip) + full_len;
-        ioreqs = kmalloc(num_cmds * sizeof(struct zd_ioreq32), GFP_KERNEL);
+        ioreqs = kmalloc_array(num_cmds, sizeof(struct zd_ioreq32),
+                               GFP_KERNEL);
         if (!ioreqs) {
                 r = -ENOMEM;
                 goto out_nofree;
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index e1aef253601e..cd51492ae6c2 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -977,8 +977,8 @@ static void connect(struct backend_info *be)
         }
 
         /* Use the number of queues requested by the frontend */
-        be->vif->queues = vzalloc(requested_num_queues *
-                                  sizeof(struct xenvif_queue));
+        be->vif->queues = vzalloc(array_size(requested_num_queues,
+                                             sizeof(struct xenvif_queue)));
         if (!be->vif->queues) {
                 xenbus_dev_fatal(dev, -ENOMEM,
                                  "allocating queues");
diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
index c4da50e07bbc..d8d70dd830b0 100644
--- a/drivers/nfc/fdp/i2c.c
+++ b/drivers/nfc/fdp/i2c.c
@@ -259,8 +259,8 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev,
                 /* Add 1 to the length to inclue the length byte itself */
                 len++;
 
-                *fw_vsc_cfg = devm_kmalloc(dev,
-                                           len * sizeof(**fw_vsc_cfg),
+                *fw_vsc_cfg = devm_kmalloc_array(dev,
+                                           len, sizeof(**fw_vsc_cfg),
                                            GFP_KERNEL);
 
                 r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME,
diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
index 3cfa46876239..efb214fc545a 100644
--- a/drivers/ntb/hw/amd/ntb_hw_amd.c
+++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
@@ -592,12 +592,12 @@ static int ndev_init_isr(struct amd_ntb_dev *ndev,
         ndev->db_mask = ndev->db_valid_mask;
 
         /* Try to set up msix irq */
-        ndev->vec = kzalloc_node(msix_max * sizeof(*ndev->vec),
+        ndev->vec = kcalloc_node(msix_max, sizeof(*ndev->vec),
                                  GFP_KERNEL, node);
         if (!ndev->vec)
                 goto err_msix_vec_alloc;
 
-        ndev->msix = kzalloc_node(msix_max * sizeof(*ndev->msix),
+        ndev->msix = kcalloc_node(msix_max, sizeof(*ndev->msix),
                                   GFP_KERNEL, node);
         if (!ndev->msix)
                 goto err_msix_alloc;
diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c
index ffdee98e8ece..6aa573227279 100644
--- a/drivers/ntb/hw/intel/ntb_hw_gen1.c
+++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c
@@ -380,12 +380,12 @@ int ndev_init_isr(struct intel_ntb_dev *ndev,
 
         /* Try to set up msix irq */
 
-        ndev->vec = kzalloc_node(msix_max * sizeof(*ndev->vec),
+        ndev->vec = kcalloc_node(msix_max, sizeof(*ndev->vec),
                                  GFP_KERNEL, node);
         if (!ndev->vec)
                 goto err_msix_vec_alloc;
 
-        ndev->msix = kzalloc_node(msix_max * sizeof(*ndev->msix),
+        ndev->msix = kcalloc_node(msix_max, sizeof(*ndev->msix),
                                   GFP_KERNEL, node);
         if (!ndev->msix)
                 goto err_msix_alloc;
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 8145be34328b..939895966476 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1102,7 +1102,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
         max_mw_count_for_spads = (spad_count - MW0_SZ_HIGH) / 2;
         nt->mw_count = min(mw_count, max_mw_count_for_spads);
 
-        nt->mw_vec = kzalloc_node(mw_count * sizeof(*nt->mw_vec),
+        nt->mw_vec = kcalloc_node(mw_count, sizeof(*nt->mw_vec),
                                   GFP_KERNEL, node);
         if (!nt->mw_vec) {
                 rc = -ENOMEM;
@@ -1143,7 +1143,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
         nt->qp_bitmap = qp_bitmap;
         nt->qp_bitmap_free = qp_bitmap;
 
-        nt->qp_vec = kzalloc_node(qp_count * sizeof(*nt->qp_vec),
+        nt->qp_vec = kcalloc_node(qp_count, sizeof(*nt->qp_vec),
                                   GFP_KERNEL, node);
         if (!nt->qp_vec) {
                 rc = -ENOMEM;
diff --git a/drivers/nvmem/rockchip-efuse.c b/drivers/nvmem/rockchip-efuse.c
index b3b0b648be62..146de9489339 100644
--- a/drivers/nvmem/rockchip-efuse.c
+++ b/drivers/nvmem/rockchip-efuse.c
@@ -122,7 +122,8 @@ static int rockchip_rk3328_efuse_read(void *context, unsigned int offset,
         addr_offset = offset % RK3399_NBYTES;
         addr_len = addr_end - addr_start;
 
-        buf = kzalloc(sizeof(*buf) * addr_len * RK3399_NBYTES, GFP_KERNEL);
+        buf = kzalloc(array3_size(addr_len, RK3399_NBYTES, sizeof(*buf)),
+                      GFP_KERNEL);
         if (!buf) {
                 ret = -ENOMEM;
                 goto nomem;
@@ -174,7 +175,8 @@ static int rockchip_rk3399_efuse_read(void *context, unsigned int offset,
         addr_offset = offset % RK3399_NBYTES;
         addr_len = addr_end - addr_start;
 
-        buf = kzalloc(sizeof(*buf) * addr_len * RK3399_NBYTES, GFP_KERNEL);
+        buf = kzalloc(array3_size(addr_len, RK3399_NBYTES, sizeof(*buf)),
+                      GFP_KERNEL);
         if (!buf) {
                 clk_disable_unprepare(efuse->clk);
                 return -ENOMEM;
diff --git a/drivers/nvmem/sunxi_sid.c b/drivers/nvmem/sunxi_sid.c
index 26bb637afe92..d020f89248fd 100644
--- a/drivers/nvmem/sunxi_sid.c
+++ b/drivers/nvmem/sunxi_sid.c
@@ -185,7 +185,7 @@ static int sunxi_sid_probe(struct platform_device *pdev)
         if (IS_ERR(nvmem))
                 return PTR_ERR(nvmem);
 
-        randomness = kzalloc(sizeof(u8) * (size), GFP_KERNEL);
+        randomness = kzalloc(size, GFP_KERNEL);
         if (!randomness) {
                 ret = -EINVAL;
                 goto err_unreg_nvmem;
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 59731a950c1f..6925d993e1f0 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -129,7 +129,7 @@ struct platform_device *of_device_alloc(struct device_node *np,
 
         /* Populate the resource table */
         if (num_irq || num_reg) {
-                res = kzalloc(sizeof(*res) * (num_irq + num_reg), GFP_KERNEL);
+                res = kcalloc(num_irq + num_reg, sizeof(*res), GFP_KERNEL);
                 if (!res) {
                         platform_device_put(dev);
                         return NULL;
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index ecee50d10d14..722537e14848 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -156,7 +156,7 @@ static void __init of_unittest_dynamic(void)
         }
 
         /* Array of 4 properties for the purpose of testing */
-        prop = kzalloc(sizeof(*prop) * 4, GFP_KERNEL);
+        prop = kcalloc(4, sizeof(*prop), GFP_KERNEL);
         if (!prop) {
                 unittest(0, "kzalloc() failed\n");
                 return;
diff --git a/drivers/opp/ti-opp-supply.c b/drivers/opp/ti-opp-supply.c
index 370eff3acd8a..9e5a9a3112c9 100644
--- a/drivers/opp/ti-opp-supply.c
+++ b/drivers/opp/ti-opp-supply.c
@@ -122,8 +122,8 @@ static int _store_optimized_voltages(struct device *dev,
                 goto out;
         }
 
-        table = kzalloc(sizeof(*data->vdd_table) *
-                                  data->num_vdd_table, GFP_KERNEL);
+        table = kcalloc(data->num_vdd_table, sizeof(*data->vdd_table),
+                        GFP_KERNEL);
         if (!table) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
index 32888f2bd1a9..12ea4a4ad607 100644
--- a/drivers/oprofile/event_buffer.c
+++ b/drivers/oprofile/event_buffer.c
@@ -91,7 +91,7 @@ int alloc_event_buffer(void)
                 return -EINVAL;
 
         buffer_pos = 0;
-        event_buffer = vmalloc(sizeof(unsigned long) * buffer_size);
+        event_buffer = vmalloc(array_size(buffer_size, sizeof(unsigned long)));
         if (!event_buffer)
                 return -ENOMEM;
 
diff --git a/drivers/pci/controller/dwc/pci-dra7xx.c b/drivers/pci/controller/dwc/pci-dra7xx.c
index cfaeef81d868..345aab56ce8b 100644
--- a/drivers/pci/controller/dwc/pci-dra7xx.c
+++ b/drivers/pci/controller/dwc/pci-dra7xx.c
@@ -639,11 +639,11 @@ static int __init dra7xx_pcie_probe(struct platform_device *pdev)
                 return phy_count;
         }
 
-        phy = devm_kzalloc(dev, sizeof(*phy) * phy_count, GFP_KERNEL);
+        phy = devm_kcalloc(dev, phy_count, sizeof(*phy), GFP_KERNEL);
         if (!phy)
                 return -ENOMEM;
 
-        link = devm_kzalloc(dev, sizeof(*link) * phy_count, GFP_KERNEL);
+        link = devm_kcalloc(dev, phy_count, sizeof(*link), GFP_KERNEL);
         if (!link)
                 return -ENOMEM;
 
diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
index 1eec4415a77f..8650416f6f9e 100644
--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
@@ -366,19 +366,21 @@ int dw_pcie_ep_init(struct dw_pcie_ep *ep)
                 return -EINVAL;
         }
 
-        ep->ib_window_map = devm_kzalloc(dev, sizeof(long) *
+        ep->ib_window_map = devm_kcalloc(dev,
                                          BITS_TO_LONGS(ep->num_ib_windows),
+                                         sizeof(long),
                                          GFP_KERNEL);
         if (!ep->ib_window_map)
                 return -ENOMEM;
 
-        ep->ob_window_map = devm_kzalloc(dev, sizeof(long) *
+        ep->ob_window_map = devm_kcalloc(dev,
                                          BITS_TO_LONGS(ep->num_ob_windows),
+                                         sizeof(long),
                                          GFP_KERNEL);
         if (!ep->ob_window_map)
                 return -ENOMEM;
 
-        addr = devm_kzalloc(dev, sizeof(phys_addr_t) * ep->num_ob_windows,
+        addr = devm_kcalloc(dev, ep->num_ob_windows, sizeof(phys_addr_t),
                             GFP_KERNEL);
         if (!addr)
                 return -ENOMEM;
diff --git a/drivers/pci/controller/pcie-cadence-ep.c b/drivers/pci/controller/pcie-cadence-ep.c
index 3d8283e450a9..e3fe4124e3af 100644
--- a/drivers/pci/controller/pcie-cadence-ep.c
+++ b/drivers/pci/controller/pcie-cadence-ep.c
@@ -467,7 +467,8 @@ static int cdns_pcie_ep_probe(struct platform_device *pdev)
                 dev_err(dev, "missing \"cdns,max-outbound-regions\"\n");
                 return ret;
         }
-        ep->ob_addr = devm_kzalloc(dev, ep->max_regions * sizeof(*ep->ob_addr),
+        ep->ob_addr = devm_kcalloc(dev,
+                                   ep->max_regions, sizeof(*ep->ob_addr),
                                    GFP_KERNEL);
         if (!ep->ob_addr)
                 return -ENOMEM;
diff --git a/drivers/pci/controller/pcie-rockchip-ep.c b/drivers/pci/controller/pcie-rockchip-ep.c
index fc267a49a932..6beba8ed7b84 100644
--- a/drivers/pci/controller/pcie-rockchip-ep.c
+++ b/drivers/pci/controller/pcie-rockchip-ep.c
@@ -593,7 +593,7 @@ static int rockchip_pcie_ep_probe(struct platform_device *pdev)
                             PCIE_CLIENT_CONFIG);
 
         max_regions = ep->max_regions;
-        ep->ob_addr = devm_kzalloc(dev, max_regions * sizeof(*ep->ob_addr),
+        ep->ob_addr = devm_kcalloc(dev, max_regions, sizeof(*ep->ob_addr),
                                    GFP_KERNEL);
 
         if (!ep->ob_addr) {
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index f45b74fcc059..4d88afdfc843 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -474,7 +474,7 @@ static int populate_msi_sysfs(struct pci_dev *pdev)
                 return 0;
 
         /* Dynamically create the MSI attributes for the PCI device */
-        msi_attrs = kzalloc(sizeof(void *) * (num_msi + 1), GFP_KERNEL);
+        msi_attrs = kcalloc(num_msi + 1, sizeof(void *), GFP_KERNEL);
         if (!msi_attrs)
                 return -ENOMEM;
         for_each_pci_msi_entry(entry, pdev) {
@@ -501,7 +501,7 @@ static int populate_msi_sysfs(struct pci_dev *pdev)
         msi_irq_group->name = "msi_irqs";
         msi_irq_group->attrs = msi_attrs;
 
-        msi_irq_groups = kzalloc(sizeof(void *) * 2, GFP_KERNEL);
+        msi_irq_groups = kcalloc(2, sizeof(void *), GFP_KERNEL);
         if (!msi_irq_groups)
                 goto error_irq_group;
         msi_irq_groups[0] = msi_irq_group;
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 788a200fb2dc..0c4653c1d2ce 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -1076,7 +1076,7 @@ void pci_create_legacy_files(struct pci_bus *b)
 {
         int error;
 
-        b->legacy_io = kzalloc(sizeof(struct bin_attribute) * 2,
+        b->legacy_io = kcalloc(2, sizeof(struct bin_attribute),
                                GFP_ATOMIC);
         if (!b->legacy_io)
                 goto kzalloc_err;
diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
index 102646fedb56..ac0672b8dfca 100644
--- a/drivers/pcmcia/cistpl.c
+++ b/drivers/pcmcia/cistpl.c
@@ -1481,11 +1481,11 @@ static ssize_t pccard_extract_cis(struct pcmcia_socket *s, char *buf,
         u_char *tuplebuffer;
         u_char *tempbuffer;
 
-        tuplebuffer = kmalloc(sizeof(u_char) * 256, GFP_KERNEL);
+        tuplebuffer = kmalloc_array(256, sizeof(u_char), GFP_KERNEL);
         if (!tuplebuffer)
                 return -ENOMEM;
 
-        tempbuffer = kmalloc(sizeof(u_char) * 258, GFP_KERNEL);
+        tempbuffer = kmalloc_array(258, sizeof(u_char), GFP_KERNEL);
         if (!tempbuffer) {
                 ret = -ENOMEM;
                 goto free_tuple;
diff --git a/drivers/pcmcia/pd6729.c b/drivers/pcmcia/pd6729.c
index 959ae3e65ef8..f0af9985ca09 100644
--- a/drivers/pcmcia/pd6729.c
+++ b/drivers/pcmcia/pd6729.c
@@ -628,7 +628,7 @@ static int pd6729_pci_probe(struct pci_dev *dev,
         char configbyte;
         struct pd6729_socket *socket;
 
-        socket = kzalloc(sizeof(struct pd6729_socket) * MAX_SOCKETS,
+        socket = kcalloc(MAX_SOCKETS, sizeof(struct pd6729_socket),
                          GFP_KERNEL);
         if (!socket) {
                 dev_warn(&dev->dev, "failed to kzalloc socket.\n");
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index 136ccaf53df8..fa530913a2c8 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -771,8 +771,8 @@ static int bcm2835_pctl_dt_node_to_map(struct pinctrl_dev *pctldev,
                 maps_per_pin++;
         if (num_pulls)
                 maps_per_pin++;
-        cur_map = maps = kzalloc(num_pins * maps_per_pin * sizeof(*maps),
-                                GFP_KERNEL);
+        cur_map = maps = kcalloc(num_pins * maps_per_pin, sizeof(*maps),
+                                 GFP_KERNEL);
         if (!maps)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/berlin/berlin.c b/drivers/pinctrl/berlin/berlin.c
index a620a8e8fa78..d6d183e9db17 100644
--- a/drivers/pinctrl/berlin/berlin.c
+++ b/drivers/pinctrl/berlin/berlin.c
@@ -216,8 +216,9 @@ static int berlin_pinctrl_build_state(struct platform_device *pdev)
         }
 
         /* we will reallocate later */
-        pctrl->functions = devm_kzalloc(&pdev->dev,
-                                        max_functions * sizeof(*pctrl->functions),
+        pctrl->functions = devm_kcalloc(&pdev->dev,
+                                        max_functions,
+                                        sizeof(*pctrl->functions),
                                         GFP_KERNEL);
         if (!pctrl->functions)
                 return -ENOMEM;
@@ -261,8 +262,9 @@ static int berlin_pinctrl_build_state(struct platform_device *pdev)
 
                         if (!function->groups) {
                                 function->groups =
-                                        devm_kzalloc(&pdev->dev,
-                                                     function->ngroups * sizeof(char *),
+                                        devm_kcalloc(&pdev->dev,
+                                                     function->ngroups,
+                                                     sizeof(char *),
                                                      GFP_KERNEL);
 
                                 if (!function->groups)
diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
index e582a21cfe54..1c6bb15579e1 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx.c
@@ -81,7 +81,8 @@ static int imx_dt_node_to_map(struct pinctrl_dev *pctldev,
                         map_num++;
         }
 
-        new_map = kmalloc(sizeof(struct pinctrl_map) * map_num, GFP_KERNEL);
+        new_map = kmalloc_array(map_num, sizeof(struct pinctrl_map),
+                                GFP_KERNEL);
         if (!new_map)
                 return -ENOMEM;
 
@@ -476,10 +477,12 @@ static int imx_pinctrl_parse_groups(struct device_node *np,
         config = imx_pinconf_parse_generic_config(np, ipctl);
 
         grp->num_pins = size / pin_size;
-        grp->data = devm_kzalloc(ipctl->dev, grp->num_pins *
-                                 sizeof(struct imx_pin), GFP_KERNEL);
-        grp->pins = devm_kzalloc(ipctl->dev, grp->num_pins *
-                                 sizeof(unsigned int), GFP_KERNEL);
+        grp->data = devm_kcalloc(ipctl->dev,
+                                 grp->num_pins, sizeof(struct imx_pin),
+                                 GFP_KERNEL);
+        grp->pins = devm_kcalloc(ipctl->dev,
+                                 grp->num_pins, sizeof(unsigned int),
+                                 GFP_KERNEL);
         if (!grp->pins || !grp->data)
                 return -ENOMEM;
 
@@ -697,8 +700,9 @@ int imx_pinctrl_probe(struct platform_device *pdev,
         if (!ipctl)
                 return -ENOMEM;
 
-        ipctl->pin_regs = devm_kmalloc(&pdev->dev, sizeof(*ipctl->pin_regs) *
-                                      info->npins, GFP_KERNEL);
+        ipctl->pin_regs = devm_kmalloc_array(&pdev->dev,
+                                       info->npins, sizeof(*ipctl->pin_regs),
+                                       GFP_KERNEL);
         if (!ipctl->pin_regs)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
index 5af89de0ff02..c3bdd90b1422 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
@@ -241,7 +241,8 @@ static int imx1_dt_node_to_map(struct pinctrl_dev *pctldev,
         for (i = 0; i < grp->npins; i++)
                 map_num++;
 
-        new_map = kmalloc(sizeof(struct pinctrl_map) * map_num, GFP_KERNEL);
+        new_map = kmalloc_array(map_num, sizeof(struct pinctrl_map),
+                                GFP_KERNEL);
         if (!new_map)
                 return -ENOMEM;
 
@@ -482,10 +483,10 @@ static int imx1_pinctrl_parse_groups(struct device_node *np,
         }
 
         grp->npins = size / 12;
-        grp->pins = devm_kzalloc(info->dev,
-                        grp->npins * sizeof(struct imx1_pin), GFP_KERNEL);
-        grp->pin_ids = devm_kzalloc(info->dev,
-                        grp->npins * sizeof(unsigned int), GFP_KERNEL);
+        grp->pins = devm_kcalloc(info->dev,
+                        grp->npins, sizeof(struct imx1_pin), GFP_KERNEL);
+        grp->pin_ids = devm_kcalloc(info->dev,
+                        grp->npins, sizeof(unsigned int), GFP_KERNEL);
 
         if (!grp->pins || !grp->pin_ids)
                 return -ENOMEM;
@@ -522,8 +523,8 @@ static int imx1_pinctrl_parse_functions(struct device_node *np,
         if (func->num_groups == 0)
                 return -EINVAL;
 
-        func->groups = devm_kzalloc(info->dev,
-                        func->num_groups * sizeof(char *), GFP_KERNEL);
+        func->groups = devm_kcalloc(info->dev,
+                        func->num_groups, sizeof(char *), GFP_KERNEL);
 
         if (!func->groups)
                 return -ENOMEM;
@@ -565,12 +566,12 @@ static int imx1_pinctrl_parse_dt(struct platform_device *pdev,
         }
 
         info->nfunctions = nfuncs;
-        info->functions = devm_kzalloc(&pdev->dev,
-                        nfuncs * sizeof(struct imx1_pmx_func), GFP_KERNEL);
+        info->functions = devm_kcalloc(&pdev->dev,
+                        nfuncs, sizeof(struct imx1_pmx_func), GFP_KERNEL);
 
         info->ngroups = ngroups;
-        info->groups = devm_kzalloc(&pdev->dev,
-                        ngroups * sizeof(struct imx1_pin_group), GFP_KERNEL);
+        info->groups = devm_kcalloc(&pdev->dev,
+                        ngroups, sizeof(struct imx1_pin_group), GFP_KERNEL);
 
 
         if (!info->functions || !info->groups)
diff --git a/drivers/pinctrl/freescale/pinctrl-mxs.c b/drivers/pinctrl/freescale/pinctrl-mxs.c
index 594f3e5ce9a9..a612e46ca51c 100644
--- a/drivers/pinctrl/freescale/pinctrl-mxs.c
+++ b/drivers/pinctrl/freescale/pinctrl-mxs.c
@@ -89,7 +89,7 @@ static int mxs_dt_node_to_map(struct pinctrl_dev *pctldev,
         if (!purecfg && config)
                 new_num = 2;
 
-        new_map = kzalloc(sizeof(*new_map) * new_num, GFP_KERNEL);
+        new_map = kcalloc(new_num, sizeof(*new_map), GFP_KERNEL);
         if (!new_map)
                 return -ENOMEM;
 
@@ -370,12 +370,12 @@ static int mxs_pinctrl_parse_group(struct platform_device *pdev,
                 return -EINVAL;
         g->npins = length / sizeof(u32);
 
-        g->pins = devm_kzalloc(&pdev->dev, g->npins * sizeof(*g->pins),
+        g->pins = devm_kcalloc(&pdev->dev, g->npins, sizeof(*g->pins),
                                GFP_KERNEL);
         if (!g->pins)
                 return -ENOMEM;
 
-        g->muxsel = devm_kzalloc(&pdev->dev, g->npins * sizeof(*g->muxsel),
+        g->muxsel = devm_kcalloc(&pdev->dev, g->npins, sizeof(*g->muxsel),
                                  GFP_KERNEL);
         if (!g->muxsel)
                 return -ENOMEM;
@@ -426,13 +426,16 @@ static int mxs_pinctrl_probe_dt(struct platform_device *pdev,
                 }
         }
 
-        soc->functions = devm_kzalloc(&pdev->dev, soc->nfunctions *
-                                      sizeof(*soc->functions), GFP_KERNEL);
+        soc->functions = devm_kcalloc(&pdev->dev,
+                                      soc->nfunctions,
+                                      sizeof(*soc->functions),
+                                      GFP_KERNEL);
         if (!soc->functions)
                 return -ENOMEM;
 
-        soc->groups = devm_kzalloc(&pdev->dev, soc->ngroups *
-                                   sizeof(*soc->groups), GFP_KERNEL);
+        soc->groups = devm_kcalloc(&pdev->dev,
+                                   soc->ngroups, sizeof(*soc->groups),
+                                   GFP_KERNEL);
         if (!soc->groups)
                 return -ENOMEM;
 
@@ -492,7 +495,8 @@ static int mxs_pinctrl_probe_dt(struct platform_device *pdev,
 
                 if (strcmp(fn, child->name)) {
                         f = &soc->functions[idxf++];
-                        f->groups = devm_kzalloc(&pdev->dev, f->ngroups *
+                        f->groups = devm_kcalloc(&pdev->dev,
+                                                 f->ngroups,
                                                  sizeof(*f->groups),
                                                  GFP_KERNEL);
                         if (!f->groups)
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
index 674ffdf8103c..53cf800688e9 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
@@ -856,9 +856,10 @@ static int armada_37xx_fill_group(struct armada_37xx_pinctrl *info)
                 struct armada_37xx_pin_group *grp = &info->groups[n];
                 int i, j, f;
 
-                grp->pins = devm_kzalloc(info->dev,
-                                         (grp->npins + grp->extra_npins) *
-                                         sizeof(*grp->pins), GFP_KERNEL);
+                grp->pins = devm_kcalloc(info->dev,
+                                         grp->npins + grp->extra_npins,
+                                         sizeof(*grp->pins),
+                                         GFP_KERNEL);
                 if (!grp->pins)
                         return -ENOMEM;
 
@@ -908,7 +909,8 @@ static int armada_37xx_fill_func(struct armada_37xx_pinctrl *info)
                 const char **groups;
                 int g;
 
-                funcs[n].groups = devm_kzalloc(info->dev, funcs[n].ngroups *
+                funcs[n].groups = devm_kcalloc(info->dev,
+                                               funcs[n].ngroups,
                                                sizeof(*(funcs[n].groups)),
                                                GFP_KERNEL);
                 if (!funcs[n].groups)
@@ -948,8 +950,9 @@ static int armada_37xx_pinctrl_register(struct platform_device *pdev,
         ctrldesc->pmxops = &armada_37xx_pmx_ops;
         ctrldesc->confops = &armada_37xx_pinconf_ops;
 
-        pindesc = devm_kzalloc(&pdev->dev, sizeof(*pindesc) *
-                               pin_data->nr_pins, GFP_KERNEL);
+        pindesc = devm_kcalloc(&pdev->dev,
+                               pin_data->nr_pins, sizeof(*pindesc),
+                               GFP_KERNEL);
         if (!pindesc)
                 return -ENOMEM;
 
@@ -968,8 +971,10 @@ static int armada_37xx_pinctrl_register(struct platform_device *pdev,
          * we allocate functions for number of pins and hope there are
          * fewer unique functions than pins available
          */
-        info->funcs = devm_kzalloc(&pdev->dev, pin_data->nr_pins *
-                           sizeof(struct armada_37xx_pmx_func), GFP_KERNEL);
+        info->funcs = devm_kcalloc(&pdev->dev,
+                                   pin_data->nr_pins,
+                                   sizeof(struct armada_37xx_pmx_func),
+                                   GFP_KERNEL);
         if (!info->funcs)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
index 5e828468e43d..43231fd065a1 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
@@ -630,8 +630,8 @@ static int armada_xp_pinctrl_probe(struct platform_device *pdev)
 
         nregs = DIV_ROUND_UP(soc->nmodes, MVEBU_MPPS_PER_REG);
 
-        mpp_saved_regs = devm_kmalloc(&pdev->dev, nregs * sizeof(u32),
-                                      GFP_KERNEL);
+        mpp_saved_regs = devm_kmalloc_array(&pdev->dev, nregs, sizeof(u32),
+                                            GFP_KERNEL);
         if (!mpp_saved_regs)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/mvebu/pinctrl-mvebu.c b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
index 9e05cfaf75f0..d7ec7119701b 100644
--- a/drivers/pinctrl/mvebu/pinctrl-mvebu.c
+++ b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
@@ -501,8 +501,9 @@ static int mvebu_pinctrl_build_functions(struct platform_device *pdev,
 
         /* we allocate functions for number of pins and hope
          * there are fewer unique functions than pins available */
-        funcs = devm_kzalloc(&pdev->dev, funcsize *
-                             sizeof(struct mvebu_pinctrl_function), GFP_KERNEL);
+        funcs = devm_kcalloc(&pdev->dev,
+                             funcsize, sizeof(struct mvebu_pinctrl_function),
+                             GFP_KERNEL);
         if (!funcs)
                 return -ENOMEM;
 
@@ -549,8 +550,9 @@ static int mvebu_pinctrl_build_functions(struct platform_device *pdev,
 
                         /* allocate group name array if not done already */
                         if (!f->groups) {
-                                f->groups = devm_kzalloc(&pdev->dev,
-                                                 f->num_groups * sizeof(char *),
+                                f->groups = devm_kcalloc(&pdev->dev,
+                                                 f->num_groups,
+                                                 sizeof(char *),
                                                  GFP_KERNEL);
                                 if (!f->groups)
                                         return -ENOMEM;
@@ -622,8 +624,10 @@ int mvebu_pinctrl_probe(struct platform_device *pdev)
                 }
         }
 
-        pdesc = devm_kzalloc(&pdev->dev, pctl->desc.npins *
-                             sizeof(struct pinctrl_pin_desc), GFP_KERNEL);
+        pdesc = devm_kcalloc(&pdev->dev,
+                             pctl->desc.npins,
+                             sizeof(struct pinctrl_pin_desc),
+                             GFP_KERNEL);
         if (!pdesc)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
index bafb3d40545e..67e4d9ffa6b1 100644
--- a/drivers/pinctrl/pinctrl-at91-pio4.c
+++ b/drivers/pinctrl/pinctrl-at91-pio4.c
@@ -945,27 +945,30 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
                 return PTR_ERR(atmel_pioctrl->clk);
         }
 
-        atmel_pioctrl->pins = devm_kzalloc(dev, sizeof(*atmel_pioctrl->pins)
-                        * atmel_pioctrl->npins, GFP_KERNEL);
+        atmel_pioctrl->pins = devm_kcalloc(dev,
+                                           atmel_pioctrl->npins,
+                                           sizeof(*atmel_pioctrl->pins),
+                                           GFP_KERNEL);
         if (!atmel_pioctrl->pins)
                 return -ENOMEM;
 
-        pin_desc = devm_kzalloc(dev, sizeof(*pin_desc)
-                        * atmel_pioctrl->npins, GFP_KERNEL);
+        pin_desc = devm_kcalloc(dev, atmel_pioctrl->npins, sizeof(*pin_desc),
+                                GFP_KERNEL);
         if (!pin_desc)
                 return -ENOMEM;
         atmel_pinctrl_desc.pins = pin_desc;
         atmel_pinctrl_desc.npins = atmel_pioctrl->npins;
 
         /* One pin is one group since a pin can achieve all functions. */
-        group_names = devm_kzalloc(dev, sizeof(*group_names)
-                        * atmel_pioctrl->npins, GFP_KERNEL);
+        group_names = devm_kcalloc(dev,
+                                   atmel_pioctrl->npins, sizeof(*group_names),
+                                   GFP_KERNEL);
         if (!group_names)
                 return -ENOMEM;
         atmel_pioctrl->group_names = group_names;
 
-        atmel_pioctrl->groups = devm_kzalloc(&pdev->dev,
-                        sizeof(*atmel_pioctrl->groups) * atmel_pioctrl->npins,
+        atmel_pioctrl->groups = devm_kcalloc(&pdev->dev,
+                        atmel_pioctrl->npins, sizeof(*atmel_pioctrl->groups),
                         GFP_KERNEL);
         if (!atmel_pioctrl->groups)
                 return -ENOMEM;
@@ -1001,20 +1004,24 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
         atmel_pioctrl->gpio_chip->parent = dev;
         atmel_pioctrl->gpio_chip->names = atmel_pioctrl->group_names;
 
-        atmel_pioctrl->pm_wakeup_sources = devm_kzalloc(dev,
-                        sizeof(*atmel_pioctrl->pm_wakeup_sources)
-                        * atmel_pioctrl->nbanks, GFP_KERNEL);
+        atmel_pioctrl->pm_wakeup_sources = devm_kcalloc(dev,
+                        atmel_pioctrl->nbanks,
+                        sizeof(*atmel_pioctrl->pm_wakeup_sources),
+                        GFP_KERNEL);
         if (!atmel_pioctrl->pm_wakeup_sources)
                 return -ENOMEM;
 
-        atmel_pioctrl->pm_suspend_backup = devm_kzalloc(dev,
-                        sizeof(*atmel_pioctrl->pm_suspend_backup)
-                        * atmel_pioctrl->nbanks, GFP_KERNEL);
+        atmel_pioctrl->pm_suspend_backup = devm_kcalloc(dev,
+                        atmel_pioctrl->nbanks,
+                        sizeof(*atmel_pioctrl->pm_suspend_backup),
+                        GFP_KERNEL);
         if (!atmel_pioctrl->pm_suspend_backup)
                 return -ENOMEM;
 
-        atmel_pioctrl->irqs = devm_kzalloc(dev, sizeof(*atmel_pioctrl->irqs)
-                        * atmel_pioctrl->nbanks, GFP_KERNEL);
+        atmel_pioctrl->irqs = devm_kcalloc(dev,
+                                           atmel_pioctrl->nbanks,
+                                           sizeof(*atmel_pioctrl->irqs),
+                                           GFP_KERNEL);
         if (!atmel_pioctrl->irqs)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index 297f1d161211..50f0ec42c637 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -269,7 +269,8 @@ static int at91_dt_node_to_map(struct pinctrl_dev *pctldev,
         }
 
         map_num += grp->npins;
-        new_map = devm_kzalloc(pctldev->dev, sizeof(*new_map) * map_num, GFP_KERNEL);
+        new_map = devm_kcalloc(pctldev->dev, map_num, sizeof(*new_map),
+                               GFP_KERNEL);
         if (!new_map)
                 return -ENOMEM;
 
@@ -1049,7 +1050,8 @@ static int at91_pinctrl_mux_mask(struct at91_pinctrl *info,
         }
         info->nmux = size / gpio_banks;
 
-        info->mux_mask = devm_kzalloc(info->dev, sizeof(u32) * size, GFP_KERNEL);
+        info->mux_mask = devm_kcalloc(info->dev, size, sizeof(u32),
+                                      GFP_KERNEL);
         if (!info->mux_mask)
                 return -ENOMEM;
 
@@ -1087,10 +1089,12 @@ static int at91_pinctrl_parse_groups(struct device_node *np,
         }
 
         grp->npins = size / 4;
-        pin = grp->pins_conf = devm_kzalloc(info->dev, grp->npins * sizeof(struct at91_pmx_pin),
-                                GFP_KERNEL);
-        grp->pins = devm_kzalloc(info->dev, grp->npins * sizeof(unsigned int),
-                                GFP_KERNEL);
+        pin = grp->pins_conf = devm_kcalloc(info->dev,
+                                            grp->npins,
+                                            sizeof(struct at91_pmx_pin),
+                                            GFP_KERNEL);
+        grp->pins = devm_kcalloc(info->dev, grp->npins, sizeof(unsigned int),
+                                 GFP_KERNEL);
         if (!grp->pins_conf || !grp->pins)
                 return -ENOMEM;
 
@@ -1129,8 +1133,8 @@ static int at91_pinctrl_parse_functions(struct device_node *np,
                 dev_err(info->dev, "no groups defined\n");
                 return -EINVAL;
         }
-        func->groups = devm_kzalloc(info->dev,
-                        func->ngroups * sizeof(char *), GFP_KERNEL);
+        func->groups = devm_kcalloc(info->dev,
+                        func->ngroups, sizeof(char *), GFP_KERNEL);
         if (!func->groups)
                 return -ENOMEM;
 
@@ -1192,12 +1196,16 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev,
 
         dev_dbg(&pdev->dev, "nfunctions = %d\n", info->nfunctions);
         dev_dbg(&pdev->dev, "ngroups = %d\n", info->ngroups);
-        info->functions = devm_kzalloc(&pdev->dev, info->nfunctions * sizeof(struct at91_pmx_func),
+        info->functions = devm_kcalloc(&pdev->dev,
+                                        info->nfunctions,
+                                        sizeof(struct at91_pmx_func),
                                         GFP_KERNEL);
         if (!info->functions)
                 return -ENOMEM;
 
-        info->groups = devm_kzalloc(&pdev->dev, info->ngroups * sizeof(struct at91_pin_group),
+        info->groups = devm_kcalloc(&pdev->dev,
+                                        info->ngroups,
+                                        sizeof(struct at91_pin_group),
                                         GFP_KERNEL);
         if (!info->groups)
                 return -ENOMEM;
@@ -1256,7 +1264,9 @@ static int at91_pinctrl_probe(struct platform_device *pdev)
         at91_pinctrl_desc.name = dev_name(&pdev->dev);
         at91_pinctrl_desc.npins = gpio_banks * MAX_NB_GPIO_PER_BANK;
         at91_pinctrl_desc.pins = pdesc =
-                devm_kzalloc(&pdev->dev, sizeof(*pdesc) * at91_pinctrl_desc.npins, GFP_KERNEL);
+                devm_kcalloc(&pdev->dev,
+                             at91_pinctrl_desc.npins, sizeof(*pdesc),
+                             GFP_KERNEL);
 
         if (!at91_pinctrl_desc.pins)
                 return -ENOMEM;
@@ -1763,7 +1773,7 @@ static int at91_gpio_probe(struct platform_device *pdev)
                         chip->ngpio = ngpio;
         }
 
-        names = devm_kzalloc(&pdev->dev, sizeof(char *) * chip->ngpio,
+        names = devm_kcalloc(&pdev->dev, chip->ngpio, sizeof(char *),
                              GFP_KERNEL);
 
         if (!names) {
diff --git a/drivers/pinctrl/pinctrl-axp209.c b/drivers/pinctrl/pinctrl-axp209.c
index 1231bbbfa744..a52779f33ad4 100644
--- a/drivers/pinctrl/pinctrl-axp209.c
+++ b/drivers/pinctrl/pinctrl-axp209.c
@@ -328,7 +328,8 @@ static void axp20x_funcs_groups_from_mask(struct device *dev, unsigned int mask,
 
         func->ngroups = ngroups;
         if (func->ngroups > 0) {
-                func->groups = devm_kzalloc(dev, ngroups * sizeof(const char *),
+                func->groups = devm_kcalloc(dev,
+                                            ngroups, sizeof(const char *),
                                             GFP_KERNEL);
                 group = func->groups;
                 for_each_set_bit(bit, &mask_cpy, mask_len) {
@@ -358,8 +359,8 @@ static void axp20x_build_funcs_groups(struct platform_device *pdev)
         /* Every pin supports GPIO_OUT and GPIO_IN functions */
         for (i = 0; i <= AXP20X_FUNC_GPIO_IN; i++) {
                 pctl->funcs[i].ngroups = npins;
-                pctl->funcs[i].groups = devm_kzalloc(&pdev->dev,
-                                                     npins * sizeof(char *),
+                pctl->funcs[i].groups = devm_kcalloc(&pdev->dev,
+                                                     npins, sizeof(char *),
                                                      GFP_KERNEL);
                 for (pin = 0; pin < npins; pin++)
                         pctl->funcs[i].groups[pin] = pctl->desc->pins[pin].name;
diff --git a/drivers/pinctrl/pinctrl-digicolor.c b/drivers/pinctrl/pinctrl-digicolor.c
index ce269ced4d49..5353b23f775c 100644
--- a/drivers/pinctrl/pinctrl-digicolor.c
+++ b/drivers/pinctrl/pinctrl-digicolor.c
@@ -291,10 +291,11 @@ static int dc_pinctrl_probe(struct platform_device *pdev)
         if (IS_ERR(pmap->regs))
                 return PTR_ERR(pmap->regs);
 
-        pins = devm_kzalloc(&pdev->dev, sizeof(*pins)*PINS_COUNT, GFP_KERNEL);
+        pins = devm_kcalloc(&pdev->dev, PINS_COUNT, sizeof(*pins),
+                            GFP_KERNEL);
         if (!pins)
                 return -ENOMEM;
-        pin_names = devm_kzalloc(&pdev->dev, name_len * PINS_COUNT,
+        pin_names = devm_kcalloc(&pdev->dev, PINS_COUNT, name_len,
                                  GFP_KERNEL);
         if (!pin_names)
                 return -ENOMEM;
diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c
index ac38a3f9f86b..a1d7156d0a43 100644
--- a/drivers/pinctrl/pinctrl-ingenic.c
+++ b/drivers/pinctrl/pinctrl-ingenic.c
@@ -770,8 +770,8 @@ static int ingenic_pinctrl_probe(struct platform_device *pdev)
         pctl_desc->pmxops = &ingenic_pmxops;
         pctl_desc->confops = &ingenic_confops;
         pctl_desc->npins = chip_info->num_chips * PINS_PER_GPIO_CHIP;
-        pctl_desc->pins = jzpc->pdesc = devm_kzalloc(&pdev->dev,
-                        sizeof(*jzpc->pdesc) * pctl_desc->npins, GFP_KERNEL);
+        pctl_desc->pins = jzpc->pdesc = devm_kcalloc(&pdev->dev,
+                        pctl_desc->npins, sizeof(*jzpc->pdesc), GFP_KERNEL);
         if (!jzpc->pdesc)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/pinctrl-lantiq.c b/drivers/pinctrl/pinctrl-lantiq.c
index 41dc39c7a7b1..81632af3a86a 100644
--- a/drivers/pinctrl/pinctrl-lantiq.c
+++ b/drivers/pinctrl/pinctrl-lantiq.c
@@ -158,7 +158,8 @@ static int ltq_pinctrl_dt_node_to_map(struct pinctrl_dev *pctldev,
 
         for_each_child_of_node(np_config, np)
                 max_maps += ltq_pinctrl_dt_subnode_size(np);
-        *map = kzalloc(max_maps * sizeof(struct pinctrl_map) * 2, GFP_KERNEL);
+        *map = kzalloc(array3_size(max_maps, sizeof(struct pinctrl_map), 2),
+                       GFP_KERNEL);
         if (!*map)
                 return -ENOMEM;
         tmp = *map;
diff --git a/drivers/pinctrl/pinctrl-lpc18xx.c b/drivers/pinctrl/pinctrl-lpc18xx.c
index d090f37ca4a1..190f17e4bbda 100644
--- a/drivers/pinctrl/pinctrl-lpc18xx.c
+++ b/drivers/pinctrl/pinctrl-lpc18xx.c
@@ -1308,8 +1308,9 @@ static int lpc18xx_create_group_func_map(struct device *dev,
                 }
 
                 scu->func[func].ngroups = ngroups;
-                scu->func[func].groups = devm_kzalloc(dev, ngroups *
-                                                      sizeof(char *), GFP_KERNEL);
+                scu->func[func].groups = devm_kcalloc(dev,
+                                                      ngroups, sizeof(char *),
+                                                      GFP_KERNEL);
                 if (!scu->func[func].groups)
                         return -ENOMEM;
 
diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c
index b5b3547fdcb2..15bb1cb8729b 100644
--- a/drivers/pinctrl/pinctrl-ocelot.c
+++ b/drivers/pinctrl/pinctrl-ocelot.c
@@ -330,7 +330,8 @@ static int ocelot_create_group_func_map(struct device *dev,
                 }
 
                 info->func[f].ngroups = npins;
-                info->func[f].groups = devm_kzalloc(dev, npins *
+                info->func[f].groups = devm_kcalloc(dev,
+                                                         npins,
                                                          sizeof(char *),
                                                          GFP_KERNEL);
                 if (!info->func[f].groups)
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index 1882713e68f9..f4a61429e06e 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -507,7 +507,7 @@ static int rockchip_dt_node_to_map(struct pinctrl_dev *pctldev,
         }
 
         map_num += grp->npins;
-        new_map = devm_kzalloc(pctldev->dev, sizeof(*new_map) * map_num,
+        new_map = devm_kcalloc(pctldev->dev, map_num, sizeof(*new_map),
                                                                 GFP_KERNEL);
         if (!new_map)
                 return -ENOMEM;
@@ -2473,10 +2473,11 @@ static int rockchip_pinctrl_parse_groups(struct device_node *np,
 
         grp->npins = size / 4;
 
-        grp->pins = devm_kzalloc(info->dev, grp->npins * sizeof(unsigned int),
+        grp->pins = devm_kcalloc(info->dev, grp->npins, sizeof(unsigned int),
                                                 GFP_KERNEL);
-        grp->data = devm_kzalloc(info->dev, grp->npins *
-                                          sizeof(struct rockchip_pin_config),
+        grp->data = devm_kcalloc(info->dev,
+                                        grp->npins,
+                                        sizeof(struct rockchip_pin_config),
                                         GFP_KERNEL);
         if (!grp->pins || !grp->data)
                 return -ENOMEM;
@@ -2528,8 +2529,8 @@ static int rockchip_pinctrl_parse_functions(struct device_node *np,
         if (func->ngroups <= 0)
                 return 0;
 
-        func->groups = devm_kzalloc(info->dev,
-                        func->ngroups * sizeof(char *), GFP_KERNEL);
+        func->groups = devm_kcalloc(info->dev,
+                        func->ngroups, sizeof(char *), GFP_KERNEL);
         if (!func->groups)
                 return -ENOMEM;
 
@@ -2560,13 +2561,15 @@ static int rockchip_pinctrl_parse_dt(struct platform_device *pdev,
         dev_dbg(&pdev->dev, "nfunctions = %d\n", info->nfunctions);
         dev_dbg(&pdev->dev, "ngroups = %d\n", info->ngroups);
 
-        info->functions = devm_kzalloc(dev, info->nfunctions *
+        info->functions = devm_kcalloc(dev,
+                                              info->nfunctions,
                                               sizeof(struct rockchip_pmx_func),
                                               GFP_KERNEL);
         if (!info->functions)
                 return -EINVAL;
 
-        info->groups = devm_kzalloc(dev, info->ngroups *
+        info->groups = devm_kcalloc(dev,
+                                            info->ngroups,
                                             sizeof(struct rockchip_pin_group),
                                             GFP_KERNEL);
         if (!info->groups)
@@ -2604,8 +2607,9 @@ static int rockchip_pinctrl_register(struct platform_device *pdev,
         ctrldesc->pmxops = &rockchip_pmx_ops;
         ctrldesc->confops = &rockchip_pinconf_ops;
 
-        pindesc = devm_kzalloc(&pdev->dev, sizeof(*pindesc) *
-                        info->ctrl->nr_pins, GFP_KERNEL);
+        pindesc = devm_kcalloc(&pdev->dev,
+                               info->ctrl->nr_pins, sizeof(*pindesc),
+                               GFP_KERNEL);
         if (!pindesc)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 9c3c00515aa0..b3153c095199 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -712,8 +712,8 @@ static int pcs_allocate_pin_table(struct pcs_device *pcs)
         }
 
         dev_dbg(pcs->dev, "allocating %i pins\n", nr_pins);
-        pcs->pins.pa = devm_kzalloc(pcs->dev,
-                                sizeof(*pcs->pins.pa) * nr_pins,
+        pcs->pins.pa = devm_kcalloc(pcs->dev,
+                                nr_pins, sizeof(*pcs->pins.pa),
                                 GFP_KERNEL);
         if (!pcs->pins.pa)
                 return -ENOMEM;
@@ -924,15 +924,15 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np,
         if (!nconfs)
                 return 0;
 
-        func->conf = devm_kzalloc(pcs->dev,
-                                  sizeof(struct pcs_conf_vals) * nconfs,
+        func->conf = devm_kcalloc(pcs->dev,
+                                  nconfs, sizeof(struct pcs_conf_vals),
                                   GFP_KERNEL);
         if (!func->conf)
                 return -ENOMEM;
         func->nconfs = nconfs;
         conf = &(func->conf[0]);
         m++;
-        settings = devm_kzalloc(pcs->dev, sizeof(unsigned long) * nconfs,
+        settings = devm_kcalloc(pcs->dev, nconfs, sizeof(unsigned long),
                                 GFP_KERNEL);
         if (!settings)
                 return -ENOMEM;
@@ -988,11 +988,11 @@ static int pcs_parse_one_pinctrl_entry(struct pcs_device *pcs,
                 return -EINVAL;
         }
 
-        vals = devm_kzalloc(pcs->dev, sizeof(*vals) * rows, GFP_KERNEL);
+        vals = devm_kcalloc(pcs->dev, rows, sizeof(*vals), GFP_KERNEL);
         if (!vals)
                 return -ENOMEM;
 
-        pins = devm_kzalloc(pcs->dev, sizeof(*pins) * rows, GFP_KERNEL);
+        pins = devm_kcalloc(pcs->dev, rows, sizeof(*pins), GFP_KERNEL);
         if (!pins)
                 goto free_vals;
 
@@ -1089,13 +1089,15 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs,
 
         npins_in_row = pcs->width / pcs->bits_per_pin;
 
-        vals = devm_kzalloc(pcs->dev, sizeof(*vals) * rows * npins_in_row,
-                        GFP_KERNEL);
+        vals = devm_kzalloc(pcs->dev,
+                            array3_size(rows, npins_in_row, sizeof(*vals)),
+                            GFP_KERNEL);
         if (!vals)
                 return -ENOMEM;
 
-        pins = devm_kzalloc(pcs->dev, sizeof(*pins) * rows * npins_in_row,
-                        GFP_KERNEL);
+        pins = devm_kzalloc(pcs->dev,
+                            array3_size(rows, npins_in_row, sizeof(*pins)),
+                            GFP_KERNEL);
         if (!pins)
                 goto free_vals;
 
@@ -1217,7 +1219,7 @@ static int pcs_dt_node_to_map(struct pinctrl_dev *pctldev,
         pcs = pinctrl_dev_get_drvdata(pctldev);
 
         /* create 2 maps. One is for pinmux, and the other is for pinconf. */
-        *map = devm_kzalloc(pcs->dev, sizeof(**map) * 2, GFP_KERNEL);
+        *map = devm_kcalloc(pcs->dev, 2, sizeof(**map), GFP_KERNEL);
         if (!*map)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index 2081c67667a8..0966bb0bf71f 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -823,8 +823,8 @@ static int st_pctl_dt_node_to_map(struct pinctrl_dev *pctldev,
         }
 
         map_num = grp->npins + 1;
-        new_map = devm_kzalloc(pctldev->dev,
-                                sizeof(*new_map) * map_num, GFP_KERNEL);
+        new_map = devm_kcalloc(pctldev->dev,
+                                map_num, sizeof(*new_map), GFP_KERNEL);
         if (!new_map)
                 return -ENOMEM;
 
@@ -1191,9 +1191,9 @@ static int st_pctl_dt_parse_groups(struct device_node *np,
 
         grp->npins = npins;
         grp->name = np->name;
-        grp->pins = devm_kzalloc(info->dev, npins * sizeof(u32), GFP_KERNEL);
-        grp->pin_conf = devm_kzalloc(info->dev,
-                                        npins * sizeof(*conf), GFP_KERNEL);
+        grp->pins = devm_kcalloc(info->dev, npins, sizeof(u32), GFP_KERNEL);
+        grp->pin_conf = devm_kcalloc(info->dev,
+                                        npins, sizeof(*conf), GFP_KERNEL);
 
         if (!grp->pins || !grp->pin_conf)
                 return -ENOMEM;
@@ -1249,8 +1249,8 @@ static int st_pctl_parse_functions(struct device_node *np,
                 dev_err(info->dev, "No groups defined\n");
                 return -EINVAL;
         }
-        func->groups = devm_kzalloc(info->dev,
-                        func->ngroups * sizeof(char *), GFP_KERNEL);
+        func->groups = devm_kcalloc(info->dev,
+                        func->ngroups, sizeof(char *), GFP_KERNEL);
         if (!func->groups)
                 return -ENOMEM;
 
@@ -1573,14 +1573,15 @@ static int st_pctl_probe_dt(struct platform_device *pdev,
         dev_info(&pdev->dev, "nfunctions = %d\n", info->nfunctions);
         dev_info(&pdev->dev, "ngroups = %d\n", info->ngroups);
 
-        info->functions = devm_kzalloc(&pdev->dev,
-                info->nfunctions * sizeof(*info->functions), GFP_KERNEL);
+        info->functions = devm_kcalloc(&pdev->dev,
+                info->nfunctions, sizeof(*info->functions), GFP_KERNEL);
 
-        info->groups = devm_kzalloc(&pdev->dev,
-                        info->ngroups * sizeof(*info->groups) , GFP_KERNEL);
+        info->groups = devm_kcalloc(&pdev->dev,
+                        info->ngroups, sizeof(*info->groups),
+                        GFP_KERNEL);
 
-        info->banks = devm_kzalloc(&pdev->dev,
-                        info->nbanks * sizeof(*info->banks), GFP_KERNEL);
+        info->banks = devm_kcalloc(&pdev->dev,
+                        info->nbanks, sizeof(*info->banks), GFP_KERNEL);
 
         if (!info->functions || !info->groups || !info->banks)
                 return -ENOMEM;
@@ -1608,8 +1609,8 @@ static int st_pctl_probe_dt(struct platform_device *pdev,
         }
 
         pctl_desc->npins = info->nbanks * ST_GPIO_PINS_PER_BANK;
-        pdesc = devm_kzalloc(&pdev->dev,
-                        sizeof(*pdesc) * pctl_desc->npins, GFP_KERNEL);
+        pdesc = devm_kcalloc(&pdev->dev,
+                        pctl_desc->npins, sizeof(*pdesc), GFP_KERNEL);
         if (!pdesc)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c
index cd0f402c1164..93f8bd04e7fe 100644
--- a/drivers/pinctrl/pinctrl-xway.c
+++ b/drivers/pinctrl/pinctrl-xway.c
@@ -1727,8 +1727,8 @@ static int pinmux_xway_probe(struct platform_device *pdev)
         xway_chip.ngpio = xway_soc->pin_count;
 
         /* load our pad descriptors */
-        xway_info.pads = devm_kzalloc(&pdev->dev,
-                        sizeof(struct pinctrl_pin_desc) * xway_chip.ngpio,
+        xway_info.pads = devm_kcalloc(&pdev->dev,
+                        xway_chip.ngpio, sizeof(struct pinctrl_pin_desc),
                         GFP_KERNEL);
         if (!xway_info.pads)
                 return -ENOMEM;
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c
index 0a625a64ff5d..a263ddd94945 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
@@ -491,8 +491,9 @@ int exynos_eint_wkup_init(struct samsung_pinctrl_drv_data *d)
                         continue;
                 }
 
-                weint_data = devm_kzalloc(dev, bank->nr_pins
-                                        * sizeof(*weint_data), GFP_KERNEL);
+                weint_data = devm_kcalloc(dev,
+                                          bank->nr_pins, sizeof(*weint_data),
+                                          GFP_KERNEL);
                 if (!weint_data)
                         return -ENOMEM;
 
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index 618945a0fd38..698c7d8c9a08 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -674,7 +674,7 @@ static struct samsung_pin_group *samsung_pinctrl_create_groups(
         const struct pinctrl_pin_desc *pdesc;
         int i;
 
-        groups = devm_kzalloc(dev, ctrldesc->npins * sizeof(*groups),
+        groups = devm_kcalloc(dev, ctrldesc->npins, sizeof(*groups),
                                 GFP_KERNEL);
         if (!groups)
                 return ERR_PTR(-EINVAL);
@@ -711,7 +711,7 @@ static int samsung_pinctrl_create_function(struct device *dev,
 
         func->name = func_np->full_name;
 
-        func->groups = devm_kzalloc(dev, npins * sizeof(char *), GFP_KERNEL);
+        func->groups = devm_kcalloc(dev, npins, sizeof(char *), GFP_KERNEL);
         if (!func->groups)
                 return -ENOMEM;
 
@@ -768,7 +768,7 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions(
                 }
         }
 
-        functions = devm_kzalloc(dev, func_cnt * sizeof(*functions),
+        functions = devm_kcalloc(dev, func_cnt, sizeof(*functions),
                                         GFP_KERNEL);
         if (!functions)
                 return ERR_PTR(-ENOMEM);
@@ -860,8 +860,9 @@ static int samsung_pinctrl_register(struct platform_device *pdev,
         ctrldesc->pmxops = &samsung_pinmux_ops;
         ctrldesc->confops = &samsung_pinconf_ops;
 
-        pindesc = devm_kzalloc(&pdev->dev, sizeof(*pindesc) *
-                        drvdata->nr_pins, GFP_KERNEL);
+        pindesc = devm_kcalloc(&pdev->dev,
+                               drvdata->nr_pins, sizeof(*pindesc),
+                               GFP_KERNEL);
         if (!pindesc)
                 return -ENOMEM;
         ctrldesc->pins = pindesc;
@@ -875,8 +876,10 @@ static int samsung_pinctrl_register(struct platform_device *pdev,
          * allocate space for storing the dynamically generated names for all
          * the pins which belong to this pin-controller.
          */
-        pin_names = devm_kzalloc(&pdev->dev, sizeof(char) * PIN_NAME_LENGTH *
-                                        drvdata->nr_pins, GFP_KERNEL);
+        pin_names = devm_kzalloc(&pdev->dev,
+                                 array3_size(sizeof(char), PIN_NAME_LENGTH,
+                                             drvdata->nr_pins),
+                                 GFP_KERNEL);
         if (!pin_names)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/sh-pfc/core.c b/drivers/pinctrl/sh-pfc/core.c
index eb06981538b4..c671c3c4aca6 100644
--- a/drivers/pinctrl/sh-pfc/core.c
+++ b/drivers/pinctrl/sh-pfc/core.c
@@ -57,7 +57,7 @@ static int sh_pfc_map_resources(struct sh_pfc *pfc,
                 return -EINVAL;
 
         /* Allocate memory windows and IRQs arrays. */
-        windows = devm_kzalloc(pfc->dev, num_windows * sizeof(*windows),
+        windows = devm_kcalloc(pfc->dev, num_windows, sizeof(*windows),
                                GFP_KERNEL);
         if (windows == NULL)
                 return -ENOMEM;
@@ -66,7 +66,7 @@ static int sh_pfc_map_resources(struct sh_pfc *pfc,
         pfc->windows = windows;
 
         if (num_irqs) {
-                irqs = devm_kzalloc(pfc->dev, num_irqs * sizeof(*irqs),
+                irqs = devm_kcalloc(pfc->dev, num_irqs, sizeof(*irqs),
                                     GFP_KERNEL);
                 if (irqs == NULL)
                         return -ENOMEM;
@@ -444,7 +444,7 @@ static int sh_pfc_init_ranges(struct sh_pfc *pfc)
         }
 
         pfc->nr_ranges = nr_ranges;
-        pfc->ranges = devm_kzalloc(pfc->dev, sizeof(*pfc->ranges) * nr_ranges,
+        pfc->ranges = devm_kcalloc(pfc->dev, nr_ranges, sizeof(*pfc->ranges),
                                    GFP_KERNEL);
         if (pfc->ranges == NULL)
                 return -ENOMEM;
diff --git a/drivers/pinctrl/sh-pfc/gpio.c b/drivers/pinctrl/sh-pfc/gpio.c
index 946d9be50b62..6ffdc6beb203 100644
--- a/drivers/pinctrl/sh-pfc/gpio.c
+++ b/drivers/pinctrl/sh-pfc/gpio.c
@@ -107,7 +107,7 @@ static int gpio_setup_data_regs(struct sh_pfc_chip *chip)
         for (i = 0; pfc->info->data_regs[i].reg_width; ++i)
                 ;
 
-        chip->regs = devm_kzalloc(pfc->dev, i * sizeof(*chip->regs),
+        chip->regs = devm_kcalloc(pfc->dev, i, sizeof(*chip->regs),
                                   GFP_KERNEL);
         if (chip->regs == NULL)
                 return -ENOMEM;
@@ -224,8 +224,9 @@ static int gpio_pin_setup(struct sh_pfc_chip *chip)
         struct gpio_chip *gc = &chip->gpio_chip;
         int ret;
 
-        chip->pins = devm_kzalloc(pfc->dev, pfc->info->nr_pins *
-                                  sizeof(*chip->pins), GFP_KERNEL);
+        chip->pins = devm_kcalloc(pfc->dev,
+                                  pfc->info->nr_pins, sizeof(*chip->pins),
+                                  GFP_KERNEL);
         if (chip->pins == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/sh-pfc/pinctrl.c b/drivers/pinctrl/sh-pfc/pinctrl.c
index 70db21638901..654dc20e171b 100644
--- a/drivers/pinctrl/sh-pfc/pinctrl.c
+++ b/drivers/pinctrl/sh-pfc/pinctrl.c
@@ -770,14 +770,14 @@ static int sh_pfc_map_pins(struct sh_pfc *pfc, struct sh_pfc_pinctrl *pmx)
         unsigned int i;
 
         /* Allocate and initialize the pins and configs arrays. */
-        pmx->pins = devm_kzalloc(pfc->dev,
-                                 sizeof(*pmx->pins) * pfc->info->nr_pins,
+        pmx->pins = devm_kcalloc(pfc->dev,
+                                 pfc->info->nr_pins, sizeof(*pmx->pins),
                                  GFP_KERNEL);
         if (unlikely(!pmx->pins))
                 return -ENOMEM;
 
-        pmx->configs = devm_kzalloc(pfc->dev,
-                                    sizeof(*pmx->configs) * pfc->info->nr_pins,
+        pmx->configs = devm_kcalloc(pfc->dev,
+                                    pfc->info->nr_pins, sizeof(*pmx->configs),
                                     GFP_KERNEL);
         if (unlikely(!pmx->configs))
                 return -ENOMEM;
diff --git a/drivers/pinctrl/sirf/pinctrl-sirf.c b/drivers/pinctrl/sirf/pinctrl-sirf.c
index ca2347d0d579..505845c66dd0 100644
--- a/drivers/pinctrl/sirf/pinctrl-sirf.c
+++ b/drivers/pinctrl/sirf/pinctrl-sirf.c
@@ -108,7 +108,7 @@ static int sirfsoc_dt_node_to_map(struct pinctrl_dev *pctldev,
                 return -ENODEV;
         }
 
-        *map = kzalloc(sizeof(**map) * count, GFP_KERNEL);
+        *map = kcalloc(count, sizeof(**map), GFP_KERNEL);
         if (!*map)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/spear/pinctrl-plgpio.c b/drivers/pinctrl/spear/pinctrl-plgpio.c
index d2123e396b29..9d906474f3e4 100644
--- a/drivers/pinctrl/spear/pinctrl-plgpio.c
+++ b/drivers/pinctrl/spear/pinctrl-plgpio.c
@@ -538,9 +538,9 @@ static int plgpio_probe(struct platform_device *pdev)
                 dev_warn(&pdev->dev, "clk_get() failed, work without it\n");
 
 #ifdef CONFIG_PM_SLEEP
-        plgpio->csave_regs = devm_kzalloc(&pdev->dev,
-                        sizeof(*plgpio->csave_regs) *
+        plgpio->csave_regs = devm_kcalloc(&pdev->dev,
                         DIV_ROUND_UP(plgpio->chip.ngpio, MAX_GPIO_PER_REG),
+                        sizeof(*plgpio->csave_regs),
                         GFP_KERNEL);
         if (!plgpio->csave_regs)
                 return -ENOMEM;
diff --git a/drivers/pinctrl/spear/pinctrl-spear.c b/drivers/pinctrl/spear/pinctrl-spear.c
index efe79d3f7659..c4f850345dc4 100644
--- a/drivers/pinctrl/spear/pinctrl-spear.c
+++ b/drivers/pinctrl/spear/pinctrl-spear.c
@@ -172,7 +172,7 @@ static int spear_pinctrl_dt_node_to_map(struct pinctrl_dev *pctldev,
                 return -ENODEV;
         }
 
-        *map = kzalloc(sizeof(**map) * count, GFP_KERNEL);
+        *map = kcalloc(count, sizeof(**map), GFP_KERNEL);
         if (!*map)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/sprd/pinctrl-sprd.c b/drivers/pinctrl/sprd/pinctrl-sprd.c
index ba1c2ca406e4..78c2f548b25f 100644
--- a/drivers/pinctrl/sprd/pinctrl-sprd.c
+++ b/drivers/pinctrl/sprd/pinctrl-sprd.c
@@ -879,8 +879,9 @@ static int sprd_pinctrl_parse_groups(struct device_node *np,
 
         grp->name = np->name;
         grp->npins = ret;
-        grp->pins = devm_kzalloc(sprd_pctl->dev, grp->npins *
-                                 sizeof(unsigned int), GFP_KERNEL);
+        grp->pins = devm_kcalloc(sprd_pctl->dev,
+                                 grp->npins, sizeof(unsigned int),
+                                 GFP_KERNEL);
         if (!grp->pins)
                 return -ENOMEM;
 
@@ -931,14 +932,15 @@ static int sprd_pinctrl_parse_dt(struct sprd_pinctrl *sprd_pctl)
         if (!info->ngroups)
                 return 0;
 
-        info->groups = devm_kzalloc(sprd_pctl->dev, info->ngroups *
+        info->groups = devm_kcalloc(sprd_pctl->dev,
+                                    info->ngroups,
                                     sizeof(struct sprd_pin_group),
                                     GFP_KERNEL);
         if (!info->groups)
                 return -ENOMEM;
 
-        info->grp_names = devm_kzalloc(sprd_pctl->dev,
-                                       info->ngroups * sizeof(char *),
+        info->grp_names = devm_kcalloc(sprd_pctl->dev,
+                                       info->ngroups, sizeof(char *),
                                        GFP_KERNEL);
         if (!info->grp_names)
                 return -ENOMEM;
@@ -980,8 +982,8 @@ static int sprd_pinctrl_add_pins(struct sprd_pinctrl *sprd_pctl,
         int i;
 
         info->npins = pins_cnt;
-        info->pins = devm_kzalloc(sprd_pctl->dev,
-                                  info->npins * sizeof(struct sprd_pin),
+        info->pins = devm_kcalloc(sprd_pctl->dev,
+                                  info->npins, sizeof(struct sprd_pin),
                                   GFP_KERNEL);
         if (!info->pins)
                 return -ENOMEM;
@@ -1057,7 +1059,8 @@ int sprd_pinctrl_core_probe(struct platform_device *pdev,
                 return ret;
         }
 
-        pin_desc = devm_kzalloc(&pdev->dev, pinctrl_info->npins *
+        pin_desc = devm_kcalloc(&pdev->dev,
+                                pinctrl_info->npins,
                                 sizeof(struct pinctrl_pin_desc),
                                 GFP_KERNEL);
         if (!pin_desc)
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 25e80a5370ca..4d9bf9b3e9f3 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -277,7 +277,7 @@ static unsigned long *sunxi_pctrl_build_pin_config(struct device_node *node,
         if (!configlen)
                 return NULL;
 
-        pinconfig = kzalloc(configlen * sizeof(*pinconfig), GFP_KERNEL);
+        pinconfig = kcalloc(configlen, sizeof(*pinconfig), GFP_KERNEL);
         if (!pinconfig)
                 return ERR_PTR(-ENOMEM);
 
@@ -352,7 +352,7 @@ static int sunxi_pctrl_dt_node_to_map(struct pinctrl_dev *pctldev,
          * any configuration.
          */
         nmaps = npins * 2;
-        *map = kmalloc(nmaps * sizeof(struct pinctrl_map), GFP_KERNEL);
+        *map = kmalloc_array(nmaps, sizeof(struct pinctrl_map), GFP_KERNEL);
         if (!*map)
                 return -ENOMEM;
 
@@ -1055,8 +1055,8 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
          * this means that the number of pins is the maximum group
          * number we will ever see.
          */
-        pctl->groups = devm_kzalloc(&pdev->dev,
-                                    pctl->desc->npins * sizeof(*pctl->groups),
+        pctl->groups = devm_kcalloc(&pdev->dev,
+                                    pctl->desc->npins, sizeof(*pctl->groups),
                                     GFP_KERNEL);
         if (!pctl->groups)
                 return -ENOMEM;
@@ -1079,8 +1079,9 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
          * We suppose that we won't have any more functions than pins,
          * we'll reallocate that later anyway
          */
-        pctl->functions = devm_kzalloc(&pdev->dev,
-                                       pctl->ngroups * sizeof(*pctl->functions),
+        pctl->functions = devm_kcalloc(&pdev->dev,
+                                       pctl->ngroups,
+                                       sizeof(*pctl->functions),
                                        GFP_KERNEL);
         if (!pctl->functions)
                 return -ENOMEM;
@@ -1137,8 +1138,9 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
 
                         if (!func_item->groups) {
                                 func_item->groups =
-                                        devm_kzalloc(&pdev->dev,
-                                                     func_item->ngroups * sizeof(*func_item->groups),
+                                        devm_kcalloc(&pdev->dev,
+                                                     func_item->ngroups,
+                                                     sizeof(*func_item->groups),
                                                      GFP_KERNEL);
                                 if (!func_item->groups)
                                         return -ENOMEM;
@@ -1281,8 +1283,8 @@ int sunxi_pinctrl_init_with_variant(struct platform_device *pdev,
                 return ret;
         }
 
-        pins = devm_kzalloc(&pdev->dev,
-                            pctl->desc->npins * sizeof(*pins),
+        pins = devm_kcalloc(&pdev->dev,
+                            pctl->desc->npins, sizeof(*pins),
                             GFP_KERNEL);
         if (!pins)
                 return -ENOMEM;
diff --git a/drivers/pinctrl/tegra/pinctrl-tegra.c b/drivers/pinctrl/tegra/pinctrl-tegra.c
index 49c7c1499bc3..f974eee29a19 100644
--- a/drivers/pinctrl/tegra/pinctrl-tegra.c
+++ b/drivers/pinctrl/tegra/pinctrl-tegra.c
@@ -665,8 +665,8 @@ int tegra_pinctrl_probe(struct platform_device *pdev,
          * Each mux group will appear in 4 functions' list of groups.
          * This over-allocates slightly, since not all groups are mux groups.
          */
-        pmx->group_pins = devm_kzalloc(&pdev->dev,
-                soc_data->ngroups * 4 * sizeof(*pmx->group_pins),
+        pmx->group_pins = devm_kcalloc(&pdev->dev,
+                soc_data->ngroups * 4, sizeof(*pmx->group_pins),
                 GFP_KERNEL);
         if (!pmx->group_pins)
                 return -ENOMEM;
@@ -708,7 +708,7 @@ int tegra_pinctrl_probe(struct platform_device *pdev,
         }
         pmx->nbanks = i;
 
-        pmx->regs = devm_kzalloc(&pdev->dev, pmx->nbanks * sizeof(*pmx->regs),
+        pmx->regs = devm_kcalloc(&pdev->dev, pmx->nbanks, sizeof(*pmx->regs),
                                  GFP_KERNEL);
         if (!pmx->regs)
                 return -ENOMEM;
diff --git a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
index a8a6510183b6..8782c348ebe9 100644
--- a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
+++ b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
@@ -510,11 +510,11 @@ static int ti_iodelay_dt_node_to_map(struct pinctrl_dev *pctldev,
                 goto free_map;
         }
 
-        pins = devm_kzalloc(iod->dev, sizeof(*pins) * rows, GFP_KERNEL);
+        pins = devm_kcalloc(iod->dev, rows, sizeof(*pins), GFP_KERNEL);
         if (!pins)
                 goto free_group;
 
-        cfg = devm_kzalloc(iod->dev, sizeof(*cfg) * rows, GFP_KERNEL);
+        cfg = devm_kcalloc(iod->dev, rows, sizeof(*cfg), GFP_KERNEL);
         if (!cfg) {
                 error = -ENOMEM;
                 goto free_pins;
@@ -749,7 +749,7 @@ static int ti_iodelay_alloc_pins(struct device *dev,
         nr_pins = ti_iodelay_offset_to_pin(iod, r->regmap_config->max_register);
         dev_dbg(dev, "Allocating %i pins\n", nr_pins);
 
-        iod->pa = devm_kzalloc(dev, sizeof(*iod->pa) * nr_pins, GFP_KERNEL);
+        iod->pa = devm_kcalloc(dev, nr_pins, sizeof(*iod->pa), GFP_KERNEL);
         if (!iod->pa)
                 return -ENOMEM;
 
diff --git a/drivers/pinctrl/vt8500/pinctrl-wmt.c b/drivers/pinctrl/vt8500/pinctrl-wmt.c
index d73956bdc211..c08318a5a91b 100644
--- a/drivers/pinctrl/vt8500/pinctrl-wmt.c
+++ b/drivers/pinctrl/vt8500/pinctrl-wmt.c
@@ -352,7 +352,7 @@ static int wmt_pctl_dt_node_to_map(struct pinctrl_dev *pctldev,
         if (num_pulls)
                 maps_per_pin++;
 
-        cur_map = maps = kzalloc(num_pins * maps_per_pin * sizeof(*maps),
+        cur_map = maps = kcalloc(num_pins * maps_per_pin, sizeof(*maps),
                                  GFP_KERNEL);
         if (!maps)
                 return -ENOMEM;
diff --git a/drivers/pinctrl/zte/pinctrl-zx.c b/drivers/pinctrl/zte/pinctrl-zx.c
index ded366bb6564..caa44dd2880a 100644
--- a/drivers/pinctrl/zte/pinctrl-zx.c
+++ b/drivers/pinctrl/zte/pinctrl-zx.c
@@ -277,7 +277,7 @@ static int zx_pinctrl_build_state(struct platform_device *pdev)
 
         /* Every single pin composes a group */
         ngroups = info->npins;
-        groups = devm_kzalloc(&pdev->dev, ngroups * sizeof(*groups),
+        groups = devm_kcalloc(&pdev->dev, ngroups, sizeof(*groups),
                               GFP_KERNEL);
         if (!groups)
                 return -ENOMEM;
@@ -362,8 +362,8 @@ static int zx_pinctrl_build_state(struct platform_device *pdev)
 
                         func = functions + j;
                         if (!func->group_names) {
-                                func->group_names = devm_kzalloc(&pdev->dev,
-                                                func->num_group_names *
+                                func->group_names = devm_kcalloc(&pdev->dev,
+                                                func->num_group_names,
                                                 sizeof(*func->group_names),
                                                 GFP_KERNEL);
                                 if (!func->group_names) {
diff --git a/drivers/platform/mellanox/mlxreg-hotplug.c b/drivers/platform/mellanox/mlxreg-hotplug.c
index ea9e7f4479ca..36a41ff506f0 100644
--- a/drivers/platform/mellanox/mlxreg-hotplug.c
+++ b/drivers/platform/mellanox/mlxreg-hotplug.c
@@ -217,7 +217,8 @@ static int mlxreg_hotplug_attr_init(struct mlxreg_hotplug_priv_data *priv)
                 }
         }
 
-        priv->group.attrs = devm_kzalloc(&priv->pdev->dev, num_attrs *
+        priv->group.attrs = devm_kcalloc(&priv->pdev->dev,
+                                         num_attrs,
                                          sizeof(struct attribute *),
                                          GFP_KERNEL);
         if (!priv->group.attrs)
diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
index 9d7dbd925065..d975462a4c57 100644
--- a/drivers/platform/x86/alienware-wmi.c
+++ b/drivers/platform/x86/alienware-wmi.c
@@ -458,19 +458,19 @@ static int alienware_zone_init(struct platform_device *dev)
          *      - zone_data num_zones is for the distinct zones
          */
         zone_dev_attrs =
-            kzalloc(sizeof(struct device_attribute) * (quirks->num_zones + 1),
+            kcalloc(quirks->num_zones + 1, sizeof(struct device_attribute),
                     GFP_KERNEL);
         if (!zone_dev_attrs)
                 return -ENOMEM;
 
         zone_attrs =
-            kzalloc(sizeof(struct attribute *) * (quirks->num_zones + 2),
+            kcalloc(quirks->num_zones + 2, sizeof(struct attribute *),
                     GFP_KERNEL);
         if (!zone_attrs)
                 return -ENOMEM;
 
         zone_data =
-            kzalloc(sizeof(struct platform_zone) * (quirks->num_zones),
+            kcalloc(quirks->num_zones, sizeof(struct platform_zone),
                     GFP_KERNEL);
         if (!zone_data)
                 return -ENOMEM;
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index a0c95853fd3f..014fc1634a3d 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -964,12 +964,12 @@ static int ips_monitor(void *data)
         u16 *mcp_samples, *ctv1_samples, *ctv2_samples, *mch_samples;
         u8 cur_seqno, last_seqno;
 
-        mcp_samples = kzalloc(sizeof(u16) * IPS_SAMPLE_COUNT, GFP_KERNEL);
-        ctv1_samples = kzalloc(sizeof(u16) * IPS_SAMPLE_COUNT, GFP_KERNEL);
-        ctv2_samples = kzalloc(sizeof(u16) * IPS_SAMPLE_COUNT, GFP_KERNEL);
-        mch_samples = kzalloc(sizeof(u16) * IPS_SAMPLE_COUNT, GFP_KERNEL);
-        cpu_samples = kzalloc(sizeof(u32) * IPS_SAMPLE_COUNT, GFP_KERNEL);
-        mchp_samples = kzalloc(sizeof(u32) * IPS_SAMPLE_COUNT, GFP_KERNEL);
+        mcp_samples = kcalloc(IPS_SAMPLE_COUNT, sizeof(u16), GFP_KERNEL);
+        ctv1_samples = kcalloc(IPS_SAMPLE_COUNT, sizeof(u16), GFP_KERNEL);
+        ctv2_samples = kcalloc(IPS_SAMPLE_COUNT, sizeof(u16), GFP_KERNEL);
+        mch_samples = kcalloc(IPS_SAMPLE_COUNT, sizeof(u16), GFP_KERNEL);
+        cpu_samples = kcalloc(IPS_SAMPLE_COUNT, sizeof(u32), GFP_KERNEL);
+        mchp_samples = kcalloc(IPS_SAMPLE_COUNT, sizeof(u32), GFP_KERNEL);
         if (!mcp_samples || !ctv1_samples || !ctv2_samples || !mch_samples ||
                         !cpu_samples || !mchp_samples) {
                 dev_err(ips->dev,
diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
index 5c39b3211709..8361ad75389a 100644
--- a/drivers/platform/x86/panasonic-laptop.c
+++ b/drivers/platform/x86/panasonic-laptop.c
@@ -571,7 +571,7 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
                 return -ENOMEM;
         }
 
-        pcc->sinf = kzalloc(sizeof(u32) * (num_sifr + 1), GFP_KERNEL);
+        pcc->sinf = kcalloc(num_sifr + 1, sizeof(u32), GFP_KERNEL);
         if (!pcc->sinf) {
                 result = -ENOMEM;
                 goto out_hotkey;
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index da1ca4856ea1..ab2d28867c52 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -6006,7 +6006,7 @@ static int __init led_init(struct ibm_init_struct *iibm)
         if (led_supported == TPACPI_LED_NONE)
                 return 1;
 
-        tpacpi_leds = kzalloc(sizeof(*tpacpi_leds) * TPACPI_LED_NUMLEDS,
+        tpacpi_leds = kcalloc(TPACPI_LED_NUMLEDS, sizeof(*tpacpi_leds),
                               GFP_KERNEL);
         if (!tpacpi_leds) {
                 pr_err("Out of memory for LED data\n");
diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c
index 2a50b4654793..faa1a67cf3d2 100644
--- a/drivers/power/supply/charger-manager.c
+++ b/drivers/power/supply/charger-manager.c
@@ -1380,7 +1380,7 @@ static int charger_manager_register_sysfs(struct charger_manager *cm)
 
                 snprintf(buf, 10, "charger.%d", i);
                 str = devm_kzalloc(cm->dev,
-                                sizeof(char) * (strlen(buf) + 1), GFP_KERNEL);
+                                strlen(buf) + 1, GFP_KERNEL);
                 if (!str)
                         return -ENOMEM;
 
@@ -1522,8 +1522,10 @@ static struct charger_desc *of_cm_parse_desc(struct device *dev)
         of_property_read_u32(np, "cm-num-chargers", &num_chgs);
         if (num_chgs) {
                 /* Allocate empty bin at the tail of array */
-                desc->psy_charger_stat = devm_kzalloc(dev, sizeof(char *)
-                                                * (num_chgs + 1), GFP_KERNEL);
+                desc->psy_charger_stat = devm_kcalloc(dev,
+                                                      num_chgs + 1,
+                                                      sizeof(char *),
+                                                      GFP_KERNEL);
                 if (desc->psy_charger_stat) {
                         int i;
                         for (i = 0; i < num_chgs; i++)
@@ -1555,8 +1557,9 @@ static struct charger_desc *of_cm_parse_desc(struct device *dev)
                 struct charger_regulator *chg_regs;
                 struct device_node *child;
 
-                chg_regs = devm_kzalloc(dev, sizeof(*chg_regs)
-                                        * desc->num_charger_regulators,
+                chg_regs = devm_kcalloc(dev,
+                                        desc->num_charger_regulators,
+                                        sizeof(*chg_regs),
                                         GFP_KERNEL);
                 if (!chg_regs)
                         return ERR_PTR(-ENOMEM);
@@ -1573,9 +1576,10 @@ static struct charger_desc *of_cm_parse_desc(struct device *dev)
                         /* charger cables */
                         chg_regs->num_cables = of_get_child_count(child);
                         if (chg_regs->num_cables) {
-                                cables = devm_kzalloc(dev, sizeof(*cables)
-                                                * chg_regs->num_cables,
-                                                GFP_KERNEL);
+                                cables = devm_kcalloc(dev,
+                                                      chg_regs->num_cables,
+                                                      sizeof(*cables),
+                                                      GFP_KERNEL);
                                 if (!cables) {
                                         of_node_put(child);
                                         return ERR_PTR(-ENOMEM);
@@ -1725,10 +1729,11 @@ static int charger_manager_probe(struct platform_device *pdev)
         cm->charger_psy_desc.name = cm->psy_name_buf;
 
         /* Allocate for psy properties because they may vary */
-        cm->charger_psy_desc.properties = devm_kzalloc(&pdev->dev,
-                                sizeof(enum power_supply_property)
-                                * (ARRAY_SIZE(default_charger_props) +
-                                NUM_CHARGER_PSY_OPTIONAL), GFP_KERNEL);
+        cm->charger_psy_desc.properties =
+                devm_kcalloc(&pdev->dev,
+                             ARRAY_SIZE(default_charger_props) +
+                                NUM_CHARGER_PSY_OPTIONAL,
+                             sizeof(enum power_supply_property), GFP_KERNEL);
         if (!cm->charger_psy_desc.properties)
                 return -ENOMEM;
 
diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index f57ab0a27301..d21f478741c1 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -263,8 +263,8 @@ static int power_supply_check_supplies(struct power_supply *psy)
         if (!psy->supplied_from)
                 return -ENOMEM;
 
-        *psy->supplied_from = devm_kzalloc(&psy->dev,
-                                           sizeof(char *) * (cnt - 1),
+        *psy->supplied_from = devm_kcalloc(&psy->dev,
+                                           cnt - 1, sizeof(char *),
                                            GFP_KERNEL);
         if (!*psy->supplied_from)
                 return -ENOMEM;
diff --git a/drivers/power/supply/wm97xx_battery.c b/drivers/power/supply/wm97xx_battery.c
index bd4f66651513..6754e761778a 100644
--- a/drivers/power/supply/wm97xx_battery.c
+++ b/drivers/power/supply/wm97xx_battery.c
@@ -201,7 +201,7 @@ static int wm97xx_bat_probe(struct platform_device *dev)
         if (pdata->min_voltage >= 0)
                 props++;        /* POWER_SUPPLY_PROP_VOLTAGE_MIN */
 
-        prop = kzalloc(props * sizeof(*prop), GFP_KERNEL);
+        prop = kcalloc(props, sizeof(*prop), GFP_KERNEL);
         if (!prop) {
                 ret = -ENOMEM;
                 goto err3;
diff --git a/drivers/power/supply/z2_battery.c b/drivers/power/supply/z2_battery.c
index 8a43b49cfd35..bcc2d1a9b0a7 100644
--- a/drivers/power/supply/z2_battery.c
+++ b/drivers/power/supply/z2_battery.c
@@ -146,7 +146,7 @@ static int z2_batt_ps_init(struct z2_charger *charger, int props)
         if (info->min_voltage >= 0)
                 props++;        /* POWER_SUPPLY_PROP_VOLTAGE_MIN */
 
-        prop = kzalloc(props * sizeof(*prop), GFP_KERNEL);
+        prop = kcalloc(props, sizeof(*prop), GFP_KERNEL);
         if (!prop)
                 return -ENOMEM;
 
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index 64b2b2501a79..9e2f274bd44f 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -545,15 +545,16 @@ struct powercap_zone *powercap_register_zone(
         dev_set_name(&power_zone->dev, "%s:%x",
                                         dev_name(power_zone->dev.parent),
                                         power_zone->id);
-        power_zone->constraints = kzalloc(sizeof(*power_zone->constraints) *
-                                         nr_constraints, GFP_KERNEL);
+        power_zone->constraints = kcalloc(nr_constraints,
+                                          sizeof(*power_zone->constraints),
+                                          GFP_KERNEL);
         if (!power_zone->constraints)
                 goto err_const_alloc;
 
         nr_attrs = nr_constraints * POWERCAP_CONSTRAINTS_ATTRS +
                                                 POWERCAP_ZONE_MAX_ATTRS + 1;
-        power_zone->zone_dev_attrs = kzalloc(sizeof(void *) *
-                                                nr_attrs, GFP_KERNEL);
+        power_zone->zone_dev_attrs = kcalloc(nr_attrs, sizeof(void *),
+                                             GFP_KERNEL);
         if (!power_zone->zone_dev_attrs)
                 goto err_attr_alloc;
         create_power_zone_common_attributes(power_zone);
diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c
index 52584e9962ed..15b40a8bc4fb 100644
--- a/drivers/pwm/pwm-lp3943.c
+++ b/drivers/pwm/pwm-lp3943.c
@@ -225,7 +225,7 @@ static int lp3943_pwm_parse_dt(struct device *dev,
                 if (num_outputs == 0)
                         continue;
 
-                output = devm_kzalloc(dev, sizeof(*output) * num_outputs,
+                output = devm_kcalloc(dev, num_outputs, sizeof(*output),
                                       GFP_KERNEL);
                 if (!output)
                         return -ENOMEM;
diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index 0434ab7b6497..a8cb8d2f2abb 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -975,7 +975,7 @@ static int rio_mport_transfer_ioctl(struct file *filp, void __user *arg)
              priv->md->properties.transfer_mode) == 0)
                 return -ENODEV;
 
-        transfer = vmalloc(transaction.count * sizeof(*transfer));
+        transfer = vmalloc(array_size(sizeof(*transfer), transaction.count));
         if (!transfer)
                 return -ENOMEM;
 
diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c
index 161b927d9de1..fd7b517132ac 100644
--- a/drivers/rapidio/rio-scan.c
+++ b/drivers/rapidio/rio-scan.c
@@ -425,9 +425,9 @@ static struct rio_dev *rio_setup_device(struct rio_net *net,
                 rswitch = rdev->rswitch;
                 rswitch->port_ok = 0;
                 spin_lock_init(&rswitch->lock);
-                rswitch->route_table = kzalloc(sizeof(u8)*
-                                        RIO_MAX_ROUTE_ENTRIES(port->sys_size),
-                                        GFP_KERNEL);
+                rswitch->route_table =
+                        kzalloc(RIO_MAX_ROUTE_ENTRIES(port->sys_size),
+                                GFP_KERNEL);
                 if (!rswitch->route_table)
                         goto cleanup;
                 /* Initialize switch route table */
diff --git a/drivers/regulator/act8865-regulator.c b/drivers/regulator/act8865-regulator.c
index 7652477e6a9d..21e20483bd91 100644
--- a/drivers/regulator/act8865-regulator.c
+++ b/drivers/regulator/act8865-regulator.c
@@ -424,9 +424,10 @@ static int act8865_pdata_from_dt(struct device *dev,
         if (matched <= 0)
                 return matched;
 
-        pdata->regulators = devm_kzalloc(dev,
-                                         sizeof(struct act8865_regulator_data) *
-                                         num_matches, GFP_KERNEL);
+        pdata->regulators = devm_kcalloc(dev,
+                                         num_matches,
+                                         sizeof(struct act8865_regulator_data),
+                                         GFP_KERNEL);
         if (!pdata->regulators)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/as3711-regulator.c b/drivers/regulator/as3711-regulator.c
index 874d415d6b4f..565a71343a8e 100644
--- a/drivers/regulator/as3711-regulator.c
+++ b/drivers/regulator/as3711-regulator.c
@@ -239,8 +239,10 @@ static int as3711_regulator_probe(struct platform_device *pdev)
                 }
         }
 
-        regs = devm_kzalloc(&pdev->dev, AS3711_REGULATOR_NUM *
-                        sizeof(struct as3711_regulator), GFP_KERNEL);
+        regs = devm_kcalloc(&pdev->dev,
+                            AS3711_REGULATOR_NUM,
+                            sizeof(struct as3711_regulator),
+                            GFP_KERNEL);
         if (!regs)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/bcm590xx-regulator.c b/drivers/regulator/bcm590xx-regulator.c
index 9dd715407b39..92d6d7b10cf7 100644
--- a/drivers/regulator/bcm590xx-regulator.c
+++ b/drivers/regulator/bcm590xx-regulator.c
@@ -383,8 +383,10 @@ static int bcm590xx_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, pmu);
 
-        pmu->desc = devm_kzalloc(&pdev->dev, BCM590XX_NUM_REGS *
-                        sizeof(struct regulator_desc), GFP_KERNEL);
+        pmu->desc = devm_kcalloc(&pdev->dev,
+                                 BCM590XX_NUM_REGS,
+                                 sizeof(struct regulator_desc),
+                                 GFP_KERNEL);
         if (!pmu->desc)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/da9063-regulator.c b/drivers/regulator/da9063-regulator.c
index 6a8f9cd69f52..2df26f36c687 100644
--- a/drivers/regulator/da9063-regulator.c
+++ b/drivers/regulator/da9063-regulator.c
@@ -681,8 +681,8 @@ static struct da9063_regulators_pdata *da9063_parse_regulators_dt(
         if (!pdata)
                 return ERR_PTR(-ENOMEM);
 
-        pdata->regulator_data = devm_kzalloc(&pdev->dev,
-                                        num * sizeof(*pdata->regulator_data),
+        pdata->regulator_data = devm_kcalloc(&pdev->dev,
+                                        num, sizeof(*pdata->regulator_data),
                                         GFP_KERNEL);
         if (!pdata->regulator_data)
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c
index a86b8997bb54..b2f5ec4f658a 100644
--- a/drivers/regulator/gpio-regulator.c
+++ b/drivers/regulator/gpio-regulator.c
@@ -172,8 +172,8 @@ of_get_gpio_regulator_config(struct device *dev, struct device_node *np,
 
         if (ret > 0) {
                 config->nr_gpios = ret;
-                config->gpios = devm_kzalloc(dev,
-                                        sizeof(struct gpio) * config->nr_gpios,
+                config->gpios = devm_kcalloc(dev,
+                                        config->nr_gpios, sizeof(struct gpio),
                                         GFP_KERNEL);
                 if (!config->gpios)
                         return ERR_PTR(-ENOMEM);
@@ -214,9 +214,9 @@ of_get_gpio_regulator_config(struct device *dev, struct device_node *np,
                 return ERR_PTR(-EINVAL);
         }
 
-        config->states = devm_kzalloc(dev,
-                                sizeof(struct gpio_regulator_state)
-                                * (proplen / 2),
+        config->states = devm_kcalloc(dev,
+                                proplen / 2,
+                                sizeof(struct gpio_regulator_state),
                                 GFP_KERNEL);
         if (!config->states)
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/regulator/max1586.c b/drivers/regulator/max1586.c
index 66bbaa999433..cc52779b53f7 100644
--- a/drivers/regulator/max1586.c
+++ b/drivers/regulator/max1586.c
@@ -194,8 +194,10 @@ static int of_get_max1586_platform_data(struct device *dev,
         if (matched <= 0)
                 return matched;
 
-        pdata->subdevs = devm_kzalloc(dev, sizeof(struct max1586_subdev_data) *
-                                                matched, GFP_KERNEL);
+        pdata->subdevs = devm_kcalloc(dev,
+                                      matched,
+                                      sizeof(struct max1586_subdev_data),
+                                      GFP_KERNEL);
         if (!pdata->subdevs)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
index a6183425f27d..4cf6897a401f 100644
--- a/drivers/regulator/max8660.c
+++ b/drivers/regulator/max8660.c
@@ -351,8 +351,10 @@ static int max8660_pdata_from_dt(struct device *dev,
         if (matched <= 0)
                 return matched;
 
-        pdata->subdevs = devm_kzalloc(dev, sizeof(struct max8660_subdev_data) *
-                                                matched, GFP_KERNEL);
+        pdata->subdevs = devm_kcalloc(dev,
+                                      matched,
+                                      sizeof(struct max8660_subdev_data),
+                                      GFP_KERNEL);
         if (!pdata->subdevs)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/max8997-regulator.c b/drivers/regulator/max8997-regulator.c
index 559b9ac45404..a8ea30ee18a6 100644
--- a/drivers/regulator/max8997-regulator.c
+++ b/drivers/regulator/max8997-regulator.c
@@ -929,8 +929,9 @@ static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
         /* count the number of regulators to be supported in pmic */
         pdata->num_regulators = of_get_child_count(regulators_np);
 
-        rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) *
-                                pdata->num_regulators, GFP_KERNEL);
+        rdata = devm_kcalloc(&pdev->dev,
+                             pdata->num_regulators, sizeof(*rdata),
+                             GFP_KERNEL);
         if (!rdata) {
                 of_node_put(regulators_np);
                 return -ENOMEM;
diff --git a/drivers/regulator/max8998.c b/drivers/regulator/max8998.c
index 6a2b61c012b5..6b9f262ebbb0 100644
--- a/drivers/regulator/max8998.c
+++ b/drivers/regulator/max8998.c
@@ -670,8 +670,9 @@ static int max8998_pmic_dt_parse_pdata(struct max8998_dev *iodev,
         /* count the number of regulators to be supported in pmic */
         pdata->num_regulators = of_get_child_count(regulators_np);
 
-        rdata = devm_kzalloc(iodev->dev, sizeof(*rdata) *
-                                pdata->num_regulators, GFP_KERNEL);
+        rdata = devm_kcalloc(iodev->dev,
+                             pdata->num_regulators, sizeof(*rdata),
+                             GFP_KERNEL);
         if (!rdata) {
                 of_node_put(regulators_np);
                 return -ENOMEM;
diff --git a/drivers/regulator/mc13xxx-regulator-core.c b/drivers/regulator/mc13xxx-regulator-core.c
index 41271aeea63e..da4fb9824757 100644
--- a/drivers/regulator/mc13xxx-regulator-core.c
+++ b/drivers/regulator/mc13xxx-regulator-core.c
@@ -171,7 +171,7 @@ struct mc13xxx_regulator_init_data *mc13xxx_parse_regulators_dt(
         if (!parent)
                 return NULL;
 
-        data = devm_kzalloc(&pdev->dev, sizeof(*data) * priv->num_regulators,
+        data = devm_kcalloc(&pdev->dev, priv->num_regulators, sizeof(*data),
                             GFP_KERNEL);
         if (!data) {
                 of_node_put(parent);
diff --git a/drivers/regulator/pbias-regulator.c b/drivers/regulator/pbias-regulator.c
index 8f782d22fdbe..92b41a6a4dc2 100644
--- a/drivers/regulator/pbias-regulator.c
+++ b/drivers/regulator/pbias-regulator.c
@@ -173,8 +173,9 @@ static int pbias_regulator_probe(struct platform_device *pdev)
         if (count < 0)
                 return count;
 
-        drvdata = devm_kzalloc(&pdev->dev, sizeof(struct pbias_regulator_data)
-                               * count, GFP_KERNEL);
+        drvdata = devm_kcalloc(&pdev->dev,
+                               count, sizeof(struct pbias_regulator_data),
+                               GFP_KERNEL);
         if (!drvdata)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/rc5t583-regulator.c b/drivers/regulator/rc5t583-regulator.c
index d0f1340168b1..2ec51af43673 100644
--- a/drivers/regulator/rc5t583-regulator.c
+++ b/drivers/regulator/rc5t583-regulator.c
@@ -132,8 +132,10 @@ static int rc5t583_regulator_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        regs = devm_kzalloc(&pdev->dev, RC5T583_REGULATOR_MAX *
-                        sizeof(struct rc5t583_regulator), GFP_KERNEL);
+        regs = devm_kcalloc(&pdev->dev,
+                            RC5T583_REGULATOR_MAX,
+                            sizeof(struct rc5t583_regulator),
+                            GFP_KERNEL);
         if (!regs)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index 7726b874e539..d1207ec683db 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -1139,8 +1139,8 @@ static int s2mps11_pmic_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        s2mps11->ext_control_gpio = devm_kmalloc(&pdev->dev,
-                        sizeof(*s2mps11->ext_control_gpio) * rdev_num,
+        s2mps11->ext_control_gpio = devm_kmalloc_array(&pdev->dev,
+                        rdev_num, sizeof(*s2mps11->ext_control_gpio),
                         GFP_KERNEL);
         if (!s2mps11->ext_control_gpio)
                 return -ENOMEM;
@@ -1162,7 +1162,7 @@ static int s2mps11_pmic_probe(struct platform_device *pdev)
                 }
         }
 
-        rdata = kzalloc(sizeof(*rdata) * rdev_num, GFP_KERNEL);
+        rdata = kcalloc(rdev_num, sizeof(*rdata), GFP_KERNEL);
         if (!rdata)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
index b8443a360646..0cbc980753c2 100644
--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -553,13 +553,15 @@ static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
         /* count the number of regulators to be supported in pmic */
         pdata->num_regulators = of_get_child_count(regulators_np);
 
-        rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) *
-                                pdata->num_regulators, GFP_KERNEL);
+        rdata = devm_kcalloc(&pdev->dev,
+                             pdata->num_regulators, sizeof(*rdata),
+                             GFP_KERNEL);
         if (!rdata)
                 return -ENOMEM;
 
-        rmode = devm_kzalloc(&pdev->dev, sizeof(*rmode) *
-                                pdata->num_regulators, GFP_KERNEL);
+        rmode = devm_kcalloc(&pdev->dev,
+                             pdata->num_regulators, sizeof(*rmode),
+                             GFP_KERNEL);
         if (!rmode)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
index d2f994298753..cced1ffb896c 100644
--- a/drivers/regulator/ti-abb-regulator.c
+++ b/drivers/regulator/ti-abb-regulator.c
@@ -532,13 +532,13 @@ static int ti_abb_init_table(struct device *dev, struct ti_abb *abb,
         }
         num_entries /= num_values;
 
-        info = devm_kzalloc(dev, sizeof(*info) * num_entries, GFP_KERNEL);
+        info = devm_kcalloc(dev, num_entries, sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
         abb->info = info;
 
-        volt_table = devm_kzalloc(dev, sizeof(unsigned int) * num_entries,
+        volt_table = devm_kcalloc(dev, num_entries, sizeof(unsigned int),
                                   GFP_KERNEL);
         if (!volt_table)
                 return -ENOMEM;
diff --git a/drivers/regulator/tps65090-regulator.c b/drivers/regulator/tps65090-regulator.c
index 2d398fa3b720..edaef9e4dc74 100644
--- a/drivers/regulator/tps65090-regulator.c
+++ b/drivers/regulator/tps65090-regulator.c
@@ -331,8 +331,9 @@ static struct tps65090_platform_data *tps65090_parse_dt_reg_data(
         if (!tps65090_pdata)
                 return ERR_PTR(-ENOMEM);
 
-        reg_pdata = devm_kzalloc(&pdev->dev, TPS65090_REGULATOR_MAX *
-                                sizeof(*reg_pdata), GFP_KERNEL);
+        reg_pdata = devm_kcalloc(&pdev->dev,
+                                 TPS65090_REGULATOR_MAX, sizeof(*reg_pdata),
+                                 GFP_KERNEL);
         if (!reg_pdata)
                 return ERR_PTR(-ENOMEM);
 
@@ -429,8 +430,9 @@ static int tps65090_regulator_probe(struct platform_device *pdev)
                 return tps65090_pdata ? PTR_ERR(tps65090_pdata) : -EINVAL;
         }
 
-        pmic = devm_kzalloc(&pdev->dev, TPS65090_REGULATOR_MAX * sizeof(*pmic),
-                        GFP_KERNEL);
+        pmic = devm_kcalloc(&pdev->dev,
+                            TPS65090_REGULATOR_MAX, sizeof(*pmic),
+                            GFP_KERNEL);
         if (!pmic)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/tps65217-regulator.c b/drivers/regulator/tps65217-regulator.c
index 7b12e880d1ea..fc12badf3805 100644
--- a/drivers/regulator/tps65217-regulator.c
+++ b/drivers/regulator/tps65217-regulator.c
@@ -229,8 +229,9 @@ static int tps65217_regulator_probe(struct platform_device *pdev)
         unsigned int val;
 
         /* Allocate memory for strobes */
-        tps->strobes = devm_kzalloc(&pdev->dev, sizeof(u8) *
-                                    TPS65217_NUM_REGULATOR, GFP_KERNEL);
+        tps->strobes = devm_kcalloc(&pdev->dev,
+                                    TPS65217_NUM_REGULATOR, sizeof(u8),
+                                    GFP_KERNEL);
 
         platform_set_drvdata(pdev, tps);
 
diff --git a/drivers/regulator/tps65218-regulator.c b/drivers/regulator/tps65218-regulator.c
index 1827185beacc..6209beee1018 100644
--- a/drivers/regulator/tps65218-regulator.c
+++ b/drivers/regulator/tps65218-regulator.c
@@ -324,8 +324,9 @@ static int tps65218_regulator_probe(struct platform_device *pdev)
         config.regmap = tps->regmap;
 
         /* Allocate memory for strobes */
-        tps->strobes = devm_kzalloc(&pdev->dev, sizeof(u8) *
-                                    TPS65218_NUM_REGULATOR, GFP_KERNEL);
+        tps->strobes = devm_kcalloc(&pdev->dev,
+                                    TPS65218_NUM_REGULATOR, sizeof(u8),
+                                    GFP_KERNEL);
         if (!tps->strobes)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index 81672a58fcc2..02ccdaa226a7 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -1131,18 +1131,24 @@ static int tps65910_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        pmic->desc = devm_kzalloc(&pdev->dev, pmic->num_regulators *
-                        sizeof(struct regulator_desc), GFP_KERNEL);
+        pmic->desc = devm_kcalloc(&pdev->dev,
+                                  pmic->num_regulators,
+                                  sizeof(struct regulator_desc),
+                                  GFP_KERNEL);
         if (!pmic->desc)
                 return -ENOMEM;
 
-        pmic->info = devm_kzalloc(&pdev->dev, pmic->num_regulators *
-                        sizeof(struct tps_info *), GFP_KERNEL);
+        pmic->info = devm_kcalloc(&pdev->dev,
+                                  pmic->num_regulators,
+                                  sizeof(struct tps_info *),
+                                  GFP_KERNEL);
         if (!pmic->info)
                 return -ENOMEM;
 
-        pmic->rdev = devm_kzalloc(&pdev->dev, pmic->num_regulators *
-                        sizeof(struct regulator_dev *), GFP_KERNEL);
+        pmic->rdev = devm_kcalloc(&pdev->dev,
+                                  pmic->num_regulators,
+                                  sizeof(struct regulator_dev *),
+                                  GFP_KERNEL);
         if (!pmic->rdev)
                 return -ENOMEM;
 
diff --git a/drivers/regulator/tps80031-regulator.c b/drivers/regulator/tps80031-regulator.c
index d4cc60ad18ae..1001147404c3 100644
--- a/drivers/regulator/tps80031-regulator.c
+++ b/drivers/regulator/tps80031-regulator.c
@@ -691,8 +691,8 @@ static int tps80031_regulator_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        pmic = devm_kzalloc(&pdev->dev,
-                        TPS80031_REGULATOR_MAX * sizeof(*pmic), GFP_KERNEL);
+        pmic = devm_kcalloc(&pdev->dev,
+                        TPS80031_REGULATOR_MAX, sizeof(*pmic), GFP_KERNEL);
         if (!pmic)
                 return -ENOMEM;
 
diff --git a/drivers/reset/reset-ti-syscon.c b/drivers/reset/reset-ti-syscon.c
index 99520b0a1329..a2635c21db7f 100644
--- a/drivers/reset/reset-ti-syscon.c
+++ b/drivers/reset/reset-ti-syscon.c
@@ -189,7 +189,8 @@ static int ti_syscon_reset_probe(struct platform_device *pdev)
         }
 
         nr_controls = (size / sizeof(*list)) / 7;
-        controls = devm_kzalloc(dev, nr_controls * sizeof(*controls), GFP_KERNEL);
+        controls = devm_kcalloc(dev, nr_controls, sizeof(*controls),
+                                GFP_KERNEL);
         if (!controls)
                 return -ENOMEM;
 
diff --git a/drivers/s390/block/dasd_eer.c b/drivers/s390/block/dasd_eer.c
index fb2c3599d95c..0af8c5295b65 100644
--- a/drivers/s390/block/dasd_eer.c
+++ b/drivers/s390/block/dasd_eer.c
@@ -561,8 +561,8 @@ static int dasd_eer_open(struct inode *inp, struct file *filp)
                 return -EINVAL;
         }
         eerb->buffersize = eerb->buffer_page_count * PAGE_SIZE;
-        eerb->buffer = kmalloc(eerb->buffer_page_count * sizeof(char *),
-                               GFP_KERNEL);
+        eerb->buffer = kmalloc_array(eerb->buffer_page_count, sizeof(char *),
+                                     GFP_KERNEL);
         if (!eerb->buffer) {
                 kfree(eerb);
                 return -ENOMEM;
diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index 29024492b8ed..ed607288e696 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -238,9 +238,9 @@ dcssblk_is_continuous(struct dcssblk_dev_info *dev_info)
         if (dev_info->num_of_segments <= 1)
                 return 0;
 
-        sort_list = kzalloc(
-                        sizeof(struct segment_info) * dev_info->num_of_segments,
-                        GFP_KERNEL);
+        sort_list = kcalloc(dev_info->num_of_segments,
+                            sizeof(struct segment_info),
+                            GFP_KERNEL);
         if (sort_list == NULL)
                 return -ENOMEM;
         i = 0;
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index db1fbf9b00b5..79eb60958015 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -78,7 +78,7 @@ kbd_alloc(void) {
                 }
         }
         kbd->fn_handler =
-                kzalloc(sizeof(fn_handler_fn *) * NR_FN_HANDLER, GFP_KERNEL);
+                kcalloc(NR_FN_HANDLER, sizeof(fn_handler_fn *), GFP_KERNEL);
         if (!kbd->fn_handler)
                 goto out_func;
         kbd->accent_table = kmemdup(ebc_accent_table,
diff --git a/drivers/s390/char/sclp_sd.c b/drivers/s390/char/sclp_sd.c
index 99f41db5123b..1e244f78f192 100644
--- a/drivers/s390/char/sclp_sd.c
+++ b/drivers/s390/char/sclp_sd.c
@@ -300,7 +300,7 @@ static int sclp_sd_store_data(struct sclp_sd_data *result, u8 di)
                 goto out_result;
 
         /* Allocate memory */
-        data = vzalloc((size_t) dsize * PAGE_SIZE);
+        data = vzalloc(array_size((size_t)dsize, PAGE_SIZE));
         if (!data) {
                 rc = -ENOMEM;
                 goto out;
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index 1c98023cffd4..5b8af2782282 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -719,7 +719,8 @@ tty3270_alloc_view(void)
         if (!tp)
                 goto out_err;
         tp->freemem_pages =
-                kmalloc(sizeof(void *) * TTY3270_STRING_PAGES, GFP_KERNEL);
+                kmalloc_array(TTY3270_STRING_PAGES, sizeof(void *),
+                              GFP_KERNEL);
         if (!tp->freemem_pages)
                 goto out_tp;
         INIT_LIST_HEAD(&tp->freemem);
diff --git a/drivers/s390/char/vmur.c b/drivers/s390/char/vmur.c
index 52aa89424318..cbde65ab2170 100644
--- a/drivers/s390/char/vmur.c
+++ b/drivers/s390/char/vmur.c
@@ -242,7 +242,7 @@ static struct ccw1 *alloc_chan_prog(const char __user *ubuf, int rec_count,
          * That means we allocate room for CCWs to cover count/reclen
          * records plus a NOP.
          */
-        cpa = kzalloc((rec_count + 1) * sizeof(struct ccw1),
+        cpa = kcalloc(rec_count + 1, sizeof(struct ccw1),
                       GFP_KERNEL | GFP_DMA);
         if (!cpa)
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
index 4369662cfff5..76d3c50bf078 100644
--- a/drivers/s390/char/zcore.c
+++ b/drivers/s390/char/zcore.c
@@ -152,7 +152,7 @@ static int zcore_memmap_open(struct inode *inode, struct file *filp)
         char *buf;
         int i = 0;
 
-        buf = kzalloc(memblock.memory.cnt * CHUNK_INFO_SIZE, GFP_KERNEL);
+        buf = kcalloc(memblock.memory.cnt, CHUNK_INFO_SIZE, GFP_KERNEL);
         if (!buf) {
                 return -ENOMEM;
         }
diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
index 4c14ce428e92..78f1be41b05e 100644
--- a/drivers/s390/cio/qdio_setup.c
+++ b/drivers/s390/cio/qdio_setup.c
@@ -536,7 +536,7 @@ void qdio_print_subchannel_info(struct qdio_irq *irq_ptr,
 
 int qdio_enable_async_operation(struct qdio_output_q *outq)
 {
-        outq->aobs = kzalloc(sizeof(struct qaob *) * QDIO_MAX_BUFFERS_PER_Q,
+        outq->aobs = kcalloc(QDIO_MAX_BUFFERS_PER_Q, sizeof(struct qaob *),
                              GFP_ATOMIC);
         if (!outq->aobs) {
                 outq->use_cq = 0;
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index 0787b587e4b8..07dea602205b 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -241,8 +241,9 @@ out:
 /* allocate non-shared indicators and shared indicator */
 int __init tiqdio_allocate_memory(void)
 {
-        q_indicators = kzalloc(sizeof(struct indicator_t) * TIQDIO_NR_INDICATORS,
-                             GFP_KERNEL);
+        q_indicators = kcalloc(TIQDIO_NR_INDICATORS,
+                               sizeof(struct indicator_t),
+                               GFP_KERNEL);
         if (!q_indicators)
                 return -ENOMEM;
         return 0;
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index ed80d00cdb6f..3929c8be8098 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -121,7 +121,7 @@ static int alloc_and_prep_cprbmem(size_t paramblen,
          * allocate consecutive memory for request CPRB, request param
          * block, reply CPRB and reply param block
          */
-        cprbmem = kzalloc(2 * cprbplusparamblen, GFP_KERNEL);
+        cprbmem = kcalloc(2, cprbplusparamblen, GFP_KERNEL);
         if (!cprbmem)
                 return -ENOMEM;
 
@@ -899,9 +899,9 @@ int pkey_findcard(const struct pkey_seckey *seckey,
                 return -EINVAL;
 
         /* fetch status of all crypto cards */
-        device_status = kmalloc(MAX_ZDEV_ENTRIES_EXT
-                                * sizeof(struct zcrypt_device_status_ext),
-                                GFP_KERNEL);
+        device_status = kmalloc_array(MAX_ZDEV_ENTRIES_EXT,
+                                      sizeof(struct zcrypt_device_status_ext),
+                                      GFP_KERNEL);
         if (!device_status)
                 return -ENOMEM;
         zcrypt_device_status_mask_ext(device_status);
diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
index 7ce98b70cad3..7617d21cb296 100644
--- a/drivers/s390/net/ctcm_main.c
+++ b/drivers/s390/net/ctcm_main.c
@@ -1379,7 +1379,7 @@ static int add_channel(struct ccw_device *cdev, enum ctcm_channel_types type,
         } else
                 ccw_num = 8;
 
-        ch->ccw = kzalloc(ccw_num * sizeof(struct ccw1), GFP_KERNEL | GFP_DMA);
+        ch->ccw = kcalloc(ccw_num, sizeof(struct ccw1), GFP_KERNEL | GFP_DMA);
         if (ch->ccw == NULL)
                                         goto nomem_return;
 
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 9f28b6f2efc4..8e1474f1ffac 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -374,9 +374,10 @@ static int qeth_alloc_cq(struct qeth_card *card)
                 }
                 card->qdio.no_in_queues = 2;
                 card->qdio.out_bufstates =
-                        kzalloc(card->qdio.no_out_queues *
-                                QDIO_MAX_BUFFERS_PER_Q *
-                                sizeof(struct qdio_outbuf_state), GFP_KERNEL);
+                        kcalloc(card->qdio.no_out_queues *
+                                        QDIO_MAX_BUFFERS_PER_Q,
+                                sizeof(struct qdio_outbuf_state),
+                                GFP_KERNEL);
                 outbuf_states = card->qdio.out_bufstates;
                 if (outbuf_states == NULL) {
                         rc = -1;
@@ -2538,8 +2539,9 @@ static int qeth_alloc_qdio_buffers(struct qeth_card *card)
 
         /* outbound */
         card->qdio.out_qs =
-                kzalloc(card->qdio.no_out_queues *
-                        sizeof(struct qeth_qdio_out_q *), GFP_KERNEL);
+                kcalloc(card->qdio.no_out_queues,
+                        sizeof(struct qeth_qdio_out_q *),
+                        GFP_KERNEL);
         if (!card->qdio.out_qs)
                 goto out_freepool;
         for (i = 0; i < card->qdio.no_out_queues; ++i) {
@@ -4963,8 +4965,8 @@ static int qeth_qdio_establish(struct qeth_card *card)
 
         QETH_DBF_TEXT(SETUP, 2, "qdioest");
 
-        qib_param_field = kzalloc(QDIO_MAX_BUFFERS_PER_Q * sizeof(char),
-                              GFP_KERNEL);
+        qib_param_field = kzalloc(QDIO_MAX_BUFFERS_PER_Q,
+                                  GFP_KERNEL);
         if (!qib_param_field) {
                 rc =  -ENOMEM;
                 goto out_free_nothing;
@@ -4973,8 +4975,8 @@ static int qeth_qdio_establish(struct qeth_card *card)
         qeth_create_qib_param_field(card, qib_param_field);
         qeth_create_qib_param_field_blkt(card, qib_param_field);
 
-        in_sbal_ptrs = kzalloc(card->qdio.no_in_queues *
-                               QDIO_MAX_BUFFERS_PER_Q * sizeof(void *),
+        in_sbal_ptrs = kcalloc(card->qdio.no_in_queues * QDIO_MAX_BUFFERS_PER_Q,
+                               sizeof(void *),
                                GFP_KERNEL);
         if (!in_sbal_ptrs) {
                 rc = -ENOMEM;
@@ -4985,7 +4987,7 @@ static int qeth_qdio_establish(struct qeth_card *card)
                         virt_to_phys(card->qdio.in_q->bufs[i].buffer);
         }
 
-        queue_start_poll = kzalloc(sizeof(void *) * card->qdio.no_in_queues,
+        queue_start_poll = kcalloc(card->qdio.no_in_queues, sizeof(void *),
                                    GFP_KERNEL);
         if (!queue_start_poll) {
                 rc = -ENOMEM;
@@ -4997,8 +4999,9 @@ static int qeth_qdio_establish(struct qeth_card *card)
         qeth_qdio_establish_cq(card, in_sbal_ptrs, queue_start_poll);
 
         out_sbal_ptrs =
-                kzalloc(card->qdio.no_out_queues * QDIO_MAX_BUFFERS_PER_Q *
-                        sizeof(void *), GFP_KERNEL);
+                kcalloc(card->qdio.no_out_queues * QDIO_MAX_BUFFERS_PER_Q,
+                        sizeof(void *),
+                        GFP_KERNEL);
         if (!out_sbal_ptrs) {
                 rc = -ENOMEM;
                 goto out_free_queue_start_poll;
diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
index 35380a58d3f0..0d4ffe0ae306 100644
--- a/drivers/scsi/BusLogic.c
+++ b/drivers/scsi/BusLogic.c
@@ -2366,7 +2366,7 @@ static int __init blogic_init(void)
         if (blogic_probe_options.noprobe)
                 return -ENODEV;
         blogic_probeinfo_list =
-            kzalloc(BLOGIC_MAX_ADAPTERS * sizeof(struct blogic_probeinfo),
+            kcalloc(BLOGIC_MAX_ADAPTERS, sizeof(struct blogic_probeinfo),
                             GFP_KERNEL);
         if (blogic_probeinfo_list == NULL) {
                 blogic_err("BusLogic: Unable to allocate Probe Info List\n",
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index e7961cbd2c55..a9831bd37a73 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -4132,7 +4132,7 @@ static int aac_convert_sgraw2(struct aac_raw_io2 *rio2, int pages, int nseg, int
         if (aac_convert_sgl == 0)
                 return 0;
 
-        sge = kmalloc(nseg_new * sizeof(struct sge_ieee1212), GFP_ATOMIC);
+        sge = kmalloc_array(nseg_new, sizeof(struct sge_ieee1212), GFP_ATOMIC);
         if (sge == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index f24fb942065d..04443577d48b 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1681,7 +1681,9 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         if (aac_reset_devices || reset_devices)
                 aac->init_reset = true;
 
-        aac->fibs = kzalloc(sizeof(struct fib) * (shost->can_queue + AAC_NUM_MGT_FIB), GFP_KERNEL);
+        aac->fibs = kcalloc(shost->can_queue + AAC_NUM_MGT_FIB,
+                            sizeof(struct fib),
+                            GFP_KERNEL);
         if (!aac->fibs)
                 goto out_free_host;
         spin_lock_init(&aac->fib_lock);
diff --git a/drivers/scsi/aha1542.c b/drivers/scsi/aha1542.c
index 124217927c4a..41add33e3f1f 100644
--- a/drivers/scsi/aha1542.c
+++ b/drivers/scsi/aha1542.c
@@ -400,7 +400,8 @@ static int aha1542_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *cmd)
 #endif
         if (bufflen) {  /* allocate memory before taking host_lock */
                 sg_count = scsi_sg_count(cmd);
-                cptr = kmalloc(sizeof(*cptr) * sg_count, GFP_KERNEL | GFP_DMA);
+                cptr = kmalloc_array(sg_count, sizeof(*cptr),
+                                     GFP_KERNEL | GFP_DMA);
                 if (!cptr)
                         return SCSI_MLQUEUE_HOST_BUSY;
         } else {
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 034f4eebb160..67d292dcc607 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -7063,7 +7063,8 @@ ahd_init(struct ahd_softc *ahd)
         AHD_ASSERT_MODES(ahd, AHD_MODE_SCSI_MSK, AHD_MODE_SCSI_MSK);
 
         ahd->stack_size = ahd_probe_stack_size(ahd);
-        ahd->saved_stack = kmalloc(ahd->stack_size * sizeof(uint16_t), GFP_ATOMIC);
+        ahd->saved_stack = kmalloc_array(ahd->stack_size, sizeof(uint16_t),
+                                         GFP_ATOMIC);
         if (ahd->saved_stack == NULL)
                 return (ENOMEM);
 
diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c
index e97eceacf522..915a34f141e4 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_core.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_core.c
@@ -4779,8 +4779,8 @@ ahc_init_scbdata(struct ahc_softc *ahc)
         SLIST_INIT(&scb_data->sg_maps);
 
         /* Allocate SCB resources */
-        scb_data->scbarray = kzalloc(sizeof(struct scb) * AHC_SCB_MAX_ALLOC,
-                                GFP_ATOMIC);
+        scb_data->scbarray = kcalloc(AHC_SCB_MAX_ALLOC, sizeof(struct scb),
+                                     GFP_ATOMIC);
         if (scb_data->scbarray == NULL)
                 return (ENOMEM);
 
diff --git a/drivers/scsi/aic94xx/aic94xx_hwi.c b/drivers/scsi/aic94xx/aic94xx_hwi.c
index 2dbc8330d7d3..3b8ad55e59de 100644
--- a/drivers/scsi/aic94xx/aic94xx_hwi.c
+++ b/drivers/scsi/aic94xx/aic94xx_hwi.c
@@ -220,8 +220,9 @@ static int asd_init_scbs(struct asd_ha_struct *asd_ha)
 
         /* allocate the index array and bitmap */
         asd_ha->seq.tc_index_bitmap_bits = asd_ha->hw_prof.max_scbs;
-        asd_ha->seq.tc_index_array = kzalloc(asd_ha->seq.tc_index_bitmap_bits*
-                                             sizeof(void *), GFP_KERNEL);
+        asd_ha->seq.tc_index_array = kcalloc(asd_ha->seq.tc_index_bitmap_bits,
+                                             sizeof(void *),
+                                             GFP_KERNEL);
         if (!asd_ha->seq.tc_index_array)
                 return -ENOMEM;
 
@@ -291,7 +292,8 @@ static int asd_alloc_edbs(struct asd_ha_struct *asd_ha, gfp_t gfp_flags)
         struct asd_seq_data *seq = &asd_ha->seq;
         int i;
 
-        seq->edb_arr = kmalloc(seq->num_edbs*sizeof(*seq->edb_arr), gfp_flags);
+        seq->edb_arr = kmalloc_array(seq->num_edbs, sizeof(*seq->edb_arr),
+                                     gfp_flags);
         if (!seq->edb_arr)
                 return -ENOMEM;
 
@@ -323,8 +325,8 @@ static int asd_alloc_escbs(struct asd_ha_struct *asd_ha,
         struct asd_ascb *escb;
         int i, escbs;
 
-        seq->escb_arr = kmalloc(seq->num_escbs*sizeof(*seq->escb_arr),
-                                gfp_flags);
+        seq->escb_arr = kmalloc_array(seq->num_escbs, sizeof(*seq->escb_arr),
+                                      gfp_flags);
         if (!seq->escb_arr)
                 return -ENOMEM;
 
diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index 6c838865ac5a..80e5b283fd81 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -350,7 +350,7 @@ static ssize_t asd_store_update_bios(struct device *dev,
         int flash_command = FLASH_CMD_NONE;
         int err = 0;
 
-        cmd_ptr = kzalloc(count*2, GFP_KERNEL);
+        cmd_ptr = kcalloc(count, 2, GFP_KERNEL);
 
         if (!cmd_ptr) {
                 err = FAIL_OUT_MEMORY;
diff --git a/drivers/scsi/arm/queue.c b/drivers/scsi/arm/queue.c
index 3441ce3ebabf..996dfe903928 100644
--- a/drivers/scsi/arm/queue.c
+++ b/drivers/scsi/arm/queue.c
@@ -70,7 +70,7 @@ int queue_initialise (Queue_t *queue)
          * need to keep free lists or allocate this
          * memory.
          */
-        queue->alloc = q = kmalloc(sizeof(QE_t) * nqueues, GFP_KERNEL);
+        queue->alloc = q = kmalloc_array(nqueues, sizeof(QE_t), GFP_KERNEL);
         if (q) {
                 for (; nqueues; q++, nqueues--) {
                         SET_MAGIC(q, QUEUE_MAGIC_FREE);
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index b3cfdd5f4d1c..818d185d63f0 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -2467,8 +2467,8 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
 
         /* Allocate memory for wrb_context */
         phwi_ctrlr = phba->phwi_ctrlr;
-        phwi_ctrlr->wrb_context = kzalloc(sizeof(struct hwi_wrb_context) *
-                                          phba->params.cxns_per_ctrl,
+        phwi_ctrlr->wrb_context = kcalloc(phba->params.cxns_per_ctrl,
+                                          sizeof(struct hwi_wrb_context),
                                           GFP_KERNEL);
         if (!phwi_ctrlr->wrb_context) {
                 kfree(phba->phwi_ctrlr);
@@ -2483,8 +2483,9 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
                 return -ENOMEM;
         }
 
-        mem_arr_orig = kmalloc(sizeof(*mem_arr_orig) * BEISCSI_MAX_FRAGS_INIT,
-                               GFP_KERNEL);
+        mem_arr_orig = kmalloc_array(BEISCSI_MAX_FRAGS_INIT,
+                                     sizeof(*mem_arr_orig),
+                                     GFP_KERNEL);
         if (!mem_arr_orig) {
                 kfree(phba->init_mem);
                 kfree(phwi_ctrlr->wrb_context);
@@ -2533,8 +2534,8 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
                 } while (alloc_size);
                 mem_descr->num_elements = j;
                 mem_descr->size_in_bytes = phba->mem_req[i];
-                mem_descr->mem_array = kmalloc(sizeof(*mem_arr) * j,
-                                               GFP_KERNEL);
+                mem_descr->mem_array = kmalloc_array(j, sizeof(*mem_arr),
+                                                     GFP_KERNEL);
                 if (!mem_descr->mem_array)
                         goto free_mem;
 
@@ -2620,8 +2621,8 @@ static int beiscsi_init_wrb_handle(struct beiscsi_hba *phba)
 
         /* Allocate memory for WRBQ */
         phwi_ctxt = phwi_ctrlr->phwi_ctxt;
-        phwi_ctxt->be_wrbq = kzalloc(sizeof(struct be_queue_info) *
-                                     phba->params.cxns_per_ctrl,
+        phwi_ctxt->be_wrbq = kcalloc(phba->params.cxns_per_ctrl,
+                                     sizeof(struct be_queue_info),
                                      GFP_KERNEL);
         if (!phwi_ctxt->be_wrbq) {
                 beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
@@ -2632,16 +2633,18 @@ static int beiscsi_init_wrb_handle(struct beiscsi_hba *phba)
         for (index = 0; index < phba->params.cxns_per_ctrl; index++) {
                 pwrb_context = &phwi_ctrlr->wrb_context[index];
                 pwrb_context->pwrb_handle_base =
-                                kzalloc(sizeof(struct wrb_handle *) *
-                                        phba->params.wrbs_per_cxn, GFP_KERNEL);
+                                kcalloc(phba->params.wrbs_per_cxn,
+                                        sizeof(struct wrb_handle *),
+                                        GFP_KERNEL);
                 if (!pwrb_context->pwrb_handle_base) {
                         beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
                                     "BM_%d : Mem Alloc Failed. Failing to load\n");
                         goto init_wrb_hndl_failed;
                 }
                 pwrb_context->pwrb_handle_basestd =
-                                kzalloc(sizeof(struct wrb_handle *) *
-                                        phba->params.wrbs_per_cxn, GFP_KERNEL);
+                                kcalloc(phba->params.wrbs_per_cxn,
+                                        sizeof(struct wrb_handle *),
+                                        GFP_KERNEL);
                 if (!pwrb_context->pwrb_handle_basestd) {
                         beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
                                     "BM_%d : Mem Alloc Failed. Failing to load\n");
@@ -3353,8 +3356,9 @@ beiscsi_create_wrb_rings(struct beiscsi_hba *phba,
         idx = 0;
         mem_descr = phba->init_mem;
         mem_descr += HWI_MEM_WRB;
-        pwrb_arr = kmalloc(sizeof(*pwrb_arr) * phba->params.cxns_per_ctrl,
-                           GFP_KERNEL);
+        pwrb_arr = kmalloc_array(phba->params.cxns_per_ctrl,
+                                 sizeof(*pwrb_arr),
+                                 GFP_KERNEL);
         if (!pwrb_arr) {
                 beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
                             "BM_%d : Memory alloc failed in create wrb ring.\n");
@@ -3894,18 +3898,18 @@ static int beiscsi_init_sgl_handle(struct beiscsi_hba *phba)
         mem_descr_sglh = phba->init_mem;
         mem_descr_sglh += HWI_MEM_SGLH;
         if (1 == mem_descr_sglh->num_elements) {
-                phba->io_sgl_hndl_base = kzalloc(sizeof(struct sgl_handle *) *
-                                                 phba->params.ios_per_ctrl,
+                phba->io_sgl_hndl_base = kcalloc(phba->params.ios_per_ctrl,
+                                                 sizeof(struct sgl_handle *),
                                                  GFP_KERNEL);
                 if (!phba->io_sgl_hndl_base) {
                         beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
                                     "BM_%d : Mem Alloc Failed. Failing to load\n");
                         return -ENOMEM;
                 }
-                phba->eh_sgl_hndl_base = kzalloc(sizeof(struct sgl_handle *) *
-                                                 (phba->params.icds_per_ctrl -
-                                                 phba->params.ios_per_ctrl),
-                                                 GFP_KERNEL);
+                phba->eh_sgl_hndl_base =
+                        kcalloc(phba->params.icds_per_ctrl -
+                                        phba->params.ios_per_ctrl,
+                                sizeof(struct sgl_handle *), GFP_KERNEL);
                 if (!phba->eh_sgl_hndl_base) {
                         kfree(phba->io_sgl_hndl_base);
                         beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
@@ -4032,8 +4036,9 @@ static int hba_setup_cid_tbls(struct beiscsi_hba *phba)
                         phba->cid_array_info[ulp_num] = ptr_cid_info;
                 }
         }
-        phba->ep_array = kzalloc(sizeof(struct iscsi_endpoint *) *
-                                 phba->params.cxns_per_ctrl, GFP_KERNEL);
+        phba->ep_array = kcalloc(phba->params.cxns_per_ctrl,
+                                 sizeof(struct iscsi_endpoint *),
+                                 GFP_KERNEL);
         if (!phba->ep_array) {
                 beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
                             "BM_%d : Failed to allocate memory in "
@@ -4043,8 +4048,9 @@ static int hba_setup_cid_tbls(struct beiscsi_hba *phba)
                 goto free_memory;
         }
 
-        phba->conn_table = kzalloc(sizeof(struct beiscsi_conn *) *
-                                   phba->params.cxns_per_ctrl, GFP_KERNEL);
+        phba->conn_table = kcalloc(phba->params.cxns_per_ctrl,
+                                   sizeof(struct beiscsi_conn *),
+                                   GFP_KERNEL);
         if (!phba->conn_table) {
                 beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_INIT,
                             "BM_%d : Failed to allocate memory in"
diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c
index d4d276c757ea..26b0fa4e90b5 100644
--- a/drivers/scsi/bfa/bfad_attr.c
+++ b/drivers/scsi/bfa/bfad_attr.c
@@ -927,7 +927,7 @@ bfad_im_num_of_discovered_ports_show(struct device *dev,
         struct bfa_rport_qualifier_s *rports = NULL;
         unsigned long   flags;
 
-        rports = kzalloc(sizeof(struct bfa_rport_qualifier_s) * nrports,
+        rports = kcalloc(nrports, sizeof(struct bfa_rport_qualifier_s),
                          GFP_ATOMIC);
         if (rports == NULL)
                 return snprintf(buf, PAGE_SIZE, "Failed\n");
diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
index 7c884f881180..5d163ca1b366 100644
--- a/drivers/scsi/bfa/bfad_bsg.c
+++ b/drivers/scsi/bfa/bfad_bsg.c
@@ -3252,8 +3252,9 @@ bfad_fcxp_map_sg(struct bfad_s *bfad, void *payload_kbuf,
         struct bfa_sge_s        *sg_table;
         int sge_num = 1;
 
-        buf_base = kzalloc((sizeof(struct bfad_buf_info) +
-                           sizeof(struct bfa_sge_s)) * sge_num, GFP_KERNEL);
+        buf_base = kcalloc(sizeof(struct bfad_buf_info) +
+                                sizeof(struct bfa_sge_s),
+                           sge_num, GFP_KERNEL);
         if (!buf_base)
                 return NULL;
 
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 65de1d0578a1..f00045813378 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -1397,7 +1397,7 @@ static struct bnx2fc_hba *bnx2fc_hba_create(struct cnic_dev *cnic)
         hba->next_conn_id = 0;
 
         hba->tgt_ofld_list =
-                kzalloc(sizeof(struct bnx2fc_rport *) * BNX2FC_NUM_MAX_SESS,
+                kcalloc(BNX2FC_NUM_MAX_SESS, sizeof(struct bnx2fc_rport *),
                         GFP_KERNEL);
         if (!hba->tgt_ofld_list) {
                 printk(KERN_ERR PFX "Unable to allocate tgt offload list\n");
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 5a645b8b9af1..350257c13a5b 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -240,15 +240,15 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
                 return NULL;
         }
 
-        cmgr->free_list = kzalloc(sizeof(*cmgr->free_list) *
-                                  arr_sz, GFP_KERNEL);
+        cmgr->free_list = kcalloc(arr_sz, sizeof(*cmgr->free_list),
+                                  GFP_KERNEL);
         if (!cmgr->free_list) {
                 printk(KERN_ERR PFX "failed to alloc free_list\n");
                 goto mem_err;
         }
 
-        cmgr->free_list_lock = kzalloc(sizeof(*cmgr->free_list_lock) *
-                                       arr_sz, GFP_KERNEL);
+        cmgr->free_list_lock = kcalloc(arr_sz, sizeof(*cmgr->free_list_lock),
+                                       GFP_KERNEL);
         if (!cmgr->free_list_lock) {
                 printk(KERN_ERR PFX "failed to alloc free_list_lock\n");
                 kfree(cmgr->free_list);
diff --git a/drivers/scsi/csiostor/csio_wr.c b/drivers/scsi/csiostor/csio_wr.c
index c0a17789752f..faa357b62c61 100644
--- a/drivers/scsi/csiostor/csio_wr.c
+++ b/drivers/scsi/csiostor/csio_wr.c
@@ -276,7 +276,7 @@ csio_wr_alloc_q(struct csio_hw *hw, uint32_t qsize, uint32_t wrsize,
                         q->un.iq.flq_idx = flq_idx;
 
                         flq = wrm->q_arr[q->un.iq.flq_idx];
-                        flq->un.fl.bufs = kzalloc(flq->credits *
+                        flq->un.fl.bufs = kcalloc(flq->credits,
                                                   sizeof(struct csio_dma_buf),
                                                   GFP_KERNEL);
                         if (!flq->un.fl.bufs) {
@@ -1579,7 +1579,7 @@ csio_wrm_init(struct csio_wrm *wrm, struct csio_hw *hw)
                 return -EINVAL;
         }
 
-        wrm->q_arr = kzalloc(sizeof(struct csio_q *) * wrm->num_q, GFP_KERNEL);
+        wrm->q_arr = kcalloc(wrm->num_q, sizeof(struct csio_q *), GFP_KERNEL);
         if (!wrm->q_arr)
                 goto err;
 
diff --git a/drivers/scsi/esas2r/esas2r_init.c b/drivers/scsi/esas2r/esas2r_init.c
index 9db645dde35e..bbe77db8938d 100644
--- a/drivers/scsi/esas2r/esas2r_init.c
+++ b/drivers/scsi/esas2r/esas2r_init.c
@@ -833,7 +833,7 @@ bool esas2r_init_adapter_struct(struct esas2r_adapter *a,
 
         /* allocate requests for asynchronous events */
         a->first_ae_req =
-                kzalloc(num_ae_requests * sizeof(struct esas2r_request),
+                kcalloc(num_ae_requests, sizeof(struct esas2r_request),
                         GFP_KERNEL);
 
         if (a->first_ae_req == NULL) {
@@ -843,8 +843,8 @@ bool esas2r_init_adapter_struct(struct esas2r_adapter *a,
         }
 
         /* allocate the S/G list memory descriptors */
-        a->sg_list_mds = kzalloc(
-                num_sg_lists * sizeof(struct esas2r_mem_desc), GFP_KERNEL);
+        a->sg_list_mds = kcalloc(num_sg_lists, sizeof(struct esas2r_mem_desc),
+                                 GFP_KERNEL);
 
         if (a->sg_list_mds == NULL) {
                 esas2r_log(ESAS2R_LOG_CRIT,
@@ -854,8 +854,9 @@ bool esas2r_init_adapter_struct(struct esas2r_adapter *a,
 
         /* allocate the request table */
         a->req_table =
-                kzalloc((num_requests + num_ae_requests +
-                         1) * sizeof(struct esas2r_request *), GFP_KERNEL);
+                kcalloc(num_requests + num_ae_requests + 1,
+                        sizeof(struct esas2r_request *),
+                        GFP_KERNEL);
 
         if (a->req_table == NULL) {
                 esas2r_log(ESAS2R_LOG_CRIT,
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 097f37de6ce9..ea23c8dffc25 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -1390,8 +1390,8 @@ static void fcoe_ctlr_recv_clr_vlink(struct fcoe_ctlr *fip,
          */
         num_vlink_desc = rlen / sizeof(*vp);
         if (num_vlink_desc)
-                vlink_desc_arr = kmalloc(sizeof(vp) * num_vlink_desc,
-                                         GFP_ATOMIC);
+                vlink_desc_arr = kmalloc_array(num_vlink_desc, sizeof(vp),
+                                               GFP_ATOMIC);
         if (!vlink_desc_arr)
                 return;
         num_vlink_desc = 0;
diff --git a/drivers/scsi/fnic/fnic_debugfs.c b/drivers/scsi/fnic/fnic_debugfs.c
index 6d3e1cb4fea6..139fffa3658a 100644
--- a/drivers/scsi/fnic/fnic_debugfs.c
+++ b/drivers/scsi/fnic/fnic_debugfs.c
@@ -233,8 +233,8 @@ static int fnic_trace_debugfs_open(struct inode *inode,
                 return -ENOMEM;
 
         if (*rdata_ptr == fc_trc_flag->fnic_trace) {
-                fnic_dbg_prt->buffer = vmalloc(3 *
-                                        (trace_max_pages * PAGE_SIZE));
+                fnic_dbg_prt->buffer = vmalloc(array3_size(3, trace_max_pages,
+                                                           PAGE_SIZE));
                 if (!fnic_dbg_prt->buffer) {
                         kfree(fnic_dbg_prt);
                         return -ENOMEM;
@@ -244,7 +244,8 @@ static int fnic_trace_debugfs_open(struct inode *inode,
                 fnic_dbg_prt->buffer_len = fnic_get_trace_data(fnic_dbg_prt);
         } else {
                 fnic_dbg_prt->buffer =
-                        vmalloc(3 * (fnic_fc_trace_max_pages * PAGE_SIZE));
+                        vmalloc(array3_size(3, fnic_fc_trace_max_pages,
+                                            PAGE_SIZE));
                 if (!fnic_dbg_prt->buffer) {
                         kfree(fnic_dbg_prt);
                         return -ENOMEM;
diff --git a/drivers/scsi/fnic/fnic_trace.c b/drivers/scsi/fnic/fnic_trace.c
index 98597b59c12a..8271785bdb93 100644
--- a/drivers/scsi/fnic/fnic_trace.c
+++ b/drivers/scsi/fnic/fnic_trace.c
@@ -477,8 +477,9 @@ int fnic_trace_buf_init(void)
         }
         memset((void *)fnic_trace_buf_p, 0, (trace_max_pages * PAGE_SIZE));
 
-        fnic_trace_entries.page_offset = vmalloc(fnic_max_trace_entries *
-                                                  sizeof(unsigned long));
+        fnic_trace_entries.page_offset =
+                vmalloc(array_size(fnic_max_trace_entries,
+                                   sizeof(unsigned long)));
         if (!fnic_trace_entries.page_offset) {
                 printk(KERN_ERR PFX "Failed to allocate memory for"
                                   " page_offset\n");
@@ -555,8 +556,9 @@ int fnic_fc_trace_init(void)
 
         fc_trace_max_entries = (fnic_fc_trace_max_pages * PAGE_SIZE)/
                                 FC_TRC_SIZE_BYTES;
-        fnic_fc_ctlr_trace_buf_p = (unsigned long)vmalloc(
-                                        fnic_fc_trace_max_pages * PAGE_SIZE);
+        fnic_fc_ctlr_trace_buf_p =
+                (unsigned long)vmalloc(array_size(PAGE_SIZE,
+                                                  fnic_fc_trace_max_pages));
         if (!fnic_fc_ctlr_trace_buf_p) {
                 pr_err("fnic: Failed to allocate memory for "
                        "FC Control Trace Buf\n");
@@ -568,8 +570,9 @@ int fnic_fc_trace_init(void)
                         fnic_fc_trace_max_pages * PAGE_SIZE);
 
         /* Allocate memory for page offset */
-        fc_trace_entries.page_offset = vmalloc(fc_trace_max_entries *
-                                                sizeof(unsigned long));
+        fc_trace_entries.page_offset =
+                vmalloc(array_size(fc_trace_max_entries,
+                                   sizeof(unsigned long)));
         if (!fc_trace_entries.page_offset) {
                 pr_err("fnic:Failed to allocate memory for page_offset\n");
                 if (fnic_fc_ctlr_trace_buf_p) {
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 3a9eca163db8..af0e628ff396 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -1923,8 +1923,8 @@ static void adjust_hpsa_scsi_table(struct ctlr_info *h,
         }
         spin_unlock_irqrestore(&h->reset_lock, flags);
 
-        added = kzalloc(sizeof(*added) * HPSA_MAX_DEVICES, GFP_KERNEL);
-        removed = kzalloc(sizeof(*removed) * HPSA_MAX_DEVICES, GFP_KERNEL);
+        added = kcalloc(HPSA_MAX_DEVICES, sizeof(*added), GFP_KERNEL);
+        removed = kcalloc(HPSA_MAX_DEVICES, sizeof(*removed), GFP_KERNEL);
 
         if (!added || !removed) {
                 dev_warn(&h->pdev->dev, "out of memory in "
@@ -2171,14 +2171,15 @@ static int hpsa_allocate_ioaccel2_sg_chain_blocks(struct ctlr_info *h)
                 return 0;
 
         h->ioaccel2_cmd_sg_list =
-                kzalloc(sizeof(*h->ioaccel2_cmd_sg_list) * h->nr_cmds,
+                kcalloc(h->nr_cmds, sizeof(*h->ioaccel2_cmd_sg_list),
                                         GFP_KERNEL);
         if (!h->ioaccel2_cmd_sg_list)
                 return -ENOMEM;
         for (i = 0; i < h->nr_cmds; i++) {
                 h->ioaccel2_cmd_sg_list[i] =
-                        kmalloc(sizeof(*h->ioaccel2_cmd_sg_list[i]) *
-                                        h->maxsgentries, GFP_KERNEL);
+                        kmalloc_array(h->maxsgentries,
+                                      sizeof(*h->ioaccel2_cmd_sg_list[i]),
+                                      GFP_KERNEL);
                 if (!h->ioaccel2_cmd_sg_list[i])
                         goto clean;
         }
@@ -2210,14 +2211,15 @@ static int hpsa_alloc_sg_chain_blocks(struct ctlr_info *h)
         if (h->chainsize <= 0)
                 return 0;
 
-        h->cmd_sg_list = kzalloc(sizeof(*h->cmd_sg_list) * h->nr_cmds,
-                                GFP_KERNEL);
+        h->cmd_sg_list = kcalloc(h->nr_cmds, sizeof(*h->cmd_sg_list),
+                                 GFP_KERNEL);
         if (!h->cmd_sg_list)
                 return -ENOMEM;
 
         for (i = 0; i < h->nr_cmds; i++) {
-                h->cmd_sg_list[i] = kmalloc(sizeof(*h->cmd_sg_list[i]) *
-                                                h->chainsize, GFP_KERNEL);
+                h->cmd_sg_list[i] = kmalloc_array(h->chainsize,
+                                                  sizeof(*h->cmd_sg_list[i]),
+                                                  GFP_KERNEL);
                 if (!h->cmd_sg_list[i])
                         goto clean;
 
@@ -4319,7 +4321,7 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h)
         bool physical_device;
         DECLARE_BITMAP(lunzerobits, MAX_EXT_TARGETS);
 
-        currentsd = kzalloc(sizeof(*currentsd) * HPSA_MAX_DEVICES, GFP_KERNEL);
+        currentsd = kcalloc(HPSA_MAX_DEVICES, sizeof(*currentsd), GFP_KERNEL);
         physdev_list = kzalloc(sizeof(*physdev_list), GFP_KERNEL);
         logdev_list = kzalloc(sizeof(*logdev_list), GFP_KERNEL);
         tmpdevice = kzalloc(sizeof(*tmpdevice), GFP_KERNEL);
@@ -6402,12 +6404,12 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp)
                 status = -EINVAL;
                 goto cleanup1;
         }
-        buff = kzalloc(SG_ENTRIES_IN_CMD * sizeof(char *), GFP_KERNEL);
+        buff = kcalloc(SG_ENTRIES_IN_CMD, sizeof(char *), GFP_KERNEL);
         if (!buff) {
                 status = -ENOMEM;
                 goto cleanup1;
         }
-        buff_size = kmalloc(SG_ENTRIES_IN_CMD * sizeof(int), GFP_KERNEL);
+        buff_size = kmalloc_array(SG_ENTRIES_IN_CMD, sizeof(int), GFP_KERNEL);
         if (!buff_size) {
                 status = -ENOMEM;
                 goto cleanup1;
@@ -7151,7 +7153,7 @@ static int controller_reset_failed(struct CfgTable __iomem *cfgtable)
         char *driver_ver, *old_driver_ver;
         int rc, size = sizeof(cfgtable->driver_version);
 
-        old_driver_ver = kmalloc(2 * size, GFP_KERNEL);
+        old_driver_ver = kmalloc_array(2, size, GFP_KERNEL);
         if (!old_driver_ver)
                 return -ENOMEM;
         driver_ver = old_driver_ver + size;
@@ -7931,9 +7933,9 @@ static void hpsa_free_cmd_pool(struct ctlr_info *h)
 
 static int hpsa_alloc_cmd_pool(struct ctlr_info *h)
 {
-        h->cmd_pool_bits = kzalloc(
-                DIV_ROUND_UP(h->nr_cmds, BITS_PER_LONG) *
-                sizeof(unsigned long), GFP_KERNEL);
+        h->cmd_pool_bits = kcalloc(DIV_ROUND_UP(h->nr_cmds, BITS_PER_LONG),
+                                   sizeof(unsigned long),
+                                   GFP_KERNEL);
         h->cmd_pool = pci_alloc_consistent(h->pdev,
                     h->nr_cmds * sizeof(*h->cmd_pool),
                     &(h->cmd_pool_dhandle));
@@ -8507,7 +8509,7 @@ static struct ctlr_info *hpda_alloc_ctlr_info(void)
         if (!h)
                 return NULL;
 
-        h->reply_map = kzalloc(sizeof(*h->reply_map) * nr_cpu_ids, GFP_KERNEL);
+        h->reply_map = kcalloc(nr_cpu_ids, sizeof(*h->reply_map), GFP_KERNEL);
         if (!h->reply_map) {
                 kfree(h);
                 return NULL;
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 6615ad8754b8..0a9b8b387bd2 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4331,9 +4331,11 @@ static int ipr_alloc_dump(struct ipr_ioa_cfg *ioa_cfg)
         }
 
         if (ioa_cfg->sis64)
-                ioa_data = vmalloc(IPR_FMT3_MAX_NUM_DUMP_PAGES * sizeof(__be32 *));
+                ioa_data = vmalloc(array_size(IPR_FMT3_MAX_NUM_DUMP_PAGES,
+                                              sizeof(__be32 *)));
         else
-                ioa_data = vmalloc(IPR_FMT2_MAX_NUM_DUMP_PAGES * sizeof(__be32 *));
+                ioa_data = vmalloc(array_size(IPR_FMT2_MAX_NUM_DUMP_PAGES,
+                                              sizeof(__be32 *)));
 
         if (!ioa_data) {
                 ipr_err("Dump memory allocation failed\n");
@@ -9713,8 +9715,9 @@ static int ipr_alloc_mem(struct ipr_ioa_cfg *ioa_cfg)
         int i, rc = -ENOMEM;
 
         ENTER;
-        ioa_cfg->res_entries = kzalloc(sizeof(struct ipr_resource_entry) *
-                                       ioa_cfg->max_devs_supported, GFP_KERNEL);
+        ioa_cfg->res_entries = kcalloc(ioa_cfg->max_devs_supported,
+                                       sizeof(struct ipr_resource_entry),
+                                       GFP_KERNEL);
 
         if (!ioa_cfg->res_entries)
                 goto out;
@@ -9775,8 +9778,9 @@ static int ipr_alloc_mem(struct ipr_ioa_cfg *ioa_cfg)
                 list_add_tail(&ioa_cfg->hostrcb[i]->queue, &ioa_cfg->hostrcb_free_q);
         }
 
-        ioa_cfg->trace = kzalloc(sizeof(struct ipr_trace_entry) *
-                                 IPR_NUM_TRACE_ENTRIES, GFP_KERNEL);
+        ioa_cfg->trace = kcalloc(IPR_NUM_TRACE_ENTRIES,
+                                 sizeof(struct ipr_trace_entry),
+                                 GFP_KERNEL);
 
         if (!ioa_cfg->trace)
                 goto out_free_hostrcb_dma;
diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
index 05cf4daf8788..08c7b1e25fe4 100644
--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
@@ -232,14 +232,14 @@ static int isci_register_sas_ha(struct isci_host *isci_host)
         struct asd_sas_phy **sas_phys;
         struct asd_sas_port **sas_ports;
 
-        sas_phys = devm_kzalloc(&isci_host->pdev->dev,
-                                SCI_MAX_PHYS * sizeof(void *),
+        sas_phys = devm_kcalloc(&isci_host->pdev->dev,
+                                SCI_MAX_PHYS, sizeof(void *),
                                 GFP_KERNEL);
         if (!sas_phys)
                 return -ENOMEM;
 
-        sas_ports = devm_kzalloc(&isci_host->pdev->dev,
-                                 SCI_MAX_PORTS * sizeof(void *),
+        sas_ports = devm_kcalloc(&isci_host->pdev->dev,
+                                 SCI_MAX_PORTS, sizeof(void *),
                                  GFP_KERNEL);
         if (!sas_ports)
                 return -ENOMEM;
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 71bdc0b52cf9..d6093838f5f2 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -2576,7 +2576,7 @@ iscsi_pool_init(struct iscsi_pool *q, int max, void ***items, int item_size)
          * the array. */
         if (items)
                 num_arrays++;
-        q->pool = kvzalloc(num_arrays * max * sizeof(void*), GFP_KERNEL);
+        q->pool = kvcalloc(num_arrays * max, sizeof(void *), GFP_KERNEL);
         if (q->pool == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 8b7114348def..fadc99cb60df 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -443,7 +443,7 @@ static int sas_expander_discover(struct domain_device *dev)
         struct expander_device *ex = &dev->ex_dev;
         int res = -ENOMEM;
 
-        ex->ex_phy = kzalloc(sizeof(*ex->ex_phy)*ex->num_phys, GFP_KERNEL);
+        ex->ex_phy = kcalloc(ex->num_phys, sizeof(*ex->ex_phy), GFP_KERNEL);
         if (!ex->ex_phy)
                 return -ENOMEM;
 
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 7ae343b14630..52cae87da0d2 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -5723,8 +5723,9 @@ lpfc_sli_driver_resource_setup(struct lpfc_hba *phba)
         }
 
         if (!phba->sli.sli3_ring)
-                phba->sli.sli3_ring = kzalloc(LPFC_SLI3_MAX_RING *
-                        sizeof(struct lpfc_sli_ring), GFP_KERNEL);
+                phba->sli.sli3_ring = kcalloc(LPFC_SLI3_MAX_RING,
+                                              sizeof(struct lpfc_sli_ring),
+                                              GFP_KERNEL);
         if (!phba->sli.sli3_ring)
                 return -ENOMEM;
 
@@ -6233,7 +6234,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
 
         /* Allocate eligible FCF bmask memory for FCF roundrobin failover */
         longs = (LPFC_SLI4_FCF_TBL_INDX_MAX + BITS_PER_LONG - 1)/BITS_PER_LONG;
-        phba->fcf.fcf_rr_bmask = kzalloc(longs * sizeof(unsigned long),
+        phba->fcf.fcf_rr_bmask = kcalloc(longs, sizeof(unsigned long),
                                          GFP_KERNEL);
         if (!phba->fcf.fcf_rr_bmask) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 41361662ff08..0758edb9dfe2 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -120,8 +120,9 @@ lpfc_mem_alloc(struct lpfc_hba *phba, int align)
         if (!phba->lpfc_mbuf_pool)
                 goto fail_free_dma_buf_pool;
 
-        pool->elements = kmalloc(sizeof(struct lpfc_dmabuf) *
-                                         LPFC_MBUF_POOL_SIZE, GFP_KERNEL);
+        pool->elements = kmalloc_array(LPFC_MBUF_POOL_SIZE,
+                                       sizeof(struct lpfc_dmabuf),
+                                       GFP_KERNEL);
         if (!pool->elements)
                 goto fail_free_lpfc_mbuf_pool;
 
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 4b70d53acb72..6f3c00a233ec 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -1720,7 +1720,7 @@ lpfc_sli_next_iotag(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq)
                                            - LPFC_IOCBQ_LOOKUP_INCREMENT)) {
                 new_len = psli->iocbq_lookup_len + LPFC_IOCBQ_LOOKUP_INCREMENT;
                 spin_unlock_irq(&phba->hbalock);
-                new_arr = kzalloc(new_len * sizeof (struct lpfc_iocbq *),
+                new_arr = kcalloc(new_len, sizeof(struct lpfc_iocbq *),
                                   GFP_KERNEL);
                 if (new_arr) {
                         spin_lock_irq(&phba->hbalock);
@@ -5142,16 +5142,17 @@ lpfc_sli_hba_setup(struct lpfc_hba *phba)
                  */
                 if ((phba->vpi_bmask == NULL) && (phba->vpi_ids == NULL)) {
                         longs = (phba->max_vpi + BITS_PER_LONG) / BITS_PER_LONG;
-                        phba->vpi_bmask = kzalloc(longs * sizeof(unsigned long),
+                        phba->vpi_bmask = kcalloc(longs,
+                                                  sizeof(unsigned long),
                                                   GFP_KERNEL);
                         if (!phba->vpi_bmask) {
                                 rc = -ENOMEM;
                                 goto lpfc_sli_hba_setup_error;
                         }
 
-                        phba->vpi_ids = kzalloc(
-                                        (phba->max_vpi+1) * sizeof(uint16_t),
-                                        GFP_KERNEL);
+                        phba->vpi_ids = kcalloc(phba->max_vpi + 1,
+                                                sizeof(uint16_t),
+                                                GFP_KERNEL);
                         if (!phba->vpi_ids) {
                                 kfree(phba->vpi_bmask);
                                 rc = -ENOMEM;
@@ -5836,14 +5837,14 @@ lpfc_sli4_alloc_extent(struct lpfc_hba *phba, uint16_t type)
         length = sizeof(struct lpfc_rsrc_blks);
         switch (type) {
         case LPFC_RSC_TYPE_FCOE_RPI:
-                phba->sli4_hba.rpi_bmask = kzalloc(longs *
+                phba->sli4_hba.rpi_bmask = kcalloc(longs,
                                                    sizeof(unsigned long),
                                                    GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.rpi_bmask)) {
                         rc = -ENOMEM;
                         goto err_exit;
                 }
-                phba->sli4_hba.rpi_ids = kzalloc(rsrc_id_cnt *
+                phba->sli4_hba.rpi_ids = kcalloc(rsrc_id_cnt,
                                                  sizeof(uint16_t),
                                                  GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.rpi_ids)) {
@@ -5865,15 +5866,13 @@ lpfc_sli4_alloc_extent(struct lpfc_hba *phba, uint16_t type)
                 ext_blk_list = &phba->sli4_hba.lpfc_rpi_blk_list;
                 break;
         case LPFC_RSC_TYPE_FCOE_VPI:
-                phba->vpi_bmask = kzalloc(longs *
-                                          sizeof(unsigned long),
+                phba->vpi_bmask = kcalloc(longs, sizeof(unsigned long),
                                           GFP_KERNEL);
                 if (unlikely(!phba->vpi_bmask)) {
                         rc = -ENOMEM;
                         goto err_exit;
                 }
-                phba->vpi_ids = kzalloc(rsrc_id_cnt *
-                                         sizeof(uint16_t),
+                phba->vpi_ids = kcalloc(rsrc_id_cnt, sizeof(uint16_t),
                                          GFP_KERNEL);
                 if (unlikely(!phba->vpi_ids)) {
                         kfree(phba->vpi_bmask);
@@ -5887,7 +5886,7 @@ lpfc_sli4_alloc_extent(struct lpfc_hba *phba, uint16_t type)
                 ext_blk_list = &phba->lpfc_vpi_blk_list;
                 break;
         case LPFC_RSC_TYPE_FCOE_XRI:
-                phba->sli4_hba.xri_bmask = kzalloc(longs *
+                phba->sli4_hba.xri_bmask = kcalloc(longs,
                                                    sizeof(unsigned long),
                                                    GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.xri_bmask)) {
@@ -5895,7 +5894,7 @@ lpfc_sli4_alloc_extent(struct lpfc_hba *phba, uint16_t type)
                         goto err_exit;
                 }
                 phba->sli4_hba.max_cfg_param.xri_used = 0;
-                phba->sli4_hba.xri_ids = kzalloc(rsrc_id_cnt *
+                phba->sli4_hba.xri_ids = kcalloc(rsrc_id_cnt,
                                                  sizeof(uint16_t),
                                                  GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.xri_ids)) {
@@ -5910,14 +5909,14 @@ lpfc_sli4_alloc_extent(struct lpfc_hba *phba, uint16_t type)
                 ext_blk_list = &phba->sli4_hba.lpfc_xri_blk_list;
                 break;
         case LPFC_RSC_TYPE_FCOE_VFI:
-                phba->sli4_hba.vfi_bmask = kzalloc(longs *
+                phba->sli4_hba.vfi_bmask = kcalloc(longs,
                                                    sizeof(unsigned long),
                                                    GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.vfi_bmask)) {
                         rc = -ENOMEM;
                         goto err_exit;
                 }
-                phba->sli4_hba.vfi_ids = kzalloc(rsrc_id_cnt *
+                phba->sli4_hba.vfi_ids = kcalloc(rsrc_id_cnt,
                                                  sizeof(uint16_t),
                                                  GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.vfi_ids)) {
@@ -6250,15 +6249,14 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba)
                 }
                 base = phba->sli4_hba.max_cfg_param.rpi_base;
                 longs = (count + BITS_PER_LONG - 1) / BITS_PER_LONG;
-                phba->sli4_hba.rpi_bmask = kzalloc(longs *
+                phba->sli4_hba.rpi_bmask = kcalloc(longs,
                                                    sizeof(unsigned long),
                                                    GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.rpi_bmask)) {
                         rc = -ENOMEM;
                         goto err_exit;
                 }
-                phba->sli4_hba.rpi_ids = kzalloc(count *
-                                                 sizeof(uint16_t),
+                phba->sli4_hba.rpi_ids = kcalloc(count, sizeof(uint16_t),
                                                  GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.rpi_ids)) {
                         rc = -ENOMEM;
@@ -6279,15 +6277,13 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba)
                 }
                 base = phba->sli4_hba.max_cfg_param.vpi_base;
                 longs = (count + BITS_PER_LONG - 1) / BITS_PER_LONG;
-                phba->vpi_bmask = kzalloc(longs *
-                                          sizeof(unsigned long),
+                phba->vpi_bmask = kcalloc(longs, sizeof(unsigned long),
                                           GFP_KERNEL);
                 if (unlikely(!phba->vpi_bmask)) {
                         rc = -ENOMEM;
                         goto free_rpi_ids;
                 }
-                phba->vpi_ids = kzalloc(count *
-                                        sizeof(uint16_t),
+                phba->vpi_ids = kcalloc(count, sizeof(uint16_t),
                                         GFP_KERNEL);
                 if (unlikely(!phba->vpi_ids)) {
                         rc = -ENOMEM;
@@ -6308,7 +6304,7 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba)
                 }
                 base = phba->sli4_hba.max_cfg_param.xri_base;
                 longs = (count + BITS_PER_LONG - 1) / BITS_PER_LONG;
-                phba->sli4_hba.xri_bmask = kzalloc(longs *
+                phba->sli4_hba.xri_bmask = kcalloc(longs,
                                                    sizeof(unsigned long),
                                                    GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.xri_bmask)) {
@@ -6316,8 +6312,7 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba)
                         goto free_vpi_ids;
                 }
                 phba->sli4_hba.max_cfg_param.xri_used = 0;
-                phba->sli4_hba.xri_ids = kzalloc(count *
-                                                 sizeof(uint16_t),
+                phba->sli4_hba.xri_ids = kcalloc(count, sizeof(uint16_t),
                                                  GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.xri_ids)) {
                         rc = -ENOMEM;
@@ -6338,15 +6333,14 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba)
                 }
                 base = phba->sli4_hba.max_cfg_param.vfi_base;
                 longs = (count + BITS_PER_LONG - 1) / BITS_PER_LONG;
-                phba->sli4_hba.vfi_bmask = kzalloc(longs *
+                phba->sli4_hba.vfi_bmask = kcalloc(longs,
                                                    sizeof(unsigned long),
                                                    GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.vfi_bmask)) {
                         rc = -ENOMEM;
                         goto free_xri_ids;
                 }
-                phba->sli4_hba.vfi_ids = kzalloc(count *
-                                                 sizeof(uint16_t),
+                phba->sli4_hba.vfi_ids = kcalloc(count, sizeof(uint16_t),
                                                  GFP_KERNEL);
                 if (unlikely(!phba->sli4_hba.vfi_ids)) {
                         rc = -ENOMEM;
diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c
index c9d33b1268cb..81bc12dedf41 100644
--- a/drivers/scsi/lpfc/lpfc_vport.c
+++ b/drivers/scsi/lpfc/lpfc_vport.c
@@ -840,7 +840,7 @@ lpfc_create_vport_work_array(struct lpfc_hba *phba)
         struct lpfc_vport *port_iterator;
         struct lpfc_vport **vports;
         int index = 0;
-        vports = kzalloc((phba->max_vports + 1) * sizeof(struct lpfc_vport *),
+        vports = kcalloc(phba->max_vports + 1, sizeof(struct lpfc_vport *),
                          GFP_KERNEL);
         if (vports == NULL)
                 return NULL;
diff --git a/drivers/scsi/mac53c94.c b/drivers/scsi/mac53c94.c
index 8c4d3003b68b..177701dfdfcb 100644
--- a/drivers/scsi/mac53c94.c
+++ b/drivers/scsi/mac53c94.c
@@ -464,8 +464,9 @@ static int mac53c94_probe(struct macio_dev *mdev, const struct of_device_id *mat
          * +1 to allow for aligning.
          * XXX FIXME: Use DMA consistent routines
          */
-        dma_cmd_space = kmalloc((host->sg_tablesize + 2) *
-                                sizeof(struct dbdma_cmd), GFP_KERNEL);
+        dma_cmd_space = kmalloc_array(host->sg_tablesize + 2,
+                                             sizeof(struct dbdma_cmd),
+                                             GFP_KERNEL);
         if (dma_cmd_space == 0) {
                 printk(KERN_ERR "mac53c94: couldn't allocate dma "
                        "command space for %pOF\n", node);
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index 3b3767e240d8..8e8cf1145d7f 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -4292,7 +4292,8 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 goto out_host_put;
         }
 
-        adapter->scb_list = kmalloc(sizeof(scb_t) * MAX_COMMANDS, GFP_KERNEL);
+        adapter->scb_list = kmalloc_array(MAX_COMMANDS, sizeof(scb_t),
+                                          GFP_KERNEL);
         if (!adapter->scb_list) {
                 dev_warn(&pdev->dev, "out of RAM\n");
                 goto out_free_cmd_buffer;
diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c
index bb802b0c12b8..8428247015db 100644
--- a/drivers/scsi/megaraid/megaraid_mm.c
+++ b/drivers/scsi/megaraid/megaraid_mm.c
@@ -935,10 +935,12 @@ mraid_mm_register_adp(mraid_mmadp_t *lld_adp)
          * Allocate single blocks of memory for all required kiocs,
          * mailboxes and passthru structures.
          */
-        adapter->kioc_list      = kmalloc(sizeof(uioc_t) * lld_adp->max_kioc,
-                                                GFP_KERNEL);
-        adapter->mbox_list      = kmalloc(sizeof(mbox64_t) * lld_adp->max_kioc,
-                                                GFP_KERNEL);
+        adapter->kioc_list      = kmalloc_array(lld_adp->max_kioc,
+                                                  sizeof(uioc_t),
+                                                  GFP_KERNEL);
+        adapter->mbox_list      = kmalloc_array(lld_adp->max_kioc,
+                                                  sizeof(mbox64_t),
+                                                  GFP_KERNEL);
         adapter->pthru_dma_pool = dma_pool_create("megaraid mm pthru pool",
                                                 &adapter->pdev->dev,
                                                 sizeof(mraid_passthru_t),
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index c5d0c4bd71d2..71d97573a667 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -5419,9 +5419,9 @@ static int megasas_init_fw(struct megasas_instance *instance)
         /* stream detection initialization */
         if (instance->adapter_type == VENTURA_SERIES) {
                 fusion->stream_detect_by_ld =
-                        kzalloc(sizeof(struct LD_STREAM_DETECT *)
-                        * MAX_LOGICAL_DRIVES_EXT,
-                        GFP_KERNEL);
+                        kcalloc(MAX_LOGICAL_DRIVES_EXT,
+                                sizeof(struct LD_STREAM_DETECT *),
+                                GFP_KERNEL);
                 if (!fusion->stream_detect_by_ld) {
                         dev_err(&instance->pdev->dev,
                                 "unable to allocate stream detection for pool of LDs\n");
@@ -6139,7 +6139,7 @@ static inline int megasas_alloc_mfi_ctrl_mem(struct megasas_instance *instance)
  */
 static int megasas_alloc_ctrl_mem(struct megasas_instance *instance)
 {
-        instance->reply_map = kzalloc(sizeof(unsigned int) * nr_cpu_ids,
+        instance->reply_map = kcalloc(nr_cpu_ids, sizeof(unsigned int),
                                       GFP_KERNEL);
         if (!instance->reply_map)
                 return -ENOMEM;
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index 98a7a090b75e..94c23ad51179 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -487,7 +487,7 @@ megasas_alloc_cmdlist_fusion(struct megasas_instance *instance)
          * commands.
          */
         fusion->cmd_list =
-                kzalloc(sizeof(struct megasas_cmd_fusion *) * max_mpt_cmd,
+                kcalloc(max_mpt_cmd, sizeof(struct megasas_cmd_fusion *),
                         GFP_KERNEL);
         if (!fusion->cmd_list) {
                 dev_err(&instance->pdev->dev,
@@ -4829,8 +4829,9 @@ megasas_alloc_fusion_context(struct megasas_instance *instance)
                 (PLD_SPAN_INFO)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
                                                 fusion->log_to_span_pages);
         if (!fusion->log_to_span) {
-                fusion->log_to_span = vzalloc(MAX_LOGICAL_DRIVES_EXT *
-                                              sizeof(LD_SPAN_INFO));
+                fusion->log_to_span =
+                        vzalloc(array_size(MAX_LOGICAL_DRIVES_EXT,
+                                           sizeof(LD_SPAN_INFO)));
                 if (!fusion->log_to_span) {
                         dev_err(&instance->pdev->dev, "Failed from %s %d\n",
                                 __func__, __LINE__);
@@ -4844,8 +4845,9 @@ megasas_alloc_fusion_context(struct megasas_instance *instance)
                 (struct LD_LOAD_BALANCE_INFO *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
                 fusion->load_balance_info_pages);
         if (!fusion->load_balance_info) {
-                fusion->load_balance_info = vzalloc(MAX_LOGICAL_DRIVES_EXT *
-                        sizeof(struct LD_LOAD_BALANCE_INFO));
+                fusion->load_balance_info =
+                        vzalloc(array_size(MAX_LOGICAL_DRIVES_EXT,
+                                           sizeof(struct LD_LOAD_BALANCE_INFO)));
                 if (!fusion->load_balance_info)
                         dev_err(&instance->pdev->dev, "Failed to allocate load_balance_info, "
                                 "continuing without Load Balance support\n");
diff --git a/drivers/scsi/osst.c b/drivers/scsi/osst.c
index 2bbe797f8c3d..7a1a1edde35d 100644
--- a/drivers/scsi/osst.c
+++ b/drivers/scsi/osst.c
@@ -381,7 +381,7 @@ static int osst_execute(struct osst_request *SRpnt, const unsigned char *cmd,
                 struct scatterlist *sg, *sgl = (struct scatterlist *)buffer;
                 int i;
 
-                pages = kzalloc(use_sg * sizeof(struct page *), GFP_KERNEL);
+                pages = kcalloc(use_sg, sizeof(struct page *), GFP_KERNEL);
                 if (!pages)
                         goto free_req;
 
@@ -1488,7 +1488,7 @@ static int osst_read_back_buffer_and_rewrite(struct osst_tape * STp, struct osst
         int                     dbg              = debugging;
 #endif
 
-        if ((buffer = vmalloc((nframes + 1) * OS_DATA_SIZE)) == NULL)
+        if ((buffer = vmalloc(array_size((nframes + 1), OS_DATA_SIZE))) == NULL)
                 return (-EIO);
 
         printk(KERN_INFO "%s:I: Reading back %d frames from drive buffer%s\n",
@@ -5856,7 +5856,9 @@ static int osst_probe(struct device *dev)
         /* if this is the first attach, build the infrastructure */
         write_lock(&os_scsi_tapes_lock);
         if (os_scsi_tapes == NULL) {
-                os_scsi_tapes = kmalloc(osst_max_dev * sizeof(struct osst_tape *), GFP_ATOMIC);
+                os_scsi_tapes = kmalloc_array(osst_max_dev,
+                                              sizeof(struct osst_tape *),
+                                              GFP_ATOMIC);
                 if (os_scsi_tapes == NULL) {
                         write_unlock(&os_scsi_tapes_lock);
                         printk(KERN_ERR "osst :E: Unable to allocate array for OnStream SCSI tapes.\n");
diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
index 596f3ff965f5..d193961ea82f 100644
--- a/drivers/scsi/pm8001/pm8001_ctl.c
+++ b/drivers/scsi/pm8001/pm8001_ctl.c
@@ -705,7 +705,7 @@ static ssize_t pm8001_store_update_fw(struct device *cdev,
                 return -EINPROGRESS;
         pm8001_ha->fw_status = FLASH_IN_PROGRESS;
 
-        cmd_ptr = kzalloc(count*2, GFP_KERNEL);
+        cmd_ptr = kcalloc(count, 2, GFP_KERNEL);
         if (!cmd_ptr) {
                 pm8001_ha->fw_status = FAIL_OUT_MEMORY;
                 return -ENOMEM;
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index 95530393872d..4e86994e10e8 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -4873,8 +4873,9 @@ static int pmcraid_allocate_config_buffers(struct pmcraid_instance *pinstance)
         int i;
 
         pinstance->res_entries =
-                        kzalloc(sizeof(struct pmcraid_resource_entry) *
-                                PMCRAID_MAX_RESOURCES, GFP_KERNEL);
+                        kcalloc(PMCRAID_MAX_RESOURCES,
+                                sizeof(struct pmcraid_resource_entry),
+                                GFP_KERNEL);
 
         if (NULL == pinstance->res_entries) {
                 pmcraid_err("failed to allocate memory for resource table\n");
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 32ee7f62fef9..cf274a79e77a 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -524,7 +524,7 @@ static int qedi_init_id_tbl(struct qedi_portid_tbl *id_tbl, u16 size,
         id_tbl->max = size;
         id_tbl->next = next;
         spin_lock_init(&id_tbl->lock);
-        id_tbl->table = kzalloc(DIV_ROUND_UP(size, 32) * 4, GFP_KERNEL);
+        id_tbl->table = kcalloc(DIV_ROUND_UP(size, 32), 4, GFP_KERNEL);
         if (!id_tbl->table)
                 return -ENOMEM;
 
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 1aa3720ea2ed..fbbb328c64d5 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -3089,8 +3089,9 @@ qla2x00_alloc_outstanding_cmds(struct qla_hw_data *ha, struct req_que *req)
                         req->num_outstanding_cmds = ha->cur_fw_iocb_count;
         }
 
-        req->outstanding_cmds = kzalloc(sizeof(srb_t *) *
-            req->num_outstanding_cmds, GFP_KERNEL);
+        req->outstanding_cmds = kcalloc(req->num_outstanding_cmds,
+                                        sizeof(srb_t *),
+                                        GFP_KERNEL);
 
         if (!req->outstanding_cmds) {
                 /*
@@ -3098,8 +3099,9 @@ qla2x00_alloc_outstanding_cmds(struct qla_hw_data *ha, struct req_que *req)
                  * initialization.
                  */
                 req->num_outstanding_cmds = MIN_OUTSTANDING_COMMANDS;
-                req->outstanding_cmds = kzalloc(sizeof(srb_t *) *
-                    req->num_outstanding_cmds, GFP_KERNEL);
+                req->outstanding_cmds = kcalloc(req->num_outstanding_cmds,
+                                                sizeof(srb_t *),
+                                                GFP_KERNEL);
 
                 if (!req->outstanding_cmds) {
                         ql_log(ql_log_fatal, NULL, 0x0126,
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index a3dc83f9444d..d14d3911516d 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3434,8 +3434,9 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
                             "Adjusted Max no of queues pairs: %d.\n", ha->max_qpairs);
                 }
         }
-        ha->msix_entries = kzalloc(sizeof(struct qla_msix_entry) *
-                                ha->msix_count, GFP_KERNEL);
+        ha->msix_entries = kcalloc(ha->msix_count,
+                                   sizeof(struct qla_msix_entry),
+                                   GFP_KERNEL);
         if (!ha->msix_entries) {
                 ql_log(ql_log_fatal, vha, 0x00c8,
                     "Failed to allocate memory for ha->msix_entries.\n");
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 872d66dd79cd..de2bc78449e7 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -1230,7 +1230,7 @@ qla82xx_pinit_from_rom(scsi_qla_host_t *vha)
         ql_log(ql_log_info, vha, 0x0072,
             "%d CRB init values found in ROM.\n", n);
 
-        buf = kmalloc(n * sizeof(struct crb_addr_pair), GFP_KERNEL);
+        buf = kmalloc_array(n, sizeof(struct crb_addr_pair), GFP_KERNEL);
         if (buf == NULL) {
                 ql_log(ql_log_fatal, vha, 0x010c,
                     "Unable to allocate memory.\n");
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 817c18a8e84d..e881fce7477a 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -410,7 +410,7 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req,
                                 struct rsp_que *rsp)
 {
         scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev);
-        ha->req_q_map = kzalloc(sizeof(struct req_que *) * ha->max_req_queues,
+        ha->req_q_map = kcalloc(ha->max_req_queues, sizeof(struct req_que *),
                                 GFP_KERNEL);
         if (!ha->req_q_map) {
                 ql_log(ql_log_fatal, vha, 0x003b,
@@ -418,7 +418,7 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req,
                 goto fail_req_map;
         }
 
-        ha->rsp_q_map = kzalloc(sizeof(struct rsp_que *) * ha->max_rsp_queues,
+        ha->rsp_q_map = kcalloc(ha->max_rsp_queues, sizeof(struct rsp_que *),
                                 GFP_KERNEL);
         if (!ha->rsp_q_map) {
                 ql_log(ql_log_fatal, vha, 0x003c,
@@ -4045,8 +4045,9 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
             (*rsp)->ring);
         /* Allocate memory for NVRAM data for vports */
         if (ha->nvram_npiv_size) {
-                ha->npiv_info = kzalloc(sizeof(struct qla_npiv_entry) *
-                    ha->nvram_npiv_size, GFP_KERNEL);
+                ha->npiv_info = kcalloc(ha->nvram_npiv_size,
+                                        sizeof(struct qla_npiv_entry),
+                                        GFP_KERNEL);
                 if (!ha->npiv_info) {
                         ql_log_pci(ql_log_fatal, ha->pdev, 0x002d,
                             "Failed to allocate memory for npiv_info.\n");
@@ -4080,8 +4081,9 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
         INIT_LIST_HEAD(&ha->vp_list);
 
         /* Allocate memory for our loop_id bitmap */
-        ha->loop_id_map = kzalloc(BITS_TO_LONGS(LOOPID_MAP_SIZE) * sizeof(long),
-            GFP_KERNEL);
+        ha->loop_id_map = kcalloc(BITS_TO_LONGS(LOOPID_MAP_SIZE),
+                                  sizeof(long),
+                                  GFP_KERNEL);
         if (!ha->loop_id_map)
                 goto fail_loop_id_map;
         else {
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index b85c833099ff..0fea2e2326be 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -6248,8 +6248,9 @@ int qlt_add_target(struct qla_hw_data *ha, struct scsi_qla_host *base_vha)
                 return -ENOMEM;
         }
 
-        tgt->qphints = kzalloc((ha->max_qpairs + 1) *
-            sizeof(struct qla_qpair_hint), GFP_KERNEL);
+        tgt->qphints = kcalloc(ha->max_qpairs + 1,
+                               sizeof(struct qla_qpair_hint),
+                               GFP_KERNEL);
         if (!tgt->qphints) {
                 kfree(tgt);
                 ql_log(ql_log_warn, base_vha, 0x0197,
@@ -7089,8 +7090,9 @@ qlt_mem_alloc(struct qla_hw_data *ha)
         if (!QLA_TGT_MODE_ENABLED())
                 return 0;
 
-        ha->tgt.tgt_vp_map = kzalloc(sizeof(struct qla_tgt_vp_map) *
-            MAX_MULTI_ID_FABRIC, GFP_KERNEL);
+        ha->tgt.tgt_vp_map = kcalloc(MAX_MULTI_ID_FABRIC,
+                                     sizeof(struct qla_tgt_vp_map),
+                                     GFP_KERNEL);
         if (!ha->tgt.tgt_vp_map)
                 return -ENOMEM;
 
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 0c2e82af9c0a..7732e9336d43 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -1661,7 +1661,9 @@ static int tcm_qla2xxx_init_lport(struct tcm_qla2xxx_lport *lport)
                 return rc;
         }
 
-        lport->lport_loopid_map = vzalloc(sizeof(struct tcm_qla2xxx_fc_loopid) * 65536);
+        lport->lport_loopid_map =
+                vzalloc(array_size(65536,
+                                   sizeof(struct tcm_qla2xxx_fc_loopid)));
         if (!lport->lport_loopid_map) {
                 pr_err("Unable to allocate lport->lport_loopid_map of %zu bytes\n",
                     sizeof(struct tcm_qla2xxx_fc_loopid) * 65536);
diff --git a/drivers/scsi/qla4xxx/ql4_nx.c b/drivers/scsi/qla4xxx/ql4_nx.c
index 43f73583ef5c..d2b333d629be 100644
--- a/drivers/scsi/qla4xxx/ql4_nx.c
+++ b/drivers/scsi/qla4xxx/ql4_nx.c
@@ -1077,7 +1077,7 @@ qla4_82xx_pinit_from_rom(struct scsi_qla_host *ha, int verbose)
         ql4_printk(KERN_INFO, ha,
                 "%s: %d CRB init values found in ROM.\n", DRIVER_NAME, n);
 
-        buf = kmalloc(n * sizeof(struct crb_addr_pair), GFP_KERNEL);
+        buf = kmalloc_array(n, sizeof(struct crb_addr_pair), GFP_KERNEL);
         if (buf == NULL) {
                 ql4_printk(KERN_WARNING, ha,
                     "%s: [ERROR] Unable to malloc memory.\n", DRIVER_NAME);
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 656c98e116a9..24d7496cd9e2 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -3450,7 +3450,7 @@ static int resp_comp_write(struct scsi_cmnd *scp,
                 return check_condition_result;
         }
         dnum = 2 * num;
-        arr = kzalloc(dnum * lb_size, GFP_ATOMIC);
+        arr = kcalloc(lb_size, dnum, GFP_ATOMIC);
         if (NULL == arr) {
                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
                                 INSUFF_RES_ASCQ);
@@ -5439,7 +5439,8 @@ static int __init scsi_debug_init(void)
                 }
 
                 map_size = lba_to_map_index(sdebug_store_sectors - 1) + 1;
-                map_storep = vmalloc(BITS_TO_LONGS(map_size) * sizeof(long));
+                map_storep = vmalloc(array_size(sizeof(long),
+                                                BITS_TO_LONGS(map_size)));
 
                 pr_info("%lu provisioning blocks\n", map_size);
 
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 323e3dc4bc59..76da8c3a6f09 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -494,7 +494,7 @@ out_free:
 static inline unsigned long *
 sd_zbc_alloc_zone_bitmap(u32 nr_zones, int numa_node)
 {
-        return kzalloc_node(BITS_TO_LONGS(nr_zones) * sizeof(unsigned long),
+        return kcalloc_node(BITS_TO_LONGS(nr_zones), sizeof(unsigned long),
                             GFP_KERNEL, numa_node);
 }
 
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 62f04c0511cf..0fc39224ce1e 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -747,7 +747,7 @@ static int ses_intf_add(struct device *cdev,
                 buf = NULL;
         }
 page2_not_supported:
-        scomp = kzalloc(sizeof(struct ses_component) * components, GFP_KERNEL);
+        scomp = kcalloc(components, sizeof(struct ses_component), GFP_KERNEL);
         if (!scomp)
                 goto err_free;
 
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 573763908562..53ae52dbff84 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1045,7 +1045,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
                 else {
                         sg_req_info_t *rinfo;
 
-                        rinfo = kzalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
+                        rinfo = kcalloc(SG_MAX_QUEUE, SZ_SG_REQ_INFO,
                                         GFP_KERNEL);
                         if (!rinfo)
                                 return -ENOMEM;
diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 592b6dbf8b35..b78d20b74ed8 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -1820,8 +1820,9 @@ static int pqi_update_scsi_devices(struct pqi_ctrl_info *ctrl_info)
 
         num_new_devices = num_physicals + num_logicals;
 
-        new_device_list = kmalloc(sizeof(*new_device_list) *
-                num_new_devices, GFP_KERNEL);
+        new_device_list = kmalloc_array(num_new_devices,
+                                        sizeof(*new_device_list),
+                                        GFP_KERNEL);
         if (!new_device_list) {
                 dev_warn(&ctrl_info->pci_dev->dev, "%s\n", out_of_memory_msg);
                 rc = -ENOMEM;
@@ -4251,8 +4252,9 @@ static int pqi_alloc_io_resources(struct pqi_ctrl_info *ctrl_info)
         struct device *dev;
         struct pqi_io_request *io_request;
 
-        ctrl_info->io_request_pool = kzalloc(ctrl_info->max_io_slots *
-                sizeof(ctrl_info->io_request_pool[0]), GFP_KERNEL);
+        ctrl_info->io_request_pool =
+                kcalloc(ctrl_info->max_io_slots,
+                        sizeof(ctrl_info->io_request_pool[0]), GFP_KERNEL);
 
         if (!ctrl_info->io_request_pool) {
                 dev_err(&ctrl_info->pci_dev->dev,
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index c9e27e752c25..50c66ccc4b41 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -3888,7 +3888,7 @@ static struct st_buffer *new_tape_buffer(int need_dma, int max_sg)
         tb->dma = need_dma;
         tb->buffer_size = 0;
 
-        tb->reserved_pages = kzalloc(max_sg * sizeof(struct page *),
+        tb->reserved_pages = kcalloc(max_sg, sizeof(struct page *),
                                      GFP_KERNEL);
         if (!tb->reserved_pages) {
                 kfree(tb);
@@ -4915,7 +4915,8 @@ static int sgl_map_user_pages(struct st_buffer *STbp,
         if (count == 0)
                 return 0;
 
-        if ((pages = kmalloc(max_pages * sizeof(*pages), GFP_KERNEL)) == NULL)
+        pages = kmalloc_array(max_pages, sizeof(*pages), GFP_KERNEL);
+        if (pages == NULL)
                 return -ENOMEM;
 
         /* Try to fault in all of the necessary pages */
diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
index e82bde077296..895a9b5ac989 100644
--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
+++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
@@ -86,8 +86,8 @@ static int ufshcd_parse_clock_info(struct ufs_hba *hba)
                 goto out;
         }
 
-        clkfreq = devm_kzalloc(dev, sz * sizeof(*clkfreq),
-                        GFP_KERNEL);
+        clkfreq = devm_kcalloc(dev, sz, sizeof(*clkfreq),
+                               GFP_KERNEL);
         if (!clkfreq) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 3a811c5f70ba..397081d320b1 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -3357,8 +3357,8 @@ static int ufshcd_memory_alloc(struct ufs_hba *hba)
         }
 
         /* Allocate memory for local reference block */
-        hba->lrb = devm_kzalloc(hba->dev,
-                                hba->nutrs * sizeof(struct ufshcd_lrb),
+        hba->lrb = devm_kcalloc(hba->dev,
+                                hba->nutrs, sizeof(struct ufshcd_lrb),
                                 GFP_KERNEL);
         if (!hba->lrb) {
                 dev_err(hba->dev, "LRB Memory allocation failed\n");
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 45d04631888a..6dc8891ccb74 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -794,9 +794,10 @@ static int virtscsi_init(struct virtio_device *vdev,
         struct irq_affinity desc = { .pre_vectors = 2 };
 
         num_vqs = vscsi->num_queues + VIRTIO_SCSI_VQ_BASE;
-        vqs = kmalloc(num_vqs * sizeof(struct virtqueue *), GFP_KERNEL);
-        callbacks = kmalloc(num_vqs * sizeof(vq_callback_t *), GFP_KERNEL);
-        names = kmalloc(num_vqs * sizeof(char *), GFP_KERNEL);
+        vqs = kmalloc_array(num_vqs, sizeof(struct virtqueue *), GFP_KERNEL);
+        callbacks = kmalloc_array(num_vqs, sizeof(vq_callback_t *),
+                                  GFP_KERNEL);
+        names = kmalloc_array(num_vqs, sizeof(char *), GFP_KERNEL);
 
         if (!callbacks || !vqs || !names) {
                 err = -ENOMEM;
diff --git a/drivers/sh/clk/cpg.c b/drivers/sh/clk/cpg.c
index 7442bc130055..eeb028b9cdb3 100644
--- a/drivers/sh/clk/cpg.c
+++ b/drivers/sh/clk/cpg.c
@@ -249,7 +249,7 @@ static int __init sh_clk_div_register_ops(struct clk *clks, int nr,
         int k;
 
         freq_table_size *= (nr_divs + 1);
-        freq_table = kzalloc(freq_table_size * nr, GFP_KERNEL);
+        freq_table = kcalloc(nr, freq_table_size, GFP_KERNEL);
         if (!freq_table) {
                 pr_err("%s: unable to alloc memory\n", __func__);
                 return -ENOMEM;
diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c
index 8e72bcbd3d6d..46f0f322d4d8 100644
--- a/drivers/sh/intc/core.c
+++ b/drivers/sh/intc/core.c
@@ -203,7 +203,7 @@ int __init register_intc_controller(struct intc_desc *desc)
 
         if (desc->num_resources) {
                 d->nr_windows = desc->num_resources;
-                d->window = kzalloc(d->nr_windows * sizeof(*d->window),
+                d->window = kcalloc(d->nr_windows, sizeof(*d->window),
                                     GFP_NOWAIT);
                 if (!d->window)
                         goto err1;
@@ -230,12 +230,12 @@ int __init register_intc_controller(struct intc_desc *desc)
         d->nr_reg += hw->ack_regs ? hw->nr_ack_regs : 0;
         d->nr_reg += hw->subgroups ? hw->nr_subgroups : 0;
 
-        d->reg = kzalloc(d->nr_reg * sizeof(*d->reg), GFP_NOWAIT);
+        d->reg = kcalloc(d->nr_reg, sizeof(*d->reg), GFP_NOWAIT);
         if (!d->reg)
                 goto err2;
 
 #ifdef CONFIG_SMP
-        d->smp = kzalloc(d->nr_reg * sizeof(*d->smp), GFP_NOWAIT);
+        d->smp = kcalloc(d->nr_reg, sizeof(*d->smp), GFP_NOWAIT);
         if (!d->smp)
                 goto err3;
 #endif
@@ -253,7 +253,7 @@ int __init register_intc_controller(struct intc_desc *desc)
         }
 
         if (hw->prio_regs) {
-                d->prio = kzalloc(hw->nr_vectors * sizeof(*d->prio),
+                d->prio = kcalloc(hw->nr_vectors, sizeof(*d->prio),
                                   GFP_NOWAIT);
                 if (!d->prio)
                         goto err4;
@@ -269,7 +269,7 @@ int __init register_intc_controller(struct intc_desc *desc)
         }
 
         if (hw->sense_regs) {
-                d->sense = kzalloc(hw->nr_vectors * sizeof(*d->sense),
+                d->sense = kcalloc(hw->nr_vectors, sizeof(*d->sense),
                                    GFP_NOWAIT);
                 if (!d->sense)
                         goto err5;
diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c
index 7525039d812c..2e45988d1259 100644
--- a/drivers/sh/maple/maple.c
+++ b/drivers/sh/maple/maple.c
@@ -161,7 +161,7 @@ int maple_add_packet(struct maple_device *mdev, u32 function, u32 command,
         void *sendbuf = NULL;
 
         if (length) {
-                sendbuf = kzalloc(length * 4, GFP_KERNEL);
+                sendbuf = kcalloc(length, 4, GFP_KERNEL);
                 if (!sendbuf) {
                         ret = -ENOMEM;
                         goto out;
diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c
index bb36a8fbc9b1..db1f5135846a 100644
--- a/drivers/slimbus/qcom-ctrl.c
+++ b/drivers/slimbus/qcom-ctrl.c
@@ -540,7 +540,7 @@ static int qcom_slim_probe(struct platform_device *pdev)
         ctrl->tx.sl_sz = SLIM_MSGQ_BUF_LEN;
         ctrl->rx.n = QCOM_RX_MSGS;
         ctrl->rx.sl_sz = SLIM_MSGQ_BUF_LEN;
-        ctrl->wr_comp = kzalloc(sizeof(struct completion *) * QCOM_TX_MSGS,
+        ctrl->wr_comp = kcalloc(QCOM_TX_MSGS, sizeof(struct completion *),
                                 GFP_KERNEL);
         if (!ctrl->wr_comp)
                 return -ENOMEM;
diff --git a/drivers/soc/bcm/raspberrypi-power.c b/drivers/soc/bcm/raspberrypi-power.c
index f7ed1187518b..a78dfe0a2b50 100644
--- a/drivers/soc/bcm/raspberrypi-power.c
+++ b/drivers/soc/bcm/raspberrypi-power.c
@@ -165,8 +165,10 @@ static int rpi_power_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         rpi_domains->xlate.domains =
-                devm_kzalloc(dev, sizeof(*rpi_domains->xlate.domains) *
-                             RPI_POWER_DOMAIN_COUNT, GFP_KERNEL);
+                devm_kcalloc(dev,
+                             RPI_POWER_DOMAIN_COUNT,
+                             sizeof(*rpi_domains->xlate.domains),
+                             GFP_KERNEL);
         if (!rpi_domains->xlate.domains)
                 return -ENOMEM;
 
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index ba3cfa8e279b..ecb22749df0b 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -1021,7 +1021,8 @@ int qman_alloc_fq_table(u32 _num_fqids)
 {
         num_fqids = _num_fqids;
 
-        fq_table = vzalloc(num_fqids * 2 * sizeof(struct qman_fq *));
+        fq_table = vzalloc(array3_size(sizeof(struct qman_fq *),
+                                       num_fqids, 2));
         if (!fq_table)
                 return -ENOMEM;
 
@@ -1181,7 +1182,7 @@ static int qman_create_portal(struct qman_portal *portal,
         qm_dqrr_set_ithresh(p, QMAN_PIRQ_DQRR_ITHRESH);
         qm_mr_set_ithresh(p, QMAN_PIRQ_MR_ITHRESH);
         qm_out(p, QM_REG_ITPR, QMAN_PIRQ_IPERIOD);
-        portal->cgrs = kmalloc(2 * sizeof(*cgrs), GFP_KERNEL);
+        portal->cgrs = kmalloc_array(2, sizeof(*cgrs), GFP_KERNEL);
         if (!portal->cgrs)
                 goto fail_cgrs;
         /* initial snapshot is no-depletion */
diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c
index 128e3dd3186d..5b24bb4bfbf6 100644
--- a/drivers/soc/mediatek/mtk-scpsys.c
+++ b/drivers/soc/mediatek/mtk-scpsys.c
@@ -376,15 +376,15 @@ static struct scp *init_scp(struct platform_device *pdev,
         if (IS_ERR(scp->base))
                 return ERR_CAST(scp->base);
 
-        scp->domains = devm_kzalloc(&pdev->dev,
-                                sizeof(*scp->domains) * num, GFP_KERNEL);
+        scp->domains = devm_kcalloc(&pdev->dev,
+                                num, sizeof(*scp->domains), GFP_KERNEL);
         if (!scp->domains)
                 return ERR_PTR(-ENOMEM);
 
         pd_data = &scp->pd_data;
 
-        pd_data->domains = devm_kzalloc(&pdev->dev,
-                        sizeof(*pd_data->domains) * num, GFP_KERNEL);
+        pd_data->domains = devm_kcalloc(&pdev->dev,
+                        num, sizeof(*pd_data->domains), GFP_KERNEL);
         if (!pd_data->domains)
                 return ERR_PTR(-ENOMEM);
 
diff --git a/drivers/soc/ti/knav_qmss_acc.c b/drivers/soc/ti/knav_qmss_acc.c
index 3d7225f4e77f..316e82e46f6c 100644
--- a/drivers/soc/ti/knav_qmss_acc.c
+++ b/drivers/soc/ti/knav_qmss_acc.c
@@ -405,8 +405,8 @@ static int knav_acc_init_queue(struct knav_range_info *range,
 {
         unsigned id = kq->id - range->queue_base;
 
-        kq->descs = devm_kzalloc(range->kdev->dev,
-                                 ACC_DESCS_MAX * sizeof(u32), GFP_KERNEL);
+        kq->descs = devm_kcalloc(range->kdev->dev,
+                                 ACC_DESCS_MAX, sizeof(u32), GFP_KERNEL);
         if (!kq->descs)
                 return -ENOMEM;
 
@@ -552,7 +552,7 @@ int knav_init_acc_range(struct knav_device *kdev,
         info->list_size = list_size;
         mem_size   = PAGE_ALIGN(list_size * 2);
         info->mem_size  = mem_size;
-        range->acc = devm_kzalloc(kdev->dev, channels * sizeof(*range->acc),
+        range->acc = devm_kcalloc(kdev->dev, channels, sizeof(*range->acc),
                                   GFP_KERNEL);
         if (!range->acc)
                 return -ENOMEM;
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index 60d59b003aa4..577084bb911b 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -923,9 +923,10 @@ static int davinci_spi_probe(struct platform_device *pdev)
         /* pdata in dspi is now updated and point pdata to that */
         pdata = &dspi->pdata;
 
-        dspi->bytes_per_word = devm_kzalloc(&pdev->dev,
-                                            sizeof(*dspi->bytes_per_word) *
-                                            pdata->num_chipselect, GFP_KERNEL);
+        dspi->bytes_per_word = devm_kcalloc(&pdev->dev,
+                                            pdata->num_chipselect,
+                                            sizeof(*dspi->bytes_per_word),
+                                            GFP_KERNEL);
         if (dspi->bytes_per_word == NULL) {
                 ret = -ENOMEM;
                 goto free_master;
diff --git a/drivers/spi/spi-ep93xx.c b/drivers/spi/spi-ep93xx.c
index e5cc07357746..f1526757aaf6 100644
--- a/drivers/spi/spi-ep93xx.c
+++ b/drivers/spi/spi-ep93xx.c
@@ -671,8 +671,8 @@ static int ep93xx_spi_probe(struct platform_device *pdev)
         master->bits_per_word_mask = SPI_BPW_RANGE_MASK(4, 16);
 
         master->num_chipselect = info->num_chipselect;
-        master->cs_gpios = devm_kzalloc(&master->dev,
-                                        sizeof(int) * master->num_chipselect,
+        master->cs_gpios = devm_kcalloc(&master->dev,
+                                        master->num_chipselect, sizeof(int),
                                         GFP_KERNEL);
         if (!master->cs_gpios) {
                 error = -ENOMEM;
diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
index b85a93cad44a..6ae92d4dca19 100644
--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -373,8 +373,9 @@ static int spi_gpio_probe(struct platform_device *pdev)
 
         spi_gpio = spi_master_get_devdata(master);
 
-        spi_gpio->cs_gpios = devm_kzalloc(&pdev->dev,
-                                pdata->num_chipselect * sizeof(*spi_gpio->cs_gpios),
+        spi_gpio->cs_gpios = devm_kcalloc(&pdev->dev,
+                                pdata->num_chipselect,
+                                sizeof(*spi_gpio->cs_gpios),
                                 GFP_KERNEL);
         if (!spi_gpio->cs_gpios)
                 return -ENOMEM;
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 866246f21041..d3b21faf6b1f 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -1511,8 +1511,9 @@ static int spi_imx_probe(struct platform_device *pdev)
         if (mxc_platform_info) {
                 master->num_chipselect = mxc_platform_info->num_chipselect;
                 if (mxc_platform_info->chipselect) {
-                        master->cs_gpios = devm_kzalloc(&master->dev,
-                                sizeof(int) * master->num_chipselect, GFP_KERNEL);
+                        master->cs_gpios = devm_kcalloc(&master->dev,
+                                master->num_chipselect, sizeof(int),
+                                GFP_KERNEL);
                         if (!master->cs_gpios)
                                 return -ENOMEM;
 
diff --git a/drivers/spi/spi-oc-tiny.c b/drivers/spi/spi-oc-tiny.c
index b5911282a611..085f580be7ec 100644
--- a/drivers/spi/spi-oc-tiny.c
+++ b/drivers/spi/spi-oc-tiny.c
@@ -213,8 +213,8 @@ static int tiny_spi_of_probe(struct platform_device *pdev)
                 return 0;
         hw->gpio_cs_count = of_gpio_count(np);
         if (hw->gpio_cs_count > 0) {
-                hw->gpio_cs = devm_kzalloc(&pdev->dev,
-                                hw->gpio_cs_count * sizeof(unsigned int),
+                hw->gpio_cs = devm_kcalloc(&pdev->dev,
+                                hw->gpio_cs_count, sizeof(unsigned int),
                                 GFP_KERNEL);
                 if (!hw->gpio_cs)
                         return -ENOMEM;
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 4797c57f4263..1af8c96b940e 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -2135,7 +2135,7 @@ static int pl022_probe(struct amba_device *adev, const struct amba_id *id)
         pl022->master_info = platform_info;
         pl022->adev = adev;
         pl022->vendor = id->data;
-        pl022->chipselects = devm_kzalloc(dev, num_cs * sizeof(int),
+        pl022->chipselects = devm_kcalloc(dev, num_cs, sizeof(int),
                                           GFP_KERNEL);
         if (!pl022->chipselects) {
                 status = -ENOMEM;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index efc624f9e490..ec395a6baf9c 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2049,7 +2049,7 @@ static int of_spi_register_master(struct spi_controller *ctlr)
         else if (nb < 0)
                 return nb;
 
-        cs = devm_kzalloc(&ctlr->dev, sizeof(int) * ctlr->num_chipselect,
+        cs = devm_kcalloc(&ctlr->dev, ctlr->num_chipselect, sizeof(int),
                           GFP_KERNEL);
         ctlr->cs_gpios = cs;
 
diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c
index 772dad65396e..e8c440329708 100644
--- a/drivers/staging/android/ion/ion_heap.c
+++ b/drivers/staging/android/ion/ion_heap.c
@@ -25,7 +25,8 @@ void *ion_heap_map_kernel(struct ion_heap *heap,
         pgprot_t pgprot;
         struct sg_table *table = buffer->sg_table;
         int npages = PAGE_ALIGN(buffer->size) / PAGE_SIZE;
-        struct page **pages = vmalloc(sizeof(struct page *) * npages);
+        struct page **pages = vmalloc(array_size(npages,
+                                                 sizeof(struct page *)));
         struct page **tmp = pages;
 
         if (!pages)
diff --git a/drivers/staging/greybus/audio_topology.c b/drivers/staging/greybus/audio_topology.c
index 15e57f701630..b71078339e86 100644
--- a/drivers/staging/greybus/audio_topology.c
+++ b/drivers/staging/greybus/audio_topology.c
@@ -144,7 +144,7 @@ static const char **gb_generate_enum_strings(struct gbaudio_module_info *gb,
         __u8 *data;
 
         items = le32_to_cpu(gbenum->items);
-        strings = devm_kzalloc(gb->dev, sizeof(char *) * items, GFP_KERNEL);
+        strings = devm_kcalloc(gb->dev, items, sizeof(char *), GFP_KERNEL);
         data = gbenum->names;
 
         for (i = 0; i < items; i++) {
diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c
index 341f729a9779..6dded10f4155 100644
--- a/drivers/staging/greybus/camera.c
+++ b/drivers/staging/greybus/camera.c
@@ -1175,8 +1175,9 @@ static int gb_camera_debugfs_init(struct gb_camera *gcam)
 
         gcam->debugfs.root = debugfs_create_dir(dirname, gb_debugfs_get());
 
-        gcam->debugfs.buffers = vmalloc(sizeof(*gcam->debugfs.buffers) *
-                                        GB_CAMERA_DEBUGFS_BUFFER_MAX);
+        gcam->debugfs.buffers =
+                vmalloc(array_size(GB_CAMERA_DEBUGFS_BUFFER_MAX,
+                                   sizeof(*gcam->debugfs.buffers)));
         if (!gcam->debugfs.buffers)
                 return -ENOMEM;
 
diff --git a/drivers/staging/media/imx/imx-media-dev.c b/drivers/staging/media/imx/imx-media-dev.c
index 289d775c4820..b0be80f05767 100644
--- a/drivers/staging/media/imx/imx-media-dev.c
+++ b/drivers/staging/media/imx/imx-media-dev.c
@@ -303,9 +303,9 @@ static int imx_media_alloc_pad_vdev_lists(struct imx_media_dev *imxmd)
 
         list_for_each_entry(sd, &imxmd->v4l2_dev.subdevs, list) {
                 entity = &sd->entity;
-                vdev_lists = devm_kzalloc(
+                vdev_lists = devm_kcalloc(
                         imxmd->md.dev,
-                        entity->num_pads * sizeof(*vdev_lists),
+                        entity->num_pads, sizeof(*vdev_lists),
                         GFP_KERNEL);
                 if (!vdev_lists)
                         return -ENOMEM;
@@ -544,7 +544,7 @@ static int imx_media_probe(struct platform_device *pdev)
                 goto unreg_dev;
         }
 
-        subdevs = devm_kzalloc(imxmd->md.dev, sizeof(*subdevs) * num_subdevs,
+        subdevs = devm_kcalloc(imxmd->md.dev, num_subdevs, sizeof(*subdevs),
                                GFP_KERNEL);
         if (!subdevs) {
                 ret = -ENOMEM;
diff --git a/drivers/staging/media/zoran/zoran_driver.c b/drivers/staging/media/zoran/zoran_driver.c
index d2e13fffbc6b..d7842224fff6 100644
--- a/drivers/staging/media/zoran/zoran_driver.c
+++ b/drivers/staging/media/zoran/zoran_driver.c
@@ -941,7 +941,7 @@ static int zoran_open(struct file *file)
         /* used to be BUZ_MAX_WIDTH/HEIGHT, but that gives overflows
          * on norm-change! */
         fh->overlay_mask =
-            kmalloc(((768 + 31) / 32) * 576 * 4, GFP_KERNEL);
+            kmalloc(array3_size((768 + 31) / 32, 576, 4), GFP_KERNEL);
         if (!fh->overlay_mask) {
                 dprintk(1,
                         KERN_ERR
@@ -1220,7 +1220,8 @@ static int setup_window(struct zoran_fh *fh,
                 }
         } else if (clipcount) {
                 /* write our own bitmap from the clips */
-                vcp = vmalloc(sizeof(struct v4l2_clip) * (clipcount + 4));
+                vcp = vmalloc(array_size(sizeof(struct v4l2_clip),
+                                         clipcount + 4));
                 if (vcp == NULL) {
                         dprintk(1,
                                 KERN_ERR
diff --git a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
index 2d9ab2620b82..0c3e498ae99c 100644
--- a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
+++ b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
@@ -143,7 +143,7 @@ static int rt2880_pinctrl_dt_node_to_map(struct pinctrl_dev *pctrldev,
         if (!max_maps)
                 return max_maps;
 
-        *map = kzalloc(max_maps * sizeof(struct pinctrl_map), GFP_KERNEL);
+        *map = kcalloc(max_maps, sizeof(struct pinctrl_map), GFP_KERNEL);
         if (!*map)
                 return -ENOMEM;
 
@@ -287,7 +287,8 @@ static int rt2880_pinmux_index(struct rt2880_priv *p)
         }
 
         /* allocate the group names array needed by the gpio function */
-        p->group_names = devm_kzalloc(p->dev, sizeof(char *) * p->group_count, GFP_KERNEL);
+        p->group_names = devm_kcalloc(p->dev, p->group_count, sizeof(char *),
+                                      GFP_KERNEL);
         if (!p->group_names)
                 return -1;
 
@@ -300,8 +301,12 @@ static int rt2880_pinmux_index(struct rt2880_priv *p)
         p->func_count++;
 
         /* allocate our function and group mapping index buffers */
-        f = p->func = devm_kzalloc(p->dev, sizeof(struct rt2880_pmx_func) * p->func_count, GFP_KERNEL);
-        gpio_func.groups = devm_kzalloc(p->dev, sizeof(int) * p->group_count, GFP_KERNEL);
+        f = p->func = devm_kcalloc(p->dev,
+                                   p->func_count,
+                                   sizeof(struct rt2880_pmx_func),
+                                   GFP_KERNEL);
+        gpio_func.groups = devm_kcalloc(p->dev, p->group_count, sizeof(int),
+                                        GFP_KERNEL);
         if (!f || !gpio_func.groups)
                 return -1;
 
@@ -337,7 +342,10 @@ static int rt2880_pinmux_pins(struct rt2880_priv *p)
                 if (!p->func[i]->pin_count)
                         continue;
 
-                p->func[i]->pins = devm_kzalloc(p->dev, sizeof(int) * p->func[i]->pin_count, GFP_KERNEL);
+                p->func[i]->pins = devm_kcalloc(p->dev,
+                                                p->func[i]->pin_count,
+                                                sizeof(int),
+                                                GFP_KERNEL);
                 for (j = 0; j < p->func[i]->pin_count; j++)
                         p->func[i]->pins[j] = p->func[i]->pin_first + j;
 
@@ -347,11 +355,11 @@ static int rt2880_pinmux_pins(struct rt2880_priv *p)
         }
 
         /* the buffer that tells us which pins are gpio */
-        p->gpio = devm_kzalloc(p->dev,sizeof(uint8_t) * p->max_pins,
-                GFP_KERNEL);
+        p->gpio = devm_kcalloc(p->dev,p->max_pins, sizeof(uint8_t),
+                               GFP_KERNEL);
         /* the pads needed to tell pinctrl about our pins */
-        p->pads = devm_kzalloc(p->dev,
-                sizeof(struct pinctrl_pin_desc) * p->max_pins,
+        p->pads = devm_kcalloc(p->dev,
+                p->max_pins, sizeof(struct pinctrl_pin_desc),
                 GFP_KERNEL);
         if (!p->pads || !p->gpio ) {
                 dev_err(p->dev, "Failed to allocate gpio data\n");
diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme.c b/drivers/staging/rtl8188eu/core/rtw_mlme.c
index 24e92998a30c..50e7cae32f75 100644
--- a/drivers/staging/rtl8188eu/core/rtw_mlme.c
+++ b/drivers/staging/rtl8188eu/core/rtw_mlme.c
@@ -53,7 +53,7 @@ int rtw_init_mlme_priv(struct adapter *padapter)
 
         memset(&pmlmepriv->assoc_ssid, 0, sizeof(struct ndis_802_11_ssid));
 
-        pbuf = vzalloc(MAX_BSS_CNT * (sizeof(struct wlan_network)));
+        pbuf = vzalloc(array_size(MAX_BSS_CNT, sizeof(struct wlan_network)));
 
         if (!pbuf) {
                 res = _FAIL;
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
index 37a610d05ad2..f2cdcc2bcab4 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
@@ -597,8 +597,9 @@ static void RxReorderIndicatePacket(struct ieee80211_device *ieee,
         bool                    bMatchWinStart = false, bPktInBuf = false;
         IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): Seq is %d,pTS->RxIndicateSeq is %d, WinSize is %d\n",__func__,SeqNum,pTS->RxIndicateSeq,WinSize);
 
-        prxbIndicateArray = kmalloc(sizeof(struct ieee80211_rxb *) *
-                        REORDER_WIN_SIZE, GFP_KERNEL);
+        prxbIndicateArray = kmalloc_array(REORDER_WIN_SIZE,
+                                          sizeof(struct ieee80211_rxb *),
+                                          GFP_KERNEL);
         if (!prxbIndicateArray)
                 return;
 
diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index a4df95cc7f60..8b17400f6c13 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -1640,8 +1640,8 @@ static short rtl8192_usb_initendpoints(struct net_device *dev)
 {
         struct r8192_priv *priv = ieee80211_priv(dev);
 
-        priv->rx_urb = kmalloc(sizeof(struct urb *) * (MAX_RX_URB + 1),
-                               GFP_KERNEL);
+        priv->rx_urb = kmalloc_array(MAX_RX_URB + 1, sizeof(struct urb *),
+                                     GFP_KERNEL);
         if (!priv->rx_urb)
                 return -ENOMEM;
 
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index cc4f115e082c..f9392b8db49b 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -37,7 +37,7 @@ sint	_rtw_init_mlme_priv(struct adapter *padapter)
 
         memset(&pmlmepriv->assoc_ssid, 0, sizeof(struct ndis_802_11_ssid));
 
-        pbuf = vzalloc(MAX_BSS_CNT * (sizeof(struct wlan_network)));
+        pbuf = vzalloc(array_size(MAX_BSS_CNT, sizeof(struct wlan_network)));
 
         if (pbuf == NULL) {
                 res = _FAIL;
diff --git a/drivers/staging/rtlwifi/efuse.c b/drivers/staging/rtlwifi/efuse.c
index d7c7d146a84d..1dc71455f270 100644
--- a/drivers/staging/rtlwifi/efuse.c
+++ b/drivers/staging/rtlwifi/efuse.c
@@ -237,8 +237,8 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
         }
 
         /* allocate memory for efuse_tbl and efuse_word */
-        efuse_tbl = kzalloc(rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE] *
-                            sizeof(u8), GFP_ATOMIC);
+        efuse_tbl = kzalloc(rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE],
+                            GFP_ATOMIC);
         if (!efuse_tbl)
                 return;
         efuse_word = kcalloc(EFUSE_MAX_WORD_UNIT, sizeof(u16 *), GFP_ATOMIC);
diff --git a/drivers/staging/rts5208/ms.c b/drivers/staging/rts5208/ms.c
index 821256b95e22..b89ef15e3c20 100644
--- a/drivers/staging/rts5208/ms.c
+++ b/drivers/staging/rts5208/ms.c
@@ -2618,7 +2618,7 @@ static int ms_build_l2p_tbl(struct rtsx_chip *chip, int seg_no)
         segment = &ms_card->segment[seg_no];
 
         if (!segment->l2p_table) {
-                segment->l2p_table = vmalloc(table_size * 2);
+                segment->l2p_table = vmalloc(array_size(table_size, 2));
                 if (!segment->l2p_table) {
                         rtsx_trace(chip);
                         goto BUILD_FAIL;
diff --git a/drivers/staging/rts5208/rtsx_chip.c b/drivers/staging/rts5208/rtsx_chip.c
index 4ad472dd9daf..8a823466ca2b 100644
--- a/drivers/staging/rts5208/rtsx_chip.c
+++ b/drivers/staging/rts5208/rtsx_chip.c
@@ -1660,13 +1660,13 @@ int rtsx_write_cfg_seq(struct rtsx_chip *chip, u8 func, u16 addr, u8 *buf,
 
         dev_dbg(rtsx_dev(chip), "dw_len = %d\n", dw_len);
 
-        data = vzalloc(dw_len * 4);
+        data = vzalloc(array_size(dw_len, 4));
         if (!data) {
                 rtsx_trace(chip);
                 return STATUS_NOMEM;
         }
 
-        mask = vzalloc(dw_len * 4);
+        mask = vzalloc(array_size(dw_len, 4));
         if (!mask) {
                 vfree(data);
                 rtsx_trace(chip);
@@ -1721,7 +1721,7 @@ int rtsx_read_cfg_seq(struct rtsx_chip *chip, u8 func, u16 addr, u8 *buf,
 
         dev_dbg(rtsx_dev(chip), "dw_len = %d\n", dw_len);
 
-        data = vmalloc(dw_len * 4);
+        data = vmalloc(array_size(dw_len, 4));
         if (!data) {
                 rtsx_trace(chip);
                 return STATUS_NOMEM;
diff --git a/drivers/staging/unisys/visorhba/visorhba_main.c b/drivers/staging/unisys/visorhba/visorhba_main.c
index 167e98f8688e..4fc521c51c0e 100644
--- a/drivers/staging/unisys/visorhba/visorhba_main.c
+++ b/drivers/staging/unisys/visorhba/visorhba_main.c
@@ -865,7 +865,7 @@ static void do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp,
                 if (cmdrsp->scsi.no_disk_result == 0)
                         return;
 
-                buf = kzalloc(sizeof(char) * 36, GFP_KERNEL);
+                buf = kzalloc(36, GFP_KERNEL);
                 if (!buf)
                         return;
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index f0e8f0f4ccb4..ee5081ba5313 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -250,10 +250,10 @@ int transport_alloc_session_tags(struct se_session *se_sess,
 {
         int rc;
 
-        se_sess->sess_cmd_map = kzalloc(tag_num * tag_size,
+        se_sess->sess_cmd_map = kcalloc(tag_size, tag_num,
                                         GFP_KERNEL | __GFP_NOWARN | __GFP_RETRY_MAYFAIL);
         if (!se_sess->sess_cmd_map) {
-                se_sess->sess_cmd_map = vzalloc(tag_num * tag_size);
+                se_sess->sess_cmd_map = vzalloc(array_size(tag_size, tag_num));
                 if (!se_sess->sess_cmd_map) {
                         pr_err("Unable to allocate se_sess->sess_cmd_map\n");
                         return -ENOMEM;
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 94b183efd236..7f96dfa32b9c 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1717,8 +1717,9 @@ static int tcmu_configure_device(struct se_device *dev)
 
         info = &udev->uio_info;
 
-        udev->data_bitmap = kzalloc(BITS_TO_LONGS(udev->max_blocks) *
-                                    sizeof(unsigned long), GFP_KERNEL);
+        udev->data_bitmap = kcalloc(BITS_TO_LONGS(udev->max_blocks),
+                                    sizeof(unsigned long),
+                                    GFP_KERNEL);
         if (!udev->data_bitmap) {
                 ret = -ENOMEM;
                 goto err_bitmap_alloc;
diff --git a/drivers/thermal/int340x_thermal/acpi_thermal_rel.c b/drivers/thermal/int340x_thermal/acpi_thermal_rel.c
index c719167e9f28..45e7e5cbdffb 100644
--- a/drivers/thermal/int340x_thermal/acpi_thermal_rel.c
+++ b/drivers/thermal/int340x_thermal/acpi_thermal_rel.c
@@ -96,7 +96,7 @@ int acpi_parse_trt(acpi_handle handle, int *trt_count, struct trt **trtp,
         }
 
         *trt_count = p->package.count;
-        trts = kzalloc(*trt_count * sizeof(struct trt), GFP_KERNEL);
+        trts = kcalloc(*trt_count, sizeof(struct trt), GFP_KERNEL);
         if (!trts) {
                 result = -ENOMEM;
                 goto end;
@@ -178,7 +178,7 @@ int acpi_parse_art(acpi_handle handle, int *art_count, struct art **artp,
 
         /* ignore p->package.elements[0], as this is _ART Revision field */
         *art_count = p->package.count - 1;
-        arts = kzalloc(*art_count * sizeof(struct art), GFP_KERNEL);
+        arts = kcalloc(*art_count, sizeof(struct art), GFP_KERNEL);
         if (!arts) {
                 result = -ENOMEM;
                 goto end;
diff --git a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
index dfdf6dbc2ddc..9ec27ac1856b 100644
--- a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
+++ b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
@@ -239,9 +239,10 @@ struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *adev,
         if (ACPI_FAILURE(status))
                 trip_cnt = 0;
         else {
-                int34x_thermal_zone->aux_trips = kzalloc(
-                                sizeof(*int34x_thermal_zone->aux_trips) *
-                                trip_cnt, GFP_KERNEL);
+                int34x_thermal_zone->aux_trips =
+                        kcalloc(trip_cnt,
+                                sizeof(*int34x_thermal_zone->aux_trips),
+                                GFP_KERNEL);
                 if (!int34x_thermal_zone->aux_trips) {
                         ret = -ENOMEM;
                         goto err_trip_alloc;
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index eea2fce82bf7..977a8307fbb1 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -853,7 +853,7 @@ __init *thermal_of_build_thermal_zone(struct device_node *np)
         if (tz->ntrips == 0) /* must have at least one child */
                 goto finish;
 
-        tz->trips = kzalloc(tz->ntrips * sizeof(*tz->trips), GFP_KERNEL);
+        tz->trips = kcalloc(tz->ntrips, sizeof(*tz->trips), GFP_KERNEL);
         if (!tz->trips) {
                 ret = -ENOMEM;
                 goto free_tz;
@@ -879,7 +879,7 @@ __init *thermal_of_build_thermal_zone(struct device_node *np)
         if (tz->num_tbps == 0)
                 goto finish;
 
-        tz->tbps = kzalloc(tz->num_tbps * sizeof(*tz->tbps), GFP_KERNEL);
+        tz->tbps = kcalloc(tz->num_tbps, sizeof(*tz->tbps), GFP_KERNEL);
         if (!tz->tbps) {
                 ret = -ENOMEM;
                 goto free_trips;
diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
index 207a79838643..ed28110a3535 100644
--- a/drivers/thermal/tegra/soctherm.c
+++ b/drivers/thermal/tegra/soctherm.c
@@ -1318,8 +1318,8 @@ static int tegra_soctherm_probe(struct platform_device *pdev)
                 return PTR_ERR(tegra->clock_soctherm);
         }
 
-        tegra->calib = devm_kzalloc(&pdev->dev,
-                                    sizeof(u32) * soc->num_tsensors,
+        tegra->calib = devm_kcalloc(&pdev->dev,
+                                    soc->num_tsensors, sizeof(u32),
                                     GFP_KERNEL);
         if (!tegra->calib)
                 return -ENOMEM;
@@ -1338,8 +1338,8 @@ static int tegra_soctherm_probe(struct platform_device *pdev)
                         return err;
         }
 
-        tegra->thermctl_tzs = devm_kzalloc(&pdev->dev,
-                                           sizeof(*z) * soc->num_ttgs,
+        tegra->thermctl_tzs = devm_kcalloc(&pdev->dev,
+                                           soc->num_ttgs, sizeof(*z),
                                            GFP_KERNEL);
         if (!tegra->thermctl_tzs)
                 return -ENOMEM;
diff --git a/drivers/thermal/thermal-generic-adc.c b/drivers/thermal/thermal-generic-adc.c
index 46d3005335c7..bf1c628d4a7a 100644
--- a/drivers/thermal/thermal-generic-adc.c
+++ b/drivers/thermal/thermal-generic-adc.c
@@ -87,8 +87,9 @@ static int gadc_thermal_read_linear_lookup_table(struct device *dev,
                 return -EINVAL;
         }
 
-        gti->lookup_table = devm_kzalloc(dev, sizeof(*gti->lookup_table) *
-                                         ntable, GFP_KERNEL);
+        gti->lookup_table = devm_kcalloc(dev,
+                                         ntable, sizeof(*gti->lookup_table),
+                                         GFP_KERNEL);
         if (!gti->lookup_table)
                 return -ENOMEM;
 
diff --git a/drivers/thermal/x86_pkg_temp_thermal.c b/drivers/thermal/x86_pkg_temp_thermal.c
index 1a6c88b10a39..1ef937d799e4 100644
--- a/drivers/thermal/x86_pkg_temp_thermal.c
+++ b/drivers/thermal/x86_pkg_temp_thermal.c
@@ -516,7 +516,8 @@ static int __init pkg_temp_thermal_init(void)
                 return -ENODEV;
 
         max_packages = topology_max_packages();
-        packages = kzalloc(max_packages * sizeof(struct pkg_device *), GFP_KERNEL);
+        packages = kcalloc(max_packages, sizeof(struct pkg_device *),
+                           GFP_KERNEL);
         if (!packages)
                 return -ENOMEM;
 
diff --git a/drivers/tty/ehv_bytechan.c b/drivers/tty/ehv_bytechan.c
index 47ac56817c43..eea4049b5dcc 100644
--- a/drivers/tty/ehv_bytechan.c
+++ b/drivers/tty/ehv_bytechan.c
@@ -754,7 +754,7 @@ static int __init ehv_bc_init(void)
          * array, then you can use pointer math (e.g. "bc - bcs") to get its
          * tty index.
          */
-        bcs = kzalloc(count * sizeof(struct ehv_bc_data), GFP_KERNEL);
+        bcs = kcalloc(count, sizeof(struct ehv_bc_data), GFP_KERNEL);
         if (!bcs)
                 return -ENOMEM;
 
diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c
index 1c1bd0afcd48..37caba7c3aff 100644
--- a/drivers/tty/goldfish.c
+++ b/drivers/tty/goldfish.c
@@ -245,8 +245,9 @@ static int goldfish_tty_create_driver(void)
         int ret;
         struct tty_driver *tty;
 
-        goldfish_ttys = kzalloc(sizeof(*goldfish_ttys) *
-                                goldfish_tty_line_count, GFP_KERNEL);
+        goldfish_ttys = kcalloc(goldfish_tty_line_count,
+                                sizeof(*goldfish_ttys),
+                                GFP_KERNEL);
         if (goldfish_ttys == NULL) {
                 ret = -ENOMEM;
                 goto err_alloc_goldfish_ttys_failed;
diff --git a/drivers/tty/hvc/hvc_iucv.c b/drivers/tty/hvc/hvc_iucv.c
index a74680729825..2af1e5751bd6 100644
--- a/drivers/tty/hvc/hvc_iucv.c
+++ b/drivers/tty/hvc/hvc_iucv.c
@@ -1252,7 +1252,7 @@ static int hvc_iucv_setup_filter(const char *val)
         if (size > MAX_VMID_FILTER)
                 return -ENOSPC;
 
-        array = kzalloc(size * 8, GFP_KERNEL);
+        array = kcalloc(size, 8, GFP_KERNEL);
         if (!array)
                 return -ENOMEM;
 
diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
index 1db1d97e72e7..cb4db1b3ca3c 100644
--- a/drivers/tty/hvc/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
@@ -1441,7 +1441,8 @@ static int hvcs_alloc_index_list(int n)
 {
         int i;
 
-        hvcs_index_list = kmalloc(n * sizeof(hvcs_index_count),GFP_KERNEL);
+        hvcs_index_list = kmalloc_array(n, sizeof(hvcs_index_count),
+                                        GFP_KERNEL);
         if (!hvcs_index_list)
                 return -ENOMEM;
         hvcs_index_count = n;
diff --git a/drivers/tty/isicom.c b/drivers/tty/isicom.c
index bdd3027ef01b..8d96e86966f1 100644
--- a/drivers/tty/isicom.c
+++ b/drivers/tty/isicom.c
@@ -1477,7 +1477,7 @@ static int load_firmware(struct pci_dev *pdev,
                         goto errrelfw;
                 }
 
-                data = kmalloc(word_count * 2, GFP_KERNEL);
+                data = kmalloc_array(word_count, 2, GFP_KERNEL);
                 if (data == NULL) {
                         dev_err(&pdev->dev, "Card%d, firmware upload "
                                 "failed, not enough memory\n", index + 1);
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index 55b3eff148b1..8e4428725848 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -2738,8 +2738,9 @@ static int atmel_serial_probe(struct platform_device *pdev)
 
         if (!atmel_use_pdc_rx(&atmel_port->uart)) {
                 ret = -ENOMEM;
-                data = kmalloc(sizeof(struct atmel_uart_char)
-                                * ATMEL_SERIAL_RINGSIZE, GFP_KERNEL);
+                data = kmalloc_array(ATMEL_SERIAL_RINGSIZE,
+                                     sizeof(struct atmel_uart_char),
+                                     GFP_KERNEL);
                 if (!data)
                         goto err_alloc_ring;
                 atmel_port->rx_ring.buf = data;
diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
index 760d5dd0aada..cb85002a10d8 100644
--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -991,7 +991,7 @@ static unsigned int dma_handle_tx(struct eg20t_port *priv)
 
         priv->tx_dma_use = 1;
 
-        priv->sg_tx_p = kzalloc(sizeof(struct scatterlist)*num, GFP_ATOMIC);
+        priv->sg_tx_p = kcalloc(num, sizeof(struct scatterlist), GFP_ATOMIC);
         if (!priv->sg_tx_p) {
                 dev_err(priv->port.dev, "%s:kzalloc Failed\n", __func__);
                 return 0;
diff --git a/drivers/tty/serial/rp2.c b/drivers/tty/serial/rp2.c
index 520b43b23543..5690c09cc041 100644
--- a/drivers/tty/serial/rp2.c
+++ b/drivers/tty/serial/rp2.c
@@ -774,7 +774,7 @@ static int rp2_probe(struct pci_dev *pdev,
 
         rp2_init_card(card);
 
-        ports = devm_kzalloc(&pdev->dev, sizeof(*ports) * card->n_ports,
+        ports = devm_kcalloc(&pdev->dev, card->n_ports, sizeof(*ports),
                              GFP_KERNEL);
         if (!ports)
                 return -ENOMEM;
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 890b8832aff2..9c14a453f73c 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2445,7 +2445,7 @@ int uart_register_driver(struct uart_driver *drv)
          * Maybe we should be using a slab cache for this, especially if
          * we have a large number of ports to handle.
          */
-        drv->state = kzalloc(sizeof(struct uart_state) * drv->nr, GFP_KERNEL);
+        drv->state = kcalloc(drv->nr, sizeof(struct uart_state), GFP_KERNEL);
         if (!drv->state)
                 goto out;
 
diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
index b93d0225f8c9..72131b5e132e 100644
--- a/drivers/tty/serial/sunsab.c
+++ b/drivers/tty/serial/sunsab.c
@@ -1125,8 +1125,9 @@ static int __init sunsab_init(void)
         }
 
         if (num_channels) {
-                sunsab_ports = kzalloc(sizeof(struct uart_sunsab_port) *
-                                       num_channels, GFP_KERNEL);
+                sunsab_ports = kcalloc(num_channels,
+                                       sizeof(struct uart_sunsab_port),
+                                       GFP_KERNEL);
                 if (!sunsab_ports)
                         return -ENOMEM;
 
diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
index 722a6690c70d..7c7ada0b3ea0 100644
--- a/drivers/tty/vt/consolemap.c
+++ b/drivers/tty/vt/consolemap.c
@@ -231,7 +231,7 @@ static void set_inverse_trans_unicode(struct vc_data *conp,
         q = p->inverse_trans_unicode;
         if (!q) {
                 q = p->inverse_trans_unicode =
-                        kmalloc(MAX_GLYPH * sizeof(u16), GFP_KERNEL);
+                        kmalloc_array(MAX_GLYPH, sizeof(u16), GFP_KERNEL);
                 if (!q)
                         return;
         }
@@ -479,7 +479,8 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos)
 
         p1 = p->uni_pgdir[n = unicode >> 11];
         if (!p1) {
-                p1 = p->uni_pgdir[n] = kmalloc(32*sizeof(u16 *), GFP_KERNEL);
+                p1 = p->uni_pgdir[n] = kmalloc_array(32, sizeof(u16 *),
+                                                     GFP_KERNEL);
                 if (!p1) return -ENOMEM;
                 for (i = 0; i < 32; i++)
                         p1[i] = NULL;
@@ -487,7 +488,7 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos)
 
         p2 = p1[n = (unicode >> 6) & 0x1f];
         if (!p2) {
-                p2 = p1[n] = kmalloc(64*sizeof(u16), GFP_KERNEL);
+                p2 = p1[n] = kmalloc_array(64, sizeof(u16), GFP_KERNEL);
                 if (!p2) return -ENOMEM;
                 memset(p2, 0xff, 64*sizeof(u16)); /* No glyphs for the characters (yet) */
         }
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 5d412df8e943..d5b4a2b44ab8 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -1624,7 +1624,7 @@ int vt_do_diacrit(unsigned int cmd, void __user *udp, int perm)
                 struct kbdiacr *dia;
                 int i;
 
-                dia = kmalloc(MAX_DIACR * sizeof(struct kbdiacr),
+                dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr),
                                                                 GFP_KERNEL);
                 if (!dia)
                         return -ENOMEM;
@@ -1657,7 +1657,7 @@ int vt_do_diacrit(unsigned int cmd, void __user *udp, int perm)
                 struct kbdiacrsuc __user *a = udp;
                 void *buf;
 
-                buf = kmalloc(MAX_DIACR * sizeof(struct kbdiacruc),
+                buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc),
                                                                 GFP_KERNEL);
                 if (buf == NULL)
                         return -ENOMEM;
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index 7851383fbd6c..90ea1cc52b7a 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -280,7 +280,8 @@ int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *t
 
         /* Allocate a new buffer before freeing the old one ... */
         multiplier = use_unicode ? 3 : 1;  /* chars can take up to 3 bytes */
-        bp = kmalloc(((sel_end-sel_start)/2+1)*multiplier, GFP_KERNEL);
+        bp = kmalloc_array((sel_end - sel_start) / 2 + 1, multiplier,
+                           GFP_KERNEL);
         if (!bp) {
                 printk(KERN_WARNING "selection: kmalloc() failed\n");
                 clear_selection();
diff --git a/drivers/uio/uio_pruss.c b/drivers/uio/uio_pruss.c
index 31d5b1d3b5af..91aea8823af5 100644
--- a/drivers/uio/uio_pruss.c
+++ b/drivers/uio/uio_pruss.c
@@ -129,7 +129,7 @@ static int pruss_probe(struct platform_device *pdev)
         if (!gdev)
                 return -ENOMEM;
 
-        gdev->info = kzalloc(sizeof(*p) * MAX_PRUSS_EVT, GFP_KERNEL);
+        gdev->info = kcalloc(MAX_PRUSS_EVT, sizeof(*p), GFP_KERNEL);
         if (!gdev->info) {
                 kfree(gdev);
                 return -ENOMEM;
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 76e16c5251b9..476dcc5f2da3 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -897,7 +897,7 @@ static int parse_usbdevfs_streams(struct usb_dev_state *ps,
         if (num_streams_ret && (num_streams < 2 || num_streams > 65536))
                 return -EINVAL;
 
-        eps = kmalloc(num_eps * sizeof(*eps), GFP_KERNEL);
+        eps = kmalloc_array(num_eps, sizeof(*eps), GFP_KERNEL);
         if (!eps)
                 return -ENOMEM;
 
@@ -1602,8 +1602,9 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
         as->mem_usage = u;
 
         if (num_sgs) {
-                as->urb->sg = kmalloc(num_sgs * sizeof(struct scatterlist),
-                                      GFP_KERNEL);
+                as->urb->sg = kmalloc_array(num_sgs,
+                                            sizeof(struct scatterlist),
+                                            GFP_KERNEL);
                 if (!as->urb->sg) {
                         ret = -ENOMEM;
                         goto error;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 26c2438d2889..fcae521df29b 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1376,7 +1376,7 @@ static int hub_configure(struct usb_hub *hub,
         dev_info(hub_dev, "%d port%s detected\n", maxchild,
                         (maxchild == 1) ? "" : "s");
 
-        hub->ports = kzalloc(maxchild * sizeof(struct usb_port *), GFP_KERNEL);
+        hub->ports = kcalloc(maxchild, sizeof(struct usb_port *), GFP_KERNEL);
         if (!hub->ports) {
                 ret = -ENOMEM;
                 goto fail;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 7b137003c2be..1a15392326fc 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -390,7 +390,7 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
         }
 
         /* initialize all the urbs we'll use */
-        io->urbs = kmalloc(io->entries * sizeof(*io->urbs), mem_flags);
+        io->urbs = kmalloc_array(io->entries, sizeof(*io->urbs), mem_flags);
         if (!io->urbs)
                 goto nomem;
 
@@ -1824,8 +1824,8 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
         n = nintf = 0;
         if (cp) {
                 nintf = cp->desc.bNumInterfaces;
-                new_interfaces = kmalloc(nintf * sizeof(*new_interfaces),
-                                GFP_NOIO);
+                new_interfaces = kmalloc_array(nintf, sizeof(*new_interfaces),
+                                               GFP_NOIO);
                 if (!new_interfaces)
                         return -ENOMEM;
 
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index 1faefea16cec..edaf0b6af4f0 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -5079,13 +5079,14 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
         dev_dbg(hsotg->dev, "hcfg=%08x\n", hcfg);
 
 #ifdef CONFIG_USB_DWC2_TRACK_MISSED_SOFS
-        hsotg->frame_num_array = kzalloc(sizeof(*hsotg->frame_num_array) *
-                                         FRAME_NUM_ARRAY_SIZE, GFP_KERNEL);
+        hsotg->frame_num_array = kcalloc(FRAME_NUM_ARRAY_SIZE,
+                                         sizeof(*hsotg->frame_num_array),
+                                         GFP_KERNEL);
         if (!hsotg->frame_num_array)
                 goto error1;
-        hsotg->last_frame_num_array = kzalloc(
-                        sizeof(*hsotg->last_frame_num_array) *
-                        FRAME_NUM_ARRAY_SIZE, GFP_KERNEL);
+        hsotg->last_frame_num_array =
+                kcalloc(FRAME_NUM_ARRAY_SIZE,
+                        sizeof(*hsotg->last_frame_num_array), GFP_KERNEL);
         if (!hsotg->last_frame_num_array)
                 goto error1;
 #endif
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index a4d99bf50f2f..17147b8c771e 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -2036,7 +2036,7 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev,
                 udc->num_ep = usba_config_fifo_table(udc);
         }
 
-        eps = devm_kzalloc(&pdev->dev, sizeof(struct usba_ep) * udc->num_ep,
+        eps = devm_kcalloc(&pdev->dev, udc->num_ep, sizeof(struct usba_ep),
                            GFP_KERNEL);
         if (!eps)
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
index 03149b9d7ea7..a4d9b5e1e50e 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
@@ -138,9 +138,9 @@ static int ep_bd_list_alloc(struct bdc_ep *ep)
                 __func__, ep, num_tabs);
 
         /* Allocate memory for table array */
-        ep->bd_list.bd_table_array = kzalloc(
-                                        num_tabs * sizeof(struct bd_table *),
-                                        GFP_ATOMIC);
+        ep->bd_list.bd_table_array = kcalloc(num_tabs,
+                                             sizeof(struct bd_table *),
+                                             GFP_ATOMIC);
         if (!ep->bd_list.bd_table_array)
                 return -ENOMEM;
 
diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
index 9a3f7db26a5e..be59309e848c 100644
--- a/drivers/usb/gadget/udc/fsl_udc_core.c
+++ b/drivers/usb/gadget/udc/fsl_udc_core.c
@@ -2246,7 +2246,7 @@ static int struct_udc_setup(struct fsl_udc *udc,
         pdata = dev_get_platdata(&pdev->dev);
         udc->phy_mode = pdata->phy_mode;
 
-        udc->eps = kzalloc(sizeof(struct fsl_ep) * udc->max_ep, GFP_KERNEL);
+        udc->eps = kcalloc(udc->max_ep, sizeof(struct fsl_ep), GFP_KERNEL);
         if (!udc->eps)
                 return -1;
 
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 977ea1a02cf9..7cf98c793e04 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -2427,7 +2427,8 @@ static int renesas_usb3_init_ep(struct renesas_usb3 *usb3, struct device *dev,
         if (usb3->num_usb3_eps > USB3_MAX_NUM_PIPES)
                 usb3->num_usb3_eps = USB3_MAX_NUM_PIPES;
 
-        usb3->usb3_ep = devm_kzalloc(dev, sizeof(*usb3_ep) * usb3->num_usb3_eps,
+        usb3->usb3_ep = devm_kcalloc(dev,
+                                     usb3->num_usb3_eps, sizeof(*usb3_ep),
                                      GFP_KERNEL);
         if (!usb3->usb3_ep)
                 return -ENOMEM;
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index e56db44708bc..1d87295682b8 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -117,8 +117,9 @@ static struct ehci_tt *find_tt(struct usb_device *udev)
         if (utt->multi) {
                 tt_index = utt->hcpriv;
                 if (!tt_index) {                /* Create the index array */
-                        tt_index = kzalloc(utt->hub->maxchild *
-                                        sizeof(*tt_index), GFP_ATOMIC);
+                        tt_index = kcalloc(utt->hub->maxchild,
+                                           sizeof(*tt_index),
+                                           GFP_ATOMIC);
                         if (!tt_index)
                                 return ERR_PTR(-ENOMEM);
                         utt->hcpriv = tt_index;
diff --git a/drivers/usb/host/fhci-tds.c b/drivers/usb/host/fhci-tds.c
index 3a4e8f616751..f3308ce25043 100644
--- a/drivers/usb/host/fhci-tds.c
+++ b/drivers/usb/host/fhci-tds.c
@@ -189,7 +189,7 @@ u32 fhci_create_ep(struct fhci_usb *usb, enum fhci_mem_alloc data_mem,
                         goto err;
                 }
 
-                buff = kmalloc(1028 * sizeof(*buff), GFP_KERNEL);
+                buff = kmalloc_array(1028, sizeof(*buff), GFP_KERNEL);
                 if (!buff) {
                         kfree(pkt);
                         err_for = "buffer";
diff --git a/drivers/usb/host/imx21-hcd.c b/drivers/usb/host/imx21-hcd.c
index 3a8bbfe43a8e..6e3dad19d369 100644
--- a/drivers/usb/host/imx21-hcd.c
+++ b/drivers/usb/host/imx21-hcd.c
@@ -741,8 +741,8 @@ static int imx21_hc_urb_enqueue_isoc(struct usb_hcd *hcd,
         if (urb_priv == NULL)
                 return -ENOMEM;
 
-        urb_priv->isoc_td = kzalloc(
-                sizeof(struct td) * urb->number_of_packets, mem_flags);
+        urb_priv->isoc_td = kcalloc(urb->number_of_packets, sizeof(struct td),
+                                    mem_flags);
         if (urb_priv->isoc_td == NULL) {
                 ret = -ENOMEM;
                 goto alloc_td_failed;
diff --git a/drivers/usb/host/ohci-dbg.c b/drivers/usb/host/ohci-dbg.c
index d3ee1f52aaab..4f267dc93882 100644
--- a/drivers/usb/host/ohci-dbg.c
+++ b/drivers/usb/host/ohci-dbg.c
@@ -492,7 +492,7 @@ static ssize_t fill_periodic_buffer(struct debug_buffer *buf)
         char                    *next;
         unsigned                i;
 
-        seen = kmalloc(DBG_SCHED_LIMIT * sizeof *seen, GFP_ATOMIC);
+        seen = kmalloc_array(DBG_SCHED_LIMIT, sizeof(*seen), GFP_ATOMIC);
         if (!seen)
                 return 0;
         seen_count = 0;
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 4fe74711938e..acbd3d7b8828 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2274,8 +2274,8 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
                 xhci->hw_ports[i].hw_portnum = i;
         }
 
-        xhci->rh_bw = kzalloc_node(sizeof(*xhci->rh_bw)*num_ports, flags,
-                        dev_to_node(dev));
+        xhci->rh_bw = kcalloc_node(num_ports, sizeof(*xhci->rh_bw), flags,
+                                   dev_to_node(dev));
         if (!xhci->rh_bw)
                 return -ENOMEM;
         for (i = 0; i < num_ports; i++) {
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index 236a60f53099..c2e255f02a72 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -695,7 +695,10 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
                 dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n");
 
         dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
-        dev->ring_buffer = kmalloc(ring_buffer_size*(sizeof(size_t)+dev->interrupt_in_endpoint_size), GFP_KERNEL);
+        dev->ring_buffer =
+                kmalloc_array(ring_buffer_size,
+                              sizeof(size_t) + dev->interrupt_in_endpoint_size,
+                              GFP_KERNEL);
         if (!dev->ring_buffer)
                 goto error;
         dev->interrupt_in_buffer = kmalloc(dev->interrupt_in_endpoint_size, GFP_KERNEL);
@@ -706,7 +709,9 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
                 goto error;
         dev->interrupt_out_endpoint_size = dev->interrupt_out_endpoint ? usb_endpoint_maxp(dev->interrupt_out_endpoint) :
                                                                          udev->descriptor.bMaxPacketSize0;
-        dev->interrupt_out_buffer = kmalloc(write_buffer_size*dev->interrupt_out_endpoint_size, GFP_KERNEL);
+        dev->interrupt_out_buffer =
+                kmalloc_array(write_buffer_size,
+                              dev->interrupt_out_endpoint_size, GFP_KERNEL);
         if (!dev->interrupt_out_buffer)
                 goto error;
         dev->interrupt_out_urb = usb_alloc_urb(0, GFP_KERNEL);
diff --git a/drivers/usb/misc/sisusbvga/sisusb_con.c b/drivers/usb/misc/sisusbvga/sisusb_con.c
index a0d6e0af957c..c4f017e1d17a 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_con.c
+++ b/drivers/usb/misc/sisusbvga/sisusb_con.c
@@ -1243,7 +1243,7 @@ sisusbcon_font_set(struct vc_data *c, struct console_font *font,
         }
 
         if (!sisusb->font_backup)
-                sisusb->font_backup = vmalloc(charcount * 32);
+                sisusb->font_backup = vmalloc(array_size(charcount, 32));
 
         if (sisusb->font_backup) {
                 memcpy(sisusb->font_backup, font->data, charcount * 32);
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index 34e866ad4a81..ad2c082bd0fb 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -1024,7 +1024,8 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg
                         return -EINVAL;
 
                 size = CHUNK_ALIGN(arg);
-                vec = kzalloc(sizeof(struct mon_pgmap) * (size / CHUNK_SIZE), GFP_KERNEL);
+                vec = kcalloc(size / CHUNK_SIZE, sizeof(struct mon_pgmap),
+                              GFP_KERNEL);
                 if (vec == NULL) {
                         ret = -ENOMEM;
                         break;
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 34ee9ebe12a3..33d059c40616 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -1068,7 +1068,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv)
         if (!gpriv)
                 return -ENOMEM;
 
-        uep = kzalloc(sizeof(struct usbhsg_uep) * pipe_size, GFP_KERNEL);
+        uep = kcalloc(pipe_size, sizeof(struct usbhsg_uep), GFP_KERNEL);
         if (!uep) {
                 ret = -ENOMEM;
                 goto usbhs_mod_gadget_probe_err_gpriv;
diff --git a/drivers/usb/renesas_usbhs/pipe.c b/drivers/usb/renesas_usbhs/pipe.c
index 9677e0e31475..c4922b96c93b 100644
--- a/drivers/usb/renesas_usbhs/pipe.c
+++ b/drivers/usb/renesas_usbhs/pipe.c
@@ -803,7 +803,8 @@ int usbhs_pipe_probe(struct usbhs_priv *priv)
                 return -EINVAL;
         }
 
-        info->pipe = kzalloc(sizeof(struct usbhs_pipe) * pipe_size, GFP_KERNEL);
+        info->pipe = kcalloc(pipe_size, sizeof(struct usbhs_pipe),
+                             GFP_KERNEL);
         if (!info->pipe)
                 return -ENOMEM;
 
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 62c91e360baf..2fb71303ec3a 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -736,7 +736,7 @@ static int iuu_uart_on(struct usb_serial_port *port)
         int status;
         u8 *buf;
 
-        buf = kmalloc(sizeof(u8) * 4, GFP_KERNEL);
+        buf = kmalloc(4, GFP_KERNEL);
 
         if (!buf)
                 return -ENOMEM;
@@ -790,7 +790,7 @@ static int iuu_uart_baud(struct usb_serial_port *port, u32 baud_base,
         unsigned int T1FrekvensHZ = 0;
 
         dev_dbg(&port->dev, "%s - enter baud_base=%d\n", __func__, baud_base);
-        dataout = kmalloc(sizeof(u8) * 5, GFP_KERNEL);
+        dataout = kmalloc(5, GFP_KERNEL);
 
         if (!dataout)
                 return -ENOMEM;
diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
index 900591df8bb2..6b8edf6178df 100644
--- a/drivers/usb/storage/alauda.c
+++ b/drivers/usb/storage/alauda.c
@@ -1025,7 +1025,7 @@ static int alauda_write_data(struct us_data *us, unsigned long address,
          * We also need a temporary block buffer, where we read in the old data,
          * overwrite parts with the new data, and manipulate the redundancy data
          */
-        blockbuffer = kmalloc((pagesize + 64) * blocksize, GFP_NOIO);
+        blockbuffer = kmalloc_array(pagesize + 64, blocksize, GFP_NOIO);
         if (!blockbuffer) {
                 kfree(buffer);
                 return USB_STOR_TRANSPORT_ERROR;
diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index 93cf57ac47d6..4d261e4de9ad 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -807,8 +807,12 @@ static int ms_lib_alloc_logicalmap(struct us_data *us)
         u32  i;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
 
-        info->MS_Lib.Phy2LogMap = kmalloc(info->MS_Lib.NumberOfPhyBlock * sizeof(u16), GFP_KERNEL);
-        info->MS_Lib.Log2PhyMap = kmalloc(info->MS_Lib.NumberOfLogBlock * sizeof(u16), GFP_KERNEL);
+        info->MS_Lib.Phy2LogMap = kmalloc_array(info->MS_Lib.NumberOfPhyBlock,
+                                                sizeof(u16),
+                                                GFP_KERNEL);
+        info->MS_Lib.Log2PhyMap = kmalloc_array(info->MS_Lib.NumberOfLogBlock,
+                                                sizeof(u16),
+                                                GFP_KERNEL);
 
         if ((info->MS_Lib.Phy2LogMap == NULL) || (info->MS_Lib.Log2PhyMap == NULL)) {
                 ms_lib_free_logicalmap(us);
@@ -1113,8 +1117,12 @@ static int ms_lib_alloc_writebuf(struct us_data *us)
 
         info->MS_Lib.wrtblk = (u16)-1;
 
-        info->MS_Lib.blkpag = kmalloc(info->MS_Lib.PagesPerBlock * info->MS_Lib.BytesPerSector, GFP_KERNEL);
-        info->MS_Lib.blkext = kmalloc(info->MS_Lib.PagesPerBlock * sizeof(struct ms_lib_type_extdat), GFP_KERNEL);
+        info->MS_Lib.blkpag = kmalloc_array(info->MS_Lib.PagesPerBlock,
+                                            info->MS_Lib.BytesPerSector,
+                                            GFP_KERNEL);
+        info->MS_Lib.blkext = kmalloc_array(info->MS_Lib.PagesPerBlock,
+                                            sizeof(struct ms_lib_type_extdat),
+                                            GFP_KERNEL);
 
         if ((info->MS_Lib.blkpag == NULL) || (info->MS_Lib.blkext == NULL)) {
                 ms_lib_free_writebuf(us);
diff --git a/drivers/usb/storage/sddr09.c b/drivers/usb/storage/sddr09.c
index 1cf7dbfe277c..bc9da736bdfc 100644
--- a/drivers/usb/storage/sddr09.c
+++ b/drivers/usb/storage/sddr09.c
@@ -1231,8 +1231,8 @@ sddr09_read_map(struct us_data *us) {
 
         kfree(info->lba_to_pba);
         kfree(info->pba_to_lba);
-        info->lba_to_pba = kmalloc(numblocks*sizeof(int), GFP_NOIO);
-        info->pba_to_lba = kmalloc(numblocks*sizeof(int), GFP_NOIO);
+        info->lba_to_pba = kmalloc_array(numblocks, sizeof(int), GFP_NOIO);
+        info->pba_to_lba = kmalloc_array(numblocks, sizeof(int), GFP_NOIO);
 
         if (info->lba_to_pba == NULL || info->pba_to_lba == NULL) {
                 printk(KERN_WARNING "sddr09_read_map: out of memory\n");
diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c
index 8c814b2ec9b2..b8527c55335b 100644
--- a/drivers/usb/storage/sddr55.c
+++ b/drivers/usb/storage/sddr55.c
@@ -651,7 +651,7 @@ static int sddr55_read_map(struct us_data *us) {
 
         numblocks = info->capacity >> (info->blockshift + info->pageshift);
         
-        buffer = kmalloc( numblocks * 2, GFP_NOIO );
+        buffer = kmalloc_array(numblocks, 2, GFP_NOIO );
         
         if (!buffer)
                 return -1;
@@ -684,8 +684,8 @@ static int sddr55_read_map(struct us_data *us) {
 
         kfree(info->lba_to_pba);
         kfree(info->pba_to_lba);
-        info->lba_to_pba = kmalloc(numblocks*sizeof(int), GFP_NOIO);
-        info->pba_to_lba = kmalloc(numblocks*sizeof(int), GFP_NOIO);
+        info->lba_to_pba = kmalloc_array(numblocks, sizeof(int), GFP_NOIO);
+        info->pba_to_lba = kmalloc_array(numblocks, sizeof(int), GFP_NOIO);
 
         if (info->lba_to_pba == NULL || info->pba_to_lba == NULL) {
                 kfree(info->lba_to_pba);
diff --git a/drivers/usb/wusbcore/wa-rpipe.c b/drivers/usb/wusbcore/wa-rpipe.c
index d0f1a6698460..38884aac862b 100644
--- a/drivers/usb/wusbcore/wa-rpipe.c
+++ b/drivers/usb/wusbcore/wa-rpipe.c
@@ -470,7 +470,8 @@ error:
 int wa_rpipes_create(struct wahc *wa)
 {
         wa->rpipes = le16_to_cpu(wa->wa_descr->wNumRPipes);
-        wa->rpipe_bm = kzalloc(BITS_TO_LONGS(wa->rpipes)*sizeof(unsigned long),
+        wa->rpipe_bm = kcalloc(BITS_TO_LONGS(wa->rpipes),
+                               sizeof(unsigned long),
                                GFP_KERNEL);
         if (wa->rpipe_bm == NULL)
                 return -ENOMEM;
diff --git a/drivers/uwb/est.c b/drivers/uwb/est.c
index f3e232584284..ad30ddfe30b3 100644
--- a/drivers/uwb/est.c
+++ b/drivers/uwb/est.c
@@ -217,7 +217,7 @@ static
 int uwb_est_grow(void)
 {
         size_t actual_size = uwb_est_size * sizeof(uwb_est[0]);
-        void *new = kmalloc(2 * actual_size, GFP_ATOMIC);
+        void *new = kmalloc_array(2, actual_size, GFP_ATOMIC);
         if (new == NULL)
                 return -ENOMEM;
         memcpy(new, uwb_est, actual_size);
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index a50cf45e530f..c0430a41e24b 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -376,7 +376,7 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
 
         i1480 = &i1480_usb->i1480;
         i1480->buf_size = 512;
-        i1480->cmd_buf = kmalloc(2 * i1480->buf_size, GFP_KERNEL);
+        i1480->cmd_buf = kmalloc_array(2, i1480->buf_size, GFP_KERNEL);
         if (i1480->cmd_buf == NULL) {
                 dev_err(dev, "Cannot allocate transfer buffers\n");
                 result = -ENOMEM;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index e7cf7d21cfb5..686dc670fd29 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -274,8 +274,10 @@ static int vhost_net_set_ubuf_info(struct vhost_net *n)
                 zcopy = vhost_net_zcopy_mask & (0x1 << i);
                 if (!zcopy)
                         continue;
-                n->vqs[i].ubuf_info = kmalloc(sizeof(*n->vqs[i].ubuf_info) *
-                                              UIO_MAXIOV, GFP_KERNEL);
+                n->vqs[i].ubuf_info =
+                        kmalloc_array(UIO_MAXIOV,
+                                      sizeof(*n->vqs[i].ubuf_info),
+                                      GFP_KERNEL);
                 if  (!n->vqs[i].ubuf_info)
                         goto err;
         }
@@ -943,7 +945,7 @@ static int vhost_net_open(struct inode *inode, struct file *f)
         n = kvmalloc(sizeof *n, GFP_KERNEL | __GFP_RETRY_MAYFAIL);
         if (!n)
                 return -ENOMEM;
-        vqs = kmalloc(VHOST_NET_VQ_MAX * sizeof(*vqs), GFP_KERNEL);
+        vqs = kmalloc_array(VHOST_NET_VQ_MAX, sizeof(*vqs), GFP_KERNEL);
         if (!vqs) {
                 kvfree(n);
                 return -ENOMEM;
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 7ad57094d736..17fcd3b2e686 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1378,7 +1378,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
                         goto err_vs;
         }
 
-        vqs = kmalloc(VHOST_SCSI_MAX_VQ * sizeof(*vqs), GFP_KERNEL);
+        vqs = kmalloc_array(VHOST_SCSI_MAX_VQ, sizeof(*vqs), GFP_KERNEL);
         if (!vqs)
                 goto err_vqs;
 
@@ -1685,22 +1685,25 @@ static int vhost_scsi_nexus_cb(struct se_portal_group *se_tpg,
         for (i = 0; i < VHOST_SCSI_DEFAULT_TAGS; i++) {
                 tv_cmd = &((struct vhost_scsi_cmd *)se_sess->sess_cmd_map)[i];
 
-                tv_cmd->tvc_sgl = kzalloc(sizeof(struct scatterlist) *
-                                        VHOST_SCSI_PREALLOC_SGLS, GFP_KERNEL);
+                tv_cmd->tvc_sgl = kcalloc(VHOST_SCSI_PREALLOC_SGLS,
+                                          sizeof(struct scatterlist),
+                                          GFP_KERNEL);
                 if (!tv_cmd->tvc_sgl) {
                         pr_err("Unable to allocate tv_cmd->tvc_sgl\n");
                         goto out;
                 }
 
-                tv_cmd->tvc_upages = kzalloc(sizeof(struct page *) *
-                                VHOST_SCSI_PREALLOC_UPAGES, GFP_KERNEL);
+                tv_cmd->tvc_upages = kcalloc(VHOST_SCSI_PREALLOC_UPAGES,
+                                             sizeof(struct page *),
+                                             GFP_KERNEL);
                 if (!tv_cmd->tvc_upages) {
                         pr_err("Unable to allocate tv_cmd->tvc_upages\n");
                         goto out;
                 }
 
-                tv_cmd->tvc_prot_sgl = kzalloc(sizeof(struct scatterlist) *
-                                VHOST_SCSI_PREALLOC_PROT_SGLS, GFP_KERNEL);
+                tv_cmd->tvc_prot_sgl = kcalloc(VHOST_SCSI_PREALLOC_PROT_SGLS,
+                                               sizeof(struct scatterlist),
+                                               GFP_KERNEL);
                 if (!tv_cmd->tvc_prot_sgl) {
                         pr_err("Unable to allocate tv_cmd->tvc_prot_sgl\n");
                         goto out;
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index 906b8f0f19f7..40589850eb33 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -107,7 +107,7 @@ static int vhost_test_open(struct inode *inode, struct file *f)
 
         if (!n)
                 return -ENOMEM;
-        vqs = kmalloc(VHOST_TEST_VQ_MAX * sizeof(*vqs), GFP_KERNEL);
+        vqs = kmalloc_array(VHOST_TEST_VQ_MAX, sizeof(*vqs), GFP_KERNEL);
         if (!vqs) {
                 kfree(n);
                 return -ENOMEM;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 895eaa25807c..ce8c95b6365b 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -385,10 +385,13 @@ static long vhost_dev_alloc_iovecs(struct vhost_dev *dev)
 
         for (i = 0; i < dev->nvqs; ++i) {
                 vq = dev->vqs[i];
-                vq->indirect = kmalloc(sizeof *vq->indirect * UIO_MAXIOV,
-                                       GFP_KERNEL);
-                vq->log = kmalloc(sizeof *vq->log * UIO_MAXIOV, GFP_KERNEL);
-                vq->heads = kmalloc(sizeof *vq->heads * UIO_MAXIOV, GFP_KERNEL);
+                vq->indirect = kmalloc_array(UIO_MAXIOV,
+                                             sizeof(*vq->indirect),
+                                             GFP_KERNEL);
+                vq->log = kmalloc_array(UIO_MAXIOV, sizeof(*vq->log),
+                                        GFP_KERNEL);
+                vq->heads = kmalloc_array(UIO_MAXIOV, sizeof(*vq->heads),
+                                          GFP_KERNEL);
                 if (!vq->indirect || !vq->log || !vq->heads)
                         goto err_nomem;
         }
@@ -1286,7 +1289,8 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
                 return -EOPNOTSUPP;
         if (mem.nregions > max_mem_regions)
                 return -E2BIG;
-        newmem = kvzalloc(size + mem.nregions * sizeof(*m->regions), GFP_KERNEL);
+        newmem = kvzalloc(struct_size(newmem, regions, mem.nregions),
+                        GFP_KERNEL);
         if (!newmem)
                 return -ENOMEM;
 
diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index bb8971f2a634..a94d700a4503 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -191,7 +191,7 @@ static int resize_iovec(struct vringh_kiov *iov, gfp_t gfp)
         if (flag)
                 new = krealloc(iov->iov, new_num * sizeof(struct iovec), gfp);
         else {
-                new = kmalloc(new_num * sizeof(struct iovec), gfp);
+                new = kmalloc_array(new_num, sizeof(struct iovec), gfp);
                 if (new) {
                         memcpy(new, iov->iov,
                                iov->max_num * sizeof(struct iovec));
diff --git a/drivers/video/backlight/adp8860_bl.c b/drivers/video/backlight/adp8860_bl.c
index e7315bf14d60..16119bde9750 100644
--- a/drivers/video/backlight/adp8860_bl.c
+++ b/drivers/video/backlight/adp8860_bl.c
@@ -223,7 +223,7 @@ static int adp8860_led_probe(struct i2c_client *client)
         struct led_info *cur_led;
         int ret, i;
 
-        led = devm_kzalloc(&client->dev, sizeof(*led) * pdata->num_leds,
+        led = devm_kcalloc(&client->dev, pdata->num_leds, sizeof(*led),
                                 GFP_KERNEL);
         if (led == NULL)
                 return -ENOMEM;
diff --git a/drivers/video/backlight/adp8870_bl.c b/drivers/video/backlight/adp8870_bl.c
index 058d1def2d1f..4fec9aa92d9b 100644
--- a/drivers/video/backlight/adp8870_bl.c
+++ b/drivers/video/backlight/adp8870_bl.c
@@ -246,7 +246,7 @@ static int adp8870_led_probe(struct i2c_client *client)
         struct led_info *cur_led;
         int ret, i;
 
-        led = devm_kzalloc(&client->dev, pdata->num_leds * sizeof(*led),
+        led = devm_kcalloc(&client->dev, pdata->num_leds, sizeof(*led),
                                 GFP_KERNEL);
         if (led == NULL)
                 return -ENOMEM;
diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
index 939f057836e1..73612485ed07 100644
--- a/drivers/video/backlight/lp855x_bl.c
+++ b/drivers/video/backlight/lp855x_bl.c
@@ -374,7 +374,7 @@ static int lp855x_parse_dt(struct lp855x *lp)
                 struct device_node *child;
                 int i = 0;
 
-                rom = devm_kzalloc(dev, sizeof(*rom) * rom_length, GFP_KERNEL);
+                rom = devm_kcalloc(dev, rom_length, sizeof(*rom), GFP_KERNEL);
                 if (!rom)
                         return -ENOMEM;
 
diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
index 08b822656846..ff45dca3ee46 100644
--- a/drivers/video/console/sticore.c
+++ b/drivers/video/console/sticore.c
@@ -649,7 +649,7 @@ static void *sti_bmode_font_raw(struct sti_cooked_font *f)
         unsigned char *n, *p, *q;
         int size = f->raw->bytes_per_char*256+sizeof(struct sti_rom_font);
         
-        n = kzalloc(4*size, STI_LOWMEM);
+        n = kcalloc(4, size, STI_LOWMEM);
         if (!n)
                 return NULL;
         p = n + 3;
diff --git a/drivers/video/fbdev/au1100fb.c b/drivers/video/fbdev/au1100fb.c
index 7c9a672e9811..d555a78df5c6 100644
--- a/drivers/video/fbdev/au1100fb.c
+++ b/drivers/video/fbdev/au1100fb.c
@@ -501,7 +501,7 @@ static int au1100fb_drv_probe(struct platform_device *dev)
         fbdev->info.fix = au1100fb_fix;
 
         fbdev->info.pseudo_palette =
-                devm_kzalloc(&dev->dev, sizeof(u32) * 16, GFP_KERNEL);
+                devm_kcalloc(&dev->dev, 16, sizeof(u32), GFP_KERNEL);
         if (!fbdev->info.pseudo_palette)
                 return -ENOMEM;
 
diff --git a/drivers/video/fbdev/broadsheetfb.c b/drivers/video/fbdev/broadsheetfb.c
index 9f9a7bef1ff6..d6ba348deb9f 100644
--- a/drivers/video/fbdev/broadsheetfb.c
+++ b/drivers/video/fbdev/broadsheetfb.c
@@ -617,7 +617,7 @@ static int broadsheet_spiflash_rewrite_sector(struct broadsheetfb_par *par,
         int tail_start_addr;
         int start_sector_addr;
 
-        sector_buffer = kzalloc(sizeof(char)*sector_size, GFP_KERNEL);
+        sector_buffer = kzalloc(sector_size, GFP_KERNEL);
         if (!sector_buffer)
                 return -ENOMEM;
 
diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index 790900d646c0..ca935c09a261 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -269,7 +269,7 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
         if (attribute) {
                 u8 *dst;
 
-                dst = kmalloc(w * vc->vc_font.height, GFP_ATOMIC);
+                dst = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
                 if (!dst)
                         return;
                 kfree(ops->cursor_data);
@@ -312,7 +312,7 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
             vc->vc_cursor_type != ops->p->cursor_shape ||
             ops->cursor_state.mask == NULL ||
             ops->cursor_reset) {
-                char *mask = kmalloc(w*vc->vc_font.height, GFP_ATOMIC);
+                char *mask = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
                 int cur_height, size, i = 0;
                 u8 msk = 0xff;
 
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 3e330e0f56ed..c910e74d46ff 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -591,7 +591,8 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info,
                 if (scr_readw(r) != vc->vc_video_erase_char)
                         break;
         if (r != q && new_rows >= rows + logo_lines) {
-                save = kmalloc(logo_lines * new_cols * 2, GFP_KERNEL);
+                save = kmalloc(array3_size(logo_lines, new_cols, 2),
+                               GFP_KERNEL);
                 if (save) {
                         int i = cols < new_cols ? cols : new_cols;
                         scr_memsetw(save, erase, logo_lines * new_cols * 2);
diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c
index 37a8b0b22566..dfa9a8aa4509 100644
--- a/drivers/video/fbdev/core/fbcon_ccw.c
+++ b/drivers/video/fbdev/core/fbcon_ccw.c
@@ -258,7 +258,7 @@ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
         if (attribute) {
                 u8 *dst;
 
-                dst = kmalloc(w * vc->vc_font.width, GFP_ATOMIC);
+                dst = kmalloc_array(w, vc->vc_font.width, GFP_ATOMIC);
                 if (!dst)
                         return;
                 kfree(ops->cursor_data);
@@ -304,14 +304,15 @@ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
             vc->vc_cursor_type != ops->p->cursor_shape ||
             ops->cursor_state.mask == NULL ||
             ops->cursor_reset) {
-                char *tmp, *mask = kmalloc(w*vc->vc_font.width, GFP_ATOMIC);
+                char *tmp, *mask = kmalloc_array(w, vc->vc_font.width,
+                                                 GFP_ATOMIC);
                 int cur_height, size, i = 0;
                 int width = (vc->vc_font.width + 7)/8;
 
                 if (!mask)
                         return;
 
-                tmp = kmalloc(width * vc->vc_font.height, GFP_ATOMIC);
+                tmp = kmalloc_array(width, vc->vc_font.height, GFP_ATOMIC);
 
                 if (!tmp) {
                         kfree(mask);
diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c
index 1888f8c866e8..ce08251bfd38 100644
--- a/drivers/video/fbdev/core/fbcon_cw.c
+++ b/drivers/video/fbdev/core/fbcon_cw.c
@@ -241,7 +241,7 @@ static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
         if (attribute) {
                 u8 *dst;
 
-                dst = kmalloc(w * vc->vc_font.width, GFP_ATOMIC);
+                dst = kmalloc_array(w, vc->vc_font.width, GFP_ATOMIC);
                 if (!dst)
                         return;
                 kfree(ops->cursor_data);
@@ -287,14 +287,15 @@ static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
             vc->vc_cursor_type != ops->p->cursor_shape ||
             ops->cursor_state.mask == NULL ||
             ops->cursor_reset) {
-                char *tmp, *mask = kmalloc(w*vc->vc_font.width, GFP_ATOMIC);
+                char *tmp, *mask = kmalloc_array(w, vc->vc_font.width,
+                                                 GFP_ATOMIC);
                 int cur_height, size, i = 0;
                 int width = (vc->vc_font.width + 7)/8;
 
                 if (!mask)
                         return;
 
-                tmp = kmalloc(width * vc->vc_font.height, GFP_ATOMIC);
+                tmp = kmalloc_array(width, vc->vc_font.height, GFP_ATOMIC);
 
                 if (!tmp) {
                         kfree(mask);
diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c
index 8a51e4d95cc5..c0d445294aa7 100644
--- a/drivers/video/fbdev/core/fbcon_rotate.c
+++ b/drivers/video/fbdev/core/fbcon_rotate.c
@@ -46,7 +46,7 @@ static int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc)
                 info->fbops->fb_sync(info);
 
         if (ops->fd_size < d_cellsize * len) {
-                dst = kmalloc(d_cellsize * len, GFP_KERNEL);
+                dst = kmalloc_array(len, d_cellsize, GFP_KERNEL);
 
                 if (dst == NULL) {
                         err = -ENOMEM;
diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c
index f98eee263597..1936afc78fec 100644
--- a/drivers/video/fbdev/core/fbcon_ud.c
+++ b/drivers/video/fbdev/core/fbcon_ud.c
@@ -289,7 +289,7 @@ static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode,
         if (attribute) {
                 u8 *dst;
 
-                dst = kmalloc(w * vc->vc_font.height, GFP_ATOMIC);
+                dst = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
                 if (!dst)
                         return;
                 kfree(ops->cursor_data);
@@ -335,7 +335,7 @@ static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode,
             vc->vc_cursor_type != ops->p->cursor_shape ||
             ops->cursor_state.mask == NULL ||
             ops->cursor_reset) {
-                char *mask = kmalloc(w*vc->vc_font.height, GFP_ATOMIC);
+                char *mask = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
                 int cur_height, size, i = 0;
                 u8 msk = 0xff;
 
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 924d0730ffe2..609438d2465b 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -489,7 +489,8 @@ static int fb_show_logo_line(struct fb_info *info, int rotate,
         }
 
         if (fb_logo.depth <= 4) {
-                logo_new = kmalloc(logo->width * logo->height, GFP_KERNEL);
+                logo_new = kmalloc_array(logo->width, logo->height,
+                                         GFP_KERNEL);
                 if (logo_new == NULL) {
                         kfree(palette);
                         if (saved_pseudo_palette)
@@ -506,8 +507,8 @@ static int fb_show_logo_line(struct fb_info *info, int rotate,
         image.height = logo->height;
 
         if (rotate) {
-                logo_rotate = kmalloc(logo->width *
-                                      logo->height, GFP_KERNEL);
+                logo_rotate = kmalloc_array(logo->width, logo->height,
+                                            GFP_KERNEL);
                 if (logo_rotate)
                         fb_rotate_logo(info, logo_rotate, &image, rotate);
         }
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index 2b2d67328514..852d86c1c527 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -620,7 +620,7 @@ static struct fb_videomode *fb_create_modedb(unsigned char *edid, int *dbsize,
         int num = 0, i, first = 1;
         int ver, rev;
 
-        mode = kzalloc(50 * sizeof(struct fb_videomode), GFP_KERNEL);
+        mode = kcalloc(50, sizeof(struct fb_videomode), GFP_KERNEL);
         if (mode == NULL)
                 return NULL;
 
@@ -671,7 +671,7 @@ static struct fb_videomode *fb_create_modedb(unsigned char *edid, int *dbsize,
         }
 
         *dbsize = num;
-        m = kmalloc(num * sizeof(struct fb_videomode), GFP_KERNEL);
+        m = kmalloc_array(num, sizeof(struct fb_videomode), GFP_KERNEL);
         if (!m)
                 return mode;
         memmove(m, mode, num * sizeof(struct fb_videomode));
@@ -1055,8 +1055,9 @@ void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs)
         if (!(num + svd_n))
                 return;
 
-        m = kzalloc((specs->modedb_len + num + svd_n) *
-                       sizeof(struct fb_videomode), GFP_KERNEL);
+        m = kcalloc(specs->modedb_len + num + svd_n,
+                    sizeof(struct fb_videomode),
+                    GFP_KERNEL);
 
         if (!m)
                 return;
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index ba82f97fb42b..c4eb8661f751 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -662,7 +662,7 @@ static int imxfb_init_fbinfo(struct platform_device *pdev)
 
         pr_debug("%s\n",__func__);
 
-        info->pseudo_palette = kmalloc(sizeof(u32) * 16, GFP_KERNEL);
+        info->pseudo_palette = kmalloc_array(16, sizeof(u32), GFP_KERNEL);
         if (!info->pseudo_palette)
                 return -ENOMEM;
 
diff --git a/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
index fe92eed6da70..8dd296d257dd 100644
--- a/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
+++ b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
@@ -245,7 +245,7 @@ static void mb86290fb_imageblit(struct fb_info *info,
                 return;
         }
 
-        cmd = kmalloc(cmdlen * 4, GFP_DMA);
+        cmd = kmalloc_array(cmdlen, 4, GFP_DMA);
         if (!cmd)
                 return cfb_imageblit(info, image);
         cmdfn(cmd, step, dx, dy, width, height, fgcolor, bgcolor, image, info);
diff --git a/drivers/video/fbdev/mmp/fb/mmpfb.c b/drivers/video/fbdev/mmp/fb/mmpfb.c
index 92279e02dd94..f27697e07c55 100644
--- a/drivers/video/fbdev/mmp/fb/mmpfb.c
+++ b/drivers/video/fbdev/mmp/fb/mmpfb.c
@@ -493,8 +493,8 @@ static int modes_setup(struct mmpfb_info *fbi)
                 return 0;
         }
         /* put videomode list to info structure */
-        videomodes = kzalloc(sizeof(struct fb_videomode) * videomode_num,
-                        GFP_KERNEL);
+        videomodes = kcalloc(videomode_num, sizeof(struct fb_videomode),
+                             GFP_KERNEL);
         if (!videomodes) {
                 dev_err(fbi->dev, "can't malloc video modes\n");
                 return -ENOMEM;
diff --git a/drivers/video/fbdev/mxsfb.c b/drivers/video/fbdev/mxsfb.c
index 246bea3a7d9b..12c8bd1d24d5 100644
--- a/drivers/video/fbdev/mxsfb.c
+++ b/drivers/video/fbdev/mxsfb.c
@@ -931,7 +931,7 @@ static int mxsfb_probe(struct platform_device *pdev)
         if (IS_ERR(host->reg_lcd))
                 host->reg_lcd = NULL;
 
-        fb_info->pseudo_palette = devm_kzalloc(&pdev->dev, sizeof(u32) * 16,
+        fb_info->pseudo_palette = devm_kcalloc(&pdev->dev, 16, sizeof(u32),
                                                GFP_KERNEL);
         if (!fb_info->pseudo_palette) {
                 ret = -ENOMEM;
diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
index 418a2d0d06a9..2e50120bcfae 100644
--- a/drivers/video/fbdev/nvidia/nvidia.c
+++ b/drivers/video/fbdev/nvidia/nvidia.c
@@ -566,7 +566,7 @@ static int nvidiafb_cursor(struct fb_info *info, struct fb_cursor *cursor)
                 u8 *msk = (u8 *) cursor->mask;
                 u8 *src;
 
-                src = kmalloc(s_pitch * cursor->image.height, GFP_ATOMIC);
+                src = kmalloc_array(s_pitch, cursor->image.height, GFP_ATOMIC);
 
                 if (src) {
                         switch (cursor->rop) {
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/manager.c b/drivers/video/fbdev/omap2/omapfb/dss/manager.c
index 69f86d2cc274..d21c641e1f3c 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/manager.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/manager.c
@@ -42,8 +42,8 @@ int dss_init_overlay_managers(void)
 
         num_managers = dss_feat_get_num_mgrs();
 
-        managers = kzalloc(sizeof(struct omap_overlay_manager) * num_managers,
-                        GFP_KERNEL);
+        managers = kcalloc(num_managers, sizeof(struct omap_overlay_manager),
+                           GFP_KERNEL);
 
         BUG_ON(managers == NULL);
 
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/overlay.c b/drivers/video/fbdev/omap2/omapfb/dss/overlay.c
index d6c5d75d2ef8..be17a4785a5e 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/overlay.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/overlay.c
@@ -59,8 +59,8 @@ void dss_init_overlays(struct platform_device *pdev)
 
         num_overlays = dss_feat_get_num_ovls();
 
-        overlays = kzalloc(sizeof(struct omap_overlay) * num_overlays,
-                        GFP_KERNEL);
+        overlays = kcalloc(num_overlays, sizeof(struct omap_overlay),
+                           GFP_KERNEL);
 
         BUG_ON(overlays == NULL);
 
diff --git a/drivers/video/fbdev/omap2/omapfb/vrfb.c b/drivers/video/fbdev/omap2/omapfb/vrfb.c
index f346b02eee1d..f355ecfac3b1 100644
--- a/drivers/video/fbdev/omap2/omapfb/vrfb.c
+++ b/drivers/video/fbdev/omap2/omapfb/vrfb.c
@@ -359,8 +359,8 @@ static int __init vrfb_probe(struct platform_device *pdev)
 
         num_ctxs = pdev->num_resources - 1;
 
-        ctxs = devm_kzalloc(&pdev->dev,
-                        sizeof(struct vrfb_ctx) * num_ctxs,
+        ctxs = devm_kcalloc(&pdev->dev,
+                        num_ctxs, sizeof(struct vrfb_ctx),
                         GFP_KERNEL);
 
         if (!ctxs)
diff --git a/drivers/video/fbdev/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c
index a582d3ae7ac1..8a53d1de611d 100644
--- a/drivers/video/fbdev/pvr2fb.c
+++ b/drivers/video/fbdev/pvr2fb.c
@@ -682,7 +682,7 @@ static ssize_t pvr2fb_write(struct fb_info *info, const char *buf,
 
         nr_pages = (count + PAGE_SIZE - 1) >> PAGE_SHIFT;
 
-        pages = kmalloc(nr_pages * sizeof(struct page *), GFP_KERNEL);
+        pages = kmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL);
         if (!pages)
                 return -ENOMEM;
 
diff --git a/drivers/video/fbdev/riva/fbdev.c b/drivers/video/fbdev/riva/fbdev.c
index ff8282374f37..cc242ba057d3 100644
--- a/drivers/video/fbdev/riva/fbdev.c
+++ b/drivers/video/fbdev/riva/fbdev.c
@@ -1615,7 +1615,7 @@ static int rivafb_cursor(struct fb_info *info, struct fb_cursor *cursor)
                 u8 *msk = (u8 *) cursor->mask;
                 u8 *src;
                 
-                src = kmalloc(s_pitch * cursor->image.height, GFP_ATOMIC);
+                src = kmalloc_array(s_pitch, cursor->image.height, GFP_ATOMIC);
 
                 if (src) {
                         switch (cursor->rop) {
diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
index 73676eb0244a..440a6636d8f0 100644
--- a/drivers/video/fbdev/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
@@ -486,8 +486,9 @@ static int uvesafb_vbe_getmodes(struct uvesafb_ktask *task,
                 mode++;
         }
 
-        par->vbe_modes = kzalloc(sizeof(struct vbe_mode_ib) *
-                                par->vbe_modes_cnt, GFP_KERNEL);
+        par->vbe_modes = kcalloc(par->vbe_modes_cnt,
+                                 sizeof(struct vbe_mode_ib),
+                                 GFP_KERNEL);
         if (!par->vbe_modes)
                 return -ENOMEM;
 
@@ -858,7 +859,7 @@ static int uvesafb_vbe_init_mode(struct fb_info *info)
          * Convert the modelist into a modedb so that we can use it with
          * fb_find_mode().
          */
-        mode = kzalloc(i * sizeof(*mode), GFP_KERNEL);
+        mode = kcalloc(i, sizeof(*mode), GFP_KERNEL);
         if (mode) {
                 i = 0;
                 list_for_each(pos, &info->modelist) {
@@ -1044,7 +1045,8 @@ static int uvesafb_setcmap(struct fb_cmap *cmap, struct fb_info *info)
                     info->cmap.len || cmap->start < info->cmap.start)
                         return -EINVAL;
 
-                entries = kmalloc(sizeof(*entries) * cmap->len, GFP_KERNEL);
+                entries = kmalloc_array(cmap->len, sizeof(*entries),
+                                        GFP_KERNEL);
                 if (!entries)
                         return -ENOMEM;
 
diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
index 9b45125988fb..52f577b0669b 100644
--- a/drivers/video/fbdev/via/viafbdev.c
+++ b/drivers/video/fbdev/via/viafbdev.c
@@ -596,7 +596,8 @@ static int viafb_ioctl(struct fb_info *info, u_int cmd, u_long arg)
                 break;
 
         case VIAFB_GET_GAMMA_LUT:
-                viafb_gamma_table = kmalloc(256 * sizeof(u32), GFP_KERNEL);
+                viafb_gamma_table = kmalloc_array(256, sizeof(u32),
+                                                  GFP_KERNEL);
                 if (!viafb_gamma_table)
                         return -ENOMEM;
                 viafb_get_gamma_table(viafb_gamma_table);
diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c
index 035ff6e02894..696106ecdff0 100644
--- a/drivers/video/fbdev/w100fb.c
+++ b/drivers/video/fbdev/w100fb.c
@@ -693,7 +693,8 @@ int w100fb_probe(struct platform_device *pdev)
                 goto out;
         }
 
-        info->pseudo_palette = kmalloc(sizeof (u32) * MAX_PALETTES, GFP_KERNEL);
+        info->pseudo_palette = kmalloc_array(MAX_PALETTES, sizeof(u32),
+                                             GFP_KERNEL);
         if (!info->pseudo_palette) {
                 err = -ENOMEM;
                 goto out;
diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c
index 46f63960fa9e..6a4bbc9e1fb0 100644
--- a/drivers/video/fbdev/xen-fbfront.c
+++ b/drivers/video/fbdev/xen-fbfront.c
@@ -412,7 +412,7 @@ static int xenfb_probe(struct xenbus_device *dev,
 
         info->nr_pages = (fb_size + PAGE_SIZE - 1) >> PAGE_SHIFT;
 
-        info->gfns = vmalloc(sizeof(unsigned long) * info->nr_pages);
+        info->gfns = vmalloc(array_size(sizeof(unsigned long), info->nr_pages));
         if (!info->gfns)
                 goto error_nomem;
 
diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
index 83b8963c9657..5244e93ceafc 100644
--- a/drivers/video/of_display_timing.c
+++ b/drivers/video/of_display_timing.c
@@ -181,8 +181,9 @@ struct display_timings *of_get_display_timings(const struct device_node *np)
                 goto entryfail;
         }
 
-        disp->timings = kzalloc(sizeof(struct display_timing *) *
-                                disp->num_timings, GFP_KERNEL);
+        disp->timings = kcalloc(disp->num_timings,
+                                sizeof(struct display_timing *),
+                                GFP_KERNEL);
         if (!disp->timings) {
                 pr_err("%pOF: could not allocate timings array\n", np);
                 goto entryfail;
diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
index 4e05d7f711fe..8ba726e600e9 100644
--- a/drivers/virt/fsl_hypervisor.c
+++ b/drivers/virt/fsl_hypervisor.c
@@ -223,7 +223,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
          * 'pages' is an array of struct page pointers that's initialized by
          * get_user_pages().
          */
-        pages = kzalloc(num_pages * sizeof(struct page *), GFP_KERNEL);
+        pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
         if (!pages) {
                 pr_debug("fsl-hv: could not allocate page list\n");
                 return -ENOMEM;
diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
index 2f3856a95856..3093655c7b92 100644
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -69,7 +69,7 @@ static void vbg_guest_mappings_init(struct vbg_dev *gdev)
         /* Add 4M so that we can align the vmap to 4MiB as the host requires. */
         size = PAGE_ALIGN(req->hypervisor_size) + SZ_4M;
 
-        pages = kmalloc(sizeof(*pages) * (size >> PAGE_SHIFT), GFP_KERNEL);
+        pages = kmalloc_array(size >> PAGE_SHIFT, sizeof(*pages), GFP_KERNEL);
         if (!pages)
                 goto out;
 
@@ -262,8 +262,9 @@ static int vbg_balloon_inflate(struct vbg_dev *gdev, u32 chunk_idx)
         struct page **pages;
         int i, rc, ret;
 
-        pages = kmalloc(sizeof(*pages) * VMMDEV_MEMORY_BALLOON_CHUNK_PAGES,
-                        GFP_KERNEL | __GFP_NOWARN);
+        pages = kmalloc_array(VMMDEV_MEMORY_BALLOON_CHUNK_PAGES,
+                              sizeof(*pages),
+                              GFP_KERNEL | __GFP_NOWARN);
         if (!pages)
                 return -ENOMEM;
 
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 48d4d1cf1cb6..b563a4499cc8 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -113,12 +113,13 @@ static int vp_request_msix_vectors(struct virtio_device *vdev, int nvectors,
 
         vp_dev->msix_vectors = nvectors;
 
-        vp_dev->msix_names = kmalloc(nvectors * sizeof *vp_dev->msix_names,
-                                     GFP_KERNEL);
+        vp_dev->msix_names = kmalloc_array(nvectors,
+                                           sizeof(*vp_dev->msix_names),
+                                           GFP_KERNEL);
         if (!vp_dev->msix_names)
                 goto error;
         vp_dev->msix_affinity_masks
-                = kzalloc(nvectors * sizeof *vp_dev->msix_affinity_masks,
+                = kcalloc(nvectors, sizeof(*vp_dev->msix_affinity_masks),
                           GFP_KERNEL);
         if (!vp_dev->msix_affinity_masks)
                 goto error;
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 21d464a29cf8..814b395007b2 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -247,7 +247,7 @@ static struct vring_desc *alloc_indirect(struct virtqueue *_vq,
          */
         gfp &= ~__GFP_HIGHMEM;
 
-        desc = kmalloc(total_sg * sizeof(struct vring_desc), gfp);
+        desc = kmalloc_array(total_sg, sizeof(struct vring_desc), gfp);
         if (!desc)
                 return NULL;
 
diff --git a/drivers/xen/arm-device.c b/drivers/xen/arm-device.c
index 85dd20e05726..3e789c77f568 100644
--- a/drivers/xen/arm-device.c
+++ b/drivers/xen/arm-device.c
@@ -70,9 +70,9 @@ static int xen_map_device_mmio(const struct resource *resources,
                 if ((resource_type(r) != IORESOURCE_MEM) || (nr == 0))
                         continue;
 
-                gpfns = kzalloc(sizeof(xen_pfn_t) * nr, GFP_KERNEL);
-                idxs = kzalloc(sizeof(xen_ulong_t) * nr, GFP_KERNEL);
-                errs = kzalloc(sizeof(int) * nr, GFP_KERNEL);
+                gpfns = kcalloc(nr, sizeof(xen_pfn_t), GFP_KERNEL);
+                idxs = kcalloc(nr, sizeof(xen_ulong_t), GFP_KERNEL);
+                errs = kcalloc(nr, sizeof(int), GFP_KERNEL);
                 if (!gpfns || !idxs || !errs) {
                         kfree(gpfns);
                         kfree(idxs);
diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index 8cac07ab60ab..6d1a5e58968f 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -322,7 +322,7 @@ static int evtchn_resize_ring(struct per_user_data *u)
         else
                 new_size = 2 * u->ring_size;
 
-        new_ring = kvmalloc(new_size * sizeof(*new_ring), GFP_KERNEL);
+        new_ring = kvmalloc_array(new_size, sizeof(*new_ring), GFP_KERNEL);
         if (!new_ring)
                 return -ENOMEM;
 
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 27be107d6480..2473b0a9e6e4 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1137,7 +1137,7 @@ static int gnttab_map(unsigned int start_idx, unsigned int end_idx)
         /* No need for kzalloc as it is initialized in following hypercall
          * GNTTABOP_setup_table.
          */
-        frames = kmalloc(nr_gframes * sizeof(unsigned long), GFP_ATOMIC);
+        frames = kmalloc_array(nr_gframes, sizeof(unsigned long), GFP_ATOMIC);
         if (!frames)
                 return -ENOMEM;
 
@@ -1300,8 +1300,9 @@ int gnttab_init(void)
         max_nr_glist_frames = (max_nr_grant_frames *
                                gnttab_interface->grefs_per_grant_frame / RPP);
 
-        gnttab_list = kmalloc(max_nr_glist_frames * sizeof(grant_ref_t *),
-                              GFP_KERNEL);
+        gnttab_list = kmalloc_array(max_nr_glist_frames,
+                                    sizeof(grant_ref_t *),
+                                    GFP_KERNEL);
         if (gnttab_list == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index ee2c891b55c6..ea4a08b83fa0 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -234,7 +234,7 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
         if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY))
                 return -ENXIO;
 
-        entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
+        entries = kmalloc_array(op->value, sizeof(*entries), GFP_KERNEL);
         if (entries == NULL)
                 return -ENOMEM;
 
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index ed4f8519b627..a9ef46f02354 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -100,7 +100,7 @@ static int build_path_from_dentry(struct v9fs_session_info *v9ses,
         for (ds = dentry; !IS_ROOT(ds); ds = ds->d_parent)
                 n++;
 
-        wnames = kmalloc(sizeof(char *) * n, GFP_KERNEL);
+        wnames = kmalloc_array(n, sizeof(char *), GFP_KERNEL);
         if (!wnames)
                 goto err_out;
 
diff --git a/fs/adfs/super.c b/fs/adfs/super.c
index cfda2c7caedc..71fa525d63a0 100644
--- a/fs/adfs/super.c
+++ b/fs/adfs/super.c
@@ -313,7 +313,7 @@ static struct adfs_discmap *adfs_read_map(struct super_block *sb, struct adfs_di
 
         asb->s_ids_per_zone = zone_size / (asb->s_idlen + 1);
 
-        dm = kmalloc(nzones * sizeof(*dm), GFP_KERNEL);
+        dm = kmalloc_array(nzones, sizeof(*dm), GFP_KERNEL);
         if (dm == NULL) {
                 adfs_error(sb, "not enough memory");
                 return ERR_PTR(-ENOMEM);
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index c332c95a6940..238fd28cfdd2 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -191,7 +191,8 @@ static int afs_deliver_cb_callback(struct afs_call *call)
                 if (call->count > AFSCBMAX)
                         return afs_protocol_error(call, -EBADMSG);
 
-                call->buffer = kmalloc(call->count * 3 * 4, GFP_KERNEL);
+                call->buffer = kmalloc(array3_size(call->count, 3, 4),
+                                       GFP_KERNEL);
                 if (!call->buffer)
                         return -ENOMEM;
                 call->offset = 0;
@@ -330,7 +331,7 @@ static int afs_deliver_cb_init_call_back_state3(struct afs_call *call)
         switch (call->unmarshall) {
         case 0:
                 call->offset = 0;
-                call->buffer = kmalloc(11 * sizeof(__be32), GFP_KERNEL);
+                call->buffer = kmalloc_array(11, sizeof(__be32), GFP_KERNEL);
                 if (!call->buffer)
                         return -ENOMEM;
                 call->unmarshall++;
@@ -453,7 +454,7 @@ static int afs_deliver_cb_probe_uuid(struct afs_call *call)
         switch (call->unmarshall) {
         case 0:
                 call->offset = 0;
-                call->buffer = kmalloc(11 * sizeof(__be32), GFP_KERNEL);
+                call->buffer = kmalloc_array(11, sizeof(__be32), GFP_KERNEL);
                 if (!call->buffer)
                         return -ENOMEM;
                 call->unmarshall++;
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 4ad6f669fe34..070b6184642d 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -2010,7 +2010,7 @@ static int elf_note_info_init(struct elf_note_info *info)
         INIT_LIST_HEAD(&info->thread_list);
 
         /* Allocate space for ELF notes */
-        info->notes = kmalloc(8 * sizeof(struct memelfnote), GFP_KERNEL);
+        info->notes = kmalloc_array(8, sizeof(struct memelfnote), GFP_KERNEL);
         if (!info->notes)
                 return 0;
         info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
@@ -2294,7 +2294,7 @@ static int elf_core_dump(struct coredump_params *cprm)
 
         if (segs - 1 > ULONG_MAX / sizeof(*vma_filesz))
                 goto end_coredump;
-        vma_filesz = vmalloc((segs - 1) * sizeof(*vma_filesz));
+        vma_filesz = vmalloc(array_size(sizeof(*vma_filesz), (segs - 1)));
         if (!vma_filesz)
                 goto end_coredump;
 
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index d90993adeffa..b53bb3729ac1 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -1600,7 +1600,8 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
         psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
         if (!psinfo)
                 goto cleanup;
-        notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote), GFP_KERNEL);
+        notes = kmalloc_array(NUM_NOTES, sizeof(struct memelfnote),
+                              GFP_KERNEL);
         if (!notes)
                 goto cleanup;
         fpu = kmalloc(sizeof(*fpu), GFP_KERNEL);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 05e12aea2404..0dd87aaeb39a 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -205,7 +205,8 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
         if (nr_pages <= DIO_INLINE_BIO_VECS)
                 vecs = inline_vecs;
         else {
-                vecs = kmalloc(nr_pages * sizeof(struct bio_vec), GFP_KERNEL);
+                vecs = kmalloc_array(nr_pages, sizeof(struct bio_vec),
+                                     GFP_KERNEL);
                 if (!vecs)
                         return -ENOMEM;
         }
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index dc062b195c46..a3fdb4fe967d 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -1603,8 +1603,8 @@ static int btrfsic_read_block(struct btrfsic_state *state,
 
         num_pages = (block_ctx->len + (u64)PAGE_SIZE - 1) >>
                     PAGE_SHIFT;
-        block_ctx->mem_to_free = kzalloc((sizeof(*block_ctx->datav) +
-                                          sizeof(*block_ctx->pagev)) *
+        block_ctx->mem_to_free = kcalloc(sizeof(*block_ctx->datav) +
+                                                sizeof(*block_ctx->pagev),
                                          num_pages, GFP_NOFS);
         if (!block_ctx->mem_to_free)
                 return -ENOMEM;
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 5f7ad3d0df2e..c9cb2f33a6d6 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -370,7 +370,7 @@ static int start_read(struct inode *inode, struct ceph_rw_context *rw_ctx,
 
         /* build page vector */
         nr_pages = calc_pages_for(0, len);
-        pages = kmalloc(sizeof(*pages) * nr_pages, GFP_KERNEL);
+        pages = kmalloc_array(nr_pages, sizeof(*pages), GFP_KERNEL);
         if (!pages) {
                 ret = -ENOMEM;
                 goto out_put;
@@ -966,8 +966,9 @@ get_more_pages:
 
                                 BUG_ON(pages);
                                 max_pages = calc_pages_for(0, (u64)len);
-                                pages = kmalloc(max_pages * sizeof (*pages),
-                                                GFP_NOFS);
+                                pages = kmalloc_array(max_pages,
+                                                      sizeof(*pages),
+                                                      GFP_NOFS);
                                 if (!pages) {
                                         pool = fsc->wb_pagevec_pool;
                                         pages = mempool_alloc(pool, GFP_NOFS);
@@ -1113,8 +1114,8 @@ new_request:
 
                         /* allocate new pages array for next request */
                         data_pages = pages;
-                        pages = kmalloc(locked_pages * sizeof (*pages),
-                                        GFP_NOFS);
+                        pages = kmalloc_array(locked_pages, sizeof(*pages),
+                                              GFP_NOFS);
                         if (!pages) {
                                 pool = fsc->wb_pagevec_pool;
                                 pages = mempool_alloc(pool, GFP_NOFS);
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 5ece2e6ad154..cf8d24812cc0 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2992,8 +2992,9 @@ encode_again:
                         num_flock_locks = 0;
                 }
                 if (num_fcntl_locks + num_flock_locks > 0) {
-                        flocks = kmalloc((num_fcntl_locks + num_flock_locks) *
-                                         sizeof(struct ceph_filelock), GFP_NOFS);
+                        flocks = kmalloc_array(num_fcntl_locks + num_flock_locks,
+                                               sizeof(struct ceph_filelock),
+                                               GFP_NOFS);
                         if (!flocks) {
                                 err = -ENOMEM;
                                 goto out_free;
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index a3b56544c21b..3d19595eb352 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -428,7 +428,7 @@ asn1_oid_decode(struct asn1_ctx *ctx,
         if (size < 2 || size > UINT_MAX/sizeof(unsigned long))
                 return 0;
 
-        *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
+        *oid = kmalloc_array(size, sizeof(unsigned long), GFP_ATOMIC);
         if (*oid == NULL)
                 return 0;
 
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 13a8a77322c9..1d377b7f2860 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -747,8 +747,8 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
 
                 if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *))
                         return;
-                ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
-                                GFP_KERNEL);
+                ppace = kmalloc_array(num_aces, sizeof(struct cifs_ace *),
+                                      GFP_KERNEL);
                 if (!ppace)
                         return;
 
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 5aca336642c0..42329b25877d 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -2077,7 +2077,7 @@ struct cifs_writedata *
 cifs_writedata_alloc(unsigned int nr_pages, work_func_t complete)
 {
         struct page **pages =
-                kzalloc(sizeof(struct page *) * nr_pages, GFP_NOFS);
+                kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS);
         if (pages)
                 return cifs_writedata_direct_alloc(pages, complete);
 
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 87eece6fbd48..8d41ca7bfcf1 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2900,7 +2900,7 @@ static struct cifs_readdata *
 cifs_readdata_alloc(unsigned int nr_pages, work_func_t complete)
 {
         struct page **pages =
-                kzalloc(sizeof(struct page *) * nr_pages, GFP_KERNEL);
+                kcalloc(nr_pages, sizeof(struct page *), GFP_KERNEL);
         struct cifs_readdata *ret = NULL;
 
         if (pages) {
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 745fd7fe8d0e..a94071c7b408 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1792,7 +1792,7 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
                  * with unix extensions enabled.
                  */
                 info_buf_source =
-                        kmalloc(2 * sizeof(FILE_UNIX_BASIC_INFO),
+                        kmalloc_array(2, sizeof(FILE_UNIX_BASIC_INFO),
                                         GFP_KERNEL);
                 if (info_buf_source == NULL) {
                         rc = -ENOMEM;
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index f90d4ad6624c..af29ade195c0 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -789,7 +789,7 @@ setup_aio_ctx_iter(struct cifs_aio_ctx *ctx, struct iov_iter *iter, int rw)
                                    GFP_KERNEL);
 
         if (!bv) {
-                bv = vmalloc(max_pages * sizeof(struct bio_vec));
+                bv = vmalloc(array_size(max_pages, sizeof(struct bio_vec)));
                 if (!bv)
                         return -ENOMEM;
         }
@@ -799,7 +799,7 @@ setup_aio_ctx_iter(struct cifs_aio_ctx *ctx, struct iov_iter *iter, int rw)
                                       GFP_KERNEL);
 
         if (!pages) {
-                pages = vmalloc(max_pages * sizeof(struct page *));
+                pages = vmalloc(array_size(max_pages, sizeof(struct page *)));
                 if (!pages) {
                         kvfree(bv);
                         return -ENOMEM;
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 48e2004c75fb..af032e1a3eac 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3471,7 +3471,7 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
         if (!num)
                 return -EINVAL;
 
-        iov = kmalloc(sizeof(struct kvec) * num, GFP_KERNEL);
+        iov = kmalloc_array(num, sizeof(struct kvec), GFP_KERNEL);
         if (!iov)
                 return -ENOMEM;
 
@@ -3535,7 +3535,7 @@ SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon,
         int rc;
         int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
 
-        data = kmalloc(sizeof(void *) * 2, GFP_KERNEL);
+        data = kmalloc_array(2, sizeof(void *), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
@@ -3583,7 +3583,7 @@ SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon,
         int rc;
         int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
 
-        data = kmalloc(sizeof(void *) * 2, GFP_KERNEL);
+        data = kmalloc_array(2, sizeof(void *), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 24887a0898c0..1f1a68f89110 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -844,8 +844,8 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses,
         int rc;
 
         if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
-                new_iov = kmalloc(sizeof(struct kvec) * (n_vec + 1),
-                                  GFP_KERNEL);
+                new_iov = kmalloc_array(n_vec + 1, sizeof(struct kvec),
+                                        GFP_KERNEL);
                 if (!new_iov) {
                         /* otherwise cifs_send_recv below sets resp_buf_type */
                         *resp_buf_type = CIFS_NO_BUFFER;
@@ -886,8 +886,8 @@ smb2_send_recv(const unsigned int xid, struct cifs_ses *ses,
         __be32 rfc1002_marker;
 
         if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
-                new_iov = kmalloc(sizeof(struct kvec) * (n_vec + 1),
-                                  GFP_KERNEL);
+                new_iov = kmalloc_array(n_vec + 1, sizeof(struct kvec),
+                                        GFP_KERNEL);
                 if (!new_iov)
                         return -ENOMEM;
         } else
diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
index 78a7c855b06b..5ba94be006ee 100644
--- a/fs/dlm/lockspace.c
+++ b/fs/dlm/lockspace.c
@@ -517,7 +517,7 @@ static int new_lockspace(const char *name, const char *cluster,
         size = dlm_config.ci_rsbtbl_size;
         ls->ls_rsbtbl_size = size;
 
-        ls->ls_rsbtbl = vmalloc(sizeof(struct dlm_rsbtable) * size);
+        ls->ls_rsbtbl = vmalloc(array_size(size, sizeof(struct dlm_rsbtable)));
         if (!ls->ls_rsbtbl)
                 goto out_lsfree;
         for (i = 0; i < size; i++) {
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 0ac62811b341..5f81fcd383a4 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -110,8 +110,8 @@ static int pcol_try_alloc(struct page_collect *pcol)
         pages =  exofs_max_io_pages(&pcol->sbi->layout, pcol->expected_pages);
 
         for (; pages; pages >>= 1) {
-                pcol->pages = kmalloc(pages * sizeof(struct page *),
-                                      GFP_KERNEL);
+                pcol->pages = kmalloc_array(pages, sizeof(struct page *),
+                                            GFP_KERNEL);
                 if (likely(pcol->pages)) {
                         pcol->alloc_pages = pages;
                         return 0;
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index c09289a42dc5..25ab1274090f 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1082,7 +1082,9 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
                                         / EXT2_BLOCKS_PER_GROUP(sb)) + 1;
         db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) /
                    EXT2_DESC_PER_BLOCK(sb);
-        sbi->s_group_desc = kmalloc (db_count * sizeof (struct buffer_head *), GFP_KERNEL);
+        sbi->s_group_desc = kmalloc_array (db_count,
+                                           sizeof(struct buffer_head *),
+                                           GFP_KERNEL);
         if (sbi->s_group_desc == NULL) {
                 ext2_msg(sb, KERN_ERR, "error: not enough memory");
                 goto failed_mount;
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index c969275ce3ee..0057fe3f248d 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -577,7 +577,7 @@ int ext4_ext_precache(struct inode *inode)
         down_read(&ei->i_data_sem);
         depth = ext_depth(inode);
 
-        path = kzalloc(sizeof(struct ext4_ext_path) * (depth + 1),
+        path = kcalloc(depth + 1, sizeof(struct ext4_ext_path),
                        GFP_NOFS);
         if (path == NULL) {
                 up_read(&ei->i_data_sem);
@@ -879,7 +879,7 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block,
         }
         if (!path) {
                 /* account possible depth increase */
-                path = kzalloc(sizeof(struct ext4_ext_path) * (depth + 2),
+                path = kcalloc(depth + 2, sizeof(struct ext4_ext_path),
                                 GFP_NOFS);
                 if (unlikely(!path))
                         return ERR_PTR(-ENOMEM);
@@ -1063,7 +1063,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
          * We need this to handle errors and free blocks
          * upon them.
          */
-        ablocks = kzalloc(sizeof(ext4_fsblk_t) * depth, GFP_NOFS);
+        ablocks = kcalloc(depth, sizeof(ext4_fsblk_t), GFP_NOFS);
         if (!ablocks)
                 return -ENOMEM;
 
@@ -2921,7 +2921,7 @@ again:
                         path[k].p_block =
                                 le16_to_cpu(path[k].p_hdr->eh_entries)+1;
         } else {
-                path = kzalloc(sizeof(struct ext4_ext_path) * (depth + 1),
+                path = kcalloc(depth + 1, sizeof(struct ext4_ext_path),
                                GFP_NOFS);
                 if (path == NULL) {
                         ext4_journal_stop(handle);
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index d792b7689d92..e5fb38451a73 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -204,12 +204,14 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)
                 goto out2;
         flex_gd->count = flexbg_size;
 
-        flex_gd->groups = kmalloc(sizeof(struct ext4_new_group_data) *
-                                  flexbg_size, GFP_NOFS);
+        flex_gd->groups = kmalloc_array(flexbg_size,
+                                        sizeof(struct ext4_new_group_data),
+                                        GFP_NOFS);
         if (flex_gd->groups == NULL)
                 goto out2;
 
-        flex_gd->bg_flags = kmalloc(flexbg_size * sizeof(__u16), GFP_NOFS);
+        flex_gd->bg_flags = kmalloc_array(flexbg_size, sizeof(__u16),
+                                          GFP_NOFS);
         if (flex_gd->bg_flags == NULL)
                 goto out1;
 
@@ -969,7 +971,7 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
         int res, i;
         int err;
 
-        primary = kmalloc(reserved_gdb * sizeof(*primary), GFP_NOFS);
+        primary = kmalloc_array(reserved_gdb, sizeof(*primary), GFP_NOFS);
         if (!primary)
                 return -ENOMEM;
 
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 00fe75a71c4b..0c4c2201b3aa 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3993,9 +3993,9 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                         goto failed_mount;
                 }
         }
-        sbi->s_group_desc = kvmalloc(db_count *
-                                          sizeof(struct buffer_head *),
-                                          GFP_KERNEL);
+        sbi->s_group_desc = kvmalloc_array(db_count,
+                                           sizeof(struct buffer_head *),
+                                           GFP_KERNEL);
         if (sbi->s_group_desc == NULL) {
                 ext4_msg(sb, KERN_ERR, "not enough memory");
                 ret = -ENOMEM;
diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index 9624a8f7254b..9f1c96caebda 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -806,7 +806,8 @@ int f2fs_get_valid_checkpoint(struct f2fs_sb_info *sbi)
         block_t cp_blk_no;
         int i;
 
-        sbi->ckpt = f2fs_kzalloc(sbi, cp_blks * blk_size, GFP_KERNEL);
+        sbi->ckpt = f2fs_kzalloc(sbi, array_size(blk_size, cp_blks),
+                                 GFP_KERNEL);
         if (!sbi->ckpt)
                 return -ENOMEM;
         /*
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 13f2f6845e87..cadb425c02d7 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1122,12 +1122,14 @@ static int __exchange_data_block(struct inode *src_inode,
                 olen = min((pgoff_t)4 * ADDRS_PER_BLOCK, len);
 
                 src_blkaddr = f2fs_kvzalloc(F2FS_I_SB(src_inode),
-                                        sizeof(block_t) * olen, GFP_KERNEL);
+                                        array_size(olen, sizeof(block_t)),
+                                        GFP_KERNEL);
                 if (!src_blkaddr)
                         return -ENOMEM;
 
                 do_replace = f2fs_kvzalloc(F2FS_I_SB(src_inode),
-                                        sizeof(int) * olen, GFP_KERNEL);
+                                        array_size(olen, sizeof(int)),
+                                        GFP_KERNEL);
                 if (!do_replace) {
                         kvfree(src_blkaddr);
                         return -ENOMEM;
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 47d0e64a95a8..10643b11bd59 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -2753,8 +2753,10 @@ static int init_free_nid_cache(struct f2fs_sb_info *sbi)
         struct f2fs_nm_info *nm_i = NM_I(sbi);
         int i;
 
-        nm_i->free_nid_bitmap = f2fs_kzalloc(sbi, nm_i->nat_blocks *
-                                sizeof(unsigned char *), GFP_KERNEL);
+        nm_i->free_nid_bitmap =
+                f2fs_kzalloc(sbi, array_size(sizeof(unsigned char *),
+                                             nm_i->nat_blocks),
+                             GFP_KERNEL);
         if (!nm_i->free_nid_bitmap)
                 return -ENOMEM;
 
@@ -2770,8 +2772,10 @@ static int init_free_nid_cache(struct f2fs_sb_info *sbi)
         if (!nm_i->nat_block_bitmap)
                 return -ENOMEM;
 
-        nm_i->free_nid_count = f2fs_kvzalloc(sbi, nm_i->nat_blocks *
-                                        sizeof(unsigned short), GFP_KERNEL);
+        nm_i->free_nid_count =
+                f2fs_kvzalloc(sbi, array_size(sizeof(unsigned short),
+                                              nm_i->nat_blocks),
+                              GFP_KERNEL);
         if (!nm_i->free_nid_count)
                 return -ENOMEM;
         return 0;
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 6dbdf2c48fba..9efce174c51a 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -3517,8 +3517,10 @@ static int build_sit_info(struct f2fs_sb_info *sbi)
 
         SM_I(sbi)->sit_info = sit_i;
 
-        sit_i->sentries = f2fs_kvzalloc(sbi, MAIN_SEGS(sbi) *
-                                        sizeof(struct seg_entry), GFP_KERNEL);
+        sit_i->sentries =
+                f2fs_kvzalloc(sbi, array_size(sizeof(struct seg_entry),
+                                              MAIN_SEGS(sbi)),
+                              GFP_KERNEL);
         if (!sit_i->sentries)
                 return -ENOMEM;
 
@@ -3558,8 +3560,10 @@ static int build_sit_info(struct f2fs_sb_info *sbi)
                 return -ENOMEM;
 
         if (sbi->segs_per_sec > 1) {
-                sit_i->sec_entries = f2fs_kvzalloc(sbi, MAIN_SECS(sbi) *
-                                        sizeof(struct sec_entry), GFP_KERNEL);
+                sit_i->sec_entries =
+                        f2fs_kvzalloc(sbi, array_size(sizeof(struct sec_entry),
+                                                      MAIN_SECS(sbi)),
+                                      GFP_KERNEL);
                 if (!sit_i->sec_entries)
                         return -ENOMEM;
         }
@@ -3635,7 +3639,8 @@ static int build_curseg(struct f2fs_sb_info *sbi)
         struct curseg_info *array;
         int i;
 
-        array = f2fs_kzalloc(sbi, sizeof(*array) * NR_CURSEG_TYPE, GFP_KERNEL);
+        array = f2fs_kzalloc(sbi, array_size(NR_CURSEG_TYPE, sizeof(*array)),
+                             GFP_KERNEL);
         if (!array)
                 return -ENOMEM;
 
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index e7441e8d1ff8..3995e926ba3a 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -2419,8 +2419,10 @@ static int init_blkz_info(struct f2fs_sb_info *sbi, int devi)
 
 #define F2FS_REPORT_NR_ZONES   4096
 
-        zones = f2fs_kzalloc(sbi, sizeof(struct blk_zone) *
-                                F2FS_REPORT_NR_ZONES, GFP_KERNEL);
+        zones = f2fs_kzalloc(sbi,
+                             array_size(F2FS_REPORT_NR_ZONES,
+                                        sizeof(struct blk_zone)),
+                             GFP_KERNEL);
         if (!zones)
                 return -ENOMEM;
 
@@ -2560,8 +2562,10 @@ static int f2fs_scan_devices(struct f2fs_sb_info *sbi)
          * Initialize multiple devices information, or single
          * zoned block device information.
          */
-        sbi->devs = f2fs_kzalloc(sbi, sizeof(struct f2fs_dev_info) *
-                                                max_devices, GFP_KERNEL);
+        sbi->devs = f2fs_kzalloc(sbi,
+                                 array_size(max_devices,
+                                            sizeof(struct f2fs_dev_info)),
+                                 GFP_KERNEL);
         if (!sbi->devs)
                 return -ENOMEM;
 
@@ -2783,9 +2787,11 @@ try_onemore:
                 int n = (i == META) ? 1: NR_TEMP_TYPE;
                 int j;
 
-                sbi->write_io[i] = f2fs_kmalloc(sbi,
-                                        n * sizeof(struct f2fs_bio_info),
-                                        GFP_KERNEL);
+                sbi->write_io[i] =
+                        f2fs_kmalloc(sbi,
+                                     array_size(n,
+                                                sizeof(struct f2fs_bio_info)),
+                                     GFP_KERNEL);
                 if (!sbi->write_io[i]) {
                         err = -ENOMEM;
                         goto free_options;
diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
index 4f4362d5a04c..d4e23f8ddcf6 100644
--- a/fs/fat/namei_vfat.c
+++ b/fs/fat/namei_vfat.c
@@ -664,7 +664,7 @@ static int vfat_add_entry(struct inode *dir, const struct qstr *qname,
         if (len == 0)
                 return -ENOENT;
 
-        slots = kmalloc(sizeof(*slots) * MSDOS_SLOTS, GFP_NOFS);
+        slots = kmalloc_array(MSDOS_SLOTS, sizeof(*slots), GFP_NOFS);
         if (slots == NULL)
                 return -ENOMEM;
 
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index e03ca14f40e9..c6b88fa85e2e 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -64,9 +64,12 @@ static struct fuse_req *__fuse_request_alloc(unsigned npages, gfp_t flags)
                         pages = req->inline_pages;
                         page_descs = req->inline_page_descs;
                 } else {
-                        pages = kmalloc(sizeof(struct page *) * npages, flags);
-                        page_descs = kmalloc(sizeof(struct fuse_page_desc) *
-                                             npages, flags);
+                        pages = kmalloc_array(npages, sizeof(struct page *),
+                                              flags);
+                        page_descs =
+                                kmalloc_array(npages,
+                                              sizeof(struct fuse_page_desc),
+                                              flags);
                 }
 
                 if (!pages || !page_descs) {
@@ -1359,7 +1362,8 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
         if (!fud)
                 return -EPERM;
 
-        bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
+        bufs = kmalloc_array(pipe->buffers, sizeof(struct pipe_buffer),
+                             GFP_KERNEL);
         if (!bufs)
                 return -ENOMEM;
 
@@ -1940,7 +1944,8 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
         if (!fud)
                 return -EPERM;
 
-        bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
+        bufs = kmalloc_array(pipe->buffers, sizeof(struct pipe_buffer),
+                             GFP_KERNEL);
         if (!bufs)
                 return -ENOMEM;
 
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index d9fb0ad6cc30..3090c445e8fc 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -1055,7 +1055,7 @@ static int dir_split_leaf(struct inode *inode, const struct qstr *name)
         /* Change the pointers.
            Don't bother distinguishing stuffed from non-stuffed.
            This code is complicated enough already. */
-        lp = kmalloc(half_len * sizeof(__be64), GFP_NOFS);
+        lp = kmalloc_array(half_len, sizeof(__be64), GFP_NOFS);
         if (!lp) {
                 error = -ENOMEM;
                 goto fail_brelse;
@@ -1169,7 +1169,7 @@ static int dir_double_exhash(struct gfs2_inode *dip)
         if (IS_ERR(hc))
                 return PTR_ERR(hc);
 
-        hc2 = kmalloc(hsize_bytes * 2, GFP_NOFS | __GFP_NOWARN);
+        hc2 = kmalloc_array(hsize_bytes, 2, GFP_NOFS | __GFP_NOWARN);
         if (hc2 == NULL)
                 hc2 = __vmalloc(hsize_bytes * 2, GFP_NOFS, PAGE_KERNEL);
 
@@ -1596,7 +1596,7 @@ int gfs2_dir_read(struct inode *inode, struct dir_context *ctx,
 
         error = -ENOMEM;
         /* 96 is max number of dirents which can be stuffed into an inode */
-        darr = kmalloc(96 * sizeof(struct gfs2_dirent *), GFP_NOFS);
+        darr = kmalloc_array(96, sizeof(struct gfs2_dirent *), GFP_NOFS);
         if (darr) {
                 g.pdent = (const struct gfs2_dirent **)darr;
                 g.offset = 0;
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 097bd3c0f270..4614ee25f621 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1303,7 +1303,8 @@ int gfs2_glock_nq_m(unsigned int num_gh, struct gfs2_holder *ghs)
         default:
                 if (num_gh <= 4)
                         break;
-                pph = kmalloc(num_gh * sizeof(struct gfs2_holder *), GFP_NOFS);
+                pph = kmalloc_array(num_gh, sizeof(struct gfs2_holder *),
+                                    GFP_NOFS);
                 if (!pph)
                         return -ENOMEM;
         }
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index e8585dfd209f..0efae7a0ee80 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -886,7 +886,7 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)
         gfs2_write_calc_reserv(ip, sizeof(struct gfs2_quota),
                               &data_blocks, &ind_blocks);
 
-        ghs = kmalloc(num_qd * sizeof(struct gfs2_holder), GFP_NOFS);
+        ghs = kmalloc_array(num_qd, sizeof(struct gfs2_holder), GFP_NOFS);
         if (!ghs)
                 return -ENOMEM;
 
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 6bc5cfe710d1..33abcf29bc05 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -2605,8 +2605,9 @@ void gfs2_rlist_alloc(struct gfs2_rgrp_list *rlist, unsigned int state)
 {
         unsigned int x;
 
-        rlist->rl_ghs = kmalloc(rlist->rl_rgrps * sizeof(struct gfs2_holder),
-                                GFP_NOFS | __GFP_NOFAIL);
+        rlist->rl_ghs = kmalloc_array(rlist->rl_rgrps,
+                                      sizeof(struct gfs2_holder),
+                                      GFP_NOFS | __GFP_NOFAIL);
         for (x = 0; x < rlist->rl_rgrps; x++)
                 gfs2_holder_init(rlist->rl_rgd[x]->rd_gl,
                                 state, 0,
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index cf5c7f3080d2..af0d5b01cf0b 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1097,7 +1097,7 @@ static int gfs2_statfs_slow(struct gfs2_sbd *sdp, struct gfs2_statfs_change_host
         int error = 0, err;
 
         memset(sc, 0, sizeof(struct gfs2_statfs_change_host));
-        gha = kmalloc(slots * sizeof(struct gfs2_holder), GFP_KERNEL);
+        gha = kmalloc_array(slots, sizeof(struct gfs2_holder), GFP_KERNEL);
         if (!gha)
                 return -ENOMEM;
         for (x = 0; x < slots; x++)
diff --git a/fs/hpfs/dnode.c b/fs/hpfs/dnode.c
index a4ad18afbdec..4ada525c5c43 100644
--- a/fs/hpfs/dnode.c
+++ b/fs/hpfs/dnode.c
@@ -33,7 +33,8 @@ int hpfs_add_pos(struct inode *inode, loff_t *pos)
                         if (hpfs_inode->i_rddir_off[i] == pos)
                                 return 0;
         if (!(i&0x0f)) {
-                if (!(ppos = kmalloc((i+0x11) * sizeof(loff_t*), GFP_NOFS))) {
+                ppos = kmalloc_array(i + 0x11, sizeof(loff_t *), GFP_NOFS);
+                if (!ppos) {
                         pr_err("out of memory for position list\n");
                         return -ENOMEM;
                 }
diff --git a/fs/hpfs/map.c b/fs/hpfs/map.c
index 7c49f1ef0c85..ecd9fccd1663 100644
--- a/fs/hpfs/map.c
+++ b/fs/hpfs/map.c
@@ -115,7 +115,7 @@ __le32 *hpfs_load_bitmap_directory(struct super_block *s, secno bmp)
         int n = (hpfs_sb(s)->sb_fs_size + 0x200000 - 1) >> 21;
         int i;
         __le32 *b;
-        if (!(b = kmalloc(n * 512, GFP_KERNEL))) {
+        if (!(b = kmalloc_array(n, 512, GFP_KERNEL))) {
                 pr_err("can't allocate memory for bitmap directory\n");
                 return NULL;
         }       
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index 240779e4689c..a1143e57a718 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -223,7 +223,7 @@ static struct jbd2_revoke_table_s *jbd2_journal_init_revoke_table(int hash_size)
         table->hash_size = hash_size;
         table->hash_shift = shift;
         table->hash_table =
-                kmalloc(hash_size * sizeof(struct list_head), GFP_KERNEL);
+                kmalloc_array(hash_size, sizeof(struct list_head), GFP_KERNEL);
         if (!table->hash_table) {
                 kmem_cache_free(jbd2_revoke_table_cache, table);
                 table = NULL;
diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c
index 7ebacf14837f..093ffbd82395 100644
--- a/fs/jffs2/acl.c
+++ b/fs/jffs2/acl.c
@@ -133,7 +133,8 @@ static void *jffs2_acl_to_medium(const struct posix_acl *acl, size_t *size)
         size_t i;
 
         *size = jffs2_acl_size(acl->a_count);
-        header = kmalloc(sizeof(*header) + acl->a_count * sizeof(*entry), GFP_KERNEL);
+        header = kmalloc(struct_size(header, a_entries, acl->a_count),
+                        GFP_KERNEL);
         if (!header)
                 return ERR_PTR(-ENOMEM);
         header->a_version = cpu_to_je32(JFFS2_ACL_VERSION);
diff --git a/fs/jffs2/acl.h b/fs/jffs2/acl.h
index 2e2b5745c3b7..12d0271bdde3 100644
--- a/fs/jffs2/acl.h
+++ b/fs/jffs2/acl.h
@@ -22,6 +22,7 @@ struct jffs2_acl_entry_short {
 
 struct jffs2_acl_header {
         jint32_t        a_version;
+        struct jffs2_acl_entry  a_entries[];
 };
 
 #ifdef CONFIG_JFFS2_FS_POSIX_ACL
diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
index 2cfe487708e0..c6821a509481 100644
--- a/fs/jffs2/wbuf.c
+++ b/fs/jffs2/wbuf.c
@@ -1208,7 +1208,7 @@ int jffs2_nand_flash_setup(struct jffs2_sb_info *c)
         if (!c->wbuf)
                 return -ENOMEM;
 
-        c->oobbuf = kmalloc(NR_OOB_SCAN_PAGES * c->oobavail, GFP_KERNEL);
+        c->oobbuf = kmalloc_array(NR_OOB_SCAN_PAGES, c->oobavail, GFP_KERNEL);
         if (!c->oobbuf) {
                 kfree(c->wbuf);
                 return -ENOMEM;
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 2d514c7affc2..49263e220dbc 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1641,7 +1641,7 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen)
         max_ranges = nblocks;
         do_div(max_ranges, minlen);
         range_cnt = min_t(u64, max_ranges + 1, 32 * 1024);
-        totrim = kmalloc(sizeof(struct range2trim) * range_cnt, GFP_NOFS);
+        totrim = kmalloc_array(range_cnt, sizeof(struct range2trim), GFP_NOFS);
         if (totrim == NULL) {
                 jfs_error(bmp->db_ipbmap->i_sb, "no memory for trim array\n");
                 IWRITE_UNLOCK(ipbmap);
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index de2bcb36e079..52bae3f5c914 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -594,7 +594,8 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
         struct component_name ciKey;
         struct super_block *sb = ip->i_sb;
 
-        ciKey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t), GFP_NOFS);
+        ciKey.name = kmalloc_array(JFS_NAME_MAX + 1, sizeof(wchar_t),
+                                   GFP_NOFS);
         if (!ciKey.name) {
                 rc = -ENOMEM;
                 goto dtSearch_Exit2;
@@ -957,7 +958,7 @@ static int dtSplitUp(tid_t tid,
         smp = split->mp;
         sp = DT_PAGE(ip, smp);
 
-        key.name = kmalloc((JFS_NAME_MAX + 2) * sizeof(wchar_t), GFP_NOFS);
+        key.name = kmalloc_array(JFS_NAME_MAX + 2, sizeof(wchar_t), GFP_NOFS);
         if (!key.name) {
                 DT_PUTPAGE(smp);
                 rc = -ENOMEM;
@@ -3779,12 +3780,12 @@ static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
         struct component_name lkey;
         struct component_name rkey;
 
-        lkey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t),
+        lkey.name = kmalloc_array(JFS_NAME_MAX + 1, sizeof(wchar_t),
                                         GFP_KERNEL);
         if (lkey.name == NULL)
                 return -ENOMEM;
 
-        rkey.name = kmalloc((JFS_NAME_MAX + 1) * sizeof(wchar_t),
+        rkey.name = kmalloc_array(JFS_NAME_MAX + 1, sizeof(wchar_t),
                                         GFP_KERNEL);
         if (rkey.name == NULL) {
                 kfree(lkey.name);
diff --git a/fs/jfs/jfs_unicode.c b/fs/jfs/jfs_unicode.c
index c7de6f5bbefc..0148e2e4d97a 100644
--- a/fs/jfs/jfs_unicode.c
+++ b/fs/jfs/jfs_unicode.c
@@ -121,7 +121,7 @@ int get_UCSname(struct component_name * uniName, struct dentry *dentry)
                 return -ENAMETOOLONG;
 
         uniName->name =
-            kmalloc((length + 1) * sizeof(wchar_t), GFP_NOFS);
+            kmalloc_array(length + 1, sizeof(wchar_t), GFP_NOFS);
 
         if (uniName->name == NULL)
                 return -ENOMEM;
diff --git a/fs/mbcache.c b/fs/mbcache.c
index bf41e2e72c18..081ccf0caee3 100644
--- a/fs/mbcache.c
+++ b/fs/mbcache.c
@@ -353,8 +353,9 @@ struct mb_cache *mb_cache_create(int bucket_bits)
         cache->c_max_entries = bucket_count << 4;
         INIT_LIST_HEAD(&cache->c_list);
         spin_lock_init(&cache->c_list_lock);
-        cache->c_hash = kmalloc(bucket_count * sizeof(struct hlist_bl_head),
-                                GFP_KERNEL);
+        cache->c_hash = kmalloc_array(bucket_count,
+                                      sizeof(struct hlist_bl_head),
+                                      GFP_KERNEL);
         if (!cache->c_hash) {
                 kfree(cache);
                 goto err_out;
diff --git a/fs/namei.c b/fs/namei.c
index 6df1f61855d6..2490ddb8bc90 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -537,12 +537,12 @@ static int __nd_alloc_stack(struct nameidata *nd)
         struct saved *p;
 
         if (nd->flags & LOOKUP_RCU) {
-                p= kmalloc(MAXSYMLINKS * sizeof(struct saved),
+                p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
                                   GFP_ATOMIC);
                 if (unlikely(!p))
                         return -ECHILD;
         } else {
-                p= kmalloc(MAXSYMLINKS * sizeof(struct saved),
+                p= kmalloc_array(MAXSYMLINKS, sizeof(struct saved),
                                   GFP_KERNEL);
                 if (unlikely(!p))
                         return -ENOMEM;
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 3ae038d9c292..d4a07acad598 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -461,7 +461,7 @@ ff_layout_alloc_lseg(struct pnfs_layout_hdr *lh,
                 fh_count = be32_to_cpup(p);
 
                 fls->mirror_array[i]->fh_versions =
-                        kzalloc(fh_count * sizeof(struct nfs_fh),
+                        kcalloc(fh_count, sizeof(struct nfs_fh),
                                 gfp_flags);
                 if (fls->mirror_array[i]->fh_versions == NULL) {
                         rc = -ENOMEM;
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index d62279d3fc5d..59aa04976331 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -99,7 +99,8 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
         version_count = be32_to_cpup(p);
         dprintk("%s: version count %d\n", __func__, version_count);
 
-        ds_versions = kzalloc(version_count * sizeof(struct nfs4_ff_ds_version),
+        ds_versions = kcalloc(version_count,
+                              sizeof(struct nfs4_ff_ds_version),
                               gfp_flags);
         if (!ds_versions)
                 goto out_scratch;
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 8ceb25a10ea0..a1143f7c2201 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -404,8 +404,9 @@ fsloc_parse(char **mesg, char *buf, struct nfsd4_fs_locations *fsloc)
         if (fsloc->locations_count == 0)
                 return 0;
 
-        fsloc->locations = kzalloc(fsloc->locations_count
-                        * sizeof(struct nfsd4_fs_location), GFP_KERNEL);
+        fsloc->locations = kcalloc(fsloc->locations_count,
+                                   sizeof(struct nfsd4_fs_location),
+                                   GFP_KERNEL);
         if (!fsloc->locations)
                 return -ENOMEM;
         for (i=0; i < fsloc->locations_count; i++) {
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 66eaeb1e8c2c..9c247fa1e959 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -510,8 +510,9 @@ nfs4_legacy_state_init(struct net *net)
         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
         int i;
 
-        nn->reclaim_str_hashtbl = kmalloc(sizeof(struct list_head) *
-                                          CLIENT_HASH_SIZE, GFP_KERNEL);
+        nn->reclaim_str_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
+                                                sizeof(struct list_head),
+                                                GFP_KERNEL);
         if (!nn->reclaim_str_hashtbl)
                 return -ENOMEM;
 
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 3b40d1b57613..857141446d6b 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1807,8 +1807,9 @@ static struct nfs4_client *alloc_client(struct xdr_netobj name)
         clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
         if (clp->cl_name.data == NULL)
                 goto err_no_name;
-        clp->cl_ownerstr_hashtbl = kmalloc(sizeof(struct list_head) *
-                        OWNER_HASH_SIZE, GFP_KERNEL);
+        clp->cl_ownerstr_hashtbl = kmalloc_array(OWNER_HASH_SIZE,
+                                                 sizeof(struct list_head),
+                                                 GFP_KERNEL);
         if (!clp->cl_ownerstr_hashtbl)
                 goto err_no_hashtbl;
         for (i = 0; i < OWNER_HASH_SIZE; i++)
@@ -7096,16 +7097,19 @@ static int nfs4_state_create_net(struct net *net)
         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
         int i;
 
-        nn->conf_id_hashtbl = kmalloc(sizeof(struct list_head) *
-                        CLIENT_HASH_SIZE, GFP_KERNEL);
+        nn->conf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
+                                            sizeof(struct list_head),
+                                            GFP_KERNEL);
         if (!nn->conf_id_hashtbl)
                 goto err;
-        nn->unconf_id_hashtbl = kmalloc(sizeof(struct list_head) *
-                        CLIENT_HASH_SIZE, GFP_KERNEL);
+        nn->unconf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
+                                              sizeof(struct list_head),
+                                              GFP_KERNEL);
         if (!nn->unconf_id_hashtbl)
                 goto err_unconf_id;
-        nn->sessionid_hashtbl = kmalloc(sizeof(struct list_head) *
-                        SESSION_HASH_SIZE, GFP_KERNEL);
+        nn->sessionid_hashtbl = kmalloc_array(SESSION_HASH_SIZE,
+                                              sizeof(struct list_head),
+                                              GFP_KERNEL);
         if (!nn->sessionid_hashtbl)
                 goto err_sessionid;
 
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 637f87c39183..dbdeb9d6af03 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -177,7 +177,8 @@ int nfsd_reply_cache_init(void)
 
         drc_hashtbl = kcalloc(hashsize, sizeof(*drc_hashtbl), GFP_KERNEL);
         if (!drc_hashtbl) {
-                drc_hashtbl = vzalloc(hashsize * sizeof(*drc_hashtbl));
+                drc_hashtbl = vzalloc(array_size(hashsize,
+                                                 sizeof(*drc_hashtbl)));
                 if (!drc_hashtbl)
                         goto out_nomem;
         }
diff --git a/fs/ntfs/compress.c b/fs/ntfs/compress.c
index f8eb04387ca4..fbd0090d7d0c 100644
--- a/fs/ntfs/compress.c
+++ b/fs/ntfs/compress.c
@@ -527,7 +527,7 @@ int ntfs_read_compressed_block(struct page *page)
         BUG_ON(ni->type != AT_DATA);
         BUG_ON(ni->name_len);
 
-        pages = kmalloc(nr_pages * sizeof(struct page *), GFP_NOFS);
+        pages = kmalloc_array(nr_pages, sizeof(struct page *), GFP_NOFS);
 
         /* Allocate memory to store the buffer heads we need. */
         bhs_size = cb_size / block_size * sizeof(struct buffer_head *);
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index e5076185cc1e..1296f78ae966 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1078,7 +1078,7 @@ int o2net_send_message_vec(u32 msg_type, u32 key, struct kvec *caller_vec,
         o2net_set_nst_sock_container(&nst, sc);
 
         veclen = caller_veclen + 1;
-        vec = kmalloc(sizeof(struct kvec) * veclen, GFP_ATOMIC);
+        vec = kmalloc_array(veclen, sizeof(struct kvec), GFP_ATOMIC);
         if (vec == NULL) {
                 mlog(0, "failed to %zu element kvec!\n", veclen);
                 ret = -ENOMEM;
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 425081be6161..2acd58ba9b7b 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -86,7 +86,7 @@ static void dlm_free_pagevec(void **vec, int pages)
 
 static void **dlm_alloc_pagevec(int pages)
 {
-        void **vec = kmalloc(pages * sizeof(void *), GFP_KERNEL);
+        void **vec = kmalloc_array(pages, sizeof(void *), GFP_KERNEL);
         int i;
 
         if (!vec)
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index e5dcea6cee5f..bd3475694e83 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -1383,7 +1383,7 @@ static int __ocfs2_recovery_thread(void *arg)
                 goto bail;
         }
 
-        rm_quota = kzalloc(osb->max_slots * sizeof(int), GFP_NOFS);
+        rm_quota = kcalloc(osb->max_slots, sizeof(int), GFP_NOFS);
         if (!rm_quota) {
                 status = -ENOMEM;
                 goto bail;
diff --git a/fs/ocfs2/sysfile.c b/fs/ocfs2/sysfile.c
index af155c183123..5965f3878d49 100644
--- a/fs/ocfs2/sysfile.c
+++ b/fs/ocfs2/sysfile.c
@@ -69,10 +69,11 @@ static struct inode **get_local_system_inode(struct ocfs2_super *osb,
         spin_unlock(&osb->osb_lock);
 
         if (unlikely(!local_system_inodes)) {
-                local_system_inodes = kzalloc(sizeof(struct inode *) *
-                                              NUM_LOCAL_SYSTEM_INODES *
-                                              osb->max_slots,
-                                              GFP_NOFS);
+                local_system_inodes =
+                        kzalloc(array3_size(sizeof(struct inode *),
+                                            NUM_LOCAL_SYSTEM_INODES,
+                                            osb->max_slots),
+                                GFP_NOFS);
                 if (!local_system_inodes) {
                         mlog_errno(-ENOMEM);
                         /*
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index 08801b45df00..c993dd8db739 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -612,7 +612,7 @@ static int ovl_get_index_name_fh(struct ovl_fh *fh, struct qstr *name)
 {
         char *n, *s;
 
-        n = kzalloc(fh->len * 2, GFP_KERNEL);
+        n = kcalloc(fh->len, 2, GFP_KERNEL);
         if (!n)
                 return -ENOMEM;
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 4aa9ce5df02f..80aa42506b8b 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -389,7 +389,8 @@ static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns,
         unsigned long *entries;
         int err;
 
-        entries = kmalloc(MAX_STACK_TRACE_DEPTH * sizeof(*entries), GFP_KERNEL);
+        entries = kmalloc_array(MAX_STACK_TRACE_DEPTH, sizeof(*entries),
+                                GFP_KERNEL);
         if (!entries)
                 return -ENOMEM;
 
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 4d765e5e91ed..89921a0d2ebb 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -1426,7 +1426,7 @@ static int register_leaf_sysctl_tables(const char *path, char *pos,
         /* If there are mixed files and directories we need a new table */
         if (nr_dirs && nr_files) {
                 struct ctl_table *new;
-                files = kzalloc(sizeof(struct ctl_table) * (nr_files + 1),
+                files = kcalloc(nr_files + 1, sizeof(struct ctl_table),
                                 GFP_KERNEL);
                 if (!files)
                         goto out;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 597969db9e90..e9679016271f 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1473,7 +1473,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
         pm.show_pfn = file_ns_capable(file, &init_user_ns, CAP_SYS_ADMIN);
 
         pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
-        pm.buffer = kmalloc(pm.len * PM_ENTRY_BYTES, GFP_KERNEL);
+        pm.buffer = kmalloc_array(pm.len, PM_ENTRY_BYTES, GFP_KERNEL);
         ret = -ENOMEM;
         if (!pm.buffer)
                 goto out_mm;
diff --git a/fs/read_write.c b/fs/read_write.c
index e83bd9744b5d..153f8f690490 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -778,7 +778,7 @@ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,
                 goto out;
         }
         if (nr_segs > fast_segs) {
-                iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL);
+                iov = kmalloc_array(nr_segs, sizeof(struct iovec), GFP_KERNEL);
                 if (iov == NULL) {
                         ret = -ENOMEM;
                         goto out;
@@ -849,7 +849,7 @@ ssize_t compat_rw_copy_check_uvector(int type,
                 goto out;
         if (nr_segs > fast_segs) {
                 ret = -ENOMEM;
-                iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL);
+                iov = kmalloc_array(nr_segs, sizeof(struct iovec), GFP_KERNEL);
                 if (iov == NULL)
                         goto out;
         }
diff --git a/fs/reiserfs/bitmap.c b/fs/reiserfs/bitmap.c
index edc8ef78b63f..bf708ac287b4 100644
--- a/fs/reiserfs/bitmap.c
+++ b/fs/reiserfs/bitmap.c
@@ -1456,7 +1456,7 @@ int reiserfs_init_bitmap_cache(struct super_block *sb)
         struct reiserfs_bitmap_info *bitmap;
         unsigned int bmap_nr = reiserfs_bmap_count(sb);
 
-        bitmap = vmalloc(sizeof(*bitmap) * bmap_nr);
+        bitmap = vmalloc(array_size(bmap_nr, sizeof(*bitmap)));
         if (bitmap == NULL)
                 return -ENOMEM;
 
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index b13fc024d2ee..132ec4406ed0 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -1044,7 +1044,8 @@ research:
                         if (blocks_needed == 1) {
                                 un = &unf_single;
                         } else {
-                                un = kzalloc(min(blocks_needed, max_to_insert) * UNFM_P_SIZE, GFP_NOFS);
+                                un = kcalloc(min(blocks_needed, max_to_insert),
+                                             UNFM_P_SIZE, GFP_NOFS);
                                 if (!un) {
                                         un = &unf_single;
                                         blocks_needed = 1;
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 23148c3ed675..52eb5d293a34 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -350,7 +350,8 @@ static struct reiserfs_journal_cnode *allocate_cnodes(int num_cnodes)
         if (num_cnodes <= 0) {
                 return NULL;
         }
-        head = vzalloc(num_cnodes * sizeof(struct reiserfs_journal_cnode));
+        head = vzalloc(array_size(num_cnodes,
+                                  sizeof(struct reiserfs_journal_cnode)));
         if (!head) {
                 return NULL;
         }
@@ -2192,10 +2193,12 @@ static int journal_read_transaction(struct super_block *sb,
          * now we know we've got a good transaction, and it was
          * inside the valid time ranges
          */
-        log_blocks = kmalloc(get_desc_trans_len(desc) *
-                             sizeof(struct buffer_head *), GFP_NOFS);
-        real_blocks = kmalloc(get_desc_trans_len(desc) *
-                              sizeof(struct buffer_head *), GFP_NOFS);
+        log_blocks = kmalloc_array(get_desc_trans_len(desc),
+                                   sizeof(struct buffer_head *),
+                                   GFP_NOFS);
+        real_blocks = kmalloc_array(get_desc_trans_len(desc),
+                                    sizeof(struct buffer_head *),
+                                    GFP_NOFS);
         if (!log_blocks || !real_blocks) {
                 brelse(c_bh);
                 brelse(d_bh);
diff --git a/fs/reiserfs/resize.c b/fs/reiserfs/resize.c
index 6052d323bc9a..8096c74c38ac 100644
--- a/fs/reiserfs/resize.c
+++ b/fs/reiserfs/resize.c
@@ -120,7 +120,8 @@ int reiserfs_resize(struct super_block *s, unsigned long block_count_new)
                  * array of bitmap block pointers
                  */
                 bitmap =
-                    vzalloc(sizeof(struct reiserfs_bitmap_info) * bmap_nr_new);
+                    vzalloc(array_size(bmap_nr_new,
+                                       sizeof(struct reiserfs_bitmap_info)));
                 if (!bitmap) {
                         /*
                          * Journal bitmaps are still supersized, but the
diff --git a/fs/select.c b/fs/select.c
index bc3cc0f98896..317891ff8165 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -1236,7 +1236,7 @@ static int compat_core_sys_select(int n, compat_ulong_t __user *inp,
         size = FDS_BYTES(n);
         bits = stack_fds;
         if (size > sizeof(stack_fds) / 6) {
-                bits = kmalloc(6 * size, GFP_KERNEL);
+                bits = kmalloc_array(6, size, GFP_KERNEL);
                 ret = -ENOMEM;
                 if (!bits)
                         goto out_nofds;
diff --git a/fs/splice.c b/fs/splice.c
index 005d09cf3fa8..2365ab073a27 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -259,8 +259,9 @@ int splice_grow_spd(const struct pipe_inode_info *pipe, struct splice_pipe_desc
         if (buffers <= PIPE_DEF_BUFFERS)
                 return 0;
 
-        spd->pages = kmalloc(buffers * sizeof(struct page *), GFP_KERNEL);
-        spd->partial = kmalloc(buffers * sizeof(struct partial_page), GFP_KERNEL);
+        spd->pages = kmalloc_array(buffers, sizeof(struct page *), GFP_KERNEL);
+        spd->partial = kmalloc_array(buffers, sizeof(struct partial_page),
+                                     GFP_KERNEL);
 
         if (spd->pages && spd->partial)
                 return 0;
@@ -395,7 +396,7 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
 
         vec = __vec;
         if (nr_pages > PIPE_DEF_BUFFERS) {
-                vec = kmalloc(nr_pages * sizeof(struct kvec), GFP_KERNEL);
+                vec = kmalloc_array(nr_pages, sizeof(struct kvec), GFP_KERNEL);
                 if (unlikely(!vec)) {
                         res = -ENOMEM;
                         goto out;
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index da8afdfccaa6..07b4956e0425 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -1282,10 +1282,11 @@ static int truncate_data_node(const struct ubifs_info *c, const struct inode *in
                               int *new_len)
 {
         void *buf;
-        int err, dlen, compr_type, out_len, old_dlen;
+        int err, compr_type;
+        u32 dlen, out_len, old_dlen;
 
         out_len = le32_to_cpu(dn->size);
-        buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS);
+        buf = kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS);
         if (!buf)
                 return -ENOMEM;
 
diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index 9a517109da0f..8e99dad18880 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -628,11 +628,12 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
         /* Needed by 'ubifs_pack_lsave()' */
         c->main_first = c->leb_cnt - *main_lebs;
 
-        lsave = kmalloc(sizeof(int) * c->lsave_cnt, GFP_KERNEL);
+        lsave = kmalloc_array(c->lsave_cnt, sizeof(int), GFP_KERNEL);
         pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_KERNEL);
         nnode = kzalloc(sizeof(struct ubifs_nnode), GFP_KERNEL);
         buf = vmalloc(c->leb_size);
-        ltab = vmalloc(sizeof(struct ubifs_lpt_lprops) * c->lpt_lebs);
+        ltab = vmalloc(array_size(sizeof(struct ubifs_lpt_lprops),
+                                  c->lpt_lebs));
         if (!pnode || !nnode || !buf || !ltab || !lsave) {
                 err = -ENOMEM;
                 goto out;
@@ -1626,7 +1627,8 @@ static int lpt_init_rd(struct ubifs_info *c)
 {
         int err, i;
 
-        c->ltab = vmalloc(sizeof(struct ubifs_lpt_lprops) * c->lpt_lebs);
+        c->ltab = vmalloc(array_size(sizeof(struct ubifs_lpt_lprops),
+                                     c->lpt_lebs));
         if (!c->ltab)
                 return -ENOMEM;
 
@@ -1636,15 +1638,17 @@ static int lpt_init_rd(struct ubifs_info *c)
                 return -ENOMEM;
 
         for (i = 0; i < LPROPS_HEAP_CNT; i++) {
-                c->lpt_heap[i].arr = kmalloc(sizeof(void *) * LPT_HEAP_SZ,
-                                             GFP_KERNEL);
+                c->lpt_heap[i].arr = kmalloc_array(LPT_HEAP_SZ,
+                                                   sizeof(void *),
+                                                   GFP_KERNEL);
                 if (!c->lpt_heap[i].arr)
                         return -ENOMEM;
                 c->lpt_heap[i].cnt = 0;
                 c->lpt_heap[i].max_cnt = LPT_HEAP_SZ;
         }
 
-        c->dirty_idx.arr = kmalloc(sizeof(void *) * LPT_HEAP_SZ, GFP_KERNEL);
+        c->dirty_idx.arr = kmalloc_array(LPT_HEAP_SZ, sizeof(void *),
+                                         GFP_KERNEL);
         if (!c->dirty_idx.arr)
                 return -ENOMEM;
         c->dirty_idx.cnt = 0;
@@ -1688,7 +1692,8 @@ static int lpt_init_wr(struct ubifs_info *c)
 {
         int err, i;
 
-        c->ltab_cmt = vmalloc(sizeof(struct ubifs_lpt_lprops) * c->lpt_lebs);
+        c->ltab_cmt = vmalloc(array_size(sizeof(struct ubifs_lpt_lprops),
+                                         c->lpt_lebs));
         if (!c->ltab_cmt)
                 return -ENOMEM;
 
@@ -1697,7 +1702,7 @@ static int lpt_init_wr(struct ubifs_info *c)
                 return -ENOMEM;
 
         if (c->big_lpt) {
-                c->lsave = kmalloc(sizeof(int) * c->lsave_cnt, GFP_NOFS);
+                c->lsave = kmalloc_array(c->lsave_cnt, sizeof(int), GFP_NOFS);
                 if (!c->lsave)
                         return -ENOMEM;
                 err = read_lsave(c);
@@ -1939,8 +1944,8 @@ int ubifs_lpt_scan_nolock(struct ubifs_info *c, int start_lnum, int end_lnum,
                         return err;
         }
 
-        path = kmalloc(sizeof(struct lpt_scan_node) * (c->lpt_hght + 1),
-                       GFP_NOFS);
+        path = kmalloc_array(c->lpt_hght + 1, sizeof(struct lpt_scan_node),
+                             GFP_NOFS);
         if (!path)
                 return -ENOMEM;
 
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 6c397a389105..c5466c70d620 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1196,7 +1196,8 @@ static int mount_ubifs(struct ubifs_info *c)
          * never exceed 64.
          */
         err = -ENOMEM;
-        c->bottom_up_buf = kmalloc(BOTTOM_UP_HEIGHT * sizeof(int), GFP_KERNEL);
+        c->bottom_up_buf = kmalloc_array(BOTTOM_UP_HEIGHT, sizeof(int),
+                                         GFP_KERNEL);
         if (!c->bottom_up_buf)
                 goto out_free;
 
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index ba3d0e0f8615..4a21e7f75e7a 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -1104,8 +1104,9 @@ static struct ubifs_znode *dirty_cow_bottom_up(struct ubifs_info *c,
         ubifs_assert(znode);
         if (c->zroot.znode->level > BOTTOM_UP_HEIGHT) {
                 kfree(c->bottom_up_buf);
-                c->bottom_up_buf = kmalloc(c->zroot.znode->level * sizeof(int),
-                                           GFP_NOFS);
+                c->bottom_up_buf = kmalloc_array(c->zroot.znode->level,
+                                                 sizeof(int),
+                                                 GFP_NOFS);
                 if (!c->bottom_up_buf)
                         return ERR_PTR(-ENOMEM);
                 path = c->bottom_up_buf;
diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
index aa31f60220ef..a9df94ad46a3 100644
--- a/fs/ubifs/tnc_commit.c
+++ b/fs/ubifs/tnc_commit.c
@@ -366,7 +366,8 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
 
         dbg_gc("%d znodes to write", cnt);
 
-        c->gap_lebs = kmalloc(sizeof(int) * (c->lst.idx_lebs + 1), GFP_NOFS);
+        c->gap_lebs = kmalloc_array(c->lst.idx_lebs + 1, sizeof(int),
+                                    GFP_NOFS);
         if (!c->gap_lebs)
                 return -ENOMEM;
 
@@ -674,7 +675,7 @@ static int alloc_idx_lebs(struct ubifs_info *c, int cnt)
         dbg_cmt("need about %d empty LEBS for TNC commit", leb_cnt);
         if (!leb_cnt)
                 return 0;
-        c->ilebs = kmalloc(leb_cnt * sizeof(int), GFP_NOFS);
+        c->ilebs = kmalloc_array(leb_cnt, sizeof(int), GFP_NOFS);
         if (!c->ilebs)
                 return -ENOMEM;
         for (i = 0; i < leb_cnt; i++) {
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 0d27d41f5c6e..fc77ea736da7 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1585,7 +1585,7 @@ static struct udf_vds_record *handle_partition_descriptor(
                 struct udf_vds_record *new_loc;
                 unsigned int new_size = ALIGN(partnum, PART_DESC_ALLOC_STEP);
 
-                new_loc = kzalloc(sizeof(*new_loc) * new_size, GFP_KERNEL);
+                new_loc = kcalloc(new_size, sizeof(*new_loc), GFP_KERNEL);
                 if (!new_loc)
                         return ERR_PTR(-ENOMEM);
                 memcpy(new_loc, data->part_descs_loc,
@@ -1644,8 +1644,9 @@ static noinline int udf_process_sequence(
 
         memset(data.vds, 0, sizeof(struct udf_vds_record) * VDS_POS_LENGTH);
         data.size_part_descs = PART_DESC_ALLOC_STEP;
-        data.part_descs_loc = kzalloc(sizeof(*data.part_descs_loc) *
-                                        data.size_part_descs, GFP_KERNEL);
+        data.part_descs_loc = kcalloc(data.size_part_descs,
+                                      sizeof(*data.part_descs_loc),
+                                      GFP_KERNEL);
         if (!data.part_descs_loc)
                 return -ENOMEM;
 
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 8254b8b3690f..488088141451 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -541,7 +541,9 @@ static int ufs_read_cylinder_structures(struct super_block *sb)
          * Read cylinder group (we read only first fragment from block
          * at this time) and prepare internal data structures for cg caching.
          */
-        if (!(sbi->s_ucg = kmalloc (sizeof(struct buffer_head *) * uspi->s_ncg, GFP_NOFS)))
+        sbi->s_ucg = kmalloc_array(uspi->s_ncg, sizeof(struct buffer_head *),
+                                   GFP_NOFS);
+        if (!sbi->s_ucg)
                 goto failed;
         for (i = 0; i < uspi->s_ncg; i++) 
                 sbi->s_ucg[i] = NULL;
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 0e493884e6e1..a0fbb9ffe380 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -575,6 +575,11 @@ static inline void *kvmalloc_array(size_t n, size_t size, gfp_t flags)
         return kvmalloc(bytes, flags);
 }
 
+static inline void *kvcalloc(size_t n, size_t size, gfp_t flags)
+{
+        return kvmalloc_array(n, size, flags | __GFP_ZERO);
+}
+
 extern void kvfree(const void *addr);
 
 static inline atomic_t *compound_mapcount_ptr(struct page *page)
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 2043e1a8f851..4c6241bc2039 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -2093,10 +2093,7 @@ struct ib_flow_attr {
         u32          flags;
         u8           num_of_specs;
         u8           port;
-        /* Following are the optional layers according to user request
-         * struct ib_flow_spec_xxx
-         * struct ib_flow_spec_yyy
-         */
+        union ib_flow_spec flows[];
 };
 
 struct ib_flow {
diff --git a/ipc/sem.c b/ipc/sem.c
index cfd94d48a9aa..59a3cd1d3252 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1945,7 +1945,7 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
         if (nsops > ns->sc_semopm)
                 return -E2BIG;
         if (nsops > SEMOPM_FAST) {
-                sops = kvmalloc(sizeof(*sops)*nsops, GFP_KERNEL);
+                sops = kvmalloc_array(nsops, sizeof(*sops), GFP_KERNEL);
                 if (sops == NULL)
                         return -ENOMEM;
         }
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 8653ab004c73..2d49d18b793a 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -608,7 +608,7 @@ static int btf_add_type(struct btf_verifier_env *env, struct btf_type *t)
                 new_size = min_t(u32, BTF_MAX_TYPE,
                                  btf->types_size + expand_by);
 
-                new_types = kvzalloc(new_size * sizeof(*new_types),
+                new_types = kvcalloc(new_size, sizeof(*new_types),
                                      GFP_KERNEL | __GFP_NOWARN);
                 if (!new_types)
                         return -ENOMEM;
@@ -698,17 +698,17 @@ static int env_resolve_init(struct btf_verifier_env *env)
         u8 *visit_states = NULL;
 
         /* +1 for btf_void */
-        resolved_sizes = kvzalloc((nr_types + 1) * sizeof(*resolved_sizes),
+        resolved_sizes = kvcalloc(nr_types + 1, sizeof(*resolved_sizes),
                                   GFP_KERNEL | __GFP_NOWARN);
         if (!resolved_sizes)
                 goto nomem;
 
-        resolved_ids = kvzalloc((nr_types + 1) * sizeof(*resolved_ids),
+        resolved_ids = kvcalloc(nr_types + 1, sizeof(*resolved_ids),
                                 GFP_KERNEL | __GFP_NOWARN);
         if (!resolved_ids)
                 goto nomem;
 
-        visit_states = kvzalloc((nr_types + 1) * sizeof(*visit_states),
+        visit_states = kvcalloc(nr_types + 1, sizeof(*visit_states),
                                 GFP_KERNEL | __GFP_NOWARN);
         if (!visit_states)
                 goto nomem;
diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index b4b5b81e7251..1603492c9cc7 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -623,8 +623,9 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key)
         if (!key || key->prefixlen > trie->max_prefixlen)
                 goto find_leftmost;
 
-        node_stack = kmalloc(trie->max_prefixlen * sizeof(struct lpm_trie_node *),
-                             GFP_ATOMIC | __GFP_NOWARN);
+        node_stack = kmalloc_array(trie->max_prefixlen,
+                                   sizeof(struct lpm_trie_node *),
+                                   GFP_ATOMIC | __GFP_NOWARN);
         if (!node_stack)
                 return -ENOMEM;
 
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index cced0c1e63e2..9e2bf834f13a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5206,7 +5206,8 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env, u32 prog_len,
 
         if (cnt == 1)
                 return 0;
-        new_data = vzalloc(sizeof(struct bpf_insn_aux_data) * prog_len);
+        new_data = vzalloc(array_size(prog_len,
+                                      sizeof(struct bpf_insn_aux_data)));
         if (!new_data)
                 return -ENOMEM;
         memcpy(new_data, old_data, sizeof(struct bpf_insn_aux_data) * off);
@@ -5447,7 +5448,7 @@ static int jit_subprogs(struct bpf_verifier_env *env)
                 insn->imm = 1;
         }
 
-        func = kzalloc(sizeof(prog) * env->subprog_cnt, GFP_KERNEL);
+        func = kcalloc(env->subprog_cnt, sizeof(prog), GFP_KERNEL);
         if (!func)
                 return -ENOMEM;
 
@@ -5870,8 +5871,9 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr)
                 return -ENOMEM;
         log = &env->log;
 
-        env->insn_aux_data = vzalloc(sizeof(struct bpf_insn_aux_data) *
-                                     (*prog)->len);
+        env->insn_aux_data =
+                vzalloc(array_size(sizeof(struct bpf_insn_aux_data),
+                                   (*prog)->len));
         ret = -ENOMEM;
         if (!env->insn_aux_data)
                 goto err_free_env;
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index e06c97f3ed1a..8b4f0768efd6 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -195,9 +195,9 @@ struct cgroup_pidlist {
 static void *pidlist_allocate(int count)
 {
         if (PIDLIST_TOO_LARGE(count))
-                return vmalloc(count * sizeof(pid_t));
+                return vmalloc(array_size(count, sizeof(pid_t)));
         else
-                return kmalloc(count * sizeof(pid_t), GFP_KERNEL);
+                return kmalloc_array(count, sizeof(pid_t), GFP_KERNEL);
 }
 
 static void pidlist_free(void *p)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index b42037e6e81d..d8b12e0d39cd 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -683,7 +683,7 @@ static int generate_sched_domains(cpumask_var_t **domains,
                 goto done;
         }
 
-        csa = kmalloc(nr_cpusets() * sizeof(cp), GFP_KERNEL);
+        csa = kmalloc_array(nr_cpusets(), sizeof(cp), GFP_KERNEL);
         if (!csa)
                 goto done;
         csn = 0;
@@ -753,7 +753,8 @@ restart:
          * The rest of the code, including the scheduler, can deal with
          * dattr==NULL case. No need to abort if alloc fails.
          */
-        dattr = kmalloc(ndoms * sizeof(struct sched_domain_attr), GFP_KERNEL);
+        dattr = kmalloc_array(ndoms, sizeof(struct sched_domain_attr),
+                              GFP_KERNEL);
 
         for (nslot = 0, i = 0; i < csn; i++) {
                 struct cpuset *a = csa[i];
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index e405677ee08d..2ddfce8f1e8f 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -691,7 +691,7 @@ static int kdb_defcmd2(const char *cmdstr, const char *argv0)
         }
         if (!s->usable)
                 return KDB_NOTIMP;
-        s->command = kzalloc((s->count + 1) * sizeof(*(s->command)), GFP_KDB);
+        s->command = kcalloc(s->count + 1, sizeof(*(s->command)), GFP_KDB);
         if (!s->command) {
                 kdb_printf("Could not allocate new kdb_defcmd table for %s\n",
                            cmdstr);
@@ -729,8 +729,8 @@ static int kdb_defcmd(int argc, const char **argv)
                 kdb_printf("Command only available during kdb_init()\n");
                 return KDB_NOTIMP;
         }
-        defcmd_set = kmalloc((defcmd_set_count + 1) * sizeof(*defcmd_set),
-                             GFP_KDB);
+        defcmd_set = kmalloc_array(defcmd_set_count + 1, sizeof(*defcmd_set),
+                                   GFP_KDB);
         if (!defcmd_set)
                 goto fail_defcmd;
         memcpy(defcmd_set, save_defcmd_set,
@@ -2706,8 +2706,11 @@ int kdb_register_flags(char *cmd,
         }
 
         if (i >= kdb_max_commands) {
-                kdbtab_t *new = kmalloc((kdb_max_commands - KDB_BASE_CMD_MAX +
-                         kdb_command_extend) * sizeof(*new), GFP_KDB);
+                kdbtab_t *new = kmalloc_array(kdb_max_commands -
+                                                KDB_BASE_CMD_MAX +
+                                                kdb_command_extend,
+                                              sizeof(*new),
+                                              GFP_KDB);
                 if (!new) {
                         kdb_printf("Could not allocate new kdb_command "
                                    "table\n");
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 1d8ca9ea9979..045a37e9ddee 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -614,7 +614,8 @@ int rb_alloc_aux(struct ring_buffer *rb, struct perf_event *event,
                 }
         }
 
-        rb->aux_pages = kzalloc_node(nr_pages * sizeof(void *), GFP_KERNEL, node);
+        rb->aux_pages = kcalloc_node(nr_pages, sizeof(void *), GFP_KERNEL,
+                                     node);
         if (!rb->aux_pages)
                 return -ENOMEM;
 
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 1725b902983f..ccc579a7d32e 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1184,7 +1184,8 @@ static struct xol_area *__create_xol_area(unsigned long vaddr)
         if (unlikely(!area))
                 goto out;
 
-        area->bitmap = kzalloc(BITS_TO_LONGS(UINSNS_PER_PAGE) * sizeof(long), GFP_KERNEL);
+        area->bitmap = kcalloc(BITS_TO_LONGS(UINSNS_PER_PAGE), sizeof(long),
+                               GFP_KERNEL);
         if (!area->bitmap)
                 goto free_area;
 
diff --git a/kernel/fail_function.c b/kernel/fail_function.c
index 1d5632d8bbcc..5349c91c2298 100644
--- a/kernel/fail_function.c
+++ b/kernel/fail_function.c
@@ -258,7 +258,7 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
         /* cut off if it is too long */
         if (count > KSYM_NAME_LEN)
                 count = KSYM_NAME_LEN;
-        buf = kmalloc(sizeof(char) * (count + 1), GFP_KERNEL);
+        buf = kmalloc(count + 1, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 75d8e7cf040e..c6a3b6851372 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -793,7 +793,7 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi,
          * The section headers in kexec_purgatory are read-only. In order to
          * have them modifiable make a temporary copy.
          */
-        sechdrs = vzalloc(pi->ehdr->e_shnum * sizeof(Elf_Shdr));
+        sechdrs = vzalloc(array_size(sizeof(Elf_Shdr), pi->ehdr->e_shnum));
         if (!sechdrs)
                 return -ENOMEM;
         memcpy(sechdrs, (void *)pi->ehdr + pi->ehdr->e_shoff,
diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c
index 6850ffd69125..8402b3349dca 100644
--- a/kernel/locking/locktorture.c
+++ b/kernel/locking/locktorture.c
@@ -913,7 +913,9 @@ static int __init lock_torture_init(void)
         /* Initialize the statistics so that each run gets its own numbers. */
         if (nwriters_stress) {
                 lock_is_write_held = 0;
-                cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL);
+                cxt.lwsa = kmalloc_array(cxt.nrealwriters_stress,
+                                         sizeof(*cxt.lwsa),
+                                         GFP_KERNEL);
                 if (cxt.lwsa == NULL) {
                         VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory");
                         firsterr = -ENOMEM;
@@ -942,7 +944,9 @@ static int __init lock_torture_init(void)
 
                 if (nreaders_stress) {
                         lock_is_read_held = 0;
-                        cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL);
+                        cxt.lrsa = kmalloc_array(cxt.nrealreaders_stress,
+                                                 sizeof(*cxt.lrsa),
+                                                 GFP_KERNEL);
                         if (cxt.lrsa == NULL) {
                                 VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory");
                                 firsterr = -ENOMEM;
@@ -985,7 +989,8 @@ static int __init lock_torture_init(void)
         }
 
         if (nwriters_stress) {
-                writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]),
+                writer_tasks = kcalloc(cxt.nrealwriters_stress,
+                                       sizeof(writer_tasks[0]),
                                        GFP_KERNEL);
                 if (writer_tasks == NULL) {
                         VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory");
@@ -995,7 +1000,8 @@ static int __init lock_torture_init(void)
         }
 
         if (cxt.cur_ops->readlock) {
-                reader_tasks = kzalloc(cxt.nrealreaders_stress * sizeof(reader_tasks[0]),
+                reader_tasks = kcalloc(cxt.nrealreaders_stress,
+                                       sizeof(reader_tasks[0]),
                                        GFP_KERNEL);
                 if (reader_tasks == NULL) {
                         VERBOSE_TOROUT_ERRSTRING("reader_tasks: Out of memory");
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 1efcb5b0c3ed..c2bcf97d24c8 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -698,7 +698,7 @@ static int save_image_lzo(struct swap_map_handle *handle,
                 goto out_clean;
         }
 
-        data = vmalloc(sizeof(*data) * nr_threads);
+        data = vmalloc(array_size(nr_threads, sizeof(*data)));
         if (!data) {
                 pr_err("Failed to allocate LZO data\n");
                 ret = -ENOMEM;
@@ -1183,14 +1183,14 @@ static int load_image_lzo(struct swap_map_handle *handle,
         nr_threads = num_online_cpus() - 1;
         nr_threads = clamp_val(nr_threads, 1, LZO_THREADS);
 
-        page = vmalloc(sizeof(*page) * LZO_MAX_RD_PAGES);
+        page = vmalloc(array_size(LZO_MAX_RD_PAGES, sizeof(*page)));
         if (!page) {
                 pr_err("Failed to allocate LZO page\n");
                 ret = -ENOMEM;
                 goto out_clean;
         }
 
-        data = vmalloc(sizeof(*data) * nr_threads);
+        data = vmalloc(array_size(nr_threads, sizeof(*data)));
         if (!data) {
                 pr_err("Failed to allocate LZO data\n");
                 ret = -ENOMEM;
diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index e628fcfd1bde..42fcb7f05fac 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -831,8 +831,9 @@ rcu_torture_cbflood(void *arg)
             cbflood_intra_holdoff > 0 &&
             cur_ops->call &&
             cur_ops->cb_barrier) {
-                rhp = vmalloc(sizeof(*rhp) *
-                              cbflood_n_burst * cbflood_n_per_burst);
+                rhp = vmalloc(array3_size(cbflood_n_burst,
+                                          cbflood_n_per_burst,
+                                          sizeof(*rhp)));
                 err = !rhp;
         }
         if (err) {
diff --git a/kernel/relay.c b/kernel/relay.c
index c955b10c973c..9f5326e8a036 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -169,7 +169,8 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan)
         buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
         if (!buf)
                 return NULL;
-        buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL);
+        buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t *),
+                                     GFP_KERNEL);
         if (!buf->padding)
                 goto free_buf;
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index e497c05aab7f..1866e64792a7 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -10215,10 +10215,10 @@ int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent)
         struct cfs_rq *cfs_rq;
         int i;
 
-        tg->cfs_rq = kzalloc(sizeof(cfs_rq) * nr_cpu_ids, GFP_KERNEL);
+        tg->cfs_rq = kcalloc(nr_cpu_ids, sizeof(cfs_rq), GFP_KERNEL);
         if (!tg->cfs_rq)
                 goto err;
-        tg->se = kzalloc(sizeof(se) * nr_cpu_ids, GFP_KERNEL);
+        tg->se = kcalloc(nr_cpu_ids, sizeof(se), GFP_KERNEL);
         if (!tg->se)
                 goto err;
 
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index ef3c4e6f5345..47556b0c9a95 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -183,10 +183,10 @@ int alloc_rt_sched_group(struct task_group *tg, struct task_group *parent)
         struct sched_rt_entity *rt_se;
         int i;
 
-        tg->rt_rq = kzalloc(sizeof(rt_rq) * nr_cpu_ids, GFP_KERNEL);
+        tg->rt_rq = kcalloc(nr_cpu_ids, sizeof(rt_rq), GFP_KERNEL);
         if (!tg->rt_rq)
                 goto err;
-        tg->rt_se = kzalloc(sizeof(rt_se) * nr_cpu_ids, GFP_KERNEL);
+        tg->rt_se = kcalloc(nr_cpu_ids, sizeof(rt_se), GFP_KERNEL);
         if (!tg->rt_se)
                 goto err;
 
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 61a1125c1ae4..05a831427bc7 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -1750,7 +1750,7 @@ cpumask_var_t *alloc_sched_domains(unsigned int ndoms)
         int i;
         cpumask_var_t *doms;
 
-        doms = kmalloc(sizeof(*doms) * ndoms, GFP_KERNEL);
+        doms = kmalloc_array(ndoms, sizeof(*doms), GFP_KERNEL);
         if (!doms)
                 return NULL;
         for (i = 0; i < ndoms; i++) {
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 6a78cf70761d..2d9837c0aff4 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -3047,7 +3047,8 @@ int proc_do_large_bitmap(struct ctl_table *table, int write,
                 if (IS_ERR(kbuf))
                         return PTR_ERR(kbuf);
 
-                tmp_bitmap = kzalloc(BITS_TO_LONGS(bitmap_len) * sizeof(unsigned long),
+                tmp_bitmap = kcalloc(BITS_TO_LONGS(bitmap_len),
+                                     sizeof(unsigned long),
                                      GFP_KERNEL);
                 if (!tmp_bitmap) {
                         kfree(kbuf);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 8d83bcf9ef69..efed9c1cfb7e 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -728,7 +728,7 @@ static int ftrace_profile_init_cpu(int cpu)
          */
         size = FTRACE_PROFILE_HASH_SIZE;
 
-        stat->hash = kzalloc(sizeof(struct hlist_head) * size, GFP_KERNEL);
+        stat->hash = kcalloc(size, sizeof(struct hlist_head), GFP_KERNEL);
 
         if (!stat->hash)
                 return -ENOMEM;
@@ -6830,9 +6830,10 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
         struct task_struct *g, *t;
 
         for (i = 0; i < FTRACE_RETSTACK_ALLOC_SIZE; i++) {
-                ret_stack_list[i] = kmalloc(FTRACE_RETFUNC_DEPTH
-                                        * sizeof(struct ftrace_ret_stack),
-                                        GFP_KERNEL);
+                ret_stack_list[i] =
+                        kmalloc_array(FTRACE_RETFUNC_DEPTH,
+                                      sizeof(struct ftrace_ret_stack),
+                                      GFP_KERNEL);
                 if (!ret_stack_list[i]) {
                         start = 0;
                         end = i;
@@ -6904,9 +6905,9 @@ static int start_graph_tracing(void)
         struct ftrace_ret_stack **ret_stack_list;
         int ret, cpu;
 
-        ret_stack_list = kmalloc(FTRACE_RETSTACK_ALLOC_SIZE *
-                                sizeof(struct ftrace_ret_stack *),
-                                GFP_KERNEL);
+        ret_stack_list = kmalloc_array(FTRACE_RETSTACK_ALLOC_SIZE,
+                                       sizeof(struct ftrace_ret_stack *),
+                                       GFP_KERNEL);
 
         if (!ret_stack_list)
                 return -ENOMEM;
@@ -7088,9 +7089,10 @@ void ftrace_graph_init_idle_task(struct task_struct *t, int cpu)
 
                 ret_stack = per_cpu(idle_ret_stack, cpu);
                 if (!ret_stack) {
-                        ret_stack = kmalloc(FTRACE_RETFUNC_DEPTH
-                                            * sizeof(struct ftrace_ret_stack),
-                                            GFP_KERNEL);
+                        ret_stack =
+                                kmalloc_array(FTRACE_RETFUNC_DEPTH,
+                                              sizeof(struct ftrace_ret_stack),
+                                              GFP_KERNEL);
                         if (!ret_stack)
                                 return;
                         per_cpu(idle_ret_stack, cpu) = ret_stack;
@@ -7109,9 +7111,9 @@ void ftrace_graph_init_task(struct task_struct *t)
         if (ftrace_graph_active) {
                 struct ftrace_ret_stack *ret_stack;
 
-                ret_stack = kmalloc(FTRACE_RETFUNC_DEPTH
-                                * sizeof(struct ftrace_ret_stack),
-                                GFP_KERNEL);
+                ret_stack = kmalloc_array(FTRACE_RETFUNC_DEPTH,
+                                          sizeof(struct ftrace_ret_stack),
+                                          GFP_KERNEL);
                 if (!ret_stack)
                         return;
                 graph_init_task(t, ret_stack);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 108ce3e1dc13..c9336e98ac59 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1751,12 +1751,13 @@ static inline void set_cmdline(int idx, const char *cmdline)
 static int allocate_cmdlines_buffer(unsigned int val,
                                     struct saved_cmdlines_buffer *s)
 {
-        s->map_cmdline_to_pid = kmalloc(val * sizeof(*s->map_cmdline_to_pid),
-                                        GFP_KERNEL);
+        s->map_cmdline_to_pid = kmalloc_array(val,
+                                              sizeof(*s->map_cmdline_to_pid),
+                                              GFP_KERNEL);
         if (!s->map_cmdline_to_pid)
                 return -ENOMEM;
 
-        s->saved_cmdlines = kmalloc(val * TASK_COMM_LEN, GFP_KERNEL);
+        s->saved_cmdlines = kmalloc_array(TASK_COMM_LEN, val, GFP_KERNEL);
         if (!s->saved_cmdlines) {
                 kfree(s->map_cmdline_to_pid);
                 return -ENOMEM;
@@ -4360,7 +4361,8 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
 
         if (mask == TRACE_ITER_RECORD_TGID) {
                 if (!tgid_map)
-                        tgid_map = kzalloc((PID_MAX_DEFAULT + 1) * sizeof(*tgid_map),
+                        tgid_map = kcalloc(PID_MAX_DEFAULT + 1,
+                                           sizeof(*tgid_map),
                                            GFP_KERNEL);
                 if (!tgid_map) {
                         tr->trace_flags &= ~TRACE_ITER_RECORD_TGID;
@@ -5063,7 +5065,7 @@ trace_insert_eval_map_file(struct module *mod, struct trace_eval_map **start,
          * where the head holds the module and length of array, and the
          * tail holds a pointer to the next list.
          */
-        map_array = kmalloc(sizeof(*map_array) * (len + 2), GFP_KERNEL);
+        map_array = kmalloc_array(len + 2, sizeof(*map_array), GFP_KERNEL);
         if (!map_array) {
                 pr_warn("Unable to allocate trace eval mapping\n");
                 return;
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 0171407d231f..e1c818dbc0d7 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -436,15 +436,15 @@ predicate_parse(const char *str, int nr_parens, int nr_preds,
 
         nr_preds += 2; /* For TRUE and FALSE */
 
-        op_stack = kmalloc(sizeof(*op_stack) * nr_parens, GFP_KERNEL);
+        op_stack = kmalloc_array(nr_parens, sizeof(*op_stack), GFP_KERNEL);
         if (!op_stack)
                 return ERR_PTR(-ENOMEM);
-        prog_stack = kmalloc(sizeof(*prog_stack) * nr_preds, GFP_KERNEL);
+        prog_stack = kmalloc_array(nr_preds, sizeof(*prog_stack), GFP_KERNEL);
         if (!prog_stack) {
                 parse_error(pe, -ENOMEM, 0);
                 goto out_free;
         }
-        inverts = kmalloc(sizeof(*inverts) * nr_preds, GFP_KERNEL);
+        inverts = kmalloc_array(nr_preds, sizeof(*inverts), GFP_KERNEL);
         if (!inverts) {
                 parse_error(pe, -ENOMEM, 0);
                 goto out_free;
diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
index 5cadb1b8b5fe..752d8042bad4 100644
--- a/kernel/trace/tracing_map.c
+++ b/kernel/trace/tracing_map.c
@@ -1075,7 +1075,7 @@ int tracing_map_sort_entries(struct tracing_map *map,
         struct tracing_map_sort_entry *sort_entry, **entries;
         int i, n_entries, ret;
 
-        entries = vmalloc(map->max_elts * sizeof(sort_entry));
+        entries = vmalloc(array_size(sizeof(sort_entry), map->max_elts));
         if (!entries)
                 return -ENOMEM;
 
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 492c255e6c5a..c3d7583fcd21 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -764,8 +764,9 @@ static int insert_extent(struct uid_gid_map *map, struct uid_gid_extent *extent)
                 struct uid_gid_extent *forward;
 
                 /* Allocate memory for 340 mappings. */
-                forward = kmalloc(sizeof(struct uid_gid_extent) *
-                                 UID_GID_MAP_MAX_EXTENTS, GFP_KERNEL);
+                forward = kmalloc_array(UID_GID_MAP_MAX_EXTENTS,
+                                        sizeof(struct uid_gid_extent),
+                                        GFP_KERNEL);
                 if (!forward)
                         return -ENOMEM;
 
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 465a28b4cd32..78b192071ef7 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5638,7 +5638,7 @@ static void __init wq_numa_init(void)
          * available.  Build one from cpu_to_node() which should have been
          * fully initialized by now.
          */
-        tbl = kzalloc(nr_node_ids * sizeof(tbl[0]), GFP_KERNEL);
+        tbl = kcalloc(nr_node_ids, sizeof(tbl[0]), GFP_KERNEL);
         BUG_ON(!tbl);
 
         for_each_node(node)
diff --git a/lib/argv_split.c b/lib/argv_split.c
index 5c35752a9414..1a19a0a93dc1 100644
--- a/lib/argv_split.c
+++ b/lib/argv_split.c
@@ -69,7 +69,7 @@ char **argv_split(gfp_t gfp, const char *str, int *argcp)
                 return NULL;
 
         argc = count_argc(argv_str);
-        argv = kmalloc(sizeof(*argv) * (argc + 2), gfp);
+        argv = kmalloc_array(argc + 2, sizeof(*argv), gfp);
         if (!argv) {
                 kfree(argv_str);
                 return NULL;
diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c
index 835242e74aaa..75509a1511a3 100644
--- a/lib/interval_tree_test.c
+++ b/lib/interval_tree_test.c
@@ -64,11 +64,12 @@ static int interval_tree_test_init(void)
         unsigned long results;
         cycles_t time1, time2, time;
 
-        nodes = kmalloc(nnodes * sizeof(struct interval_tree_node), GFP_KERNEL);
+        nodes = kmalloc_array(nnodes, sizeof(struct interval_tree_node),
+                              GFP_KERNEL);
         if (!nodes)
                 return -ENOMEM;
 
-        queries = kmalloc(nsearches * sizeof(int), GFP_KERNEL);
+        queries = kmalloc_array(nsearches, sizeof(int), GFP_KERNEL);
         if (!queries) {
                 kfree(nodes);
                 return -ENOMEM;
diff --git a/lib/kfifo.c b/lib/kfifo.c
index b0f757bf7213..015656aa8182 100644
--- a/lib/kfifo.c
+++ b/lib/kfifo.c
@@ -54,7 +54,7 @@ int __kfifo_alloc(struct __kfifo *fifo, unsigned int size,
                 return -EINVAL;
         }
 
-        fifo->data = kmalloc(size * esize, gfp_mask);
+        fifo->data = kmalloc_array(esize, size, gfp_mask);
 
         if (!fifo->data) {
                 fifo->mask = 0;
diff --git a/lib/lru_cache.c b/lib/lru_cache.c
index 28ba40b99337..2b10a4024c35 100644
--- a/lib/lru_cache.c
+++ b/lib/lru_cache.c
@@ -119,7 +119,7 @@ struct lru_cache *lc_create(const char *name, struct kmem_cache *cache,
         slot = kcalloc(e_count, sizeof(struct hlist_head), GFP_KERNEL);
         if (!slot)
                 goto out_fail;
-        element = kzalloc(e_count * sizeof(struct lc_element *), GFP_KERNEL);
+        element = kcalloc(e_count, sizeof(struct lc_element *), GFP_KERNEL);
         if (!element)
                 goto out_fail;
 
diff --git a/lib/mpi/mpiutil.c b/lib/mpi/mpiutil.c
index 314f4dfa603e..20ed0f766787 100644
--- a/lib/mpi/mpiutil.c
+++ b/lib/mpi/mpiutil.c
@@ -91,14 +91,14 @@ int mpi_resize(MPI a, unsigned nlimbs)
                 return 0;       /* no need to do it */
 
         if (a->d) {
-                p = kmalloc(nlimbs * sizeof(mpi_limb_t), GFP_KERNEL);
+                p = kmalloc_array(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL);
                 if (!p)
                         return -ENOMEM;
                 memcpy(p, a->d, a->alloced * sizeof(mpi_limb_t));
                 kzfree(a->d);
                 a->d = p;
         } else {
-                a->d = kzalloc(nlimbs * sizeof(mpi_limb_t), GFP_KERNEL);
+                a->d = kcalloc(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL);
                 if (!a->d)
                         return -ENOMEM;
         }
diff --git a/lib/rbtree_test.c b/lib/rbtree_test.c
index 7d36c1e27ff6..b7055b2a07d3 100644
--- a/lib/rbtree_test.c
+++ b/lib/rbtree_test.c
@@ -247,7 +247,7 @@ static int __init rbtree_test_init(void)
         cycles_t time1, time2, time;
         struct rb_node *node;
 
-        nodes = kmalloc(nnodes * sizeof(*nodes), GFP_KERNEL);
+        nodes = kmalloc_array(nnodes, sizeof(*nodes), GFP_KERNEL);
         if (!nodes)
                 return -ENOMEM;
 
diff --git a/lib/reed_solomon/reed_solomon.c b/lib/reed_solomon/reed_solomon.c
index dfcf54242fb9..d8bb1a1eba72 100644
--- a/lib/reed_solomon/reed_solomon.c
+++ b/lib/reed_solomon/reed_solomon.c
@@ -88,15 +88,15 @@ static struct rs_codec *codec_init(int symsize, int gfpoly, int (*gffunc)(int),
         rs->gffunc = gffunc;
 
         /* Allocate the arrays */
-        rs->alpha_to = kmalloc(sizeof(uint16_t) * (rs->nn + 1), gfp);
+        rs->alpha_to = kmalloc_array(rs->nn + 1, sizeof(uint16_t), gfp);
         if (rs->alpha_to == NULL)
                 goto err;
 
-        rs->index_of = kmalloc(sizeof(uint16_t) * (rs->nn + 1), gfp);
+        rs->index_of = kmalloc_array(rs->nn + 1, sizeof(uint16_t), gfp);
         if (rs->index_of == NULL)
                 goto err;
 
-        rs->genpoly = kmalloc(sizeof(uint16_t) * (rs->nroots + 1), gfp);
+        rs->genpoly = kmalloc_array(rs->nroots + 1, sizeof(uint16_t), gfp);
         if(rs->genpoly == NULL)
                 goto err;
 
diff --git a/lib/sbitmap.c b/lib/sbitmap.c
index 6fdc6267f4a8..fdd1b8aa8ac6 100644
--- a/lib/sbitmap.c
+++ b/lib/sbitmap.c
@@ -52,7 +52,7 @@ int sbitmap_init_node(struct sbitmap *sb, unsigned int depth, int shift,
                 return 0;
         }
 
-        sb->map = kzalloc_node(sb->map_nr * sizeof(*sb->map), flags, node);
+        sb->map = kcalloc_node(sb->map_nr, sizeof(*sb->map), flags, node);
         if (!sb->map)
                 return -ENOMEM;
 
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index 06dad7a072fd..1642fd507a96 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -170,7 +170,8 @@ static struct scatterlist *sg_kmalloc(unsigned int nents, gfp_t gfp_mask)
                 kmemleak_alloc(ptr, PAGE_SIZE, 1, gfp_mask);
                 return ptr;
         } else
-                return kmalloc(nents * sizeof(struct scatterlist), gfp_mask);
+                return kmalloc_array(nents, sizeof(struct scatterlist),
+                                     gfp_mask);
 }
 
 static void sg_kfree(struct scatterlist *sg, unsigned int nents)
diff --git a/lib/test_firmware.c b/lib/test_firmware.c
index cee000ac54d8..b984806d7d7b 100644
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -618,8 +618,9 @@ static ssize_t trigger_batched_requests_store(struct device *dev,
 
         mutex_lock(&test_fw_mutex);
 
-        test_fw_config->reqs = vzalloc(sizeof(struct test_batched_req) *
-                                       test_fw_config->num_requests * 2);
+        test_fw_config->reqs =
+                vzalloc(array3_size(sizeof(struct test_batched_req),
+                                    test_fw_config->num_requests, 2));
         if (!test_fw_config->reqs) {
                 rc = -ENOMEM;
                 goto out_unlock;
@@ -720,8 +721,9 @@ ssize_t trigger_batched_requests_async_store(struct device *dev,
 
         mutex_lock(&test_fw_mutex);
 
-        test_fw_config->reqs = vzalloc(sizeof(struct test_batched_req) *
-                                       test_fw_config->num_requests * 2);
+        test_fw_config->reqs =
+                vzalloc(array3_size(sizeof(struct test_batched_req),
+                                    test_fw_config->num_requests, 2));
         if (!test_fw_config->reqs) {
                 rc = -ENOMEM;
                 goto out;
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index 0e5b7a61460b..e3ddd836491f 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -779,8 +779,9 @@ static int kmod_config_sync_info(struct kmod_test_device *test_dev)
         struct test_config *config = &test_dev->config;
 
         free_test_dev_info(test_dev);
-        test_dev->info = vzalloc(config->num_threads *
-                                 sizeof(struct kmod_test_device_info));
+        test_dev->info =
+                vzalloc(array_size(sizeof(struct kmod_test_device_info),
+                                   config->num_threads));
         if (!test_dev->info)
                 return -ENOMEM;
 
diff --git a/lib/test_overflow.c b/lib/test_overflow.c
index aecbbb217305..2278fe05a1b0 100644
--- a/lib/test_overflow.c
+++ b/lib/test_overflow.c
@@ -367,7 +367,7 @@ static int __init test_overflow_allocation(void)
 
         /* Create dummy device for devm_kmalloc()-family tests. */
         dev = root_device_register(device_name);
-        if (!dev) {
+        if (IS_ERR(dev)) {
                 pr_warn("Cannot register test device\n");
                 return 1;
         }
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index f4000c137dbe..fb6968109113 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -285,12 +285,14 @@ static int __init test_rhltable(unsigned int entries)
         if (entries == 0)
                 entries = 1;
 
-        rhl_test_objects = vzalloc(sizeof(*rhl_test_objects) * entries);
+        rhl_test_objects = vzalloc(array_size(entries,
+                                              sizeof(*rhl_test_objects)));
         if (!rhl_test_objects)
                 return -ENOMEM;
 
         ret = -ENOMEM;
-        obj_in_table = vzalloc(BITS_TO_LONGS(entries) * sizeof(unsigned long));
+        obj_in_table = vzalloc(array_size(sizeof(unsigned long),
+                                          BITS_TO_LONGS(entries)));
         if (!obj_in_table)
                 goto out_free;
 
@@ -706,7 +708,8 @@ static int __init test_rht_init(void)
         test_rht_params.max_size = max_size ? : roundup_pow_of_two(entries);
         test_rht_params.nelem_hint = size;
 
-        objs = vzalloc((test_rht_params.max_size + 1) * sizeof(struct test_obj));
+        objs = vzalloc(array_size(sizeof(struct test_obj),
+                                  test_rht_params.max_size + 1));
         if (!objs)
                 return -ENOMEM;
 
@@ -753,10 +756,10 @@ static int __init test_rht_init(void)
         pr_info("Testing concurrent rhashtable access from %d threads\n",
                 tcount);
         sema_init(&prestart_sem, 1 - tcount);
-        tdata = vzalloc(tcount * sizeof(struct thread_data));
+        tdata = vzalloc(array_size(tcount, sizeof(struct thread_data)));
         if (!tdata)
                 return -ENOMEM;
-        objs  = vzalloc(tcount * entries * sizeof(struct test_obj));
+        objs  = vzalloc(array3_size(sizeof(struct test_obj), tcount, entries));
         if (!objs) {
                 vfree(tdata);
                 return -ENOMEM;
diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c
index 0f44759486e2..6a473709e9b6 100644
--- a/mm/gup_benchmark.c
+++ b/mm/gup_benchmark.c
@@ -23,7 +23,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
         struct page **pages;
 
         nr_pages = gup->size / PAGE_SIZE;
-        pages = kvzalloc(sizeof(void *) * nr_pages, GFP_KERNEL);
+        pages = kvcalloc(nr_pages, sizeof(void *), GFP_KERNEL);
         if (!pages)
                 return -ENOMEM;
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index ba8fdc0b6e7f..1cd7c1a57a14 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1131,8 +1131,8 @@ static int do_huge_pmd_wp_page_fallback(struct vm_fault *vmf, pmd_t orig_pmd,
         unsigned long mmun_start;       /* For mmu_notifiers */
         unsigned long mmun_end;         /* For mmu_notifiers */
 
-        pages = kmalloc(sizeof(struct page *) * HPAGE_PMD_NR,
-                        GFP_KERNEL);
+        pages = kmalloc_array(HPAGE_PMD_NR, sizeof(struct page *),
+                              GFP_KERNEL);
         if (unlikely(!pages)) {
                 ret |= VM_FAULT_OOM;
                 goto out;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 696befffe6f7..3612fbb32e9d 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2798,7 +2798,8 @@ static int __init hugetlb_init(void)
         num_fault_mutexes = 1;
 #endif
         hugetlb_fault_mutex_table =
-                kmalloc(sizeof(struct mutex) * num_fault_mutexes, GFP_KERNEL);
+                kmalloc_array(num_fault_mutexes, sizeof(struct mutex),
+                              GFP_KERNEL);
         BUG_ON(!hugetlb_fault_mutex_table);
 
         for (i = 0; i < num_fault_mutexes; i++)
diff --git a/mm/percpu-stats.c b/mm/percpu-stats.c
index 063ff60ecd90..b5fdd43b60c9 100644
--- a/mm/percpu-stats.c
+++ b/mm/percpu-stats.c
@@ -144,7 +144,7 @@ alloc_buffer:
         spin_unlock_irq(&pcpu_lock);
 
         /* there can be at most this many free and allocated fragments */
-        buffer = vmalloc((2 * max_nr_alloc + 1) * sizeof(int));
+        buffer = vmalloc(array_size(sizeof(int), (2 * max_nr_alloc + 1)));
         if (!buffer)
                 return -ENOMEM;
 
diff --git a/mm/slab.c b/mm/slab.c
index 36688f6c87eb..aa76a70e087e 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4338,7 +4338,8 @@ static int leaks_show(struct seq_file *m, void *p)
         if (x[0] == x[1]) {
                 /* Increase the buffer size */
                 mutex_unlock(&slab_mutex);
-                m->private = kzalloc(x[0] * 4 * sizeof(unsigned long), GFP_KERNEL);
+                m->private = kcalloc(x[0] * 4, sizeof(unsigned long),
+                                     GFP_KERNEL);
                 if (!m->private) {
                         /* Too bad, we are really out */
                         m->private = x;
diff --git a/mm/slub.c b/mm/slub.c
index 15505479c3ab..a3b8467c14af 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3623,8 +3623,9 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
 #ifdef CONFIG_SLUB_DEBUG
         void *addr = page_address(page);
         void *p;
-        unsigned long *map = kzalloc(BITS_TO_LONGS(page->objects) *
-                                     sizeof(long), GFP_ATOMIC);
+        unsigned long *map = kcalloc(BITS_TO_LONGS(page->objects),
+                                     sizeof(long),
+                                     GFP_ATOMIC);
         if (!map)
                 return;
         slab_err(s, page, text, s->name);
@@ -4412,8 +4413,9 @@ static long validate_slab_cache(struct kmem_cache *s)
 {
         int node;
         unsigned long count = 0;
-        unsigned long *map = kmalloc(BITS_TO_LONGS(oo_objects(s->max)) *
-                                sizeof(unsigned long), GFP_KERNEL);
+        unsigned long *map = kmalloc_array(BITS_TO_LONGS(oo_objects(s->max)),
+                                           sizeof(unsigned long),
+                                           GFP_KERNEL);
         struct kmem_cache_node *n;
 
         if (!map)
@@ -4573,8 +4575,9 @@ static int list_locations(struct kmem_cache *s, char *buf,
         unsigned long i;
         struct loc_track t = { 0, 0, NULL };
         int node;
-        unsigned long *map = kmalloc(BITS_TO_LONGS(oo_objects(s->max)) *
-                                     sizeof(unsigned long), GFP_KERNEL);
+        unsigned long *map = kmalloc_array(BITS_TO_LONGS(oo_objects(s->max)),
+                                           sizeof(unsigned long),
+                                           GFP_KERNEL);
         struct kmem_cache_node *n;
 
         if (!map || !alloc_loc_track(&t, PAGE_SIZE / sizeof(struct location),
@@ -4750,7 +4753,7 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
         int x;
         unsigned long *nodes;
 
-        nodes = kzalloc(sizeof(unsigned long) * nr_node_ids, GFP_KERNEL);
+        nodes = kcalloc(nr_node_ids, sizeof(unsigned long), GFP_KERNEL);
         if (!nodes)
                 return -ENOMEM;
 
@@ -5293,7 +5296,7 @@ static int show_stat(struct kmem_cache *s, char *buf, enum stat_item si)
         unsigned long sum  = 0;
         int cpu;
         int len;
-        int *data = kmalloc(nr_cpu_ids * sizeof(int), GFP_KERNEL);
+        int *data = kmalloc_array(nr_cpu_ids, sizeof(int), GFP_KERNEL);
 
         if (!data)
                 return -ENOMEM;
diff --git a/mm/swap_slots.c b/mm/swap_slots.c
index f51ac051c0c9..a791411fed71 100644
--- a/mm/swap_slots.c
+++ b/mm/swap_slots.c
@@ -122,12 +122,12 @@ static int alloc_swap_slot_cache(unsigned int cpu)
          * as kvzalloc could trigger reclaim and get_swap_page,
          * which can lock swap_slots_cache_mutex.
          */
-        slots = kvzalloc(sizeof(swp_entry_t) * SWAP_SLOTS_CACHE_SIZE,
+        slots = kvcalloc(SWAP_SLOTS_CACHE_SIZE, sizeof(swp_entry_t),
                          GFP_KERNEL);
         if (!slots)
                 return -ENOMEM;
 
-        slots_ret = kvzalloc(sizeof(swp_entry_t) * SWAP_SLOTS_CACHE_SIZE,
+        slots_ret = kvcalloc(SWAP_SLOTS_CACHE_SIZE, sizeof(swp_entry_t),
                              GFP_KERNEL);
         if (!slots_ret) {
                 kvfree(slots);
diff --git a/mm/swap_state.c b/mm/swap_state.c
index ab8e59cd18ea..ecee9c6c4cc1 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -620,7 +620,7 @@ int init_swap_address_space(unsigned int type, unsigned long nr_pages)
         unsigned int i, nr;
 
         nr = DIV_ROUND_UP(nr_pages, SWAP_ADDRESS_SPACE_PAGES);
-        spaces = kvzalloc(sizeof(struct address_space) * nr, GFP_KERNEL);
+        spaces = kvcalloc(nr, sizeof(struct address_space), GFP_KERNEL);
         if (!spaces)
                 return -ENOMEM;
         for (i = 0; i < nr; i++) {
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 78a015fcec3b..925cf795a652 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -3196,7 +3196,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
                 p->cluster_next = 1 + (prandom_u32() % p->highest_bit);
                 nr_cluster = DIV_ROUND_UP(maxpages, SWAPFILE_CLUSTER);
 
-                cluster_info = kvzalloc(nr_cluster * sizeof(*cluster_info),
+                cluster_info = kvcalloc(nr_cluster, sizeof(*cluster_info),
                                         GFP_KERNEL);
                 if (!cluster_info) {
                         error = -ENOMEM;
@@ -3233,7 +3233,8 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
         }
         /* frontswap enabled? set up bit-per-page map for frontswap */
         if (IS_ENABLED(CONFIG_FRONTSWAP))
-                frontswap_map = kvzalloc(BITS_TO_LONGS(maxpages) * sizeof(long),
+                frontswap_map = kvcalloc(BITS_TO_LONGS(maxpages),
+                                         sizeof(long),
                                          GFP_KERNEL);
 
         if (p->bdev &&(swap_flags & SWAP_FLAG_DISCARD) && swap_discardable(p)) {
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 16e10680518c..931ea00c4fed 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -242,8 +242,9 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                                                 "w", nwname);
                                 if (!errcode) {
                                         *wnames =
-                                            kmalloc(sizeof(char *) * *nwname,
-                                                    GFP_NOFS);
+                                            kmalloc_array(*nwname,
+                                                          sizeof(char *),
+                                                          GFP_NOFS);
                                         if (!*wnames)
                                                 errcode = -ENOMEM;
                                 }
@@ -285,9 +286,9 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                     p9pdu_readf(pdu, proto_version, "w", nwqid);
                                 if (!errcode) {
                                         *wqids =
-                                            kmalloc(*nwqid *
-                                                    sizeof(struct p9_qid),
-                                                    GFP_NOFS);
+                                            kmalloc_array(*nwqid,
+                                                          sizeof(struct p9_qid),
+                                                          GFP_NOFS);
                                         if (*wqids == NULL)
                                                 errcode = -ENOMEM;
                                 }
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 4d0372263e5d..05006cbb3361 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -360,7 +360,8 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
                 nr_pages = DIV_ROUND_UP((unsigned long)p + len, PAGE_SIZE) -
                            (unsigned long)p / PAGE_SIZE;
 
-                *pages = kmalloc(sizeof(struct page *) * nr_pages, GFP_NOFS);
+                *pages = kmalloc_array(nr_pages, sizeof(struct page *),
+                                       GFP_NOFS);
                 if (!*pages)
                         return -ENOMEM;
 
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 31e0dcb970f8..75620c2f2617 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -472,7 +472,7 @@ static const uint8_t *copy_macs(struct mpoa_client *mpc,
                 if (mpc->number_of_mps_macs != 0)
                         kfree(mpc->mps_macs);
                 mpc->number_of_mps_macs = 0;
-                mpc->mps_macs = kmalloc(num_macs * ETH_ALEN, GFP_KERNEL);
+                mpc->mps_macs = kmalloc_array(ETH_ALEN, num_macs, GFP_KERNEL);
                 if (mpc->mps_macs == NULL) {
                         pr_info("(%s) out of mem\n", mpc->dev->name);
                         return NULL;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 1dec33790198..ee8ef1228263 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1281,7 +1281,7 @@ int hci_inquiry(void __user *arg)
         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
          * copy it to the user space.
          */
-        buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
+        buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
         if (!buf) {
                 err = -ENOMEM;
                 goto done;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9b7907ebfa01..d17a4736e47c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -331,7 +331,7 @@ static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
          */
         alloc_size = roundup_pow_of_two(size);
 
-        seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
+        seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
         if (!seq_list->list)
                 return -ENOMEM;
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index cb4729539b82..920665dd92db 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -333,7 +333,7 @@ static int br_mdb_rehash(struct net_bridge_mdb_htable __rcu **mdbp, int max,
         mdb->max = max;
         mdb->old = old;
 
-        mdb->mhash = kzalloc(max * sizeof(*mdb->mhash), GFP_ATOMIC);
+        mdb->mhash = kcalloc(max, sizeof(*mdb->mhash), GFP_ATOMIC);
         if (!mdb->mhash) {
                 kfree(mdb);
                 return -ENOMEM;
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 28f68a2ec911..684b66bfa199 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -903,12 +903,13 @@ static int translate_table(struct net *net, const char *name,
                  * if an error occurs
                  */
                 newinfo->chainstack =
-                        vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
+                        vmalloc(array_size(nr_cpu_ids,
+                                           sizeof(*(newinfo->chainstack))));
                 if (!newinfo->chainstack)
                         return -ENOMEM;
                 for_each_possible_cpu(i) {
                         newinfo->chainstack[i] =
-                          vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
+                          vmalloc(array_size(udc_cnt, sizeof(*(newinfo->chainstack[0]))));
                         if (!newinfo->chainstack[i]) {
                                 while (i)
                                         vfree(newinfo->chainstack[--i]);
@@ -918,7 +919,7 @@ static int translate_table(struct net *net, const char *name,
                         }
                 }
 
-                cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
+                cl_s = vmalloc(array_size(udc_cnt, sizeof(*cl_s)));
                 if (!cl_s)
                         return -ENOMEM;
                 i = 0; /* the i'th udc */
@@ -1293,7 +1294,7 @@ static int do_update_counters(struct net *net, const char *name,
         if (num_counters == 0)
                 return -EINVAL;
 
-        tmp = vmalloc(num_counters * sizeof(*tmp));
+        tmp = vmalloc(array_size(num_counters, sizeof(*tmp)));
         if (!tmp)
                 return -ENOMEM;
 
@@ -1434,7 +1435,7 @@ static int copy_counters_to_user(struct ebt_table *t,
                 return -EINVAL;
         }
 
-        counterstmp = vmalloc(nentries * sizeof(*counterstmp));
+        counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp)));
         if (!counterstmp)
                 return -ENOMEM;
 
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 97fedff3f0c4..9393f25df08d 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -923,8 +923,9 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 
                 /* create array for CAN frames and copy the data */
                 if (msg_head->nframes > 1) {
-                        op->frames = kmalloc(msg_head->nframes * op->cfsiz,
-                                             GFP_KERNEL);
+                        op->frames = kmalloc_array(msg_head->nframes,
+                                                   op->cfsiz,
+                                                   GFP_KERNEL);
                         if (!op->frames) {
                                 kfree(op);
                                 return -ENOMEM;
@@ -1095,15 +1096,17 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 
                 if (msg_head->nframes > 1) {
                         /* create array for CAN frames and copy the data */
-                        op->frames = kmalloc(msg_head->nframes * op->cfsiz,
-                                             GFP_KERNEL);
+                        op->frames = kmalloc_array(msg_head->nframes,
+                                                   op->cfsiz,
+                                                   GFP_KERNEL);
                         if (!op->frames) {
                                 kfree(op);
                                 return -ENOMEM;
                         }
 
                         /* create and init array for received CAN frames */
-                        op->last_frames = kzalloc(msg_head->nframes * op->cfsiz,
+                        op->last_frames = kcalloc(msg_head->nframes,
+                                                  op->cfsiz,
                                                   GFP_KERNEL);
                         if (!op->last_frames) {
                                 kfree(op->frames);
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 9645ffd6acfb..e22820e24f50 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1299,8 +1299,9 @@ static int set_primary_affinity(struct ceph_osdmap *map, int osd, u32 aff)
         if (!map->osd_primary_affinity) {
                 int i;
 
-                map->osd_primary_affinity = kmalloc(map->max_osd*sizeof(u32),
-                                                    GFP_NOFS);
+                map->osd_primary_affinity = kmalloc_array(map->max_osd,
+                                                          sizeof(u32),
+                                                          GFP_NOFS);
                 if (!map->osd_primary_affinity)
                         return -ENOMEM;
 
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
index a3d0adc828e6..e560d3975f41 100644
--- a/net/ceph/pagevec.c
+++ b/net/ceph/pagevec.c
@@ -20,7 +20,7 @@ struct page **ceph_get_direct_page_vector(const void __user *data,
         int got = 0;
         int rc = 0;
 
-        pages = kmalloc(sizeof(*pages) * num_pages, GFP_NOFS);
+        pages = kmalloc_array(num_pages, sizeof(*pages), GFP_NOFS);
         if (!pages)
                 return ERR_PTR(-ENOMEM);
 
@@ -74,7 +74,7 @@ struct page **ceph_alloc_page_vector(int num_pages, gfp_t flags)
         struct page **pages;
         int i;
 
-        pages = kmalloc(sizeof(*pages) * num_pages, flags);
+        pages = kmalloc_array(num_pages, sizeof(*pages), flags);
         if (!pages)
                 return ERR_PTR(-ENOMEM);
         for (i = 0; i < num_pages; i++) {
diff --git a/net/core/dev.c b/net/core/dev.c
index 6e18242a1cae..57b7bab5f70b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8823,7 +8823,7 @@ static struct hlist_head * __net_init netdev_create_hash(void)
         int i;
         struct hlist_head *hash;
 
-        hash = kmalloc(sizeof(*hash) * NETDEV_HASHENTRIES, GFP_KERNEL);
+        hash = kmalloc_array(NETDEV_HASHENTRIES, sizeof(*hash), GFP_KERNEL);
         if (hash != NULL)
                 for (i = 0; i < NETDEV_HASHENTRIES; i++)
                         INIT_HLIST_HEAD(&hash[i]);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index c15075dc7572..e677a20180cf 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -911,7 +911,7 @@ static noinline_for_stack int ethtool_get_sset_info(struct net_device *dev,
         memset(&info, 0, sizeof(info));
         info.cmd = ETHTOOL_GSSET_INFO;
 
-        info_buf = kzalloc(n_bits * sizeof(u32), GFP_USER);
+        info_buf = kcalloc(n_bits, sizeof(u32), GFP_USER);
         if (!info_buf)
                 return -ENOMEM;
 
@@ -1017,7 +1017,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
         if (info.cmd == ETHTOOL_GRXCLSRLALL) {
                 if (info.rule_cnt > 0) {
                         if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
-                                rule_buf = kzalloc(info.rule_cnt * sizeof(u32),
+                                rule_buf = kcalloc(info.rule_cnt, sizeof(u32),
                                                    GFP_USER);
                         if (!rule_buf)
                                 return -ENOMEM;
@@ -1816,7 +1816,7 @@ static int ethtool_self_test(struct net_device *dev, char __user *useraddr)
                 return -EFAULT;
 
         test.len = test_len;
-        data = kmalloc(test_len * sizeof(u64), GFP_USER);
+        data = kmalloc_array(test_len, sizeof(u64), GFP_USER);
         if (!data)
                 return -ENOMEM;
 
@@ -1852,7 +1852,7 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr)
         WARN_ON_ONCE(!ret);
 
         gstrings.len = ret;
-        data = vzalloc(gstrings.len * ETH_GSTRING_LEN);
+        data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
         if (gstrings.len && !data)
                 return -ENOMEM;
 
@@ -1952,7 +1952,7 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
                 return -EFAULT;
 
         stats.n_stats = n_stats;
-        data = vzalloc(n_stats * sizeof(u64));
+        data = vzalloc(array_size(n_stats, sizeof(u64)));
         if (n_stats && !data)
                 return -ENOMEM;
 
@@ -1996,7 +1996,7 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
                 return -EFAULT;
 
         stats.n_stats = n_stats;
-        data = vzalloc(n_stats * sizeof(u64));
+        data = vzalloc(array_size(n_stats, sizeof(u64)));
         if (n_stats && !data)
                 return -ENOMEM;
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 7e4ede34cc52..49368e21d228 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3603,7 +3603,8 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
                 return -ENOMEM;
 
         strcpy(pkt_dev->odevname, ifname);
-        pkt_dev->flows = vzalloc_node(MAX_CFLOWS * sizeof(struct flow_state),
+        pkt_dev->flows = vzalloc_node(array_size(MAX_CFLOWS,
+                                                 sizeof(struct flow_state)),
                                       node);
         if (pkt_dev->flows == NULL) {
                 kfree(pkt_dev);
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index d2f4e0c1faaf..2589a6b78aa1 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -984,7 +984,8 @@ static int dcbnl_build_peer_app(struct net_device *netdev, struct sk_buff* skb,
          */
         err = ops->peer_getappinfo(netdev, &info, &app_count);
         if (!err && app_count) {
-                table = kmalloc(sizeof(struct dcb_app) * app_count, GFP_KERNEL);
+                table = kmalloc_array(app_count, sizeof(struct dcb_app),
+                                      GFP_KERNEL);
                 if (!table)
                         return -ENOMEM;
 
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 385f153fe031..2b75df469220 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -46,7 +46,8 @@ static int ccid2_hc_tx_alloc_seq(struct ccid2_hc_tx_sock *hc)
                 return -ENOMEM;
 
         /* allocate buffer and initialize linked list */
-        seqp = kmalloc(CCID2_SEQBUF_LEN * sizeof(struct ccid2_seq), gfp_any());
+        seqp = kmalloc_array(CCID2_SEQBUF_LEN, sizeof(struct ccid2_seq),
+                             gfp_any());
         if (seqp == NULL)
                 return -ENOMEM;
 
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index dc2960be51e0..b231e40f006a 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -38,7 +38,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 portid,
 {
         void *hdr;
         int i, pages = 0;
-        uint32_t *buf = kzalloc(32 * sizeof(uint32_t), GFP_KERNEL);
+        uint32_t *buf = kcalloc(32, sizeof(uint32_t), GFP_KERNEL);
 
         pr_debug("%s\n", __func__);
 
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 63aa39b3af03..b21833651394 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -567,7 +567,7 @@ static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt,
                 struct nlattr *mx;
                 int len = 0;
 
-                mx = kzalloc(3 * nla_total_size(4), GFP_KERNEL);
+                mx = kcalloc(3, nla_total_size(4), GFP_KERNEL);
                 if (!mx)
                         return -ENOMEM;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index bf4e4adc2d00..1df6e97106d7 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -649,7 +649,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
 
         hash = rcu_dereference(nh->nh_exceptions);
         if (!hash) {
-                hash = kzalloc(FNHE_HASH_SIZE * sizeof(*hash), GFP_ATOMIC);
+                hash = kcalloc(FNHE_HASH_SIZE, sizeof(*hash), GFP_ATOMIC);
                 if (!hash)
                         goto out_unlock;
                 rcu_assign_pointer(nh->nh_exceptions, hash);
@@ -3146,7 +3146,8 @@ int __init ip_rt_init(void)
 {
         int cpu;
 
-        ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
+        ip_idents = kmalloc_array(IP_IDENTS_SZ, sizeof(*ip_idents),
+                                  GFP_KERNEL);
         if (!ip_idents)
                 panic("IP: failed to allocate ip_idents\n");
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index d8c4b6374377..be491bf6ab6e 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -956,7 +956,7 @@ static int __net_init icmpv6_sk_init(struct net *net)
         int err, i, j;
 
         net->ipv6.icmp_sk =
-                kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
+                kcalloc(nr_cpu_ids, sizeof(struct sock *), GFP_KERNEL);
         if (!net->ipv6.icmp_sk)
                 return -ENOMEM;
 
diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 44c39c5f0638..10ae13560b40 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -42,7 +42,8 @@ static int alloc_ila_locks(struct ila_net *ilan)
         size = roundup_pow_of_two(nr_pcpus * LOCKS_PER_CPU);
 
         if (sizeof(spinlock_t) != 0) {
-                ilan->locks = kvmalloc(size * sizeof(spinlock_t), GFP_KERNEL);
+                ilan->locks = kvmalloc_array(size, sizeof(spinlock_t),
+                                             GFP_KERNEL);
                 if (!ilan->locks)
                         return -ENOMEM;
                 for (i = 0; i < size; i++)
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 89178b46b32f..d9558ffb8acf 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -1186,7 +1186,7 @@ static int ieee80211_chsw_switch_vifs(struct ieee80211_local *local,
         lockdep_assert_held(&local->mtx);
         lockdep_assert_held(&local->chanctx_mtx);
 
-        vif_chsw = kzalloc(sizeof(vif_chsw[0]) * n_vifs, GFP_KERNEL);
+        vif_chsw = kcalloc(n_vifs, sizeof(vif_chsw[0]), GFP_KERNEL);
         if (!vif_chsw)
                 return -ENOMEM;
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 4d2e797e3f16..fb1b1f9e7e5e 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -772,7 +772,7 @@ static int ieee80211_init_cipher_suites(struct ieee80211_local *local)
                 if (have_mfp)
                         n_suites += 4;
 
-                suites = kmalloc(sizeof(u32) * n_suites, GFP_KERNEL);
+                suites = kmalloc_array(n_suites, sizeof(u32), GFP_KERNEL);
                 if (!suites)
                         return -ENOMEM;
 
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 8221bc5582ab..76048b53c5b2 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -592,11 +592,11 @@ minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
                         max_rates = sband->n_bitrates;
         }
 
-        mi->r = kzalloc(sizeof(struct minstrel_rate) * max_rates, gfp);
+        mi->r = kcalloc(max_rates, sizeof(struct minstrel_rate), gfp);
         if (!mi->r)
                 goto error;
 
-        mi->sample_table = kmalloc(SAMPLE_COLUMNS * max_rates, gfp);
+        mi->sample_table = kmalloc_array(max_rates, SAMPLE_COLUMNS, gfp);
         if (!mi->sample_table)
                 goto error1;
 
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index fb586b6e5d49..67ebdeaffbbc 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -1313,11 +1313,11 @@ minstrel_ht_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
         if (!msp)
                 return NULL;
 
-        msp->ratelist = kzalloc(sizeof(struct minstrel_rate) * max_rates, gfp);
+        msp->ratelist = kcalloc(max_rates, sizeof(struct minstrel_rate), gfp);
         if (!msp->ratelist)
                 goto error;
 
-        msp->sample_table = kmalloc(SAMPLE_COLUMNS * max_rates, gfp);
+        msp->sample_table = kmalloc_array(max_rates, SAMPLE_COLUMNS, gfp);
         if (!msp->sample_table)
                 goto error1;
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index a3b1bcc2b461..2e917a6d239d 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -1157,7 +1157,7 @@ int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        ie = kzalloc(num_bands * iebufsz, GFP_KERNEL);
+        ie = kcalloc(iebufsz, num_bands, GFP_KERNEL);
         if (!ie) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 2d82c88efd0b..5e2e511c4a6f 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1803,8 +1803,9 @@ static int ieee80211_reconfig_nan(struct ieee80211_sub_if_data *sdata)
         if (WARN_ON(res))
                 return res;
 
-        funcs = kzalloc((sdata->local->hw.max_nan_de_entries + 1) *
-                        sizeof(*funcs), GFP_KERNEL);
+        funcs = kcalloc(sdata->local->hw.max_nan_de_entries + 1,
+                        sizeof(*funcs),
+                        GFP_KERNEL);
         if (!funcs)
                 return -ENOMEM;
 
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 61c3a389da89..99e0aa350dc5 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -1380,7 +1380,8 @@ int __init ip_vs_conn_init(void)
         /*
          * Allocate the connection hash table and initialize its list heads
          */
-        ip_vs_conn_tab = vmalloc(ip_vs_conn_tab_size * sizeof(*ip_vs_conn_tab));
+        ip_vs_conn_tab = vmalloc(array_size(ip_vs_conn_tab_size,
+                                            sizeof(*ip_vs_conn_tab)));
         if (!ip_vs_conn_tab)
                 return -ENOMEM;
 
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index afdeca53e88b..d88841fbc560 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -402,7 +402,8 @@ int nf_ct_l4proto_register_one(const struct nf_conntrack_l4proto *l4proto)
                 struct nf_conntrack_l4proto __rcu **proto_array;
                 int i;
 
-                proto_array = kmalloc(MAX_NF_CT_PROTO *
+                proto_array =
+                        kmalloc_array(MAX_NF_CT_PROTO,
                                       sizeof(struct nf_conntrack_l4proto *),
                                       GFP_KERNEL);
                 if (proto_array == NULL) {
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index b7df32a56e7e..46f9df99d276 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -691,8 +691,9 @@ int nf_nat_l4proto_register(u8 l3proto, const struct nf_nat_l4proto *l4proto)
 
         mutex_lock(&nf_nat_proto_mutex);
         if (nf_nat_l4protos[l3proto] == NULL) {
-                l4protos = kmalloc(IPPROTO_MAX * sizeof(struct nf_nat_l4proto *),
-                                   GFP_KERNEL);
+                l4protos = kmalloc_array(IPPROTO_MAX,
+                                         sizeof(struct nf_nat_l4proto *),
+                                         GFP_KERNEL);
                 if (l4protos == NULL) {
                         ret = -ENOMEM;
                         goto out;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ca4c4d994ddb..f0411fbffe77 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5303,7 +5303,7 @@ static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
         if (err < 0)
                 return err;
 
-        ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
+        ops = kcalloc(n, sizeof(struct nf_hook_ops), GFP_KERNEL);
         if (!ops)
                 return -ENOMEM;
 
@@ -7164,8 +7164,8 @@ static int __init nf_tables_module_init(void)
 
         nft_chain_filter_init();
 
-        info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
-                       GFP_KERNEL);
+        info = kmalloc_array(NFT_RULE_MAXEXPRS, sizeof(struct nft_expr_info),
+                             GFP_KERNEL);
         if (info == NULL) {
                 err = -ENOMEM;
                 goto err1;
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index cb5b5f207777..e5d27b2e4eba 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -190,8 +190,9 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
         if (class_max > NF_CT_MAX_EXPECT_CLASSES)
                 return -EOVERFLOW;
 
-        expect_policy = kzalloc(sizeof(struct nf_conntrack_expect_policy) *
-                                class_max, GFP_KERNEL);
+        expect_policy = kcalloc(class_max,
+                                sizeof(struct nf_conntrack_expect_policy),
+                                GFP_KERNEL);
         if (expect_policy == NULL)
                 return -ENOMEM;
 
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index df9ab71b0ed9..d0d8397c9588 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1904,7 +1904,7 @@ static int __init xt_init(void)
                 seqcount_init(&per_cpu(xt_recseq, i));
         }
 
-        xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);
+        xt = kmalloc_array(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
         if (!xt)
                 return -ENOMEM;
 
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index b9ce82c9440f..25eeb6d2a75a 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -352,8 +352,9 @@ int genl_register_family(struct genl_family *family)
         }
 
         if (family->maxattr && !family->parallel_ops) {
-                family->attrbuf = kmalloc((family->maxattr+1) *
-                                        sizeof(struct nlattr *), GFP_KERNEL);
+                family->attrbuf = kmalloc_array(family->maxattr + 1,
+                                                sizeof(struct nlattr *),
+                                                GFP_KERNEL);
                 if (family->attrbuf == NULL) {
                         err = -ENOMEM;
                         goto errout_locked;
@@ -566,8 +567,9 @@ static int genl_family_rcv_msg(const struct genl_family *family,
                 return -EOPNOTSUPP;
 
         if (family->maxattr && family->parallel_ops) {
-                attrbuf = kmalloc((family->maxattr+1) *
-                                        sizeof(struct nlattr *), GFP_KERNEL);
+                attrbuf = kmalloc_array(family->maxattr + 1,
+                                        sizeof(struct nlattr *),
+                                        GFP_KERNEL);
                 if (attrbuf == NULL)
                         return -ENOMEM;
         } else
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index b97eb766a1d5..93fbcafbf388 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1395,7 +1395,7 @@ static int __init nr_proto_init(void)
                 return -1;
         }
 
-        dev_nr = kzalloc(nr_ndevs * sizeof(struct net_device *), GFP_KERNEL);
+        dev_nr = kcalloc(nr_ndevs, sizeof(struct net_device *), GFP_KERNEL);
         if (dev_nr == NULL) {
                 printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device array\n");
                 return -1;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index a61818e94396..0f5ce77460d4 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1578,8 +1578,9 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
                 goto err_destroy_table;
         }
 
-        dp->ports = kmalloc(DP_VPORT_HASH_BUCKETS * sizeof(struct hlist_head),
-                            GFP_KERNEL);
+        dp->ports = kmalloc_array(DP_VPORT_HASH_BUCKETS,
+                                  sizeof(struct hlist_head),
+                                  GFP_KERNEL);
         if (!dp->ports) {
                 err = -ENOMEM;
                 goto err_destroy_percpu;
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index f81c1d0ddff4..19f6765566e7 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -47,7 +47,7 @@ static struct hlist_head *dev_table;
  */
 int ovs_vport_init(void)
 {
-        dev_table = kzalloc(VPORT_HASH_BUCKETS * sizeof(struct hlist_head),
+        dev_table = kcalloc(VPORT_HASH_BUCKETS, sizeof(struct hlist_head),
                             GFP_KERNEL);
         if (!dev_table)
                 return -ENOMEM;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ee018564b2b4..50809748c127 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4161,7 +4161,7 @@ static char *alloc_one_pg_vec_page(unsigned long order)
                 return buffer;
 
         /* __get_free_pages failed, fall back to vmalloc */
-        buffer = vzalloc((1 << order) * PAGE_SIZE);
+        buffer = vzalloc(array_size((1 << order), PAGE_SIZE));
         if (buffer)
                 return buffer;
 
diff --git a/net/rds/ib.c b/net/rds/ib.c
index 02deee29e7f1..b6ad38e48f62 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -163,7 +163,8 @@ static void rds_ib_add_one(struct ib_device *device)
         rds_ibdev->max_initiator_depth = device->attrs.max_qp_init_rd_atom;
         rds_ibdev->max_responder_resources = device->attrs.max_qp_rd_atom;
 
-        rds_ibdev->vector_load = kzalloc(sizeof(int) * device->num_comp_vectors,
+        rds_ibdev->vector_load = kcalloc(device->num_comp_vectors,
+                                         sizeof(int),
                                          GFP_KERNEL);
         if (!rds_ibdev->vector_load) {
                 pr_err("RDS/IB: %s failed to allocate vector memory\n",
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 13b38ad0fa4a..f1684ae6abfd 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -526,7 +526,8 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                 goto recv_hdrs_dma_out;
         }
 
-        ic->i_sends = vzalloc_node(ic->i_send_ring.w_nr * sizeof(struct rds_ib_send_work),
+        ic->i_sends = vzalloc_node(array_size(sizeof(struct rds_ib_send_work),
+                                              ic->i_send_ring.w_nr),
                                    ibdev_to_node(dev));
         if (!ic->i_sends) {
                 ret = -ENOMEM;
@@ -534,7 +535,8 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                 goto ack_dma_out;
         }
 
-        ic->i_recvs = vzalloc_node(ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work),
+        ic->i_recvs = vzalloc_node(array_size(sizeof(struct rds_ib_recv_work),
+                                              ic->i_recv_ring.w_nr),
                                    ibdev_to_node(dev));
         if (!ic->i_recvs) {
                 ret = -ENOMEM;
diff --git a/net/rds/info.c b/net/rds/info.c
index 140a44a5f7b7..e367a97a18c8 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -188,7 +188,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
         nr_pages = (PAGE_ALIGN(start + len) - (start & PAGE_MASK))
                         >> PAGE_SHIFT;
 
-        pages = kmalloc(nr_pages * sizeof(struct page *), GFP_KERNEL);
+        pages = kmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL);
         if (!pages) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 5b73fea849df..ebe42e7eb456 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1514,7 +1514,8 @@ static int __init rose_proto_init(void)
 
         rose_callsign = null_ax25_address;
 
-        dev_rose = kzalloc(rose_ndevs * sizeof(struct net_device *), GFP_KERNEL);
+        dev_rose = kcalloc(rose_ndevs, sizeof(struct net_device *),
+                           GFP_KERNEL);
         if (dev_rose == NULL) {
                 printk(KERN_ERR "ROSE: rose_proto_init - unable to allocate device structure\n");
                 rc = -ENOMEM;
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 6c0ae27fff84..278ac0807a60 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -432,7 +432,7 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
 
         sg = _sg;
         if (unlikely(nsg > 4)) {
-                sg = kmalloc(sizeof(*sg) * nsg, GFP_NOIO);
+                sg = kmalloc_array(nsg, sizeof(*sg), GFP_NOIO);
                 if (!sg)
                         goto nomem;
         }
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 22fa13cf5d8b..cd2e0e342fb6 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -489,11 +489,12 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt,
                 return err;
 
         if (!q->flows) {
-                q->flows = kvzalloc(q->flows_cnt *
-                                           sizeof(struct fq_codel_flow), GFP_KERNEL);
+                q->flows = kvcalloc(q->flows_cnt,
+                                    sizeof(struct fq_codel_flow),
+                                    GFP_KERNEL);
                 if (!q->flows)
                         return -ENOMEM;
-                q->backlogs = kvzalloc(q->flows_cnt * sizeof(u32), GFP_KERNEL);
+                q->backlogs = kvcalloc(q->flows_cnt, sizeof(u32), GFP_KERNEL);
                 if (!q->backlogs)
                         return -ENOMEM;
                 for (i = 0; i < q->flows_cnt; i++) {
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index bce2632212d3..c3a8388dcdf6 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -599,8 +599,8 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt,
 
         if (!q->hh_flows) {
                 /* Initialize heavy-hitter flow table. */
-                q->hh_flows = kvzalloc(HH_FLOWS_CNT *
-                                         sizeof(struct list_head), GFP_KERNEL);
+                q->hh_flows = kvcalloc(HH_FLOWS_CNT, sizeof(struct list_head),
+                                       GFP_KERNEL);
                 if (!q->hh_flows)
                         return -ENOMEM;
                 for (i = 0; i < HH_FLOWS_CNT; i++)
@@ -614,8 +614,9 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt,
 
                 /* Initialize heavy-hitter filter arrays. */
                 for (i = 0; i < HHF_ARRAYS_CNT; i++) {
-                        q->hhf_arrays[i] = kvzalloc(HHF_ARRAYS_LEN *
-                                                      sizeof(u32), GFP_KERNEL);
+                        q->hhf_arrays[i] = kvcalloc(HHF_ARRAYS_LEN,
+                                                    sizeof(u32),
+                                                    GFP_KERNEL);
                         if (!q->hhf_arrays[i]) {
                                 /* Note: hhf_destroy() will be called
                                  * by our caller.
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index e64630cd3331..5b537613946f 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -482,8 +482,9 @@ int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
                 return 0;
 
         /* Allocated the array of pointers to transorms */
-        ep->auth_hmacs = kzalloc(sizeof(struct crypto_shash *) *
-                                 SCTP_AUTH_NUM_HMACS, gfp);
+        ep->auth_hmacs = kcalloc(SCTP_AUTH_NUM_HMACS,
+                                 sizeof(struct crypto_shash *),
+                                 gfp);
         if (!ep->auth_hmacs)
                 return -ENOMEM;
 
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 11d93377ba5e..5dffbc493008 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1438,7 +1438,7 @@ static __init int sctp_init(void)
         /* Allocate and initialize the endpoint hash table.  */
         sctp_ep_hashsize = 64;
         sctp_ep_hashtable =
-                kmalloc(64 * sizeof(struct sctp_hashbucket), GFP_KERNEL);
+                kmalloc_array(64, sizeof(struct sctp_hashbucket), GFP_KERNEL);
         if (!sctp_ep_hashtable) {
                 pr_err("Failed endpoint_hash alloc\n");
                 status = -ENOMEM;
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index cc7c1bb60fe8..dbd2605d1962 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -584,9 +584,9 @@ int smc_wr_alloc_link_mem(struct smc_link *link)
                                    GFP_KERNEL);
         if (!link->wr_rx_sges)
                 goto no_mem_wr_tx_sges;
-        link->wr_tx_mask = kzalloc(
-                BITS_TO_LONGS(SMC_WR_BUF_CNT) * sizeof(*link->wr_tx_mask),
-                GFP_KERNEL);
+        link->wr_tx_mask = kcalloc(BITS_TO_LONGS(SMC_WR_BUF_CNT),
+                                   sizeof(*link->wr_tx_mask),
+                                   GFP_KERNEL);
         if (!link->wr_tx_mask)
                 goto no_mem_wr_rx_sges;
         link->wr_tx_pends = kcalloc(SMC_WR_BUF_CNT,
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 9463af4b32e8..be8f103d22fd 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1753,7 +1753,8 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
         last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT;
         rqstp->rq_enc_pages_num = last - first + 1 + 1;
         rqstp->rq_enc_pages
-                = kmalloc(rqstp->rq_enc_pages_num * sizeof(struct page *),
+                = kmalloc_array(rqstp->rq_enc_pages_num,
+                                sizeof(struct page *),
                                 GFP_NOFS);
         if (!rqstp->rq_enc_pages)
                 goto out;
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index d98e2b610ce8..1c7c49dbf8ba 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -224,7 +224,7 @@ static void gssp_free_receive_pages(struct gssx_arg_accept_sec_context *arg)
 static int gssp_alloc_receive_pages(struct gssx_arg_accept_sec_context *arg)
 {
         arg->npages = DIV_ROUND_UP(NGROUPS_MAX * 4, PAGE_SIZE);
-        arg->pages = kzalloc(arg->npages * sizeof(struct page *), GFP_KERNEL);
+        arg->pages = kcalloc(arg->npages, sizeof(struct page *), GFP_KERNEL);
         /*
          * XXX: actual pages are allocated by xdr layer in
          * xdr_partial_copy_from_skb.
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index cdda4744c9b1..109fbe591e7b 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1683,7 +1683,7 @@ struct cache_detail *cache_create_net(const struct cache_detail *tmpl, struct ne
         if (cd == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        cd->hash_table = kzalloc(cd->hash_size * sizeof(struct hlist_head),
+        cd->hash_table = kcalloc(cd->hash_size, sizeof(struct hlist_head),
                                  GFP_KERNEL);
         if (cd->hash_table == NULL) {
                 kfree(cd);
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 4492cda45566..a2f76743c73a 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -285,8 +285,9 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
         if (!trans_buf)
                 return -ENOMEM;
 
-        attrbuf = kmalloc((tipc_genl_family.maxattr + 1) *
-                        sizeof(struct nlattr *), GFP_KERNEL);
+        attrbuf = kmalloc_array(tipc_genl_family.maxattr + 1,
+                                sizeof(struct nlattr *),
+                                GFP_KERNEL);
         if (!attrbuf) {
                 err = -ENOMEM;
                 goto trans_out;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 07514ca011b2..c7bbe5f0aae8 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -10833,7 +10833,7 @@ static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
         struct nlattr **tb;
         int err;
 
-        tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
+        tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
         if (!tb)
                 return -ENOMEM;
 
@@ -11793,7 +11793,7 @@ static int nl80211_nan_add_func(struct sk_buff *skb,
 
                         func->srf_num_macs = n_entries;
                         func->srf_macs =
-                                kzalloc(sizeof(*func->srf_macs) * n_entries,
+                                kcalloc(n_entries, sizeof(*func->srf_macs),
                                         GFP_KERNEL);
                         if (!func->srf_macs) {
                                 err = -ENOMEM;
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index b9e6b2cafa69..0e566a01d217 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -475,7 +475,7 @@ static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
                 /* currently 4 exec bits and entries 0-3 are reserved iupcx */
                 if (size > 16 - 4)
                         goto fail;
-                profile->file.trans.table = kzalloc(sizeof(char *) * size,
+                profile->file.trans.table = kcalloc(size, sizeof(char *),
                                                     GFP_KERNEL);
                 if (!profile->file.trans.table)
                         goto fail;
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 423776682025..b69d3b1777c2 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1148,7 +1148,7 @@ static long trusted_read(const struct key *key, char __user *buffer,
                 return -EINVAL;
 
         if (buffer && buflen >= 2 * p->blob_len) {
-                ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
+                ascii_buf = kmalloc_array(2, p->blob_len, GFP_KERNEL);
                 if (!ascii_buf)
                         return -ENOMEM;
 
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index a2d44824121c..dd2ceec06fef 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2118,7 +2118,7 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
         int rc = 0;
         struct policy_file file = { data, len }, *fp = &file;
 
-        oldpolicydb = kzalloc(2 * sizeof(*oldpolicydb), GFP_KERNEL);
+        oldpolicydb = kcalloc(2, sizeof(*oldpolicydb), GFP_KERNEL);
         if (!oldpolicydb) {
                 rc = -ENOMEM;
                 goto out;
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index 39d853bfa5ac..946ab080ac00 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -426,7 +426,7 @@ static int snd_pcm_ioctl_xfern_compat(struct snd_pcm_substream *substream,
             get_user(frames, &data32->frames))
                 return -EFAULT;
         bufptr = compat_ptr(buf);
-        bufs = kmalloc(sizeof(void __user *) * ch, GFP_KERNEL);
+        bufs = kmalloc_array(ch, sizeof(void __user *), GFP_KERNEL);
         if (bufs == NULL)
                 return -ENOMEM;
         for (i = 0; i < ch; i++) {
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 04c6301394d0..cecc79772c94 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3072,7 +3072,7 @@ static ssize_t snd_pcm_readv(struct kiocb *iocb, struct iov_iter *to)
         if (!frame_aligned(runtime, to->iov->iov_len))
                 return -EINVAL;
         frames = bytes_to_samples(runtime, to->iov->iov_len);
-        bufs = kmalloc(sizeof(void *) * to->nr_segs, GFP_KERNEL);
+        bufs = kmalloc_array(to->nr_segs, sizeof(void *), GFP_KERNEL);
         if (bufs == NULL)
                 return -ENOMEM;
         for (i = 0; i < to->nr_segs; ++i)
@@ -3107,7 +3107,7 @@ static ssize_t snd_pcm_writev(struct kiocb *iocb, struct iov_iter *from)
             !frame_aligned(runtime, from->iov->iov_len))
                 return -EINVAL;
         frames = bytes_to_samples(runtime, from->iov->iov_len);
-        bufs = kmalloc(sizeof(void *) * from->nr_segs, GFP_KERNEL);
+        bufs = kmalloc_array(from->nr_segs, sizeof(void *), GFP_KERNEL);
         if (bufs == NULL)
                 return -ENOMEM;
         for (i = 0; i < from->nr_segs; ++i)
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index ab1112e90f88..a4c8543176b2 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -389,7 +389,8 @@ int snd_seq_pool_init(struct snd_seq_pool *pool)
         if (snd_BUG_ON(!pool))
                 return -EINVAL;
 
-        cellptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
+        cellptr = vmalloc(array_size(sizeof(struct snd_seq_event_cell),
+                                     pool->size));
         if (!cellptr)
                 return -ENOMEM;
 
diff --git a/sound/core/seq/seq_midi_emul.c b/sound/core/seq/seq_midi_emul.c
index 9e2912e3e80f..288f839a554b 100644
--- a/sound/core/seq/seq_midi_emul.c
+++ b/sound/core/seq/seq_midi_emul.c
@@ -657,7 +657,7 @@ static struct snd_midi_channel *snd_midi_channel_init_set(int n)
         struct snd_midi_channel *chan;
         int  i;
 
-        chan = kmalloc(n * sizeof(struct snd_midi_channel), GFP_KERNEL);
+        chan = kmalloc_array(n, sizeof(struct snd_midi_channel), GFP_KERNEL);
         if (chan) {
                 for (i = 0; i < n; i++)
                         snd_midi_channel_init(chan+i, i);
diff --git a/sound/firewire/fireface/ff-protocol-ff400.c b/sound/firewire/fireface/ff-protocol-ff400.c
index 12aa15df435d..ad7a0a32557d 100644
--- a/sound/firewire/fireface/ff-protocol-ff400.c
+++ b/sound/firewire/fireface/ff-protocol-ff400.c
@@ -147,7 +147,7 @@ static int ff400_switch_fetching_mode(struct snd_ff *ff, bool enable)
         __le32 *reg;
         int i;
 
-        reg = kzalloc(sizeof(__le32) * 18, GFP_KERNEL);
+        reg = kcalloc(18, sizeof(__le32), GFP_KERNEL);
         if (reg == NULL)
                 return -ENOMEM;
 
diff --git a/sound/firewire/packets-buffer.c b/sound/firewire/packets-buffer.c
index ea1506679c66..1ebf00c83409 100644
--- a/sound/firewire/packets-buffer.c
+++ b/sound/firewire/packets-buffer.c
@@ -27,7 +27,7 @@ int iso_packets_buffer_init(struct iso_packets_buffer *b, struct fw_unit *unit,
         void *p;
         int err;
 
-        b->packets = kmalloc(count * sizeof(*b->packets), GFP_KERNEL);
+        b->packets = kmalloc_array(count, sizeof(*b->packets), GFP_KERNEL);
         if (!b->packets) {
                 err = -ENOMEM;
                 goto error;
diff --git a/sound/oss/dmasound/dmasound_core.c b/sound/oss/dmasound/dmasound_core.c
index 8c0f8a9ee0ba..fc9bcd47d6a4 100644
--- a/sound/oss/dmasound/dmasound_core.c
+++ b/sound/oss/dmasound/dmasound_core.c
@@ -420,7 +420,7 @@ static int sq_allocate_buffers(struct sound_queue *sq, int num, int size)
                 return 0;
         sq->numBufs = num;
         sq->bufSize = size;
-        sq->buffers = kmalloc (num * sizeof(char *), GFP_KERNEL);
+        sq->buffers = kmalloc_array (num, sizeof(char *), GFP_KERNEL);
         if (!sq->buffers)
                 return -ENOMEM;
         for (i = 0; i < num; i++) {
diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c
index ed1251c5f449..146e1a3498c7 100644
--- a/sound/pci/cs46xx/cs46xx_lib.c
+++ b/sound/pci/cs46xx/cs46xx_lib.c
@@ -460,7 +460,7 @@ static int load_firmware(struct snd_cs46xx *chip,
                 entry->size = le32_to_cpu(fwdat[fwlen++]);
                 if (fwlen + entry->size > fwsize)
                         goto error_inval;
-                entry->data = kmalloc(entry->size * 4, GFP_KERNEL);
+                entry->data = kmalloc_array(entry->size, 4, GFP_KERNEL);
                 if (!entry->data)
                         goto error;
                 memcpy_le32(entry->data, &fwdat[fwlen], entry->size * 4);
@@ -4036,8 +4036,9 @@ int snd_cs46xx_create(struct snd_card *card,
         snd_cs46xx_proc_init(card, chip);
 
 #ifdef CONFIG_PM_SLEEP
-        chip->saved_regs = kmalloc(sizeof(*chip->saved_regs) *
-                                   ARRAY_SIZE(saved_regs), GFP_KERNEL);
+        chip->saved_regs = kmalloc_array(ARRAY_SIZE(saved_regs),
+                                         sizeof(*chip->saved_regs),
+                                         GFP_KERNEL);
         if (!chip->saved_regs) {
                 snd_cs46xx_free(chip);
                 return -ENOMEM;
diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c
index c44eadef64ae..598d140bb7cb 100644
--- a/sound/pci/cs46xx/dsp_spos.c
+++ b/sound/pci/cs46xx/dsp_spos.c
@@ -240,10 +240,13 @@ struct dsp_spos_instance *cs46xx_dsp_spos_create (struct snd_cs46xx * chip)
                 return NULL;
 
         /* better to use vmalloc for this big table */
-        ins->symbol_table.symbols = vmalloc(sizeof(struct dsp_symbol_entry) *
-                                            DSP_MAX_SYMBOLS);
+        ins->symbol_table.symbols =
+                vmalloc(array_size(DSP_MAX_SYMBOLS,
+                                   sizeof(struct dsp_symbol_entry)));
         ins->code.data = kmalloc(DSP_CODE_BYTE_SIZE, GFP_KERNEL);
-        ins->modules = kmalloc(sizeof(struct dsp_module_desc) * DSP_MAX_MODULES, GFP_KERNEL);
+        ins->modules = kmalloc_array(DSP_MAX_MODULES,
+                                     sizeof(struct dsp_module_desc),
+                                     GFP_KERNEL);
         if (!ins->symbol_table.symbols || !ins->code.data || !ins->modules) {
                 cs46xx_dsp_spos_destroy(chip);
                 goto error;
diff --git a/sound/pci/ctxfi/ctatc.c b/sound/pci/ctxfi/ctatc.c
index 908658a00377..2ada8444abd9 100644
--- a/sound/pci/ctxfi/ctatc.c
+++ b/sound/pci/ctxfi/ctatc.c
@@ -275,7 +275,7 @@ static int atc_pcm_playback_prepare(struct ct_atc *atc, struct ct_atc_pcm *apcm)
 
         /* Get AMIXER resource */
         n_amixer = (n_amixer < 2) ? 2 : n_amixer;
-        apcm->amixers = kzalloc(sizeof(void *)*n_amixer, GFP_KERNEL);
+        apcm->amixers = kcalloc(n_amixer, sizeof(void *), GFP_KERNEL);
         if (!apcm->amixers) {
                 err = -ENOMEM;
                 goto error1;
@@ -543,18 +543,18 @@ atc_pcm_capture_get_resources(struct ct_atc *atc, struct ct_atc_pcm *apcm)
         }
 
         if (n_srcc) {
-                apcm->srccs = kzalloc(sizeof(void *)*n_srcc, GFP_KERNEL);
+                apcm->srccs = kcalloc(n_srcc, sizeof(void *), GFP_KERNEL);
                 if (!apcm->srccs)
                         return -ENOMEM;
         }
         if (n_amixer) {
-                apcm->amixers = kzalloc(sizeof(void *)*n_amixer, GFP_KERNEL);
+                apcm->amixers = kcalloc(n_amixer, sizeof(void *), GFP_KERNEL);
                 if (!apcm->amixers) {
                         err = -ENOMEM;
                         goto error1;
                 }
         }
-        apcm->srcimps = kzalloc(sizeof(void *)*n_srcimp, GFP_KERNEL);
+        apcm->srcimps = kcalloc(n_srcimp, sizeof(void *), GFP_KERNEL);
         if (!apcm->srcimps) {
                 err = -ENOMEM;
                 goto error1;
@@ -819,7 +819,7 @@ static int spdif_passthru_playback_get_resources(struct ct_atc *atc,
 
         /* Get AMIXER resource */
         n_amixer = (n_amixer < 2) ? 2 : n_amixer;
-        apcm->amixers = kzalloc(sizeof(void *)*n_amixer, GFP_KERNEL);
+        apcm->amixers = kcalloc(n_amixer, sizeof(void *), GFP_KERNEL);
         if (!apcm->amixers) {
                 err = -ENOMEM;
                 goto error1;
@@ -1378,19 +1378,19 @@ static int atc_get_resources(struct ct_atc *atc)
         num_daios = ((atc->model == CTSB1270) ? 8 : 7);
         num_srcs = ((atc->model == CTSB1270) ? 6 : 4);
 
-        atc->daios = kzalloc(sizeof(void *)*num_daios, GFP_KERNEL);
+        atc->daios = kcalloc(num_daios, sizeof(void *), GFP_KERNEL);
         if (!atc->daios)
                 return -ENOMEM;
 
-        atc->srcs = kzalloc(sizeof(void *)*num_srcs, GFP_KERNEL);
+        atc->srcs = kcalloc(num_srcs, sizeof(void *), GFP_KERNEL);
         if (!atc->srcs)
                 return -ENOMEM;
 
-        atc->srcimps = kzalloc(sizeof(void *)*num_srcs, GFP_KERNEL);
+        atc->srcimps = kcalloc(num_srcs, sizeof(void *), GFP_KERNEL);
         if (!atc->srcimps)
                 return -ENOMEM;
 
-        atc->pcm = kzalloc(sizeof(void *)*(2*4), GFP_KERNEL);
+        atc->pcm = kcalloc(2 * 4, sizeof(void *), GFP_KERNEL);
         if (!atc->pcm)
                 return -ENOMEM;
 
diff --git a/sound/pci/ctxfi/ctdaio.c b/sound/pci/ctxfi/ctdaio.c
index 7f089cb433e1..f35a7341e446 100644
--- a/sound/pci/ctxfi/ctdaio.c
+++ b/sound/pci/ctxfi/ctdaio.c
@@ -398,7 +398,8 @@ static int dao_rsc_init(struct dao *dao,
         if (err)
                 return err;
 
-        dao->imappers = kzalloc(sizeof(void *)*desc->msr*2, GFP_KERNEL);
+        dao->imappers = kzalloc(array3_size(sizeof(void *), desc->msr, 2),
+                                GFP_KERNEL);
         if (!dao->imappers) {
                 err = -ENOMEM;
                 goto error1;
diff --git a/sound/pci/ctxfi/ctmixer.c b/sound/pci/ctxfi/ctmixer.c
index 4f4a2a5dedb8..db710d0a609f 100644
--- a/sound/pci/ctxfi/ctmixer.c
+++ b/sound/pci/ctxfi/ctmixer.c
@@ -910,13 +910,14 @@ static int ct_mixer_get_mem(struct ct_mixer **rmixer)
         if (!mixer)
                 return -ENOMEM;
 
-        mixer->amixers = kzalloc(sizeof(void *)*(NUM_CT_AMIXERS*CHN_NUM),
+        mixer->amixers = kcalloc(NUM_CT_AMIXERS * CHN_NUM, sizeof(void *),
                                  GFP_KERNEL);
         if (!mixer->amixers) {
                 err = -ENOMEM;
                 goto error1;
         }
-        mixer->sums = kzalloc(sizeof(void *)*(NUM_CT_SUMS*CHN_NUM), GFP_KERNEL);
+        mixer->sums = kcalloc(NUM_CT_SUMS * CHN_NUM, sizeof(void *),
+                              GFP_KERNEL);
         if (!mixer->sums) {
                 err = -ENOMEM;
                 goto error2;
diff --git a/sound/pci/ctxfi/ctsrc.c b/sound/pci/ctxfi/ctsrc.c
index bb4c9c3c89ae..a4fc10723fc6 100644
--- a/sound/pci/ctxfi/ctsrc.c
+++ b/sound/pci/ctxfi/ctsrc.c
@@ -679,7 +679,7 @@ static int srcimp_rsc_init(struct srcimp *srcimp,
                 return err;
 
         /* Reserve memory for imapper nodes */
-        srcimp->imappers = kzalloc(sizeof(struct imapper)*desc->msr,
+        srcimp->imappers = kcalloc(desc->msr, sizeof(struct imapper),
                                    GFP_KERNEL);
         if (!srcimp->imappers) {
                 err = -ENOMEM;
diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
index 18267de3a269..61f85ff91cd9 100644
--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -1941,9 +1941,10 @@ int snd_emu10k1_create(struct snd_card *card,
                 (unsigned long)emu->ptb_pages.addr,
                 (unsigned long)(emu->ptb_pages.addr + emu->ptb_pages.bytes));
 
-        emu->page_ptr_table = vmalloc(emu->max_cache_pages * sizeof(void *));
-        emu->page_addr_table = vmalloc(emu->max_cache_pages *
-                                       sizeof(unsigned long));
+        emu->page_ptr_table = vmalloc(array_size(sizeof(void *),
+                                                 emu->max_cache_pages));
+        emu->page_addr_table = vmalloc(array_size(sizeof(unsigned long),
+                                                  emu->max_cache_pages));
         if (emu->page_ptr_table == NULL || emu->page_addr_table == NULL) {
                 err = -ENOMEM;
                 goto error;
@@ -2099,7 +2100,7 @@ static int alloc_pm_buffer(struct snd_emu10k1 *emu)
         size = ARRAY_SIZE(saved_regs);
         if (emu->audigy)
                 size += ARRAY_SIZE(saved_regs_audigy);
-        emu->saved_ptr = vmalloc(4 * NUM_G * size);
+        emu->saved_ptr = vmalloc(array3_size(4, NUM_G, size));
         if (!emu->saved_ptr)
                 return -ENOMEM;
         if (snd_emu10k1_efx_alloc_pm_buffer(emu) < 0)
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index b45a01bb73e5..de2ecbe95d6c 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -2683,16 +2683,16 @@ int snd_emu10k1_efx_alloc_pm_buffer(struct snd_emu10k1 *emu)
         int len;
 
         len = emu->audigy ? 0x200 : 0x100;
-        emu->saved_gpr = kmalloc(len * 4, GFP_KERNEL);
+        emu->saved_gpr = kmalloc_array(len, 4, GFP_KERNEL);
         if (! emu->saved_gpr)
                 return -ENOMEM;
         len = emu->audigy ? 0x100 : 0xa0;
-        emu->tram_val_saved = kmalloc(len * 4, GFP_KERNEL);
-        emu->tram_addr_saved = kmalloc(len * 4, GFP_KERNEL);
+        emu->tram_val_saved = kmalloc_array(len, 4, GFP_KERNEL);
+        emu->tram_addr_saved = kmalloc_array(len, 4, GFP_KERNEL);
         if (! emu->tram_val_saved || ! emu->tram_addr_saved)
                 return -ENOMEM;
         len = emu->audigy ? 2 * 1024 : 2 * 512;
-        emu->saved_icode = vmalloc(len * 4);
+        emu->saved_icode = vmalloc(array_size(len, 4));
         if (! emu->saved_icode)
                 return -ENOMEM;
         return 0;
diff --git a/sound/pci/emu10k1/p16v.c b/sound/pci/emu10k1/p16v.c
index a30da78a95b7..4948b95f6665 100644
--- a/sound/pci/emu10k1/p16v.c
+++ b/sound/pci/emu10k1/p16v.c
@@ -874,7 +874,7 @@ int snd_p16v_mixer(struct snd_emu10k1 *emu)
 
 int snd_p16v_alloc_pm_buffer(struct snd_emu10k1 *emu)
 {
-        emu->p16v_saved = vmalloc(NUM_CHS * 4 * 0x80);
+        emu->p16v_saved = vmalloc(array_size(NUM_CHS * 4, 0x80));
         if (! emu->p16v_saved)
                 return -ENOMEM;
         return 0;
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 08151f3c0b13..d91c87e41756 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -158,7 +158,7 @@ static int read_and_add_raw_conns(struct hda_codec *codec, hda_nid_t nid)
         len = snd_hda_get_raw_connections(codec, nid, list, ARRAY_SIZE(list));
         if (len == -ENOSPC) {
                 len = snd_hda_get_num_raw_conns(codec, nid);
-                result = kmalloc(sizeof(hda_nid_t) * len, GFP_KERNEL);
+                result = kmalloc_array(len, sizeof(hda_nid_t), GFP_KERNEL);
                 if (!result)
                         return -ENOMEM;
                 len = snd_hda_get_raw_connections(codec, nid, result, len);
@@ -438,7 +438,7 @@ static int read_widget_caps(struct hda_codec *codec, hda_nid_t fg_node)
         int i;
         hda_nid_t nid;
 
-        codec->wcaps = kmalloc(codec->core.num_nodes * 4, GFP_KERNEL);
+        codec->wcaps = kmalloc_array(codec->core.num_nodes, 4, GFP_KERNEL);
         if (!codec->wcaps)
                 return -ENOMEM;
         nid = codec->core.start_nid;
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
index 033aa84365b9..c6b778b2580c 100644
--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -825,8 +825,9 @@ static void print_codec_info(struct snd_info_entry *entry,
                 if (wid_caps & AC_WCAP_CONN_LIST) {
                         conn_len = snd_hda_get_num_raw_conns(codec, nid);
                         if (conn_len > 0) {
-                                conn = kmalloc(sizeof(hda_nid_t) * conn_len,
-                                               GFP_KERNEL);
+                                conn = kmalloc_array(conn_len,
+                                                     sizeof(hda_nid_t),
+                                                     GFP_KERNEL);
                                 if (!conn)
                                         return;
                                 if (snd_hda_get_raw_connections(codec, nid, conn,
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 292e2c592c17..04e949aa01ad 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -7482,7 +7482,9 @@ static int ca0132_prepare_verbs(struct hda_codec *codec)
         spec->chip_init_verbs = ca0132_init_verbs0;
         if (spec->quirk == QUIRK_SBZ)
                 spec->sbz_init_verbs = sbz_init_verbs;
-        spec->spec_init_verbs = kzalloc(sizeof(struct hda_verb) * NUM_SPEC_VERBS, GFP_KERNEL);
+        spec->spec_init_verbs = kcalloc(NUM_SPEC_VERBS,
+                                        sizeof(struct hda_verb),
+                                        GFP_KERNEL);
         if (!spec->spec_init_verbs)
                 return -ENOMEM;
 
diff --git a/sound/pci/maestro3.c b/sound/pci/maestro3.c
index 8f20dec97843..224e942f556d 100644
--- a/sound/pci/maestro3.c
+++ b/sound/pci/maestro3.c
@@ -2657,7 +2657,10 @@ snd_m3_create(struct snd_card *card, struct pci_dev *pci,
         chip->irq = pci->irq;
 
 #ifdef CONFIG_PM_SLEEP
-        chip->suspend_mem = vmalloc(sizeof(u16) * (REV_B_CODE_MEMORY_LENGTH + REV_B_DATA_MEMORY_LENGTH));
+        chip->suspend_mem =
+                vmalloc(array_size(sizeof(u16),
+                                   REV_B_CODE_MEMORY_LENGTH +
+                                        REV_B_DATA_MEMORY_LENGTH));
         if (chip->suspend_mem == NULL)
                 dev_warn(card->dev, "can't allocate apm buffer\n");
 #endif
diff --git a/sound/pci/trident/trident_main.c b/sound/pci/trident/trident_main.c
index eabd84d9ffee..49c64fae3466 100644
--- a/sound/pci/trident/trident_main.c
+++ b/sound/pci/trident/trident_main.c
@@ -3362,7 +3362,9 @@ static int snd_trident_tlb_alloc(struct snd_trident *trident)
         trident->tlb.entries = (unsigned int*)ALIGN((unsigned long)trident->tlb.buffer.area, SNDRV_TRIDENT_MAX_PAGES * 4);
         trident->tlb.entries_dmaaddr = ALIGN(trident->tlb.buffer.addr, SNDRV_TRIDENT_MAX_PAGES * 4);
         /* allocate shadow TLB page table (virtual addresses) */
-        trident->tlb.shadow_entries = vmalloc(SNDRV_TRIDENT_MAX_PAGES*sizeof(unsigned long));
+        trident->tlb.shadow_entries =
+                vmalloc(array_size(SNDRV_TRIDENT_MAX_PAGES,
+                                   sizeof(unsigned long)));
         if (!trident->tlb.shadow_entries)
                 return -ENOMEM;
 
diff --git a/sound/pci/via82xx.c b/sound/pci/via82xx.c
index 3a1c0b8b4ea2..c488c5afa195 100644
--- a/sound/pci/via82xx.c
+++ b/sound/pci/via82xx.c
@@ -439,7 +439,9 @@ static int build_via_table(struct viadev *dev, struct snd_pcm_substream *substre
                         return -ENOMEM;
         }
         if (! dev->idx_table) {
-                dev->idx_table = kmalloc(sizeof(*dev->idx_table) * VIA_TABLE_SIZE, GFP_KERNEL);
+                dev->idx_table = kmalloc_array(VIA_TABLE_SIZE,
+                                               sizeof(*dev->idx_table),
+                                               GFP_KERNEL);
                 if (! dev->idx_table)
                         return -ENOMEM;
         }
diff --git a/sound/pci/via82xx_modem.c b/sound/pci/via82xx_modem.c
index 8a69221c1b86..b13c8688cc8d 100644
--- a/sound/pci/via82xx_modem.c
+++ b/sound/pci/via82xx_modem.c
@@ -292,7 +292,9 @@ static int build_via_table(struct viadev *dev, struct snd_pcm_substream *substre
                         return -ENOMEM;
         }
         if (! dev->idx_table) {
-                dev->idx_table = kmalloc(sizeof(*dev->idx_table) * VIA_TABLE_SIZE, GFP_KERNEL);
+                dev->idx_table = kmalloc_array(VIA_TABLE_SIZE,
+                                               sizeof(*dev->idx_table),
+                                               GFP_KERNEL);
                 if (! dev->idx_table)
                         return -ENOMEM;
         }
diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
index 8ca2e41e5827..6f81396aadc9 100644
--- a/sound/pci/ymfpci/ymfpci_main.c
+++ b/sound/pci/ymfpci/ymfpci_main.c
@@ -2435,8 +2435,8 @@ int snd_ymfpci_create(struct snd_card *card,
                 goto free_chip;
 
 #ifdef CONFIG_PM_SLEEP
-        chip->saved_regs = kmalloc(YDSXGR_NUM_SAVED_REGS * sizeof(u32),
-                                   GFP_KERNEL);
+        chip->saved_regs = kmalloc_array(YDSXGR_NUM_SAVED_REGS, sizeof(u32),
+                                         GFP_KERNEL);
         if (chip->saved_regs == NULL) {
                 err = -ENOMEM;
                 goto free_chip;
diff --git a/sound/soc/au1x/dbdma2.c b/sound/soc/au1x/dbdma2.c
index fb650659c3a3..a906560d0cdd 100644
--- a/sound/soc/au1x/dbdma2.c
+++ b/sound/soc/au1x/dbdma2.c
@@ -339,8 +339,8 @@ static int au1xpsc_pcm_drvprobe(struct platform_device *pdev)
 {
         struct au1xpsc_audio_dmadata *dmadata;
 
-        dmadata = devm_kzalloc(&pdev->dev,
-                               2 * sizeof(struct au1xpsc_audio_dmadata),
+        dmadata = devm_kcalloc(&pdev->dev,
+                               2, sizeof(struct au1xpsc_audio_dmadata),
                                GFP_KERNEL);
         if (!dmadata)
                 return -ENOMEM;
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index 6fa11888672d..38e4a8515709 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -771,7 +771,7 @@ static int hdmi_codec_probe(struct platform_device *pdev)
         hcp->hcd = *hcd;
         mutex_init(&hcp->current_stream_lock);
 
-        hcp->daidrv = devm_kzalloc(dev, dai_count * sizeof(*hcp->daidrv),
+        hcp->daidrv = devm_kcalloc(dev, dai_count, sizeof(*hcp->daidrv),
                                    GFP_KERNEL);
         if (!hcp->daidrv)
                 return -ENOMEM;
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index 712384581ebf..1dc70f452c1b 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -3449,8 +3449,9 @@ static int rt5645_probe(struct snd_soc_component *component)
         if (rt5645->pdata.long_name)
                 component->card->long_name = rt5645->pdata.long_name;
 
-        rt5645->eq_param = devm_kzalloc(component->dev,
-                RT5645_HWEQ_NUM * sizeof(struct rt5645_eq_param_s), GFP_KERNEL);
+        rt5645->eq_param = devm_kcalloc(component->dev,
+                RT5645_HWEQ_NUM, sizeof(struct rt5645_eq_param_s),
+                GFP_KERNEL);
 
         return 0;
 }
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index f13ef334c0d7..9037a35b931d 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -2023,8 +2023,9 @@ static void wm8904_handle_pdata(struct snd_soc_component *component)
                                      wm8904_get_drc_enum, wm8904_put_drc_enum);
 
                 /* We need an array of texts for the enum API */
-                wm8904->drc_texts = kmalloc(sizeof(char *)
-                                            * pdata->num_drc_cfgs, GFP_KERNEL);
+                wm8904->drc_texts = kmalloc_array(pdata->num_drc_cfgs,
+                                                  sizeof(char *),
+                                                  GFP_KERNEL);
                 if (!wm8904->drc_texts)
                         return;
 
diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c
index 8d495220fa25..108e8bf42a34 100644
--- a/sound/soc/codecs/wm8958-dsp2.c
+++ b/sound/soc/codecs/wm8958-dsp2.c
@@ -932,8 +932,9 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
                 };
 
                 /* We need an array of texts for the enum API */
-                wm8994->mbc_texts = kmalloc(sizeof(char *)
-                                            * pdata->num_mbc_cfgs, GFP_KERNEL);
+                wm8994->mbc_texts = kmalloc_array(pdata->num_mbc_cfgs,
+                                                  sizeof(char *),
+                                                  GFP_KERNEL);
                 if (!wm8994->mbc_texts)
                         return;
 
@@ -957,8 +958,9 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
                 };
 
                 /* We need an array of texts for the enum API */
-                wm8994->vss_texts = kmalloc(sizeof(char *)
-                                            * pdata->num_vss_cfgs, GFP_KERNEL);
+                wm8994->vss_texts = kmalloc_array(pdata->num_vss_cfgs,
+                                                  sizeof(char *),
+                                                  GFP_KERNEL);
                 if (!wm8994->vss_texts)
                         return;
 
@@ -983,8 +985,9 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
                 };
 
                 /* We need an array of texts for the enum API */
-                wm8994->vss_hpf_texts = kmalloc(sizeof(char *)
-                                                * pdata->num_vss_hpf_cfgs, GFP_KERNEL);
+                wm8994->vss_hpf_texts = kmalloc_array(pdata->num_vss_hpf_cfgs,
+                                                      sizeof(char *),
+                                                      GFP_KERNEL);
                 if (!wm8994->vss_hpf_texts)
                         return;
 
@@ -1010,8 +1013,9 @@ void wm8958_dsp2_init(struct snd_soc_component *component)
                 };
 
                 /* We need an array of texts for the enum API */
-                wm8994->enh_eq_texts = kmalloc(sizeof(char *)
-                                                * pdata->num_enh_eq_cfgs, GFP_KERNEL);
+                wm8994->enh_eq_texts = kmalloc_array(pdata->num_enh_eq_cfgs,
+                                                     sizeof(char *),
+                                                     GFP_KERNEL);
                 if (!wm8994->enh_eq_texts)
                         return;
 
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 6e9e32a07259..7fdfdf3f6e67 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -3298,8 +3298,8 @@ static void wm8994_handle_pdata(struct wm8994_priv *wm8994)
                 };
 
                 /* We need an array of texts for the enum API */
-                wm8994->drc_texts = devm_kzalloc(wm8994->hubs.component->dev,
-                            sizeof(char *) * pdata->num_drc_cfgs, GFP_KERNEL);
+                wm8994->drc_texts = devm_kcalloc(wm8994->hubs.component->dev,
+                            pdata->num_drc_cfgs, sizeof(char *), GFP_KERNEL);
                 if (!wm8994->drc_texts)
                         return;
 
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 2175dccdf388..2fcdd84021a5 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1899,7 +1899,7 @@ static void *wm_adsp_read_algs(struct wm_adsp *dsp, size_t n_algs,
                 adsp_warn(dsp, "Algorithm list end %x 0x%x != 0xbedead\n",
                           pos + len, be32_to_cpu(val));
 
-        alg = kzalloc(len * 2, GFP_KERNEL | GFP_DMA);
+        alg = kcalloc(len, 2, GFP_KERNEL | GFP_DMA);
         if (!alg)
                 return ERR_PTR(-ENOMEM);
 
diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index 1f96c9dbe9c4..47c0c821d325 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -1868,8 +1868,8 @@ static int davinci_mcasp_probe(struct platform_device *pdev)
 
         mcasp->num_serializer = pdata->num_serializer;
 #ifdef CONFIG_PM_SLEEP
-        mcasp->context.xrsr_regs = devm_kzalloc(&pdev->dev,
-                                        sizeof(u32) * mcasp->num_serializer,
+        mcasp->context.xrsr_regs = devm_kcalloc(&pdev->dev,
+                                        mcasp->num_serializer, sizeof(u32),
                                         GFP_KERNEL);
         if (!mcasp->context.xrsr_regs) {
                 ret = -ENOMEM;
@@ -2004,13 +2004,15 @@ static int davinci_mcasp_probe(struct platform_device *pdev)
          * bytes.
          */
         mcasp->chconstr[SNDRV_PCM_STREAM_PLAYBACK].list =
-                devm_kzalloc(mcasp->dev, sizeof(unsigned int) *
-                             (32 + mcasp->num_serializer - 1),
+                devm_kcalloc(mcasp->dev,
+                             32 + mcasp->num_serializer - 1,
+                             sizeof(unsigned int),
                              GFP_KERNEL);
 
         mcasp->chconstr[SNDRV_PCM_STREAM_CAPTURE].list =
-                devm_kzalloc(mcasp->dev, sizeof(unsigned int) *
-                             (32 + mcasp->num_serializer - 1),
+                devm_kcalloc(mcasp->dev,
+                             32 + mcasp->num_serializer - 1,
+                             sizeof(unsigned int),
                              GFP_KERNEL);
 
         if (!mcasp->chconstr[SNDRV_PCM_STREAM_PLAYBACK].list ||
diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
index 1b6164249341..d93bacacbd5b 100644
--- a/sound/soc/generic/audio-graph-card.c
+++ b/sound/soc/generic/audio-graph-card.c
@@ -296,8 +296,8 @@ static int asoc_graph_card_probe(struct platform_device *pdev)
         if (num == 0)
                 return -EINVAL;
 
-        dai_props = devm_kzalloc(dev, sizeof(*dai_props) * num, GFP_KERNEL);
-        dai_link  = devm_kzalloc(dev, sizeof(*dai_link)  * num, GFP_KERNEL);
+        dai_props = devm_kcalloc(dev, num, sizeof(*dai_props), GFP_KERNEL);
+        dai_link  = devm_kcalloc(dev, num, sizeof(*dai_link), GFP_KERNEL);
         if (!dai_props || !dai_link)
                 return -ENOMEM;
 
diff --git a/sound/soc/generic/audio-graph-scu-card.c b/sound/soc/generic/audio-graph-scu-card.c
index a967aa143d51..095ef6426d42 100644
--- a/sound/soc/generic/audio-graph-scu-card.c
+++ b/sound/soc/generic/audio-graph-scu-card.c
@@ -348,8 +348,8 @@ static int asoc_graph_card_probe(struct platform_device *pdev)
         if (num == 0)
                 return -EINVAL;
 
-        dai_props = devm_kzalloc(dev, sizeof(*dai_props) * num, GFP_KERNEL);
-        dai_link  = devm_kzalloc(dev, sizeof(*dai_link)  * num, GFP_KERNEL);
+        dai_props = devm_kcalloc(dev, num, sizeof(*dai_props), GFP_KERNEL);
+        dai_link  = devm_kcalloc(dev, num, sizeof(*dai_link), GFP_KERNEL);
         if (!dai_props || !dai_link)
                 return -ENOMEM;
 
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 4a516c428b3d..8b374af86a6e 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -340,8 +340,8 @@ static int asoc_simple_card_parse_aux_devs(struct device_node *node,
         if (n <= 0)
                 return -EINVAL;
 
-        card->aux_dev = devm_kzalloc(dev,
-                        n * sizeof(*card->aux_dev), GFP_KERNEL);
+        card->aux_dev = devm_kcalloc(dev,
+                        n, sizeof(*card->aux_dev), GFP_KERNEL);
         if (!card->aux_dev)
                 return -ENOMEM;
 
@@ -435,8 +435,8 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
         if (!priv)
                 return -ENOMEM;
 
-        dai_props = devm_kzalloc(dev, sizeof(*dai_props) * num, GFP_KERNEL);
-        dai_link  = devm_kzalloc(dev, sizeof(*dai_link)  * num, GFP_KERNEL);
+        dai_props = devm_kcalloc(dev, num, sizeof(*dai_props), GFP_KERNEL);
+        dai_link  = devm_kcalloc(dev, num, sizeof(*dai_link), GFP_KERNEL);
         if (!dai_props || !dai_link)
                 return -ENOMEM;
 
diff --git a/sound/soc/generic/simple-scu-card.c b/sound/soc/generic/simple-scu-card.c
index 48606c63562a..487716559deb 100644
--- a/sound/soc/generic/simple-scu-card.c
+++ b/sound/soc/generic/simple-scu-card.c
@@ -246,8 +246,8 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
 
         num = of_get_child_count(np);
 
-        dai_props = devm_kzalloc(dev, sizeof(*dai_props) * num, GFP_KERNEL);
-        dai_link  = devm_kzalloc(dev, sizeof(*dai_link)  * num, GFP_KERNEL);
+        dai_props = devm_kcalloc(dev, num, sizeof(*dai_props), GFP_KERNEL);
+        dai_link  = devm_kcalloc(dev, num, sizeof(*dai_link), GFP_KERNEL);
         if (!dai_props || !dai_link)
                 return -ENOMEM;
 
diff --git a/sound/soc/img/img-i2s-in.c b/sound/soc/img/img-i2s-in.c
index d7fbb0a0a28b..388cefd7340a 100644
--- a/sound/soc/img/img-i2s-in.c
+++ b/sound/soc/img/img-i2s-in.c
@@ -509,8 +509,8 @@ static int img_i2s_in_probe(struct platform_device *pdev)
 
         pm_runtime_put(&pdev->dev);
 
-        i2s->suspend_ch_ctl = devm_kzalloc(dev,
-                sizeof(*i2s->suspend_ch_ctl) * i2s->max_i2s_chan, GFP_KERNEL);
+        i2s->suspend_ch_ctl = devm_kcalloc(dev,
+                i2s->max_i2s_chan, sizeof(*i2s->suspend_ch_ctl), GFP_KERNEL);
         if (!i2s->suspend_ch_ctl) {
                 ret = -ENOMEM;
                 goto err_suspend;
diff --git a/sound/soc/img/img-i2s-out.c b/sound/soc/img/img-i2s-out.c
index 30a95bcef2db..fc2d1dac6333 100644
--- a/sound/soc/img/img-i2s-out.c
+++ b/sound/soc/img/img-i2s-out.c
@@ -479,8 +479,8 @@ static int img_i2s_out_probe(struct platform_device *pdev)
                 return PTR_ERR(i2s->clk_ref);
         }
 
-        i2s->suspend_ch_ctl = devm_kzalloc(dev,
-                sizeof(*i2s->suspend_ch_ctl) * i2s->max_i2s_chan, GFP_KERNEL);
+        i2s->suspend_ch_ctl = devm_kcalloc(dev,
+                i2s->max_i2s_chan, sizeof(*i2s->suspend_ch_ctl), GFP_KERNEL);
         if (!i2s->suspend_ch_ctl)
                 return -ENOMEM;
 
diff --git a/sound/soc/intel/common/sst-ipc.c b/sound/soc/intel/common/sst-ipc.c
index 62f3a8e0ec87..dcff13802c00 100644
--- a/sound/soc/intel/common/sst-ipc.c
+++ b/sound/soc/intel/common/sst-ipc.c
@@ -121,8 +121,8 @@ static int msg_empty_list_init(struct sst_generic_ipc *ipc)
 {
         int i;
 
-        ipc->msg = kzalloc(sizeof(struct ipc_message) *
-                IPC_EMPTY_LIST_SIZE, GFP_KERNEL);
+        ipc->msg = kcalloc(IPC_EMPTY_LIST_SIZE, sizeof(struct ipc_message),
+                           GFP_KERNEL);
         if (ipc->msg == NULL)
                 return -ENOMEM;
 
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index 2c5129782959..fcdc716754b6 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -2428,8 +2428,10 @@ static int skl_tplg_get_token(struct device *dev,
 
         case SKL_TKN_U8_DYN_IN_PIN:
                 if (!mconfig->m_in_pin)
-                        mconfig->m_in_pin = devm_kzalloc(dev, MAX_IN_QUEUE *
-                                        sizeof(*mconfig->m_in_pin), GFP_KERNEL);
+                        mconfig->m_in_pin =
+                                devm_kcalloc(dev, MAX_IN_QUEUE,
+                                             sizeof(*mconfig->m_in_pin),
+                                             GFP_KERNEL);
                 if (!mconfig->m_in_pin)
                         return -ENOMEM;
 
@@ -2439,8 +2441,10 @@ static int skl_tplg_get_token(struct device *dev,
 
         case SKL_TKN_U8_DYN_OUT_PIN:
                 if (!mconfig->m_out_pin)
-                        mconfig->m_out_pin = devm_kzalloc(dev, MAX_IN_QUEUE *
-                                        sizeof(*mconfig->m_in_pin), GFP_KERNEL);
+                        mconfig->m_out_pin =
+                                devm_kcalloc(dev, MAX_IN_QUEUE,
+                                             sizeof(*mconfig->m_in_pin),
+                                             GFP_KERNEL);
                 if (!mconfig->m_out_pin)
                         return -ENOMEM;
 
@@ -2852,14 +2856,14 @@ static int skl_tplg_get_pvt_data_v4(struct snd_soc_tplg_dapm_widget *tplg_w,
         mconfig->time_slot = dfw->time_slot;
         mconfig->formats_config.caps_size = dfw->caps.caps_size;
 
-        mconfig->m_in_pin = devm_kzalloc(dev,
-                                MAX_IN_QUEUE * sizeof(*mconfig->m_in_pin),
+        mconfig->m_in_pin = devm_kcalloc(dev,
+                                MAX_IN_QUEUE, sizeof(*mconfig->m_in_pin),
                                 GFP_KERNEL);
         if (!mconfig->m_in_pin)
                 return -ENOMEM;
 
-        mconfig->m_out_pin = devm_kzalloc(dev,
-                                MAX_OUT_QUEUE * sizeof(*mconfig->m_out_pin),
+        mconfig->m_out_pin = devm_kcalloc(dev,
+                                MAX_OUT_QUEUE, sizeof(*mconfig->m_out_pin),
                                 GFP_KERNEL);
         if (!mconfig->m_out_pin)
                 return -ENOMEM;
diff --git a/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c b/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c
index 828d11c30c6a..968fba4d7533 100644
--- a/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c
+++ b/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c
@@ -1347,7 +1347,8 @@ static int mt2701_afe_pcm_dev_probe(struct platform_device *pdev)
         afe->dev = &pdev->dev;
         dev = afe->dev;
 
-        afe_priv->i2s_path = devm_kzalloc(dev, afe_priv->soc->i2s_num *
+        afe_priv->i2s_path = devm_kcalloc(dev,
+                                          afe_priv->soc->i2s_num,
                                           sizeof(struct mt2701_i2s_path),
                                           GFP_KERNEL);
         if (!afe_priv->i2s_path)
diff --git a/sound/soc/pxa/mmp-sspa.c b/sound/soc/pxa/mmp-sspa.c
index 7c998ea4ebee..12d4513ebe8a 100644
--- a/sound/soc/pxa/mmp-sspa.c
+++ b/sound/soc/pxa/mmp-sspa.c
@@ -425,8 +425,8 @@ static int asoc_mmp_sspa_probe(struct platform_device *pdev)
         if (priv->sspa == NULL)
                 return -ENOMEM;
 
-        priv->dma_params = devm_kzalloc(&pdev->dev,
-                        2 * sizeof(struct snd_dmaengine_dai_dma_data),
+        priv->dma_params = devm_kcalloc(&pdev->dev,
+                        2, sizeof(struct snd_dmaengine_dai_dma_data),
                         GFP_KERNEL);
         if (priv->dma_params == NULL)
                 return -ENOMEM;
diff --git a/sound/soc/rockchip/rk3399_gru_sound.c b/sound/soc/rockchip/rk3399_gru_sound.c
index f184168f9a41..f2a51ae2b674 100644
--- a/sound/soc/rockchip/rk3399_gru_sound.c
+++ b/sound/soc/rockchip/rk3399_gru_sound.c
@@ -462,7 +462,7 @@ static int rockchip_sound_of_parse_dais(struct device *dev,
         num_routes = 0;
         for (i = 0; i < ARRAY_SIZE(rockchip_routes); i++)
                 num_routes += rockchip_routes[i].num_routes;
-        routes = devm_kzalloc(dev, num_routes * sizeof(*routes),
+        routes = devm_kcalloc(dev, num_routes, sizeof(*routes),
                               GFP_KERNEL);
         if (!routes)
                 return -ENOMEM;
diff --git a/sound/soc/sh/rcar/cmd.c b/sound/soc/sh/rcar/cmd.c
index 4221937ae79b..5900fb535a2b 100644
--- a/sound/soc/sh/rcar/cmd.c
+++ b/sound/soc/sh/rcar/cmd.c
@@ -155,7 +155,7 @@ int rsnd_cmd_probe(struct rsnd_priv *priv)
         if (!nr)
                 return 0;
 
-        cmd = devm_kzalloc(dev, sizeof(*cmd) * nr, GFP_KERNEL);
+        cmd = devm_kcalloc(dev, nr, sizeof(*cmd), GFP_KERNEL);
         if (!cmd)
                 return -ENOMEM;
 
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index af04d41a4274..f237002180c0 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -1110,8 +1110,8 @@ static int rsnd_dai_probe(struct rsnd_priv *priv)
         if (!nr)
                 return -EINVAL;
 
-        rdrv = devm_kzalloc(dev, sizeof(*rdrv) * nr, GFP_KERNEL);
-        rdai = devm_kzalloc(dev, sizeof(*rdai) * nr, GFP_KERNEL);
+        rdrv = devm_kcalloc(dev, nr, sizeof(*rdrv), GFP_KERNEL);
+        rdai = devm_kcalloc(dev, nr, sizeof(*rdai), GFP_KERNEL);
         if (!rdrv || !rdai)
                 return -ENOMEM;
 
diff --git a/sound/soc/sh/rcar/ctu.c b/sound/soc/sh/rcar/ctu.c
index d201d551866d..83be7d3ae0a8 100644
--- a/sound/soc/sh/rcar/ctu.c
+++ b/sound/soc/sh/rcar/ctu.c
@@ -378,7 +378,7 @@ int rsnd_ctu_probe(struct rsnd_priv *priv)
                 goto rsnd_ctu_probe_done;
         }
 
-        ctu = devm_kzalloc(dev, sizeof(*ctu) * nr, GFP_KERNEL);
+        ctu = devm_kcalloc(dev, nr, sizeof(*ctu), GFP_KERNEL);
         if (!ctu) {
                 ret = -ENOMEM;
                 goto rsnd_ctu_probe_done;
diff --git a/sound/soc/sh/rcar/dvc.c b/sound/soc/sh/rcar/dvc.c
index dbe54f024d68..ca1780e0b830 100644
--- a/sound/soc/sh/rcar/dvc.c
+++ b/sound/soc/sh/rcar/dvc.c
@@ -344,7 +344,7 @@ int rsnd_dvc_probe(struct rsnd_priv *priv)
                 goto rsnd_dvc_probe_done;
         }
 
-        dvc     = devm_kzalloc(dev, sizeof(*dvc) * nr, GFP_KERNEL);
+        dvc     = devm_kcalloc(dev, nr, sizeof(*dvc), GFP_KERNEL);
         if (!dvc) {
                 ret = -ENOMEM;
                 goto rsnd_dvc_probe_done;
diff --git a/sound/soc/sh/rcar/mix.c b/sound/soc/sh/rcar/mix.c
index 7998380766f6..1881b2de9126 100644
--- a/sound/soc/sh/rcar/mix.c
+++ b/sound/soc/sh/rcar/mix.c
@@ -294,7 +294,7 @@ int rsnd_mix_probe(struct rsnd_priv *priv)
                 goto rsnd_mix_probe_done;
         }
 
-        mix     = devm_kzalloc(dev, sizeof(*mix) * nr, GFP_KERNEL);
+        mix     = devm_kcalloc(dev, nr, sizeof(*mix), GFP_KERNEL);
         if (!mix) {
                 ret = -ENOMEM;
                 goto rsnd_mix_probe_done;
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index a727e71587b6..6c72d1a81cf5 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -575,7 +575,7 @@ int rsnd_src_probe(struct rsnd_priv *priv)
                 goto rsnd_src_probe_done;
         }
 
-        src     = devm_kzalloc(dev, sizeof(*src) * nr, GFP_KERNEL);
+        src     = devm_kcalloc(dev, nr, sizeof(*src), GFP_KERNEL);
         if (!src) {
                 ret = -ENOMEM;
                 goto rsnd_src_probe_done;
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 9538f76f8e20..6e1166ec24a0 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -1116,7 +1116,7 @@ int rsnd_ssi_probe(struct rsnd_priv *priv)
                 goto rsnd_ssi_probe_done;
         }
 
-        ssi     = devm_kzalloc(dev, sizeof(*ssi) * nr, GFP_KERNEL);
+        ssi     = devm_kcalloc(dev, nr, sizeof(*ssi), GFP_KERNEL);
         if (!ssi) {
                 ret = -ENOMEM;
                 goto rsnd_ssi_probe_done;
diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
index 6ff8a36c2c82..47bdba9fc582 100644
--- a/sound/soc/sh/rcar/ssiu.c
+++ b/sound/soc/sh/rcar/ssiu.c
@@ -258,7 +258,7 @@ int rsnd_ssiu_probe(struct rsnd_priv *priv)
 
         /* same number to SSI */
         nr      = priv->ssi_nr;
-        ssiu    = devm_kzalloc(dev, sizeof(*ssiu) * nr, GFP_KERNEL);
+        ssiu    = devm_kcalloc(dev, nr, sizeof(*ssiu), GFP_KERNEL);
         if (!ssiu)
                 return -ENOMEM;
 
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 3d56f1fe5914..4663de3cf495 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -373,8 +373,8 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
         if (!rtd->dai_link->ops)
                 rtd->dai_link->ops = &null_snd_soc_ops;
 
-        rtd->codec_dais = kzalloc(sizeof(struct snd_soc_dai *) *
-                                        dai_link->num_codecs,
+        rtd->codec_dais = kcalloc(dai_link->num_codecs,
+                                        sizeof(struct snd_soc_dai *),
                                         GFP_KERNEL);
         if (!rtd->codec_dais) {
                 kfree(rtd);
@@ -3354,7 +3354,7 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
                 return -EINVAL;
         }
 
-        routes = devm_kzalloc(card->dev, num_routes * sizeof(*routes),
+        routes = devm_kcalloc(card->dev, num_routes, sizeof(*routes),
                               GFP_KERNEL);
         if (!routes) {
                 dev_err(card->dev,
@@ -3678,8 +3678,8 @@ int snd_soc_of_get_dai_link_codecs(struct device *dev,
                         dev_err(dev, "Bad phandle in 'sound-dai'\n");
                 return num_codecs;
         }
-        component = devm_kzalloc(dev,
-                                 sizeof *component * num_codecs,
+        component = devm_kcalloc(dev,
+                                 num_codecs, sizeof(*component),
                                  GFP_KERNEL);
         if (!component)
                 return -ENOMEM;
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 255cad43a972..229c12349803 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3055,7 +3055,7 @@ int snd_soc_dapm_new_widgets(struct snd_soc_card *card)
                         continue;
 
                 if (w->num_kcontrols) {
-                        w->kcontrols = kzalloc(w->num_kcontrols *
+                        w->kcontrols = kcalloc(w->num_kcontrols,
                                                 sizeof(struct snd_kcontrol *),
                                                 GFP_KERNEL);
                         if (!w->kcontrols) {
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 3fd5d9c867b9..53f121a50c97 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -885,7 +885,7 @@ static int soc_tplg_denum_create_texts(struct soc_enum *se,
         int i, ret;
 
         se->dobj.control.dtexts =
-                kzalloc(sizeof(char *) * ec->items, GFP_KERNEL);
+                kcalloc(ec->items, sizeof(char *), GFP_KERNEL);
         if (se->dobj.control.dtexts == NULL)
                 return -ENOMEM;
 
diff --git a/sound/soc/uniphier/aio-cpu.c b/sound/soc/uniphier/aio-cpu.c
index 80daec17be25..2d9b7dde2ffa 100644
--- a/sound/soc/uniphier/aio-cpu.c
+++ b/sound/soc/uniphier/aio-cpu.c
@@ -624,15 +624,17 @@ int uniphier_aio_probe(struct platform_device *pdev)
                 return PTR_ERR(chip->rst);
 
         chip->num_aios = chip->chip_spec->num_dais;
-        chip->aios = devm_kzalloc(dev,
-                                  sizeof(struct uniphier_aio) * chip->num_aios,
+        chip->aios = devm_kcalloc(dev,
+                                  chip->num_aios, sizeof(struct uniphier_aio),
                                   GFP_KERNEL);
         if (!chip->aios)
                 return -ENOMEM;
 
         chip->num_plls = chip->chip_spec->num_plls;
-        chip->plls = devm_kzalloc(dev, sizeof(struct uniphier_aio_pll) *
-                                  chip->num_plls, GFP_KERNEL);
+        chip->plls = devm_kcalloc(dev,
+                                  chip->num_plls,
+                                  sizeof(struct uniphier_aio_pll),
+                                  GFP_KERNEL);
         if (!chip->plls)
                 return -ENOMEM;
         memcpy(chip->plls, chip->chip_spec->plls,
diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c
index 224a6a5d1c0e..2dd2518a71d3 100644
--- a/sound/usb/6fire/pcm.c
+++ b/sound/usb/6fire/pcm.c
@@ -591,12 +591,14 @@ static int usb6fire_pcm_buffers_init(struct pcm_runtime *rt)
         int i;
 
         for (i = 0; i < PCM_N_URBS; i++) {
-                rt->out_urbs[i].buffer = kzalloc(PCM_N_PACKETS_PER_URB
-                                * PCM_MAX_PACKET_SIZE, GFP_KERNEL);
+                rt->out_urbs[i].buffer = kcalloc(PCM_MAX_PACKET_SIZE,
+                                                 PCM_N_PACKETS_PER_URB,
+                                                 GFP_KERNEL);
                 if (!rt->out_urbs[i].buffer)
                         return -ENOMEM;
-                rt->in_urbs[i].buffer = kzalloc(PCM_N_PACKETS_PER_URB
-                                * PCM_MAX_PACKET_SIZE, GFP_KERNEL);
+                rt->in_urbs[i].buffer = kcalloc(PCM_MAX_PACKET_SIZE,
+                                                PCM_N_PACKETS_PER_URB,
+                                                GFP_KERNEL);
                 if (!rt->in_urbs[i].buffer)
                         return -ENOMEM;
         }
diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
index fb1c1eac0b5e..f35d29f49ffe 100644
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -728,7 +728,7 @@ static struct urb **alloc_urbs(struct snd_usb_caiaqdev *cdev, int dir, int *ret)
                 usb_sndisocpipe(usb_dev, ENDPOINT_PLAYBACK) :
                 usb_rcvisocpipe(usb_dev, ENDPOINT_CAPTURE);
 
-        urbs = kmalloc(N_URBS * sizeof(*urbs), GFP_KERNEL);
+        urbs = kmalloc_array(N_URBS, sizeof(*urbs), GFP_KERNEL);
         if (!urbs) {
                 *ret = -ENOMEM;
                 return NULL;
@@ -742,7 +742,8 @@ static struct urb **alloc_urbs(struct snd_usb_caiaqdev *cdev, int dir, int *ret)
                 }
 
                 urbs[i]->transfer_buffer =
-                        kmalloc(FRAMES_PER_URB * BYTES_PER_FRAME, GFP_KERNEL);
+                        kmalloc_array(BYTES_PER_FRAME, FRAMES_PER_URB,
+                                      GFP_KERNEL);
                 if (!urbs[i]->transfer_buffer) {
                         *ret = -ENOMEM;
                         return urbs;
@@ -857,7 +858,7 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev)
                                 &snd_usb_caiaq_ops);
 
         cdev->data_cb_info =
-                kmalloc(sizeof(struct snd_usb_caiaq_cb_info) * N_URBS,
+                kmalloc_array(N_URBS, sizeof(struct snd_usb_caiaq_cb_info),
                                         GFP_KERNEL);
 
         if (!cdev->data_cb_info)
diff --git a/sound/usb/format.c b/sound/usb/format.c
index 49e7ec6d2399..1f7a74a77ea3 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -188,7 +188,8 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof
                  */
                 int r, idx;
 
-                fp->rate_table = kmalloc(sizeof(int) * nr_rates, GFP_KERNEL);
+                fp->rate_table = kmalloc_array(nr_rates, sizeof(int),
+                                               GFP_KERNEL);
                 if (fp->rate_table == NULL)
                         return -ENOMEM;
 
@@ -362,7 +363,7 @@ static int parse_audio_format_rates_v2v3(struct snd_usb_audio *chip,
                 goto err_free;
         }
 
-        fp->rate_table = kmalloc(sizeof(int) * fp->nr_rates, GFP_KERNEL);
+        fp->rate_table = kmalloc_array(fp->nr_rates, sizeof(int), GFP_KERNEL);
         if (!fp->rate_table) {
                 ret = -ENOMEM;
                 goto err_free;
diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c
index 947d6168f24a..d8a14d769f48 100644
--- a/sound/usb/line6/capture.c
+++ b/sound/usb/line6/capture.c
@@ -264,8 +264,8 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm)
         struct usb_line6 *line6 = line6pcm->line6;
         int i;
 
-        line6pcm->in.urbs = kzalloc(
-                sizeof(struct urb *) * line6->iso_buffers, GFP_KERNEL);
+        line6pcm->in.urbs = kcalloc(line6->iso_buffers, sizeof(struct urb *),
+                                    GFP_KERNEL);
         if (line6pcm->in.urbs == NULL)
                 return -ENOMEM;
 
diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index b3854f8c0c67..72c6f8e82a7e 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -158,8 +158,10 @@ static int line6_buffer_acquire(struct snd_line6_pcm *line6pcm,
 
         /* Invoked multiple times in a row so allocate once only */
         if (!test_and_set_bit(type, &pstr->opened) && !pstr->buffer) {
-                pstr->buffer = kmalloc(line6pcm->line6->iso_buffers *
-                                       LINE6_ISO_PACKETS * pkt_size, GFP_KERNEL);
+                pstr->buffer =
+                        kmalloc(array3_size(line6pcm->line6->iso_buffers,
+                                            LINE6_ISO_PACKETS, pkt_size),
+                                GFP_KERNEL);
                 if (!pstr->buffer)
                         return -ENOMEM;
         }
diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c
index 819e9b2d1d6e..dec89d2beb57 100644
--- a/sound/usb/line6/playback.c
+++ b/sound/usb/line6/playback.c
@@ -409,8 +409,8 @@ int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm)
         struct usb_line6 *line6 = line6pcm->line6;
         int i;
 
-        line6pcm->out.urbs = kzalloc(
-                sizeof(struct urb *) * line6->iso_buffers, GFP_KERNEL);
+        line6pcm->out.urbs = kcalloc(line6->iso_buffers, sizeof(struct urb *),
+                                     GFP_KERNEL);
         if (line6pcm->out.urbs == NULL)
                 return -ENOMEM;
 
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 898afd3001ea..8c3568d8d03b 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2515,7 +2515,7 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
                 cval->control = (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR) ?
                         UAC2_CX_CLOCK_SELECTOR : UAC2_SU_SELECTOR;
 
-        namelist = kmalloc(sizeof(char *) * desc->bNrInPins, GFP_KERNEL);
+        namelist = kmalloc_array(desc->bNrInPins, sizeof(char *), GFP_KERNEL);
         if (!namelist) {
                 kfree(cval);
                 return -ENOMEM;
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 78d1cad08a0a..160f52c4871b 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1123,7 +1123,7 @@ static int snd_usb_pcm_check_knot(struct snd_pcm_runtime *runtime,
                 return 0;
 
         subs->rate_list.list = rate_list =
-                kmalloc(sizeof(int) * count, GFP_KERNEL);
+                kmalloc_array(count, sizeof(int), GFP_KERNEL);
         if (!subs->rate_list.list)
                 return -ENOMEM;
         subs->rate_list.count = count;
diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
index 0ddf29267d70..da4a5a541512 100644
--- a/sound/usb/usx2y/usbusx2y.c
+++ b/sound/usb/usx2y/usbusx2y.c
@@ -266,7 +266,9 @@ int usX2Y_AsyncSeq04_init(struct usX2Ydev *usX2Y)
         int     err = 0,
                 i;
 
-        if (NULL == (usX2Y->AS04.buffer = kmalloc(URB_DataLen_AsyncSeq*URBS_AsyncSeq, GFP_KERNEL))) {
+        usX2Y->AS04.buffer = kmalloc_array(URBS_AsyncSeq,
+                                           URB_DataLen_AsyncSeq, GFP_KERNEL);
+        if (NULL == usX2Y->AS04.buffer) {
                 err = -ENOMEM;
         } else
                 for (i = 0; i < URBS_AsyncSeq; ++i) {
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index 345e439aa95b..2b833054e3b0 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -436,7 +436,9 @@ static int usX2Y_urbs_allocate(struct snd_usX2Y_substream *subs)
                 }
                 if (!is_playback && !(*purb)->transfer_buffer) {
                         /* allocate a capture buffer per urb */
-                        (*purb)->transfer_buffer = kmalloc(subs->maxpacksize * nr_of_packs(), GFP_KERNEL);
+                        (*purb)->transfer_buffer =
+                                kmalloc_array(subs->maxpacksize,
+                                              nr_of_packs(), GFP_KERNEL);
                         if (NULL == (*purb)->transfer_buffer) {
                                 usX2Y_urbs_release(subs);
                                 return -ENOMEM;
@@ -662,7 +664,8 @@ static int usX2Y_rate_set(struct usX2Ydev *usX2Y, int rate)
                         err = -ENOMEM;
                         goto cleanup;
                 }
-                usbdata = kmalloc(sizeof(int) * NOOF_SETRATE_URBS, GFP_KERNEL);
+                usbdata = kmalloc_array(NOOF_SETRATE_URBS, sizeof(int),
+                                        GFP_KERNEL);
                 if (NULL == usbdata) {
                         err = -ENOMEM;
                         goto cleanup;
diff --git a/virt/kvm/arm/vgic/vgic-v4.c b/virt/kvm/arm/vgic/vgic-v4.c
index bc4265154bac..1ed5f2286b8e 100644
--- a/virt/kvm/arm/vgic/vgic-v4.c
+++ b/virt/kvm/arm/vgic/vgic-v4.c
@@ -126,7 +126,7 @@ int vgic_v4_init(struct kvm *kvm)
 
         nr_vcpus = atomic_read(&kvm->online_vcpus);
 
-        dist->its_vm.vpes = kzalloc(sizeof(*dist->its_vm.vpes) * nr_vcpus,
+        dist->its_vm.vpes = kcalloc(nr_vcpus, sizeof(*dist->its_vm.vpes),
                                     GFP_KERNEL);
         if (!dist->its_vm.vpes)
                 return -ENOMEM;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index aa7da1d8ece2..ada21f47f22b 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3076,7 +3076,8 @@ static long kvm_vm_ioctl(struct file *filp,
                         goto out;
                 if (routing.nr) {
                         r = -ENOMEM;
-                        entries = vmalloc(routing.nr * sizeof(*entries));
+                        entries = vmalloc(array_size(sizeof(*entries),
+                                                     routing.nr));
                         if (!entries)
                                 goto out;
                         r = -EFAULT;