Merge tag 'overflow-v4.18-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull more overflow updates from Kees Cook:
 "The rest of the overflow changes for v4.18-rc1.

  This includes the explicit overflow fixes from Silvio, further
  struct_size() conversions from Matthew, and a bug fix from Dan.

  But the bulk of it is the treewide conversions to use either the
  2-factor argument allocators (e.g. kmalloc(a * b, ...) into
  kmalloc_array(a, b, ...) or the array_size() macros (e.g. vmalloc(a *
  b) into vmalloc(array_size(a, b)).

  Coccinelle was fighting me on several fronts, so I've done a bunch of
  manual whitespace updates in the patches as well.

  Summary:

   - Error path bug fix for overflow tests (Dan)

   - Additional struct_size() conversions (Matthew, Kees)

   - Explicitly reported overflow fixes (Silvio, Kees)

   - Add missing kvcalloc() function (Kees)

   - Treewide conversions of allocators to use either 2-factor argument
     variant when available, or array_size() and array3_size() as needed
     (Kees)"

* tag 'overflow-v4.18-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (26 commits)
  treewide: Use array_size in f2fs_kvzalloc()
  treewide: Use array_size() in f2fs_kzalloc()
  treewide: Use array_size() in f2fs_kmalloc()
  treewide: Use array_size() in sock_kmalloc()
  treewide: Use array_size() in kvzalloc_node()
  treewide: Use array_size() in vzalloc_node()
  treewide: Use array_size() in vzalloc()
  treewide: Use array_size() in vmalloc()
  treewide: devm_kzalloc() -> devm_kcalloc()
  treewide: devm_kmalloc() -> devm_kmalloc_array()
  treewide: kvzalloc() -> kvcalloc()
  treewide: kvmalloc() -> kvmalloc_array()
  treewide: kzalloc_node() -> kcalloc_node()
  treewide: kzalloc() -> kcalloc()
  treewide: kmalloc() -> kmalloc_array()
  mm: Introduce kvcalloc()
  video: uvesafb: Fix integer overflow in allocation
  UBIFS: Fix potential integer overflow in allocation
  leds: Use struct_size() in allocation
  Convert intel uncore to struct_size
  ...

137 files changed, 430 insertions, 364 deletions

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index bd53a71f6b00..63e3844c5bec 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2418,7 +2418,7 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,
         struct list_head  *iter;
 
         if (start_dev == end_dev) {
-                tags = kzalloc(sizeof(*tags) * (level + 1), GFP_ATOMIC);
+                tags = kcalloc(level + 1, sizeof(*tags), GFP_ATOMIC);
                 if (!tags)
                         return ERR_PTR(-ENOMEM);
                 tags[level].vlan_proto = VLAN_N_VID;
diff --git a/drivers/net/can/grcan.c b/drivers/net/can/grcan.c
index 2d3046afa80d..7eec1d9f86a0 100644
--- a/drivers/net/can/grcan.c
+++ b/drivers/net/can/grcan.c
@@ -1057,7 +1057,7 @@ static int grcan_open(struct net_device *dev)
                 return err;
         }
 
-        priv->echo_skb = kzalloc(dma->tx.size * sizeof(*priv->echo_skb),
+        priv->echo_skb = kcalloc(dma->tx.size, sizeof(*priv->echo_skb),
                                  GFP_KERNEL);
         if (!priv->echo_skb) {
                 err = -ENOMEM;
@@ -1066,7 +1066,7 @@ static int grcan_open(struct net_device *dev)
         priv->can.echo_skb_max = dma->tx.size;
         priv->can.echo_skb = priv->echo_skb;
 
-        priv->txdlc = kzalloc(dma->tx.size * sizeof(*priv->txdlc), GFP_KERNEL);
+        priv->txdlc = kcalloc(dma->tx.size, sizeof(*priv->txdlc), GFP_KERNEL);
         if (!priv->txdlc) {
                 err = -ENOMEM;
                 goto exit_free_echo_skb;
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index 89d60d8e467c..aa97dbc797b6 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -703,7 +703,7 @@ static int __init slcan_init(void)
         pr_info("slcan: serial line CAN interface driver\n");
         pr_info("slcan: %d dynamic interface channels.\n", maxdev);
 
-        slcan_devs = kzalloc(sizeof(struct net_device *)*maxdev, GFP_KERNEL);
+        slcan_devs = kcalloc(maxdev, sizeof(struct net_device *), GFP_KERNEL);
         if (!slcan_devs)
                 return -ENOMEM;
 
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 5e010b1592f7..d93c790bfbe8 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -2044,14 +2044,14 @@ static int b53_switch_init(struct b53_device *dev)
                 }
         }
 
-        dev->ports = devm_kzalloc(dev->dev,
-                                  sizeof(struct b53_port) * dev->num_ports,
+        dev->ports = devm_kcalloc(dev->dev,
+                                  dev->num_ports, sizeof(struct b53_port),
                                   GFP_KERNEL);
         if (!dev->ports)
                 return -ENOMEM;
 
-        dev->vlans = devm_kzalloc(dev->dev,
-                                  sizeof(struct b53_vlan) * dev->num_vlans,
+        dev->vlans = devm_kcalloc(dev->dev,
+                                  dev->num_vlans, sizeof(struct b53_vlan),
                                   GFP_KERNEL);
         if (!dev->vlans)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index 060cb18fa659..521607bc4393 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -838,8 +838,8 @@ static void ena_dump_stats_ex(struct ena_adapter *adapter, u8 *buf)
                 return;
         }
 
-        strings_buf = devm_kzalloc(&adapter->pdev->dev,
-                                   strings_num * ETH_GSTRING_LEN,
+        strings_buf = devm_kcalloc(&adapter->pdev->dev,
+                                   ETH_GSTRING_LEN, strings_num,
                                    GFP_ATOMIC);
         if (!strings_buf) {
                 netif_err(adapter, drv, netdev,
@@ -847,8 +847,8 @@ static void ena_dump_stats_ex(struct ena_adapter *adapter, u8 *buf)
                 return;
         }
 
-        data_buf = devm_kzalloc(&adapter->pdev->dev,
-                                strings_num * sizeof(u64),
+        data_buf = devm_kcalloc(&adapter->pdev->dev,
+                                strings_num, sizeof(u64),
                                 GFP_ATOMIC);
         if (!data_buf) {
                 netif_err(adapter, drv, netdev,
diff --git a/drivers/net/ethernet/amd/lance.c b/drivers/net/ethernet/amd/lance.c
index 12a6a93d221b..b56d84c7df46 100644
--- a/drivers/net/ethernet/amd/lance.c
+++ b/drivers/net/ethernet/amd/lance.c
@@ -551,13 +551,13 @@ static int __init lance_probe1(struct net_device *dev, int ioaddr, int irq, int
         if (lance_debug > 6) printk(" (#0x%05lx)", (unsigned long)lp);
         dev->ml_priv = lp;
         lp->name = chipname;
-        lp->rx_buffs = (unsigned long)kmalloc(PKT_BUF_SZ*RX_RING_SIZE,
-                                                  GFP_DMA | GFP_KERNEL);
+        lp->rx_buffs = (unsigned long)kmalloc_array(RX_RING_SIZE, PKT_BUF_SZ,
+                                                    GFP_DMA | GFP_KERNEL);
         if (!lp->rx_buffs)
                 goto out_lp;
         if (lance_need_isa_bounce_buffers) {
-                lp->tx_bounce_buffs = kmalloc(PKT_BUF_SZ*TX_RING_SIZE,
-                                                  GFP_DMA | GFP_KERNEL);
+                lp->tx_bounce_buffs = kmalloc_array(TX_RING_SIZE, PKT_BUF_SZ,
+                                                    GFP_DMA | GFP_KERNEL);
                 if (!lp->tx_bounce_buffs)
                         goto out_rx;
         } else
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c b/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
index cfe86a20c899..28e9ae1a193b 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_ethtool.c
@@ -209,8 +209,8 @@ static int atl1c_get_eeprom(struct net_device *netdev,
         first_dword = eeprom->offset >> 2;
         last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
 
-        eeprom_buff = kmalloc(sizeof(u32) *
-                        (last_dword - first_dword + 1), GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_dword - first_dword + 1, sizeof(u32),
+                                    GFP_KERNEL);
         if (eeprom_buff == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c b/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
index cb489e7e8374..282ebdde4769 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_ethtool.c
@@ -236,8 +236,8 @@ static int atl1e_get_eeprom(struct net_device *netdev,
         first_dword = eeprom->offset >> 2;
         last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
 
-        eeprom_buff = kmalloc(sizeof(u32) *
-                        (last_dword - first_dword + 1), GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_dword - first_dword + 1, sizeof(u32),
+                                    GFP_KERNEL);
         if (eeprom_buff == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
index db4bcc51023a..bb41becb6609 100644
--- a/drivers/net/ethernet/atheros/atlx/atl2.c
+++ b/drivers/net/ethernet/atheros/atlx/atl2.c
@@ -1941,8 +1941,8 @@ static int atl2_get_eeprom(struct net_device *netdev,
         first_dword = eeprom->offset >> 2;
         last_dword = (eeprom->offset + eeprom->len - 1) >> 2;
 
-        eeprom_buff = kmalloc(sizeof(u32) * (last_dword - first_dword + 1),
-                GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_dword - first_dword + 1, sizeof(u32),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
index 14a59e51db67..897302adc38e 100644
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -2150,7 +2150,7 @@ static int bcm_enetsw_open(struct net_device *dev)
         priv->tx_desc_alloc_size = size;
         priv->tx_desc_cpu = p;
 
-        priv->tx_skb = kzalloc(sizeof(struct sk_buff *) * priv->tx_ring_size,
+        priv->tx_skb = kcalloc(priv->tx_ring_size, sizeof(struct sk_buff *),
                                GFP_KERNEL);
         if (!priv->tx_skb) {
                 dev_err(kdev, "cannot allocate rx skb queue\n");
@@ -2164,7 +2164,7 @@ static int bcm_enetsw_open(struct net_device *dev)
         spin_lock_init(&priv->tx_lock);
 
         /* init & fill rx ring with skbs */
-        priv->rx_skb = kzalloc(sizeof(struct sk_buff *) * priv->rx_ring_size,
+        priv->rx_skb = kcalloc(priv->rx_ring_size, sizeof(struct sk_buff *),
                                GFP_KERNEL);
         if (!priv->rx_skb) {
                 dev_err(kdev, "cannot allocate rx skb queue\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 3853296d78c1..122fdb80a789 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -778,7 +778,7 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
                 int j;
 
                 rxr->rx_buf_ring =
-                        vzalloc(SW_RXBD_RING_SIZE * bp->rx_max_ring);
+                        vzalloc(array_size(SW_RXBD_RING_SIZE, bp->rx_max_ring));
                 if (!rxr->rx_buf_ring)
                         return -ENOMEM;
 
@@ -794,8 +794,9 @@ bnx2_alloc_rx_mem(struct bnx2 *bp)
                 }
 
                 if (bp->rx_pg_ring_size) {
-                        rxr->rx_pg_ring = vzalloc(SW_RXPG_RING_SIZE *
-                                                  bp->rx_max_pg_ring);
+                        rxr->rx_pg_ring =
+                                vzalloc(array_size(SW_RXPG_RING_SIZE,
+                                                   bp->rx_max_pg_ring));
                         if (!rxr->rx_pg_ring)
                                 return -ENOMEM;
 
@@ -2666,7 +2667,7 @@ bnx2_alloc_bad_rbuf(struct bnx2 *bp)
         u32 good_mbuf_cnt;
         u32 val;
 
-        good_mbuf = kmalloc(512 * sizeof(u16), GFP_KERNEL);
+        good_mbuf = kmalloc_array(512, sizeof(u16), GFP_KERNEL);
         if (!good_mbuf)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index ffa7959f6b31..dc77bfded865 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -571,7 +571,7 @@ int bnx2x_vf_mcast(struct bnx2x *bp, struct bnx2x_virtf *vf,
         else
                 set_bit(RAMROD_COMP_WAIT, &mcast.ramrod_flags);
         if (mc_num) {
-                mc = kzalloc(mc_num * sizeof(struct bnx2x_mcast_list_elem),
+                mc = kcalloc(mc_num, sizeof(struct bnx2x_mcast_list_elem),
                              GFP_KERNEL);
                 if (!mc) {
                         BNX2X_ERR("Cannot Configure multicasts due to lack of memory\n");
@@ -1253,8 +1253,9 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param,
            num_vfs_param, iov->nr_virtfn);
 
         /* allocate the vf array */
-        bp->vfdb->vfs = kzalloc(sizeof(struct bnx2x_virtf) *
-                                BNX2X_NR_VIRTFN(bp), GFP_KERNEL);
+        bp->vfdb->vfs = kcalloc(BNX2X_NR_VIRTFN(bp),
+                                sizeof(struct bnx2x_virtf),
+                                GFP_KERNEL);
         if (!bp->vfdb->vfs) {
                 BNX2X_ERR("failed to allocate vf array\n");
                 err = -ENOMEM;
@@ -1278,9 +1279,9 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param,
         }
 
         /* allocate the queue arrays for all VFs */
-        bp->vfdb->vfqs = kzalloc(
-                BNX2X_MAX_NUM_VF_QUEUES * sizeof(struct bnx2x_vf_queue),
-                GFP_KERNEL);
+        bp->vfdb->vfqs = kcalloc(BNX2X_MAX_NUM_VF_QUEUES,
+                                 sizeof(struct bnx2x_vf_queue),
+                                 GFP_KERNEL);
 
         if (!bp->vfdb->vfqs) {
                 BNX2X_ERR("failed to allocate vf queue array\n");
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c
index 38f635cf8408..05d405905906 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_vfr.c
@@ -444,8 +444,8 @@ static int bnxt_vf_reps_create(struct bnxt *bp)
                 return -ENOMEM;
 
         /* storage for cfa_code to vf-idx mapping */
-        cfa_code_map = kmalloc(sizeof(*bp->cfa_code_map) * MAX_CFA_CODE,
-                               GFP_KERNEL);
+        cfa_code_map = kmalloc_array(MAX_CFA_CODE, sizeof(*bp->cfa_code_map),
+                                     GFP_KERNEL);
         if (!cfa_code_map) {
                 rc = -ENOMEM;
                 goto err;
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 8bc126a156e8..30273a7717e2 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -660,7 +660,7 @@ static int cnic_init_id_tbl(struct cnic_id_tbl *id_tbl, u32 size, u32 start_id,
         id_tbl->max = size;
         id_tbl->next = next;
         spin_lock_init(&id_tbl->lock);
-        id_tbl->table = kzalloc(DIV_ROUND_UP(size, 32) * 4, GFP_KERNEL);
+        id_tbl->table = kcalloc(DIV_ROUND_UP(size, 32), 4, GFP_KERNEL);
         if (!id_tbl->table)
                 return -ENOMEM;
 
@@ -1255,13 +1255,13 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
                         cp->fcoe_init_cid = 0x10;
         }
 
-        cp->iscsi_tbl = kzalloc(sizeof(struct cnic_iscsi) * MAX_ISCSI_TBL_SZ,
+        cp->iscsi_tbl = kcalloc(MAX_ISCSI_TBL_SZ, sizeof(struct cnic_iscsi),
                                 GFP_KERNEL);
         if (!cp->iscsi_tbl)
                 goto error;
 
-        cp->ctx_tbl = kzalloc(sizeof(struct cnic_context) *
-                                cp->max_cid_space, GFP_KERNEL);
+        cp->ctx_tbl = kcalloc(cp->max_cid_space, sizeof(struct cnic_context),
+                              GFP_KERNEL);
         if (!cp->ctx_tbl)
                 goto error;
 
@@ -4100,7 +4100,7 @@ static int cnic_cm_alloc_mem(struct cnic_dev *dev)
         struct cnic_local *cp = dev->cnic_priv;
         u32 port_id;
 
-        cp->csk_tbl = kzalloc(sizeof(struct cnic_sock) * MAX_CM_SK_TBL_SZ,
+        cp->csk_tbl = kcalloc(MAX_CM_SK_TBL_SZ, sizeof(struct cnic_sock),
                               GFP_KERNEL);
         if (!cp->csk_tbl)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 9f59b1270a7c..3be87efdc93d 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -8631,8 +8631,9 @@ static int tg3_mem_tx_acquire(struct tg3 *tp)
                 tnapi++;
 
         for (i = 0; i < tp->txq_cnt; i++, tnapi++) {
-                tnapi->tx_buffers = kzalloc(sizeof(struct tg3_tx_ring_info) *
-                                            TG3_TX_RING_SIZE, GFP_KERNEL);
+                tnapi->tx_buffers = kcalloc(TG3_TX_RING_SIZE,
+                                            sizeof(struct tg3_tx_ring_info),
+                                            GFP_KERNEL);
                 if (!tnapi->tx_buffers)
                         goto err_out;
 
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index 69cc3e0119d6..ea5f32ea308a 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -3141,7 +3141,7 @@ bnad_set_rx_ucast_fltr(struct bnad *bnad)
         if (uc_count > bna_attr(&bnad->bna)->num_ucmac)
                 goto mode_default;
 
-        mac_list = kzalloc(uc_count * ETH_ALEN, GFP_ATOMIC);
+        mac_list = kcalloc(ETH_ALEN, uc_count, GFP_ATOMIC);
         if (mac_list == NULL)
                 goto mode_default;
 
@@ -3182,7 +3182,7 @@ bnad_set_rx_mcast_fltr(struct bnad *bnad)
         if (mc_count > bna_attr(&bnad->bna)->num_mcmac)
                 goto mode_allmulti;
 
-        mac_list = kzalloc((mc_count + 1) * ETH_ALEN, GFP_ATOMIC);
+        mac_list = kcalloc(mc_count + 1, ETH_ALEN, GFP_ATOMIC);
 
         if (mac_list == NULL)
                 goto mode_allmulti;
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index 2bd7c638b178..2c63afff1382 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -739,7 +739,7 @@ static int xgmac_dma_desc_rings_init(struct net_device *dev)
 
         netdev_dbg(priv->dev, "mtu [%d] bfsize [%d]\n", dev->mtu, bfsize);
 
-        priv->rx_skbuff = kzalloc(sizeof(struct sk_buff *) * DMA_RX_RING_SZ,
+        priv->rx_skbuff = kcalloc(DMA_RX_RING_SZ, sizeof(struct sk_buff *),
                                   GFP_KERNEL);
         if (!priv->rx_skbuff)
                 return -ENOMEM;
@@ -752,7 +752,7 @@ static int xgmac_dma_desc_rings_init(struct net_device *dev)
         if (!priv->dma_rx)
                 goto err_dma_rx;
 
-        priv->tx_skbuff = kzalloc(sizeof(struct sk_buff *) * DMA_TX_RING_SZ,
+        priv->tx_skbuff = kcalloc(DMA_TX_RING_SZ, sizeof(struct sk_buff *),
                                   GFP_KERNEL);
         if (!priv->tx_skbuff)
                 goto err_tx_skb;
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
index f044718cea52..a71dbb7ab6af 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
@@ -281,13 +281,12 @@ int octeon_init_droq(struct octeon_device *oct,
                 droq->max_count);
 
         droq->recv_buf_list = (struct octeon_recv_buffer *)
-                              vzalloc_node(droq->max_count *
-                                                OCT_DROQ_RECVBUF_SIZE,
-                                                numa_node);
+              vzalloc_node(array_size(droq->max_count, OCT_DROQ_RECVBUF_SIZE),
+                           numa_node);
         if (!droq->recv_buf_list)
                 droq->recv_buf_list = (struct octeon_recv_buffer *)
-                                      vzalloc(droq->max_count *
-                                                OCT_DROQ_RECVBUF_SIZE);
+                      vzalloc(array_size(droq->max_count,
+                                         OCT_DROQ_RECVBUF_SIZE));
         if (!droq->recv_buf_list) {
                 dev_err(&oct->pci_dev->dev, "Output queue recv buf list alloc failed\n");
                 goto init_droq_fail;
diff --git a/drivers/net/ethernet/cavium/liquidio/request_manager.c b/drivers/net/ethernet/cavium/liquidio/request_manager.c
index b1270355b0b1..1f2e75da28f8 100644
--- a/drivers/net/ethernet/cavium/liquidio/request_manager.c
+++ b/drivers/net/ethernet/cavium/liquidio/request_manager.c
@@ -98,8 +98,9 @@ int octeon_init_instr_queue(struct octeon_device *oct,
         iq->request_list = vmalloc_node((sizeof(*iq->request_list) * num_descs),
                                                numa_node);
         if (!iq->request_list)
-                iq->request_list = vmalloc(sizeof(*iq->request_list) *
-                                                  num_descs);
+                iq->request_list =
+                        vmalloc(array_size(num_descs,
+                                           sizeof(*iq->request_list)));
         if (!iq->request_list) {
                 lio_dma_free(oct, q_size, iq->base_addr, iq->base_addr_dma);
                 dev_err(&oct->pci_dev->dev, "Alloc failed for IQ[%d] nr free list\n",
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index d42704d07484..187a249ff2d1 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -292,8 +292,8 @@ static int  nicvf_init_rbdr(struct nicvf *nic, struct rbdr *rbdr,
                 rbdr->is_xdp = true;
         }
         rbdr->pgcnt = roundup_pow_of_two(rbdr->pgcnt);
-        rbdr->pgcache = kzalloc(sizeof(*rbdr->pgcache) *
-                                rbdr->pgcnt, GFP_KERNEL);
+        rbdr->pgcache = kcalloc(rbdr->pgcnt, sizeof(*rbdr->pgcache),
+                                GFP_KERNEL);
         if (!rbdr->pgcache)
                 return -ENOMEM;
         rbdr->pgidx = 0;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
index 290039026ece..5701272aa7f7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
@@ -304,7 +304,7 @@ struct clip_tbl *t4_init_clip_tbl(unsigned int clipt_start,
         for (i = 0; i < ctbl->clipt_size; ++i)
                 INIT_LIST_HEAD(&ctbl->hash_list[i]);
 
-        cl_list = kvzalloc(clipt_size*sizeof(struct clip_entry), GFP_KERNEL);
+        cl_list = kvcalloc(clipt_size, sizeof(struct clip_entry), GFP_KERNEL);
         if (!cl_list) {
                 kvfree(ctbl);
                 return NULL;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
index 251d5bdc972f..c301aaf79d64 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
@@ -873,7 +873,7 @@ static int cctrl_tbl_show(struct seq_file *seq, void *v)
         u16 (*incr)[NCCTRL_WIN];
         struct adapter *adap = seq->private;
 
-        incr = kmalloc(sizeof(*incr) * NMTUS, GFP_KERNEL);
+        incr = kmalloc_array(NMTUS, sizeof(*incr), GFP_KERNEL);
         if (!incr)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 35cb3ae4f7b6..dd04a2f89ce6 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -713,7 +713,7 @@ int cxgb4_write_rss(const struct port_info *pi, const u16 *queues)
         const struct sge_eth_rxq *rxq;
 
         rxq = &adapter->sge.ethrxq[pi->first_qset];
-        rss = kmalloc(pi->rss_size * sizeof(u16), GFP_KERNEL);
+        rss = kmalloc_array(pi->rss_size, sizeof(u16), GFP_KERNEL);
         if (!rss)
                 return -ENOMEM;
 
@@ -4972,8 +4972,8 @@ static int enable_msix(struct adapter *adap)
                 max_ingq += (MAX_OFLD_QSETS * adap->num_uld);
         if (is_offload(adap))
                 max_ingq += (MAX_OFLD_QSETS * adap->num_ofld_uld);
-        entries = kmalloc(sizeof(*entries) * (max_ingq + 1),
-                          GFP_KERNEL);
+        entries = kmalloc_array(max_ingq + 1, sizeof(*entries),
+                                GFP_KERNEL);
         if (!entries)
                 return -ENOMEM;
 
@@ -5646,8 +5646,8 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 adapter->params.offload = 0;
         }
 
-        adapter->mps_encap = kvzalloc(sizeof(struct mps_encap_entry) *
-                                          adapter->params.arch.mps_tcam_size,
+        adapter->mps_encap = kvcalloc(adapter->params.arch.mps_tcam_size,
+                                      sizeof(struct mps_encap_entry),
                                       GFP_KERNEL);
         if (!adapter->mps_encap)
                 dev_warn(&pdev->dev, "could not allocate MPS Encap entries, continuing\n");
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
index ab174bcfbfb0..18eb2aedd4cb 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
@@ -457,7 +457,8 @@ struct cxgb4_tc_u32_table *cxgb4_init_tc_u32(struct adapter *adap)
                 unsigned int bmap_size;
 
                 bmap_size = BITS_TO_LONGS(max_tids);
-                link->tid_map = kvzalloc(sizeof(unsigned long) * bmap_size, GFP_KERNEL);
+                link->tid_map = kvcalloc(bmap_size, sizeof(unsigned long),
+                                         GFP_KERNEL);
                 if (!link->tid_map)
                         goto out_no_mem;
                 bitmap_zero(link->tid_map, max_tids);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
index a95cde0fadf7..4bc211093c98 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
@@ -561,13 +561,13 @@ int t4_uld_mem_alloc(struct adapter *adap)
         if (!adap->uld)
                 return -ENOMEM;
 
-        s->uld_rxq_info = kzalloc(CXGB4_ULD_MAX *
+        s->uld_rxq_info = kcalloc(CXGB4_ULD_MAX,
                                   sizeof(struct sge_uld_rxq_info *),
                                   GFP_KERNEL);
         if (!s->uld_rxq_info)
                 goto err_uld;
 
-        s->uld_txq_info = kzalloc(CXGB4_TX_MAX *
+        s->uld_txq_info = kcalloc(CXGB4_TX_MAX,
                                   sizeof(struct sge_uld_txq_info *),
                                   GFP_KERNEL);
         if (!s->uld_txq_info)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 7a271feec5e7..395e2a0e8d7f 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -699,7 +699,7 @@ static void *alloc_ring(struct device *dev, size_t nelem, size_t elem_size,
         if (!p)
                 return NULL;
         if (sw_size) {
-                s = kzalloc_node(nelem * sw_size, GFP_KERNEL, node);
+                s = kcalloc_node(sw_size, nelem, GFP_KERNEL, node);
 
                 if (!s) {
                         dma_free_coherent(dev, len, p, *phys);
diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index ff9eb45f67f8..6d7404f66f84 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -910,8 +910,8 @@ static int geth_setup_freeq(struct gemini_ethernet *geth)
         }
 
         /* Allocate a mapping to page look-up index */
-        geth->freeq_pages = kzalloc(pages * sizeof(*geth->freeq_pages),
-                                   GFP_KERNEL);
+        geth->freeq_pages = kcalloc(pages, sizeof(*geth->freeq_pages),
+                                    GFP_KERNEL);
         if (!geth->freeq_pages)
                 goto err_freeq;
         geth->num_freeq_pages = pages;
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index 00a57273b753..60da0499ad66 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -1141,7 +1141,8 @@ static int ethoc_probe(struct platform_device *pdev)
         dev_dbg(&pdev->dev, "ethoc: num_tx: %d num_rx: %d\n",
                 priv->num_tx, priv->num_rx);
 
-        priv->vma = devm_kzalloc(&pdev->dev, num_bd*sizeof(void *), GFP_KERNEL);
+        priv->vma = devm_kcalloc(&pdev->dev, num_bd, sizeof(void *),
+                                 GFP_KERNEL);
         if (!priv->vma) {
                 ret = -ENOMEM;
                 goto free;
diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
index fd43f98ddbe7..5f4e1ffa7b95 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -664,7 +664,7 @@ static struct dpaa_fq *dpaa_fq_alloc(struct device *dev,
         struct dpaa_fq *dpaa_fq;
         int i;
 
-        dpaa_fq = devm_kzalloc(dev, sizeof(*dpaa_fq) * count,
+        dpaa_fq = devm_kcalloc(dev, count, sizeof(*dpaa_fq),
                                GFP_KERNEL);
         if (!dpaa_fq)
                 return NULL;
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index a96b838cffce..42fca3208c0b 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -2253,9 +2253,9 @@ static int ucc_geth_alloc_tx(struct ucc_geth_private *ugeth)
         /* Init Tx bds */
         for (j = 0; j < ug_info->numQueuesTx; j++) {
                 /* Setup the skbuff rings */
-                ugeth->tx_skbuff[j] = kmalloc(sizeof(struct sk_buff *) *
-                                              ugeth->ug_info->bdRingLenTx[j],
-                                              GFP_KERNEL);
+                ugeth->tx_skbuff[j] =
+                        kmalloc_array(ugeth->ug_info->bdRingLenTx[j],
+                                      sizeof(struct sk_buff *), GFP_KERNEL);
 
                 if (ugeth->tx_skbuff[j] == NULL) {
                         if (netif_msg_ifup(ugeth))
@@ -2326,9 +2326,9 @@ static int ucc_geth_alloc_rx(struct ucc_geth_private *ugeth)
         /* Init Rx bds */
         for (j = 0; j < ug_info->numQueuesRx; j++) {
                 /* Setup the skbuff rings */
-                ugeth->rx_skbuff[j] = kmalloc(sizeof(struct sk_buff *) *
-                                              ugeth->ug_info->bdRingLenRx[j],
-                                              GFP_KERNEL);
+                ugeth->rx_skbuff[j] =
+                        kmalloc_array(ugeth->ug_info->bdRingLenRx[j],
+                                      sizeof(struct sk_buff *), GFP_KERNEL);
 
                 if (ugeth->rx_skbuff[j] == NULL) {
                         if (netif_msg_ifup(ugeth))
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 85e1d14514fc..0ce07f6eb1e6 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -1406,8 +1406,8 @@ static int hns_dsaf_init(struct dsaf_device *dsaf_dev)
                 return ret;
 
         /* malloc mem for tcam mac key(vlan+mac) */
-        priv->soft_mac_tbl = vzalloc(sizeof(*priv->soft_mac_tbl)
-                  * DSAF_TCAM_SUM);
+        priv->soft_mac_tbl = vzalloc(array_size(DSAF_TCAM_SUM,
+                                                sizeof(*priv->soft_mac_tbl)));
         if (!priv->soft_mac_tbl) {
                 ret = -ENOMEM;
                 goto remove_hw;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 1ccb6443d2ed..ef9ef703d13a 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -2197,7 +2197,8 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv)
                 return -EINVAL;
         }
 
-        priv->ring_data = kzalloc(h->q_num * sizeof(*priv->ring_data) * 2,
+        priv->ring_data = kzalloc(array3_size(h->q_num,
+                                              sizeof(*priv->ring_data), 2),
                                   GFP_KERNEL);
         if (!priv->ring_data)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index f2b31d278bc9..25a73bb2e642 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2846,8 +2846,10 @@ static int hns3_get_ring_config(struct hns3_nic_priv *priv)
         struct pci_dev *pdev = h->pdev;
         int i, ret;
 
-        priv->ring_data =  devm_kzalloc(&pdev->dev, h->kinfo.num_tqps *
-                                        sizeof(*priv->ring_data) * 2,
+        priv->ring_data =  devm_kzalloc(&pdev->dev,
+                                        array3_size(h->kinfo.num_tqps,
+                                                    sizeof(*priv->ring_data),
+                                                    2),
                                         GFP_KERNEL);
         if (!priv->ring_data)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
index 28a81ac97af5..4d09ea786b35 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
@@ -753,11 +753,12 @@ static int init_cmdq(struct hinic_cmdq *cmdq, struct hinic_wq *wq,
 
         spin_lock_init(&cmdq->cmdq_lock);
 
-        cmdq->done = vzalloc(wq->q_depth * sizeof(*cmdq->done));
+        cmdq->done = vzalloc(array_size(sizeof(*cmdq->done), wq->q_depth));
         if (!cmdq->done)
                 return -ENOMEM;
 
-        cmdq->errcode = vzalloc(wq->q_depth * sizeof(*cmdq->errcode));
+        cmdq->errcode = vzalloc(array_size(sizeof(*cmdq->errcode),
+                                           wq->q_depth));
         if (!cmdq->errcode) {
                 err = -ENOMEM;
                 goto err_errcode;
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index c1b51edaaf62..525d8b89187b 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -171,7 +171,7 @@ static int ibmveth_alloc_buffer_pool(struct ibmveth_buff_pool *pool)
 {
         int i;
 
-        pool->free_map = kmalloc(sizeof(u16) * pool->size, GFP_KERNEL);
+        pool->free_map = kmalloc_array(pool->size, sizeof(u16), GFP_KERNEL);
 
         if (!pool->free_map)
                 return -1;
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index 5d365a986bb0..bdb3f8e65ed4 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -435,8 +435,8 @@ static int e1000_get_eeprom(struct net_device *netdev,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) *
-                        (last_word - first_word + 1), GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index e084cb734eb1..02ebf208f48b 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -509,8 +509,8 @@ static int e1000_get_eeprom(struct net_device *netdev,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
-                              GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index acf1e8b52b8e..3ba0c90e7055 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3312,7 +3312,7 @@ static int e1000e_write_mc_addr_list(struct net_device *netdev)
                 return 0;
         }
 
-        mta_list = kzalloc(netdev_mc_count(netdev) * ETH_ALEN, GFP_ATOMIC);
+        mta_list = kcalloc(netdev_mc_count(netdev), ETH_ALEN, GFP_ATOMIC);
         if (!mta_list)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
index 7657daa27298..4895dd83dd08 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
@@ -558,7 +558,7 @@ static int fm10k_set_ringparam(struct net_device *netdev,
 
         /* allocate temporary buffer to store rings in */
         i = max_t(int, interface->num_tx_queues, interface->num_rx_queues);
-        temp_ring = vmalloc(i * sizeof(struct fm10k_ring));
+        temp_ring = vmalloc(array_size(i, sizeof(struct fm10k_ring)));
 
         if (!temp_ring) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 2d798499d35e..f92f7918112d 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -736,8 +736,8 @@ static int igb_get_eeprom(struct net_device *netdev,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) *
-                        (last_word - first_word + 1), GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
@@ -902,11 +902,11 @@ static int igb_set_ringparam(struct net_device *netdev,
         }
 
         if (adapter->num_tx_queues > adapter->num_rx_queues)
-                temp_ring = vmalloc(adapter->num_tx_queues *
-                                    sizeof(struct igb_ring));
+                temp_ring = vmalloc(array_size(sizeof(struct igb_ring),
+                                               adapter->num_tx_queues));
         else
-                temp_ring = vmalloc(adapter->num_rx_queues *
-                                    sizeof(struct igb_ring));
+                temp_ring = vmalloc(array_size(sizeof(struct igb_ring),
+                                               adapter->num_rx_queues));
 
         if (!temp_ring) {
                 err = -ENOMEM;
@@ -3245,8 +3245,8 @@ static int igb_get_module_eeprom(struct net_device *netdev,
         first_word = ee->offset >> 1;
         last_word = (ee->offset + ee->len - 1) >> 1;
 
-        dataword = kmalloc(sizeof(u16) * (last_word - first_word + 1),
-                           GFP_KERNEL);
+        dataword = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                 GFP_KERNEL);
         if (!dataword)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index c33821d2afb3..f707709969ac 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3763,8 +3763,9 @@ static int igb_sw_init(struct igb_adapter *adapter)
         /* Assume MSI-X interrupts, will be checked during IRQ allocation */
         adapter->flags |= IGB_FLAG_HAS_MSIX;
 
-        adapter->mac_table = kzalloc(sizeof(struct igb_mac_addr) *
-                                     hw->mac.rar_entry_count, GFP_ATOMIC);
+        adapter->mac_table = kcalloc(hw->mac.rar_entry_count,
+                                     sizeof(struct igb_mac_addr),
+                                     GFP_ATOMIC);
         if (!adapter->mac_table)
                 return -ENOMEM;
 
@@ -4752,7 +4753,7 @@ static int igb_write_mc_addr_list(struct net_device *netdev)
                 return 0;
         }
 
-        mta_list = kzalloc(netdev_mc_count(netdev) * 6, GFP_ATOMIC);
+        mta_list = kcalloc(netdev_mc_count(netdev), 6, GFP_ATOMIC);
         if (!mta_list)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c b/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
index 43744bf0fc1c..c8c93ac436d4 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
@@ -375,8 +375,9 @@ ixgb_get_eeprom(struct net_device *netdev,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(__le16) *
-                        (last_word - first_word + 1), GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1,
+                                    sizeof(__le16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
index 62f2173bc20e..43664adf7a3c 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
@@ -1093,8 +1093,9 @@ ixgb_set_multi(struct net_device *netdev)
                 rctl |= IXGB_RCTL_MPE;
                 IXGB_WRITE_REG(hw, RCTL, rctl);
         } else {
-                u8 *mta = kmalloc(IXGB_MAX_NUM_MULTICAST_ADDRESSES *
-                              ETH_ALEN, GFP_ATOMIC);
+                u8 *mta = kmalloc_array(ETH_ALEN,
+                                        IXGB_MAX_NUM_MULTICAST_ADDRESSES,
+                                        GFP_ATOMIC);
                 u8 *addr;
                 if (!mta)
                         goto alloc_failed;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index bdd179c29ea4..bd1ba88ec1d5 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -901,7 +901,7 @@ static int ixgbe_get_eeprom(struct net_device *netdev,
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
         eeprom_len = last_word - first_word + 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) * eeprom_len, GFP_KERNEL);
+        eeprom_buff = kmalloc_array(eeprom_len, sizeof(u16), GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
@@ -1063,7 +1063,7 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
         /* allocate temporary buffer to store rings in */
         i = max_t(int, adapter->num_tx_queues + adapter->num_xdp_queues,
                   adapter->num_rx_queues);
-        temp_ring = vmalloc(i * sizeof(struct ixgbe_ring));
+        temp_ring = vmalloc(array_size(i, sizeof(struct ixgbe_ring)));
 
         if (!temp_ring) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 4929f7265598..0b1ba3ae159c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6034,8 +6034,8 @@ static int ixgbe_sw_init(struct ixgbe_adapter *adapter,
         for (i = 1; i < IXGBE_MAX_LINK_HANDLE; i++)
                 adapter->jump_tables[i] = NULL;
 
-        adapter->mac_table = kzalloc(sizeof(struct ixgbe_mac_addr) *
-                                     hw->mac.num_rar_entries,
+        adapter->mac_table = kcalloc(hw->mac.num_rar_entries,
+                                     sizeof(struct ixgbe_mac_addr),
                                      GFP_ATOMIC);
         if (!adapter->mac_table)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/intel/ixgbevf/ethtool.c b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
index e7813d76527c..631c91046f39 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
@@ -282,8 +282,9 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
         }
 
         if (new_tx_count != adapter->tx_ring_count) {
-                tx_ring = vmalloc((adapter->num_tx_queues +
-                                   adapter->num_xdp_queues) * sizeof(*tx_ring));
+                tx_ring = vmalloc(array_size(sizeof(*tx_ring),
+                                             adapter->num_tx_queues +
+                                                adapter->num_xdp_queues));
                 if (!tx_ring) {
                         err = -ENOMEM;
                         goto clear_reset;
@@ -327,7 +328,8 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
         }
 
         if (new_rx_count != adapter->rx_ring_count) {
-                rx_ring = vmalloc(adapter->num_rx_queues * sizeof(*rx_ring));
+                rx_ring = vmalloc(array_size(sizeof(*rx_ring),
+                                             adapter->num_rx_queues));
                 if (!rx_ring) {
                         err = -ENOMEM;
                         goto clear_reset;
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 8a165842fa85..06ff185eb188 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -589,8 +589,9 @@ jme_setup_tx_resources(struct jme_adapter *jme)
         atomic_set(&txring->next_to_clean, 0);
         atomic_set(&txring->nr_free, jme->tx_ring_size);
 
-        txring->bufinf          = kzalloc(sizeof(struct jme_buffer_info) *
-                                        jme->tx_ring_size, GFP_ATOMIC);
+        txring->bufinf          = kcalloc(jme->tx_ring_size,
+                                                sizeof(struct jme_buffer_info),
+                                                GFP_ATOMIC);
         if (unlikely(!(txring->bufinf)))
                 goto err_free_txring;
 
@@ -838,8 +839,9 @@ jme_setup_rx_resources(struct jme_adapter *jme)
         rxring->next_to_use     = 0;
         atomic_set(&rxring->next_to_clean, 0);
 
-        rxring->bufinf          = kzalloc(sizeof(struct jme_buffer_info) *
-                                        jme->rx_ring_size, GFP_ATOMIC);
+        rxring->bufinf          = kcalloc(jme->rx_ring_size,
+                                                sizeof(struct jme_buffer_info),
+                                                GFP_ATOMIC);
         if (unlikely(!(rxring->bufinf)))
                 goto err_free_rxring;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
index 6dabd983e7e0..4bdf25059542 100644
--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
+++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
@@ -185,8 +185,8 @@ int mlx4_bitmap_init(struct mlx4_bitmap *bitmap, u32 num, u32 mask,
         bitmap->avail = num - reserved_top - reserved_bot;
         bitmap->effective_len = bitmap->avail;
         spin_lock_init(&bitmap->lock);
-        bitmap->table = kzalloc(BITS_TO_LONGS(bitmap->max) *
-                                sizeof(long), GFP_KERNEL);
+        bitmap->table = kcalloc(BITS_TO_LONGS(bitmap->max), sizeof(long),
+                                GFP_KERNEL);
         if (!bitmap->table)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index 6a9086dc1e92..e65bc3c95630 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2377,20 +2377,23 @@ int mlx4_multi_func_init(struct mlx4_dev *dev)
                 struct mlx4_vf_admin_state *vf_admin;
 
                 priv->mfunc.master.slave_state =
-                        kzalloc(dev->num_slaves *
-                                sizeof(struct mlx4_slave_state), GFP_KERNEL);
+                        kcalloc(dev->num_slaves,
+                                sizeof(struct mlx4_slave_state),
+                                GFP_KERNEL);
                 if (!priv->mfunc.master.slave_state)
                         goto err_comm;
 
                 priv->mfunc.master.vf_admin =
-                        kzalloc(dev->num_slaves *
-                                sizeof(struct mlx4_vf_admin_state), GFP_KERNEL);
+                        kcalloc(dev->num_slaves,
+                                sizeof(struct mlx4_vf_admin_state),
+                                GFP_KERNEL);
                 if (!priv->mfunc.master.vf_admin)
                         goto err_comm_admin;
 
                 priv->mfunc.master.vf_oper =
-                        kzalloc(dev->num_slaves *
-                                sizeof(struct mlx4_vf_oper_state), GFP_KERNEL);
+                        kcalloc(dev->num_slaves,
+                                sizeof(struct mlx4_vf_oper_state),
+                                GFP_KERNEL);
                 if (!priv->mfunc.master.vf_oper)
                         goto err_comm_oper;
 
@@ -2636,9 +2639,9 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
         int i;
         int err = 0;
 
-        priv->cmd.context = kmalloc(priv->cmd.max_cmds *
-                                   sizeof(struct mlx4_cmd_context),
-                                   GFP_KERNEL);
+        priv->cmd.context = kmalloc_array(priv->cmd.max_cmds,
+                                          sizeof(struct mlx4_cmd_context),
+                                          GFP_KERNEL);
         if (!priv->cmd.context)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 9670b33fc9b1..65eb06e017e4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2229,13 +2229,15 @@ static int mlx4_en_copy_priv(struct mlx4_en_priv *dst,
                 if (!dst->tx_ring_num[t])
                         continue;
 
-                dst->tx_ring[t] = kzalloc(sizeof(struct mlx4_en_tx_ring *) *
-                                          MAX_TX_RINGS, GFP_KERNEL);
+                dst->tx_ring[t] = kcalloc(MAX_TX_RINGS,
+                                          sizeof(struct mlx4_en_tx_ring *),
+                                          GFP_KERNEL);
                 if (!dst->tx_ring[t])
                         goto err_free_tx;
 
-                dst->tx_cq[t] = kzalloc(sizeof(struct mlx4_en_cq *) *
-                                        MAX_TX_RINGS, GFP_KERNEL);
+                dst->tx_cq[t] = kcalloc(MAX_TX_RINGS,
+                                        sizeof(struct mlx4_en_cq *),
+                                        GFP_KERNEL);
                 if (!dst->tx_cq[t]) {
                         kfree(dst->tx_ring[t]);
                         goto err_free_tx;
@@ -3320,14 +3322,16 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                 if (!priv->tx_ring_num[t])
                         continue;
 
-                priv->tx_ring[t] = kzalloc(sizeof(struct mlx4_en_tx_ring *) *
-                                           MAX_TX_RINGS, GFP_KERNEL);
+                priv->tx_ring[t] = kcalloc(MAX_TX_RINGS,
+                                           sizeof(struct mlx4_en_tx_ring *),
+                                           GFP_KERNEL);
                 if (!priv->tx_ring[t]) {
                         err = -ENOMEM;
                         goto out;
                 }
-                priv->tx_cq[t] = kzalloc(sizeof(struct mlx4_en_cq *) *
-                                         MAX_TX_RINGS, GFP_KERNEL);
+                priv->tx_cq[t] = kcalloc(MAX_TX_RINGS,
+                                         sizeof(struct mlx4_en_cq *),
+                                         GFP_KERNEL);
                 if (!priv->tx_cq[t]) {
                         err = -ENOMEM;
                         goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 6f57c052053e..1f3372c1802e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1211,8 +1211,9 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
         }
 
         priv->eq_table.irq_names =
-                kmalloc(MLX4_IRQNAME_SIZE * (dev->caps.num_comp_vectors + 1),
-                        GFP_KERNEL);
+                kmalloc_array(MLX4_IRQNAME_SIZE,
+                              (dev->caps.num_comp_vectors + 1),
+                              GFP_KERNEL);
         if (!priv->eq_table.irq_names) {
                 err = -ENOMEM;
                 goto err_out_clr_int;
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
index 5342bd8a3d0b..7262c6310650 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
@@ -408,7 +408,7 @@ int mlx4_init_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table,
                 return -EINVAL;
         num_icm = (nobj + obj_per_chunk - 1) / obj_per_chunk;
 
-        table->icm      = kvzalloc(num_icm * sizeof(*table->icm), GFP_KERNEL);
+        table->icm      = kvcalloc(num_icm, sizeof(*table->icm), GFP_KERNEL);
         if (!table->icm)
                 return -ENOMEM;
         table->virt     = virt;
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 0a30d81aab3b..872014702fc1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2982,7 +2982,8 @@ static int mlx4_init_steering(struct mlx4_dev *dev)
         int num_entries = dev->caps.num_ports;
         int i, j;
 
-        priv->steer = kzalloc(sizeof(struct mlx4_steer) * num_entries, GFP_KERNEL);
+        priv->steer = kcalloc(num_entries, sizeof(struct mlx4_steer),
+                              GFP_KERNEL);
         if (!priv->steer)
                 return -ENOMEM;
 
@@ -3103,7 +3104,7 @@ static u64 mlx4_enable_sriov(struct mlx4_dev *dev, struct pci_dev *pdev,
                 }
         }
 
-        dev->dev_vfs = kzalloc(total_vfs * sizeof(*dev->dev_vfs), GFP_KERNEL);
+        dev->dev_vfs = kcalloc(total_vfs, sizeof(*dev->dev_vfs), GFP_KERNEL);
         if (NULL == dev->dev_vfs) {
                 mlx4_err(dev, "Failed to allocate memory for VFs\n");
                 goto disable_sriov;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 29e50f787349..7b1b5ac986d0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -487,7 +487,7 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
         int max_vfs_guarantee_counter = get_max_gauranteed_vfs_counter(dev);
 
         priv->mfunc.master.res_tracker.slave_list =
-                kzalloc(dev->num_slaves * sizeof(struct slave_list),
+                kcalloc(dev->num_slaves, sizeof(struct slave_list),
                         GFP_KERNEL);
         if (!priv->mfunc.master.res_tracker.slave_list)
                 return -ENOMEM;
@@ -507,19 +507,21 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
         for (i = 0; i < MLX4_NUM_OF_RESOURCE_TYPE; i++) {
                 struct resource_allocator *res_alloc =
                         &priv->mfunc.master.res_tracker.res_alloc[i];
-                res_alloc->quota = kmalloc((dev->persist->num_vfs + 1) *
-                                           sizeof(int), GFP_KERNEL);
-                res_alloc->guaranteed = kmalloc((dev->persist->num_vfs + 1) *
-                                                sizeof(int), GFP_KERNEL);
+                res_alloc->quota = kmalloc_array(dev->persist->num_vfs + 1,
+                                                 sizeof(int),
+                                                 GFP_KERNEL);
+                res_alloc->guaranteed = kmalloc_array(dev->persist->num_vfs + 1,
+                                                      sizeof(int),
+                                                      GFP_KERNEL);
                 if (i == RES_MAC || i == RES_VLAN)
-                        res_alloc->allocated = kzalloc(MLX4_MAX_PORTS *
-                                                       (dev->persist->num_vfs
-                                                       + 1) *
-                                                       sizeof(int), GFP_KERNEL);
+                        res_alloc->allocated =
+                                kcalloc(MLX4_MAX_PORTS *
+                                                (dev->persist->num_vfs + 1),
+                                        sizeof(int), GFP_KERNEL);
                 else
-                        res_alloc->allocated = kzalloc((dev->persist->
-                                                        num_vfs + 1) *
-                                                       sizeof(int), GFP_KERNEL);
+                        res_alloc->allocated =
+                                kcalloc(dev->persist->num_vfs + 1,
+                                        sizeof(int), GFP_KERNEL);
                 /* Reduce the sink counter */
                 if (i == RES_COUNTER)
                         res_alloc->res_free = dev->caps.max_counters - 1;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 89c96a0f708e..56c1b6f5593e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -352,7 +352,7 @@ static int mlx5e_rq_alloc_mpwqe_info(struct mlx5e_rq *rq,
 {
         int wq_sz = mlx5_wq_ll_get_size(&rq->mpwqe.wq);
 
-        rq->mpwqe.info = kzalloc_node(wq_sz * sizeof(*rq->mpwqe.info),
+        rq->mpwqe.info = kcalloc_node(wq_sz, sizeof(*rq->mpwqe.info),
                                       GFP_KERNEL, cpu_to_node(c->cpu));
         if (!rq->mpwqe.info)
                 return -ENOMEM;
@@ -448,7 +448,7 @@ static int mlx5e_init_di_list(struct mlx5e_rq *rq,
 {
         int len = wq_sz << rq->wqe.info.log_num_frags;
 
-        rq->wqe.di = kvzalloc_node(len * sizeof(*rq->wqe.di),
+        rq->wqe.di = kvzalloc_node(array_size(len, sizeof(*rq->wqe.di)),
                                    GFP_KERNEL, cpu_to_node(cpu));
         if (!rq->wqe.di)
                 return -ENOMEM;
@@ -563,8 +563,8 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
 
                 rq->wqe.info = rqp->frags_info;
                 rq->wqe.frags =
-                        kvzalloc_node((wq_sz << rq->wqe.info.log_num_frags) *
-                                      sizeof(*rq->wqe.frags),
+                        kvzalloc_node(array_size(sizeof(*rq->wqe.frags),
+                                        (wq_sz << rq->wqe.info.log_num_frags)),
                                       GFP_KERNEL, cpu_to_node(c->cpu));
                 if (!rq->wqe.frags) {
                         err = -ENOMEM;
@@ -972,7 +972,7 @@ static int mlx5e_alloc_xdpsq_db(struct mlx5e_xdpsq *sq, int numa)
 {
         int wq_sz = mlx5_wq_cyc_get_size(&sq->wq);
 
-        sq->db.di = kzalloc_node(sizeof(*sq->db.di) * wq_sz,
+        sq->db.di = kcalloc_node(wq_sz, sizeof(*sq->db.di),
                                      GFP_KERNEL, numa);
         if (!sq->db.di) {
                 mlx5e_free_xdpsq_db(sq);
@@ -1031,7 +1031,7 @@ static int mlx5e_alloc_icosq_db(struct mlx5e_icosq *sq, int numa)
 {
         u8 wq_sz = mlx5_wq_cyc_get_size(&sq->wq);
 
-        sq->db.ico_wqe = kzalloc_node(sizeof(*sq->db.ico_wqe) * wq_sz,
+        sq->db.ico_wqe = kcalloc_node(wq_sz, sizeof(*sq->db.ico_wqe),
                                       GFP_KERNEL, numa);
         if (!sq->db.ico_wqe)
                 return -ENOMEM;
@@ -1086,9 +1086,9 @@ static int mlx5e_alloc_txqsq_db(struct mlx5e_txqsq *sq, int numa)
         int wq_sz = mlx5_wq_cyc_get_size(&sq->wq);
         int df_sz = wq_sz * MLX5_SEND_WQEBB_NUM_DS;
 
-        sq->db.dma_fifo = kzalloc_node(df_sz * sizeof(*sq->db.dma_fifo),
+        sq->db.dma_fifo = kcalloc_node(df_sz, sizeof(*sq->db.dma_fifo),
                                            GFP_KERNEL, numa);
-        sq->db.wqe_info = kzalloc_node(wq_sz * sizeof(*sq->db.wqe_info),
+        sq->db.wqe_info = kcalloc_node(wq_sz, sizeof(*sq->db.wqe_info),
                                            GFP_KERNEL, numa);
         if (!sq->db.dma_fifo || !sq->db.wqe_info) {
                 mlx5e_free_txqsq_db(sq);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
index 4138a770ed57..8ca1d1949d93 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
@@ -549,15 +549,17 @@ static int mlx5_fpga_conn_create_qp(struct mlx5_fpga_conn *conn,
         if (err)
                 goto out;
 
-        conn->qp.rq.bufs = kvzalloc(sizeof(conn->qp.rq.bufs[0]) *
-                                    conn->qp.rq.size, GFP_KERNEL);
+        conn->qp.rq.bufs = kvcalloc(conn->qp.rq.size,
+                                    sizeof(conn->qp.rq.bufs[0]),
+                                    GFP_KERNEL);
         if (!conn->qp.rq.bufs) {
                 err = -ENOMEM;
                 goto err_wq;
         }
 
-        conn->qp.sq.bufs = kvzalloc(sizeof(conn->qp.sq.bufs[0]) *
-                                    conn->qp.sq.size, GFP_KERNEL);
+        conn->qp.sq.bufs = kvcalloc(conn->qp.sq.size,
+                                    sizeof(conn->qp.sq.bufs[0]),
+                                    GFP_KERNEL);
         if (!conn->qp.sq.bufs) {
                 err = -ENOMEM;
                 goto err_rq_bufs;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
index a0433b48e833..5645a4facad2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
@@ -381,7 +381,7 @@ int mlx5_fpga_ipsec_counters_read(struct mlx5_core_dev *mdev, u64 *counters,
 
         count = mlx5_fpga_ipsec_counters_count(mdev);
 
-        data = kzalloc(sizeof(*data) * count * 2, GFP_KERNEL);
+        data = kzalloc(array3_size(sizeof(*data), count, 2), GFP_KERNEL);
         if (!data) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index 857035583ccd..1e062e6b2587 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -394,8 +394,9 @@ static int mlx5_init_pin_config(struct mlx5_clock *clock)
         int i;
 
         clock->ptp_info.pin_config =
-                        kzalloc(sizeof(*clock->ptp_info.pin_config) *
-                                clock->ptp_info.n_pins, GFP_KERNEL);
+                        kcalloc(clock->ptp_info.n_pins,
+                                sizeof(*clock->ptp_info.pin_config),
+                                GFP_KERNEL);
         if (!clock->ptp_info.pin_config)
                 return -ENOMEM;
         clock->ptp_info.enable = mlx5_ptp_enable;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
index 91262b0573e3..cad603c35271 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
@@ -740,7 +740,8 @@ int mlxsw_sp_tc_qdisc_init(struct mlxsw_sp_port *mlxsw_sp_port)
         mlxsw_sp_port->root_qdisc->prio_bitmap = 0xff;
         mlxsw_sp_port->root_qdisc->tclass_num = MLXSW_SP_PORT_DEFAULT_TCLASS;
 
-        mlxsw_sp_qdisc = kzalloc(sizeof(*mlxsw_sp_qdisc) * IEEE_8021QAZ_MAX_TCS,
+        mlxsw_sp_qdisc = kcalloc(IEEE_8021QAZ_MAX_TCS,
+                                 sizeof(*mlxsw_sp_qdisc),
                                  GFP_KERNEL);
         if (!mlxsw_sp_qdisc)
                 goto err_tclass_qdiscs_init;
diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
index 52207508744c..b72d1bd11296 100644
--- a/drivers/net/ethernet/micrel/ksz884x.c
+++ b/drivers/net/ethernet/micrel/ksz884x.c
@@ -4372,7 +4372,7 @@ static void ksz_update_timer(struct ksz_timer_info *info)
  */
 static int ksz_alloc_soft_desc(struct ksz_desc_info *desc_info, int transmit)
 {
-        desc_info->ring = kzalloc(sizeof(struct ksz_desc) * desc_info->alloc,
+        desc_info->ring = kcalloc(desc_info->alloc, sizeof(struct ksz_desc),
                                   GFP_KERNEL);
         if (!desc_info->ring)
                 return 1;
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 2e4effa9fe45..b34055ac476f 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -507,15 +507,15 @@ static int moxart_mac_probe(struct platform_device *pdev)
                 goto init_fail;
         }
 
-        priv->tx_buf_base = kmalloc(priv->tx_buf_size * TX_DESC_NUM,
-                                    GFP_ATOMIC);
+        priv->tx_buf_base = kmalloc_array(priv->tx_buf_size, TX_DESC_NUM,
+                                          GFP_ATOMIC);
         if (!priv->tx_buf_base) {
                 ret = -ENOMEM;
                 goto init_fail;
         }
 
-        priv->rx_buf_base = kmalloc(priv->rx_buf_size * RX_DESC_NUM,
-                                    GFP_ATOMIC);
+        priv->rx_buf_base = kmalloc_array(priv->rx_buf_size, RX_DESC_NUM,
+                                          GFP_ATOMIC);
         if (!priv->rx_buf_base) {
                 ret = -ENOMEM;
                 goto init_fail;
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
index c60da9e8bf14..358ed6118881 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
@@ -2220,22 +2220,22 @@ __vxge_hw_channel_allocate(struct __vxge_hw_vpath_handle *vph,
         channel->length = length;
         channel->vp_id = vp_id;
 
-        channel->work_arr = kzalloc(sizeof(void *)*length, GFP_KERNEL);
+        channel->work_arr = kcalloc(length, sizeof(void *), GFP_KERNEL);
         if (channel->work_arr == NULL)
                 goto exit1;
 
-        channel->free_arr = kzalloc(sizeof(void *)*length, GFP_KERNEL);
+        channel->free_arr = kcalloc(length, sizeof(void *), GFP_KERNEL);
         if (channel->free_arr == NULL)
                 goto exit1;
         channel->free_ptr = length;
 
-        channel->reserve_arr = kzalloc(sizeof(void *)*length, GFP_KERNEL);
+        channel->reserve_arr = kcalloc(length, sizeof(void *), GFP_KERNEL);
         if (channel->reserve_arr == NULL)
                 goto exit1;
         channel->reserve_ptr = length;
         channel->reserve_top = 0;
 
-        channel->orig_arr = kzalloc(sizeof(void *)*length, GFP_KERNEL);
+        channel->orig_arr = kcalloc(length, sizeof(void *), GFP_KERNEL);
         if (channel->orig_arr == NULL)
                 goto exit1;
 
@@ -2565,7 +2565,7 @@ __vxge_hw_mempool_grow(struct vxge_hw_mempool *mempool, u32 num_allocate,
                  * allocate new memblock and its private part at once.
                  * This helps to minimize memory usage a lot. */
                 mempool->memblocks_priv_arr[i] =
-                                vzalloc(mempool->items_priv_size * n_items);
+                        vzalloc(array_size(mempool->items_priv_size, n_items));
                 if (mempool->memblocks_priv_arr[i] == NULL) {
                         status = VXGE_HW_ERR_OUT_OF_MEMORY;
                         goto exit;
@@ -2665,7 +2665,7 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
 
         /* allocate array of memblocks */
         mempool->memblocks_arr =
-                vzalloc(sizeof(void *) * mempool->memblocks_max);
+                vzalloc(array_size(sizeof(void *), mempool->memblocks_max));
         if (mempool->memblocks_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
@@ -2675,7 +2675,7 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
 
         /* allocate array of private parts of items per memblocks */
         mempool->memblocks_priv_arr =
-                vzalloc(sizeof(void *) * mempool->memblocks_max);
+                vzalloc(array_size(sizeof(void *), mempool->memblocks_max));
         if (mempool->memblocks_priv_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
@@ -2685,8 +2685,8 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
 
         /* allocate array of memblocks DMA objects */
         mempool->memblocks_dma_arr =
-                vzalloc(sizeof(struct vxge_hw_mempool_dma) *
-                        mempool->memblocks_max);
+                vzalloc(array_size(sizeof(struct vxge_hw_mempool_dma),
+                                   mempool->memblocks_max));
         if (mempool->memblocks_dma_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
@@ -2695,7 +2695,8 @@ __vxge_hw_mempool_create(struct __vxge_hw_device *devh,
         }
 
         /* allocate hash array of items */
-        mempool->items_arr = vzalloc(sizeof(void *) * mempool->items_max);
+        mempool->items_arr = vzalloc(array_size(sizeof(void *),
+                                                mempool->items_max));
         if (mempool->items_arr == NULL) {
                 __vxge_hw_mempool_destroy(mempool);
                 status = VXGE_HW_ERR_OUT_OF_MEMORY;
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c
index a8918bb7c802..5ae3fa82909f 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c
@@ -3429,8 +3429,8 @@ static int vxge_device_register(struct __vxge_hw_device *hldev,
         vxge_initialize_ethtool_ops(ndev);
 
         /* Allocate memory for vpath */
-        vdev->vpaths = kzalloc((sizeof(struct vxge_vpath)) *
-                                no_of_vpath, GFP_KERNEL);
+        vdev->vpaths = kcalloc(no_of_vpath, sizeof(struct vxge_vpath),
+                               GFP_KERNEL);
         if (!vdev->vpaths) {
                 vxge_debug_init(VXGE_ERR,
                         "%s: vpath memory allocation failed",
diff --git a/drivers/net/ethernet/netronome/nfp/abm/main.c b/drivers/net/ethernet/netronome/nfp/abm/main.c
index 1561c2724c26..b84a6c2d387b 100644
--- a/drivers/net/ethernet/netronome/nfp/abm/main.c
+++ b/drivers/net/ethernet/netronome/nfp/abm/main.c
@@ -590,7 +590,7 @@ nfp_abm_vnic_alloc(struct nfp_app *app, struct nfp_net *nn, unsigned int id)
         alink->id = id;
         alink->parent = TC_H_ROOT;
         alink->total_queues = alink->vnic->max_rx_rings;
-        alink->qdiscs = kvzalloc(sizeof(*alink->qdiscs) * alink->total_queues,
+        alink->qdiscs = kvcalloc(alink->total_queues, sizeof(*alink->qdiscs),
                                  GFP_KERNEL);
         if (!alink->qdiscs) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
index 21668aa435e8..93fb809f50d1 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
@@ -417,7 +417,8 @@ int nfp_flower_metadata_init(struct nfp_app *app)
 
         /* Init ring buffer and unallocated stats_ids. */
         priv->stats_ids.free_list.buf =
-                vmalloc(NFP_FL_STATS_ENTRY_RS * NFP_FL_STATS_ELEM_RS);
+                vmalloc(array_size(NFP_FL_STATS_ELEM_RS,
+                                   NFP_FL_STATS_ENTRY_RS));
         if (!priv->stats_ids.free_list.buf)
                 goto err_free_last_used;
 
diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
index b092894dd128..09f674ec0f9e 100644
--- a/drivers/net/ethernet/ni/nixge.c
+++ b/drivers/net/ethernet/ni/nixge.c
@@ -247,9 +247,8 @@ static int nixge_hw_dma_bd_init(struct net_device *ndev)
         if (!priv->tx_bd_v)
                 goto out;
 
-        priv->tx_skb = devm_kzalloc(ndev->dev.parent,
-                                    sizeof(*priv->tx_skb) *
-                                    TX_BD_NUM,
+        priv->tx_skb = devm_kcalloc(ndev->dev.parent,
+                                    TX_BD_NUM, sizeof(*priv->tx_skb),
                                     GFP_KERNEL);
         if (!priv->tx_skb)
                 goto out;
diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
index 66c665d0b926..7cbd0174459c 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -4630,8 +4630,10 @@ static int nv_set_ringparam(struct net_device *dev, struct ethtool_ringparam* ri
                                                ring->tx_pending),
                                                &ring_addr, GFP_ATOMIC);
         }
-        rx_skbuff = kmalloc(sizeof(struct nv_skb_map) * ring->rx_pending, GFP_KERNEL);
-        tx_skbuff = kmalloc(sizeof(struct nv_skb_map) * ring->tx_pending, GFP_KERNEL);
+        rx_skbuff = kmalloc_array(ring->rx_pending, sizeof(struct nv_skb_map),
+                                  GFP_KERNEL);
+        tx_skbuff = kmalloc_array(ring->tx_pending, sizeof(struct nv_skb_map),
+                                  GFP_KERNEL);
         if (!rxtx_ring || !rx_skbuff || !tx_skbuff) {
                 /* fall back to old rings */
                 if (!nv_optimized(np)) {
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 7cd494611a74..34a1581eda95 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -2178,7 +2178,7 @@ static void pch_gbe_set_multi(struct net_device *netdev)
 
         if (mc_count >= PCH_GBE_MAR_ENTRIES)
                 return;
-        mta_list = kmalloc(mc_count * ETH_ALEN, GFP_ATOMIC);
+        mta_list = kmalloc_array(ETH_ALEN, mc_count, GFP_ATOMIC);
         if (!mta_list)
                 return;
 
diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index 07a2eb3781b1..8a31a02c9f47 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -390,8 +390,9 @@ static int pasemi_mac_setup_rx_resources(const struct net_device *dev)
         spin_lock_init(&ring->lock);
 
         ring->size = RX_RING_SIZE;
-        ring->ring_info = kzalloc(sizeof(struct pasemi_mac_buffer) *
-                                  RX_RING_SIZE, GFP_KERNEL);
+        ring->ring_info = kcalloc(RX_RING_SIZE,
+                                  sizeof(struct pasemi_mac_buffer),
+                                  GFP_KERNEL);
 
         if (!ring->ring_info)
                 goto out_ring_info;
@@ -473,8 +474,9 @@ pasemi_mac_setup_tx_resources(const struct net_device *dev)
         spin_lock_init(&ring->lock);
 
         ring->size = TX_RING_SIZE;
-        ring->ring_info = kzalloc(sizeof(struct pasemi_mac_buffer) *
-                                  TX_RING_SIZE, GFP_KERNEL);
+        ring->ring_info = kcalloc(TX_RING_SIZE,
+                                  sizeof(struct pasemi_mac_buffer),
+                                  GFP_KERNEL);
         if (!ring->ring_info)
                 goto out_ring_info;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index b9ec460dd996..a14e48489029 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -6617,7 +6617,8 @@ static enum dbg_status qed_mcp_trace_alloc_meta(struct qed_hwfn *p_hwfn,
 
         /* Read no. of modules and allocate memory for their pointers */
         meta->modules_num = qed_read_byte_from_buf(meta_buf_bytes, &offset);
-        meta->modules = kzalloc(meta->modules_num * sizeof(char *), GFP_KERNEL);
+        meta->modules = kcalloc(meta->modules_num, sizeof(char *),
+                                GFP_KERNEL);
         if (!meta->modules)
                 return DBG_STATUS_VIRT_MEM_ALLOC_FAILED;
 
@@ -6645,7 +6646,7 @@ static enum dbg_status qed_mcp_trace_alloc_meta(struct qed_hwfn *p_hwfn,
 
         /* Read number of formats and allocate memory for all formats */
         meta->formats_num = qed_read_dword_from_buf(meta_buf_bytes, &offset);
-        meta->formats = kzalloc(meta->formats_num *
+        meta->formats = kcalloc(meta->formats_num,
                                 sizeof(struct mcp_trace_format),
                                 GFP_KERNEL);
         if (!meta->formats)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index b285edc8d6a1..329781cda77f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -814,26 +814,26 @@ static int qed_alloc_qm_data(struct qed_hwfn *p_hwfn)
         if (rc)
                 goto alloc_err;
 
-        qm_info->qm_pq_params = kzalloc(sizeof(*qm_info->qm_pq_params) *
-                                        qed_init_qm_get_num_pqs(p_hwfn),
+        qm_info->qm_pq_params = kcalloc(qed_init_qm_get_num_pqs(p_hwfn),
+                                        sizeof(*qm_info->qm_pq_params),
                                         GFP_KERNEL);
         if (!qm_info->qm_pq_params)
                 goto alloc_err;
 
-        qm_info->qm_vport_params = kzalloc(sizeof(*qm_info->qm_vport_params) *
-                                           qed_init_qm_get_num_vports(p_hwfn),
+        qm_info->qm_vport_params = kcalloc(qed_init_qm_get_num_vports(p_hwfn),
+                                           sizeof(*qm_info->qm_vport_params),
                                            GFP_KERNEL);
         if (!qm_info->qm_vport_params)
                 goto alloc_err;
 
-        qm_info->qm_port_params = kzalloc(sizeof(*qm_info->qm_port_params) *
-                                          p_hwfn->cdev->num_ports_in_engine,
+        qm_info->qm_port_params = kcalloc(p_hwfn->cdev->num_ports_in_engine,
+                                          sizeof(*qm_info->qm_port_params),
                                           GFP_KERNEL);
         if (!qm_info->qm_port_params)
                 goto alloc_err;
 
-        qm_info->wfq_data = kzalloc(sizeof(*qm_info->wfq_data) *
-                                    qed_init_qm_get_num_vports(p_hwfn),
+        qm_info->wfq_data = kcalloc(qed_init_qm_get_num_vports(p_hwfn),
+                                    sizeof(*qm_info->wfq_data),
                                     GFP_KERNEL);
         if (!qm_info->wfq_data)
                 goto alloc_err;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_init_ops.c b/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
index 3bb76da6baa2..d9ab5add27a8 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
@@ -149,12 +149,12 @@ int qed_init_alloc(struct qed_hwfn *p_hwfn)
         if (IS_VF(p_hwfn->cdev))
                 return 0;
 
-        rt_data->b_valid = kzalloc(sizeof(bool) * RUNTIME_ARRAY_SIZE,
+        rt_data->b_valid = kcalloc(RUNTIME_ARRAY_SIZE, sizeof(bool),
                                    GFP_KERNEL);
         if (!rt_data->b_valid)
                 return -ENOMEM;
 
-        rt_data->init_val = kzalloc(sizeof(u32) * RUNTIME_ARRAY_SIZE,
+        rt_data->init_val = kcalloc(RUNTIME_ARRAY_SIZE, sizeof(u32),
                                     GFP_KERNEL);
         if (!rt_data->init_val) {
                 kfree(rt_data->b_valid);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 1f6ac848109d..99973e10b179 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -98,7 +98,7 @@ int qed_l2_alloc(struct qed_hwfn *p_hwfn)
                 p_l2_info->queues = max_t(u8, rx, tx);
         }
 
-        pp_qids = kzalloc(sizeof(unsigned long *) * p_l2_info->queues,
+        pp_qids = kcalloc(p_l2_info->queues, sizeof(unsigned long *),
                           GFP_KERNEL);
         if (!pp_qids)
                 return -ENOMEM;
@@ -2435,7 +2435,7 @@ static int qed_update_vport(struct qed_dev *cdev,
         if (!cdev)
                 return -ENODEV;
 
-        rss = vzalloc(sizeof(*rss) * cdev->num_hwfns);
+        rss = vzalloc(array_size(sizeof(*rss), cdev->num_hwfns));
         if (!rss)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index 6f9927d1a501..4e0b443c9519 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -2578,9 +2578,9 @@ int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
                 goto err0;
         }
 
-        nvm_info->image_att = kmalloc(nvm_info->num_images *
-                                      sizeof(struct bist_nvm_image_att),
-                                      GFP_KERNEL);
+        nvm_info->image_att = kmalloc_array(nvm_info->num_images,
+                                            sizeof(struct bist_nvm_image_att),
+                                            GFP_KERNEL);
         if (!nvm_info->image_att) {
                 rc = -ENOMEM;
                 goto err0;
diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c
index e9e088d9c815..b823bfe2ea4d 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c
@@ -342,8 +342,9 @@ int qede_alloc_arfs(struct qede_dev *edev)
         for (i = 0; i <= QEDE_RFS_FLW_MASK; i++)
                 INIT_HLIST_HEAD(QEDE_ARFS_BUCKET_HEAD(edev, i));
 
-        edev->arfs->arfs_fltr_bmap = vzalloc(BITS_TO_LONGS(QEDE_RFS_MAX_FLTR) *
-                                             sizeof(long));
+        edev->arfs->arfs_fltr_bmap =
+                vzalloc(array_size(sizeof(long),
+                                   BITS_TO_LONGS(QEDE_RFS_MAX_FLTR)));
         if (!edev->arfs->arfs_fltr_bmap) {
                 vfree(edev->arfs);
                 edev->arfs = NULL;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 97c146e7698a..569d54ededec 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -386,8 +386,9 @@ int qlcnic_83xx_setup_intr(struct qlcnic_adapter *adapter)
         }
 
         /* setup interrupt mapping table for fw */
-        ahw->intr_tbl = vzalloc(num_msix *
-                                sizeof(struct qlcnic_intrpt_config));
+        ahw->intr_tbl =
+                vzalloc(array_size(num_msix,
+                                   sizeof(struct qlcnic_intrpt_config)));
         if (!ahw->intr_tbl)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 1b5f7d57b6f8..2d38d1ac2aae 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -916,8 +916,9 @@ int qlcnic_82xx_mq_intrpt(struct qlcnic_adapter *adapter, int op_type)
         if (qlcnic_check_multi_tx(adapter) &&
             !ahw->diag_test &&
             (adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                ahw->intr_tbl = vzalloc(ahw->num_msix *
-                                        sizeof(struct qlcnic_intrpt_config));
+                ahw->intr_tbl =
+                        vzalloc(array_size(sizeof(struct qlcnic_intrpt_config),
+                                           ahw->num_msix));
                 if (!ahw->intr_tbl)
                         return -ENOMEM;
 
@@ -1025,15 +1026,17 @@ int qlcnic_init_pci_info(struct qlcnic_adapter *adapter)
 
         act_pci_func = ahw->total_nic_func;
 
-        adapter->npars = kzalloc(sizeof(struct qlcnic_npar_info) *
-                                 act_pci_func, GFP_KERNEL);
+        adapter->npars = kcalloc(act_pci_func,
+                                 sizeof(struct qlcnic_npar_info),
+                                 GFP_KERNEL);
         if (!adapter->npars) {
                 ret = -ENOMEM;
                 goto err_pci_info;
         }
 
-        adapter->eswitch = kzalloc(sizeof(struct qlcnic_eswitch) *
-                                QLCNIC_NIU_MAX_XG_PORTS, GFP_KERNEL);
+        adapter->eswitch = kcalloc(QLCNIC_NIU_MAX_XG_PORTS,
+                                   sizeof(struct qlcnic_eswitch),
+                                   GFP_KERNEL);
         if (!adapter->eswitch) {
                 ret = -ENOMEM;
                 goto err_npars;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index c58180f40844..0c744b9c6e0a 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -157,8 +157,8 @@ int qlcnic_sriov_init(struct qlcnic_adapter *adapter, int num_vfs)
         adapter->ahw->sriov = sriov;
         sriov->num_vfs = num_vfs;
         bc = &sriov->bc;
-        sriov->vf_info = kzalloc(sizeof(struct qlcnic_vf_info) *
-                                 num_vfs, GFP_KERNEL);
+        sriov->vf_info = kcalloc(num_vfs, sizeof(struct qlcnic_vf_info),
+                                 GFP_KERNEL);
         if (!sriov->vf_info) {
                 err = -ENOMEM;
                 goto qlcnic_free_sriov;
@@ -450,7 +450,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
                 return 0;
 
         num_vlans = sriov->num_allowed_vlans;
-        sriov->allowed_vlans = kzalloc(sizeof(u16) * num_vlans, GFP_KERNEL);
+        sriov->allowed_vlans = kcalloc(num_vlans, sizeof(u16), GFP_KERNEL);
         if (!sriov->allowed_vlans)
                 return -ENOMEM;
 
@@ -706,7 +706,7 @@ static inline int qlcnic_sriov_alloc_bc_trans(struct qlcnic_bc_trans **trans)
 static inline int qlcnic_sriov_alloc_bc_msg(struct qlcnic_bc_hdr **hdr,
                                             u32 size)
 {
-        *hdr = kzalloc(sizeof(struct qlcnic_bc_hdr) * size, GFP_ATOMIC);
+        *hdr = kcalloc(size, sizeof(struct qlcnic_bc_hdr), GFP_ATOMIC);
         if (!*hdr)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 70de062b72a1..353f1c129af1 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -2810,7 +2810,8 @@ static int ql_alloc_tx_resources(struct ql_adapter *qdev,
                 goto pci_alloc_err;
 
         tx_ring->q =
-            kmalloc(tx_ring->wq_len * sizeof(struct tx_ring_desc), GFP_KERNEL);
+            kmalloc_array(tx_ring->wq_len, sizeof(struct tx_ring_desc),
+                          GFP_KERNEL);
         if (tx_ring->q == NULL)
                 goto err;
 
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index d90a7b1f4088..23f0785c0573 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4984,7 +4984,8 @@ static int efx_ef10_filter_table_probe(struct efx_nic *efx)
                 net_dev->hw_features &= ~NETIF_F_HW_VLAN_CTAG_FILTER;
         }
 
-        table->entry = vzalloc(HUNT_FILTER_TBL_ROWS * sizeof(*table->entry));
+        table->entry = vzalloc(array_size(HUNT_FILTER_TBL_ROWS,
+                                          sizeof(*table->entry)));
         if (!table->entry) {
                 rc = -ENOMEM;
                 goto fail;
diff --git a/drivers/net/ethernet/sfc/falcon/farch.c b/drivers/net/ethernet/sfc/falcon/farch.c
index 494884f6af4a..411a2f419447 100644
--- a/drivers/net/ethernet/sfc/falcon/farch.c
+++ b/drivers/net/ethernet/sfc/falcon/farch.c
@@ -2755,7 +2755,8 @@ int ef4_farch_filter_table_probe(struct ef4_nic *efx)
                                              GFP_KERNEL);
                 if (!table->used_bitmap)
                         goto fail;
-                table->spec = vzalloc(table->size * sizeof(*table->spec));
+                table->spec = vzalloc(array_size(sizeof(*table->spec),
+                                                 table->size));
                 if (!table->spec)
                         goto fail;
         }
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index c72adf8b52ea..8edf20967c82 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -2826,7 +2826,8 @@ int efx_farch_filter_table_probe(struct efx_nic *efx)
                                              GFP_KERNEL);
                 if (!table->used_bitmap)
                         goto fail;
-                table->spec = vzalloc(table->size * sizeof(*table->spec));
+                table->spec = vzalloc(array_size(sizeof(*table->spec),
+                                                 table->size));
                 if (!table->spec)
                         goto fail;
         }
diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
index ce8071fc90c4..e080d3e7c582 100644
--- a/drivers/net/ethernet/socionext/netsec.c
+++ b/drivers/net/ethernet/socionext/netsec.c
@@ -973,7 +973,7 @@ static int netsec_alloc_dring(struct netsec_priv *priv, enum ring_id id)
                 goto err;
         }
 
-        dring->desc = kzalloc(DESC_NUM * sizeof(*dring->desc), GFP_KERNEL);
+        dring->desc = kcalloc(DESC_NUM, sizeof(*dring->desc), GFP_KERNEL);
         if (!dring->desc) {
                 ret = -ENOMEM;
                 goto err;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
index 881c94b73e2f..2258cd8cc844 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
@@ -277,8 +277,8 @@ static int tc_init(struct stmmac_priv *priv)
 
         /* Reserve one last filter which lets all pass */
         priv->tc_entries_max = count;
-        priv->tc_entries = devm_kzalloc(priv->device,
-                        sizeof(*priv->tc_entries) * count, GFP_KERNEL);
+        priv->tc_entries = devm_kcalloc(priv->device,
+                        count, sizeof(*priv->tc_entries), GFP_KERNEL);
         if (!priv->tc_entries)
                 return -ENOMEM;
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 534596ce00d3..358edab9e72e 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2740,8 +2740,9 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
         }
         data->active_slave = prop;
 
-        data->slave_data = devm_kzalloc(&pdev->dev, data->slaves
-                                        * sizeof(struct cpsw_slave_data),
+        data->slave_data = devm_kcalloc(&pdev->dev,
+                                        data->slaves,
+                                        sizeof(struct cpsw_slave_data),
                                         GFP_KERNEL);
         if (!data->slave_data)
                 return -ENOMEM;
@@ -3045,8 +3046,8 @@ static int cpsw_probe(struct platform_device *pdev)
 
         memcpy(ndev->dev_addr, priv->mac_addr, ETH_ALEN);
 
-        cpsw->slaves = devm_kzalloc(&pdev->dev,
-                                    sizeof(struct cpsw_slave) * data->slaves,
+        cpsw->slaves = devm_kcalloc(&pdev->dev,
+                                    data->slaves, sizeof(struct cpsw_slave),
                                     GFP_KERNEL);
         if (!cpsw->slaves) {
                 ret = -ENOMEM;
diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c
index 6e455a27a8de..72b98e27c992 100644
--- a/drivers/net/ethernet/ti/netcp_ethss.c
+++ b/drivers/net/ethernet/ti/netcp_ethss.c
@@ -3285,8 +3285,8 @@ static int set_xgbe_ethss10_priv(struct gbe_priv *gbe_dev,
         gbe_dev->et_stats = xgbe10_et_stats;
         gbe_dev->num_et_stats = ARRAY_SIZE(xgbe10_et_stats);
 
-        gbe_dev->hw_stats = devm_kzalloc(gbe_dev->dev,
-                                         gbe_dev->num_et_stats * sizeof(u64),
+        gbe_dev->hw_stats = devm_kcalloc(gbe_dev->dev,
+                                         gbe_dev->num_et_stats, sizeof(u64),
                                          GFP_KERNEL);
         if (!gbe_dev->hw_stats) {
                 dev_err(gbe_dev->dev, "hw_stats memory allocation failed\n");
@@ -3294,8 +3294,8 @@ static int set_xgbe_ethss10_priv(struct gbe_priv *gbe_dev,
         }
 
         gbe_dev->hw_stats_prev =
-                devm_kzalloc(gbe_dev->dev,
-                             gbe_dev->num_et_stats * sizeof(u32),
+                devm_kcalloc(gbe_dev->dev,
+                             gbe_dev->num_et_stats, sizeof(u32),
                              GFP_KERNEL);
         if (!gbe_dev->hw_stats_prev) {
                 dev_err(gbe_dev->dev,
@@ -3405,8 +3405,8 @@ static int set_gbe_ethss14_priv(struct gbe_priv *gbe_dev,
         gbe_dev->et_stats = gbe13_et_stats;
         gbe_dev->num_et_stats = ARRAY_SIZE(gbe13_et_stats);
 
-        gbe_dev->hw_stats = devm_kzalloc(gbe_dev->dev,
-                                         gbe_dev->num_et_stats * sizeof(u64),
+        gbe_dev->hw_stats = devm_kcalloc(gbe_dev->dev,
+                                         gbe_dev->num_et_stats, sizeof(u64),
                                          GFP_KERNEL);
         if (!gbe_dev->hw_stats) {
                 dev_err(gbe_dev->dev, "hw_stats memory allocation failed\n");
@@ -3414,8 +3414,8 @@ static int set_gbe_ethss14_priv(struct gbe_priv *gbe_dev,
         }
 
         gbe_dev->hw_stats_prev =
-                devm_kzalloc(gbe_dev->dev,
-                             gbe_dev->num_et_stats * sizeof(u32),
+                devm_kcalloc(gbe_dev->dev,
+                             gbe_dev->num_et_stats, sizeof(u32),
                              GFP_KERNEL);
         if (!gbe_dev->hw_stats_prev) {
                 dev_err(gbe_dev->dev,
@@ -3477,8 +3477,8 @@ static int set_gbenu_ethss_priv(struct gbe_priv *gbe_dev,
                 gbe_dev->num_et_stats = GBENU_ET_STATS_HOST_SIZE +
                                         GBENU_ET_STATS_PORT_SIZE;
 
-        gbe_dev->hw_stats = devm_kzalloc(gbe_dev->dev,
-                                         gbe_dev->num_et_stats * sizeof(u64),
+        gbe_dev->hw_stats = devm_kcalloc(gbe_dev->dev,
+                                         gbe_dev->num_et_stats, sizeof(u64),
                                          GFP_KERNEL);
         if (!gbe_dev->hw_stats) {
                 dev_err(gbe_dev->dev, "hw_stats memory allocation failed\n");
@@ -3486,8 +3486,8 @@ static int set_gbenu_ethss_priv(struct gbe_priv *gbe_dev,
         }
 
         gbe_dev->hw_stats_prev =
-                devm_kzalloc(gbe_dev->dev,
-                             gbe_dev->num_et_stats * sizeof(u32),
+                devm_kcalloc(gbe_dev->dev,
+                             gbe_dev->num_et_stats, sizeof(u32),
                              GFP_KERNEL);
         if (!gbe_dev->hw_stats_prev) {
                 dev_err(gbe_dev->dev,
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
index eed18f88bdff..302079e22b06 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
@@ -2320,8 +2320,9 @@ static struct net_device *gelic_wl_alloc(struct gelic_card *card)
         pr_debug("%s: wl=%p port=%p\n", __func__, wl, port);
 
         /* allocate scan list */
-        wl->networks = kzalloc(sizeof(struct gelic_wl_scan_info) *
-                               GELIC_WL_BSS_MAX_ENT, GFP_KERNEL);
+        wl->networks = kcalloc(GELIC_WL_BSS_MAX_ENT,
+                               sizeof(struct gelic_wl_scan_info),
+                               GFP_KERNEL);
 
         if (!wl->networks)
                 goto fail_bss;
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index f38e32a7ec9c..ec629a730005 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -742,11 +742,13 @@ static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize)
 {
         int i;
 
-        gtp->addr_hash = kmalloc(sizeof(struct hlist_head) * hsize, GFP_KERNEL);
+        gtp->addr_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
+                                       GFP_KERNEL);
         if (gtp->addr_hash == NULL)
                 return -ENOMEM;
 
-        gtp->tid_hash = kmalloc(sizeof(struct hlist_head) * hsize, GFP_KERNEL);
+        gtp->tid_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
+                                      GFP_KERNEL);
         if (gtp->tid_hash == NULL)
                 goto err1;
 
diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
index f41116488079..029206e4da3b 100644
--- a/drivers/net/hippi/rrunner.c
+++ b/drivers/net/hippi/rrunner.c
@@ -1583,7 +1583,7 @@ static int rr_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                         return -EPERM;
                 }
 
-                image = kmalloc(EEPROM_WORDS * sizeof(u32), GFP_KERNEL);
+                image = kmalloc_array(EEPROM_WORDS, sizeof(u32), GFP_KERNEL);
                 if (!image)
                         return -ENOMEM;
 
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index a6c87793d899..79e9b103188b 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -1097,8 +1097,9 @@ static struct dp83640_clock *dp83640_clock_get_bus(struct mii_bus *bus)
         if (!clock)
                 goto out;
 
-        clock->caps.pin_config = kzalloc(sizeof(struct ptp_pin_desc) *
-                                         DP83640_N_PINS, GFP_KERNEL);
+        clock->caps.pin_config = kcalloc(DP83640_N_PINS,
+                                         sizeof(struct ptp_pin_desc),
+                                         GFP_KERNEL);
         if (!clock->caps.pin_config) {
                 kfree(clock);
                 clock = NULL;
diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c
index 39ecad25b201..491efc1bf5c4 100644
--- a/drivers/net/phy/phy_led_triggers.c
+++ b/drivers/net/phy/phy_led_triggers.c
@@ -128,9 +128,9 @@ int phy_led_triggers_register(struct phy_device *phy)
         if (err)
                 goto out_free_link;
 
-        phy->phy_led_triggers = devm_kzalloc(&phy->mdio.dev,
-                                            sizeof(struct phy_led_trigger) *
-                                                   phy->phy_num_led_triggers,
+        phy->phy_led_triggers = devm_kcalloc(&phy->mdio.dev,
+                                            phy->phy_num_led_triggers,
+                                            sizeof(struct phy_led_trigger),
                                             GFP_KERNEL);
         if (!phy->phy_led_triggers) {
                 err = -ENOMEM;
diff --git a/drivers/net/ppp/bsd_comp.c b/drivers/net/ppp/bsd_comp.c
index a9b759add187..61fedb23d3cf 100644
--- a/drivers/net/ppp/bsd_comp.c
+++ b/drivers/net/ppp/bsd_comp.c
@@ -406,7 +406,7 @@ static void *bsd_alloc (unsigned char *options, int opt_len, int decomp)
  * Allocate space for the dictionary. This may be more than one page in
  * length.
  */
-    db->dict = vmalloc(hsize * sizeof(struct bsd_dict));
+    db->dict = vmalloc(array_size(hsize, sizeof(struct bsd_dict)));
     if (!db->dict)
       {
         bsd_free (db);
@@ -425,7 +425,7 @@ static void *bsd_alloc (unsigned char *options, int opt_len, int decomp)
  */
     else
       {
-        db->lens = vmalloc((maxmaxcode + 1) * sizeof(db->lens[0]));
+        db->lens = vmalloc(array_size(sizeof(db->lens[0]), (maxmaxcode + 1)));
         if (!db->lens)
           {
             bsd_free (db);
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 157b67c1bf8e..67ffe74747a1 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -648,7 +648,7 @@ static int __init pptp_init_module(void)
         int err = 0;
         pr_info("PPTP driver version " PPTP_DRIVER_VERSION "\n");
 
-        callid_sock = vzalloc((MAX_CALLID + 1) * sizeof(void *));
+        callid_sock = vzalloc(array_size(sizeof(void *), (MAX_CALLID + 1)));
         if (!callid_sock)
                 return -ENOMEM;
 
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index 8940417c30e5..b008266e91ea 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -1307,7 +1307,7 @@ static int __init slip_init(void)
         printk(KERN_INFO "SLIP linefill/keepalive option.\n");
 #endif
 
-        slip_devs = kzalloc(sizeof(struct net_device *)*slip_maxdev,
+        slip_devs = kcalloc(slip_maxdev, sizeof(struct net_device *),
                                                                 GFP_KERNEL);
         if (!slip_devs)
                 return -ENOMEM;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 8863fa023500..b070959737ff 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -280,7 +280,7 @@ static int __team_options_register(struct team *team,
         struct team_option **dst_opts;
         int err;
 
-        dst_opts = kzalloc(sizeof(struct team_option *) * option_count,
+        dst_opts = kcalloc(option_count, sizeof(struct team_option *),
                            GFP_KERNEL);
         if (!dst_opts)
                 return -ENOMEM;
@@ -791,7 +791,8 @@ static int team_queue_override_init(struct team *team)
 
         if (!queue_cnt)
                 return 0;
-        listarr = kmalloc(sizeof(struct list_head) * queue_cnt, GFP_KERNEL);
+        listarr = kmalloc_array(queue_cnt, sizeof(struct list_head),
+                                GFP_KERNEL);
         if (!listarr)
                 return -ENOMEM;
         team->qom_lists = listarr;
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index f4d7362eb325..e95dd12edec4 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -640,8 +640,8 @@ int asix_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
-                              GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
@@ -680,8 +680,8 @@ int asix_set_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
 
-        eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
-                              GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index a6ef75907ae9..9e8ad372f419 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -599,8 +599,8 @@ ax88179_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
 
         first_word = eeprom->offset >> 1;
         last_word = (eeprom->offset + eeprom->len - 1) >> 1;
-        eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
-                              GFP_KERNEL);
+        eeprom_buff = kmalloc_array(last_word - first_word + 1, sizeof(u16),
+                                    GFP_KERNEL);
         if (!eeprom_buff)
                 return -ENOMEM;
 
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 309b88acd3d0..06b4d290784d 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1661,7 +1661,7 @@ static int smsc95xx_suspend(struct usb_interface *intf, pm_message_t message)
         }
 
         if (pdata->wolopts & (WAKE_BCAST | WAKE_MCAST | WAKE_ARP | WAKE_UCAST)) {
-                u32 *filter_mask = kzalloc(sizeof(u32) * 32, GFP_KERNEL);
+                u32 *filter_mask = kcalloc(32, sizeof(u32), GFP_KERNEL);
                 u32 command[2];
                 u32 offset[2];
                 u32 crc[4];
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index d9eea8cfe6cb..770aa624147f 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1323,8 +1323,8 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb)
                 return 0;
 
         /* reserve one for zero packet */
-        urb->sg = kmalloc((num_sgs + 1) * sizeof(struct scatterlist),
-                          GFP_ATOMIC);
+        urb->sg = kmalloc_array(num_sgs + 1, sizeof(struct scatterlist),
+                                GFP_ATOMIC);
         if (!urb->sg)
                 return -ENOMEM;
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 1619ee3070b6..b6c9a2af3732 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2552,17 +2552,17 @@ static int virtnet_find_vqs(struct virtnet_info *vi)
                     virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ);
 
         /* Allocate space for find_vqs parameters */
-        vqs = kzalloc(total_vqs * sizeof(*vqs), GFP_KERNEL);
+        vqs = kcalloc(total_vqs, sizeof(*vqs), GFP_KERNEL);
         if (!vqs)
                 goto err_vq;
-        callbacks = kmalloc(total_vqs * sizeof(*callbacks), GFP_KERNEL);
+        callbacks = kmalloc_array(total_vqs, sizeof(*callbacks), GFP_KERNEL);
         if (!callbacks)
                 goto err_callback;
-        names = kmalloc(total_vqs * sizeof(*names), GFP_KERNEL);
+        names = kmalloc_array(total_vqs, sizeof(*names), GFP_KERNEL);
         if (!names)
                 goto err_names;
         if (!vi->big_packets || vi->mergeable_rx_bufs) {
-                ctx = kzalloc(total_vqs * sizeof(*ctx), GFP_KERNEL);
+                ctx = kcalloc(total_vqs, sizeof(*ctx), GFP_KERNEL);
                 if (!ctx)
                         goto err_ctx;
         } else {
@@ -2626,10 +2626,10 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
         vi->ctrl = kzalloc(sizeof(*vi->ctrl), GFP_KERNEL);
         if (!vi->ctrl)
                 goto err_ctrl;
-        vi->sq = kzalloc(sizeof(*vi->sq) * vi->max_queue_pairs, GFP_KERNEL);
+        vi->sq = kcalloc(vi->max_queue_pairs, sizeof(*vi->sq), GFP_KERNEL);
         if (!vi->sq)
                 goto err_sq;
-        vi->rq = kzalloc(sizeof(*vi->rq) * vi->max_queue_pairs, GFP_KERNEL);
+        vi->rq = kcalloc(vi->max_queue_pairs, sizeof(*vi->rq), GFP_KERNEL);
         if (!vi->rq)
                 goto err_rq;
 
diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 4205dfd19da3..9b09c9d0d0fb 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -198,12 +198,14 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
                 goto free_tx_bd;
         }
 
-        priv->rx_skbuff = kzalloc(priv->rx_ring_size * sizeof(*priv->rx_skbuff),
+        priv->rx_skbuff = kcalloc(priv->rx_ring_size,
+                                  sizeof(*priv->rx_skbuff),
                                   GFP_KERNEL);
         if (!priv->rx_skbuff)
                 goto free_ucc_pram;
 
-        priv->tx_skbuff = kzalloc(priv->tx_ring_size * sizeof(*priv->tx_skbuff),
+        priv->tx_skbuff = kcalloc(priv->tx_ring_size,
+                                  sizeof(*priv->tx_skbuff),
                                   GFP_KERNEL);
         if (!priv->tx_skbuff)
                 goto free_rx_skbuff;
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index bd23f6940488..c72d8af122a2 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -582,7 +582,7 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
         }
 
         htt->rx_ring.netbufs_ring =
-                kzalloc(htt->rx_ring.size * sizeof(struct sk_buff *),
+                kcalloc(htt->rx_ring.size, sizeof(struct sk_buff *),
                         GFP_KERNEL);
         if (!htt->rx_ring.netbufs_ring)
                 goto err_netbuf;
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
index 2e34a1fc5ba6..8c49a26fc571 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -155,7 +155,7 @@ ath10k_wmi_tlv_parse_alloc(struct ath10k *ar, const void *ptr,
         const void **tb;
         int ret;
 
-        tb = kzalloc(sizeof(*tb) * WMI_TLV_TAG_MAX, gfp);
+        tb = kcalloc(WMI_TLV_TAG_MAX, sizeof(*tb), gfp);
         if (!tb)
                 return ERR_PTR(-ENOMEM);
 
diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
index 3513bbec4639..e01faf641288 100644
--- a/drivers/net/wireless/ath/ath5k/debug.c
+++ b/drivers/net/wireless/ath/ath5k/debug.c
@@ -931,7 +931,7 @@ static int open_file_eeprom(struct inode *inode, struct file *file)
 
         /* Create buffer and read in eeprom */
 
-        buf = vmalloc(eesize * 2);
+        buf = vmalloc(array_size(eesize, 2));
         if (!buf) {
                 ret = -ENOMEM;
                 goto err;
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 641b13a279e1..b1b8bc326830 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -890,7 +890,8 @@ ath5k_hw_rfregs_init(struct ath5k_hw *ah,
          * ah->ah_rf_banks based on ah->ah_rf_banks_size
          * we set above */
         if (ah->ah_rf_banks == NULL) {
-                ah->ah_rf_banks = kmalloc(sizeof(u32) * ah->ah_rf_banks_size,
+                ah->ah_rf_banks = kmalloc_array(ah->ah_rf_banks_size,
+                                                                sizeof(u32),
                                                                 GFP_KERNEL);
                 if (ah->ah_rf_banks == NULL) {
                         ATH5K_ERR(ah, "out of memory\n");
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 2ba8cf3f38af..0687697d5e2d 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -1041,7 +1041,7 @@ static int ath6kl_cfg80211_scan(struct wiphy *wiphy,
 
                 n_channels = request->n_channels;
 
-                channels = kzalloc(n_channels * sizeof(u16), GFP_KERNEL);
+                channels = kcalloc(n_channels, sizeof(u16), GFP_KERNEL);
                 if (channels == NULL) {
                         ath6kl_warn("failed to set scan channels, scan all channels");
                         n_channels = 0;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 6343cc91953e..34e100940284 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -925,7 +925,7 @@ int ar9003_paprd_create_curve(struct ath_hw *ah,
 
         memset(caldata->pa_table[chain], 0, sizeof(caldata->pa_table[chain]));
 
-        buf = kmalloc(2 * 48 * sizeof(u32), GFP_KERNEL);
+        buf = kmalloc_array(2 * 48, sizeof(u32), GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 6b37036b2d36..e60bea4604e4 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -127,13 +127,13 @@ void ath9k_hw_read_array(struct ath_hw *ah, u32 array[][2], int size)
         u32 *tmp_reg_list, *tmp_data;
         int i;
 
-        tmp_reg_list = kmalloc(size * sizeof(u32), GFP_KERNEL);
+        tmp_reg_list = kmalloc_array(size, sizeof(u32), GFP_KERNEL);
         if (!tmp_reg_list) {
                 dev_err(ah->dev, "%s: tmp_reg_list: alloc filed\n", __func__);
                 return;
         }
 
-        tmp_data = kmalloc(size * sizeof(u32), GFP_KERNEL);
+        tmp_data = kmalloc_array(size, sizeof(u32), GFP_KERNEL);
         if (!tmp_data) {
                 dev_err(ah->dev, "%s tmp_data: alloc filed\n", __func__);
                 goto error_tmp_data;
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 29e93c953d93..7f1bdea742b8 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1958,7 +1958,7 @@ static int carl9170_parse_eeprom(struct ar9170 *ar)
         if (!bands)
                 return -EINVAL;
 
-        ar->survey = kzalloc(sizeof(struct survey_info) * chans, GFP_KERNEL);
+        ar->survey = kcalloc(chans, sizeof(struct survey_info), GFP_KERNEL);
         if (!ar->survey)
                 return -ENOMEM;
         ar->num_channels = chans;
@@ -1988,8 +1988,9 @@ int carl9170_register(struct ar9170 *ar)
         if (WARN_ON(ar->mem_bitmap))
                 return -EINVAL;
 
-        ar->mem_bitmap = kzalloc(roundup(ar->fw.mem_blocks, BITS_PER_LONG) *
-                                 sizeof(unsigned long), GFP_KERNEL);
+        ar->mem_bitmap = kcalloc(roundup(ar->fw.mem_blocks, BITS_PER_LONG),
+                                 sizeof(unsigned long),
+                                 GFP_KERNEL);
 
         if (!ar->mem_bitmap)
                 return -ENOMEM;
diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c
index f2a2f41e3c96..44ab080d6518 100644
--- a/drivers/net/wireless/broadcom/b43/phy_n.c
+++ b/drivers/net/wireless/broadcom/b43/phy_n.c
@@ -1518,7 +1518,7 @@ static int b43_nphy_load_samples(struct b43_wldev *dev,
         u16 i;
         u32 *data;
 
-        data = kzalloc(len * sizeof(u32), GFP_KERNEL);
+        data = kcalloc(len, sizeof(u32), GFP_KERNEL);
         if (!data) {
                 b43err(dev->wl, "allocation for samples loading failed\n");
                 return -ENOMEM;
diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c
index f1e3dad57629..55f411925960 100644
--- a/drivers/net/wireless/broadcom/b43legacy/main.c
+++ b/drivers/net/wireless/broadcom/b43legacy/main.c
@@ -3300,8 +3300,8 @@ static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev)
 
         if ((phy->type == B43legacy_PHYTYPE_B) ||
             (phy->type == B43legacy_PHYTYPE_G)) {
-                phy->_lo_pairs = kzalloc(sizeof(struct b43legacy_lopair)
-                                         * B43legacy_LO_COUNT,
+                phy->_lo_pairs = kcalloc(B43legacy_LO_COUNT,
+                                         sizeof(struct b43legacy_lopair),
                                          GFP_KERNEL);
                 if (!phy->_lo_pairs)
                         return -ENOMEM;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index 49d37ad96958..c40ba8855cd5 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -1486,8 +1486,9 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
                 (struct brcmf_commonring **)if_msgbuf->commonrings;
         msgbuf->flowrings = (struct brcmf_commonring **)if_msgbuf->flowrings;
         msgbuf->max_flowrings = if_msgbuf->max_flowrings;
-        msgbuf->flowring_dma_handle = kzalloc(msgbuf->max_flowrings *
-                sizeof(*msgbuf->flowring_dma_handle), GFP_KERNEL);
+        msgbuf->flowring_dma_handle =
+                kcalloc(msgbuf->max_flowrings,
+                        sizeof(*msgbuf->flowring_dma_handle), GFP_KERNEL);
         if (!msgbuf->flowring_dma_handle)
                 goto fail;
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 4b2149b48362..3e9c4f2f5dd1 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -1058,7 +1058,7 @@ static s32 brcmf_p2p_act_frm_search(struct brcmf_p2p_info *p2p, u16 channel)
                 channel_cnt = AF_PEER_SEARCH_CNT;
         else
                 channel_cnt = SOCIAL_CHAN_CNT;
-        default_chan_list = kzalloc(channel_cnt * sizeof(*default_chan_list),
+        default_chan_list = kcalloc(channel_cnt, sizeof(*default_chan_list),
                                     GFP_KERNEL);
         if (default_chan_list == NULL) {
                 brcmf_err("channel list allocation failed\n");
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.c
index 0a14942b8216..7d4e8f589fdc 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.c
@@ -507,7 +507,7 @@ brcms_c_attach_malloc(uint unit, uint *err, uint devid)
         wlc->hw->wlc = wlc;
 
         wlc->hw->bandstate[0] =
-                kzalloc(sizeof(struct brcms_hw_band) * MAXBANDS, GFP_ATOMIC);
+                kcalloc(MAXBANDS, sizeof(struct brcms_hw_band), GFP_ATOMIC);
         if (wlc->hw->bandstate[0] == NULL) {
                 *err = 1006;
                 goto fail;
@@ -521,7 +521,8 @@ brcms_c_attach_malloc(uint unit, uint *err, uint devid)
         }
 
         wlc->modulecb =
-                kzalloc(sizeof(struct modulecb) * BRCMS_MAXMODULES, GFP_ATOMIC);
+                kcalloc(BRCMS_MAXMODULES, sizeof(struct modulecb),
+                        GFP_ATOMIC);
         if (wlc->modulecb == NULL) {
                 *err = 1009;
                 goto fail;
@@ -553,7 +554,7 @@ brcms_c_attach_malloc(uint unit, uint *err, uint devid)
         }
 
         wlc->bandstate[0] =
-                kzalloc(sizeof(struct brcms_band)*MAXBANDS, GFP_ATOMIC);
+                kcalloc(MAXBANDS, sizeof(struct brcms_band), GFP_ATOMIC);
         if (wlc->bandstate[0] == NULL) {
                 *err = 1025;
                 goto fail;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
index 9d830d27b229..9fb0d9fbd939 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -1387,7 +1387,7 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
         s16 *ptr;
         struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy;
 
-        ptr = kmalloc(sizeof(s16) * 131, GFP_ATOMIC);
+        ptr = kmalloc_array(131, sizeof(s16), GFP_ATOMIC);
         if (NULL == ptr)
                 return false;
         if (module == 2) {
@@ -2670,7 +2670,7 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi,
         u16 *values_to_save;
         struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy;
 
-        values_to_save = kmalloc(sizeof(u16) * 20, GFP_ATOMIC);
+        values_to_save = kmalloc_array(20, sizeof(u16), GFP_ATOMIC);
         if (NULL == values_to_save)
                 return;
 
@@ -3678,11 +3678,11 @@ wlc_lcnphy_a1(struct brcms_phy *pi, int cal_type, int num_levels,
         u16 *phy_c32;
         phy_c21 = 0;
         phy_c10 = phy_c13 = phy_c14 = phy_c8 = 0;
-        ptr = kmalloc(sizeof(s16) * 131, GFP_ATOMIC);
+        ptr = kmalloc_array(131, sizeof(s16), GFP_ATOMIC);
         if (NULL == ptr)
                 return;
 
-        phy_c32 = kmalloc(sizeof(u16) * 20, GFP_ATOMIC);
+        phy_c32 = kmalloc_array(20, sizeof(u16), GFP_ATOMIC);
         if (NULL == phy_c32) {
                 kfree(ptr);
                 return;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
index 7e01981bc5c8..1a187557982e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
@@ -23032,7 +23032,7 @@ wlc_phy_loadsampletable_nphy(struct brcms_phy *pi, struct cordic_iq *tone_buf,
         u16 t;
         u32 *data_buf = NULL;
 
-        data_buf = kmalloc(sizeof(u32) * num_samps, GFP_ATOMIC);
+        data_buf = kmalloc_array(num_samps, sizeof(u32), GFP_ATOMIC);
         if (data_buf == NULL)
                 return;
 
@@ -23074,7 +23074,8 @@ wlc_phy_gen_load_samples_nphy(struct brcms_phy *pi, u32 f_kHz, u16 max_val,
                 tbl_len = (phy_bw << 1);
         }
 
-        tone_buf = kmalloc(sizeof(struct cordic_iq) * tbl_len, GFP_ATOMIC);
+        tone_buf = kmalloc_array(tbl_len, sizeof(struct cordic_iq),
+                                 GFP_ATOMIC);
         if (tone_buf == NULL)
                 return 0;
 
diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
index ce0fbf83285f..72046e182745 100644
--- a/drivers/net/wireless/cisco/airo.c
+++ b/drivers/net/wireless/cisco/airo.c
@@ -7127,7 +7127,7 @@ static int airo_get_aplist(struct net_device *dev,
         int i;
         int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
 
-        qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
+        qual = kmalloc_array(IW_MAX_AP, sizeof(*qual), GFP_KERNEL);
         if (!qual)
                 return -ENOMEM;
 
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
index 7c4f550a1475..b8fd3cc90634 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
@@ -3445,8 +3445,9 @@ static int ipw2100_msg_allocate(struct ipw2100_priv *priv)
         dma_addr_t p;
 
         priv->msg_buffers =
-            kmalloc(IPW_COMMAND_POOL_SIZE * sizeof(struct ipw2100_tx_packet),
-                    GFP_KERNEL);
+            kmalloc_array(IPW_COMMAND_POOL_SIZE,
+                          sizeof(struct ipw2100_tx_packet),
+                          GFP_KERNEL);
         if (!priv->msg_buffers)
                 return -ENOMEM;
 
@@ -4587,9 +4588,9 @@ static int ipw2100_rx_allocate(struct ipw2100_priv *priv)
         /*
          * allocate packets
          */
-        priv->rx_buffers = kmalloc(RX_QUEUE_LENGTH *
-                                   sizeof(struct ipw2100_rx_packet),
-                                   GFP_KERNEL);
+        priv->rx_buffers = kmalloc_array(RX_QUEUE_LENGTH,
+                                         sizeof(struct ipw2100_rx_packet),
+                                         GFP_KERNEL);
         if (!priv->rx_buffers) {
                 IPW_DEBUG_INFO("can't allocate rx packet buffer table\n");
 
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
index f26beeb6c5ff..8a858f7e36f4 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
@@ -3208,13 +3208,13 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
 
         IPW_DEBUG_TRACE("<< :\n");
 
-        virts = kmalloc(sizeof(void *) * CB_NUMBER_OF_ELEMENTS_SMALL,
-                        GFP_KERNEL);
+        virts = kmalloc_array(CB_NUMBER_OF_ELEMENTS_SMALL, sizeof(void *),
+                              GFP_KERNEL);
         if (!virts)
                 return -ENOMEM;
 
-        phys = kmalloc(sizeof(dma_addr_t) * CB_NUMBER_OF_ELEMENTS_SMALL,
-                        GFP_KERNEL);
+        phys = kmalloc_array(CB_NUMBER_OF_ELEMENTS_SMALL, sizeof(dma_addr_t),
+                             GFP_KERNEL);
         if (!phys) {
                 kfree(virts);
                 return -ENOMEM;
@@ -3782,7 +3782,7 @@ static int ipw_queue_tx_init(struct ipw_priv *priv,
 {
         struct pci_dev *dev = priv->pci_dev;
 
-        q->txb = kmalloc(sizeof(q->txb[0]) * count, GFP_KERNEL);
+        q->txb = kmalloc_array(count, sizeof(q->txb[0]), GFP_KERNEL);
         if (!q->txb) {
                 IPW_ERROR("vmalloc for auxiliary BD structures failed\n");
                 return -ENOMEM;
diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
index 063e19ced7c8..6514baf799fe 100644
--- a/drivers/net/wireless/intel/iwlegacy/common.c
+++ b/drivers/net/wireless/intel/iwlegacy/common.c
@@ -922,7 +922,7 @@ il_init_channel_map(struct il_priv *il)
         D_EEPROM("Parsing data for %d channels.\n", il->channel_count);
 
         il->channel_info =
-            kzalloc(sizeof(struct il_channel_info) * il->channel_count,
+            kcalloc(il->channel_count, sizeof(struct il_channel_info),
                     GFP_KERNEL);
         if (!il->channel_info) {
                 IL_ERR("Could not allocate channel_info\n");
@@ -3041,9 +3041,9 @@ il_tx_queue_init(struct il_priv *il, u32 txq_id)
         }
 
         txq->meta =
-            kzalloc(sizeof(struct il_cmd_meta) * actual_slots, GFP_KERNEL);
+            kcalloc(actual_slots, sizeof(struct il_cmd_meta), GFP_KERNEL);
         txq->cmd =
-            kzalloc(sizeof(struct il_device_cmd *) * actual_slots, GFP_KERNEL);
+            kcalloc(actual_slots, sizeof(struct il_device_cmd *), GFP_KERNEL);
 
         if (!txq->meta || !txq->cmd)
                 goto out_free_arrays;
@@ -3455,7 +3455,7 @@ il_init_geos(struct il_priv *il)
         }
 
         channels =
-            kzalloc(sizeof(struct ieee80211_channel) * il->channel_count,
+            kcalloc(il->channel_count, sizeof(struct ieee80211_channel),
                     GFP_KERNEL);
         if (!channels)
                 return -ENOMEM;
@@ -4654,8 +4654,9 @@ il_alloc_txq_mem(struct il_priv *il)
 {
         if (!il->txq)
                 il->txq =
-                    kzalloc(sizeof(struct il_tx_queue) *
-                            il->cfg->num_of_queues, GFP_KERNEL);
+                    kcalloc(il->cfg->num_of_queues,
+                            sizeof(struct il_tx_queue),
+                            GFP_KERNEL);
         if (!il->txq) {
                 IL_ERR("Not enough memory for txq\n");
                 return -ENOMEM;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 4b3753d78d03..11ecdf63b732 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -564,7 +564,7 @@ iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
         else
                 blacklist_len = IWL_SCAN_MAX_BLACKLIST_LEN;
 
-        blacklist = kzalloc(sizeof(*blacklist) * blacklist_len, GFP_KERNEL);
+        blacklist = kcalloc(blacklist_len, sizeof(*blacklist), GFP_KERNEL);
         if (!blacklist)
                 return -ENOMEM;
 
diff --git a/drivers/net/wireless/intersil/hostap/hostap_info.c b/drivers/net/wireless/intersil/hostap/hostap_info.c
index de8a099a9386..da8c30f10d92 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_info.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_info.c
@@ -271,8 +271,9 @@ static void prism2_info_scanresults(local_info_t *local, unsigned char *buf,
         left -= 4;
 
         new_count = left / sizeof(struct hfa384x_scan_result);
-        results = kmalloc(new_count * sizeof(struct hfa384x_hostscan_result),
-                          GFP_ATOMIC);
+        results = kmalloc_array(new_count,
+                                sizeof(struct hfa384x_hostscan_result),
+                                GFP_ATOMIC);
         if (results == NULL)
                 return;
 
diff --git a/drivers/net/wireless/intersil/hostap/hostap_ioctl.c b/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
index c1bc0a6ef300..1ca9731d9b14 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
@@ -513,8 +513,8 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
                 return -EOPNOTSUPP;
         }
 
-        addr = kmalloc(sizeof(struct sockaddr) * IW_MAX_AP, GFP_KERNEL);
-        qual = kmalloc(sizeof(struct iw_quality) * IW_MAX_AP, GFP_KERNEL);
+        addr = kmalloc_array(IW_MAX_AP, sizeof(struct sockaddr), GFP_KERNEL);
+        qual = kmalloc_array(IW_MAX_AP, sizeof(struct iw_quality), GFP_KERNEL);
         if (addr == NULL || qual == NULL) {
                 kfree(addr);
                 kfree(qual);
diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wireless/intersil/p54/eeprom.c
index d4c73d39336f..de2ef95c386c 100644
--- a/drivers/net/wireless/intersil/p54/eeprom.c
+++ b/drivers/net/wireless/intersil/p54/eeprom.c
@@ -161,8 +161,9 @@ static int p54_generate_band(struct ieee80211_hw *dev,
         if (!tmp)
                 goto err_out;
 
-        tmp->channels = kzalloc(sizeof(struct ieee80211_channel) *
-                                list->band_channel_num[band], GFP_KERNEL);
+        tmp->channels = kcalloc(list->band_channel_num[band],
+                                sizeof(struct ieee80211_channel),
+                                GFP_KERNEL);
         if (!tmp->channels)
                 goto err_out;
 
@@ -344,7 +345,7 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
                 goto free;
         }
         priv->chan_num = max_channel_num;
-        priv->survey = kzalloc(sizeof(struct survey_info) * max_channel_num,
+        priv->survey = kcalloc(max_channel_num, sizeof(struct survey_info),
                                GFP_KERNEL);
         if (!priv->survey) {
                 ret = -ENOMEM;
@@ -352,8 +353,9 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
         }
 
         list->max_entries = max_channel_num;
-        list->channels = kzalloc(sizeof(struct p54_channel_entry) *
-                                 max_channel_num, GFP_KERNEL);
+        list->channels = kcalloc(max_channel_num,
+                                 sizeof(struct p54_channel_entry),
+                                 GFP_KERNEL);
         if (!list->channels) {
                 ret = -ENOMEM;
                 goto free;
diff --git a/drivers/net/wireless/intersil/prism54/oid_mgt.c b/drivers/net/wireless/intersil/prism54/oid_mgt.c
index 6528ed5b9b1d..6d57e1cbcc07 100644
--- a/drivers/net/wireless/intersil/prism54/oid_mgt.c
+++ b/drivers/net/wireless/intersil/prism54/oid_mgt.c
@@ -244,7 +244,7 @@ mgt_init(islpci_private *priv)
         /* Alloc the cache */
         for (i = 0; i < OID_NUM_LAST; i++) {
                 if (isl_oid[i].flags & OID_FLAG_CACHED) {
-                        priv->mib[i] = kzalloc(isl_oid[i].size *
+                        priv->mib[i] = kcalloc(isl_oid[i].size,
                                                (isl_oid[i].range + 1),
                                                GFP_KERNEL);
                         if (!priv->mib[i])
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index 1edcddaf7b4b..7ab44cd32a9d 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -399,8 +399,8 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 
         new_node->win_size = win_size;
 
-        new_node->rx_reorder_ptr = kzalloc(sizeof(void *) * win_size,
-                                        GFP_KERNEL);
+        new_node->rx_reorder_ptr = kcalloc(win_size, sizeof(void *),
+                                           GFP_KERNEL);
         if (!new_node->rx_reorder_ptr) {
                 kfree((u8 *) new_node);
                 mwifiex_dbg(priv->adapter, ERROR,
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index a67e2d66ac9d..4b5ae9098504 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -4242,8 +4242,8 @@ int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter)
          * additional active scan request for hidden SSIDs on passive channels.
          */
         adapter->num_in_chan_stats = 2 * (n_channels_bg + n_channels_a);
-        adapter->chan_stats = vmalloc(sizeof(*adapter->chan_stats) *
-                                      adapter->num_in_chan_stats);
+        adapter->chan_stats = vmalloc(array_size(sizeof(*adapter->chan_stats),
+                                                 adapter->num_in_chan_stats));
 
         if (!adapter->chan_stats)
                 return -ENOMEM;
diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
index 47d2dcc3f28f..dfdcbc4f141a 100644
--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
+++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
@@ -2106,15 +2106,16 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
                 return -ENOMEM;
 
         /* Allocate skb pointer buffers */
-        card->mpa_rx.skb_arr = kzalloc((sizeof(void *)) *
-                                       card->mp_agg_pkt_limit, GFP_KERNEL);
+        card->mpa_rx.skb_arr = kcalloc(card->mp_agg_pkt_limit, sizeof(void *),
+                                       GFP_KERNEL);
         if (!card->mpa_rx.skb_arr) {
                 kfree(card->mp_regs);
                 return -ENOMEM;
         }
 
-        card->mpa_rx.len_arr = kzalloc(sizeof(*card->mpa_rx.len_arr) *
-                                       card->mp_agg_pkt_limit, GFP_KERNEL);
+        card->mpa_rx.len_arr = kcalloc(card->mp_agg_pkt_limit,
+                                       sizeof(*card->mpa_rx.len_arr),
+                                       GFP_KERNEL);
         if (!card->mpa_rx.len_arr) {
                 kfree(card->mp_regs);
                 kfree(card->mpa_rx.skb_arr);
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index fcd079a96782..d62e34e7eadf 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -181,7 +181,7 @@ mt76_init_sband(struct mt76_dev *dev, struct mt76_sband *msband,
         if (!chanlist)
                 return -ENOMEM;
 
-        msband->chan = devm_kzalloc(dev->dev, n_chan * sizeof(*msband->chan),
+        msband->chan = devm_kcalloc(dev->dev, n_chan, sizeof(*msband->chan),
                                     GFP_KERNEL);
         if (!msband->chan)
                 return -ENOMEM;
diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c
index 5eb143667539..c5d94a95e21a 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c
@@ -1216,7 +1216,7 @@ static int qtnf_parse_variable_mac_info(struct qtnf_wmac *mac,
                                 return -EINVAL;
                         }
 
-                        limits = kzalloc(sizeof(*limits) * rec->n_limits,
+                        limits = kcalloc(rec->n_limits, sizeof(*limits),
                                          GFP_KERNEL);
                         if (!limits)
                                 return -ENOMEM;
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
index 0eee479583b8..acc399b5574e 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
@@ -397,7 +397,7 @@ static ssize_t rt2x00debug_read_crypto_stats(struct file *file,
         if (*offset)
                 return 0;
 
-        data = kzalloc((1 + CIPHER_MAX) * MAX_LINE_LENGTH, GFP_KERNEL);
+        data = kcalloc(1 + CIPHER_MAX, MAX_LINE_LENGTH, GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/efuse.c b/drivers/net/wireless/realtek/rtlwifi/efuse.c
index fd13d4ef53b8..9729e51fce38 100644
--- a/drivers/net/wireless/realtek/rtlwifi/efuse.c
+++ b/drivers/net/wireless/realtek/rtlwifi/efuse.c
@@ -258,8 +258,8 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
         }
 
         /* allocate memory for efuse_tbl and efuse_word */
-        efuse_tbl = kzalloc(rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE] *
-                            sizeof(u8), GFP_ATOMIC);
+        efuse_tbl = kzalloc(rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE],
+                            GFP_ATOMIC);
         if (!efuse_tbl)
                 return;
         efuse_word = kcalloc(EFUSE_MAX_WORD_UNIT, sizeof(u16 *), GFP_ATOMIC);
diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index ce3103bb8ebb..f9faffc498bc 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -1048,7 +1048,7 @@ int rtl_usb_probe(struct usb_interface *intf,
         }
         rtlpriv = hw->priv;
         rtlpriv->hw = hw;
-        rtlpriv->usb_data = kzalloc(RTL_USB_MAX_RX_COUNT * sizeof(u32),
+        rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32),
                                     GFP_KERNEL);
         if (!rtlpriv->usb_data)
                 return -ENOMEM;
diff --git a/drivers/net/wireless/st/cw1200/queue.c b/drivers/net/wireless/st/cw1200/queue.c
index 5153d2cfd991..7c31b63b8258 100644
--- a/drivers/net/wireless/st/cw1200/queue.c
+++ b/drivers/net/wireless/st/cw1200/queue.c
@@ -154,7 +154,7 @@ int cw1200_queue_stats_init(struct cw1200_queue_stats *stats,
         spin_lock_init(&stats->lock);
         init_waitqueue_head(&stats->wait_link_id_empty);
 
-        stats->link_map_cache = kzalloc(sizeof(int) * map_capacity,
+        stats->link_map_cache = kcalloc(map_capacity, sizeof(int),
                                         GFP_KERNEL);
         if (!stats->link_map_cache)
                 return -ENOMEM;
@@ -181,13 +181,13 @@ int cw1200_queue_init(struct cw1200_queue *queue,
         spin_lock_init(&queue->lock);
         timer_setup(&queue->gc, cw1200_queue_gc, 0);
 
-        queue->pool = kzalloc(sizeof(struct cw1200_queue_item) * capacity,
-                        GFP_KERNEL);
+        queue->pool = kcalloc(capacity, sizeof(struct cw1200_queue_item),
+                              GFP_KERNEL);
         if (!queue->pool)
                 return -ENOMEM;
 
-        queue->link_map_cache = kzalloc(sizeof(int) * stats->map_capacity,
-                        GFP_KERNEL);
+        queue->link_map_cache = kcalloc(stats->map_capacity, sizeof(int),
+                                        GFP_KERNEL);
         if (!queue->link_map_cache) {
                 kfree(queue->pool);
                 queue->pool = NULL;
diff --git a/drivers/net/wireless/st/cw1200/scan.c b/drivers/net/wireless/st/cw1200/scan.c
index cc2ce60f4f09..67213f11acbd 100644
--- a/drivers/net/wireless/st/cw1200/scan.c
+++ b/drivers/net/wireless/st/cw1200/scan.c
@@ -230,9 +230,9 @@ void cw1200_scan_work(struct work_struct *work)
                         scan.type = WSM_SCAN_TYPE_BACKGROUND;
                         scan.flags = WSM_SCAN_FLAG_FORCE_BACKGROUND;
                 }
-                scan.ch = kzalloc(
-                        sizeof(struct wsm_scan_ch) * (it - priv->scan.curr),
-                        GFP_KERNEL);
+                scan.ch = kcalloc(it - priv->scan.curr,
+                                  sizeof(struct wsm_scan_ch),
+                                  GFP_KERNEL);
                 if (!scan.ch) {
                         priv->scan.status = -ENOMEM;
                         goto fail;
diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
index b01b44a5d16e..1f6d9f357e57 100644
--- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
@@ -732,7 +732,8 @@ static int zd_mac_config_beacon(struct ieee80211_hw *hw, struct sk_buff *beacon,
 
         /* Alloc memory for full beacon write at once. */
         num_cmds = 1 + zd_chip_is_zd1211b(&mac->chip) + full_len;
-        ioreqs = kmalloc(num_cmds * sizeof(struct zd_ioreq32), GFP_KERNEL);
+        ioreqs = kmalloc_array(num_cmds, sizeof(struct zd_ioreq32),
+                               GFP_KERNEL);
         if (!ioreqs) {
                 r = -ENOMEM;
                 goto out_nofree;
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index e1aef253601e..cd51492ae6c2 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -977,8 +977,8 @@ static void connect(struct backend_info *be)
         }
 
         /* Use the number of queues requested by the frontend */
-        be->vif->queues = vzalloc(requested_num_queues *
-                                  sizeof(struct xenvif_queue));
+        be->vif->queues = vzalloc(array_size(requested_num_queues,
+                                             sizeof(struct xenvif_queue)));
         if (!be->vif->queues) {
                 xenbus_dev_fatal(dev, -ENOMEM,
                                  "allocating queues");