treewide: Use array_size() in vzalloc()

The vzalloc() function has no 2-factor argument form, so multiplication
factors need to be wrapped in array_size(). This patch replaces cases of:

        vzalloc(a * b)

with:
        vzalloc(array_size(a, b))

as well as handling cases of:

        vzalloc(a * b * c)

with:

        vzalloc(array3_size(a, b, c))

This does, however, attempt to ignore constant size factors like:

        vzalloc(4 * 1024)

though any constants defined via macros get caught up in the conversion.

Any factors with a sizeof() of "unsigned char", "char", and "u8" were
dropped, since they're redundant.

The Coccinelle script used for this was:

// Fix redundant parens around sizeof().
@@
type TYPE;
expression THING, E;
@@

(
  vzalloc(
-	(sizeof(TYPE)) * E
+	sizeof(TYPE) * E
  , ...)
|
  vzalloc(
-	(sizeof(THING)) * E
+	sizeof(THING) * E
  , ...)
)

// Drop single-byte sizes and redundant parens.
@@
expression COUNT;
typedef u8;
typedef __u8;
@@

(
  vzalloc(
-	sizeof(u8) * (COUNT)
+	COUNT
  , ...)
|
  vzalloc(
-	sizeof(__u8) * (COUNT)
+	COUNT
  , ...)
|
  vzalloc(
-	sizeof(char) * (COUNT)
+	COUNT
  , ...)
|
  vzalloc(
-	sizeof(unsigned char) * (COUNT)
+	COUNT
  , ...)
|
  vzalloc(
-	sizeof(u8) * COUNT
+	COUNT
  , ...)
|
  vzalloc(
-	sizeof(__u8) * COUNT
+	COUNT
  , ...)
|
  vzalloc(
-	sizeof(char) * COUNT
+	COUNT
  , ...)
|
  vzalloc(
-	sizeof(unsigned char) * COUNT
+	COUNT
  , ...)
)

// 2-factor product with sizeof(type/expression) and identifier or constant.
@@
type TYPE;
expression THING;
identifier COUNT_ID;
constant COUNT_CONST;
@@

(
  vzalloc(
-	sizeof(TYPE) * (COUNT_ID)
+	array_size(COUNT_ID, sizeof(TYPE))
  , ...)
|
  vzalloc(
-	sizeof(TYPE) * COUNT_ID
+	array_size(COUNT_ID, sizeof(TYPE))
  , ...)
|
  vzalloc(
-	sizeof(TYPE) * (COUNT_CONST)
+	array_size(COUNT_CONST, sizeof(TYPE))
  , ...)
|
  vzalloc(
-	sizeof(TYPE) * COUNT_CONST
+	array_size(COUNT_CONST, sizeof(TYPE))
  , ...)
|
  vzalloc(
-	sizeof(THING) * (COUNT_ID)
+	array_size(COUNT_ID, sizeof(THING))
  , ...)
|
  vzalloc(
-	sizeof(THING) * COUNT_ID
+	array_size(COUNT_ID, sizeof(THING))
  , ...)
|
  vzalloc(
-	sizeof(THING) * (COUNT_CONST)
+	array_size(COUNT_CONST, sizeof(THING))
  , ...)
|
  vzalloc(
-	sizeof(THING) * COUNT_CONST
+	array_size(COUNT_CONST, sizeof(THING))
  , ...)
)

// 2-factor product, only identifiers.
@@
identifier SIZE, COUNT;
@@

  vzalloc(
-	SIZE * COUNT
+	array_size(COUNT, SIZE)
  , ...)

// 3-factor product with 1 sizeof(type) or sizeof(expression), with
// redundant parens removed.
@@
expression THING;
identifier STRIDE, COUNT;
type TYPE;
@@

(
  vzalloc(
-	sizeof(TYPE) * (COUNT) * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  vzalloc(
-	sizeof(TYPE) * (COUNT) * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  vzalloc(
-	sizeof(TYPE) * COUNT * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  vzalloc(
-	sizeof(TYPE) * COUNT * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  vzalloc(
-	sizeof(THING) * (COUNT) * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  vzalloc(
-	sizeof(THING) * (COUNT) * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  vzalloc(
-	sizeof(THING) * COUNT * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  vzalloc(
-	sizeof(THING) * COUNT * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
)

// 3-factor product with 2 sizeof(variable), with redundant parens removed.
@@
expression THING1, THING2;
identifier COUNT;
type TYPE1, TYPE2;
@@

(
  vzalloc(
-	sizeof(TYPE1) * sizeof(TYPE2) * COUNT
+	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
  , ...)
|
  vzalloc(
-	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
  , ...)
|
  vzalloc(
-	sizeof(THING1) * sizeof(THING2) * COUNT
+	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
  , ...)
|
  vzalloc(
-	sizeof(THING1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
  , ...)
|
  vzalloc(
-	sizeof(TYPE1) * sizeof(THING2) * COUNT
+	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
  , ...)
|
  vzalloc(
-	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
  , ...)
)

// 3-factor product, only identifiers, with redundant parens removed.
@@
identifier STRIDE, SIZE, COUNT;
@@

(
  vzalloc(
-	(COUNT) * STRIDE * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vzalloc(
-	COUNT * (STRIDE) * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vzalloc(
-	COUNT * STRIDE * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vzalloc(
-	(COUNT) * (STRIDE) * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vzalloc(
-	COUNT * (STRIDE) * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vzalloc(
-	(COUNT) * STRIDE * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vzalloc(
-	(COUNT) * (STRIDE) * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  vzalloc(
-	COUNT * STRIDE * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
)

// Any remaining multi-factor products, first at least 3-factor products
// when they're not all constants...
@@
expression E1, E2, E3;
constant C1, C2, C3;
@@

(
  vzalloc(C1 * C2 * C3, ...)
|
  vzalloc(
-	E1 * E2 * E3
+	array3_size(E1, E2, E3)
  , ...)
)

// And then all remaining 2 factors products when they're not all constants.
@@
expression E1, E2;
constant C1, C2;
@@

(
  vzalloc(C1 * C2, ...)
|
  vzalloc(
-	E1 * E2
+	array_size(E1, E2)
  , ...)
)

Signed-off-by: Kees Cook <keescook@chromium.org>

64 files changed, 164 insertions, 118 deletions

diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index cb6d2313b19f..746645cd2ba7 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -3548,7 +3548,7 @@ static void kvmppc_core_free_memslot_hv(struct kvm_memory_slot *free,
 static int kvmppc_core_create_memslot_hv(struct kvm_memory_slot *slot,
                                          unsigned long npages)
 {
-        slot->arch.rmap = vzalloc(npages * sizeof(*slot->arch.rmap));
+        slot->arch.rmap = vzalloc(array_size(npages, sizeof(*slot->arch.rmap)));
         if (!slot->arch.rmap)
                 return -ENOMEM;
 
diff --git a/arch/powerpc/mm/mmu_context_iommu.c b/arch/powerpc/mm/mmu_context_iommu.c
index 4c615fcb0cf0..abb43646927a 100644
--- a/arch/powerpc/mm/mmu_context_iommu.c
+++ b/arch/powerpc/mm/mmu_context_iommu.c
@@ -159,7 +159,7 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
                 goto unlock_exit;
         }
 
-        mem->hpas = vzalloc(entries * sizeof(mem->hpas[0]));
+        mem->hpas = vzalloc(array_size(entries, sizeof(mem->hpas[0])));
         if (!mem->hpas) {
                 kfree(mem);
                 ret = -ENOMEM;
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 66fc27b92c59..812cada68e0f 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -785,7 +785,8 @@ int kvm_dev_ioctl_get_cpuid(struct kvm_cpuid2 *cpuid,
                 return -EINVAL;
 
         r = -ENOMEM;
-        cpuid_entries = vzalloc(sizeof(struct kvm_cpuid_entry2) * cpuid->nent);
+        cpuid_entries = vzalloc(array_size(sizeof(struct kvm_cpuid_entry2),
+                                           cpuid->nent));
         if (!cpuid_entries)
                 goto out;
 
diff --git a/block/partitions/check.c b/block/partitions/check.c
index 720145c49066..ffe408fead0c 100644
--- a/block/partitions/check.c
+++ b/block/partitions/check.c
@@ -122,7 +122,7 @@ static struct parsed_partitions *allocate_partitions(struct gendisk *hd)
                 return NULL;
 
         nr = disk_max_parts(hd);
-        state->parts = vzalloc(nr * sizeof(state->parts[0]));
+        state->parts = vzalloc(array_size(nr, sizeof(state->parts[0])));
         if (!state->parts) {
                 kfree(state);
                 return NULL;
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index da51293e7c03..7436b2d27fa3 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -898,7 +898,7 @@ static bool zram_meta_alloc(struct zram *zram, u64 disksize)
         size_t num_pages;
 
         num_pages = disksize >> PAGE_SHIFT;
-        zram->table = vzalloc(num_pages * sizeof(*zram->table));
+        zram->table = vzalloc(array_size(num_pages, sizeof(*zram->table)));
         if (!zram->table)
                 return false;
 
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index 293167c6e254..fd6eec8085b4 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -321,7 +321,8 @@ static int __init raw_init(void)
                 max_raw_minors = MAX_RAW_MINORS;
         }
 
-        raw_devices = vzalloc(sizeof(struct raw_device_data) * max_raw_minors);
+        raw_devices = vzalloc(array_size(max_raw_minors,
+                                         sizeof(struct raw_device_data)));
         if (!raw_devices) {
                 printk(KERN_ERR "Not enough memory for raw device structures\n");
                 ret = -ENOMEM;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 08960a55eb27..b6575408f279 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -2339,7 +2339,7 @@ hwp_cpu_matched:
 
         pr_info("Intel P-state driver initializing\n");
 
-        all_cpu_data = vzalloc(sizeof(void *) * num_possible_cpus());
+        all_cpu_data = vzalloc(array_size(sizeof(void *), num_possible_cpus()));
         if (!all_cpu_data)
                 return -ENOMEM;
 
diff --git a/drivers/dma/mic_x100_dma.c b/drivers/dma/mic_x100_dma.c
index 94d7bd7d2880..68dd79783b54 100644
--- a/drivers/dma/mic_x100_dma.c
+++ b/drivers/dma/mic_x100_dma.c
@@ -385,7 +385,8 @@ static int mic_dma_alloc_desc_ring(struct mic_dma_chan *ch)
         if (dma_mapping_error(dev, ch->desc_ring_micpa))
                 goto map_error;
 
-        ch->tx_array = vzalloc(MIC_DMA_DESC_RX_SIZE * sizeof(*ch->tx_array));
+        ch->tx_array = vzalloc(array_size(MIC_DMA_DESC_RX_SIZE,
+                                          sizeof(*ch->tx_array)));
         if (!ch->tx_array)
                 goto tx_error;
         return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
index 17d6b9fb6d77..dd11b7313ca0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
@@ -369,7 +369,8 @@ int amdgpu_gart_init(struct amdgpu_device *adev)
 
 #ifdef CONFIG_DRM_AMDGPU_GART_DEBUGFS
         /* Allocate pages table */
-        adev->gart.pages = vzalloc(sizeof(void *) * adev->gart.num_cpu_pages);
+        adev->gart.pages = vzalloc(array_size(sizeof(void *),
+                                              adev->gart.num_cpu_pages));
         if (adev->gart.pages == NULL)
                 return -ENOMEM;
 #endif
diff --git a/drivers/gpu/drm/drm_hashtab.c b/drivers/gpu/drm/drm_hashtab.c
index dae18e58e79b..c92b00d42ece 100644
--- a/drivers/gpu/drm/drm_hashtab.c
+++ b/drivers/gpu/drm/drm_hashtab.c
@@ -47,7 +47,7 @@ int drm_ht_create(struct drm_open_hash *ht, unsigned int order)
         if (size <= PAGE_SIZE / sizeof(*ht->table))
                 ht->table = kcalloc(size, sizeof(*ht->table), GFP_KERNEL);
         else
-                ht->table = vzalloc(size*sizeof(*ht->table));
+                ht->table = vzalloc(array_size(size, sizeof(*ht->table)));
         if (!ht->table) {
                 DRM_ERROR("Out of memory for hash table\n");
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 78e55aafc8bc..23296547da95 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -1585,8 +1585,9 @@ static struct intel_vgpu_mm *intel_vgpu_create_ggtt_mm(struct intel_vgpu *vgpu)
         mm->type = INTEL_GVT_MM_GGTT;
 
         nr_entries = gvt_ggtt_gm_sz(vgpu->gvt) >> I915_GTT_PAGE_SHIFT;
-        mm->ggtt_mm.virtual_ggtt = vzalloc(nr_entries *
-                                        vgpu->gvt->device_info.gtt_entry_size);
+        mm->ggtt_mm.virtual_ggtt =
+                vzalloc(array_size(nr_entries,
+                                   vgpu->gvt->device_info.gtt_entry_size));
         if (!mm->ggtt_mm.virtual_ggtt) {
                 vgpu_free_mm(mm);
                 return ERR_PTR(-ENOMEM);
diff --git a/drivers/gpu/drm/i915/gvt/mmio.c b/drivers/gpu/drm/i915/gvt/mmio.c
index e4960aff68bd..b31eb36fc102 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.c
+++ b/drivers/gpu/drm/i915/gvt/mmio.c
@@ -267,7 +267,7 @@ int intel_vgpu_init_mmio(struct intel_vgpu *vgpu)
 {
         const struct intel_gvt_device_info *info = &vgpu->gvt->device_info;
 
-        vgpu->mmio.vreg = vzalloc(info->mmio_size * 2);
+        vgpu->mmio.vreg = vzalloc(array_size(info->mmio_size, 2));
         if (!vgpu->mmio.vreg)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 66149eaba78c..1cef155cc933 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -347,7 +347,8 @@ int radeon_gart_init(struct radeon_device *rdev)
         DRM_INFO("GART: num cpu pages %u, num gpu pages %u\n",
                  rdev->gart.num_cpu_pages, rdev->gart.num_gpu_pages);
         /* Allocate pages table */
-        rdev->gart.pages = vzalloc(sizeof(void *) * rdev->gart.num_cpu_pages);
+        rdev->gart.pages = vzalloc(array_size(sizeof(void *),
+                                   rdev->gart.num_cpu_pages));
         if (rdev->gart.pages == NULL) {
                 radeon_gart_fini(rdev);
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/selftests/test-drm_mm.c b/drivers/gpu/drm/selftests/test-drm_mm.c
index 7027a6739845..933af1c25387 100644
--- a/drivers/gpu/drm/selftests/test-drm_mm.c
+++ b/drivers/gpu/drm/selftests/test-drm_mm.c
@@ -389,7 +389,7 @@ static int __igt_reserve(unsigned int count, u64 size)
         if (!order)
                 goto err;
 
-        nodes = vzalloc(sizeof(*nodes) * count);
+        nodes = vzalloc(array_size(count, sizeof(*nodes)));
         if (!nodes)
                 goto err_order;
 
@@ -889,7 +889,7 @@ static int __igt_insert_range(unsigned int count, u64 size, u64 start, u64 end)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(count * sizeof(*nodes));
+        nodes = vzalloc(array_size(count, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -1046,7 +1046,7 @@ static int igt_align(void *ignored)
          * meets our requirements.
          */
 
-        nodes = vzalloc(max_count * sizeof(*nodes));
+        nodes = vzalloc(array_size(max_count, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -1416,7 +1416,7 @@ static int igt_evict(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(size * sizeof(*nodes));
+        nodes = vzalloc(array_size(size, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -1526,7 +1526,7 @@ static int igt_evict_range(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(size * sizeof(*nodes));
+        nodes = vzalloc(array_size(size, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -1627,7 +1627,7 @@ static int igt_topdown(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(count * sizeof(*nodes));
+        nodes = vzalloc(array_size(count, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -1741,7 +1741,7 @@ static int igt_bottomup(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(count * sizeof(*nodes));
+        nodes = vzalloc(array_size(count, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -2098,7 +2098,7 @@ static int igt_color_evict(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(total_size * sizeof(*nodes));
+        nodes = vzalloc(array_size(total_size, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
@@ -2199,7 +2199,7 @@ static int igt_color_evict_range(void *ignored)
          */
 
         ret = -ENOMEM;
-        nodes = vzalloc(total_size * sizeof(*nodes));
+        nodes = vzalloc(array_size(total_size, sizeof(*nodes)));
         if (!nodes)
                 goto err;
 
diff --git a/drivers/gpu/drm/via/via_dmablit.c b/drivers/gpu/drm/via/via_dmablit.c
index d6e84a589ef1..345bda4494e1 100644
--- a/drivers/gpu/drm/via/via_dmablit.c
+++ b/drivers/gpu/drm/via/via_dmablit.c
@@ -235,7 +235,7 @@ via_lock_all_dma_pages(drm_via_sg_info_t *vsg,  drm_via_dmablit_t *xfer)
         vsg->num_pages = VIA_PFN(xfer->mem_addr + (xfer->num_lines * xfer->mem_stride - 1)) -
                 first_pfn + 1;
 
-        vsg->pages = vzalloc(sizeof(struct page *) * vsg->num_pages);
+        vsg->pages = vzalloc(array_size(sizeof(struct page *), vsg->num_pages));
         if (NULL == vsg->pages)
                 return -ENOMEM;
         ret = get_user_pages_fast((unsigned long)xfer->mem_addr,
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 2aadf5813a40..182436b92ba9 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -285,13 +285,15 @@ struct ib_umem *ib_alloc_odp_umem(struct ib_ucontext *context,
         mutex_init(&odp_data->umem_mutex);
         init_completion(&odp_data->notifier_completion);
 
-        odp_data->page_list = vzalloc(pages * sizeof(*odp_data->page_list));
+        odp_data->page_list =
+                vzalloc(array_size(pages, sizeof(*odp_data->page_list)));
         if (!odp_data->page_list) {
                 ret = -ENOMEM;
                 goto out_odp_data;
         }
 
-        odp_data->dma_list = vzalloc(pages * sizeof(*odp_data->dma_list));
+        odp_data->dma_list =
+                vzalloc(array_size(pages, sizeof(*odp_data->dma_list)));
         if (!odp_data->dma_list) {
                 ret = -ENOMEM;
                 goto out_page_list;
@@ -371,15 +373,17 @@ int ib_umem_odp_get(struct ib_ucontext *context, struct ib_umem *umem,
         init_completion(&umem->odp_data->notifier_completion);
 
         if (ib_umem_num_pages(umem)) {
-                umem->odp_data->page_list = vzalloc(ib_umem_num_pages(umem) *
-                                            sizeof(*umem->odp_data->page_list));
+                umem->odp_data->page_list =
+                        vzalloc(array_size(sizeof(*umem->odp_data->page_list),
+                                           ib_umem_num_pages(umem)));
                 if (!umem->odp_data->page_list) {
                         ret_val = -ENOMEM;
                         goto out_odp_data;
                 }
 
-                umem->odp_data->dma_list = vzalloc(ib_umem_num_pages(umem) *
-                                          sizeof(*umem->odp_data->dma_list));
+                umem->odp_data->dma_list =
+                        vzalloc(array_size(sizeof(*umem->odp_data->dma_list),
+                                           ib_umem_num_pages(umem)));
                 if (!umem->odp_data->dma_list) {
                         ret_val = -ENOMEM;
                         goto out_page_list;
diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
index d1fe0e7957e3..eb26a5f6fc58 100644
--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
+++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
@@ -144,7 +144,7 @@ static int hns_roce_buddy_init(struct hns_roce_buddy *buddy, int max_order)
                 buddy->bits[i] = kcalloc(s, sizeof(long), GFP_KERNEL |
                                          __GFP_NOWARN);
                 if (!buddy->bits[i]) {
-                        buddy->bits[i] = vzalloc(s * sizeof(long));
+                        buddy->bits[i] = vzalloc(array_size(s, sizeof(long)));
                         if (!buddy->bits[i])
                                 goto err_out_free;
                 }
diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c
index 704505618909..d7cdc77d6306 100644
--- a/drivers/infiniband/hw/qib/qib_init.c
+++ b/drivers/infiniband/hw/qib/qib_init.c
@@ -369,11 +369,13 @@ static void init_shadow_tids(struct qib_devdata *dd)
         struct page **pages;
         dma_addr_t *addrs;
 
-        pages = vzalloc(dd->cfgctxts * dd->rcvtidcnt * sizeof(struct page *));
+        pages = vzalloc(array_size(sizeof(struct page *),
+                                   dd->cfgctxts * dd->rcvtidcnt));
         if (!pages)
                 goto bail;
 
-        addrs = vzalloc(dd->cfgctxts * dd->rcvtidcnt * sizeof(dma_addr_t));
+        addrs = vzalloc(array_size(sizeof(dma_addr_t),
+                                   dd->cfgctxts * dd->rcvtidcnt));
         if (!addrs)
                 goto bail_free;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 962fbcb57dc7..6535d9beb24d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -358,7 +358,8 @@ static int ipoib_cm_nonsrq_init_rx(struct net_device *dev, struct ib_cm_id *cm_i
         int ret;
         int i;
 
-        rx->rx_ring = vzalloc(ipoib_recvq_size * sizeof *rx->rx_ring);
+        rx->rx_ring = vzalloc(array_size(ipoib_recvq_size,
+                                         sizeof(*rx->rx_ring)));
         if (!rx->rx_ring)
                 return -ENOMEM;
 
@@ -1145,7 +1146,7 @@ static int ipoib_cm_tx_init(struct ipoib_cm_tx *p, u32 qpn,
         int ret;
 
         noio_flag = memalloc_noio_save();
-        p->tx_ring = vzalloc(ipoib_sendq_size * sizeof(*p->tx_ring));
+        p->tx_ring = vzalloc(array_size(ipoib_sendq_size, sizeof(*p->tx_ring)));
         if (!p->tx_ring) {
                 memalloc_noio_restore(noio_flag);
                 ret = -ENOMEM;
@@ -1570,7 +1571,8 @@ static void ipoib_cm_create_srq(struct net_device *dev, int max_sge)
                 return;
         }
 
-        priv->cm.srq_ring = vzalloc(ipoib_recvq_size * sizeof *priv->cm.srq_ring);
+        priv->cm.srq_ring = vzalloc(array_size(ipoib_recvq_size,
+                                               sizeof(*priv->cm.srq_ring)));
         if (!priv->cm.srq_ring) {
                 ib_destroy_srq(priv->cm.srq);
                 priv->cm.srq = NULL;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 0d74c807110e..26cde95bc0f3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1710,7 +1710,8 @@ static int ipoib_dev_init_default(struct net_device *dev)
         if (!priv->rx_ring)
                 goto out;
 
-        priv->tx_ring = vzalloc(ipoib_sendq_size * sizeof *priv->tx_ring);
+        priv->tx_ring = vzalloc(array_size(ipoib_sendq_size,
+                                           sizeof(*priv->tx_ring)));
         if (!priv->tx_ring) {
                 pr_warn("%s: failed to allocate TX ring (%d entries)\n",
                         priv->ca->name, ipoib_sendq_size);
diff --git a/drivers/lightnvm/pblk-init.c b/drivers/lightnvm/pblk-init.c
index c7a7c2de0672..b57f764d6a16 100644
--- a/drivers/lightnvm/pblk-init.c
+++ b/drivers/lightnvm/pblk-init.c
@@ -187,7 +187,7 @@ static int pblk_rwb_init(struct pblk *pblk)
 
         nr_entries = pblk_rb_calculate_size(buffer_size);
 
-        entries = vzalloc(nr_entries * sizeof(struct pblk_rb_entry));
+        entries = vzalloc(array_size(nr_entries, sizeof(struct pblk_rb_entry)));
         if (!entries)
                 return -ENOMEM;
 
diff --git a/drivers/lightnvm/pblk-recovery.c b/drivers/lightnvm/pblk-recovery.c
index 598342833d0d..3a5069183859 100644
--- a/drivers/lightnvm/pblk-recovery.c
+++ b/drivers/lightnvm/pblk-recovery.c
@@ -260,7 +260,7 @@ static int pblk_recov_pad_oob(struct pblk *pblk, struct pblk_line *line,
         if (!pad_rq)
                 return -ENOMEM;
 
-        data = vzalloc(pblk->max_write_pgs * geo->csecs);
+        data = vzalloc(array_size(pblk->max_write_pgs, geo->csecs));
         if (!data) {
                 ret = -ENOMEM;
                 goto free_rq;
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index ec5f70d021de..fa4058e43202 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -2041,8 +2041,8 @@ static int cache_alloc(struct cache *ca)
             !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
             !init_fifo(&ca->free_inc,   free << 2, GFP_KERNEL) ||
             !init_heap(&ca->heap,       free << 3, GFP_KERNEL) ||
-            !(ca->buckets       = vzalloc(sizeof(struct bucket) *
-                                          ca->sb.nbuckets)) ||
+            !(ca->buckets       = vzalloc(array_size(sizeof(struct bucket),
+                                                     ca->sb.nbuckets))) ||
             !(ca->prio_buckets  = kzalloc(array3_size(sizeof(uint64_t),
                                                       prio_buckets(ca), 2),
                                           GFP_KERNEL)) ||
diff --git a/drivers/md/dm-cache-policy-smq.c b/drivers/md/dm-cache-policy-smq.c
index 4d69b6f4129e..1b5b9ad9e492 100644
--- a/drivers/md/dm-cache-policy-smq.c
+++ b/drivers/md/dm-cache-policy-smq.c
@@ -69,7 +69,7 @@ static int space_init(struct entry_space *es, unsigned nr_entries)
                 return 0;
         }
 
-        es->begin = vzalloc(sizeof(struct entry) * nr_entries);
+        es->begin = vzalloc(array_size(nr_entries, sizeof(struct entry)));
         if (!es->begin)
                 return -ENOMEM;
 
diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
index 9b64f4f354bf..abd4c788dffd 100644
--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
@@ -119,12 +119,14 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
                 for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
                         unsigned pixelsz = plane ? 2 : 4;
 
-                        tpg->lines[pat][plane] = vzalloc(max_w * 2 * pixelsz);
+                        tpg->lines[pat][plane] =
+                                vzalloc(array3_size(max_w, 2, pixelsz));
                         if (!tpg->lines[pat][plane])
                                 return -ENOMEM;
                         if (plane == 0)
                                 continue;
-                        tpg->downsampled_lines[pat][plane] = vzalloc(max_w * 2 * pixelsz);
+                        tpg->downsampled_lines[pat][plane] =
+                                vzalloc(array3_size(max_w, 2, pixelsz));
                         if (!tpg->downsampled_lines[pat][plane])
                                 return -ENOMEM;
                 }
@@ -132,13 +134,16 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
         for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
                 unsigned pixelsz = plane ? 2 : 4;
 
-                tpg->contrast_line[plane] = vzalloc(max_w * pixelsz);
+                tpg->contrast_line[plane] =
+                        vzalloc(array_size(pixelsz, max_w));
                 if (!tpg->contrast_line[plane])
                         return -ENOMEM;
-                tpg->black_line[plane] = vzalloc(max_w * pixelsz);
+                tpg->black_line[plane] =
+                        vzalloc(array_size(pixelsz, max_w));
                 if (!tpg->black_line[plane])
                         return -ENOMEM;
-                tpg->random_line[plane] = vzalloc(max_w * 2 * pixelsz);
+                tpg->random_line[plane] =
+                        vzalloc(array3_size(max_w, 2, pixelsz));
                 if (!tpg->random_line[plane])
                         return -ENOMEM;
         }
diff --git a/drivers/media/pci/cx23885/cx23885-alsa.c b/drivers/media/pci/cx23885/cx23885-alsa.c
index 20b3cb17f97f..db1e8ff35474 100644
--- a/drivers/media/pci/cx23885/cx23885-alsa.c
+++ b/drivers/media/pci/cx23885/cx23885-alsa.c
@@ -95,7 +95,7 @@ static int cx23885_alsa_dma_init(struct cx23885_audio_dev *chip, int nr_pages)
         memset(buf->vaddr, 0, nr_pages << PAGE_SHIFT);
         buf->nr_pages = nr_pages;
 
-        buf->sglist = vzalloc(buf->nr_pages * sizeof(*buf->sglist));
+        buf->sglist = vzalloc(array_size(sizeof(*buf->sglist), buf->nr_pages));
         if (NULL == buf->sglist)
                 goto vzalloc_err;
 
diff --git a/drivers/media/pci/cx25821/cx25821-alsa.c b/drivers/media/pci/cx25821/cx25821-alsa.c
index a45bf0331eeb..ef6380651c10 100644
--- a/drivers/media/pci/cx25821/cx25821-alsa.c
+++ b/drivers/media/pci/cx25821/cx25821-alsa.c
@@ -159,7 +159,7 @@ static int cx25821_alsa_dma_init(struct cx25821_audio_dev *chip, int nr_pages)
         memset(buf->vaddr, 0, nr_pages << PAGE_SHIFT);
         buf->nr_pages = nr_pages;
 
-        buf->sglist = vzalloc(buf->nr_pages * sizeof(*buf->sglist));
+        buf->sglist = vzalloc(array_size(sizeof(*buf->sglist), buf->nr_pages));
         if (NULL == buf->sglist)
                 goto vzalloc_err;
 
diff --git a/drivers/media/pci/cx88/cx88-alsa.c b/drivers/media/pci/cx88/cx88-alsa.c
index 8a28fda703a2..e5c3387cd1e8 100644
--- a/drivers/media/pci/cx88/cx88-alsa.c
+++ b/drivers/media/pci/cx88/cx88-alsa.c
@@ -298,7 +298,7 @@ static int cx88_alsa_dma_init(struct cx88_audio_dev *chip, int nr_pages)
         memset(buf->vaddr, 0, nr_pages << PAGE_SHIFT);
         buf->nr_pages = nr_pages;
 
-        buf->sglist = vzalloc(buf->nr_pages * sizeof(*buf->sglist));
+        buf->sglist = vzalloc(array_size(sizeof(*buf->sglist), buf->nr_pages));
         if (!buf->sglist)
                 goto vzalloc_err;
 
diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
index 72311445d13d..b90cfde6e301 100644
--- a/drivers/media/pci/saa7134/saa7134-alsa.c
+++ b/drivers/media/pci/saa7134/saa7134-alsa.c
@@ -279,7 +279,7 @@ static int saa7134_alsa_dma_init(struct saa7134_dev *dev, int nr_pages)
         memset(dma->vaddr, 0, nr_pages << PAGE_SHIFT);
         dma->nr_pages = nr_pages;
 
-        dma->sglist = vzalloc(dma->nr_pages * sizeof(*dma->sglist));
+        dma->sglist = vzalloc(array_size(sizeof(*dma->sglist), dma->nr_pages));
         if (NULL == dma->sglist)
                 goto vzalloc_err;
 
diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
index 59031018985e..31db363602e5 100644
--- a/drivers/media/platform/vivid/vivid-core.c
+++ b/drivers/media/platform/vivid/vivid-core.c
@@ -844,10 +844,10 @@ static int vivid_create_instance(struct platform_device *pdev, int inst)
         tpg_init(&dev->tpg, 640, 360);
         if (tpg_alloc(&dev->tpg, MAX_ZOOM * MAX_WIDTH))
                 goto free_dev;
-        dev->scaled_line = vzalloc(MAX_ZOOM * MAX_WIDTH);
+        dev->scaled_line = vzalloc(array_size(MAX_WIDTH, MAX_ZOOM));
         if (!dev->scaled_line)
                 goto free_dev;
-        dev->blended_line = vzalloc(MAX_ZOOM * MAX_WIDTH);
+        dev->blended_line = vzalloc(array_size(MAX_WIDTH, MAX_ZOOM));
         if (!dev->blended_line)
                 goto free_dev;
 
diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
index 314abde9a922..08929c087e27 100644
--- a/drivers/media/v4l2-core/videobuf-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
@@ -69,7 +69,7 @@ static struct scatterlist *videobuf_vmalloc_to_sg(unsigned char *virt,
         struct page *pg;
         int i;
 
-        sglist = vzalloc(nr_pages * sizeof(*sglist));
+        sglist = vzalloc(array_size(nr_pages, sizeof(*sglist)));
         if (NULL == sglist)
                 return NULL;
         sg_init_table(sglist, nr_pages);
diff --git a/drivers/mtd/nand/raw/nandsim.c b/drivers/mtd/nand/raw/nandsim.c
index 9dc29d4389f7..f8edacde49ab 100644
--- a/drivers/mtd/nand/raw/nandsim.c
+++ b/drivers/mtd/nand/raw/nandsim.c
@@ -565,8 +565,9 @@ static int __init alloc_device(struct nandsim *ns)
                         err = -EINVAL;
                         goto err_close;
                 }
-                ns->pages_written = vzalloc(BITS_TO_LONGS(ns->geom.pgnum) *
-                                            sizeof(unsigned long));
+                ns->pages_written =
+                        vzalloc(array_size(sizeof(unsigned long),
+                                           BITS_TO_LONGS(ns->geom.pgnum)));
                 if (!ns->pages_written) {
                         NS_ERR("alloc_device: unable to allocate pages written array\n");
                         err = -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index e13bf3b4636d..122fdb80a789 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -778,7 +778,7 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
                 int j;
 
                 rxr->rx_buf_ring =
-                        vzalloc(SW_RXBD_RING_SIZE * bp->rx_max_ring);
+                        vzalloc(array_size(SW_RXBD_RING_SIZE, bp->rx_max_ring));
                 if (!rxr->rx_buf_ring)
                         return -ENOMEM;
 
@@ -794,8 +794,9 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
                 }
 
                 if (bp->rx_pg_ring_size) {
-                        rxr->rx_pg_ring = vzalloc(SW_RXPG_RING_SIZE *
-                                                  bp->rx_max_pg_ring);
+                        rxr->rx_pg_ring =
+                                vzalloc(array_size(SW_RXPG_RING_SIZE,
+                                                   bp->rx_max_pg_ring));
                         if (!rxr->rx_pg_ring)
                                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
index f044718cea52..5b5b6228d495 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
@@ -286,8 +286,8 @@ int octeon_init_droq(struct octeon_device *oct,
                                                 numa_node);
         if (!droq->recv_buf_list)
                 droq->recv_buf_list = (struct octeon_recv_buffer *)
-                                      vzalloc(droq->max_count *
-                                                OCT_DROQ_RECVBUF_SIZE);
+                      vzalloc(array_size(droq->max_count,
+                                         OCT_DROQ_RECVBUF_SIZE));
         if (!droq->recv_buf_list) {
                 dev_err(&oct->pci_dev->dev, "Output queue recv buf list alloc failed\n");
                 goto init_droq_fail;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 85e1d14514fc..0ce07f6eb1e6 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -1406,8 +1406,8 @@ static int hns_dsaf_init(struct dsaf_device *dsaf_dev)
                 return ret;
 
         /* malloc mem for tcam mac key(vlan+mac) */
-        priv->soft_mac_tbl = vzalloc(sizeof(*priv->soft_mac_tbl)
-                  * DSAF_TCAM_SUM);
+        priv->soft_mac_tbl = vzalloc(array_size(DSAF_TCAM_SUM,
+                                                sizeof(*priv->soft_mac_tbl)));
         if (!priv->soft_mac_tbl) {
                 ret = -ENOMEM;
                 goto remove_hw;
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
index 28a81ac97af5..4d09ea786b35 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
@@ -753,11 +753,12 @@ static int init_cmdq(struct hinic_cmdq *cmdq, struct hinic_wq *wq,
 
         spin_lock_init(&cmdq->cmdq_lock);
 
-        cmdq->done = vzalloc(wq->q_depth * sizeof(*cmdq->done));
+        cmdq->done = vzalloc(array_size(sizeof(*cmdq->done), wq->q_depth));
         if (!cmdq->done)
                 return -ENOMEM;
 
-        cmdq->errcode = vzalloc(wq->q_depth * sizeof(*cmdq->errcode));
+        cmdq->errcode = vzalloc(array_size(sizeof(*cmdq->errcode),
+                                           wq->q_depth));
         if (!cmdq->errcode) {
                 err = -ENOMEM;
                 goto err_errcode;
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
index 8d0295655933..358ed6118881 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
@@ -2565,7 +2565,7 @@ __vxge_hw_mempool_grow(struct vxge_hw_mempool *mempool, u32 num_allocate,
                  * allocate new memblock and its private part at once.
                  * This helps to minimize memory usage a lot. */
                 mempool->memblocks_priv_arr[i] =
-                                vzalloc(mempool->items_priv_size * n_items);
+                        vzalloc(array_size(mempool->items_priv_size, n_items));
                 if (mempool->memblocks_priv_arr[i] == NULL) {
                         status = VXGE_HW_ERR_OUT_OF_MEMORY;
                         goto exit;
@@ -2665,7 +2665,7 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
 
         /* allocate array of memblocks */
         mempool->memblocks_arr =
-                vzalloc(sizeof(void *) * mempool->memblocks_max);
+                vzalloc(array_size(sizeof(void *), mempool->memblocks_max));
         if (mempool->memblocks_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
@@ -2675,7 +2675,7 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
 
         /* allocate array of private parts of items per memblocks */
         mempool->memblocks_priv_arr =
-                vzalloc(sizeof(void *) * mempool->memblocks_max);
+                vzalloc(array_size(sizeof(void *), mempool->memblocks_max));
         if (mempool->memblocks_priv_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
@@ -2685,8 +2685,8 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
 
         /* allocate array of memblocks DMA objects */
         mempool->memblocks_dma_arr =
-                vzalloc(sizeof(struct vxge_hw_mempool_dma) *
-                        mempool->memblocks_max);
+                vzalloc(array_size(sizeof(struct vxge_hw_mempool_dma),
+                                   mempool->memblocks_max));
         if (mempool->memblocks_dma_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
@@ -2695,7 +2695,8 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
         }
 
         /* allocate hash array of items */
-        mempool->items_arr = vzalloc(sizeof(void *) * mempool->items_max);
+        mempool->items_arr = vzalloc(array_size(sizeof(void *),
+                                                mempool->items_max));
         if (mempool->items_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index de1c70843efd..99973e10b179 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -2435,7 +2435,7 @@ static int qed_update_vport(struct qed_dev *cdev,
         if (!cdev)
                 return -ENODEV;
 
-        rss = vzalloc(sizeof(*rss) * cdev->num_hwfns);
+        rss = vzalloc(array_size(sizeof(*rss), cdev->num_hwfns));
         if (!rss)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c
index e9e088d9c815..b823bfe2ea4d 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c
@@ -342,8 +342,9 @@ int qede_alloc_arfs(struct qede_dev *edev)
         for (i = 0; i <= QEDE_RFS_FLW_MASK; i++)
                 INIT_HLIST_HEAD(QEDE_ARFS_BUCKET_HEAD(edev, i));
 
-        edev->arfs->arfs_fltr_bmap = vzalloc(BITS_TO_LONGS(QEDE_RFS_MAX_FLTR) *
-                                             sizeof(long));
+        edev->arfs->arfs_fltr_bmap =
+                vzalloc(array_size(sizeof(long),
+                                   BITS_TO_LONGS(QEDE_RFS_MAX_FLTR)));
         if (!edev->arfs->arfs_fltr_bmap) {
                 vfree(edev->arfs);
                 edev->arfs = NULL;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 97c146e7698a..569d54ededec 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -386,8 +386,9 @@ int qlcnic_83xx_setup_intr(struct qlcnic_adapter *adapter)
         }
 
         /* setup interrupt mapping table for fw */
-        ahw->intr_tbl = vzalloc(num_msix *
-                                sizeof(struct qlcnic_intrpt_config));
+        ahw->intr_tbl =
+                vzalloc(array_size(num_msix,
+                                   sizeof(struct qlcnic_intrpt_config)));
         if (!ahw->intr_tbl)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 8c6724063231..2d38d1ac2aae 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -916,8 +916,9 @@ int qlcnic_82xx_mq_intrpt(struct qlcnic_adapter *adapter, int op_type)
         if (qlcnic_check_multi_tx(adapter) &&
             !ahw->diag_test &&
             (adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                ahw->intr_tbl = vzalloc(ahw->num_msix *
-                                        sizeof(struct qlcnic_intrpt_config));
+                ahw->intr_tbl =
+                        vzalloc(array_size(sizeof(struct qlcnic_intrpt_config),
+                                           ahw->num_msix));
                 if (!ahw->intr_tbl)
                         return -ENOMEM;
 
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index d90a7b1f4088..23f0785c0573 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4984,7 +4984,8 @@ static int efx_ef10_filter_table_probe(struct efx_nic *efx)
                 net_dev->hw_features &= ~NETIF_F_HW_VLAN_CTAG_FILTER;
         }
 
-        table->entry = vzalloc(HUNT_FILTER_TBL_ROWS * sizeof(*table->entry));
+        table->entry = vzalloc(array_size(HUNT_FILTER_TBL_ROWS,
+                                          sizeof(*table->entry)));
         if (!table->entry) {
                 rc = -ENOMEM;
                 goto fail;
diff --git a/drivers/net/ethernet/sfc/falcon/farch.c b/drivers/net/ethernet/sfc/falcon/farch.c
index 494884f6af4a..411a2f419447 100644
--- a/drivers/net/ethernet/sfc/falcon/farch.c
+++ b/drivers/net/ethernet/sfc/falcon/farch.c
@@ -2755,7 +2755,8 @@ int ef4_farch_filter_table_probe(struct ef4_nic *efx)
                                              GFP_KERNEL);
                 if (!table->used_bitmap)
                         goto fail;
-                table->spec = vzalloc(table->size * sizeof(*table->spec));
+                table->spec = vzalloc(array_size(sizeof(*table->spec),
+                                                 table->size));
                 if (!table->spec)
                         goto fail;
         }
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index c72adf8b52ea..8edf20967c82 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -2826,7 +2826,8 @@ int efx_farch_filter_table_probe(struct efx_nic *efx)
                                              GFP_KERNEL);
                 if (!table->used_bitmap)
                         goto fail;
-                table->spec = vzalloc(table->size * sizeof(*table->spec));
+                table->spec = vzalloc(array_size(sizeof(*table->spec),
+                                                 table->size));
                 if (!table->spec)
                         goto fail;
         }
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 157b67c1bf8e..67ffe74747a1 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -648,7 +648,7 @@ static int __init pptp_init_module(void)
         int err = 0;
         pr_info("PPTP driver version " PPTP_DRIVER_VERSION "\n");
 
-        callid_sock = vzalloc((MAX_CALLID + 1) * sizeof(void *));
+        callid_sock = vzalloc(array_size(sizeof(void *), (MAX_CALLID + 1)));
         if (!callid_sock)
                 return -ENOMEM;
 
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index e1aef253601e..cd51492ae6c2 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -977,8 +977,8 @@ static void connect(struct backend_info *be)
         }
 
         /* Use the number of queues requested by the frontend */
-        be->vif->queues = vzalloc(requested_num_queues *
-                                  sizeof(struct xenvif_queue));
+        be->vif->queues = vzalloc(array_size(requested_num_queues,
+                                             sizeof(struct xenvif_queue)));
         if (!be->vif->queues) {
                 xenbus_dev_fatal(dev, -ENOMEM,
                                  "allocating queues");
diff --git a/drivers/s390/char/sclp_sd.c b/drivers/s390/char/sclp_sd.c
index 99f41db5123b..1e244f78f192 100644
--- a/drivers/s390/char/sclp_sd.c
+++ b/drivers/s390/char/sclp_sd.c
@@ -300,7 +300,7 @@ static int sclp_sd_store_data(struct sclp_sd_data *result, u8 di)
                 goto out_result;
 
         /* Allocate memory */
-        data = vzalloc((size_t) dsize * PAGE_SIZE);
+        data = vzalloc(array_size((size_t)dsize, PAGE_SIZE));
         if (!data) {
                 rc = -ENOMEM;
                 goto out;
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index b965d4fe18ef..94c23ad51179 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -4829,8 +4829,9 @@ megasas_alloc_fusion_context(struct megasas_instance *instance)
                 (PLD_SPAN_INFO)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
                                                 fusion->log_to_span_pages);
         if (!fusion->log_to_span) {
-                fusion->log_to_span = vzalloc(MAX_LOGICAL_DRIVES_EXT *
-                                              sizeof(LD_SPAN_INFO));
+                fusion->log_to_span =
+                        vzalloc(array_size(MAX_LOGICAL_DRIVES_EXT,
+                                           sizeof(LD_SPAN_INFO)));
                 if (!fusion->log_to_span) {
                         dev_err(&instance->pdev->dev, "Failed from %s %d\n",
                                 __func__, __LINE__);
@@ -4844,8 +4845,9 @@ megasas_alloc_fusion_context(struct megasas_instance *instance)
                 (struct LD_LOAD_BALANCE_INFO *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
                 fusion->load_balance_info_pages);
         if (!fusion->load_balance_info) {
-                fusion->load_balance_info = vzalloc(MAX_LOGICAL_DRIVES_EXT *
-                        sizeof(struct LD_LOAD_BALANCE_INFO));
+                fusion->load_balance_info =
+                        vzalloc(array_size(MAX_LOGICAL_DRIVES_EXT,
+                                           sizeof(struct LD_LOAD_BALANCE_INFO)));
                 if (!fusion->load_balance_info)
                         dev_err(&instance->pdev->dev, "Failed to allocate load_balance_info, "
                                 "continuing without Load Balance support\n");
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 0c2e82af9c0a..7732e9336d43 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -1661,7 +1661,9 @@ static int tcm_qla2xxx_init_lport(struct tcm_qla2xxx_lport *lport)
                 return rc;
         }
 
-        lport->lport_loopid_map = vzalloc(sizeof(struct tcm_qla2xxx_fc_loopid) * 65536);
+        lport->lport_loopid_map =
+                vzalloc(array_size(65536,
+                                   sizeof(struct tcm_qla2xxx_fc_loopid)));
         if (!lport->lport_loopid_map) {
                 pr_err("Unable to allocate lport->lport_loopid_map of %zu bytes\n",
                     sizeof(struct tcm_qla2xxx_fc_loopid) * 65536);
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index a7e94a3decf2..ecb22749df0b 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -1021,7 +1021,8 @@ int qman_alloc_fq_table(u32 _num_fqids)
 {
         num_fqids = _num_fqids;
 
-        fq_table = vzalloc(num_fqids * 2 * sizeof(struct qman_fq *));
+        fq_table = vzalloc(array3_size(sizeof(struct qman_fq *),
+                                       num_fqids, 2));
         if (!fq_table)
                 return -ENOMEM;
 
diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme.c b/drivers/staging/rtl8188eu/core/rtw_mlme.c
index 24e92998a30c..50e7cae32f75 100644
--- a/drivers/staging/rtl8188eu/core/rtw_mlme.c
+++ b/drivers/staging/rtl8188eu/core/rtw_mlme.c
@@ -53,7 +53,7 @@ int rtw_init_mlme_priv(struct adapter *padapter)
 
         memset(&pmlmepriv->assoc_ssid, 0, sizeof(struct ndis_802_11_ssid));
 
-        pbuf = vzalloc(MAX_BSS_CNT * (sizeof(struct wlan_network)));
+        pbuf = vzalloc(array_size(MAX_BSS_CNT, sizeof(struct wlan_network)));
 
         if (!pbuf) {
                 res = _FAIL;
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index cc4f115e082c..f9392b8db49b 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -37,7 +37,7 @@ sint	_rtw_init_mlme_priv(struct adapter *padapter)
 
         memset(&pmlmepriv->assoc_ssid, 0, sizeof(struct ndis_802_11_ssid));
 
-        pbuf = vzalloc(MAX_BSS_CNT * (sizeof(struct wlan_network)));
+        pbuf = vzalloc(array_size(MAX_BSS_CNT, sizeof(struct wlan_network)));
 
         if (pbuf == NULL) {
                 res = _FAIL;
diff --git a/drivers/staging/rts5208/rtsx_chip.c b/drivers/staging/rts5208/rtsx_chip.c
index f8f9579cc679..8a823466ca2b 100644
--- a/drivers/staging/rts5208/rtsx_chip.c
+++ b/drivers/staging/rts5208/rtsx_chip.c
@@ -1660,13 +1660,13 @@ int rtsx_write_cfg_seq(struct rtsx_chip *chip, u8 func, u16 addr, u8 *buf,
 
         dev_dbg(rtsx_dev(chip), "dw_len = %d\n", dw_len);
 
-        data = vzalloc(dw_len * 4);
+        data = vzalloc(array_size(dw_len, 4));
         if (!data) {
                 rtsx_trace(chip);
                 return STATUS_NOMEM;
         }
 
-        mask = vzalloc(dw_len * 4);
+        mask = vzalloc(array_size(dw_len, 4));
         if (!mask) {
                 vfree(data);
                 rtsx_trace(chip);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index efe8214f2df3..ee5081ba5313 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -253,7 +253,7 @@ int transport_alloc_session_tags(struct se_session *se_sess,
         se_sess->sess_cmd_map = kcalloc(tag_size, tag_num,
                                         GFP_KERNEL | __GFP_NOWARN | __GFP_RETRY_MAYFAIL);
         if (!se_sess->sess_cmd_map) {
-                se_sess->sess_cmd_map = vzalloc(tag_num * tag_size);
+                se_sess->sess_cmd_map = vzalloc(array_size(tag_size, tag_num));
                 if (!se_sess->sess_cmd_map) {
                         pr_err("Unable to allocate se_sess->sess_cmd_map\n");
                         return -ENOMEM;
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 334f2ad60704..223b3b2dff87 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -177,7 +177,8 @@ int nfsd_reply_cache_init(void)
 
         drc_hashtbl = kcalloc(hashsize, sizeof(*drc_hashtbl), GFP_KERNEL);
         if (!drc_hashtbl) {
-                drc_hashtbl = vzalloc(hashsize * sizeof(*drc_hashtbl));
+                drc_hashtbl = vzalloc(array_size(hashsize,
+                                                 sizeof(*drc_hashtbl)));
                 if (!drc_hashtbl)
                         goto out_nomem;
         }
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 358ee2a1ce1a..52eb5d293a34 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -350,7 +350,8 @@ static struct reiserfs_journal_cnode *allocate_cnodes(int num_cnodes)
         if (num_cnodes <= 0) {
                 return NULL;
         }
-        head = vzalloc(num_cnodes * sizeof(struct reiserfs_journal_cnode));
+        head = vzalloc(array_size(num_cnodes,
+                                  sizeof(struct reiserfs_journal_cnode)));
         if (!head) {
                 return NULL;
         }
diff --git a/fs/reiserfs/resize.c b/fs/reiserfs/resize.c
index 6052d323bc9a..8096c74c38ac 100644
--- a/fs/reiserfs/resize.c
+++ b/fs/reiserfs/resize.c
@@ -120,7 +120,8 @@ int reiserfs_resize(struct super_block *s, unsigned long block_count_new)
                  * array of bitmap block pointers
                  */
                 bitmap =
-                    vzalloc(sizeof(struct reiserfs_bitmap_info) * bmap_nr_new);
+                    vzalloc(array_size(bmap_nr_new,
+                                       sizeof(struct reiserfs_bitmap_info)));
                 if (!bitmap) {
                         /*
                          * Journal bitmaps are still supersized, but the
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1494e087890e..9e2bf834f13a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5206,7 +5206,8 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env, u32 prog_len,
 
         if (cnt == 1)
                 return 0;
-        new_data = vzalloc(sizeof(struct bpf_insn_aux_data) * prog_len);
+        new_data = vzalloc(array_size(prog_len,
+                                      sizeof(struct bpf_insn_aux_data)));
         if (!new_data)
                 return -ENOMEM;
         memcpy(new_data, old_data, sizeof(struct bpf_insn_aux_data) * off);
@@ -5870,8 +5871,9 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr)
                 return -ENOMEM;
         log = &env->log;
 
-        env->insn_aux_data = vzalloc(sizeof(struct bpf_insn_aux_data) *
-                                     (*prog)->len);
+        env->insn_aux_data =
+                vzalloc(array_size(sizeof(struct bpf_insn_aux_data),
+                                   (*prog)->len));
         ret = -ENOMEM;
         if (!env->insn_aux_data)
                 goto err_free_env;
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 75d8e7cf040e..c6a3b6851372 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -793,7 +793,7 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi,
          * The section headers in kexec_purgatory are read-only. In order to
          * have them modifiable make a temporary copy.
          */
-        sechdrs = vzalloc(pi->ehdr->e_shnum * sizeof(Elf_Shdr));
+        sechdrs = vzalloc(array_size(sizeof(Elf_Shdr), pi->ehdr->e_shnum));
         if (!sechdrs)
                 return -ENOMEM;
         memcpy(sechdrs, (void *)pi->ehdr + pi->ehdr->e_shoff,
diff --git a/lib/test_firmware.c b/lib/test_firmware.c
index cee000ac54d8..b984806d7d7b 100644
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -618,8 +618,9 @@ static ssize_t trigger_batched_requests_store(struct device *dev,
 
         mutex_lock(&test_fw_mutex);
 
-        test_fw_config->reqs = vzalloc(sizeof(struct test_batched_req) *
-                                       test_fw_config->num_requests * 2);
+        test_fw_config->reqs =
+                vzalloc(array3_size(sizeof(struct test_batched_req),
+                                    test_fw_config->num_requests, 2));
         if (!test_fw_config->reqs) {
                 rc = -ENOMEM;
                 goto out_unlock;
@@ -720,8 +721,9 @@ ssize_t trigger_batched_requests_async_store(struct device *dev,
 
         mutex_lock(&test_fw_mutex);
 
-        test_fw_config->reqs = vzalloc(sizeof(struct test_batched_req) *
-                                       test_fw_config->num_requests * 2);
+        test_fw_config->reqs =
+                vzalloc(array3_size(sizeof(struct test_batched_req),
+                                    test_fw_config->num_requests, 2));
         if (!test_fw_config->reqs) {
                 rc = -ENOMEM;
                 goto out;
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index 0e5b7a61460b..e3ddd836491f 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -779,8 +779,9 @@ static int kmod_config_sync_info(struct kmod_test_device *test_dev)
         struct test_config *config = &test_dev->config;
 
         free_test_dev_info(test_dev);
-        test_dev->info = vzalloc(config->num_threads *
-                                 sizeof(struct kmod_test_device_info));
+        test_dev->info =
+                vzalloc(array_size(sizeof(struct kmod_test_device_info),
+                                   config->num_threads));
         if (!test_dev->info)
                 return -ENOMEM;
 
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index f4000c137dbe..fb6968109113 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -285,12 +285,14 @@ static int __init test_rhltable(unsigned int entries)
         if (entries == 0)
                 entries = 1;
 
-        rhl_test_objects = vzalloc(sizeof(*rhl_test_objects) * entries);
+        rhl_test_objects = vzalloc(array_size(entries,
+                                              sizeof(*rhl_test_objects)));
         if (!rhl_test_objects)
                 return -ENOMEM;
 
         ret = -ENOMEM;
-        obj_in_table = vzalloc(BITS_TO_LONGS(entries) * sizeof(unsigned long));
+        obj_in_table = vzalloc(array_size(sizeof(unsigned long),
+                                          BITS_TO_LONGS(entries)));
         if (!obj_in_table)
                 goto out_free;
 
@@ -706,7 +708,8 @@ static int __init test_rht_init(void)
         test_rht_params.max_size = max_size ? : roundup_pow_of_two(entries);
         test_rht_params.nelem_hint = size;
 
-        objs = vzalloc((test_rht_params.max_size + 1) * sizeof(struct test_obj));
+        objs = vzalloc(array_size(sizeof(struct test_obj),
+                                  test_rht_params.max_size + 1));
         if (!objs)
                 return -ENOMEM;
 
@@ -753,10 +756,10 @@ static int __init test_rht_init(void)
         pr_info("Testing concurrent rhashtable access from %d threads\n",
                 tcount);
         sema_init(&prestart_sem, 1 - tcount);
-        tdata = vzalloc(tcount * sizeof(struct thread_data));
+        tdata = vzalloc(array_size(tcount, sizeof(struct thread_data)));
         if (!tdata)
                 return -ENOMEM;
-        objs  = vzalloc(tcount * entries * sizeof(struct test_obj));
+        objs  = vzalloc(array3_size(sizeof(struct test_obj), tcount, entries));
         if (!objs) {
                 vfree(tdata);
                 return -ENOMEM;
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 8be6be2d9c7b..e677a20180cf 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1852,7 +1852,7 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr)
         WARN_ON_ONCE(!ret);
 
         gstrings.len = ret;
-        data = vzalloc(gstrings.len * ETH_GSTRING_LEN);
+        data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
         if (gstrings.len && !data)
                 return -ENOMEM;
 
@@ -1952,7 +1952,7 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
                 return -EFAULT;
 
         stats.n_stats = n_stats;
-        data = vzalloc(n_stats * sizeof(u64));
+        data = vzalloc(array_size(n_stats, sizeof(u64)));
         if (n_stats && !data)
                 return -ENOMEM;
 
@@ -1996,7 +1996,7 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
                 return -EFAULT;
 
         stats.n_stats = n_stats;
-        data = vzalloc(n_stats * sizeof(u64));
+        data = vzalloc(array_size(n_stats, sizeof(u64)));
         if (n_stats && !data)
                 return -ENOMEM;
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ee018564b2b4..50809748c127 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4161,7 +4161,7 @@ static char *alloc_one_pg_vec_page(unsigned long order)
                 return buffer;
 
         /* __get_free_pages failed, fall back to vmalloc */
-        buffer = vzalloc((1 << order) * PAGE_SIZE);
+        buffer = vzalloc(array_size((1 << order), PAGE_SIZE));
         if (buffer)
                 return buffer;