Index: sys/amd64/amd64/bpf_jit_machdep.c =================================================================== --- sys/amd64/amd64/bpf_jit_machdep.c (revision 328307) +++ sys/amd64/amd64/bpf_jit_machdep.c (working copy) @@ -186,7 +186,7 @@ /* Allocate the reference table for the jumps. */ if (fjmp) { #ifdef _KERNEL - stream.refs = malloc((nins + 1) * sizeof(u_int), M_BPFJIT, + stream.refs = mallocarray(nins + 1, sizeof(u_int), M_BPFJIT, M_NOWAIT | M_ZERO); #else stream.refs = calloc(nins + 1, sizeof(u_int)); Index: sys/amd64/amd64/mem.c =================================================================== --- sys/amd64/amd64/mem.c (revision 328307) +++ sys/amd64/amd64/mem.c (working copy) @@ -212,7 +212,7 @@ nd = imin(mo->mo_arg[0], mem_range_softc.mr_ndesc); if (nd > 0) { md = (struct mem_range_desc *) - malloc(nd * sizeof(struct mem_range_desc), + mallocarray(nd, sizeof(struct mem_range_desc), M_MEMDESC, M_WAITOK); error = mem_range_attr_get(md, &nd); if (!error) Index: sys/amd64/sgx/sgx.c =================================================================== --- sys/amd64/sgx/sgx.c (revision 328307) +++ sys/amd64/sgx/sgx.c (working copy) @@ -1083,7 +1083,7 @@ epc_base_vaddr = (vm_offset_t)pmap_mapdev_attr(sc->epc_base, sc->epc_size, VM_MEMATTR_DEFAULT); - sc->epc_pages = malloc(sizeof(struct epc_page) * sc->npages, + sc->epc_pages = mallocarray(sc->npages, sizeof(struct epc_page), M_DEVBUF, M_WAITOK | M_ZERO); for (i = 0; i < sc->npages; i++) { Index: sys/arm/allwinner/aw_usbphy.c =================================================================== --- sys/arm/allwinner/aw_usbphy.c (revision 328307) +++ sys/arm/allwinner/aw_usbphy.c (working copy) @@ -241,10 +241,10 @@ if (error == 0) sc->vbus_det_valid = 1; - sc->reg = malloc(sizeof(*(sc->reg)) * sc->phy_conf->num_phys, M_DEVBUF, - M_WAITOK | M_ZERO); - sc->pmu = malloc(sizeof(*(sc->pmu)) * sc->phy_conf->num_phys, M_DEVBUF, - M_WAITOK | M_ZERO); + sc->reg = mallocarray(sc->phy_conf->num_phys, sizeof(*(sc->reg)), + M_DEVBUF, M_WAITOK | M_ZERO); + sc->pmu = mallocarray(sc->phy_conf->num_phys, sizeof(*(sc->pmu)), + M_DEVBUF, M_WAITOK | M_ZERO); /* Get regulators */ for (off = 0; off < sc->phy_conf->num_phys; off++) { snprintf(pname, sizeof(pname), "usb%d_vbus-supply", off); Index: sys/arm/arm/gic_fdt.c =================================================================== --- sys/arm/arm/gic_fdt.c (revision 328307) +++ sys/arm/arm/gic_fdt.c (working copy) @@ -245,8 +245,8 @@ if (sc->base.nranges == 0) return (0); - sc->base.ranges = malloc(sc->base.nranges * sizeof(sc->base.ranges[0]), - M_DEVBUF, M_WAITOK); + sc->base.ranges = mallocarray(sc->base.nranges, + sizeof(sc->base.ranges[0]), M_DEVBUF, M_WAITOK); base_ranges = malloc(nbase_ranges, M_DEVBUF, M_WAITOK); OF_getencprop(node, "ranges", base_ranges, nbase_ranges); Index: sys/arm/at91/at91_pinctrl.c =================================================================== --- sys/arm/at91/at91_pinctrl.c (revision 328307) +++ sys/arm/at91/at91_pinctrl.c (working copy) @@ -181,7 +181,7 @@ if (sc->nranges == 0) return (0); - sc->ranges = malloc(sc->nranges * sizeof(sc->ranges[0]), + sc->ranges = mallocarray(sc->nranges, sizeof(sc->ranges[0]), M_DEVBUF, M_WAITOK); base_ranges = malloc(nbase_ranges, M_DEVBUF, M_WAITOK); OF_getencprop(node, "ranges", base_ranges, nbase_ranges); Index: sys/arm/mv/mv_pci_ctrl.c =================================================================== --- sys/arm/mv/mv_pci_ctrl.c (revision 328307) +++ sys/arm/mv/mv_pci_ctrl.c (working copy) @@ -296,7 +296,7 @@ if (sc->nranges == 0) return (0); - sc->ranges = malloc(sc->nranges * sizeof(sc->ranges[0]), + sc->ranges = mallocarray(sc->nranges, sizeof(sc->ranges[0]), M_DEVBUF, M_WAITOK); base_ranges = malloc(nbase_ranges, M_DEVBUF, M_WAITOK); OF_getencprop(node, "ranges", base_ranges, nbase_ranges); Index: sys/arm/xscale/ixp425/if_npe.c =================================================================== --- sys/arm/xscale/ixp425/if_npe.c (revision 328307) +++ sys/arm/xscale/ixp425/if_npe.c (working copy) @@ -515,7 +515,8 @@ return error; } /* XXX M_TEMP */ - dma->buf = malloc(nbuf * sizeof(struct npebuf), M_TEMP, M_NOWAIT | M_ZERO); + dma->buf = mallocarray(nbuf, sizeof(struct npebuf), M_TEMP, + M_NOWAIT | M_ZERO); if (dma->buf == NULL) { device_printf(sc->sc_dev, "unable to allocate memory for %s s/w buffers\n", Index: sys/arm64/arm64/busdma_bounce.c =================================================================== --- sys/arm64/arm64/busdma_bounce.c (revision 328307) +++ sys/arm64/arm64/busdma_bounce.c (working copy) @@ -302,8 +302,8 @@ error = 0; if (dmat->segments == NULL) { - dmat->segments = (bus_dma_segment_t *)malloc( - sizeof(bus_dma_segment_t) * dmat->common.nsegments, + dmat->segments = (bus_dma_segment_t *)mallocarray( + dmat->common.nsegments, sizeof(bus_dma_segment_t), M_DEVBUF, M_NOWAIT); if (dmat->segments == NULL) { CTR3(KTR_BUSDMA, "%s: tag %p error %d", Index: sys/arm64/arm64/gic_v3.c =================================================================== --- sys/arm64/arm64/gic_v3.c (revision 328307) +++ sys/arm64/arm64/gic_v3.c (working copy) @@ -242,9 +242,8 @@ * Allocate array of struct resource. * One entry for Distributor and all remaining for Re-Distributor. */ - sc->gic_res = malloc( - sizeof(*sc->gic_res) * (sc->gic_redists.nregions + 1), - M_GIC_V3, M_WAITOK); + sc->gic_res = mallocarray(sc->gic_redists.nregions + 1, + sizeof(*sc->gic_res), M_GIC_V3, M_WAITOK); /* Now allocate corresponding resources */ for (i = 0, rid = 0; i < (sc->gic_redists.nregions + 1); i++, rid++) { @@ -263,8 +262,8 @@ * Re-Dristributor interface */ /* Allocate space under region descriptions */ - sc->gic_redists.regions = malloc( - sizeof(*sc->gic_redists.regions) * sc->gic_redists.nregions, + sc->gic_redists.regions = mallocarray( + sc->gic_redists.nregions, sizeof(*sc->gic_redists.regions), M_GIC_V3, M_WAITOK); /* Fill-up bus_space information for each region. */ @@ -277,7 +276,7 @@ if (sc->gic_nirqs > GIC_I_NUM_MAX) sc->gic_nirqs = GIC_I_NUM_MAX; - sc->gic_irqs = malloc(sizeof(*sc->gic_irqs) * sc->gic_nirqs, + sc->gic_irqs = mallocarray(sc->gic_nirqs, sizeof(*sc->gic_irqs), M_GIC_V3, M_WAITOK | M_ZERO); name = device_get_nameunit(dev); for (irq = 0; irq < sc->gic_nirqs; irq++) { Index: sys/cam/cam_queue.c =================================================================== --- sys/cam/cam_queue.c (revision 328307) +++ sys/cam/cam_queue.c (working copy) @@ -126,7 +126,7 @@ KASSERT(new_size >= queue->entries, ("camq_resize: " "New queue size can't accommodate queued entries (%d < %d).", new_size, queue->entries)); - new_array = (cam_pinfo **)malloc(new_size * sizeof(cam_pinfo *), + new_array = (cam_pinfo **)mallocarray(new_size, sizeof(cam_pinfo *), M_CAMQ, M_NOWAIT); if (new_array == NULL) { /* Couldn't satisfy request */ Index: sys/cam/ctl/ctl_backend_ramdisk.c =================================================================== --- sys/cam/ctl/ctl_backend_ramdisk.c (revision 328307) +++ sys/cam/ctl/ctl_backend_ramdisk.c (working copy) @@ -494,8 +494,8 @@ off = lbaoff * cbe_lun->blocksize; op = (ARGS(io)->flags & CTL_LLF_WRITE) ? GP_WRITE : GP_READ; if (sgs > 1) { - io->scsiio.kern_data_ptr = malloc(sizeof(struct ctl_sg_entry) * - sgs, M_RAMDISK, M_WAITOK); + io->scsiio.kern_data_ptr = mallocarray(sgs, + sizeof(struct ctl_sg_entry), M_RAMDISK, M_WAITOK); sg_entries = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr; len = lbas * cbe_lun->blocksize; for (i = 0; i < sgs; i++) { Index: sys/cam/ctl/ctl_frontend.c =================================================================== --- sys/cam/ctl/ctl_frontend.c (revision 328307) +++ sys/cam/ctl/ctl_frontend.c (working copy) @@ -172,8 +172,8 @@ * Initialize the initiator and portname mappings */ port->max_initiators = CTL_MAX_INIT_PER_PORT; - port->wwpn_iid = malloc(sizeof(*port->wwpn_iid) * port->max_initiators, - M_CTL, M_NOWAIT | M_ZERO); + port->wwpn_iid = mallocarray(port->max_initiators, + sizeof(*port->wwpn_iid), M_CTL, M_NOWAIT | M_ZERO); if (port->wwpn_iid == NULL) { retval = ENOMEM; goto error; Index: sys/cam/scsi/scsi_ch.c =================================================================== --- sys/cam/scsi/scsi_ch.c (revision 328307) +++ sys/cam/scsi/scsi_ch.c (working copy) @@ -1354,7 +1354,7 @@ } user_data = (struct changer_element_status *) - malloc(avail * sizeof(struct changer_element_status), + mallocarray(avail, sizeof(struct changer_element_status), M_DEVBUF, M_WAITOK | M_ZERO); desc = (struct read_element_status_descriptor *)((uintptr_t)data + Index: sys/compat/freebsd32/freebsd32_capability.c =================================================================== --- sys/compat/freebsd32/freebsd32_capability.c (revision 328307) +++ sys/compat/freebsd32/freebsd32_capability.c (working copy) @@ -68,13 +68,15 @@ if (ncmds == 0) { cmds = NULL; } else { - cmds32 = malloc(sizeof(cmds32[0]) * ncmds, M_FILECAPS, M_WAITOK); + cmds32 = mallocarray(ncmds, sizeof(cmds32[0]), M_FILECAPS, + M_WAITOK); error = copyin(uap->cmds, cmds32, sizeof(cmds32[0]) * ncmds); if (error != 0) { free(cmds32, M_FILECAPS); return (error); } - cmds = malloc(sizeof(cmds[0]) * ncmds, M_FILECAPS, M_WAITOK); + cmds = mallocarray(ncmds, sizeof(cmds[0]), M_FILECAPS, + M_WAITOK); for (i = 0; i < ncmds; i++) cmds[i] = cmds32[i]; free(cmds32, M_FILECAPS); Index: sys/compat/ndis/kern_ndis.c =================================================================== --- sys/compat/ndis/kern_ndis.c (revision 328307) +++ sys/compat/ndis/kern_ndis.c (working copy) @@ -975,7 +975,7 @@ sc = arg; - sc->ndis_tmaps = malloc(sizeof(bus_dmamap_t) * sc->ndis_maxpkts, + sc->ndis_tmaps = mallocarray(sc->ndis_maxpkts, sizeof(bus_dmamap_t), M_DEVBUF, M_NOWAIT|M_ZERO); if (sc->ndis_tmaps == NULL) Index: sys/compat/ndis/subr_ndis.c =================================================================== --- sys/compat/ndis/subr_ndis.c (revision 328307) +++ sys/compat/ndis/subr_ndis.c (working copy) @@ -1351,7 +1351,7 @@ block = (ndis_miniport_block *)adapter; sc = device_get_softc(block->nmb_physdeviceobj->do_devext); - sc->ndis_mmaps = malloc(sizeof(bus_dmamap_t) * physmapneeded, + sc->ndis_mmaps = mallocarray(physmapneeded, sizeof(bus_dmamap_t), M_DEVBUF, M_NOWAIT|M_ZERO); if (sc->ndis_mmaps == NULL) Index: sys/crypto/aesni/aesni.c =================================================================== --- sys/crypto/aesni/aesni.c (revision 328307) +++ sys/crypto/aesni/aesni.c (working copy) @@ -183,9 +183,9 @@ return (ENOMEM); } - ctx_mtx = malloc(sizeof *ctx_mtx * (mp_maxid + 1), M_AESNI, + ctx_mtx = mallocarray(mp_maxid + 1, sizeof *ctx_mtx, M_AESNI, M_WAITOK|M_ZERO); - ctx_fpu = malloc(sizeof *ctx_fpu * (mp_maxid + 1), M_AESNI, + ctx_fpu = mallocarray(mp_maxid + 1, sizeof *ctx_fpu, M_AESNI, M_WAITOK|M_ZERO); CPU_FOREACH(i) { Index: sys/crypto/armv8/armv8_crypto.c =================================================================== --- sys/crypto/armv8/armv8_crypto.c (revision 328307) +++ sys/crypto/armv8/armv8_crypto.c (working copy) @@ -143,9 +143,9 @@ rw_init(&sc->lock, "armv8crypto"); - ctx_mtx = malloc(sizeof(*ctx_mtx) * (mp_maxid + 1), M_ARMV8_CRYPTO, + ctx_mtx = mallocarray(mp_maxid + 1, sizeof(*ctx_mtx), M_ARMV8_CRYPTO, M_WAITOK|M_ZERO); - ctx_vfp = malloc(sizeof(*ctx_vfp) * (mp_maxid + 1), M_ARMV8_CRYPTO, + ctx_vfp = mallocarray(mp_maxid + 1, sizeof(*ctx_vfp), M_ARMV8_CRYPTO, M_WAITOK|M_ZERO); CPU_FOREACH(i) { Index: sys/dev/aacraid/aacraid.c =================================================================== --- sys/dev/aacraid/aacraid.c (revision 328307) +++ sys/dev/aacraid/aacraid.c (working copy) @@ -1458,7 +1458,7 @@ int i, j, pos; u_int32_t addr_low; - sge = malloc(nseg_new * sizeof(struct aac_sge_ieee1212), + sge = mallocarray(nseg_new, sizeof(struct aac_sge_ieee1212), M_AACRAIDBUF, M_NOWAIT|M_ZERO); if (sge == NULL) return nseg; Index: sys/dev/acpi_support/atk0110.c =================================================================== --- sys/dev/acpi_support/atk0110.c (revision 328307) +++ sys/dev/acpi_support/atk0110.c (working copy) @@ -282,8 +282,8 @@ } bp = buf.Pointer; - sc->sc_asens_all = malloc(sizeof(*sc->sc_asens_all) * bp->Package.Count, - M_DEVBUF, M_WAITOK | M_ZERO); + sc->sc_asens_all = mallocarray(bp->Package.Count, + sizeof(*sc->sc_asens_all), M_DEVBUF, M_WAITOK | M_ZERO); v = t = f = 0; for (i = 0; i < bp->Package.Count; i++) { sensor = &sc->sc_asens_all[i]; @@ -397,7 +397,7 @@ return (ENXIO); } - as = malloc(sizeof(*as) * n, M_DEVBUF, M_WAITOK | M_ZERO); + as = mallocarray(n, sizeof(*as), M_DEVBUF, M_WAITOK | M_ZERO); switch (st) { case AIBS_SENS_TYPE_VOLT: sc->sc_asens_volt = as; Index: sys/dev/acpica/acpi_battery.c =================================================================== --- sys/dev/acpica/acpi_battery.c (revision 328307) +++ sys/dev/acpica/acpi_battery.c (working copy) @@ -141,8 +141,8 @@ * Allocate storage for all _BST data, their derived battinfo data, * and the current battery's _BIF data. */ - bst = malloc(devcount * sizeof(*bst), M_TEMP, M_WAITOK | M_ZERO); - bi = malloc(devcount * sizeof(*bi), M_TEMP, M_WAITOK | M_ZERO); + bst = mallocarray(devcount, sizeof(*bst), M_TEMP, M_WAITOK | M_ZERO); + bi = mallocarray(devcount, sizeof(*bi), M_TEMP, M_WAITOK | M_ZERO); bif = malloc(sizeof(*bif), M_TEMP, M_WAITOK | M_ZERO); /* Index: sys/dev/adlink/adlink.c =================================================================== --- sys/dev/adlink/adlink.c (revision 328307) +++ sys/dev/adlink/adlink.c (working copy) @@ -249,7 +249,7 @@ sample = (uint64_t *)(sc->p0 + 1); sc->p0->o_sample = (uintptr_t)sample - (uintptr_t)(sc->p0); - pg = malloc(sizeof *pg * sc->nchunks, + pg = mallocarray(sc->nchunks, sizeof(*pg), M_DEVBUF, M_WAITOK | M_ZERO); sc->chunks = pg; for (i = 0; i < sc->nchunks; i++) { Index: sys/dev/advansys/advansys.c =================================================================== --- sys/dev/advansys/advansys.c (revision 328307) +++ sys/dev/advansys/advansys.c (working copy) @@ -1255,7 +1255,7 @@ * a transaction and use it for mapping the queue to the * upper level SCSI transaction it represents. */ - adv->ccb_infos = malloc(sizeof(*adv->ccb_infos) * adv->max_openings, + adv->ccb_infos = mallocarray(adv->max_openings, sizeof(*adv->ccb_infos), M_DEVBUF, M_NOWAIT); if (adv->ccb_infos == NULL) Index: sys/dev/ath/if_ath_rx_edma.c =================================================================== --- sys/dev/ath/if_ath_rx_edma.c (revision 328307) +++ sys/dev/ath/if_ath_rx_edma.c (working copy) @@ -901,9 +901,8 @@ re->m_fifolen); /* Allocate ath_buf FIFO array, pre-zero'ed */ - re->m_fifo = malloc(sizeof(struct ath_buf *) * re->m_fifolen, - M_ATHDEV, - M_NOWAIT | M_ZERO); + re->m_fifo = mallocarray(re->m_fifolen, sizeof(struct ath_buf *), + M_ATHDEV, M_NOWAIT | M_ZERO); if (re->m_fifo == NULL) { device_printf(sc->sc_dev, "%s: malloc failed\n", __func__); Index: sys/dev/beri/virtio/virtio.c =================================================================== --- sys/dev/beri/virtio/virtio.c (revision 328307) +++ sys/dev/beri/virtio/virtio.c (working copy) @@ -250,7 +250,7 @@ struct iovec *tiov; int i; - tiov = malloc(n * sizeof(struct iovec), M_DEVBUF, M_NOWAIT); + tiov = mallocarray(n, sizeof(struct iovec), M_DEVBUF, M_NOWAIT); for (i = 0; i < n; i++) { tiov[i].iov_base = iov[i].iov_base; tiov[i].iov_len = iov[i].iov_len; Index: sys/dev/bnxt/if_bnxt.c =================================================================== --- sys/dev/bnxt/if_bnxt.c (revision 328307) +++ sys/dev/bnxt/if_bnxt.c (working copy) @@ -351,7 +351,7 @@ softc = iflib_get_softc(ctx); - softc->tx_cp_rings = malloc(sizeof(struct bnxt_cp_ring) * ntxqsets, + softc->tx_cp_rings = mallocarray(ntxqsets, sizeof(struct bnxt_cp_ring), M_DEVBUF, M_NOWAIT | M_ZERO); if (!softc->tx_cp_rings) { device_printf(iflib_get_dev(ctx), @@ -359,7 +359,7 @@ rc = ENOMEM; goto cp_alloc_fail; } - softc->tx_rings = malloc(sizeof(struct bnxt_ring) * ntxqsets, + softc->tx_rings = mallocarray(ntxqsets, sizeof(struct bnxt_ring), M_DEVBUF, M_NOWAIT | M_ZERO); if (!softc->tx_rings) { device_printf(iflib_get_dev(ctx), @@ -446,7 +446,7 @@ softc = iflib_get_softc(ctx); - softc->rx_cp_rings = malloc(sizeof(struct bnxt_cp_ring) * nrxqsets, + softc->rx_cp_rings = mallocarray(nrxqsets, sizeof(struct bnxt_cp_ring), M_DEVBUF, M_NOWAIT | M_ZERO); if (!softc->rx_cp_rings) { device_printf(iflib_get_dev(ctx), @@ -454,7 +454,7 @@ rc = ENOMEM; goto cp_alloc_fail; } - softc->rx_rings = malloc(sizeof(struct bnxt_ring) * nrxqsets, + softc->rx_rings = mallocarray(nrxqsets, sizeof(struct bnxt_ring), M_DEVBUF, M_NOWAIT | M_ZERO); if (!softc->rx_rings) { device_printf(iflib_get_dev(ctx), @@ -462,7 +462,7 @@ rc = ENOMEM; goto ring_alloc_fail; } - softc->ag_rings = malloc(sizeof(struct bnxt_ring) * nrxqsets, + softc->ag_rings = mallocarray(nrxqsets, sizeof(struct bnxt_ring), M_DEVBUF, M_NOWAIT | M_ZERO); if (!softc->ag_rings) { device_printf(iflib_get_dev(ctx), @@ -470,7 +470,7 @@ rc = ENOMEM; goto ag_alloc_fail; } - softc->grp_info = malloc(sizeof(struct bnxt_grp_info) * nrxqsets, + softc->grp_info = mallocarray(nrxqsets, sizeof(struct bnxt_grp_info), M_DEVBUF, M_NOWAIT | M_ZERO); if (!softc->grp_info) { device_printf(iflib_get_dev(ctx), @@ -540,9 +540,10 @@ softc->rx_rings[i].paddr = paddrs[i * nrxqs + 1]; /* Allocate the TPA start buffer */ - softc->rx_rings[i].tpa_start = malloc(sizeof(struct bnxt_full_tpa_start) * - (RX_TPA_START_CMPL_AGG_ID_MASK >> RX_TPA_START_CMPL_AGG_ID_SFT), - M_DEVBUF, M_NOWAIT | M_ZERO); + softc->rx_rings[i].tpa_start = mallocarray( + RX_TPA_START_CMPL_AGG_ID_MASK >> RX_TPA_START_CMPL_AGG_ID_SFT, + sizeof(struct bnxt_full_tpa_start), M_DEVBUF, + M_NOWAIT | M_ZERO); if (softc->rx_rings[i].tpa_start == NULL) { rc = -ENOMEM; device_printf(softc->dev, Index: sys/dev/bwn/if_bwn.c =================================================================== --- sys/dev/bwn/if_bwn.c (revision 328307) +++ sys/dev/bwn/if_bwn.c (working copy) @@ -2677,8 +2677,8 @@ if (for_tx) dr->dr_numslots = BWN_TXRING_SLOTS; - dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta), - M_DEVBUF, M_NOWAIT | M_ZERO); + dr->dr_meta = mallocarray(dr->dr_numslots, + sizeof(struct bwn_dmadesc_meta), M_DEVBUF, M_NOWAIT | M_ZERO); if (dr->dr_meta == NULL) goto fail0; Index: sys/dev/bwn/if_bwn_phy_lp.c =================================================================== --- sys/dev/bwn/if_bwn_phy_lp.c (revision 328307) +++ sys/dev/bwn/if_bwn_phy_lp.c (working copy) @@ -1127,7 +1127,7 @@ uint8_t mode; int8_t txpwridx; - tabs = (uint32_t *)malloc(sizeof(uint32_t) * size, M_DEVBUF, + tabs = (uint32_t *)mallocarray(size, sizeof(uint32_t), M_DEVBUF, M_NOWAIT | M_ZERO); if (tabs == NULL) { device_printf(sc->sc_dev, "failed to allocate buffer.\n"); Index: sys/dev/ciss/ciss.c =================================================================== --- sys/dev/ciss/ciss.c (revision 328307) +++ sys/dev/ciss/ciss.c (working copy) @@ -1427,7 +1427,7 @@ } sc->ciss_logical = - malloc(sc->ciss_max_logical_bus * sizeof(struct ciss_ldrive *), + mallocarray(sc->ciss_max_logical_bus, sizeof(struct ciss_ldrive *), CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO); if (sc->ciss_logical == NULL) { error = ENXIO; @@ -1436,7 +1436,7 @@ for (i = 0; i < sc->ciss_max_logical_bus; i++) { sc->ciss_logical[i] = - malloc(sc->ciss_cfg->max_logical_supported * + mallocarray(sc->ciss_cfg->max_logical_supported, sizeof(struct ciss_ldrive), CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO); if (sc->ciss_logical[i] == NULL) { @@ -1549,7 +1549,7 @@ } sc->ciss_controllers = - malloc(sc->ciss_max_logical_bus * sizeof (union ciss_device_address), + mallocarray(sc->ciss_max_logical_bus, sizeof(union ciss_device_address), CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO); if (sc->ciss_controllers == NULL) { @@ -1566,7 +1566,7 @@ } sc->ciss_physical = - malloc(sc->ciss_max_physical_bus * sizeof(struct ciss_pdrive *), + mallocarray(sc->ciss_max_physical_bus, sizeof(struct ciss_pdrive *), CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO); if (sc->ciss_physical == NULL) { ciss_printf(sc, "Could not allocate memory for physical device map\n"); @@ -2873,7 +2873,7 @@ */ maxbus = max(sc->ciss_max_logical_bus, sc->ciss_max_physical_bus + CISS_PHYSICAL_BASE); - sc->ciss_cam_sim = malloc(maxbus * sizeof(struct cam_sim*), + sc->ciss_cam_sim = mallocarray(maxbus, sizeof(struct cam_sim*), CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO); if (sc->ciss_cam_sim == NULL) { ciss_printf(sc, "can't allocate memory for controller SIM\n"); Index: sys/dev/cpuctl/cpuctl.c =================================================================== --- sys/dev/cpuctl/cpuctl.c (revision 328307) +++ sys/dev/cpuctl/cpuctl.c (working copy) @@ -559,8 +559,8 @@ case MOD_LOAD: if (bootverbose) printf("cpuctl: access to MSR registers/cpuid info.\n"); - cpuctl_devs = malloc(sizeof(*cpuctl_devs) * (mp_maxid + 1), M_CPUCTL, - M_WAITOK | M_ZERO); + cpuctl_devs = mallocarray(mp_maxid + 1, sizeof(*cpuctl_devs), + M_CPUCTL, M_WAITOK | M_ZERO); CPU_FOREACH(cpu) if (cpu_enabled(cpu)) cpuctl_devs[cpu] = make_dev(&cpuctl_cdevsw, cpu, Index: sys/dev/cxgbe/crypto/t4_crypto.c =================================================================== --- sys/dev/cxgbe/crypto/t4_crypto.c (revision 328307) +++ sys/dev/cxgbe/crypto/t4_crypto.c (working copy) @@ -1900,7 +1900,7 @@ } } if (sess == -1) { - s = malloc(sizeof(*s) * (sc->nsessions + 1), M_CCR, + s = mallocarray(sc->nsessions + 1, sizeof(*s), M_CCR, M_NOWAIT | M_ZERO); if (s == NULL) { mtx_unlock(&sc->lock); Index: sys/dev/cxgbe/t4_vf.c =================================================================== --- sys/dev/cxgbe/t4_vf.c (revision 328307) +++ sys/dev/cxgbe/t4_vf.c (working copy) @@ -613,7 +613,7 @@ pi->adapter = sc; pi->port_id = i; pi->nvi = 1; - pi->vi = malloc(sizeof(struct vi_info) * pi->nvi, M_CXGBE, + pi->vi = mallocarray( pi->nvi, sizeof(struct vi_info), M_CXGBE, M_ZERO | M_WAITOK); /* @@ -665,16 +665,16 @@ s->neq += sc->params.nports + 1;/* ctrl queues: 1 per port + 1 mgmt */ s->niq = s->nrxq + 1; /* 1 extra for firmware event queue */ - s->rxq = malloc(s->nrxq * sizeof(struct sge_rxq), M_CXGBE, + s->rxq = mallocarray(s->nrxq, sizeof(struct sge_rxq), M_CXGBE, M_ZERO | M_WAITOK); - s->txq = malloc(s->ntxq * sizeof(struct sge_txq), M_CXGBE, + s->txq = mallocarray(s->ntxq, sizeof(struct sge_txq), M_CXGBE, M_ZERO | M_WAITOK); - s->iqmap = malloc(s->niq * sizeof(struct sge_iq *), M_CXGBE, + s->iqmap = mallocarray(s->niq, sizeof(struct sge_iq *), M_CXGBE, M_ZERO | M_WAITOK); - s->eqmap = malloc(s->neq * sizeof(struct sge_eq *), M_CXGBE, + s->eqmap = mallocarray(s->neq, sizeof(struct sge_eq *), M_CXGBE, M_ZERO | M_WAITOK); - sc->irq = malloc(sc->intr_count * sizeof(struct irq), M_CXGBE, + sc->irq = mallocarray(sc->intr_count, sizeof(struct irq), M_CXGBE, M_ZERO | M_WAITOK); /* Index: sys/dev/dpaa/fman.c =================================================================== --- sys/dev/dpaa/fman.c (revision 328307) +++ sys/dev/dpaa/fman.c (working copy) @@ -236,7 +236,7 @@ if (sc->nranges == 0) return (0); - sc->ranges = malloc(sc->nranges * sizeof(sc->ranges[0]), + sc->ranges = mallocarray(sc->nranges, sizeof(sc->ranges[0]), M_DEVBUF, M_WAITOK); base_ranges = malloc(nbase_ranges, M_DEVBUF, M_WAITOK); OF_getencprop(node, "ranges", base_ranges, nbase_ranges); Index: sys/dev/e1000/if_em.c =================================================================== --- sys/dev/e1000/if_em.c (revision 328307) +++ sys/dev/e1000/if_em.c (working copy) @@ -2835,9 +2835,9 @@ /* First allocate the top level queue structs */ if (!(adapter->tx_queues = - (struct em_tx_queue *) malloc(sizeof(struct em_tx_queue) * - adapter->tx_num_queues, M_DEVBUF, M_NOWAIT | M_ZERO))) { - device_printf(iflib_get_dev(ctx), "Unable to allocate queue memory\n"); + (struct em_tx_queue *) mallocarray(adapter->tx_num_queues, + sizeof(struct em_tx_queue), M_DEVBUF, M_NOWAIT | M_ZERO))) { + device_printf(iflib_get_dev(ctx), "Unable to allocate queue memory\n"); return(ENOMEM); } @@ -2849,7 +2849,8 @@ que->me = txr->me = i; /* Allocate report status array */ - if (!(txr->tx_rsq = (qidx_t *) malloc(sizeof(qidx_t) * scctx->isc_ntxd[0], M_DEVBUF, M_NOWAIT | M_ZERO))) { + if (!(txr->tx_rsq = (qidx_t *) mallocarray(scctx->isc_ntxd[0], + sizeof(qidx_t), M_DEVBUF, M_NOWAIT | M_ZERO))) { device_printf(iflib_get_dev(ctx), "failed to allocate rs_idxs memory\n"); error = ENOMEM; goto fail; @@ -2881,8 +2882,8 @@ /* First allocate the top level queue structs */ if (!(adapter->rx_queues = - (struct em_rx_queue *) malloc(sizeof(struct em_rx_queue) * - adapter->rx_num_queues, M_DEVBUF, M_NOWAIT | M_ZERO))) { + (struct em_rx_queue *) mallocarray(adapter->rx_num_queues, + sizeof(struct em_rx_queue), M_DEVBUF, M_NOWAIT | M_ZERO))) { device_printf(iflib_get_dev(ctx), "Unable to allocate queue memory\n"); error = ENOMEM; goto fail; Index: sys/dev/esp/ncr53c9x.c =================================================================== --- sys/dev/esp/ncr53c9x.c (revision 328307) +++ sys/dev/esp/ncr53c9x.c (working copy) @@ -292,7 +292,7 @@ } else sc->sc_imess_self = 0; - sc->sc_tinfo = malloc(sc->sc_ntarg * sizeof(sc->sc_tinfo[0]), + sc->sc_tinfo = mallocarray(sc->sc_ntarg, sizeof(sc->sc_tinfo[0]), M_DEVBUF, M_NOWAIT | M_ZERO); if (sc->sc_tinfo == NULL) { device_printf(sc->sc_dev, Index: sys/dev/fb/splash.c =================================================================== --- sys/dev/fb/splash.c (revision 328307) +++ sys/dev/fb/splash.c (working copy) @@ -136,8 +136,8 @@ break; } if ((i >= decoders) && (decoders % DECODER_ARRAY_DELTA) == 0) { - p = malloc(sizeof(*p)*(decoders + DECODER_ARRAY_DELTA), - M_DEVBUF, M_NOWAIT); + p = mallocarray(decoders + DECODER_ARRAY_DELTA, + sizeof(*p), M_DEVBUF, M_NOWAIT); if (p == NULL) return ENOMEM; if (decoder_set != NULL) { Index: sys/dev/fb/vesa.c =================================================================== --- sys/dev/fb/vesa.c (revision 328307) +++ sys/dev/fb/vesa.c (working copy) @@ -937,7 +937,7 @@ /* expand the array if necessary */ if (modes >= vesa_vmode_max) { vesa_vmode_max += MODE_TABLE_DELTA; - p = malloc(sizeof(*vesa_vmode) * (vesa_vmode_max + 1), + p = mallocarray(vesa_vmode_max + 1, sizeof(*vesa_vmode), M_DEVBUF, M_WAITOK); #if VESA_DEBUG > 1 printf("vesa_bios_init(): modes:%d, vesa_mode_max:%d\n", Index: sys/dev/fdt/simplebus.c =================================================================== --- sys/dev/fdt/simplebus.c (revision 328307) +++ sys/dev/fdt/simplebus.c (working copy) @@ -206,7 +206,7 @@ if (sc->nranges == 0) return (0); - sc->ranges = malloc(sc->nranges * sizeof(sc->ranges[0]), + sc->ranges = mallocarray(sc->nranges, sizeof(sc->ranges[0]), M_DEVBUF, M_WAITOK); base_ranges = malloc(nbase_ranges, M_DEVBUF, M_WAITOK); OF_getencprop(node, "ranges", base_ranges, nbase_ranges); Index: sys/dev/firewire/fwdev.c =================================================================== --- sys/dev/firewire/fwdev.c (revision 328307) +++ sys/dev/firewire/fwdev.c (working copy) @@ -102,7 +102,7 @@ if (q->flag & (FWXFERQ_RUNNING | FWXFERQ_EXTBUF)) return (EBUSY); - q->bulkxfer = malloc(sizeof(struct fw_bulkxfer) * b->nchunk, + q->bulkxfer = mallocarray(b->nchunk, sizeof(struct fw_bulkxfer), M_FW, M_WAITOK); b->psize = roundup2(b->psize, sizeof(uint32_t)); Index: sys/dev/gpio/gpiobus.c =================================================================== --- sys/dev/gpio/gpiobus.c (revision 328307) +++ sys/dev/gpio/gpiobus.c (working copy) @@ -235,7 +235,7 @@ /* Pins = GPIO_PIN_MAX() + 1 */ sc->sc_npins++; - sc->sc_pins = malloc(sizeof(*sc->sc_pins) * sc->sc_npins, M_DEVBUF, + sc->sc_pins = mallocarray(sc->sc_npins, sizeof(*sc->sc_pins), M_DEVBUF, M_NOWAIT | M_ZERO); if (sc->sc_pins == NULL) return (ENOMEM); @@ -251,11 +251,11 @@ { /* Allocate pins and flags memory. */ - devi->pins = malloc(sizeof(uint32_t) * devi->npins, M_DEVBUF, + devi->pins = mallocarray(devi->npins, sizeof(uint32_t), M_DEVBUF, M_NOWAIT | M_ZERO); if (devi->pins == NULL) return (ENOMEM); - devi->flags = malloc(sizeof(uint32_t) * devi->npins, M_DEVBUF, + devi->flags = mallocarray(devi->npins, sizeof(uint32_t), M_DEVBUF, M_NOWAIT | M_ZERO); if (devi->flags == NULL) { free(devi->pins, M_DEVBUF); Index: sys/dev/gpio/gpioled_fdt.c =================================================================== --- sys/dev/gpio/gpioled_fdt.c (revision 328307) +++ sys/dev/gpio/gpioled_fdt.c (working copy) @@ -175,7 +175,7 @@ } if (total_leds) { - sc->sc_leds = malloc(sizeof(struct gpioled) * total_leds, + sc->sc_leds = mallocarray(total_leds, sizeof(struct gpioled), M_DEVBUF, M_WAITOK | M_ZERO); sc->sc_total_leds = 0; Index: sys/dev/gpio/ofw_gpiobus.c =================================================================== --- sys/dev/gpio/ofw_gpiobus.c (revision 328307) +++ sys/dev/gpio/ofw_gpiobus.c (working copy) @@ -418,7 +418,7 @@ OF_prop_free(gpios); return (npins); } - *pins = malloc(sizeof(struct gpiobus_pin) * npins, M_DEVBUF, + *pins = mallocarray(npins, sizeof(struct gpiobus_pin), M_DEVBUF, M_NOWAIT | M_ZERO); if (*pins == NULL) { OF_prop_free(gpios); Index: sys/dev/hwpmc/hwpmc_arm64.c =================================================================== --- sys/dev/hwpmc/hwpmc_arm64.c (revision 328307) +++ sys/dev/hwpmc/hwpmc_arm64.c (working copy) @@ -441,7 +441,7 @@ arm64_pcpu[cpu] = pac = malloc(sizeof(struct arm64_cpu), M_PMC, M_WAITOK | M_ZERO); - pac->pc_arm64pmcs = malloc(sizeof(struct pmc_hw) * arm64_npmcs, + pac->pc_arm64pmcs = mallocarray(arm64_npmcs, sizeof(struct pmc_hw), M_PMC, M_WAITOK | M_ZERO); pc = pmc_pcpu[cpu]; first_ri = md->pmd_classdep[PMC_MDEP_CLASS_INDEX_ARMV8].pcd_ri; @@ -492,7 +492,7 @@ * Allocate space for pointers to PMC HW descriptors and for * the MDEP structure used by MI code. */ - arm64_pcpu = malloc(sizeof(struct arm64_cpu *) * pmc_cpu_max(), + arm64_pcpu = mallocarray(pmc_cpu_max(), sizeof(struct arm64_cpu *), M_PMC, M_WAITOK | M_ZERO); /* Just one class */ Index: sys/dev/hwpmc/hwpmc_powerpc.c =================================================================== --- sys/dev/hwpmc/hwpmc_powerpc.c (revision 328307) +++ sys/dev/hwpmc/hwpmc_powerpc.c (working copy) @@ -153,8 +153,8 @@ * Allocate space for pointers to PMC HW descriptors and for * the MDEP structure used by MI code. */ - powerpc_pcpu = malloc(sizeof(struct powerpc_cpu *) * pmc_cpu_max(), M_PMC, - M_WAITOK|M_ZERO); + powerpc_pcpu = mallocarray(pmc_cpu_max(), sizeof(struct powerpc_cpu *), + M_PMC, M_WAITOK|M_ZERO); /* Just one class */ pmc_mdep = pmc_mdep_alloc(1); Index: sys/dev/hwpmc/hwpmc_tsc.c =================================================================== --- sys/dev/hwpmc/hwpmc_tsc.c (revision 328307) +++ sys/dev/hwpmc/hwpmc_tsc.c (working copy) @@ -335,7 +335,7 @@ KASSERT(md->pmd_nclass >= 1, ("[tsc,%d] dubious md->nclass %d", __LINE__, md->pmd_nclass)); - tsc_pcpu = malloc(sizeof(struct tsc_cpu *) * maxcpu, M_PMC, + tsc_pcpu = mallocarray(maxcpu, sizeof(struct tsc_cpu *), M_PMC, M_ZERO|M_WAITOK); pcd = &md->pmd_classdep[PMC_MDEP_CLASS_INDEX_TSC]; Index: sys/dev/hwpmc/hwpmc_xscale.c =================================================================== --- sys/dev/hwpmc/hwpmc_xscale.c (revision 328307) +++ sys/dev/hwpmc/hwpmc_xscale.c (working copy) @@ -571,8 +571,8 @@ xscale_pcpu[cpu] = pac = malloc(sizeof(struct xscale_cpu), M_PMC, M_WAITOK|M_ZERO); - pac->pc_xscalepmcs = malloc(sizeof(struct pmc_hw) * xscale_npmcs, - M_PMC, M_WAITOK|M_ZERO); + pac->pc_xscalepmcs = mallocarray(xscale_npmcs, + sizeof(struct pmc_hw), M_PMC, M_WAITOK|M_ZERO); pc = pmc_pcpu[cpu]; first_ri = md->pmd_classdep[PMC_MDEP_CLASS_INDEX_XSCALE].pcd_ri; KASSERT(pc != NULL, ("[xscale,%d] NULL per-cpu pointer", __LINE__)); @@ -633,8 +633,8 @@ * Allocate space for pointers to PMC HW descriptors and for * the MDEP structure used by MI code. */ - xscale_pcpu = malloc(sizeof(struct xscale_cpu *) * pmc_cpu_max(), M_PMC, - M_WAITOK|M_ZERO); + xscale_pcpu = mallocarray(pmc_cpu_max(), sizeof(struct xscale_cpu *), + M_PMC, M_WAITOK|M_ZERO); /* Just one class */ pmc_mdep = pmc_mdep_alloc(1); Index: sys/dev/if_ndis/if_ndis.c =================================================================== --- sys/dev/if_ndis/if_ndis.c (revision 328307) +++ sys/dev/if_ndis/if_ndis.c (working copy) @@ -665,8 +665,8 @@ if (sc->ndis_maxpkts == 0) sc->ndis_maxpkts = 10; - sc->ndis_txarray = malloc(sizeof(ndis_packet *) * - sc->ndis_maxpkts, M_DEVBUF, M_NOWAIT|M_ZERO); + sc->ndis_txarray = mallocarray(sc->ndis_maxpkts, + sizeof(ndis_packet *), M_DEVBUF, M_NOWAIT|M_ZERO); /* Allocate a pool of ndis_packets for TX encapsulation. */ Index: sys/dev/iicbus/iic.c =================================================================== --- sys/dev/iicbus/iic.c (revision 328307) +++ sys/dev/iicbus/iic.c (working copy) @@ -305,7 +305,7 @@ if (d->nmsgs > IIC_RDRW_MAX_MSGS) return (EINVAL); - buf = malloc(sizeof(*d->msgs) * d->nmsgs, M_IIC, M_WAITOK); + buf = mallocarray(d->nmsgs, sizeof(*d->msgs), M_IIC, M_WAITOK); error = copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs); if (error != 0) { @@ -314,7 +314,8 @@ } /* Alloc kernel buffers for userland data, copyin write data */ - usrbufs = malloc(sizeof(void *) * d->nmsgs, M_IIC, M_WAITOK | M_ZERO); + usrbufs = mallocarray(d->nmsgs, sizeof(void *), M_IIC, + M_WAITOK | M_ZERO); for (i = 0; i < d->nmsgs; i++) { m = &(buf[i]); Index: sys/dev/iwi/if_iwi.c =================================================================== --- sys/dev/iwi/if_iwi.c (revision 328307) +++ sys/dev/iwi/if_iwi.c (working copy) @@ -640,7 +640,7 @@ goto fail; } - ring->data = malloc(count * sizeof (struct iwi_tx_data), M_DEVBUF, + ring->data = mallocarray(count, sizeof(struct iwi_tx_data), M_DEVBUF, M_NOWAIT | M_ZERO); if (ring->data == NULL) { device_printf(sc->sc_dev, "could not allocate soft data\n"); @@ -748,7 +748,7 @@ ring->count = count; ring->cur = 0; - ring->data = malloc(count * sizeof (struct iwi_rx_data), M_DEVBUF, + ring->data = mallocarray(count, sizeof(struct iwi_rx_data), M_DEVBUF, M_NOWAIT | M_ZERO); if (ring->data == NULL) { device_printf(sc->sc_dev, "could not allocate soft data\n"); Index: sys/dev/iwm/if_iwm_phy_db.c =================================================================== --- sys/dev/iwm/if_iwm_phy_db.c (revision 328307) +++ sys/dev/iwm/if_iwm_phy_db.c (working copy) @@ -330,8 +330,8 @@ * Firmware sends the largest index first, so we can use * it to know how much we should allocate. */ - phy_db->calib_ch_group_papd = malloc( - (chg_id + 1) * sizeof(struct iwm_phy_db_entry), + phy_db->calib_ch_group_papd = mallocarray( + chg_id + 1, sizeof(struct iwm_phy_db_entry), M_DEVBUF, M_NOWAIT | M_ZERO); if (!phy_db->calib_ch_group_papd) return ENOMEM; @@ -344,8 +344,8 @@ * Firmware sends the largest index first, so we can use * it to know how much we should allocate. */ - phy_db->calib_ch_group_txp = malloc( - (chg_id + 1) * sizeof(struct iwm_phy_db_entry), + phy_db->calib_ch_group_txp = mallocarray( + chg_id + 1, sizeof(struct iwm_phy_db_entry), M_DEVBUF, M_NOWAIT | M_ZERO); if (!phy_db->calib_ch_group_txp) return ENOMEM; Index: sys/dev/ixl/if_ixlv.c =================================================================== --- sys/dev/ixl/if_ixlv.c (revision 328307) +++ sys/dev/ixl/if_ixlv.c (working copy) @@ -1637,8 +1637,8 @@ /* Get memory for the station queues */ if (!(vsi->queues = - (struct ixl_queue *) malloc(sizeof(struct ixl_queue) * - vsi->num_queues, M_DEVBUF, M_NOWAIT | M_ZERO))) { + (struct ixl_queue *) mallocarray(vsi->num_queues, + sizeof(struct ixl_queue), M_DEVBUF, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate queue memory\n"); error = ENOMEM; goto early; Index: sys/dev/ixl/ixl_pf_iov.c =================================================================== --- sys/dev/ixl/ixl_pf_iov.c (revision 328307) +++ sys/dev/ixl/ixl_pf_iov.c (working copy) @@ -1695,8 +1695,8 @@ pf_vsi = &pf->vsi; IXL_PF_LOCK(pf); - pf->vfs = malloc(sizeof(struct ixl_vf) * num_vfs, M_IXL, M_NOWAIT | - M_ZERO); + pf->vfs = mallocarray(num_vfs, sizeof(struct ixl_vf), M_IXL, + M_NOWAIT | M_ZERO); if (pf->vfs == NULL) { error = ENOMEM; Index: sys/dev/ixl/ixl_pf_main.c =================================================================== --- sys/dev/ixl/ixl_pf_main.c (revision 328307) +++ sys/dev/ixl/ixl_pf_main.c (working copy) @@ -2431,8 +2431,8 @@ /* Get memory for the station queues */ if (!(vsi->queues = - (struct ixl_queue *) malloc(sizeof(struct ixl_queue) * - vsi->num_queues, M_DEVBUF, M_NOWAIT | M_ZERO))) { + (struct ixl_queue *) mallocarray(vsi->num_queues, + sizeof(struct ixl_queue), M_DEVBUF, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate queue memory\n"); error = ENOMEM; return (error); @@ -3317,7 +3317,7 @@ hw = &pf->hw; IXL_PF_LOCK_ASSERT(pf); - a = malloc(sizeof(struct i40e_aqc_add_macvlan_element_data) * cnt, + a = mallocarray(cnt, sizeof(struct i40e_aqc_add_macvlan_element_data), M_DEVBUF, M_NOWAIT | M_ZERO); if (a == NULL) { device_printf(dev, "add_hw_filters failed to get memory\n"); @@ -3380,7 +3380,8 @@ hw = &pf->hw; dev = pf->dev; - d = malloc(sizeof(struct i40e_aqc_remove_macvlan_element_data) * cnt, + d = mallocarray(cnt, + sizeof(struct i40e_aqc_remove_macvlan_element_data), M_DEVBUF, M_NOWAIT | M_ZERO); if (d == NULL) { printf("del hw filter failed to get memory\n"); Index: sys/dev/kbd/kbd.c =================================================================== --- sys/dev/kbd/kbd.c (revision 328307) +++ sys/dev/kbd/kbd.c (working copy) @@ -94,17 +94,18 @@ { keyboard_t **new_kbd; keyboard_switch_t **new_kbdsw; - int newsize; + u_int newsize; int s; s = spltty(); newsize = rounddown(keyboards + ARRAY_DELTA, ARRAY_DELTA); - new_kbd = malloc(sizeof(*new_kbd)*newsize, M_DEVBUF, M_NOWAIT|M_ZERO); + new_kbd = mallocarray(newsize, sizeof(*new_kbd), M_DEVBUF, + M_NOWAIT|M_ZERO); if (new_kbd == NULL) { splx(s); return (ENOMEM); } - new_kbdsw = malloc(sizeof(*new_kbdsw)*newsize, M_DEVBUF, + new_kbdsw = mallocarray(newsize, sizeof(*new_kbdsw), M_DEVBUF, M_NOWAIT|M_ZERO); if (new_kbdsw == NULL) { free(new_kbd, M_DEVBUF); Index: sys/dev/liquidio/base/lio_request_manager.c =================================================================== --- sys/dev/liquidio/base/lio_request_manager.c (revision 328307) +++ sys/dev/liquidio/base/lio_request_manager.c (working copy) @@ -110,7 +110,7 @@ * Initialize a list to holds requests that have been posted to * Octeon but has yet to be fetched by octeon */ - iq->request_list = malloc(sizeof(*iq->request_list) * num_descs, + iq->request_list = mallocarray(num_descs, sizeof(*iq->request_list), M_DEVBUF, M_NOWAIT | M_ZERO); if (iq->request_list == NULL) { lio_dev_err(oct, "Alloc failed for IQ[%d] nr free list\n", Index: sys/dev/liquidio/lio_main.c =================================================================== --- sys/dev/liquidio/lio_main.c (revision 328307) +++ sys/dev/liquidio/lio_main.c (working copy) @@ -1724,12 +1724,12 @@ struct lio_gather *g; int i, j; - lio->glist_lock = malloc(num_iqs * sizeof(*lio->glist_lock), M_DEVBUF, - M_NOWAIT | M_ZERO); + lio->glist_lock = mallocarray(num_iqs, sizeof(*lio->glist_lock), + M_DEVBUF, M_NOWAIT | M_ZERO); if (lio->glist_lock == NULL) return (1); - lio->ghead = malloc(num_iqs * sizeof(*lio->ghead), M_DEVBUF, + lio->ghead = mallocarray(num_iqs, sizeof(*lio->ghead), M_DEVBUF, M_NOWAIT | M_ZERO); if (lio->ghead == NULL) { free((void *)lio->glist_lock, M_DEVBUF); @@ -1743,10 +1743,10 @@ * allocate memory to store virtual and dma base address of * per glist consistent memory */ - lio->glists_virt_base = malloc(num_iqs * sizeof(void *), M_DEVBUF, + lio->glists_virt_base = mallocarray(num_iqs, sizeof(void *), M_DEVBUF, M_NOWAIT | M_ZERO); - lio->glists_dma_base = malloc(num_iqs * sizeof(vm_paddr_t), M_DEVBUF, - M_NOWAIT | M_ZERO); + lio->glists_dma_base = mallocarray(num_iqs, sizeof(vm_paddr_t), + M_DEVBUF, M_NOWAIT | M_ZERO); if ((lio->glists_virt_base == NULL) || (lio->glists_dma_base == NULL)) { lio_delete_glists(oct, lio); return (1); Index: sys/dev/md/md.c =================================================================== --- sys/dev/md/md.c (revision 328307) +++ sys/dev/md/md.c (working copy) @@ -889,7 +889,8 @@ zerosize = ZERO_REGION_SIZE - (ZERO_REGION_SIZE % sc->sectorsize); auio.uio_iovcnt = howmany(bp->bio_length, zerosize); - piov = malloc(sizeof(*piov) * auio.uio_iovcnt, M_MD, M_WAITOK); + piov = mallocarray(auio.uio_iovcnt, sizeof(*piov), M_MD, + M_WAITOK); auio.uio_iov = piov; while (len > 0) { piov->iov_base = __DECONST(void *, zero_region); Index: sys/dev/mpr/mpr.c =================================================================== --- sys/dev/mpr/mpr.c (revision 328307) +++ sys/dev/mpr/mpr.c (working copy) @@ -1192,7 +1192,7 @@ nq = sc->msi_msgs; mpr_dprint(sc, MPR_INIT|MPR_XINFO, "Allocating %d I/O queues\n", nq); - sc->queues = malloc(sizeof(struct mpr_queue) * nq, M_MPR, + sc->queues = mallocarray(nq, sizeof(struct mpr_queue), M_MPR, M_NOWAIT|M_ZERO); if (sc->queues == NULL) return (ENOMEM); Index: sys/dev/mpr/mpr_mapping.c =================================================================== --- sys/dev/mpr/mpr_mapping.c (revision 328307) +++ sys/dev/mpr/mpr_mapping.c (working copy) @@ -2141,27 +2141,27 @@ { uint32_t dpm_pg0_sz; - sc->mapping_table = malloc((sizeof(struct dev_mapping_table) * - sc->max_devices), M_MPR, M_ZERO|M_NOWAIT); + sc->mapping_table = mallocarray(sc->max_devices, + sizeof(struct dev_mapping_table), M_MPR, M_ZERO|M_NOWAIT); if (!sc->mapping_table) goto free_resources; - sc->removal_table = malloc((sizeof(struct map_removal_table) * - sc->max_devices), M_MPR, M_ZERO|M_NOWAIT); + sc->removal_table = mallocarray(sc->max_devices, + sizeof(struct map_removal_table), M_MPR, M_ZERO|M_NOWAIT); if (!sc->removal_table) goto free_resources; - sc->enclosure_table = malloc((sizeof(struct enc_mapping_table) * - sc->max_enclosures), M_MPR, M_ZERO|M_NOWAIT); + sc->enclosure_table = mallocarray(sc->max_enclosures, + sizeof(struct enc_mapping_table), M_MPR, M_ZERO|M_NOWAIT); if (!sc->enclosure_table) goto free_resources; - sc->dpm_entry_used = malloc((sizeof(u8) * sc->max_dpm_entries), + sc->dpm_entry_used = mallocarray(sc->max_dpm_entries, sizeof(u8), M_MPR, M_ZERO|M_NOWAIT); if (!sc->dpm_entry_used) goto free_resources; - sc->dpm_flush_entry = malloc((sizeof(u8) * sc->max_dpm_entries), + sc->dpm_flush_entry = mallocarray(sc->max_dpm_entries, sizeof(u8), M_MPR, M_ZERO|M_NOWAIT); if (!sc->dpm_flush_entry) goto free_resources; @@ -2912,7 +2912,7 @@ if (!num_entries) goto out; - phy_change = malloc(sizeof(struct _map_phy_change) * num_entries, + phy_change = mallocarray(num_entries, sizeof(struct _map_phy_change), M_MPR, M_NOWAIT|M_ZERO); topo_change.phy_details = phy_change; if (!phy_change) @@ -2963,7 +2963,7 @@ if (!num_entries) goto out; - port_change = malloc(sizeof(struct _map_port_change) * num_entries, + port_change = mallocarray(num_entries, sizeof(struct _map_port_change), M_MPR, M_NOWAIT|M_ZERO); topo_change.port_details = port_change; if (!port_change) @@ -3003,7 +3003,7 @@ struct dev_mapping_table *mt_entry; u16 element_flags; - wwid_table = malloc(sizeof(u64) * event_data->NumElements, M_MPR, + wwid_table = mallocarray(event_data->NumElements, sizeof(u64), M_MPR, M_NOWAIT | M_ZERO); if (!wwid_table) goto out; Index: sys/dev/mps/mps.c =================================================================== --- sys/dev/mps/mps.c (revision 328307) +++ sys/dev/mps/mps.c (working copy) @@ -1169,7 +1169,7 @@ nq = sc->msi_msgs; mps_dprint(sc, MPS_INIT|MPS_XINFO, "Allocating %d I/O queues\n", nq); - sc->queues = malloc(sizeof(struct mps_queue) * nq, M_MPT2, + sc->queues = mallocarray(nq, sizeof(struct mps_queue), M_MPT2, M_NOWAIT|M_ZERO); if (sc->queues == NULL) return (ENOMEM); Index: sys/dev/mps/mps_mapping.c =================================================================== --- sys/dev/mps/mps_mapping.c (revision 328307) +++ sys/dev/mps/mps_mapping.c (working copy) @@ -1694,27 +1694,27 @@ { uint32_t dpm_pg0_sz; - sc->mapping_table = malloc((sizeof(struct dev_mapping_table) * - sc->max_devices), M_MPT2, M_ZERO|M_NOWAIT); + sc->mapping_table = mallocarray(sc->max_devices, + sizeof(struct dev_mapping_table), M_MPT2, M_ZERO|M_NOWAIT); if (!sc->mapping_table) goto free_resources; - sc->removal_table = malloc((sizeof(struct map_removal_table) * - sc->max_devices), M_MPT2, M_ZERO|M_NOWAIT); + sc->removal_table = mallocarray(sc->max_devices, + sizeof(struct map_removal_table), M_MPT2, M_ZERO|M_NOWAIT); if (!sc->removal_table) goto free_resources; - sc->enclosure_table = malloc((sizeof(struct enc_mapping_table) * - sc->max_enclosures), M_MPT2, M_ZERO|M_NOWAIT); + sc->enclosure_table = mallocarray(sc->max_enclosures, + sizeof(struct enc_mapping_table), M_MPT2, M_ZERO|M_NOWAIT); if (!sc->enclosure_table) goto free_resources; - sc->dpm_entry_used = malloc((sizeof(u8) * sc->max_dpm_entries), + sc->dpm_entry_used = mallocarray(sc->max_dpm_entries, sizeof(u8), M_MPT2, M_ZERO|M_NOWAIT); if (!sc->dpm_entry_used) goto free_resources; - sc->dpm_flush_entry = malloc((sizeof(u8) * sc->max_dpm_entries), + sc->dpm_flush_entry = mallocarray(sc->max_dpm_entries, sizeof(u8), M_MPT2, M_ZERO|M_NOWAIT); if (!sc->dpm_flush_entry) goto free_resources; @@ -2451,7 +2451,7 @@ if (!num_entries) goto out; - phy_change = malloc(sizeof(struct _map_phy_change) * num_entries, + phy_change = mallocarray(num_entries, sizeof(struct _map_phy_change), M_MPT2, M_NOWAIT|M_ZERO); topo_change.phy_details = phy_change; if (!phy_change) @@ -2492,7 +2492,7 @@ struct dev_mapping_table *mt_entry; u16 element_flags; - wwid_table = malloc(sizeof(u64) * event_data->NumElements, M_MPT2, + wwid_table = mallocarray(event_data->NumElements, sizeof(u64), M_MPT2, M_NOWAIT | M_ZERO); if (!wwid_table) goto out; Index: sys/dev/mpt/mpt_cam.c =================================================================== --- sys/dev/mpt/mpt_cam.c (revision 328307) +++ sys/dev/mpt/mpt_cam.c (working copy) @@ -637,8 +637,8 @@ } portinfo->num_phys = buffer->NumPhys; - portinfo->phy_info = malloc(sizeof(*portinfo->phy_info) * - portinfo->num_phys, M_DEVBUF, M_NOWAIT|M_ZERO); + portinfo->phy_info = mallocarray(portinfo->num_phys, + sizeof(*portinfo->phy_info), M_DEVBUF, M_NOWAIT|M_ZERO); if (portinfo->phy_info == NULL) { free(buffer, M_DEVBUF); error = ENOMEM; @@ -4234,7 +4234,7 @@ max = mpt->mpt_max_tgtcmds; } mpt->tgt_cmd_ptrs = - malloc(max * sizeof (request_t *), M_DEVBUF, M_NOWAIT | M_ZERO); + mallocarray(max, sizeof(request_t *), M_DEVBUF, M_NOWAIT | M_ZERO); if (mpt->tgt_cmd_ptrs == NULL) { mpt_prt(mpt, "mpt_add_target_commands: could not allocate cmd ptrs\n"); Index: sys/dev/mrsas/mrsas.c =================================================================== --- sys/dev/mrsas/mrsas.c (revision 328307) +++ sys/dev/mrsas/mrsas.c (working copy) @@ -2566,7 +2566,8 @@ * Allocate the dynamic array first and then allocate individual * commands. */ - sc->mpt_cmd_list = malloc(sizeof(struct mrsas_mpt_cmd *) * max_cmd, M_MRSAS, M_NOWAIT); + sc->mpt_cmd_list = mallocarray(max_cmd, sizeof(struct mrsas_mpt_cmd *), + M_MRSAS, M_NOWAIT); if (!sc->mpt_cmd_list) { device_printf(sc->mrsas_dev, "Cannot alloc memory for mpt_cmd_list.\n"); return (ENOMEM); Index: sys/dev/mxge/if_mxge.c =================================================================== --- sys/dev/mxge/if_mxge.c (revision 328307) +++ sys/dev/mxge/if_mxge.c (working copy) @@ -688,7 +688,7 @@ { void *ptr; - ptr = malloc(items * size, M_TEMP, M_NOWAIT); + ptr = mallocarray(items, size, M_TEMP, M_NOWAIT); return ptr; } @@ -4390,8 +4390,8 @@ sc->rx_ring_size = cmd.data0; max_intr_slots = 2 * (sc->rx_ring_size / sizeof (mcp_dma_addr_t)); - bytes = sizeof (*sc->ss) * sc->num_slices; - sc->ss = malloc(bytes, M_DEVBUF, M_NOWAIT | M_ZERO); + sc->ss = mallocarray(sc->num_slices, sizeof(*sc->ss), M_DEVBUF, + M_NOWAIT | M_ZERO); if (sc->ss == NULL) return (ENOMEM); for (i = 0; i < sc->num_slices; i++) { @@ -4535,7 +4535,6 @@ static int mxge_add_msix_irqs(mxge_softc_t *sc) { - size_t bytes; int count, err, i, rid; rid = PCIR_BAR(2); @@ -4563,8 +4562,8 @@ err = ENOSPC; goto abort_with_msix; } - bytes = sizeof (*sc->msix_irq_res) * sc->num_slices; - sc->msix_irq_res = malloc(bytes, M_DEVBUF, M_NOWAIT|M_ZERO); + sc->msix_irq_res = mallocarray(sc->num_slices, + sizeof(*sc->msix_irq_res), M_DEVBUF, M_NOWAIT|M_ZERO); if (sc->msix_irq_res == NULL) { err = ENOMEM; goto abort_with_msix; @@ -4583,8 +4582,8 @@ } } - bytes = sizeof (*sc->msix_ih) * sc->num_slices; - sc->msix_ih = malloc(bytes, M_DEVBUF, M_NOWAIT|M_ZERO); + sc->msix_ih = mallocarray(sc->num_slices, sizeof(*sc->msix_ih), + M_DEVBUF, M_NOWAIT|M_ZERO); for (i = 0; i < sc->num_slices; i++) { err = bus_setup_intr(sc->dev, sc->msix_irq_res[i], Index: sys/dev/nand/nandsim_swap.c =================================================================== --- sys/dev/nand/nandsim_swap.c (revision 328307) +++ sys/dev/nand/nandsim_swap.c (working copy) @@ -67,7 +67,7 @@ if (swap == NULL) return (-1); - blk_state = malloc(swap->nof_blks * sizeof(struct block_state), + blk_state = mallocarray(swap->nof_blks, sizeof(struct block_state), M_NANDSIM, M_WAITOK | M_ZERO); for (i = 0; i < swap->nof_blks; i++) Index: sys/dev/netmap/if_ptnet.c =================================================================== --- sys/dev/netmap/if_ptnet.c (revision 328307) +++ sys/dev/netmap/if_ptnet.c (working copy) @@ -351,7 +351,7 @@ sc->num_tx_rings = num_tx_rings; /* Allocate and initialize per-queue data structures. */ - sc->queues = malloc(sizeof(struct ptnet_queue) * sc->num_rings, + sc->queues = mallocarray(sc->num_rings, sizeof(struct ptnet_queue), M_DEVBUF, M_NOWAIT | M_ZERO); if (sc->queues == NULL) { err = ENOMEM; Index: sys/dev/ntb/ntb_transport.c =================================================================== --- sys/dev/ntb/ntb_transport.c (revision 328307) +++ sys/dev/ntb/ntb_transport.c (working copy) @@ -362,7 +362,7 @@ return (ENXIO); } - nt->mw_vec = malloc(nt->mw_count * sizeof(*nt->mw_vec), M_NTB_T, + nt->mw_vec = mallocarray(nt->mw_count, sizeof(*nt->mw_vec), M_NTB_T, M_WAITOK | M_ZERO); for (i = 0; i < nt->mw_count; i++) { mw = &nt->mw_vec[i]; @@ -432,7 +432,7 @@ } nt->qp_count = qpu; - nt->qp_vec = malloc(nt->qp_count * sizeof(*nt->qp_vec), M_NTB_T, + nt->qp_vec = mallocarray(nt->qp_count, sizeof(*nt->qp_vec), M_NTB_T, M_WAITOK | M_ZERO); for (i = 0; i < nt->qp_count; i++) Index: sys/dev/nvme/nvme_ns.c =================================================================== --- sys/dev/nvme/nvme_ns.c (revision 328307) +++ sys/dev/nvme/nvme_ns.c (working copy) @@ -321,7 +321,8 @@ struct bio **child_bios; int err = 0, i; - child_bios = malloc(num_bios * sizeof(struct bio *), M_NVME, M_NOWAIT); + child_bios = mallocarray(num_bios, sizeof(struct bio *), M_NVME, + M_NOWAIT); if (child_bios == NULL) return (NULL); Index: sys/dev/ofw/ofwpci.c =================================================================== --- sys/dev/ofw/ofwpci.c (revision 328307) +++ sys/dev/ofw/ofwpci.c (working copy) @@ -175,8 +175,8 @@ error = ENXIO; goto out; } - sc->sc_range = malloc(sc->sc_nrange * sizeof(sc->sc_range[0]), - M_DEVBUF, M_WAITOK); + sc->sc_range = mallocarray(sc->sc_nrange, + sizeof(sc->sc_range[0]), M_DEVBUF, M_WAITOK); i = 0; for (c = OF_child(node); c != 0; c = OF_peer(c)) { n = ofw_pci_fill_ranges(c, &sc->sc_range[i]); @@ -191,8 +191,8 @@ error = ENXIO; goto out; } - sc->sc_range = malloc(sc->sc_nrange * sizeof(sc->sc_range[0]), - M_DEVBUF, M_WAITOK); + sc->sc_range = mallocarray(sc->sc_nrange, + sizeof(sc->sc_range[0]), M_DEVBUF, M_WAITOK); ofw_pci_fill_ranges(node, sc->sc_range); } Index: sys/dev/proto/proto_core.c =================================================================== --- sys/dev/proto/proto_core.c (revision 328307) +++ sys/dev/proto/proto_core.c (working copy) @@ -143,7 +143,7 @@ dn = (*ep == ',') ? ep + 1 : ep; } } - devnames = malloc(names * sizeof(caddr_t), M_DEVBUF, + devnames = mallocarray(names, sizeof(caddr_t), M_DEVBUF, M_WAITOK | M_ZERO); *devnamesp = devnames; if (ev != NULL) { Index: sys/dev/pst/pst-iop.c =================================================================== --- sys/dev/pst/pst-iop.c (revision 328307) +++ sys/dev/pst/pst-iop.c (working copy) @@ -323,7 +323,7 @@ contigfree(reply, ALLOCSIZE, M_PSTIOP); return 0; } - if (!(sc->lct = malloc(reply->table_size * sizeof(struct i2o_lct_entry), + if (!(sc->lct = mallocarray(reply->table_size, sizeof(struct i2o_lct_entry), M_PSTIOP, M_NOWAIT | M_ZERO))) { contigfree(reply, ALLOCSIZE, M_PSTIOP); return 0; Index: sys/dev/qlxgb/qla_misc.c =================================================================== --- sys/dev/qlxgb/qla_misc.c (revision 328307) +++ sys/dev/qlxgb/qla_misc.c (working copy) @@ -432,7 +432,7 @@ QL_DPRINT2((ha->pci_dev, "%s: [sig,val]=[0x%08x, 0x%08x] %d pairs\n", __func__, sig, val, count)); - addr_val_map = avmap = malloc((sizeof(addr_val_t) * count), + addr_val_map = avmap = mallocarray(count, sizeof(addr_val_t), M_QLA8XXXBUF, M_NOWAIT); if (addr_val_map == NULL) { Index: sys/dev/ral/rt2560.c =================================================================== --- sys/dev/ral/rt2560.c (revision 328307) +++ sys/dev/ral/rt2560.c (working copy) @@ -488,7 +488,7 @@ goto fail; } - ring->data = malloc(count * sizeof (struct rt2560_tx_data), M_DEVBUF, + ring->data = mallocarray(count, sizeof(struct rt2560_tx_data), M_DEVBUF, M_NOWAIT | M_ZERO); if (ring->data == NULL) { device_printf(sc->sc_dev, "could not allocate soft data\n"); @@ -632,8 +632,8 @@ goto fail; } - ring->data = malloc(count * sizeof (struct rt2560_rx_data), M_DEVBUF, - M_NOWAIT | M_ZERO); + ring->data = mallocarray(count, sizeof (struct rt2560_rx_data), + M_DEVBUF, M_NOWAIT | M_ZERO); if (ring->data == NULL) { device_printf(sc->sc_dev, "could not allocate soft data\n"); error = ENOMEM; Index: sys/dev/ral/rt2661.c =================================================================== --- sys/dev/ral/rt2661.c (revision 328307) +++ sys/dev/ral/rt2661.c (working copy) @@ -497,7 +497,7 @@ goto fail; } - ring->data = malloc(count * sizeof (struct rt2661_tx_data), M_DEVBUF, + ring->data = mallocarray(count, sizeof(struct rt2661_tx_data), M_DEVBUF, M_NOWAIT | M_ZERO); if (ring->data == NULL) { device_printf(sc->sc_dev, "could not allocate soft data\n"); @@ -638,7 +638,7 @@ goto fail; } - ring->data = malloc(count * sizeof (struct rt2661_rx_data), M_DEVBUF, + ring->data = mallocarray(count, sizeof(struct rt2661_rx_data), M_DEVBUF, M_NOWAIT | M_ZERO); if (ring->data == NULL) { device_printf(sc->sc_dev, "could not allocate soft data\n"); Index: sys/dev/rp/rp.c =================================================================== --- sys/dev/rp/rp.c (revision 328307) +++ sys/dev/rp/rp.c (working copy) @@ -732,7 +732,8 @@ ctlp->num_ports = num_ports; ctlp->rp = rp = (struct rp_port *) - malloc(sizeof(struct rp_port) * num_ports, M_DEVBUF, M_NOWAIT | M_ZERO); + mallocarray(num_ports, sizeof(struct rp_port), M_DEVBUF, + M_NOWAIT | M_ZERO); if (rp == NULL) { device_printf(ctlp->dev, "rp_attachcommon: Could not malloc rp_ports structures.\n"); retval = ENOMEM; Index: sys/dev/rp/rp_isa.c =================================================================== --- sys/dev/rp/rp_isa.c (revision 328307) +++ sys/dev/rp/rp_isa.c (working copy) @@ -178,8 +178,10 @@ /* The IO ports of AIOPs for an ISA controller are discrete. */ ctlp->io_num = 1; - ctlp->io_rid = malloc(sizeof(*(ctlp->io_rid)) * MAX_AIOPS_PER_BOARD, M_DEVBUF, M_NOWAIT | M_ZERO); - ctlp->io = malloc(sizeof(*(ctlp->io)) * MAX_AIOPS_PER_BOARD, M_DEVBUF, M_NOWAIT | M_ZERO); + ctlp->io_rid = mallocarray(MAX_AIOPS_PER_BOARD, sizeof(*(ctlp->io_rid)), + M_DEVBUF, M_NOWAIT | M_ZERO); + ctlp->io = mallocarray(MAX_AIOPS_PER_BOARD, sizeof(*(ctlp->io)), + M_DEVBUF, M_NOWAIT | M_ZERO); if (ctlp->io_rid == NULL || ctlp->io == NULL) { device_printf(dev, "rp_attach: Out of memory.\n"); retval = ENOMEM; Index: sys/dev/rp/rp_pci.c =================================================================== --- sys/dev/rp/rp_pci.c (revision 328307) +++ sys/dev/rp/rp_pci.c (working copy) @@ -164,8 +164,10 @@ /* The IO ports of AIOPs for a PCI controller are continuous. */ ctlp->io_num = 1; - ctlp->io_rid = malloc(sizeof(*(ctlp->io_rid)) * ctlp->io_num, M_DEVBUF, M_NOWAIT | M_ZERO); - ctlp->io = malloc(sizeof(*(ctlp->io)) * ctlp->io_num, M_DEVBUF, M_NOWAIT | M_ZERO); + ctlp->io_rid = mallocarray(ctlp->io_num, sizeof(*(ctlp->io_rid)), + M_DEVBUF, M_NOWAIT | M_ZERO); + ctlp->io = mallocarray(ctlp->io_num, sizeof(*(ctlp->io)), M_DEVBUF, + M_NOWAIT | M_ZERO); if (ctlp->io_rid == NULL || ctlp->io == NULL) { device_printf(dev, "rp_pciattach: Out of memory.\n"); retval = ENOMEM; Index: sys/dev/sfxge/sfxge_intr.c =================================================================== --- sys/dev/sfxge/sfxge_intr.c (revision 328307) +++ sys/dev/sfxge/sfxge_intr.c (working copy) @@ -251,7 +251,7 @@ intr = &sc->intr; error = 0; - table = malloc(count * sizeof(struct sfxge_intr_hdl), + table = mallocarray(count, sizeof(struct sfxge_intr_hdl), M_SFXGE, M_WAITOK); intr->table = table; Index: sys/dev/sfxge/sfxge_rx.c =================================================================== --- sys/dev/sfxge/sfxge_rx.c (revision 328307) +++ sys/dev/sfxge/sfxge_rx.c (working copy) @@ -1187,9 +1187,9 @@ KASSERT(!((st->conns_mask + 1) & st->conns_mask), ("lro_table_size must be a power of 2")); st->sc = rxq->sc; - st->conns = malloc((st->conns_mask + 1) * sizeof(st->conns[0]), + st->conns = mallocarray(st->conns_mask + 1, sizeof(st->conns[0]), M_SFXGE, M_WAITOK); - st->conns_n = malloc((st->conns_mask + 1) * sizeof(st->conns_n[0]), + st->conns_n = mallocarray(st->conns_mask + 1, sizeof(st->conns_n[0]), M_SFXGE, M_WAITOK); for (i = 0; i <= st->conns_mask; ++i) { TAILQ_INIT(&st->conns[i]); @@ -1297,8 +1297,8 @@ &rxq->buf_base_id); /* Allocate the context array and the flow table. */ - rxq->queue = malloc(sizeof(struct sfxge_rx_sw_desc) * sc->rxq_entries, - M_SFXGE, M_WAITOK | M_ZERO); + rxq->queue = mallocarray(sc->rxq_entries, + sizeof(struct sfxge_rx_sw_desc), M_SFXGE, M_WAITOK | M_ZERO); sfxge_lro_init(rxq); callout_init(&rxq->refill_callout, 1); Index: sys/dev/sound/midi/midi.c =================================================================== --- sys/dev/sound/midi/midi.c (revision 328307) +++ sys/dev/sound/midi/midi.c (working copy) @@ -340,7 +340,7 @@ mtx_lock(&m->qlock); if (inqsize) - buf = malloc(sizeof(MIDI_TYPE) * inqsize, M_MIDI, M_NOWAIT); + buf = mallocarray(inqsize, sizeof(MIDI_TYPE), M_MIDI, M_NOWAIT); else buf = NULL; @@ -347,7 +347,8 @@ MIDIQ_INIT(m->inq, buf, inqsize); if (outqsize) - buf = malloc(sizeof(MIDI_TYPE) * outqsize, M_MIDI, M_NOWAIT); + buf = mallocarray(outqsize, sizeof(MIDI_TYPE), M_MIDI, + M_NOWAIT); else buf = NULL; m->hiwat = outqsize / 2; Index: sys/dev/sound/pci/hda/hdaa.c =================================================================== --- sys/dev/sound/pci/hda/hdaa.c (revision 328307) +++ sys/dev/sound/pci/hda/hdaa.c (working copy) @@ -3034,8 +3034,8 @@ if (max < 1) return; - ctls = (struct hdaa_audio_ctl *)malloc( - sizeof(*ctls) * max, M_HDAA, M_ZERO | M_NOWAIT); + ctls = (struct hdaa_audio_ctl *)mallocarray(max, + sizeof(*ctls), M_HDAA, M_ZERO | M_NOWAIT); if (ctls == NULL) { /* Blekh! */ @@ -3187,8 +3187,8 @@ if (max < 1) return; - as = (struct hdaa_audio_as *)malloc( - sizeof(*as) * max, M_HDAA, M_ZERO | M_NOWAIT); + as = (struct hdaa_audio_as *)mallocarray(max, + sizeof(*as), M_HDAA, M_ZERO | M_NOWAIT); if (as == NULL) { /* Blekh! */ @@ -4078,8 +4078,8 @@ cnt += as[j].num_chans; } if (devinfo->num_chans == 0) { - devinfo->chans = (struct hdaa_chan *)malloc( - sizeof(struct hdaa_chan) * cnt, + devinfo->chans = (struct hdaa_chan *)mallocarray(cnt, + sizeof(struct hdaa_chan), M_HDAA, M_ZERO | M_NOWAIT); if (devinfo->chans == NULL) { device_printf(devinfo->dev, @@ -5491,8 +5491,8 @@ devinfo->num_devs = max(ardev, apdev) + max(drdev, dpdev); devinfo->devs = - (struct hdaa_pcm_devinfo *)malloc( - devinfo->num_devs * sizeof(struct hdaa_pcm_devinfo), + (struct hdaa_pcm_devinfo *)mallocarray( + devinfo->num_devs, sizeof(struct hdaa_pcm_devinfo), M_HDAA, M_ZERO | M_NOWAIT); if (devinfo->devs == NULL) { device_printf(devinfo->dev, Index: sys/dev/spibus/spigen.c =================================================================== --- sys/dev/spibus/spigen.c (revision 328307) +++ sys/dev/spibus/spigen.c (working copy) @@ -373,7 +373,7 @@ *offset = 0; sc->sc_mmap_buffer = *object = vm_pager_allocate(OBJT_PHYS, 0, size, nprot, *offset, curthread->td_ucred); - m = malloc(sizeof(*m) * pages, M_TEMP, M_WAITOK); + m = mallocarray(pages, sizeof(*m), M_TEMP, M_WAITOK); VM_OBJECT_WLOCK(*object); vm_object_reference_locked(*object); // kernel and userland both for (n = 0; n < pages; n++) { Index: sys/dev/syscons/fire/fire_saver.c =================================================================== --- sys/dev/syscons/fire/fire_saver.c (revision 328307) +++ sys/dev/syscons/fire/fire_saver.c (working copy) @@ -155,7 +155,7 @@ scrw = info.vi_width; scrh = info.vi_height; - buf = (u_char *)malloc(scrw * (scrh + 1), M_DEVBUF, M_NOWAIT); + buf = (u_char *)mallocarray(scrw, scrh + 1, M_DEVBUF, M_NOWAIT); if (buf) { bzero(buf, scrw * (scrh + 1)); } else { Index: sys/dev/uart/uart_core.c =================================================================== --- sys/dev/uart/uart_core.c (revision 328307) +++ sys/dev/uart/uart_core.c (working copy) @@ -627,9 +627,9 @@ * size of 384 bytes (handles the typical small-FIFO case). */ sc->sc_rxbufsz = MAX(384, sc->sc_rxfifosz * 3); - sc->sc_rxbuf = malloc(sc->sc_rxbufsz * sizeof(*sc->sc_rxbuf), + sc->sc_rxbuf = mallocarray(sc->sc_rxbufsz, sizeof(*sc->sc_rxbuf), M_UART, M_WAITOK); - sc->sc_txbuf = malloc(sc->sc_txfifosz * sizeof(*sc->sc_txbuf), + sc->sc_txbuf = mallocarray(sc->sc_txfifosz, sizeof(*sc->sc_txbuf), M_UART, M_WAITOK); error = UART_ATTACH(sc); Index: sys/dev/virtio/console/virtio_console.c =================================================================== --- sys/dev/virtio/console/virtio_console.c (revision 328307) +++ sys/dev/virtio/console/virtio_console.c (working copy) @@ -474,11 +474,11 @@ vtcon_alloc_scports(struct vtcon_softc *sc) { struct vtcon_softc_port *scport; - int max, i; + u_int max, i; max = sc->vtcon_max_ports; - sc->vtcon_ports = malloc(sizeof(struct vtcon_softc_port) * max, + sc->vtcon_ports = mallocarray(max, sizeof(struct vtcon_softc_port), M_DEVBUF, M_NOWAIT | M_ZERO); if (sc->vtcon_ports == NULL) return (ENOMEM); @@ -497,7 +497,8 @@ device_t dev; struct vq_alloc_info *info; struct vtcon_softc_port *scport; - int i, idx, portidx, nvqs, error; + u_int i, idx, portidx, nvqs; + int error; dev = sc->vtcon_dev; @@ -505,7 +506,8 @@ if (sc->vtcon_flags & VTCON_FLAG_MULTIPORT) nvqs += 2; - info = malloc(sizeof(struct vq_alloc_info) * nvqs, M_TEMP, M_NOWAIT); + info = mallocarray(nvqs, sizeof(struct vq_alloc_info), M_TEMP, + M_NOWAIT); if (info == NULL) return (ENOMEM); Index: sys/dev/virtio/mmio/virtio_mmio.c =================================================================== --- sys/dev/virtio/mmio/virtio_mmio.c (revision 328307) +++ sys/dev/virtio/mmio/virtio_mmio.c (working copy) @@ -507,7 +507,7 @@ if (nvqs <= 0) return (EINVAL); - sc->vtmmio_vqs = malloc(nvqs * sizeof(struct vtmmio_virtqueue), + sc->vtmmio_vqs = mallocarray(nvqs, sizeof(struct vtmmio_virtqueue), M_DEVBUF, M_NOWAIT | M_ZERO); if (sc->vtmmio_vqs == NULL) return (ENOMEM); Index: sys/dev/virtio/network/if_vtnet.c =================================================================== --- sys/dev/virtio/network/if_vtnet.c (revision 328307) +++ sys/dev/virtio/network/if_vtnet.c (working copy) @@ -755,9 +755,9 @@ npairs = sc->vtnet_max_vq_pairs; - sc->vtnet_rxqs = malloc(sizeof(struct vtnet_rxq) * npairs, M_DEVBUF, + sc->vtnet_rxqs = mallocarray(npairs, sizeof(struct vtnet_rxq), M_DEVBUF, M_NOWAIT | M_ZERO); - sc->vtnet_txqs = malloc(sizeof(struct vtnet_txq) * npairs, M_DEVBUF, + sc->vtnet_txqs = mallocarray(npairs, sizeof(struct vtnet_txq), M_DEVBUF, M_NOWAIT | M_ZERO); if (sc->vtnet_rxqs == NULL || sc->vtnet_txqs == NULL) return (ENOMEM); @@ -887,7 +887,8 @@ if (sc->vtnet_flags & VTNET_FLAG_CTRL_VQ) nvqs++; - info = malloc(sizeof(struct vq_alloc_info) * nvqs, M_TEMP, M_NOWAIT); + info = mallocarray(nvqs, sizeof(struct vq_alloc_info), M_TEMP, + M_NOWAIT); if (info == NULL) return (ENOMEM); Index: sys/dev/virtio/pci/virtio_pci.c =================================================================== --- sys/dev/virtio/pci/virtio_pci.c (revision 328307) +++ sys/dev/virtio/pci/virtio_pci.c (working copy) @@ -491,7 +491,7 @@ if (nvqs <= 0) return (EINVAL); - sc->vtpci_vqs = malloc(nvqs * sizeof(struct vtpci_virtqueue), + sc->vtpci_vqs = mallocarray(nvqs, sizeof(struct vtpci_virtqueue), M_DEVBUF, M_NOWAIT | M_ZERO); if (sc->vtpci_vqs == NULL) return (ENOMEM); @@ -927,7 +927,7 @@ /* Subtract one for the configuration changed interrupt. */ nvq_intrs = sc->vtpci_nmsix_resources - 1; - intr = sc->vtpci_msix_vq_interrupts = malloc(nvq_intrs * + intr = sc->vtpci_msix_vq_interrupts = mallocarray(nvq_intrs, sizeof(struct vtpci_interrupt), M_DEVBUF, M_NOWAIT | M_ZERO); if (sc->vtpci_msix_vq_interrupts == NULL) return (ENOMEM); Index: sys/dev/vmware/vmxnet3/if_vmx.c =================================================================== --- sys/dev/vmware/vmxnet3/if_vmx.c (revision 328307) +++ sys/dev/vmware/vmxnet3/if_vmx.c (working copy) @@ -959,7 +959,7 @@ rxr = &rxq->vxrxq_cmd_ring[i]; rxr->vxrxr_rid = i; rxr->vxrxr_ndesc = sc->vmx_nrxdescs; - rxr->vxrxr_rxbuf = malloc(rxr->vxrxr_ndesc * + rxr->vxrxr_rxbuf = mallocarray(rxr->vxrxr_ndesc, sizeof(struct vmxnet3_rxbuf), M_DEVBUF, M_NOWAIT | M_ZERO); if (rxr->vxrxr_rxbuf == NULL) return (ENOMEM); @@ -987,7 +987,7 @@ txq->vxtxq_id = q; txr->vxtxr_ndesc = sc->vmx_ntxdescs; - txr->vxtxr_txbuf = malloc(txr->vxtxr_ndesc * + txr->vxtxr_txbuf = mallocarray(txr->vxtxr_ndesc, sizeof(struct vmxnet3_txbuf), M_DEVBUF, M_NOWAIT | M_ZERO); if (txr->vxtxr_txbuf == NULL) return (ENOMEM); @@ -1023,10 +1023,10 @@ sc->vmx_max_ntxqueues = 1; } - sc->vmx_rxq = malloc(sizeof(struct vmxnet3_rxqueue) * - sc->vmx_max_nrxqueues, M_DEVBUF, M_NOWAIT | M_ZERO); - sc->vmx_txq = malloc(sizeof(struct vmxnet3_txqueue) * - sc->vmx_max_ntxqueues, M_DEVBUF, M_NOWAIT | M_ZERO); + sc->vmx_rxq = mallocarray(sc->vmx_max_nrxqueues, + sizeof(struct vmxnet3_rxqueue), M_DEVBUF, M_NOWAIT | M_ZERO); + sc->vmx_txq = mallocarray(sc->vmx_max_ntxqueues, + sizeof(struct vmxnet3_txqueue), M_DEVBUF, M_NOWAIT | M_ZERO); if (sc->vmx_rxq == NULL || sc->vmx_txq == NULL) return (ENOMEM); Index: sys/dev/vnic/mrml_bridge.c =================================================================== --- sys/dev/vnic/mrml_bridge.c (revision 328307) +++ sys/dev/vnic/mrml_bridge.c (working copy) @@ -206,7 +206,7 @@ if (sc->nranges == 0) return (0); - sc->ranges = malloc(sc->nranges * sizeof(sc->ranges[0]), + sc->ranges = mallocarray(sc->nranges, sizeof(sc->ranges[0]), M_MRMLB, M_WAITOK); base_ranges = malloc(nbase_ranges, M_MRMLB, M_WAITOK); OF_getencprop(node, "ranges", base_ranges, nbase_ranges); Index: sys/dev/vnic/nicvf_queues.c =================================================================== --- sys/dev/vnic/nicvf_queues.c (revision 328307) +++ sys/dev/vnic/nicvf_queues.c (working copy) @@ -1104,7 +1104,7 @@ } /* Allocate send buffers array */ - sq->snd_buff = malloc(sizeof(*sq->snd_buff) * q_len, M_NICVF, + sq->snd_buff = mallocarray(q_len, sizeof(*sq->snd_buff), M_NICVF, (M_NOWAIT | M_ZERO)); if (sq->snd_buff == NULL) { device_printf(nic->dev, Index: sys/dev/vnic/thunder_bgx_fdt.c =================================================================== --- sys/dev/vnic/thunder_bgx_fdt.c (revision 328307) +++ sys/dev/vnic/thunder_bgx_fdt.c (working copy) @@ -329,7 +329,7 @@ len = sizeof(BGX_NODE_NAME) + 1; /* ++<\0> */ /* Allocate memory for BGX node name + "/" character */ - bgx_sel = malloc(sizeof(*bgx_sel) * (len + 1), M_BGX, + bgx_sel = mallocarray(len + 1, sizeof(*bgx_sel), M_BGX, M_ZERO | M_WAITOK); /* Prepare node's name */ Index: sys/dev/vnic/thunder_mdio_fdt.c =================================================================== --- sys/dev/vnic/thunder_mdio_fdt.c (revision 328307) +++ sys/dev/vnic/thunder_mdio_fdt.c (working copy) @@ -214,7 +214,7 @@ if (sc->nranges == 0) return (0); - sc->ranges = malloc(sc->nranges * sizeof(sc->ranges[0]), + sc->ranges = mallocarray(sc->nranges, sizeof(sc->ranges[0]), M_THUNDER_MDIO, M_WAITOK); base_ranges = malloc(nbase_ranges, M_THUNDER_MDIO, M_WAITOK); OF_getencprop(node, "ranges", base_ranges, nbase_ranges); Index: sys/dev/xdma/xdma.c =================================================================== --- sys/dev/xdma/xdma.c (revision 328307) +++ sys/dev/xdma/xdma.c (working copy) @@ -291,8 +291,8 @@ return (-1); } - xchan->descs_phys = malloc(nsegments * sizeof(xdma_descriptor_t), M_XDMA, - (M_WAITOK | M_ZERO)); + xchan->descs_phys = mallocarray(nsegments, sizeof(xdma_descriptor_t), + M_XDMA, (M_WAITOK | M_ZERO)); xchan->map_err = 0; err = bus_dmamap_load(xchan->dma_tag, xchan->dma_map, xchan->descs, Index: sys/dev/xen/blkback/blkback.c =================================================================== --- sys/dev/xen/blkback/blkback.c (revision 328307) +++ sys/dev/xen/blkback/blkback.c (working copy) @@ -3166,7 +3166,7 @@ /* * Allocate request book keeping datastructures. */ - xbb->requests = malloc(xbb->max_requests * sizeof(*xbb->requests), + xbb->requests = mallocarray(xbb->max_requests, sizeof(*xbb->requests), M_XENBLOCKBACK, M_NOWAIT|M_ZERO); if (xbb->requests == NULL) { xenbus_dev_fatal(xbb->dev, ENOMEM, @@ -3194,7 +3194,7 @@ * If no requests can be merged, we need 1 request list per * in flight request. */ - xbb->request_lists = malloc(xbb->max_requests * + xbb->request_lists = mallocarray(xbb->max_requests, sizeof(*xbb->request_lists), M_XENBLOCKBACK, M_NOWAIT|M_ZERO); if (xbb->request_lists == NULL) { xenbus_dev_fatal(xbb->dev, ENOMEM, @@ -3222,7 +3222,7 @@ } #endif /* XBB_USE_BOUNCE_BUFFERS */ - reqlist->gnt_handles = malloc(xbb->max_reqlist_segments * + reqlist->gnt_handles = mallocarray(xbb->max_reqlist_segments, sizeof(*reqlist->gnt_handles), M_XENBLOCKBACK, M_NOWAIT|M_ZERO); if (reqlist->gnt_handles == NULL) { Index: sys/dev/xen/blkfront/blkfront.c =================================================================== --- sys/dev/xen/blkfront/blkfront.c (revision 328307) +++ sys/dev/xen/blkfront/blkfront.c (working copy) @@ -1306,8 +1306,8 @@ } /* Per-transaction data allocation. */ - sc->xbd_shadow = malloc(sizeof(*sc->xbd_shadow) * sc->xbd_max_requests, - M_XENBLOCKFRONT, M_NOWAIT|M_ZERO); + sc->xbd_shadow = mallocarray(sc->xbd_max_requests, + sizeof(*sc->xbd_shadow), M_XENBLOCKFRONT, M_NOWAIT|M_ZERO); if (sc->xbd_shadow == NULL) { bus_dma_tag_destroy(sc->xbd_io_dmat); xenbus_dev_fatal(sc->xbd_dev, ENOMEM, @@ -1320,9 +1320,8 @@ void * indirectpages; cm = &sc->xbd_shadow[i]; - cm->cm_sg_refs = malloc( - sizeof(grant_ref_t) * sc->xbd_max_request_segments, - M_XENBLOCKFRONT, M_NOWAIT); + cm->cm_sg_refs = mallocarray(sc->xbd_max_request_segments, + sizeof(grant_ref_t), M_XENBLOCKFRONT, M_NOWAIT); if (cm->cm_sg_refs == NULL) break; cm->cm_id = i; Index: sys/fs/cd9660/cd9660_vnops.c =================================================================== --- sys/fs/cd9660/cd9660_vnops.c (revision 328307) +++ sys/fs/cd9660/cd9660_vnops.c (working copy) @@ -505,7 +505,7 @@ * Guess the number of cookies needed. */ ncookies = uio->uio_resid / 16; - cookies = malloc(ncookies * sizeof(u_long), + cookies = mallocarray(ncookies, sizeof(u_long), M_TEMP, M_WAITOK); idp->cookies = cookies; idp->ncookies = ncookies; Index: sys/fs/nandfs/nandfs_cleaner.c =================================================================== --- sys/fs/nandfs/nandfs_cleaner.c (revision 328307) +++ sys/fs/nandfs/nandfs_cleaner.c (working copy) @@ -297,7 +297,7 @@ uint64_t i, ssegs; int error; - suinfo = malloc(sizeof(*suinfo) * nsegs, M_NANDFSTEMP, + suinfo = mallocarray(nsegs, sizeof(*suinfo), M_NANDFSTEMP, M_ZERO | M_WAITOK); if (*rseg >= fsdev->nd_fsdata.f_nsegments) @@ -346,13 +346,11 @@ nsegs = nandfs_cleaner_segments; - vip = vinfo = malloc(sizeof(*vinfo) * - fsdev->nd_fsdata.f_blocks_per_segment * nsegs, M_NANDFSTEMP, - M_ZERO | M_WAITOK); - bdp = bdesc = malloc(sizeof(*bdesc) * - fsdev->nd_fsdata.f_blocks_per_segment * nsegs, M_NANDFSTEMP, - M_ZERO | M_WAITOK); - segp = segnums = malloc(sizeof(*segnums) * nsegs, M_NANDFSTEMP, + vip = vinfo = mallocarray(fsdev->nd_fsdata.f_blocks_per_segment, + sizeof(*vinfo) * nsegs, M_NANDFSTEMP, M_ZERO | M_WAITOK); + bdp = bdesc = mallocarray(fsdev->nd_fsdata.f_blocks_per_segment, + sizeof(*bdesc) * nsegs, M_NANDFSTEMP, M_ZERO | M_WAITOK); + segp = segnums = mallocarray(nsegs, sizeof(*segnums), M_NANDFSTEMP, M_WAITOK); error = nandfs_cleaner_choose_segment(fsdev, &segp, nsegs, rseg); @@ -399,8 +397,8 @@ } if (cpstat.ncp_nss != 0) { - cpinfo = malloc(sizeof(struct nandfs_cpinfo) * cpstat.ncp_nss, - M_NANDFSTEMP, M_WAITOK); + cpinfo = mallocarray(cpstat.ncp_nss, + sizeof(struct nandfs_cpinfo), M_NANDFSTEMP, M_WAITOK); error = nandfs_get_cpinfo(fsdev->nd_cp_node, 1, NANDFS_SNAPSHOT, cpinfo, cpstat.ncp_nss, NULL); if (error) { @@ -557,7 +555,7 @@ nsegs * sizeof(uint64_t)); nffsdev->nd_free_count += nsegs; } else { - nffsdev->nd_free_base = malloc(nsegs * sizeof(uint64_t), + nffsdev->nd_free_base = mallocarray(nsegs, sizeof(uint64_t), M_NANDFSTEMP, M_WAITOK|M_ZERO); memcpy(nffsdev->nd_free_base, segments, nsegs * sizeof(uint64_t)); Index: sys/fs/nandfs/nandfs_vfsops.c =================================================================== --- sys/fs/nandfs/nandfs_vfsops.c (revision 328307) +++ sys/fs/nandfs/nandfs_vfsops.c (working copy) @@ -568,9 +568,9 @@ nfsds = NANDFS_NFSAREAS; nsbs = nandfs_max_sblocks(fsdev); - fsdatat = malloc(sizeof(struct nandfs_fsdata) * nfsds, M_NANDFSTEMP, + fsdatat = mallocarray(nfsds, sizeof(struct nandfs_fsdata), M_NANDFSTEMP, M_WAITOK | M_ZERO); - sblocks = malloc(sizeof(struct nandfs_super_block) * nsbs, M_NANDFSTEMP, + sblocks = mallocarray(vsizeof(struct nandfs_super_block), M_NANDFSTEMP, M_WAITOK | M_ZERO); nrsbs = 0; Index: sys/geom/raid/md_intel.c =================================================================== --- sys/geom/raid/md_intel.c (revision 328307) +++ sys/geom/raid/md_intel.c (working copy) @@ -776,7 +776,8 @@ /* Create and fill buffer. */ sectors = howmany(meta->config_size, pp->sectorsize); - buf = malloc(sectors * pp->sectorsize, M_MD_INTEL, M_WAITOK | M_ZERO); + buf = mallocarray(sectors, pp->sectorsize, M_MD_INTEL, + M_WAITOK | M_ZERO); if (sectors > 1) { memcpy(buf, ((char *)meta) + pp->sectorsize, (sectors - 1) * pp->sectorsize); Index: sys/geom/uzip/g_uzip.c =================================================================== --- sys/geom/uzip/g_uzip.c (revision 328307) +++ sys/geom/uzip/g_uzip.c (working copy) @@ -764,7 +764,7 @@ gp->name, sc->nblocks); goto e4; } - sc->toc = malloc(total_offsets * sizeof(struct g_uzip_blk), + sc->toc = mallocarray(total_offsets, sizeof(struct g_uzip_blk), M_GEOM_UZIP, M_WAITOK | M_ZERO); offsets_read = MIN(total_offsets, (pp->sectorsize - sizeof(*header)) / sizeof(uint64_t)); Index: sys/geom/uzip/g_uzip_zlib.c =================================================================== --- sys/geom/uzip/g_uzip_zlib.c (revision 328307) +++ sys/geom/uzip/g_uzip_zlib.c (working copy) @@ -132,7 +132,7 @@ { void *ptr; - ptr = malloc(type * size, M_GEOM_UZIP, M_NOWAIT); + ptr = mallocarray(type, size, M_GEOM_UZIP, M_NOWAIT); return (ptr); } Index: sys/geom/virstor/g_virstor.c =================================================================== --- sys/geom/virstor/g_virstor.c (revision 328307) +++ sys/geom/virstor/g_virstor.c (working copy) @@ -600,7 +600,7 @@ } compbak = sc->components; - newcomp = malloc(sc->n_components * sizeof(*sc->components), + newcomp = mallocarray(sc->n_components, sizeof(*sc->components), M_GVIRSTOR, M_WAITOK | M_ZERO); bcopy(sc->components, newcomp, found * sizeof(*sc->components)); bcopy(&sc->components[found + 1], newcomp + found, @@ -1108,8 +1108,8 @@ sc = malloc(sizeof(*sc), M_GVIRSTOR, M_WAITOK | M_ZERO); sc->id = md->md_id; sc->n_components = md->md_count; - sc->components = malloc(sizeof(struct g_virstor_component) * md->md_count, - M_GVIRSTOR, M_WAITOK | M_ZERO); + sc->components = mallocarray(md->md_count, + sizeof(struct g_virstor_component), M_GVIRSTOR, M_WAITOK | M_ZERO); sc->chunk_size = md->md_chunk_size; sc->virsize = md->md_virsize; STAILQ_INIT(&sc->delayed_bio_q); Index: sys/gnu/dev/bwn/phy_n/if_bwn_phy_n_core.c =================================================================== --- sys/gnu/dev/bwn/phy_n/if_bwn_phy_n_core.c (revision 328307) +++ sys/gnu/dev/bwn/phy_n/if_bwn_phy_n_core.c (working copy) @@ -1620,7 +1620,7 @@ uint16_t i; uint32_t *data; - data = malloc(len * sizeof(uint32_t), M_DEVBUF, M_NOWAIT | M_ZERO); + data = mallocarray(len, sizeof(uint32_t), M_DEVBUF, M_NOWAIT | M_ZERO); if (!data) { BWN_ERRPRINTF(mac->mac_sc, "allocation for samples loading failed\n"); return -ENOMEM; @@ -1663,7 +1663,8 @@ len = bw << 1; } - samples = malloc(len * sizeof(struct bwn_c32), M_DEVBUF, M_NOWAIT | M_ZERO); + samples = mallocarray(len, sizeof(struct bwn_c32), M_DEVBUF, + M_NOWAIT | M_ZERO); if (!samples) { BWN_ERRPRINTF(mac->mac_sc, "allocation for samples generation failed\n"); return 0; Index: sys/i386/i386/bpf_jit_machdep.c =================================================================== --- sys/i386/i386/bpf_jit_machdep.c (revision 328307) +++ sys/i386/i386/bpf_jit_machdep.c (working copy) @@ -185,7 +185,7 @@ /* Allocate the reference table for the jumps. */ if (fjmp) { #ifdef _KERNEL - stream.refs = malloc((nins + 1) * sizeof(u_int), M_BPFJIT, + stream.refs = mallocarray(nins + 1, sizeof(u_int), M_BPFJIT, M_NOWAIT | M_ZERO); #else stream.refs = calloc(nins + 1, sizeof(u_int)); Index: sys/i386/i386/k6_mem.c =================================================================== --- sys/i386/i386/k6_mem.c (revision 328307) +++ sys/i386/i386/k6_mem.c (working copy) @@ -107,7 +107,7 @@ sc->mr_cap = 0; sc->mr_ndesc = 2; /* XXX (BFF) For now, we only have one msr for this */ - sc->mr_desc = malloc(sc->mr_ndesc * sizeof(struct mem_range_desc), + sc->mr_desc = mallocarray(sc->mr_ndesc, sizeof(struct mem_range_desc), M_MEMDESC, M_NOWAIT | M_ZERO); if (sc->mr_desc == NULL) panic("k6_mrinit: malloc returns NULL"); Index: sys/i386/i386/mem.c =================================================================== --- sys/i386/i386/mem.c (revision 328307) +++ sys/i386/i386/mem.c (working copy) @@ -208,7 +208,7 @@ nd = imin(mo->mo_arg[0], mem_range_softc.mr_ndesc); if (nd > 0) { md = (struct mem_range_desc *) - malloc(nd * sizeof(struct mem_range_desc), + mallocarray(nd, sizeof(struct mem_range_desc), M_MEMDESC, M_WAITOK); error = mem_range_attr_get(md, &nd); if (!error) Index: sys/i386/i386/sys_machdep.c =================================================================== --- sys/i386/i386/sys_machdep.c (revision 328307) +++ sys/i386/i386/sys_machdep.c (working copy) @@ -205,8 +205,8 @@ if (kargs.largs.descs != NULL) { if (kargs.largs.num > MAX_LD) return (EINVAL); - lp = malloc(kargs.largs.num * sizeof(union descriptor), - M_TEMP, M_WAITOK); + lp = mallocarray(kargs.largs.num, + sizeof(union descriptor), M_TEMP, M_WAITOK); error = copyin(kargs.largs.descs, lp, kargs.largs.num * sizeof(union descriptor)); if (error == 0) @@ -537,7 +537,7 @@ #endif num = min(uap->num, MAX_LD); - data = malloc(num * sizeof(union descriptor), M_TEMP, M_WAITOK); + data = mallocarray(num, sizeof(union descriptor), M_TEMP, M_WAITOK); mtx_lock_spin(&dt_lock); pldt = td->td_proc->p_md.md_ldt; nldt = pldt != NULL ? pldt->ldt_len : nitems(ldt); Index: sys/i386/ibcs2/ibcs2_misc.c =================================================================== --- sys/i386/ibcs2/ibcs2_misc.c (revision 328307) +++ sys/i386/ibcs2/ibcs2_misc.c (working copy) @@ -661,7 +661,7 @@ if (uap->gidsetsize < ngrp) return (EINVAL); - iset = malloc(ngrp * sizeof(*iset), M_TEMP, M_WAITOK); + iset = mallocarray(ngrp, sizeof(*iset), M_TEMP, M_WAITOK); for (i = 0; i < ngrp; i++) iset[i] = (ibcs2_gid_t)cred->cr_groups[i]; error = copyout(iset, uap->gidset, ngrp * sizeof(ibcs2_gid_t)); @@ -682,9 +682,10 @@ return (EINVAL); if (uap->gidsetsize && uap->gidset == NULL) return (EINVAL); - gp = malloc(uap->gidsetsize * sizeof(*gp), M_TEMP, M_WAITOK); + gp = mallocarray(uap->gidsetsize, sizeof(*gp), M_TEMP, M_WAITOK); if (uap->gidsetsize) { - iset = malloc(uap->gidsetsize * sizeof(*iset), M_TEMP, M_WAITOK); + iset = mallocarray(uap->gidsetsize, sizeof(*iset), M_TEMP, + M_WAITOK); error = copyin(uap->gidset, iset, sizeof(ibcs2_gid_t) * uap->gidsetsize); if (error) { Index: sys/kern/imgact_binmisc.c =================================================================== --- sys/kern/imgact_binmisc.c (revision 328307) +++ sys/kern/imgact_binmisc.c (working copy) @@ -402,7 +402,7 @@ sx_slock(&interp_list_sx); count = interp_list_entry_count; - xbe = malloc(sizeof(*xbe) * count, M_BINMISC, M_WAITOK|M_ZERO); + xbe = mallocarray(count, sizeof(*xbe), M_BINMISC, M_WAITOK|M_ZERO); xbep = xbe; SLIST_FOREACH(ibe, &interpreter_list, link) { Index: sys/kern/init_main.c =================================================================== --- sys/kern/init_main.c (revision 328307) +++ sys/kern/init_main.c (working copy) @@ -159,7 +159,7 @@ count += newsysinit_end - newsysinit; else count += sysinit_end - sysinit; - newset = malloc(count * sizeof(*sipp), M_TEMP, M_NOWAIT); + newset = mallocarray(count, sizeof(*sipp), M_TEMP, M_NOWAIT); if (newset == NULL) panic("cannot malloc for sysinit"); xipp = newset; Index: sys/kern/kern_cpu.c =================================================================== --- sys/kern/kern_cpu.c (revision 328307) +++ sys/kern/kern_cpu.c (working copy) @@ -444,7 +444,7 @@ * match of settings against each level. */ count = CF_MAX_LEVELS; - levels = malloc(count * sizeof(*levels), M_TEMP, M_NOWAIT); + levels = mallocarray(count, sizeof(*levels), M_TEMP, M_NOWAIT); if (levels == NULL) return (ENOMEM); error = CPUFREQ_LEVELS(sc->dev, levels, &count); @@ -969,7 +969,7 @@ /* Get settings from the device and generate the output string. */ set_count = MAX_SETTINGS; - sets = malloc(set_count * sizeof(*sets), M_TEMP, M_NOWAIT); + sets = mallocarray(set_count, sizeof(*sets), M_TEMP, M_NOWAIT); if (sets == NULL) { sbuf_delete(&sb); return (ENOMEM); Index: sys/kern/kern_ctf.c =================================================================== --- sys/kern/kern_ctf.c (revision 328307) +++ sys/kern/kern_ctf.c (working copy) @@ -45,7 +45,7 @@ { void *ptr; - ptr = malloc(items * size, M_TEMP, M_NOWAIT); + ptr = mallocarray(items, size, M_TEMP, M_NOWAIT); return ptr; } Index: sys/kern/kern_exec.c =================================================================== --- sys/kern/kern_exec.c (revision 328307) +++ sys/kern/kern_exec.c (working copy) @@ -1305,7 +1305,7 @@ args->begin_envv = args->endp; /* Create new file descriptor table. */ - kfds = malloc(fdslen * sizeof(int), M_TEMP, M_WAITOK); + kfds = mallocarray(fdslen, sizeof(int), M_TEMP, M_WAITOK); error = copyin(fds, kfds, fdslen * sizeof(int)); if (error != 0) { free(kfds, M_TEMP); @@ -1698,7 +1698,7 @@ if (execsw) for (es = execsw; *es; es++) count++; - newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK); + newexecsw = mallocarray(count, sizeof(*es), M_TEMP, M_WAITOK); xs = newexecsw; if (execsw) for (es = execsw; *es; es++) @@ -1729,7 +1729,7 @@ for (es = execsw; *es; es++) if (*es != execsw_arg) count++; - newexecsw = malloc(count * sizeof(*es), M_TEMP, M_WAITOK); + newexecsw = mallocarray(count, sizeof(*es), M_TEMP, M_WAITOK); xs = newexecsw; for (es = execsw; *es; es++) if (*es != execsw_arg) Index: sys/kern/kern_ktr.c =================================================================== --- sys/kern/kern_ktr.c (revision 328307) +++ sys/kern/kern_ktr.c (working copy) @@ -231,7 +231,7 @@ else oldbuf = NULL; /* Allocate a new buffer. */ - buf = malloc(sizeof(*buf) * entries, M_KTR, M_WAITOK | M_ZERO); + buf = mallocarray(entries, sizeof(*buf), M_KTR, M_WAITOK | M_ZERO); /* Install the new buffer and restart ktr. */ ktr_buf = buf; ktr_entries = entries; Index: sys/kern/kern_osd.c =================================================================== --- sys/kern/kern_osd.c (revision 328307) +++ sys/kern/kern_osd.c (working copy) @@ -127,8 +127,8 @@ osdm[type].osd_methods = realloc(osdm[type].osd_methods, sizeof(osd_method_t) * osdm[type].osd_ntslots * osdm[type].osd_nmethods, M_OSD, M_WAITOK); - newptr = malloc(sizeof(osd_destructor_t) * - osdm[type].osd_ntslots, M_OSD, M_WAITOK); + newptr = mallocarray(osdm[type].osd_ntslots, + sizeof(osd_destructor_t), M_OSD, M_WAITOK); rm_wlock(&osdm[type].osd_object_lock); bcopy(osdm[type].osd_destructors, newptr, sizeof(osd_destructor_t) * i); @@ -211,7 +211,7 @@ KASSERT(slot > 0, ("Invalid slot.")); OSD_DEBUG("Reserving slot array (slot=%u).", slot); - return (malloc(sizeof(void *) * slot, M_OSD, M_WAITOK | M_ZERO)); + return (mallocarray(slot, sizeof(void *), M_OSD, M_WAITOK | M_ZERO)); } int Index: sys/kern/kern_physio.c =================================================================== --- sys/kern/kern_physio.c (revision 328307) +++ sys/kern/kern_physio.c (working copy) @@ -100,7 +100,8 @@ } else if ((dev->si_flags & SI_UNMAPPED) && unmapped_buf_allowed) { pbuf = NULL; maxpages = btoc(MIN(uio->uio_resid, MAXPHYS)) + 1; - pages = malloc(sizeof(*pages) * maxpages, M_DEVBUF, M_WAITOK); + pages = mallocarray(maxpages, sizeof(*pages), M_DEVBUF, + M_WAITOK); } else { pbuf = getpbuf(NULL); sa = pbuf->b_data; Index: sys/kern/kern_pmc.c =================================================================== --- sys/kern/kern_pmc.c (revision 328307) +++ sys/kern/kern_pmc.c (working copy) @@ -338,7 +338,8 @@ "range.\n", pmc_softevents); pmc_softevents = PMC_EV_DYN_COUNT; } - pmc_softs = malloc(pmc_softevents * sizeof(struct pmc_soft *), M_PMCHOOKS, M_NOWAIT|M_ZERO); + pmc_softs = mallocarray(pmc_softevents, sizeof(struct pmc_soft *), + M_PMCHOOKS, M_NOWAIT|M_ZERO); KASSERT(pmc_softs != NULL, ("cannot allocate soft events table")); } Index: sys/kern/link_elf_obj.c =================================================================== --- sys/kern/link_elf_obj.c (revision 328307) +++ sys/kern/link_elf_obj.c (working copy) @@ -293,13 +293,13 @@ /* Allocate space for tracking the load chunks */ if (ef->nprogtab != 0) - ef->progtab = malloc(ef->nprogtab * sizeof(*ef->progtab), + ef->progtab = mallocarray(ef->nprogtab, sizeof(*ef->progtab), M_LINKER, M_WAITOK | M_ZERO); if (ef->nreltab != 0) - ef->reltab = malloc(ef->nreltab * sizeof(*ef->reltab), + ef->reltab = mallocarray(ef->nreltab, sizeof(*ef->reltab), M_LINKER, M_WAITOK | M_ZERO); if (ef->nrelatab != 0) - ef->relatab = malloc(ef->nrelatab * sizeof(*ef->relatab), + ef->relatab = mallocarray(ef->nrelatab, sizeof(*ef->relatab), M_LINKER, M_WAITOK | M_ZERO); if ((ef->nprogtab != 0 && ef->progtab == NULL) || (ef->nreltab != 0 && ef->reltab == NULL) || @@ -649,13 +649,13 @@ /* Allocate space for tracking the load chunks */ if (ef->nprogtab != 0) - ef->progtab = malloc(ef->nprogtab * sizeof(*ef->progtab), + ef->progtab = mallocarray(ef->nprogtab, sizeof(*ef->progtab), M_LINKER, M_WAITOK | M_ZERO); if (ef->nreltab != 0) - ef->reltab = malloc(ef->nreltab * sizeof(*ef->reltab), + ef->reltab = mallocarray(ef->nreltab, sizeof(*ef->reltab), M_LINKER, M_WAITOK | M_ZERO); if (ef->nrelatab != 0) - ef->relatab = malloc(ef->nrelatab * sizeof(*ef->relatab), + ef->relatab = mallocarray(ef->nrelatab, sizeof(*ef->relatab), M_LINKER, M_WAITOK | M_ZERO); if (symtabindex == -1) { Index: sys/kern/subr_bus.c =================================================================== --- sys/kern/subr_bus.c (revision 328307) +++ sys/kern/subr_bus.c (working copy) @@ -1464,7 +1464,7 @@ device_t *list; count = devclass_get_count(dc); - list = malloc(count * sizeof(device_t), M_TEMP, M_NOWAIT|M_ZERO); + list = mallocarray(count, sizeof(device_t), M_TEMP, M_NOWAIT|M_ZERO); if (!list) return (ENOMEM); @@ -1680,7 +1680,7 @@ oldlist = dc->devices; newsize = roundup((unit + 1), MINALLOCSIZE / sizeof(device_t)); - newlist = malloc(sizeof(device_t) * newsize, M_BUS, M_NOWAIT); + newlist = mallocarray(newsize, sizeof(device_t), M_BUS, M_NOWAIT); if (!newlist) return (ENOMEM); if (oldlist != NULL) @@ -2300,7 +2300,7 @@ return (0); } - list = malloc(count * sizeof(device_t), M_TEMP, M_NOWAIT|M_ZERO); + list = mallocarray(count, sizeof(device_t), M_TEMP, M_NOWAIT|M_ZERO); if (!list) return (ENOMEM); Index: sys/kern/subr_counter.c =================================================================== --- sys/kern/subr_counter.c (revision 328307) +++ sys/kern/subr_counter.c (working copy) @@ -103,7 +103,7 @@ uint64_t *out; int error; - out = malloc(arg2 * sizeof(uint64_t), M_TEMP, M_WAITOK); + out = mallocarray(arg2, sizeof(uint64_t), M_TEMP, M_WAITOK); for (int i = 0; i < arg2; i++) out[i] = counter_u64_fetch(((counter_u64_t *)arg1)[i]); Index: sys/kern/subr_hash.c =================================================================== --- sys/kern/subr_hash.c (revision 328307) +++ sys/kern/subr_hash.c (working copy) @@ -69,7 +69,7 @@ continue; hashsize >>= 1; - hashtbl = malloc((u_long)hashsize * sizeof(*hashtbl), type, + hashtbl = mallocarray(hashsize, sizeof(*hashtbl), type, hash_mflags(flags)); if (hashtbl != NULL) { for (i = 0; i < hashsize; i++) @@ -129,7 +129,7 @@ } hashsize = primes[i - 1]; - hashtbl = malloc((u_long)hashsize * sizeof(*hashtbl), type, + hashtbl = mallocarray(hashsize, sizeof(*hashtbl), type, hash_mflags(flags)); if (hashtbl == NULL) return (NULL); Index: sys/kern/subr_intr.c =================================================================== --- sys/kern/subr_intr.c (revision 328307) +++ sys/kern/subr_intr.c (working copy) @@ -1298,7 +1298,7 @@ ("%s: Found a non-MSI controller: %s", __func__, device_get_name(pic->pic_dev))); - isrc = malloc(sizeof(*isrc) * count, M_INTRNG, M_WAITOK); + isrc = mallocarray(count, sizeof(*isrc), M_INTRNG, M_WAITOK); err = MSI_ALLOC_MSI(pic->pic_dev, child, count, maxcount, &pdev, isrc); if (err != 0) { free(isrc, M_INTRNG); @@ -1335,7 +1335,7 @@ ("%s: Found a non-MSI controller: %s", __func__, device_get_name(pic->pic_dev))); - isrc = malloc(sizeof(*isrc) * count, M_INTRNG, M_WAITOK); + isrc = mallocarray(count, sizeof(*isrc), M_INTRNG, M_WAITOK); for (i = 0; i < count; i++) { msi = (struct intr_map_data_msi *) Index: sys/kern/subr_sfbuf.c =================================================================== --- sys/kern/subr_sfbuf.c (revision 328307) +++ sys/kern/subr_sfbuf.c (working copy) @@ -97,7 +97,7 @@ sf_buf_active = hashinit(nsfbufs, M_TEMP, &sf_buf_hashmask); TAILQ_INIT(&sf_buf_freelist); sf_base = kva_alloc(nsfbufs * PAGE_SIZE); - sf_bufs = malloc(nsfbufs * sizeof(struct sf_buf), M_TEMP, + sf_bufs = mallocarray(nsfbufs, sizeof(struct sf_buf), M_TEMP, M_WAITOK | M_ZERO); for (i = 0; i < nsfbufs; i++) { sf_bufs[i].kva = sf_base + i * PAGE_SIZE; Index: sys/kern/subr_taskqueue.c =================================================================== --- sys/kern/subr_taskqueue.c (revision 328307) +++ sys/kern/subr_taskqueue.c (working copy) @@ -651,8 +651,8 @@ vsnprintf(ktname, sizeof(ktname), name, ap); tq = *tqp; - tq->tq_threads = malloc(sizeof(struct thread *) * count, M_TASKQUEUE, - M_NOWAIT | M_ZERO); + tq->tq_threads = mallocarray(count, sizeof(struct thread *), + M_TASKQUEUE, M_NOWAIT | M_ZERO); if (tq->tq_threads == NULL) { printf("%s: no memory for %s threads\n", __func__, ktname); return (ENOMEM); Index: sys/kern/subr_vmem.c =================================================================== --- sys/kern/subr_vmem.c (revision 328307) +++ sys/kern/subr_vmem.c (working copy) @@ -692,7 +692,7 @@ MPASS(newhashsize > 0); - newhashlist = malloc(sizeof(struct vmem_hashlist) * newhashsize, + newhashlist = mallocarray(newhashsize, sizeof(struct vmem_hashlist), M_VMEM, M_NOWAIT); if (newhashlist == NULL) return ENOMEM; Index: sys/kern/sysv_sem.c =================================================================== --- sys/kern/sysv_sem.c (revision 328307) +++ sys/kern/sysv_sem.c (working copy) @@ -278,12 +278,12 @@ [PR_METHOD_REMOVE] = sem_prison_remove, }; - sem = malloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); - sema = malloc(sizeof(struct semid_kernel) * seminfo.semmni, M_SEM, + sem = mallocarray(seminfo.semmns, sizeof(struct sem), M_SEM, M_WAITOK); + sema = mallocarray(seminfo.semmni,sizeof(struct semid_kernel), M_SEM, M_WAITOK); - sema_mtx = malloc(sizeof(struct mtx) * seminfo.semmni, M_SEM, + sema_mtx = mallocarray(seminfo.semmni, sizeof(struct mtx), M_SEM, M_WAITOK | M_ZERO); - semu = malloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); + semu = mallocarray(seminfo.semusz, seminfo.semmnu, M_SEM, M_WAITOK); for (i = 0; i < seminfo.semmni; i++) { sema[i].u.sem_base = 0; @@ -851,7 +851,7 @@ */ count = semakptr->u.sem_nsems; mtx_unlock(sema_mtxp); - array = malloc(sizeof(*array) * count, M_TEMP, M_WAITOK); + array = mallocarray(count, sizeof(*array), M_TEMP, M_WAITOK); mtx_lock(sema_mtxp); if ((error = semvalid(semid, rpr, semakptr)) != 0) goto done2; @@ -904,7 +904,7 @@ */ count = semakptr->u.sem_nsems; mtx_unlock(sema_mtxp); - array = malloc(sizeof(*array) * count, M_TEMP, M_WAITOK); + array = mallocarray(count, sizeof(*array), M_TEMP, M_WAITOK); error = copyin(arg->array, array, count * sizeof(*array)); mtx_lock(sema_mtxp); if (error) @@ -1136,7 +1136,7 @@ } #endif - sops = malloc(nsops * sizeof(*sops), M_TEMP, M_WAITOK); + sops = mallocarray(nsops, sizeof(*sops), M_TEMP, M_WAITOK); } if ((error = copyin(uap->sops, sops, nsops * sizeof(sops[0]))) != 0) { DPRINTF(("error = %d from copyin(%p, %p, %d)\n", error, Index: sys/kern/uipc_usrreq.c =================================================================== --- sys/kern/uipc_usrreq.c (revision 328307) +++ sys/kern/uipc_usrreq.c (working copy) @@ -1612,7 +1612,7 @@ return (error); } - unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK); + unp_list = mallocarray(n, sizeof *unp_list, M_TEMP, M_WAITOK); UNP_LINK_RLOCK(); for (unp = LIST_FIRST(head), i = 0; unp && i < n; @@ -1994,7 +1994,7 @@ fdp = data; fdep = (struct filedescent **) CMSG_DATA(mtod(*controlp, struct cmsghdr *)); - fdev = malloc(sizeof(*fdev) * oldfds, M_FILECAPS, + fdev = mallocarray(oldfds, sizeof(*fdev), M_FILECAPS, M_WAITOK); for (i = 0; i < oldfds; i++, fdev++, fdp++) { fde = &fdesc->fd_ofiles[*fdp]; @@ -2341,7 +2341,7 @@ /* * Allocate space for a local list of dead unpcbs. */ - unref = malloc(unp_unreachable * sizeof(struct file *), + unref = mallocarray(unp_unreachable, sizeof(struct file *), M_TEMP, M_WAITOK); /* Index: sys/kern/vfs_syscalls.c =================================================================== --- sys/kern/vfs_syscalls.c (revision 328307) +++ sys/kern/vfs_syscalls.c (working copy) @@ -431,8 +431,8 @@ mtx_unlock(&mountlist_mtx); if (maxcount > count) maxcount = count; - tofree = sfsp = *buf = malloc(maxcount * sizeof(struct statfs), - M_STATFS, M_WAITOK); + tofree = sfsp = *buf = mallocarray(maxcount, + sizeof(struct statfs), M_STATFS, M_WAITOK); } count = 0; mtx_lock(&mountlist_mtx); Index: sys/kgssapi/gss_add_oid_set_member.c =================================================================== --- sys/kgssapi/gss_add_oid_set_member.c (revision 328307) +++ sys/kgssapi/gss_add_oid_set_member.c (working copy) @@ -58,7 +58,7 @@ if (t) return (GSS_S_COMPLETE); - new_elements = malloc((set->count + 1) * sizeof(gss_OID_desc), + new_elements = mallocarray(set->count + 1, sizeof(gss_OID_desc), M_GSSAPI, M_WAITOK); new_oid = &new_elements[set->count]; Index: sys/mips/ingenic/jz4780_nemc.c =================================================================== --- sys/mips/ingenic/jz4780_nemc.c (revision 328307) +++ sys/mips/ingenic/jz4780_nemc.c (working copy) @@ -212,7 +212,7 @@ if (sc->nranges == 0) return (0); - sc->ranges = malloc(sc->nranges * sizeof(sc->ranges[0]), + sc->ranges = mallocarray(sc->nranges, sizeof(sc->ranges[0]), M_DEVBUF, M_WAITOK); base_ranges = malloc(nbase_ranges, M_DEVBUF, M_WAITOK); OF_getencprop(node, "ranges", base_ranges, nbase_ranges); Index: sys/mips/mips/busdma_machdep.c =================================================================== --- sys/mips/mips/busdma_machdep.c (revision 328307) +++ sys/mips/mips/busdma_machdep.c (working copy) @@ -345,7 +345,8 @@ struct sync_list *slist; bus_dmamap_t map; - slist = malloc(sizeof(*slist) * dmat->nsegments, M_BUSDMA, M_NOWAIT); + slist = mallocarray(dmat->nsegments, sizeof(*slist), M_BUSDMA, + M_NOWAIT); if (slist == NULL) return (NULL); map = uma_zalloc_arg(dmamap_zone, dmat, M_NOWAIT); @@ -534,9 +535,9 @@ int error = 0; if (dmat->segments == NULL) { - dmat->segments = (bus_dma_segment_t *)malloc( - sizeof(bus_dma_segment_t) * dmat->nsegments, M_BUSDMA, - M_NOWAIT); + dmat->segments = + (bus_dma_segment_t *)mallocarray(dmat->nsegments, + sizeof(bus_dma_segment_t), M_BUSDMA, M_NOWAIT); if (dmat->segments == NULL) { CTR3(KTR_BUSDMA, "%s: tag %p error %d", __func__, dmat, ENOMEM); @@ -647,9 +648,9 @@ else mflags = M_WAITOK; if (dmat->segments == NULL) { - dmat->segments = (bus_dma_segment_t *)malloc( - sizeof(bus_dma_segment_t) * dmat->nsegments, M_BUSDMA, - mflags); + dmat->segments = + (bus_dma_segment_t *)mallocarray(dmat->nsegments, + sizeof(bus_dma_segment_t), M_BUSDMA, mflags); if (dmat->segments == NULL) { CTR4(KTR_BUSDMA, "%s: tag %p tag flags 0x%x error %d", __func__, dmat, dmat->flags, ENOMEM); Index: sys/mips/nlm/dev/sec/nlmrsa.c =================================================================== --- sys/mips/nlm/dev/sec/nlmrsa.c (revision 328307) +++ sys/mips/nlm/dev/sec/nlmrsa.c (working copy) @@ -346,7 +346,7 @@ if (ses == NULL) { sesn = sc->sc_nsessions; - ses = malloc((sesn + 1) * sizeof(*ses), + ses = mallocarray(sesn + 1, sizeof(*ses), M_DEVBUF, M_NOWAIT); if (ses == NULL) return (ENOMEM); @@ -528,8 +528,9 @@ goto errout; } cmd->rsafn = 0; /* Mod Exp */ - cmd->rsasrc = malloc( - cmd->rsaopsize * (krp->krp_iparams + krp->krp_oparams), + cmd->rsasrc = mallocarray( + krp->krp_iparams + krp->krp_oparams, + cmd->rsaopsize, M_DEVBUF, M_NOWAIT | M_ZERO); if (cmd->rsasrc == NULL) { Index: sys/net/altq/altq_red.c =================================================================== --- sys/net/altq/altq_red.c (revision 328307) +++ sys/net/altq/altq_red.c (working copy) @@ -1294,7 +1294,7 @@ return (NULL); bzero(fv, sizeof(struct flowvalve)); - fv->fv_fves = malloc(sizeof(struct fve) * num, + fv->fv_fves = mallocarray(num, sizeof(struct fve), M_DEVBUF, M_WAITOK); if (fv->fv_fves == NULL) { free(fv, M_DEVBUF); Index: sys/net/if_vlan.c =================================================================== --- sys/net/if_vlan.c (revision 328307) +++ sys/net/if_vlan.c (working copy) @@ -479,7 +479,7 @@ return; /* M_NOWAIT because we're called with trunk mutex held */ - hash2 = malloc(sizeof(struct ifvlanhead) * n2, M_VLAN, M_NOWAIT); + hash2 = mallocarray(n2, sizeof(struct ifvlanhead), M_VLAN, M_NOWAIT); if (hash2 == NULL) { printf("%s: out of memory -- hash size not changed\n", __func__); Index: sys/net/iflib.c =================================================================== --- sys/net/iflib.c (revision 328307) +++ sys/net/iflib.c (working copy) @@ -1550,15 +1550,15 @@ goto fail; } if (!(txq->ift_sds.ifsd_flags = - (uint8_t *) malloc(sizeof(uint8_t) * - scctx->isc_ntxd[txq->ift_br_offset], M_IFLIB, M_NOWAIT | M_ZERO))) { + (uint8_t *) mallocarray(scctx->isc_ntxd[txq->ift_br_offset], + sizeof(uint8_t), M_IFLIB, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate tx_buffer memory\n"); err = ENOMEM; goto fail; } if (!(txq->ift_sds.ifsd_m = - (struct mbuf **) malloc(sizeof(struct mbuf *) * - scctx->isc_ntxd[txq->ift_br_offset], M_IFLIB, M_NOWAIT | M_ZERO))) { + (struct mbuf **) mallocarray(scctx->isc_ntxd[txq->ift_br_offset], + sizeof(struct mbuf *), M_IFLIB, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate tx_buffer memory\n"); err = ENOMEM; goto fail; @@ -1570,7 +1570,8 @@ return (0); if (!(txq->ift_sds.ifsd_map = - (bus_dmamap_t *) malloc(sizeof(bus_dmamap_t) * scctx->isc_ntxd[txq->ift_br_offset], M_IFLIB, M_NOWAIT | M_ZERO))) { + (bus_dmamap_t *) mallocarray(scctx->isc_ntxd[txq->ift_br_offset], + sizeof(bus_dmamap_t), M_IFLIB, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate tx_buffer map memory\n"); err = ENOMEM; goto fail; @@ -1726,22 +1727,22 @@ goto fail; } if (!(fl->ifl_sds.ifsd_flags = - (uint8_t *) malloc(sizeof(uint8_t) * - scctx->isc_nrxd[rxq->ifr_fl_offset], M_IFLIB, M_NOWAIT | M_ZERO))) { + (uint8_t *) mallocarray(scctx->isc_nrxd[rxq->ifr_fl_offset], + sizeof(uint8_t), M_IFLIB, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate tx_buffer memory\n"); err = ENOMEM; goto fail; } if (!(fl->ifl_sds.ifsd_m = - (struct mbuf **) malloc(sizeof(struct mbuf *) * - scctx->isc_nrxd[rxq->ifr_fl_offset], M_IFLIB, M_NOWAIT | M_ZERO))) { + (struct mbuf **) mallocarray(scctx->isc_nrxd[rxq->ifr_fl_offset], + sizeof(struct mbuf *), M_IFLIB, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate tx_buffer memory\n"); err = ENOMEM; goto fail; } if (!(fl->ifl_sds.ifsd_cl = - (caddr_t *) malloc(sizeof(caddr_t) * - scctx->isc_nrxd[rxq->ifr_fl_offset], M_IFLIB, M_NOWAIT | M_ZERO))) { + (caddr_t *) mallocarray(scctx->isc_nrxd[rxq->ifr_fl_offset], + sizeof(caddr_t), M_IFLIB, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate tx_buffer memory\n"); err = ENOMEM; goto fail; @@ -1753,7 +1754,8 @@ continue; if (!(fl->ifl_sds.ifsd_map = - (bus_dmamap_t *) malloc(sizeof(bus_dmamap_t) * scctx->isc_nrxd[rxq->ifr_fl_offset], M_IFLIB, M_NOWAIT | M_ZERO))) { + (bus_dmamap_t *) mallocarray(scctx->isc_nrxd[rxq->ifr_fl_offset], + sizeof(bus_dmamap_t), M_IFLIB, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate tx_buffer map memory\n"); err = ENOMEM; goto fail; @@ -4745,8 +4747,8 @@ /* Allocate the TX ring struct memory */ if (!(txq = - (iflib_txq_t) malloc(sizeof(struct iflib_txq) * - ntxqsets, M_IFLIB, M_NOWAIT | M_ZERO))) { + (iflib_txq_t) mallocarray(ntxqsets, sizeof(struct iflib_txq), + M_IFLIB, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate TX ring memory\n"); err = ENOMEM; goto fail; @@ -4754,8 +4756,8 @@ /* Now allocate the RX */ if (!(rxq = - (iflib_rxq_t) malloc(sizeof(struct iflib_rxq) * - nrxqsets, M_IFLIB, M_NOWAIT | M_ZERO))) { + (iflib_rxq_t) mallocarray(nrxqsets, sizeof(struct iflib_rxq), + M_IFLIB, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate RX ring memory\n"); err = ENOMEM; goto rx_fail; @@ -4849,7 +4851,8 @@ } rxq->ifr_nfl = nfree_lists; if (!(fl = - (iflib_fl_t) malloc(sizeof(struct iflib_fl) * nfree_lists, M_IFLIB, M_NOWAIT | M_ZERO))) { + (iflib_fl_t) mallocarray(nfree_lists, sizeof(struct iflib_fl), + M_IFLIB, M_NOWAIT | M_ZERO))) { device_printf(dev, "Unable to allocate free list memory\n"); err = ENOMEM; goto err_tx_desc; Index: sys/netgraph/netflow/ng_netflow.c =================================================================== --- sys/netgraph/netflow/ng_netflow.c (revision 328307) +++ sys/netgraph/netflow/ng_netflow.c (working copy) @@ -248,7 +248,7 @@ /* Initialize fib data */ priv->maxfibs = rt_numfibs; - priv->fib_data = malloc(sizeof(fib_export_p) * priv->maxfibs, + priv->fib_data = mallocarray(priv->maxfibs, sizeof(fib_export_p), M_NETGRAPH, M_WAITOK | M_ZERO); /* Make node and its data point at each other */ Index: sys/netgraph/ng_bridge.c =================================================================== --- sys/netgraph/ng_bridge.c (revision 328307) +++ sys/netgraph/ng_bridge.c (working copy) @@ -907,7 +907,7 @@ newMask = newNumBuckets - 1; /* Allocate and initialize new table */ - newTab = malloc(newNumBuckets * sizeof(*newTab), + newTab = mallocarray(newNumBuckets, sizeof(*newTab), M_NETGRAPH_BRIDGE, M_NOWAIT | M_ZERO); if (newTab == NULL) return; Index: sys/netgraph/ng_deflate.c =================================================================== --- sys/netgraph/ng_deflate.c (revision 328307) +++ sys/netgraph/ng_deflate.c (working copy) @@ -427,7 +427,7 @@ z_alloc(void *notused, u_int items, u_int size) { - return (malloc(items * size, M_NETGRAPH_DEFLATE, M_NOWAIT)); + return (mallocarray(items, size, M_NETGRAPH_DEFLATE, M_NOWAIT)); } static void Index: sys/netgraph/ng_parse.c =================================================================== --- sys/netgraph/ng_parse.c (revision 328307) +++ sys/netgraph/ng_parse.c (working copy) @@ -1207,7 +1207,8 @@ int align, len, blen, error = 0; /* Initialize */ - foff = malloc(num * sizeof(*foff), M_NETGRAPH_PARSE, M_NOWAIT | M_ZERO); + foff = mallocarray(num, sizeof(*foff), M_NETGRAPH_PARSE, + M_NOWAIT | M_ZERO); if (foff == NULL) { error = ENOMEM; goto done; Index: sys/netgraph/ng_sppp.c =================================================================== --- sys/netgraph/ng_sppp.c (revision 328307) +++ sys/netgraph/ng_sppp.c (working copy) @@ -122,7 +122,7 @@ int newlen; newlen = (2 * ng_sppp_units_len) + sizeof (*ng_sppp_units); - newarray = malloc (newlen * sizeof (*ng_sppp_units), + newarray = mallocarray(newlen, sizeof(*ng_sppp_units), M_NETGRAPH_SPPP, M_WAITOK); bcopy (ng_sppp_units, newarray, ng_sppp_units_len * sizeof (*ng_sppp_units)); Index: sys/netinet/ip_id.c =================================================================== --- sys/netinet/ip_id.c (revision 328307) +++ sys/netinet/ip_id.c (working copy) @@ -194,7 +194,7 @@ uint16_t *new_array; bitstr_t *new_bits; - new_array = malloc(new_size * sizeof(uint16_t), M_IPID, + new_array = mallocarray(new_size, sizeof(uint16_t), M_IPID, M_WAITOK | M_ZERO); new_bits = malloc(bitstr_size(65536), M_IPID, M_WAITOK | M_ZERO); Index: sys/netinet6/in6_jail.c =================================================================== --- sys/netinet6/in6_jail.c (revision 328307) +++ sys/netinet6/in6_jail.c (working copy) @@ -103,8 +103,8 @@ */ used = 1; if (newip6 == NULL) { - newip6 = malloc(ppr->pr_ip6s * sizeof(*newip6), - M_PRISON, M_NOWAIT); + newip6 = mallocarray(ppr->pr_ip6s, + sizeof(*newip6), M_PRISON, M_NOWAIT); if (newip6 != NULL) used = 0; } Index: sys/netpfil/ipfw/ip_dummynet.c =================================================================== --- sys/netpfil/ipfw/ip_dummynet.c (revision 328307) +++ sys/netpfil/ipfw/ip_dummynet.c (working copy) @@ -1235,7 +1235,7 @@ return (EINVAL); } fs->lookup_depth = dn_cfg.red_lookup_depth; - fs->w_q_lookup = (u_int *)malloc(fs->lookup_depth * sizeof(int), + fs->w_q_lookup = (u_int *)mallocarray(fs->lookup_depth, sizeof(int), M_DUMMYNET, M_NOWAIT); if (fs->w_q_lookup == NULL) { printf("dummynet: sorry, cannot allocate red lookup table\n"); Index: sys/netpfil/ipfw/ip_fw_nat.c =================================================================== --- sys/netpfil/ipfw/ip_fw_nat.c (revision 328307) +++ sys/netpfil/ipfw/ip_fw_nat.c (working copy) @@ -216,8 +216,8 @@ //memcpy(r, ser_r, SOF_REDIR); LIST_INIT(&r->spool_chain); off += sizeof(struct nat44_cfg_redir); - r->alink = malloc(sizeof(struct alias_link *) * r->pport_cnt, - M_IPFW, M_WAITOK | M_ZERO); + r->alink = mallocarray(r->pport_cnt, + sizeof(struct alias_link *), M_IPFW, M_WAITOK | M_ZERO); switch (r->mode) { case NAT44_REDIR_ADDR: r->alink[0] = LibAliasRedirectAddr(ptr->lib, r->laddr, Index: sys/netpfil/ipfw/ip_fw_sockopt.c =================================================================== --- sys/netpfil/ipfw/ip_fw_sockopt.c (revision 328307) +++ sys/netpfil/ipfw/ip_fw_sockopt.c (working copy) @@ -360,7 +360,7 @@ mflags = M_ZERO | ((locked != 0) ? M_NOWAIT : M_WAITOK); i = chain->n_rules + extra; - map = malloc(i * sizeof(struct ip_fw *), M_IPFW, mflags); + map = mallocarray(i, sizeof(struct ip_fw *), M_IPFW, mflags); if (map == NULL) { printf("%s: cannot allocate map\n", __FUNCTION__); return NULL; @@ -2798,9 +2798,8 @@ /* Stack */ pidx_first = ci->obuf; } else - pidx_first = malloc( - ci->object_opcodes * sizeof(struct obj_idx), - M_IPFW, M_WAITOK | M_ZERO); + pidx_first = mallocarray(ci->object_opcodes, + sizeof(struct obj_idx), M_IPFW, M_WAITOK | M_ZERO); error = 0; type = 0; @@ -2956,7 +2955,7 @@ memset(&rci, 0, sizeof(struct rule_check_info)); cbuf = &rci; } else - cbuf = malloc(ctlv->count * sizeof(*ci), M_TEMP, + cbuf = mallocarray(ctlv->count, sizeof(*ci), M_TEMP, M_WAITOK | M_ZERO); ci = cbuf; @@ -3223,7 +3222,7 @@ for (;;) { sz = ctl3_rsize + count; CTL3_UNLOCK(); - tmp = malloc(sizeof(*rw) * sz, M_IPFW, M_WAITOK | M_ZERO); + tmp = mallocarray(sz, sizeof(*rw), M_IPFW, M_WAITOK | M_ZERO); CTL3_LOCK(); if (ctl3_rsize + count <= sz) break; @@ -3458,7 +3457,7 @@ for (;;) { sz = ctl3_hsize + count; CTL3_UNLOCK(); - tmp = malloc(sizeof(*sh) * sz, M_IPFW, M_WAITOK | M_ZERO); + tmp = mallocarray(sz, sizeof(*sh), M_IPFW, M_WAITOK | M_ZERO); CTL3_LOCK(); if (ctl3_hsize + count <= sz) break; Index: sys/netpfil/ipfw/ip_fw_table_algo.c =================================================================== --- sys/netpfil/ipfw/ip_fw_table_algo.c (revision 328307) +++ sys/netpfil/ipfw/ip_fw_table_algo.c (working copy) @@ -1290,9 +1290,9 @@ cfg->size4 = 128; cfg->size6 = 128; - cfg->head4 = malloc(sizeof(struct chashbhead) * cfg->size4, M_IPFW, + cfg->head4 = mallocarray(cfg->size4, sizeof(struct chashbhead), M_IPFW, M_WAITOK | M_ZERO); - cfg->head6 = malloc(sizeof(struct chashbhead) * cfg->size6, M_IPFW, + cfg->head6 = mallocarray(cfg->size6, sizeof(struct chashbhead), M_IPFW, M_WAITOK | M_ZERO); for (i = 0; i < cfg->size4; i++) SLIST_INIT(&cfg->head4[i]); @@ -1750,7 +1750,7 @@ mi->size = (*pflags >> 16) & 0xFFFF; mi->size6 = *pflags & 0xFFFF; if (mi->size > 0) { - head = malloc(sizeof(struct chashbhead) * mi->size, + head = mallocarray(mi->size, sizeof(struct chashbhead), M_IPFW, M_WAITOK | M_ZERO); for (i = 0; i < mi->size; i++) SLIST_INIT(&head[i]); @@ -1758,7 +1758,7 @@ } if (mi->size6 > 0) { - head = malloc(sizeof(struct chashbhead) * mi->size6, + head = mallocarray(mi->size6, sizeof(struct chashbhead), M_IPFW, M_WAITOK | M_ZERO); for (i = 0; i < mi->size6; i++) SLIST_INIT(&head[i]); @@ -2105,7 +2105,7 @@ icfg->ii = ipfw_objhash_create(DEFAULT_IFIDX_SIZE); icfg->size = DEFAULT_IFIDX_SIZE; - icfg->main_ptr = malloc(sizeof(struct ifidx) * icfg->size, M_IPFW, + icfg->main_ptr = mallocarray(icfg->size, sizeof(struct ifidx), M_IPFW, M_WAITOK | M_ZERO); icfg->ch = ch; @@ -2453,7 +2453,7 @@ memset(mi, 0, sizeof(struct mod_item)); mi->size = *pflags; - mi->main_ptr = malloc(sizeof(struct ifidx) * mi->size, M_IPFW, + mi->main_ptr = mallocarray(mi->size, sizeof(struct ifidx), M_IPFW, M_WAITOK | M_ZERO); return (0); @@ -2728,7 +2728,7 @@ cfg = malloc(sizeof(*cfg), M_IPFW, M_WAITOK | M_ZERO); cfg->size = 16; - cfg->main_ptr = malloc(sizeof(struct numarray) * cfg->size, M_IPFW, + cfg->main_ptr = mallocarray(cfg->size, sizeof(struct numarray), M_IPFW, M_WAITOK | M_ZERO); *ta_state = cfg; @@ -2911,7 +2911,7 @@ memset(mi, 0, sizeof(struct mod_item)); mi->size = *pflags; - mi->main_ptr = malloc(sizeof(struct numarray) * mi->size, M_IPFW, + mi->main_ptr = mallocarray(mi->size, sizeof(struct numarray), M_IPFW, M_WAITOK | M_ZERO); return (0); Index: sys/netsmb/smb_crypt.c =================================================================== --- sys/netsmb/smb_crypt.c (revision 328307) +++ sys/netsmb/smb_crypt.c (working copy) @@ -121,7 +121,7 @@ u_int len; len = strlen(apwd); - unipwd = malloc((len + 1) * sizeof(u_int16_t), M_SMBTEMP, M_WAITOK); + unipwd = mallocarray(len + 1, sizeof(u_int16_t), M_SMBTEMP, M_WAITOK); /* * S21 = concat(MD4(U(apwd)), zeros(5)); */ @@ -175,7 +175,7 @@ */ pwd = smb_vc_getpass(vcp); len = strlen(pwd); - unipwd = malloc((len + 1) * sizeof(u_int16_t), M_SMBTEMP, M_WAITOK); + unipwd = mallocarray(len + 1, sizeof(u_int16_t), M_SMBTEMP, M_WAITOK); smb_strtouni(unipwd, pwd); MD4Init(&md4); MD4Update(&md4, (u_char *)unipwd, len * sizeof(u_int16_t)); Index: sys/opencrypto/criov.c =================================================================== --- sys/opencrypto/criov.c (revision 328307) +++ sys/opencrypto/criov.c (working copy) @@ -215,7 +215,7 @@ mtmp = m; while ((mtmp = mtmp->m_next) != NULL) j++; - iov = malloc(sizeof *iov * (i + j), M_CRYPTO_DATA, + iov = mallocarray(i + j, sizeof *iov, M_CRYPTO_DATA, M_NOWAIT); if (iov == NULL) return ENOMEM; Index: sys/opencrypto/cryptosoft.c =================================================================== --- sys/opencrypto/cryptosoft.c (revision 328307) +++ sys/opencrypto/cryptosoft.c (working copy) @@ -730,7 +730,7 @@ } else swcr_sesnum *= 2; - swd = malloc(swcr_sesnum * sizeof(struct swcr_data *), + swd = mallocarray(swcr_sesnum, sizeof(struct swcr_data *), M_CRYPTO_DATA, M_NOWAIT|M_ZERO); if (swd == NULL) { /* Reset session number */ Index: sys/powerpc/powernv/opal_dev.c =================================================================== --- sys/powerpc/powernv/opal_dev.c (revision 328307) +++ sys/powerpc/powernv/opal_dev.c (working copy) @@ -112,7 +112,7 @@ n_irqs = OF_getproplen(ofw_bus_get_node(dev), "opal-interrupts") / sizeof(*irqs); - irqs = malloc(n_irqs * sizeof(*irqs), M_DEVBUF, M_WAITOK); + irqs = mallocarray(n_irqs, sizeof(*irqs), M_DEVBUF, M_WAITOK); OF_getencprop(ofw_bus_get_node(dev), "opal-interrupts", irqs, n_irqs * sizeof(*irqs)); for (i = 0; i < n_irqs; i++) Index: sys/powerpc/powerpc/mem.c =================================================================== --- sys/powerpc/powerpc/mem.c (revision 328307) +++ sys/powerpc/powerpc/mem.c (working copy) @@ -219,7 +219,7 @@ { sc->mr_cap = 0; sc->mr_ndesc = 8; /* XXX: Should be dynamically expandable */ - sc->mr_desc = malloc(sc->mr_ndesc * sizeof(struct mem_range_desc), + sc->mr_desc = mallocarray(sc->mr_ndesc, sizeof(struct mem_range_desc), M_MEMDESC, M_WAITOK | M_ZERO); } @@ -289,7 +289,7 @@ nd = imin(mo->mo_arg[0], mem_range_softc.mr_ndesc); if (nd > 0) { md = (struct mem_range_desc *) - malloc(nd * sizeof(struct mem_range_desc), + mallocarray(nd, sizeof(struct mem_range_desc), M_MEMDESC, M_WAITOK); error = mem_range_attr_get(md, &nd); if (!error) Index: sys/powerpc/ps3/ps3disk.c =================================================================== --- sys/powerpc/ps3/ps3disk.c (revision 328307) +++ sys/powerpc/ps3/ps3disk.c (working copy) @@ -225,7 +225,7 @@ /* Setup disks */ - sc->sc_disk = malloc(sc->sc_nregs * sizeof(struct disk *), + sc->sc_disk = mallocarray(sc->sc_nregs, sizeof(struct disk *), M_PS3DISK, M_ZERO | M_WAITOK); if (!sc->sc_disk) { device_printf(dev, "Could not allocate disk(s)\n"); @@ -521,7 +521,7 @@ if (!sc->sc_nregs) return 0; - sc->sc_reg = malloc(sc->sc_nregs * sizeof(struct ps3disk_region), + sc->sc_reg = mallocarray(sc->sc_nregs, sizeof(struct ps3disk_region), M_PS3DISK, M_ZERO | M_WAITOK); if (!sc->sc_reg) { err = ENOMEM; Index: sys/powerpc/pseries/phyp_vscsi.c =================================================================== --- sys/powerpc/pseries/phyp_vscsi.c (revision 328307) +++ sys/powerpc/pseries/phyp_vscsi.c (working copy) @@ -336,8 +336,8 @@ mtx_lock(&sc->io_lock); vscsi_setup_bus(sc); - sc->xfer = malloc(sizeof(sc->xfer[0])*sc->max_transactions, M_VSCSI, - M_NOWAIT); + sc->xfer = mallocarray(sc->max_transactions, sizeof(sc->xfer[0]), + M_VSCSI, M_NOWAIT); for (i = 0; i < sc->max_transactions; i++) { xp = &sc->xfer[i]; xp->sc = sc; Index: sys/rpc/rpcsec_gss/rpcsec_gss_conf.c =================================================================== --- sys/rpc/rpcsec_gss/rpcsec_gss_conf.c (revision 328307) +++ sys/rpc/rpcsec_gss/rpcsec_gss_conf.c (working copy) @@ -105,7 +105,7 @@ } count++; - mech_names = malloc(count * sizeof(const char *), M_RPC, M_WAITOK); + mech_names = mallocarray(count, sizeof(const char *), M_RPC, M_WAITOK); count = 0; LIST_FOREACH(km, &kgss_mechs, km_link) { mech_names[count++] = km->km_mech_name; Index: sys/sparc64/sbus/sbus.c =================================================================== --- sys/sparc64/sbus/sbus.c (revision 328307) +++ sys/sparc64/sbus/sbus.c (working copy) @@ -303,7 +303,7 @@ sizeof(*range), (void **)&range)) == -1) { panic("%s: error getting ranges property", __func__); } - sc->sc_rd = malloc(sizeof(*sc->sc_rd) * sc->sc_nrange, M_DEVBUF, + sc->sc_rd = mallocarray(sc->sc_nrange, sizeof(*sc->sc_rd), M_DEVBUF, M_NOWAIT | M_ZERO); if (sc->sc_rd == NULL) panic("%s: cannot allocate rmans", __func__); Index: sys/x86/acpica/acpi_wakeup.c =================================================================== --- sys/x86/acpica/acpi_wakeup.c (revision 328307) +++ sys/x86/acpica/acpi_wakeup.c (working copy) @@ -357,7 +357,7 @@ printf("%s: can't register event handler\n", __func__); goto freepages; } - susppcbs = malloc(mp_ncpus * sizeof(*susppcbs), M_DEVBUF, M_WAITOK); + susppcbs = mallocarray(mp_ncpus, sizeof(*susppcbs), M_DEVBUF, M_WAITOK); for (i = 0; i < mp_ncpus; i++) { susppcbs[i] = malloc(sizeof(**susppcbs), M_DEVBUF, M_WAITOK); susppcbs[i]->sp_fpususpend = alloc_fpusave(M_WAITOK); Index: sys/x86/cpufreq/est.c =================================================================== --- sys/x86/cpufreq/est.c (revision 328307) +++ sys/x86/cpufreq/est.c (working copy) @@ -1119,7 +1119,7 @@ goto out; /* Parse settings into our local table format. */ - table = malloc((count + 1) * sizeof(freq_info), M_DEVBUF, M_NOWAIT); + table = mallocarray(count + 1, sizeof(freq_info), M_DEVBUF, M_NOWAIT); if (table == NULL) { error = ENOMEM; goto out; Index: sys/x86/iommu/busdma_dmar.c =================================================================== --- sys/x86/iommu/busdma_dmar.c (revision 328307) +++ sys/x86/iommu/busdma_dmar.c (working copy) @@ -673,7 +673,7 @@ pend = round_page(buf + buflen); offset = buf & PAGE_MASK; ma_cnt = OFF_TO_IDX(pend - pstart); - ma = malloc(sizeof(vm_page_t) * ma_cnt, M_DEVBUF, map->cansleep ? + ma = mallocarray(ma_cnt, sizeof(vm_page_t), M_DEVBUF, map->cansleep ? M_WAITOK : M_NOWAIT); if (ma == NULL) return (ENOMEM); @@ -702,7 +702,7 @@ pend = round_page((vm_offset_t)buf + buflen); offset = (vm_offset_t)buf & PAGE_MASK; ma_cnt = OFF_TO_IDX(pend - pstart); - ma = malloc(sizeof(vm_page_t) * ma_cnt, M_DEVBUF, map->cansleep ? + ma = malloc(ma_cnt, sizeof(vm_page_t), M_DEVBUF, map->cansleep ? M_WAITOK : M_NOWAIT); if (ma == NULL) return (ENOMEM); Index: sys/x86/iommu/intel_ctx.c =================================================================== --- sys/x86/iommu/intel_ctx.c (revision 328307) +++ sys/x86/iommu/intel_ctx.c (working copy) @@ -239,7 +239,7 @@ entry->end += DMAR_PAGE_SIZE * 0x20; } size = OFF_TO_IDX(entry->end - entry->start); - ma = malloc(sizeof(vm_page_t) * size, M_TEMP, M_WAITOK); + ma = mallocarray(size, sizeof(vm_page_t), M_TEMP, M_WAITOK); for (i = 0; i < size; i++) { ma[i] = vm_page_getfake(entry->start + PAGE_SIZE * i, VM_MEMATTR_DEFAULT); Index: sys/x86/iommu/intel_fault.c =================================================================== --- sys/x86/iommu/intel_fault.c (revision 328307) +++ sys/x86/iommu/intel_fault.c (working copy) @@ -269,7 +269,7 @@ TUNABLE_INT_FETCH("hw.dmar.fault_log_size", &unit->fault_log_size); if (unit->fault_log_size % 2 != 0) panic("hw.dmar_fault_log_size must be even"); - unit->fault_log = malloc(sizeof(uint64_t) * unit->fault_log_size, + unit->fault_log = mallocarray(unit->fault_log_size, sizeof(uint64_t), M_DEVBUF, M_WAITOK | M_ZERO); TASK_INIT(&unit->fault_task, 0, dmar_fault_task, unit); Index: sys/x86/x86/mca.c =================================================================== --- sys/x86/x86/mca.c (revision 328307) +++ sys/x86/x86/mca.c (working copy) @@ -825,12 +825,12 @@ static void cmci_setup(void) { - int i; + u_int i; - cmc_state = malloc((mp_maxid + 1) * sizeof(struct cmc_state *), M_MCA, + cmc_state = mallocarray(mp_maxid + 1, sizeof(struct cmc_state *), M_MCA, M_WAITOK); for (i = 0; i <= mp_maxid; i++) - cmc_state[i] = malloc(sizeof(struct cmc_state) * mca_banks, + cmc_state[i] = mallocarray(mca_banks, sizeof(struct cmc_state), M_MCA, M_WAITOK | M_ZERO); SYSCTL_ADD_PROC(NULL, SYSCTL_STATIC_CHILDREN(_hw_mca), OID_AUTO, "cmc_throttle", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, @@ -843,11 +843,11 @@ { u_int i; - amd_et_state = malloc((mp_maxid + 1) * sizeof(struct amd_et_state *), + amd_et_state = mallocarray(mp_maxid + 1, sizeof(struct amd_et_state *), M_MCA, M_WAITOK); for (i = 0; i <= mp_maxid; i++) - amd_et_state[i] = malloc(sizeof(struct amd_et_state) * - mca_banks, M_MCA, M_WAITOK | M_ZERO); + amd_et_state[i] = mallocarray(mca_banks, + sizeof(struct amd_et_state), M_MCA, M_WAITOK | M_ZERO); SYSCTL_ADD_PROC(NULL, SYSCTL_STATIC_CHILDREN(_hw_mca), OID_AUTO, "cmc_throttle", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, &cmc_throttle, 0, sysctl_positive_int, "I",