tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

treewide: Use array_size() in vmalloc()

The vmalloc() function has no 2-factor argument form, so multiplication
factors need to be wrapped in array_size(). This patch replaces cases of:

vmalloc(a * b)

with:
vmalloc(array_size(a, b))

as well as handling cases of:

vmalloc(a * b * c)

with:

vmalloc(array3_size(a, b, c))

This does, however, attempt to ignore constant size factors like:

vmalloc(4 * 1024)

though any constants defined via macros get caught up in the conversion.

Any factors with a sizeof() of "unsigned char", "char", and "u8" were
dropped, since they're redundant.

The Coccinelle script used for this was:

// Fix redundant parens around sizeof().
@@
type TYPE;
expression THING, E;
@@

(
vmalloc(
- (sizeof(TYPE)) * E
+ sizeof(TYPE) * E
, ...)
|
vmalloc(
- (sizeof(THING)) * E
+ sizeof(THING) * E
, ...)
)

// Drop single-byte sizes and redundant parens.
@@
expression COUNT;
typedef u8;
typedef __u8;
@@

(
vmalloc(
- sizeof(u8) * (COUNT)
+ COUNT
, ...)
|
vmalloc(
- sizeof(__u8) * (COUNT)
+ COUNT
, ...)
|
vmalloc(
- sizeof(char) * (COUNT)
+ COUNT
, ...)
|
vmalloc(
- sizeof(unsigned char) * (COUNT)
+ COUNT
, ...)
|
vmalloc(
- sizeof(u8) * COUNT
+ COUNT
, ...)
|
vmalloc(
- sizeof(__u8) * COUNT
+ COUNT
, ...)
|
vmalloc(
- sizeof(char) * COUNT
+ COUNT
, ...)
|
vmalloc(
- sizeof(unsigned char) * COUNT
+ COUNT
, ...)
)

// 2-factor product with sizeof(type/expression) and identifier or constant.
@@
type TYPE;
expression THING;
identifier COUNT_ID;
constant COUNT_CONST;
@@

(
vmalloc(
- sizeof(TYPE) * (COUNT_ID)
+ array_size(COUNT_ID, sizeof(TYPE))
, ...)
|
vmalloc(
- sizeof(TYPE) * COUNT_ID
+ array_size(COUNT_ID, sizeof(TYPE))
, ...)
|
vmalloc(
- sizeof(TYPE) * (COUNT_CONST)
+ array_size(COUNT_CONST, sizeof(TYPE))
, ...)
|
vmalloc(
- sizeof(TYPE) * COUNT_CONST
+ array_size(COUNT_CONST, sizeof(TYPE))
, ...)
|
vmalloc(
- sizeof(THING) * (COUNT_ID)
+ array_size(COUNT_ID, sizeof(THING))
, ...)
|
vmalloc(
- sizeof(THING) * COUNT_ID
+ array_size(COUNT_ID, sizeof(THING))
, ...)
|
vmalloc(
- sizeof(THING) * (COUNT_CONST)
+ array_size(COUNT_CONST, sizeof(THING))
, ...)
|
vmalloc(
- sizeof(THING) * COUNT_CONST
+ array_size(COUNT_CONST, sizeof(THING))
, ...)
)

// 2-factor product, only identifiers.
@@
identifier SIZE, COUNT;
@@

vmalloc(
- SIZE * COUNT
+ array_size(COUNT, SIZE)
, ...)

// 3-factor product with 1 sizeof(type) or sizeof(expression), with
// redundant parens removed.
@@
expression THING;
identifier STRIDE, COUNT;
type TYPE;
@@

(
vmalloc(
- sizeof(TYPE) * (COUNT) * (STRIDE)
+ array3_size(COUNT, STRIDE, sizeof(TYPE))
, ...)
|
vmalloc(
- sizeof(TYPE) * (COUNT) * STRIDE
+ array3_size(COUNT, STRIDE, sizeof(TYPE))
, ...)
|
vmalloc(
- sizeof(TYPE) * COUNT * (STRIDE)
+ array3_size(COUNT, STRIDE, sizeof(TYPE))
, ...)
|
vmalloc(
- sizeof(TYPE) * COUNT * STRIDE
+ array3_size(COUNT, STRIDE, sizeof(TYPE))
, ...)
|
vmalloc(
- sizeof(THING) * (COUNT) * (STRIDE)
+ array3_size(COUNT, STRIDE, sizeof(THING))
, ...)
|
vmalloc(
- sizeof(THING) * (COUNT) * STRIDE
+ array3_size(COUNT, STRIDE, sizeof(THING))
, ...)
|
vmalloc(
- sizeof(THING) * COUNT * (STRIDE)
+ array3_size(COUNT, STRIDE, sizeof(THING))
, ...)
|
vmalloc(
- sizeof(THING) * COUNT * STRIDE
+ array3_size(COUNT, STRIDE, sizeof(THING))
, ...)
)

// 3-factor product with 2 sizeof(variable), with redundant parens removed.
@@
expression THING1, THING2;
identifier COUNT;
type TYPE1, TYPE2;
@@

(
vmalloc(
- sizeof(TYPE1) * sizeof(TYPE2) * COUNT
+ array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
, ...)
|
vmalloc(
- sizeof(TYPE1) * sizeof(THING2) * (COUNT)
+ array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
, ...)
|
vmalloc(
- sizeof(THING1) * sizeof(THING2) * COUNT
+ array3_size(COUNT, sizeof(THING1), sizeof(THING2))
, ...)
|
vmalloc(
- sizeof(THING1) * sizeof(THING2) * (COUNT)
+ array3_size(COUNT, sizeof(THING1), sizeof(THING2))
, ...)
|
vmalloc(
- sizeof(TYPE1) * sizeof(THING2) * COUNT
+ array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
, ...)
|
vmalloc(
- sizeof(TYPE1) * sizeof(THING2) * (COUNT)
+ array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
, ...)
)

// 3-factor product, only identifiers, with redundant parens removed.
@@
identifier STRIDE, SIZE, COUNT;
@@

(
vmalloc(
- (COUNT) * STRIDE * SIZE
+ array3_size(COUNT, STRIDE, SIZE)
, ...)
|
vmalloc(
- COUNT * (STRIDE) * SIZE
+ array3_size(COUNT, STRIDE, SIZE)
, ...)
|
vmalloc(
- COUNT * STRIDE * (SIZE)
+ array3_size(COUNT, STRIDE, SIZE)
, ...)
|
vmalloc(
- (COUNT) * (STRIDE) * SIZE
+ array3_size(COUNT, STRIDE, SIZE)
, ...)
|
vmalloc(
- COUNT * (STRIDE) * (SIZE)
+ array3_size(COUNT, STRIDE, SIZE)
, ...)
|
vmalloc(
- (COUNT) * STRIDE * (SIZE)
+ array3_size(COUNT, STRIDE, SIZE)
, ...)
|
vmalloc(
- (COUNT) * (STRIDE) * (SIZE)
+ array3_size(COUNT, STRIDE, SIZE)
, ...)
|
vmalloc(
- COUNT * STRIDE * SIZE
+ array3_size(COUNT, STRIDE, SIZE)
, ...)
)

// Any remaining multi-factor products, first at least 3-factor products
// when they're not all constants...
@@
expression E1, E2, E3;
constant C1, C2, C3;
@@

(
vmalloc(C1 * C2 * C3, ...)
|
vmalloc(
- E1 * E2 * E3
+ array3_size(E1, E2, E3)
, ...)
)

// And then all remaining 2 factors products when they're not all constants.
@@
expression E1, E2;
constant C1, C2;
@@

(
vmalloc(C1 * C2, ...)
|
vmalloc(
- E1 * E2
+ array_size(E1, E2)
, ...)
)

Signed-off-by: Kees Cook <keescook@chromium.org>

Kees Cook 42bc47b3 a86854d0

+160 -116
+2 -1
arch/powerpc/kernel/rtasd.c
··· 559 559 rtas_error_log_max = rtas_get_error_log_max(); 560 560 rtas_error_log_buffer_max = rtas_error_log_max + sizeof(int); 561 561 562 - rtas_log_buf = vmalloc(rtas_error_log_buffer_max*LOG_NUMBER); 562 + rtas_log_buf = vmalloc(array_size(LOG_NUMBER, 563 + rtas_error_log_buffer_max)); 563 564 if (!rtas_log_buf) { 564 565 printk(KERN_ERR "rtasd: no memory\n"); 565 566 return -ENOMEM;
+1 -1
arch/powerpc/kvm/book3s_64_mmu_hv.c
··· 108 108 npte = 1ul << (order - 4); 109 109 110 110 /* Allocate reverse map array */ 111 - rev = vmalloc(sizeof(struct revmap_entry) * npte); 111 + rev = vmalloc(array_size(npte, sizeof(struct revmap_entry))); 112 112 if (!rev) { 113 113 if (cma) 114 114 kvm_free_hpt_cma(page, 1 << (order - PAGE_SHIFT));
+1 -1
arch/s390/hypfs/hypfs_diag.c
··· 239 239 static void *diag204_alloc_vbuf(int pages) 240 240 { 241 241 /* The buffer has to be page aligned! */ 242 - diag204_buf_vmalloc = vmalloc(PAGE_SIZE * (pages + 1)); 242 + diag204_buf_vmalloc = vmalloc(array_size(PAGE_SIZE, (pages + 1))); 243 243 if (!diag204_buf_vmalloc) 244 244 return ERR_PTR(-ENOMEM); 245 245 diag204_buf = page_align_ptr(diag204_buf_vmalloc);
+2 -2
arch/s390/kernel/module.c
··· 123 123 124 124 /* Allocate one syminfo structure per symbol. */ 125 125 me->arch.nsyms = symtab->sh_size / sizeof(Elf_Sym); 126 - me->arch.syminfo = vmalloc(me->arch.nsyms * 127 - sizeof(struct mod_arch_syminfo)); 126 + me->arch.syminfo = vmalloc(array_size(sizeof(struct mod_arch_syminfo), 127 + me->arch.nsyms)); 128 128 if (!me->arch.syminfo) 129 129 return -ENOMEM; 130 130 symbols = (void *) hdr + symtab->sh_offset;
+1 -1
arch/s390/kernel/sthyi.c
··· 315 315 if (pages <= 0) 316 316 return; 317 317 318 - diag204_buf = vmalloc(PAGE_SIZE * pages); 318 + diag204_buf = vmalloc(array_size(pages, PAGE_SIZE)); 319 319 if (!diag204_buf) 320 320 return; 321 321
+1 -1
arch/s390/kvm/gaccess.c
··· 847 847 nr_pages = (((ga & ~PAGE_MASK) + len - 1) >> PAGE_SHIFT) + 1; 848 848 pages = pages_array; 849 849 if (nr_pages > ARRAY_SIZE(pages_array)) 850 - pages = vmalloc(nr_pages * sizeof(unsigned long)); 850 + pages = vmalloc(array_size(nr_pages, sizeof(unsigned long))); 851 851 if (!pages) 852 852 return -ENOMEM; 853 853 need_ipte_lock = psw_bits(*psw).dat && !asce.r;
+1 -1
arch/s390/kvm/kvm-s390.c
··· 1725 1725 if (args->count == 0) 1726 1726 return 0; 1727 1727 1728 - bits = vmalloc(sizeof(*bits) * args->count); 1728 + bits = vmalloc(array_size(sizeof(*bits), args->count)); 1729 1729 if (!bits) 1730 1730 return -ENOMEM; 1731 1731
+3 -2
arch/x86/kvm/cpuid.c
··· 203 203 goto out; 204 204 r = -ENOMEM; 205 205 if (cpuid->nent) { 206 - cpuid_entries = vmalloc(sizeof(struct kvm_cpuid_entry) * 207 - cpuid->nent); 206 + cpuid_entries = 207 + vmalloc(array_size(sizeof(struct kvm_cpuid_entry), 208 + cpuid->nent)); 208 209 if (!cpuid_entries) 209 210 goto out; 210 211 r = -EFAULT;
+1 -1
drivers/base/firmware_loader/fallback.c
··· 403 403 fw_priv->page_array_size * 2); 404 404 struct page **new_pages; 405 405 406 - new_pages = vmalloc(new_array_size * sizeof(void *)); 406 + new_pages = vmalloc(array_size(new_array_size, sizeof(void *))); 407 407 if (!new_pages) { 408 408 fw_load_abort(fw_sysfs); 409 409 return -ENOMEM;
+2 -1
drivers/dma/ipu/ipu_idmac.c
··· 910 910 /* Called with ichan->chan_mutex held */ 911 911 static int idmac_desc_alloc(struct idmac_channel *ichan, int n) 912 912 { 913 - struct idmac_tx_desc *desc = vmalloc(n * sizeof(struct idmac_tx_desc)); 913 + struct idmac_tx_desc *desc = 914 + vmalloc(array_size(n, sizeof(struct idmac_tx_desc))); 914 915 struct idmac *idmac = to_idmac(ichan->dma_chan.device); 915 916 916 917 if (!desc)
+1 -1
drivers/gpu/drm/drm_memory.c
··· 80 80 * page-table instead (that's probably faster anyhow...). 81 81 */ 82 82 /* note: use vmalloc() because num_pages could be large... */ 83 - page_map = vmalloc(num_pages * sizeof(struct page *)); 83 + page_map = vmalloc(array_size(num_pages, sizeof(struct page *))); 84 84 if (!page_map) 85 85 return NULL; 86 86
+1 -1
drivers/gpu/drm/nouveau/nv84_fence.c
··· 141 141 struct nv84_fence_priv *priv = drm->fence; 142 142 int i; 143 143 144 - priv->suspend = vmalloc(drm->chan.nr * sizeof(u32)); 144 + priv->suspend = vmalloc(array_size(sizeof(u32), drm->chan.nr)); 145 145 if (priv->suspend) { 146 146 for (i = 0; i < drm->chan.nr; i++) 147 147 priv->suspend[i] = nouveau_bo_rd32(priv->bo, i*4);
+1 -1
drivers/gpu/drm/qxl/qxl_fb.c
··· 241 241 DRM_DEBUG_DRIVER("%dx%d %d\n", mode_cmd.width, 242 242 mode_cmd.height, mode_cmd.pitches[0]); 243 243 244 - shadow = vmalloc(mode_cmd.pitches[0] * mode_cmd.height); 244 + shadow = vmalloc(array_size(mode_cmd.pitches[0], mode_cmd.height)); 245 245 /* TODO: what's the usual response to memory allocation errors? */ 246 246 BUG_ON(!shadow); 247 247 DRM_DEBUG_DRIVER("surface0 at gpu offset %lld, mmap_offset %lld (virt %p, shadow %p)\n",
+2 -2
drivers/gpu/drm/radeon/radeon_gart.c
··· 352 352 radeon_gart_fini(rdev); 353 353 return -ENOMEM; 354 354 } 355 - rdev->gart.pages_entry = vmalloc(sizeof(uint64_t) * 356 - rdev->gart.num_gpu_pages); 355 + rdev->gart.pages_entry = vmalloc(array_size(sizeof(uint64_t), 356 + rdev->gart.num_gpu_pages)); 357 357 if (rdev->gart.pages_entry == NULL) { 358 358 radeon_gart_fini(rdev); 359 359 return -ENOMEM;
+1 -1
drivers/gpu/drm/selftests/test-drm_mm.c
··· 579 579 DRM_MM_BUG_ON(!size); 580 580 581 581 ret = -ENOMEM; 582 - nodes = vmalloc(count * sizeof(*nodes)); 582 + nodes = vmalloc(array_size(count, sizeof(*nodes))); 583 583 if (!nodes) 584 584 goto err; 585 585
+1 -1
drivers/iommu/tegra-gart.c
··· 465 465 gart->iovmm_base = (dma_addr_t)res_remap->start; 466 466 gart->page_count = (resource_size(res_remap) >> GART_PAGE_SHIFT); 467 467 468 - gart->savedata = vmalloc(sizeof(u32) * gart->page_count); 468 + gart->savedata = vmalloc(array_size(sizeof(u32), gart->page_count)); 469 469 if (!gart->savedata) { 470 470 dev_err(dev, "failed to allocate context save area\n"); 471 471 return -ENOMEM;
+3 -2
drivers/isdn/i4l/isdn_bsdcomp.c
··· 340 340 * Allocate space for the dictionary. This may be more than one page in 341 341 * length. 342 342 */ 343 - db->dict = vmalloc(hsize * sizeof(struct bsd_dict)); 343 + db->dict = vmalloc(array_size(hsize, sizeof(struct bsd_dict))); 344 344 if (!db->dict) { 345 345 bsd_free(db); 346 346 return NULL; ··· 353 353 if (!decomp) 354 354 db->lens = NULL; 355 355 else { 356 - db->lens = vmalloc((maxmaxcode + 1) * sizeof(db->lens[0])); 356 + db->lens = vmalloc(array_size(sizeof(db->lens[0]), 357 + maxmaxcode + 1)); 357 358 if (!db->lens) { 358 359 bsd_free(db); 359 360 return (NULL);
+1 -1
drivers/lightnvm/pblk-gc.c
··· 88 88 89 89 up(&gc->gc_sem); 90 90 91 - gc_rq->data = vmalloc(gc_rq->nr_secs * geo->csecs); 91 + gc_rq->data = vmalloc(array_size(gc_rq->nr_secs, geo->csecs)); 92 92 if (!gc_rq->data) { 93 93 pr_err("pblk: could not GC line:%d (%d/%d)\n", 94 94 line->id, *line->vsc, gc_rq->nr_secs);
+2 -1
drivers/md/bcache/sysfs.c
··· 881 881 uint16_t q[31], *p, *cached; 882 882 ssize_t ret; 883 883 884 - cached = p = vmalloc(ca->sb.nbuckets * sizeof(uint16_t)); 884 + cached = p = vmalloc(array_size(sizeof(uint16_t), 885 + ca->sb.nbuckets)); 885 886 if (!p) 886 887 return -ENOMEM; 887 888
+1 -1
drivers/md/dm-cache-policy-smq.c
··· 588 588 nr_buckets = roundup_pow_of_two(max(nr_entries / 4u, 16u)); 589 589 ht->hash_bits = __ffs(nr_buckets); 590 590 591 - ht->buckets = vmalloc(sizeof(*ht->buckets) * nr_buckets); 591 + ht->buckets = vmalloc(array_size(nr_buckets, sizeof(*ht->buckets))); 592 592 if (!ht->buckets) 593 593 return -ENOMEM; 594 594
+1 -1
drivers/md/dm-region-hash.c
··· 202 202 rh->shift = RH_HASH_SHIFT; 203 203 rh->prime = RH_HASH_MULT; 204 204 205 - rh->buckets = vmalloc(nr_buckets * sizeof(*rh->buckets)); 205 + rh->buckets = vmalloc(array_size(nr_buckets, sizeof(*rh->buckets))); 206 206 if (!rh->buckets) { 207 207 DMERR("unable to allocate region hash bucket memory"); 208 208 kfree(rh);
+2 -1
drivers/md/dm-switch.c
··· 114 114 return -EINVAL; 115 115 } 116 116 117 - sctx->region_table = vmalloc(nr_slots * sizeof(region_table_slot_t)); 117 + sctx->region_table = vmalloc(array_size(nr_slots, 118 + sizeof(region_table_slot_t))); 118 119 if (!sctx->region_table) { 119 120 ti->error = "Cannot allocate region table"; 120 121 return -ENOMEM;
+3 -1
drivers/md/dm-thin.c
··· 2939 2939 goto bad_mapping_pool; 2940 2940 } 2941 2941 2942 - pool->cell_sort_array = vmalloc(sizeof(*pool->cell_sort_array) * CELL_SORT_ARRAY_SIZE); 2942 + pool->cell_sort_array = 2943 + vmalloc(array_size(CELL_SORT_ARRAY_SIZE, 2944 + sizeof(*pool->cell_sort_array))); 2943 2945 if (!pool->cell_sort_array) { 2944 2946 *error = "Error allocating cell sort array"; 2945 2947 err_p = ERR_PTR(-ENOMEM);
+2 -1
drivers/media/dvb-core/dmxdev.c
··· 1417 1417 if (dmxdev->demux->open(dmxdev->demux) < 0) 1418 1418 return -EUSERS; 1419 1419 1420 - dmxdev->filter = vmalloc(dmxdev->filternum * sizeof(struct dmxdev_filter)); 1420 + dmxdev->filter = vmalloc(array_size(sizeof(struct dmxdev_filter), 1421 + dmxdev->filternum)); 1421 1422 if (!dmxdev->filter) 1422 1423 return -ENOMEM; 1423 1424
+4 -2
drivers/media/dvb-core/dvb_demux.c
··· 1247 1247 1248 1248 dvbdemux->cnt_storage = NULL; 1249 1249 dvbdemux->users = 0; 1250 - dvbdemux->filter = vmalloc(dvbdemux->filternum * sizeof(struct dvb_demux_filter)); 1250 + dvbdemux->filter = vmalloc(array_size(sizeof(struct dvb_demux_filter), 1251 + dvbdemux->filternum)); 1251 1252 1252 1253 if (!dvbdemux->filter) 1253 1254 return -ENOMEM; 1254 1255 1255 - dvbdemux->feed = vmalloc(dvbdemux->feednum * sizeof(struct dvb_demux_feed)); 1256 + dvbdemux->feed = vmalloc(array_size(sizeof(struct dvb_demux_feed), 1257 + dvbdemux->feednum)); 1256 1258 if (!dvbdemux->feed) { 1257 1259 vfree(dvbdemux->filter); 1258 1260 dvbdemux->filter = NULL;
+1 -1
drivers/media/pci/meye/meye.c
··· 1625 1625 ret = -ENOMEM; 1626 1626 meye.mchip_dev = pcidev; 1627 1627 1628 - meye.grab_temp = vmalloc(MCHIP_NB_PAGES_MJPEG * PAGE_SIZE); 1628 + meye.grab_temp = vmalloc(array_size(PAGE_SIZE, MCHIP_NB_PAGES_MJPEG)); 1629 1629 if (!meye.grab_temp) 1630 1630 goto outvmalloc; 1631 1631
+1 -1
drivers/media/pci/pt1/pt1.c
··· 615 615 if (!pt1_nr_tables) 616 616 return 0; 617 617 618 - tables = vmalloc(sizeof(struct pt1_table) * pt1_nr_tables); 618 + tables = vmalloc(array_size(pt1_nr_tables, sizeof(struct pt1_table))); 619 619 if (tables == NULL) 620 620 return -ENOMEM; 621 621
+1 -1
drivers/media/pci/ttpci/av7110_ipack.c
··· 24 24 int av7110_ipack_init(struct ipack *p, int size, 25 25 void (*func)(u8 *buf, int size, void *priv)) 26 26 { 27 - if (!(p->buf = vmalloc(size*sizeof(u8)))) { 27 + if (!(p->buf = vmalloc(size))) { 28 28 printk(KERN_WARNING "Couldn't allocate memory for ipack\n"); 29 29 return -ENOMEM; 30 30 }
+2 -1
drivers/media/platform/soc_camera/soc_camera.c
··· 481 481 return -ENXIO; 482 482 483 483 icd->user_formats = 484 - vmalloc(fmts * sizeof(struct soc_camera_format_xlate)); 484 + vmalloc(array_size(fmts, 485 + sizeof(struct soc_camera_format_xlate))); 485 486 if (!icd->user_formats) 486 487 return -ENOMEM; 487 488
+1 -1
drivers/media/v4l2-core/videobuf-dma-sg.c
··· 100 100 101 101 if (NULL == pages[0]) 102 102 return NULL; 103 - sglist = vmalloc(nr_pages * sizeof(*sglist)); 103 + sglist = vmalloc(array_size(nr_pages, sizeof(*sglist))); 104 104 if (NULL == sglist) 105 105 return NULL; 106 106 sg_init_table(sglist, nr_pages);
+1 -1
drivers/mtd/ftl.c
··· 263 263 264 264 /* Set up virtual page map */ 265 265 blocks = le32_to_cpu(header.FormattedSize) >> header.BlockSize; 266 - part->VirtualBlockMap = vmalloc(blocks * sizeof(uint32_t)); 266 + part->VirtualBlockMap = vmalloc(array_size(blocks, sizeof(uint32_t))); 267 267 if (!part->VirtualBlockMap) 268 268 goto out_XferInfo; 269 269
+4 -2
drivers/mtd/mtdoops.c
··· 330 330 } 331 331 332 332 /* oops_page_used is a bit field */ 333 - cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages, 334 - BITS_PER_LONG) * sizeof(unsigned long)); 333 + cxt->oops_page_used = 334 + vmalloc(array_size(sizeof(unsigned long), 335 + DIV_ROUND_UP(mtdoops_pages, 336 + BITS_PER_LONG))); 335 337 if (!cxt->oops_page_used) { 336 338 printk(KERN_ERR "mtdoops: could not allocate page array\n"); 337 339 return;
+2 -2
drivers/mtd/mtdswap.c
··· 1317 1317 for (i = 0; i < MTDSWAP_TREE_CNT; i++) 1318 1318 d->trees[i].root = RB_ROOT; 1319 1319 1320 - d->page_data = vmalloc(sizeof(int)*pages); 1320 + d->page_data = vmalloc(array_size(pages, sizeof(int))); 1321 1321 if (!d->page_data) 1322 1322 goto page_data_fail; 1323 1323 1324 - d->revmap = vmalloc(sizeof(int)*blocks); 1324 + d->revmap = vmalloc(array_size(blocks, sizeof(int))); 1325 1325 if (!d->revmap) 1326 1326 goto revmap_fail; 1327 1327
+1 -1
drivers/mtd/nand/raw/nandsim.c
··· 582 582 return 0; 583 583 } 584 584 585 - ns->pages = vmalloc(ns->geom.pgnum * sizeof(union ns_mem)); 585 + ns->pages = vmalloc(array_size(sizeof(union ns_mem), ns->geom.pgnum)); 586 586 if (!ns->pages) { 587 587 NS_ERR("alloc_device: unable to allocate page array\n"); 588 588 return -ENOMEM;
+2 -1
drivers/mtd/rfd_ftl.c
··· 189 189 if (!part->blocks) 190 190 goto err; 191 191 192 - part->sector_map = vmalloc(part->sector_count * sizeof(u_long)); 192 + part->sector_map = vmalloc(array_size(sizeof(u_long), 193 + part->sector_count)); 193 194 if (!part->sector_map) { 194 195 printk(KERN_ERR PREFIX "'%s': unable to allocate memory for " 195 196 "sector map", part->mbd.mtd->name);
+3 -2
drivers/net/ethernet/cavium/liquidio/request_manager.c
··· 98 98 iq->request_list = vmalloc_node((sizeof(*iq->request_list) * num_descs), 99 99 numa_node); 100 100 if (!iq->request_list) 101 - iq->request_list = vmalloc(sizeof(*iq->request_list) * 102 - num_descs); 101 + iq->request_list = 102 + vmalloc(array_size(num_descs, 103 + sizeof(*iq->request_list))); 103 104 if (!iq->request_list) { 104 105 lio_dma_free(oct, q_size, iq->base_addr, iq->base_addr_dma); 105 106 dev_err(&oct->pci_dev->dev, "Alloc failed for IQ[%d] nr free list\n",
+1 -1
drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
··· 558 558 559 559 /* allocate temporary buffer to store rings in */ 560 560 i = max_t(int, interface->num_tx_queues, interface->num_rx_queues); 561 - temp_ring = vmalloc(i * sizeof(struct fm10k_ring)); 561 + temp_ring = vmalloc(array_size(i, sizeof(struct fm10k_ring))); 562 562 563 563 if (!temp_ring) { 564 564 err = -ENOMEM;
+4 -4
drivers/net/ethernet/intel/igb/igb_ethtool.c
··· 902 902 } 903 903 904 904 if (adapter->num_tx_queues > adapter->num_rx_queues) 905 - temp_ring = vmalloc(adapter->num_tx_queues * 906 - sizeof(struct igb_ring)); 905 + temp_ring = vmalloc(array_size(sizeof(struct igb_ring), 906 + adapter->num_tx_queues)); 907 907 else 908 - temp_ring = vmalloc(adapter->num_rx_queues * 909 - sizeof(struct igb_ring)); 908 + temp_ring = vmalloc(array_size(sizeof(struct igb_ring), 909 + adapter->num_rx_queues)); 910 910 911 911 if (!temp_ring) { 912 912 err = -ENOMEM;
+1 -1
drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
··· 1063 1063 /* allocate temporary buffer to store rings in */ 1064 1064 i = max_t(int, adapter->num_tx_queues + adapter->num_xdp_queues, 1065 1065 adapter->num_rx_queues); 1066 - temp_ring = vmalloc(i * sizeof(struct ixgbe_ring)); 1066 + temp_ring = vmalloc(array_size(i, sizeof(struct ixgbe_ring))); 1067 1067 1068 1068 if (!temp_ring) { 1069 1069 err = -ENOMEM;
+5 -3
drivers/net/ethernet/intel/ixgbevf/ethtool.c
··· 282 282 } 283 283 284 284 if (new_tx_count != adapter->tx_ring_count) { 285 - tx_ring = vmalloc((adapter->num_tx_queues + 286 - adapter->num_xdp_queues) * sizeof(*tx_ring)); 285 + tx_ring = vmalloc(array_size(sizeof(*tx_ring), 286 + adapter->num_tx_queues + 287 + adapter->num_xdp_queues)); 287 288 if (!tx_ring) { 288 289 err = -ENOMEM; 289 290 goto clear_reset; ··· 328 327 } 329 328 330 329 if (new_rx_count != adapter->rx_ring_count) { 331 - rx_ring = vmalloc(adapter->num_rx_queues * sizeof(*rx_ring)); 330 + rx_ring = vmalloc(array_size(sizeof(*rx_ring), 331 + adapter->num_rx_queues)); 332 332 if (!rx_ring) { 333 333 err = -ENOMEM; 334 334 goto clear_reset;
+2 -1
drivers/net/ethernet/netronome/nfp/flower/metadata.c
··· 417 417 418 418 /* Init ring buffer and unallocated stats_ids. */ 419 419 priv->stats_ids.free_list.buf = 420 - vmalloc(NFP_FL_STATS_ENTRY_RS * NFP_FL_STATS_ELEM_RS); 420 + vmalloc(array_size(NFP_FL_STATS_ELEM_RS, 421 + NFP_FL_STATS_ENTRY_RS)); 421 422 if (!priv->stats_ids.free_list.buf) 422 423 goto err_free_last_used; 423 424
+2 -2
drivers/net/ppp/bsd_comp.c
··· 406 406 * Allocate space for the dictionary. This may be more than one page in 407 407 * length. 408 408 */ 409 - db->dict = vmalloc(hsize * sizeof(struct bsd_dict)); 409 + db->dict = vmalloc(array_size(hsize, sizeof(struct bsd_dict))); 410 410 if (!db->dict) 411 411 { 412 412 bsd_free (db); ··· 425 425 */ 426 426 else 427 427 { 428 - db->lens = vmalloc((maxmaxcode + 1) * sizeof(db->lens[0])); 428 + db->lens = vmalloc(array_size(sizeof(db->lens[0]), (maxmaxcode + 1))); 429 429 if (!db->lens) 430 430 { 431 431 bsd_free (db);
+1 -1
drivers/net/wireless/ath/ath5k/debug.c
··· 931 931 932 932 /* Create buffer and read in eeprom */ 933 933 934 - buf = vmalloc(eesize * 2); 934 + buf = vmalloc(array_size(eesize, 2)); 935 935 if (!buf) { 936 936 ret = -ENOMEM; 937 937 goto err;
+2 -2
drivers/net/wireless/marvell/mwifiex/cfg80211.c
··· 4242 4242 * additional active scan request for hidden SSIDs on passive channels. 4243 4243 */ 4244 4244 adapter->num_in_chan_stats = 2 * (n_channels_bg + n_channels_a); 4245 - adapter->chan_stats = vmalloc(sizeof(*adapter->chan_stats) * 4246 - adapter->num_in_chan_stats); 4245 + adapter->chan_stats = vmalloc(array_size(sizeof(*adapter->chan_stats), 4246 + adapter->num_in_chan_stats)); 4247 4247 4248 4248 if (!adapter->chan_stats) 4249 4249 return -ENOMEM;
+1 -1
drivers/oprofile/event_buffer.c
··· 91 91 return -EINVAL; 92 92 93 93 buffer_pos = 0; 94 - event_buffer = vmalloc(sizeof(unsigned long) * buffer_size); 94 + event_buffer = vmalloc(array_size(buffer_size, sizeof(unsigned long))); 95 95 if (!event_buffer) 96 96 return -ENOMEM; 97 97
+1 -1
drivers/rapidio/devices/rio_mport_cdev.c
··· 975 975 priv->md->properties.transfer_mode) == 0) 976 976 return -ENODEV; 977 977 978 - transfer = vmalloc(transaction.count * sizeof(*transfer)); 978 + transfer = vmalloc(array_size(sizeof(*transfer), transaction.count)); 979 979 if (!transfer) 980 980 return -ENOMEM; 981 981
+4 -3
drivers/scsi/fnic/fnic_debugfs.c
··· 233 233 return -ENOMEM; 234 234 235 235 if (*rdata_ptr == fc_trc_flag->fnic_trace) { 236 - fnic_dbg_prt->buffer = vmalloc(3 * 237 - (trace_max_pages * PAGE_SIZE)); 236 + fnic_dbg_prt->buffer = vmalloc(array3_size(3, trace_max_pages, 237 + PAGE_SIZE)); 238 238 if (!fnic_dbg_prt->buffer) { 239 239 kfree(fnic_dbg_prt); 240 240 return -ENOMEM; ··· 244 244 fnic_dbg_prt->buffer_len = fnic_get_trace_data(fnic_dbg_prt); 245 245 } else { 246 246 fnic_dbg_prt->buffer = 247 - vmalloc(3 * (fnic_fc_trace_max_pages * PAGE_SIZE)); 247 + vmalloc(array3_size(3, fnic_fc_trace_max_pages, 248 + PAGE_SIZE)); 248 249 if (!fnic_dbg_prt->buffer) { 249 250 kfree(fnic_dbg_prt); 250 251 return -ENOMEM;
+9 -6
drivers/scsi/fnic/fnic_trace.c
··· 477 477 } 478 478 memset((void *)fnic_trace_buf_p, 0, (trace_max_pages * PAGE_SIZE)); 479 479 480 - fnic_trace_entries.page_offset = vmalloc(fnic_max_trace_entries * 481 - sizeof(unsigned long)); 480 + fnic_trace_entries.page_offset = 481 + vmalloc(array_size(fnic_max_trace_entries, 482 + sizeof(unsigned long))); 482 483 if (!fnic_trace_entries.page_offset) { 483 484 printk(KERN_ERR PFX "Failed to allocate memory for" 484 485 " page_offset\n"); ··· 556 555 557 556 fc_trace_max_entries = (fnic_fc_trace_max_pages * PAGE_SIZE)/ 558 557 FC_TRC_SIZE_BYTES; 559 - fnic_fc_ctlr_trace_buf_p = (unsigned long)vmalloc( 560 - fnic_fc_trace_max_pages * PAGE_SIZE); 558 + fnic_fc_ctlr_trace_buf_p = 559 + (unsigned long)vmalloc(array_size(PAGE_SIZE, 560 + fnic_fc_trace_max_pages)); 561 561 if (!fnic_fc_ctlr_trace_buf_p) { 562 562 pr_err("fnic: Failed to allocate memory for " 563 563 "FC Control Trace Buf\n"); ··· 570 568 fnic_fc_trace_max_pages * PAGE_SIZE); 571 569 572 570 /* Allocate memory for page offset */ 573 - fc_trace_entries.page_offset = vmalloc(fc_trace_max_entries * 574 - sizeof(unsigned long)); 571 + fc_trace_entries.page_offset = 572 + vmalloc(array_size(fc_trace_max_entries, 573 + sizeof(unsigned long))); 575 574 if (!fc_trace_entries.page_offset) { 576 575 pr_err("fnic:Failed to allocate memory for page_offset\n"); 577 576 if (fnic_fc_ctlr_trace_buf_p) {
+4 -2
drivers/scsi/ipr.c
··· 4331 4331 } 4332 4332 4333 4333 if (ioa_cfg->sis64) 4334 - ioa_data = vmalloc(IPR_FMT3_MAX_NUM_DUMP_PAGES * sizeof(__be32 *)); 4334 + ioa_data = vmalloc(array_size(IPR_FMT3_MAX_NUM_DUMP_PAGES, 4335 + sizeof(__be32 *))); 4335 4336 else 4336 - ioa_data = vmalloc(IPR_FMT2_MAX_NUM_DUMP_PAGES * sizeof(__be32 *)); 4337 + ioa_data = vmalloc(array_size(IPR_FMT2_MAX_NUM_DUMP_PAGES, 4338 + sizeof(__be32 *))); 4337 4339 4338 4340 if (!ioa_data) { 4339 4341 ipr_err("Dump memory allocation failed\n");
+1 -1
drivers/scsi/osst.c
··· 1488 1488 int dbg = debugging; 1489 1489 #endif 1490 1490 1491 - if ((buffer = vmalloc((nframes + 1) * OS_DATA_SIZE)) == NULL) 1491 + if ((buffer = vmalloc(array_size((nframes + 1), OS_DATA_SIZE))) == NULL) 1492 1492 return (-EIO); 1493 1493 1494 1494 printk(KERN_INFO "%s:I: Reading back %d frames from drive buffer%s\n",
+2 -1
drivers/scsi/scsi_debug.c
··· 5439 5439 } 5440 5440 5441 5441 map_size = lba_to_map_index(sdebug_store_sectors - 1) + 1; 5442 - map_storep = vmalloc(BITS_TO_LONGS(map_size) * sizeof(long)); 5442 + map_storep = vmalloc(array_size(sizeof(long), 5443 + BITS_TO_LONGS(map_size))); 5443 5444 5444 5445 pr_info("%lu provisioning blocks\n", map_size); 5445 5446
+2 -1
drivers/staging/android/ion/ion_heap.c
··· 25 25 pgprot_t pgprot; 26 26 struct sg_table *table = buffer->sg_table; 27 27 int npages = PAGE_ALIGN(buffer->size) / PAGE_SIZE; 28 - struct page **pages = vmalloc(sizeof(struct page *) * npages); 28 + struct page **pages = vmalloc(array_size(npages, 29 + sizeof(struct page *))); 29 30 struct page **tmp = pages; 30 31 31 32 if (!pages)
+3 -2
drivers/staging/greybus/camera.c
··· 1175 1175 1176 1176 gcam->debugfs.root = debugfs_create_dir(dirname, gb_debugfs_get()); 1177 1177 1178 - gcam->debugfs.buffers = vmalloc(sizeof(*gcam->debugfs.buffers) * 1179 - GB_CAMERA_DEBUGFS_BUFFER_MAX); 1178 + gcam->debugfs.buffers = 1179 + vmalloc(array_size(GB_CAMERA_DEBUGFS_BUFFER_MAX, 1180 + sizeof(*gcam->debugfs.buffers))); 1180 1181 if (!gcam->debugfs.buffers) 1181 1182 return -ENOMEM; 1182 1183
+2 -1
drivers/staging/media/zoran/zoran_driver.c
··· 1220 1220 } 1221 1221 } else if (clipcount) { 1222 1222 /* write our own bitmap from the clips */ 1223 - vcp = vmalloc(sizeof(struct v4l2_clip) * (clipcount + 4)); 1223 + vcp = vmalloc(array_size(sizeof(struct v4l2_clip), 1224 + clipcount + 4)); 1224 1225 if (vcp == NULL) { 1225 1226 dprintk(1, 1226 1227 KERN_ERR
+1 -1
drivers/staging/rts5208/ms.c
··· 2618 2618 segment = &ms_card->segment[seg_no]; 2619 2619 2620 2620 if (!segment->l2p_table) { 2621 - segment->l2p_table = vmalloc(table_size * 2); 2621 + segment->l2p_table = vmalloc(array_size(table_size, 2)); 2622 2622 if (!segment->l2p_table) { 2623 2623 rtsx_trace(chip); 2624 2624 goto BUILD_FAIL;
+1 -1
drivers/staging/rts5208/rtsx_chip.c
··· 1721 1721 1722 1722 dev_dbg(rtsx_dev(chip), "dw_len = %d\n", dw_len); 1723 1723 1724 - data = vmalloc(dw_len * 4); 1724 + data = vmalloc(array_size(dw_len, 4)); 1725 1725 if (!data) { 1726 1726 rtsx_trace(chip); 1727 1727 return STATUS_NOMEM;
+1 -1
drivers/usb/misc/sisusbvga/sisusb_con.c
··· 1243 1243 } 1244 1244 1245 1245 if (!sisusb->font_backup) 1246 - sisusb->font_backup = vmalloc(charcount * 32); 1246 + sisusb->font_backup = vmalloc(array_size(charcount, 32)); 1247 1247 1248 1248 if (sisusb->font_backup) { 1249 1249 memcpy(sisusb->font_backup, font->data, charcount * 32);
+1 -1
drivers/video/fbdev/xen-fbfront.c
··· 412 412 413 413 info->nr_pages = (fb_size + PAGE_SIZE - 1) >> PAGE_SHIFT; 414 414 415 - info->gfns = vmalloc(sizeof(unsigned long) * info->nr_pages); 415 + info->gfns = vmalloc(array_size(sizeof(unsigned long), info->nr_pages)); 416 416 if (!info->gfns) 417 417 goto error_nomem; 418 418
+1 -1
fs/binfmt_elf.c
··· 2294 2294 2295 2295 if (segs - 1 > ULONG_MAX / sizeof(*vma_filesz)) 2296 2296 goto end_coredump; 2297 - vma_filesz = vmalloc((segs - 1) * sizeof(*vma_filesz)); 2297 + vma_filesz = vmalloc(array_size(sizeof(*vma_filesz), (segs - 1))); 2298 2298 if (!vma_filesz) 2299 2299 goto end_coredump; 2300 2300
+2 -2
fs/cifs/misc.c
··· 789 789 GFP_KERNEL); 790 790 791 791 if (!bv) { 792 - bv = vmalloc(max_pages * sizeof(struct bio_vec)); 792 + bv = vmalloc(array_size(max_pages, sizeof(struct bio_vec))); 793 793 if (!bv) 794 794 return -ENOMEM; 795 795 } ··· 799 799 GFP_KERNEL); 800 800 801 801 if (!pages) { 802 - pages = vmalloc(max_pages * sizeof(struct page *)); 802 + pages = vmalloc(array_size(max_pages, sizeof(struct page *))); 803 803 if (!pages) { 804 804 kvfree(bv); 805 805 return -ENOMEM;
+1 -1
fs/dlm/lockspace.c
··· 517 517 size = dlm_config.ci_rsbtbl_size; 518 518 ls->ls_rsbtbl_size = size; 519 519 520 - ls->ls_rsbtbl = vmalloc(sizeof(struct dlm_rsbtable) * size); 520 + ls->ls_rsbtbl = vmalloc(array_size(size, sizeof(struct dlm_rsbtable))); 521 521 if (!ls->ls_rsbtbl) 522 522 goto out_lsfree; 523 523 for (i = 0; i < size; i++) {
+1 -1
fs/reiserfs/bitmap.c
··· 1456 1456 struct reiserfs_bitmap_info *bitmap; 1457 1457 unsigned int bmap_nr = reiserfs_bmap_count(sb); 1458 1458 1459 - bitmap = vmalloc(sizeof(*bitmap) * bmap_nr); 1459 + bitmap = vmalloc(array_size(bmap_nr, sizeof(*bitmap))); 1460 1460 if (bitmap == NULL) 1461 1461 return -ENOMEM; 1462 1462
+6 -3
fs/ubifs/lpt.c
··· 632 632 pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_KERNEL); 633 633 nnode = kzalloc(sizeof(struct ubifs_nnode), GFP_KERNEL); 634 634 buf = vmalloc(c->leb_size); 635 - ltab = vmalloc(sizeof(struct ubifs_lpt_lprops) * c->lpt_lebs); 635 + ltab = vmalloc(array_size(sizeof(struct ubifs_lpt_lprops), 636 + c->lpt_lebs)); 636 637 if (!pnode || !nnode || !buf || !ltab || !lsave) { 637 638 err = -ENOMEM; 638 639 goto out; ··· 1627 1626 { 1628 1627 int err, i; 1629 1628 1630 - c->ltab = vmalloc(sizeof(struct ubifs_lpt_lprops) * c->lpt_lebs); 1629 + c->ltab = vmalloc(array_size(sizeof(struct ubifs_lpt_lprops), 1630 + c->lpt_lebs)); 1631 1631 if (!c->ltab) 1632 1632 return -ENOMEM; 1633 1633 ··· 1692 1690 { 1693 1691 int err, i; 1694 1692 1695 - c->ltab_cmt = vmalloc(sizeof(struct ubifs_lpt_lprops) * c->lpt_lebs); 1693 + c->ltab_cmt = vmalloc(array_size(sizeof(struct ubifs_lpt_lprops), 1694 + c->lpt_lebs)); 1696 1695 if (!c->ltab_cmt) 1697 1696 return -ENOMEM; 1698 1697
+1 -1
kernel/cgroup/cgroup-v1.c
··· 195 195 static void *pidlist_allocate(int count) 196 196 { 197 197 if (PIDLIST_TOO_LARGE(count)) 198 - return vmalloc(count * sizeof(pid_t)); 198 + return vmalloc(array_size(count, sizeof(pid_t))); 199 199 else 200 200 return kmalloc_array(count, sizeof(pid_t), GFP_KERNEL); 201 201 }
+3 -3
kernel/power/swap.c
··· 698 698 goto out_clean; 699 699 } 700 700 701 - data = vmalloc(sizeof(*data) * nr_threads); 701 + data = vmalloc(array_size(nr_threads, sizeof(*data))); 702 702 if (!data) { 703 703 pr_err("Failed to allocate LZO data\n"); 704 704 ret = -ENOMEM; ··· 1183 1183 nr_threads = num_online_cpus() - 1; 1184 1184 nr_threads = clamp_val(nr_threads, 1, LZO_THREADS); 1185 1185 1186 - page = vmalloc(sizeof(*page) * LZO_MAX_RD_PAGES); 1186 + page = vmalloc(array_size(LZO_MAX_RD_PAGES, sizeof(*page))); 1187 1187 if (!page) { 1188 1188 pr_err("Failed to allocate LZO page\n"); 1189 1189 ret = -ENOMEM; 1190 1190 goto out_clean; 1191 1191 } 1192 1192 1193 - data = vmalloc(sizeof(*data) * nr_threads); 1193 + data = vmalloc(array_size(nr_threads, sizeof(*data))); 1194 1194 if (!data) { 1195 1195 pr_err("Failed to allocate LZO data\n"); 1196 1196 ret = -ENOMEM;
+3 -2
kernel/rcu/rcutorture.c
··· 831 831 cbflood_intra_holdoff > 0 && 832 832 cur_ops->call && 833 833 cur_ops->cb_barrier) { 834 - rhp = vmalloc(sizeof(*rhp) * 835 - cbflood_n_burst * cbflood_n_per_burst); 834 + rhp = vmalloc(array3_size(cbflood_n_burst, 835 + cbflood_n_per_burst, 836 + sizeof(*rhp))); 836 837 err = !rhp; 837 838 } 838 839 if (err) {
+1 -1
kernel/trace/tracing_map.c
··· 1075 1075 struct tracing_map_sort_entry *sort_entry, **entries; 1076 1076 int i, n_entries, ret; 1077 1077 1078 - entries = vmalloc(map->max_elts * sizeof(sort_entry)); 1078 + entries = vmalloc(array_size(sizeof(sort_entry), map->max_elts)); 1079 1079 if (!entries) 1080 1080 return -ENOMEM; 1081 1081
+1 -1
mm/percpu-stats.c
··· 144 144 spin_unlock_irq(&pcpu_lock); 145 145 146 146 /* there can be at most this many free and allocated fragments */ 147 - buffer = vmalloc((2 * max_nr_alloc + 1) * sizeof(int)); 147 + buffer = vmalloc(array_size(sizeof(int), (2 * max_nr_alloc + 1))); 148 148 if (!buffer) 149 149 return -ENOMEM; 150 150
+6 -5
net/bridge/netfilter/ebtables.c
··· 903 903 * if an error occurs 904 904 */ 905 905 newinfo->chainstack = 906 - vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack))); 906 + vmalloc(array_size(nr_cpu_ids, 907 + sizeof(*(newinfo->chainstack)))); 907 908 if (!newinfo->chainstack) 908 909 return -ENOMEM; 909 910 for_each_possible_cpu(i) { 910 911 newinfo->chainstack[i] = 911 - vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0]))); 912 + vmalloc(array_size(udc_cnt, sizeof(*(newinfo->chainstack[0])))); 912 913 if (!newinfo->chainstack[i]) { 913 914 while (i) 914 915 vfree(newinfo->chainstack[--i]); ··· 919 918 } 920 919 } 921 920 922 - cl_s = vmalloc(udc_cnt * sizeof(*cl_s)); 921 + cl_s = vmalloc(array_size(udc_cnt, sizeof(*cl_s))); 923 922 if (!cl_s) 924 923 return -ENOMEM; 925 924 i = 0; /* the i'th udc */ ··· 1294 1293 if (num_counters == 0) 1295 1294 return -EINVAL; 1296 1295 1297 - tmp = vmalloc(num_counters * sizeof(*tmp)); 1296 + tmp = vmalloc(array_size(num_counters, sizeof(*tmp))); 1298 1297 if (!tmp) 1299 1298 return -ENOMEM; 1300 1299 ··· 1435 1434 return -EINVAL; 1436 1435 } 1437 1436 1438 - counterstmp = vmalloc(nentries * sizeof(*counterstmp)); 1437 + counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp))); 1439 1438 if (!counterstmp) 1440 1439 return -ENOMEM; 1441 1440
+2 -1
net/netfilter/ipvs/ip_vs_conn.c
··· 1380 1380 /* 1381 1381 * Allocate the connection hash table and initialize its list heads 1382 1382 */ 1383 - ip_vs_conn_tab = vmalloc(ip_vs_conn_tab_size * sizeof(*ip_vs_conn_tab)); 1383 + ip_vs_conn_tab = vmalloc(array_size(ip_vs_conn_tab_size, 1384 + sizeof(*ip_vs_conn_tab))); 1384 1385 if (!ip_vs_conn_tab) 1385 1386 return -ENOMEM; 1386 1387
+2 -1
sound/core/seq/seq_memory.c
··· 389 389 if (snd_BUG_ON(!pool)) 390 390 return -EINVAL; 391 391 392 - cellptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size); 392 + cellptr = vmalloc(array_size(sizeof(struct snd_seq_event_cell), 393 + pool->size)); 393 394 if (!cellptr) 394 395 return -ENOMEM; 395 396
+3 -2
sound/pci/cs46xx/dsp_spos.c
··· 240 240 return NULL; 241 241 242 242 /* better to use vmalloc for this big table */ 243 - ins->symbol_table.symbols = vmalloc(sizeof(struct dsp_symbol_entry) * 244 - DSP_MAX_SYMBOLS); 243 + ins->symbol_table.symbols = 244 + vmalloc(array_size(DSP_MAX_SYMBOLS, 245 + sizeof(struct dsp_symbol_entry))); 245 246 ins->code.data = kmalloc(DSP_CODE_BYTE_SIZE, GFP_KERNEL); 246 247 ins->modules = kmalloc_array(DSP_MAX_MODULES, 247 248 sizeof(struct dsp_module_desc),
+5 -4
sound/pci/emu10k1/emu10k1_main.c
··· 1941 1941 (unsigned long)emu->ptb_pages.addr, 1942 1942 (unsigned long)(emu->ptb_pages.addr + emu->ptb_pages.bytes)); 1943 1943 1944 - emu->page_ptr_table = vmalloc(emu->max_cache_pages * sizeof(void *)); 1945 - emu->page_addr_table = vmalloc(emu->max_cache_pages * 1946 - sizeof(unsigned long)); 1944 + emu->page_ptr_table = vmalloc(array_size(sizeof(void *), 1945 + emu->max_cache_pages)); 1946 + emu->page_addr_table = vmalloc(array_size(sizeof(unsigned long), 1947 + emu->max_cache_pages)); 1947 1948 if (emu->page_ptr_table == NULL || emu->page_addr_table == NULL) { 1948 1949 err = -ENOMEM; 1949 1950 goto error; ··· 2100 2099 size = ARRAY_SIZE(saved_regs); 2101 2100 if (emu->audigy) 2102 2101 size += ARRAY_SIZE(saved_regs_audigy); 2103 - emu->saved_ptr = vmalloc(4 * NUM_G * size); 2102 + emu->saved_ptr = vmalloc(array3_size(4, NUM_G, size)); 2104 2103 if (!emu->saved_ptr) 2105 2104 return -ENOMEM; 2106 2105 if (snd_emu10k1_efx_alloc_pm_buffer(emu) < 0)
+1 -1
sound/pci/emu10k1/emufx.c
··· 2692 2692 if (! emu->tram_val_saved || ! emu->tram_addr_saved) 2693 2693 return -ENOMEM; 2694 2694 len = emu->audigy ? 2 * 1024 : 2 * 512; 2695 - emu->saved_icode = vmalloc(len * 4); 2695 + emu->saved_icode = vmalloc(array_size(len, 4)); 2696 2696 if (! emu->saved_icode) 2697 2697 return -ENOMEM; 2698 2698 return 0;
+1 -1
sound/pci/emu10k1/p16v.c
··· 874 874 875 875 int snd_p16v_alloc_pm_buffer(struct snd_emu10k1 *emu) 876 876 { 877 - emu->p16v_saved = vmalloc(NUM_CHS * 4 * 0x80); 877 + emu->p16v_saved = vmalloc(array_size(NUM_CHS * 4, 0x80)); 878 878 if (! emu->p16v_saved) 879 879 return -ENOMEM; 880 880 return 0;
+4 -1
sound/pci/maestro3.c
··· 2657 2657 chip->irq = pci->irq; 2658 2658 2659 2659 #ifdef CONFIG_PM_SLEEP 2660 - chip->suspend_mem = vmalloc(sizeof(u16) * (REV_B_CODE_MEMORY_LENGTH + REV_B_DATA_MEMORY_LENGTH)); 2660 + chip->suspend_mem = 2661 + vmalloc(array_size(sizeof(u16), 2662 + REV_B_CODE_MEMORY_LENGTH + 2663 + REV_B_DATA_MEMORY_LENGTH)); 2661 2664 if (chip->suspend_mem == NULL) 2662 2665 dev_warn(card->dev, "can't allocate apm buffer\n"); 2663 2666 #endif
+3 -1
sound/pci/trident/trident_main.c
··· 3362 3362 trident->tlb.entries = (unsigned int*)ALIGN((unsigned long)trident->tlb.buffer.area, SNDRV_TRIDENT_MAX_PAGES * 4); 3363 3363 trident->tlb.entries_dmaaddr = ALIGN(trident->tlb.buffer.addr, SNDRV_TRIDENT_MAX_PAGES * 4); 3364 3364 /* allocate shadow TLB page table (virtual addresses) */ 3365 - trident->tlb.shadow_entries = vmalloc(SNDRV_TRIDENT_MAX_PAGES*sizeof(unsigned long)); 3365 + trident->tlb.shadow_entries = 3366 + vmalloc(array_size(SNDRV_TRIDENT_MAX_PAGES, 3367 + sizeof(unsigned long))); 3366 3368 if (!trident->tlb.shadow_entries) 3367 3369 return -ENOMEM; 3368 3370
+2 -1
virt/kvm/kvm_main.c
··· 3059 3059 goto out; 3060 3060 if (routing.nr) { 3061 3061 r = -ENOMEM; 3062 - entries = vmalloc(routing.nr * sizeof(*entries)); 3062 + entries = vmalloc(array_size(sizeof(*entries), 3063 + routing.nr)); 3063 3064 if (!entries) 3064 3065 goto out; 3065 3066 r = -EFAULT;