Some reallocarray() use; review Jean-Philippe Ouellet, patrick keshishian

ok tedu

53 files changed, 184 insertions, 186 deletions

diff --git a/sys/dev/ic/ahci.c b/sys/dev/ic/ahci.c
index 669ae5f0962..680dae6f7fb 100644
--- a/sys/dev/ic/ahci.c
+++ b/sys/dev/ic/ahci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ahci.c,v 1.15 2014/07/12 18:48:17 tedu Exp $ */
+/*	$OpenBSD: ahci.c,v 1.16 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2006 David Gwynne <dlg@openbsd.org>
@@ -527,8 +527,8 @@ ahci_port_alloc(struct ahci_softc *sc, u_int port)
 	}
 
 	/* Allocate a CCB for each command slot */
-	ap->ap_ccbs = malloc(sizeof(struct ahci_ccb) * sc->sc_ncmds, M_DEVBUF,
-	    M_NOWAIT | M_ZERO);
+	ap->ap_ccbs = mallocarray(sc->sc_ncmds, sizeof(struct ahci_ccb),
+	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (ap->ap_ccbs == NULL) {
 		printf("%s: unable to allocate command list for port %d\n",
 		    DEVNAME(sc), port);
diff --git a/sys/dev/ic/aic79xx.c b/sys/dev/ic/aic79xx.c
index 6fd07dd86cf..95c88722334 100644
--- a/sys/dev/ic/aic79xx.c
+++ b/sys/dev/ic/aic79xx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aic79xx.c,v 1.53 2014/07/12 18:48:17 tedu Exp $	*/
+/*	$OpenBSD: aic79xx.c,v 1.54 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2004 Milos Urbanek, Kenneth R. Westerback & Marco Peereboom
@@ -6177,8 +6177,8 @@ ahd_init(struct ahd_softc *ahd)
 	AHD_ASSERT_MODES(ahd, AHD_MODE_SCSI_MSK, AHD_MODE_SCSI_MSK);
 
 	ahd->stack_size = ahd_probe_stack_size(ahd);
-	ahd->saved_stack = malloc(ahd->stack_size * sizeof(uint16_t), M_DEVBUF,
-	    M_NOWAIT | M_ZERO);
+	ahd->saved_stack = mallocarray(ahd->stack_size, sizeof(uint16_t),
+	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (ahd->saved_stack == NULL)
 		return (ENOMEM);
 
diff --git a/sys/dev/ic/aic7xxx.c b/sys/dev/ic/aic7xxx.c
index 9d6874f1f09..723af0416fd 100644
--- a/sys/dev/ic/aic7xxx.c
+++ b/sys/dev/ic/aic7xxx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aic7xxx.c,v 1.87 2014/07/12 18:48:17 tedu Exp $	*/
+/*	$OpenBSD: aic7xxx.c,v 1.88 2014/07/13 23:10:23 deraadt Exp $	*/
 /*	$NetBSD: aic7xxx.c,v 1.108 2003/11/02 11:07:44 wiz Exp $	*/
 
 /*
@@ -40,7 +40,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGES.
  *
- * $Id: aic7xxx.c,v 1.87 2014/07/12 18:48:17 tedu Exp $
+ * $Id: aic7xxx.c,v 1.88 2014/07/13 23:10:23 deraadt Exp $
  */
 /*
  * Ported from FreeBSD by Pascal Renauld, Network Storage Solutions, Inc. - April 2003
@@ -4235,7 +4235,7 @@ ahc_init_scbdata(struct ahc_softc *ahc)
 	SLIST_INIT(&scb_data->sg_maps);
 
 	/* Allocate SCB resources */
-	scb_data->scbarray = malloc(sizeof(struct scb) * AHC_SCB_MAX_ALLOC,
+	scb_data->scbarray = mallocarray(AHC_SCB_MAX_ALLOC, sizeof(struct scb),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (scb_data->scbarray == NULL)
 		return (ENOMEM);
diff --git a/sys/dev/ic/ami.c b/sys/dev/ic/ami.c
index f1e3ba6bde1..9ea85f29e2c 100644
--- a/sys/dev/ic/ami.c
+++ b/sys/dev/ic/ami.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ami.c,v 1.227 2014/07/12 18:48:17 tedu Exp $	*/
+/*	$OpenBSD: ami.c,v 1.228 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2001 Michael Shalayeff
@@ -299,7 +299,7 @@ ami_alloc_ccbs(struct ami_softc *sc, int nccbs)
 	struct ami_ccbmem *ccbmem, *mem;
 	int i, error;
 
-	sc->sc_ccbs = malloc(sizeof(struct ami_ccb) * nccbs,
+	sc->sc_ccbs = mallocarray(nccbs, sizeof(struct ami_ccb),
 	    M_DEVBUF, M_NOWAIT);
 	if (sc->sc_ccbs == NULL) {
 		printf(": unable to allocate ccbs\n");
@@ -566,7 +566,7 @@ ami_attach(struct ami_softc *sc)
 #endif
 #endif
 
-	rsc = malloc(sizeof(struct ami_rawsoftc) * sc->sc_channels,
+	rsc = mallocarray(sc->sc_channels, sizeof(struct ami_rawsoftc),
 	    M_DEVBUF, M_NOWAIT|M_ZERO);
 	if (!rsc) {
 		printf("%s: no memory for raw interface\n", DEVNAME(sc));
@@ -2408,7 +2408,7 @@ ami_create_sensors(struct ami_softc *sc)
 	if (ssc == NULL)
 		return (1);
 
-	sc->sc_sensors = malloc(sizeof(struct ksensor) * sc->sc_nunits,
+	sc->sc_sensors = mallocarray(sc->sc_nunits, sizeof(struct ksensor),
 	    M_DEVBUF, M_WAITOK|M_CANFAIL|M_ZERO);
 	if (sc->sc_sensors == NULL)
 		return (1);
diff --git a/sys/dev/ic/ar5008.c b/sys/dev/ic/ar5008.c
index 0a55576527e..0cd073591c0 100644
--- a/sys/dev/ic/ar5008.c
+++ b/sys/dev/ic/ar5008.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ar5008.c,v 1.24 2014/07/12 18:48:17 tedu Exp $	*/
+/*	$OpenBSD: ar5008.c,v 1.25 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr>
@@ -569,7 +569,7 @@ ar5008_rx_alloc(struct athn_softc *sc)
 	bus_size_t size;
 	int error, nsegs, i;
 
-	rxq->bf = malloc(ATHN_NRXBUFS * sizeof(*bf), M_DEVBUF,
+	rxq->bf = mallocarray(ATHN_NRXBUFS, sizeof(*bf), M_DEVBUF,
 	    M_NOWAIT | M_ZERO);
 	if (rxq->bf == NULL)
 		return (ENOMEM);
diff --git a/sys/dev/ic/ar5xxx.c b/sys/dev/ic/ar5xxx.c
index dd86d6cd50a..fe1af1ca4fc 100644
--- a/sys/dev/ic/ar5xxx.c
+++ b/sys/dev/ic/ar5xxx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ar5xxx.c,v 1.57 2014/07/12 18:48:17 tedu Exp $	*/
+/*	$OpenBSD: ar5xxx.c,v 1.58 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2004, 2005, 2006, 2007 Reyk Floeter <reyk@openbsd.org>
@@ -388,7 +388,7 @@ ath_hal_init_channels(struct ath_hal *hal, HAL_CHANNEL *channels,
 	u_int domain_5ghz, domain_2ghz;
 	HAL_CHANNEL *all_channels;
 
-	if ((all_channels = malloc(sizeof(HAL_CHANNEL) * max_channels,
+	if ((all_channels = mallocarray(max_channels, sizeof(HAL_CHANNEL),
 	    M_TEMP, M_NOWAIT | M_ZERO)) == NULL)
 		return (AH_FALSE);
 
diff --git a/sys/dev/ic/ar9003.c b/sys/dev/ic/ar9003.c
index e80726f9db8..e0ec780f740 100644
--- a/sys/dev/ic/ar9003.c
+++ b/sys/dev/ic/ar9003.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ar9003.c,v 1.28 2014/07/12 18:48:17 tedu Exp $	*/
+/*	$OpenBSD: ar9003.c,v 1.29 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
@@ -725,7 +725,8 @@ ar9003_rx_alloc(struct athn_softc *sc, int qid, int count)
 	struct ar_rx_status *ds;
 	int error, i;
 
-	rxq->bf = malloc(count * sizeof(*bf), M_DEVBUF, M_NOWAIT | M_ZERO);
+	rxq->bf = mallocarray(count, sizeof(*bf), M_DEVBUF,
+	    M_NOWAIT | M_ZERO);
 	if (rxq->bf == NULL)
 		return (ENOMEM);
 
diff --git a/sys/dev/ic/cac.c b/sys/dev/ic/cac.c
index 2d90a355848..435dd477946 100644
--- a/sys/dev/ic/cac.c
+++ b/sys/dev/ic/cac.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cac.c,v 1.51 2014/07/12 18:48:17 tedu Exp $	*/
+/*	$OpenBSD: cac.c,v 1.52 2014/07/13 23:10:23 deraadt Exp $	*/
 /*	$NetBSD: cac.c,v 1.15 2000/11/08 19:20:35 ad Exp $	*/
 
 /*
@@ -230,8 +230,8 @@ cac_init(struct cac_softc *sc, int startfw)
 	}
 
 	sc->sc_nunits = cinfo.num_drvs;
-	sc->sc_dinfos = malloc(cinfo.num_drvs * sizeof(struct cac_drive_info),
-	    M_DEVBUF, M_NOWAIT | M_ZERO);
+	sc->sc_dinfos = mallocarray(cinfo.num_drvs,
+	    sizeof(struct cac_drive_info), M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (sc->sc_dinfos == NULL) {
 		printf("%s: cannot allocate memory for drive_info\n",
 		    sc->sc_dv.dv_xname);
@@ -911,8 +911,8 @@ cac_create_sensors(struct cac_softc *sc)
 	if (ssc == NULL)
 		return (1);
 
-	sc->sc_sensors = malloc(sizeof(struct ksensor) * sc->sc_nunits,
-	    M_DEVBUF, M_NOWAIT | M_ZERO);
+	sc->sc_sensors = mallocarray(sc->sc_nunits,
+	    sizeof(struct ksensor), M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (sc->sc_sensors == NULL)
 		return (1);
 
diff --git a/sys/dev/ic/ciss.c b/sys/dev/ic/ciss.c
index aa61a284c5c..614d4fecc42 100644
--- a/sys/dev/ic/ciss.c
+++ b/sys/dev/ic/ciss.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ciss.c,v 1.69 2014/07/12 18:48:17 tedu Exp $	*/
+/*	$OpenBSD: ciss.c,v 1.70 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2005,2006 Michael Shalayeff
@@ -347,7 +347,7 @@ ciss_attach(struct ciss_softc *sc)
 		return -1;
 	}
 
-	if (!(sc->sc_lds = malloc(sc->maxunits * sizeof(*sc->sc_lds),
+	if (!(sc->sc_lds = mallocarray(sc->maxunits, sizeof(*sc->sc_lds),
 	    M_DEVBUF, M_NOWAIT | M_ZERO))) {
 		bus_dmamem_free(sc->dmat, sc->cmdseg, 1);
 		bus_dmamap_destroy(sc->dmat, sc->cmdmap);
@@ -385,7 +385,7 @@ ciss_attach(struct ciss_softc *sc)
 
 	sc->sc_flags |= CISS_BIO;
 #ifndef SMALL_KERNEL
-	sc->sensors = malloc(sizeof(struct ksensor) * sc->maxunits,
+	sc->sensors = mallocarray(sc->maxunits, sizeof(struct ksensor),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (sc->sensors) {
 		struct device *dev;
diff --git a/sys/dev/ic/lance.c b/sys/dev/ic/lance.c
index 4d29cf1bd48..7f1b6492f60 100644
--- a/sys/dev/ic/lance.c
+++ b/sys/dev/ic/lance.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lance.c,v 1.2 2013/11/26 09:50:33 mpi Exp $	*/
+/*	$OpenBSD: lance.c,v 1.3 2014/07/13 23:10:23 deraadt Exp $	*/
 /*	$NetBSD: lance.c,v 1.46 2012/02/02 19:43:03 tls Exp $	*/
 
 /*-
@@ -247,9 +247,9 @@ lance_config(struct lance_softc *sc)
 	if_attach(ifp);
 	ether_ifattach(ifp);
 
-	sc->sc_rbufaddr = malloc(sc->sc_nrbuf * sizeof(int), M_DEVBUF,
+	sc->sc_rbufaddr = mallocarray(sc->sc_nrbuf, sizeof(int), M_DEVBUF,
 	    M_WAITOK);
-	sc->sc_tbufaddr = malloc(sc->sc_ntbuf * sizeof(int), M_DEVBUF,
+	sc->sc_tbufaddr = mallocarray(sc->sc_ntbuf, sizeof(int), M_DEVBUF,
 	    M_WAITOK);
 }
 
diff --git a/sys/dev/ic/malo.c b/sys/dev/ic/malo.c
index bf85ed4d2c6..80f442d5447 100644
--- a/sys/dev/ic/malo.c
+++ b/sys/dev/ic/malo.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: malo.c,v 1.99 2014/07/12 18:48:17 tedu Exp $ */
+/*	$OpenBSD: malo.c,v 1.100 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2006 Claudio Jeker <claudio@openbsd.org>
@@ -575,8 +575,8 @@ malo_alloc_rx_ring(struct malo_softc *sc, struct malo_rx_ring *ring, int count)
 
 	ring->physaddr = ring->map->dm_segs->ds_addr;
 
-	ring->data = malloc(count * sizeof (struct malo_rx_data), M_DEVBUF,
-	    M_NOWAIT);
+	ring->data = mallocarray(count, sizeof (struct malo_rx_data),
+	    M_DEVBUF, M_NOWAIT);
 	if (ring->data == NULL) {
 		printf("%s: could not allocate soft data\n",
 		    sc->sc_dev.dv_xname);
@@ -734,8 +734,8 @@ malo_alloc_tx_ring(struct malo_softc *sc, struct malo_tx_ring *ring,
 
 	ring->physaddr = ring->map->dm_segs->ds_addr;
 
-	ring->data = malloc(count * sizeof(struct malo_tx_data), M_DEVBUF,
-	    M_NOWAIT);
+	ring->data = mallocarray(count, sizeof(struct malo_tx_data),
+	    M_DEVBUF, M_NOWAIT);
 	if (ring->data == NULL) {
 		printf("%s: could not allocate soft data\n",
 		    sc->sc_dev.dv_xname);
diff --git a/sys/dev/ic/mfi.c b/sys/dev/ic/mfi.c
index fa15b75f4e1..5f906cb5193 100644
--- a/sys/dev/ic/mfi.c
+++ b/sys/dev/ic/mfi.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mfi.c,v 1.153 2014/07/12 18:48:17 tedu Exp $ */
+/* $OpenBSD: mfi.c,v 1.154 2014/07/13 23:10:23 deraadt Exp $ */
 /*
  * Copyright (c) 2006 Marco Peereboom <marco@peereboom.us>
  *
@@ -246,7 +246,7 @@ mfi_init_ccb(struct mfi_softc *sc)
 
 	DNPRINTF(MFI_D_CCB, "%s: mfi_init_ccb\n", DEVNAME(sc));
 
-	sc->sc_ccb = malloc(sizeof(struct mfi_ccb) * sc->sc_max_cmds,
+	sc->sc_ccb = mallocarray(sc->sc_max_cmds, sizeof(struct mfi_ccb),
 	    M_DEVBUF, M_WAITOK|M_ZERO);
 
 	for (i = 0; i < sc->sc_max_cmds; i++) {
@@ -2127,7 +2127,7 @@ mfi_create_sensors(struct mfi_softc *sc)
 	    sizeof(sc->sc_sensordev.xname));
 
 	if (ISSET(letoh32(sc->sc_info.mci_adapter_ops ), MFI_INFO_AOPS_BBU)) {
-		sc->sc_bbu = malloc(sizeof(*sc->sc_bbu) * 4,
+		sc->sc_bbu = mallocarray(4, sizeof(*sc->sc_bbu),
 		    M_DEVBUF, M_WAITOK | M_ZERO);
 
 		sc->sc_bbu[0].type = SENSOR_INDICATOR;
@@ -2162,7 +2162,7 @@ mfi_create_sensors(struct mfi_softc *sc)
 		}
 	}
 
-	sc->sc_sensors = malloc(sizeof(struct ksensor) * sc->sc_ld_cnt,
+	sc->sc_sensors = mallocarray(sc->sc_ld_cnt, sizeof(struct ksensor),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (sc->sc_sensors == NULL)
 		return (1);
diff --git a/sys/dev/ic/mpi.c b/sys/dev/ic/mpi.c
index 86648e4ed5e..e5c77b0118f 100644
--- a/sys/dev/ic/mpi.c
+++ b/sys/dev/ic/mpi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mpi.c,v 1.192 2014/07/12 18:48:17 tedu Exp $ */
+/*	$OpenBSD: mpi.c,v 1.193 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2005, 2006, 2009 David Gwynne <dlg@openbsd.org>
@@ -340,8 +340,8 @@ mpi_attach(struct mpi_softc *sc)
 				    DEVNAME(sc));
 			}
 
-			sc->sc_vol_page = malloc(sc->sc_cfg_hdr.page_length * 4,
-			    M_TEMP, M_WAITOK | M_CANFAIL);
+			sc->sc_vol_page = mallocarray(sc->sc_cfg_hdr.page_length,
+			    4, M_TEMP, M_WAITOK | M_CANFAIL);
 			if (sc->sc_vol_page == NULL) {
 				panic("%s: can't get memory for IOC page 2, "
 				    "bio disabled", DEVNAME(sc));
@@ -1050,7 +1050,7 @@ mpi_alloc_ccbs(struct mpi_softc *sc)
 	SLIST_INIT(&sc->sc_ccb_free);
 	mtx_init(&sc->sc_ccb_mtx, IPL_BIO);
 
-	sc->sc_ccbs = malloc(sizeof(struct mpi_ccb) * sc->sc_maxcmds,
+	sc->sc_ccbs = mallocarray(sc->sc_maxcmds, sizeof(struct mpi_ccb),
 	    M_DEVBUF, M_WAITOK | M_CANFAIL | M_ZERO);
 	if (sc->sc_ccbs == NULL) {
 		printf("%s: unable to allocate ccbs\n", DEVNAME(sc));
@@ -1156,7 +1156,7 @@ mpi_alloc_replies(struct mpi_softc *sc)
 {
 	DNPRINTF(MPI_D_MISC, "%s: mpi_alloc_replies\n", DEVNAME(sc));
 
-	sc->sc_rcbs = malloc(sc->sc_repq * sizeof(struct mpi_rcb), M_DEVBUF,
+	sc->sc_rcbs = mallocarray(sc->sc_repq, sizeof(struct mpi_rcb), M_DEVBUF,
 	    M_WAITOK|M_CANFAIL);
 	if (sc->sc_rcbs == NULL)
 		return (1);
@@ -3430,7 +3430,7 @@ mpi_create_sensors(struct mpi_softc *sc)
 	if (vol == 0)
 		return (0);
 
-	sc->sc_sensors = malloc(sizeof(struct ksensor) * vol,
+	sc->sc_sensors = mallocarray(vol, sizeof(struct ksensor),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (sc->sc_sensors == NULL)
 		return (1);
diff --git a/sys/dev/ic/nvme.c b/sys/dev/ic/nvme.c
index 8e2ae166171..6b852d88e70 100644
--- a/sys/dev/ic/nvme.c
+++ b/sys/dev/ic/nvme.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nvme.c,v 1.5 2014/07/12 18:48:17 tedu Exp $ */
+/*	$OpenBSD: nvme.c,v 1.6 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2014 David Gwynne <dlg@openbsd.org>
@@ -511,7 +511,7 @@ nvme_ccbs_alloc(struct nvme_softc *sc, u_int nccbs)
 	struct nvme_ccb *ccb;
 	u_int i;
 
-	sc->sc_ccbs = malloc(sizeof(*ccb) * nccbs, M_DEVBUF,
+	sc->sc_ccbs = mallocarray(nccbs, sizeof(*ccb), M_DEVBUF,
 	    M_WAITOK | M_CANFAIL);
 	if (sc->sc_ccbs == NULL)
 		return (1);
diff --git a/sys/dev/ic/oosiop.c b/sys/dev/ic/oosiop.c
index e47023b1331..00d0a58b976 100644
--- a/sys/dev/ic/oosiop.c
+++ b/sys/dev/ic/oosiop.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: oosiop.c,v 1.21 2014/07/08 17:19:25 deraadt Exp $	*/
+/*	$OpenBSD: oosiop.c,v 1.22 2014/07/13 23:10:23 deraadt Exp $	*/
 /*	$NetBSD: oosiop.c,v 1.4 2003/10/29 17:45:55 tsutsui Exp $	*/
 
 /*
@@ -292,7 +292,7 @@ oosiop_alloc_cb(struct oosiop_softc *sc, int ncb)
 	/*
 	 * Allocate oosiop_cb.
 	 */
-	cb = malloc(sizeof(*cb) * ncb, M_DEVBUF, M_NOWAIT | M_ZERO);
+	cb = mallocarray(ncb, sizeof(*cb), M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (cb == NULL) {
 		printf(": failed to allocate cb memory\n");
 		return (ENOMEM);
diff --git a/sys/dev/ic/osiop.c b/sys/dev/ic/osiop.c
index d933010bb12..9626df5a262 100644
--- a/sys/dev/ic/osiop.c
+++ b/sys/dev/ic/osiop.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: osiop.c,v 1.48 2011/06/23 16:31:16 deraadt Exp $	*/
+/*	$OpenBSD: osiop.c,v 1.49 2014/07/13 23:10:23 deraadt Exp $	*/
 /*	$NetBSD: osiop.c,v 1.9 2002/04/05 18:27:54 bouyer Exp $	*/
 
 /*
@@ -267,7 +267,7 @@ osiop_attach(sc)
 	/*
 	 * Allocate (malloc) memory for acb's.
 	 */
-	acb = malloc(sizeof(*acb) * OSIOP_NACB, M_DEVBUF, M_NOWAIT | M_ZERO);
+	acb = mallocarray(OSIOP_NACB, sizeof(*acb), M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (acb == NULL) {
 		printf(": can't allocate memory for acb\n");
 		return;
diff --git a/sys/dev/ic/qla.c b/sys/dev/ic/qla.c
index 7a520c6ae1b..41afecbd1e6 100644
--- a/sys/dev/ic/qla.c
+++ b/sys/dev/ic/qla.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qla.c,v 1.42 2014/07/12 18:48:17 tedu Exp $ */
+/*	$OpenBSD: qla.c,v 1.43 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2011 David Gwynne <dlg@openbsd.org>
@@ -2547,7 +2547,7 @@ qla_alloc_ccbs(struct qla_softc *sc)
 	mtx_init(&sc->sc_port_mtx, IPL_BIO);
 	mtx_init(&sc->sc_mbox_mtx, IPL_BIO);
 
-	sc->sc_ccbs = malloc(sizeof(struct qla_ccb) * sc->sc_maxcmds,
+	sc->sc_ccbs = mallocarray(sc->sc_maxcmds, sizeof(struct qla_ccb),
 	    M_DEVBUF, M_WAITOK | M_CANFAIL | M_ZERO);
 	if (sc->sc_ccbs == NULL) {
 		printf("%s: unable to allocate ccbs\n", DEVNAME(sc));
diff --git a/sys/dev/ic/qlw.c b/sys/dev/ic/qlw.c
index 37f21205760..86c32bd5125 100644
--- a/sys/dev/ic/qlw.c
+++ b/sys/dev/ic/qlw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qlw.c,v 1.23 2014/07/12 18:48:17 tedu Exp $ */
+/*	$OpenBSD: qlw.c,v 1.24 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2011 David Gwynne <dlg@openbsd.org>
@@ -1699,7 +1699,7 @@ qlw_alloc_ccbs(struct qlw_softc *sc)
 	mtx_init(&sc->sc_ccb_mtx, IPL_BIO);
 	mtx_init(&sc->sc_queue_mtx, IPL_BIO);
 
-	sc->sc_ccbs = malloc(sizeof(struct qlw_ccb) * sc->sc_maxccbs,
+	sc->sc_ccbs = mallocarray(sc->sc_maxccbs, sizeof(struct qlw_ccb),
 	    M_DEVBUF, M_WAITOK | M_CANFAIL | M_ZERO);
 	if (sc->sc_ccbs == NULL) {
 		printf("%s: unable to allocate ccbs\n", DEVNAME(sc));
diff --git a/sys/dev/ic/rt2560.c b/sys/dev/ic/rt2560.c
index fc9c24b0351..f460c801a65 100644
--- a/sys/dev/ic/rt2560.c
+++ b/sys/dev/ic/rt2560.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2560.c,v 1.64 2014/07/12 18:48:17 tedu Exp $  */
+/*	$OpenBSD: rt2560.c,v 1.65 2014/07/13 23:10:23 deraadt Exp $  */
 
 /*-
  * Copyright (c) 2005, 2006
@@ -388,8 +388,8 @@ rt2560_alloc_tx_ring(struct rt2560_softc *sc, struct rt2560_tx_ring *ring,
 
 	ring->physaddr = ring->map->dm_segs->ds_addr;
 
-	ring->data = malloc(count * sizeof (struct rt2560_tx_data), M_DEVBUF,
-	    M_NOWAIT | M_ZERO);
+	ring->data = mallocarray(count, sizeof (struct rt2560_tx_data),
+	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (ring->data == NULL) {
 		printf("%s: could not allocate soft data\n",
 		    sc->sc_dev.dv_xname);
@@ -532,8 +532,8 @@ rt2560_alloc_rx_ring(struct rt2560_softc *sc, struct rt2560_rx_ring *ring,
 
 	ring->physaddr = ring->map->dm_segs->ds_addr;
 
-	ring->data = malloc(count * sizeof (struct rt2560_rx_data), M_DEVBUF,
-	    M_NOWAIT | M_ZERO);
+	ring->data = mallocarray(count, sizeof (struct rt2560_rx_data),
+	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (ring->data == NULL) {
 		printf("%s: could not allocate soft data\n",
 		    sc->sc_dev.dv_xname);
diff --git a/sys/dev/ic/rt2661.c b/sys/dev/ic/rt2661.c
index caa37d0e1ce..798ff295f28 100644
--- a/sys/dev/ic/rt2661.c
+++ b/sys/dev/ic/rt2661.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2661.c,v 1.73 2014/07/12 18:48:17 tedu Exp $	*/
+/*	$OpenBSD: rt2661.c,v 1.74 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 2006
@@ -473,8 +473,8 @@ rt2661_alloc_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring,
 
 	ring->physaddr = ring->map->dm_segs->ds_addr;
 
-	ring->data = malloc(count * sizeof (struct rt2661_tx_data), M_DEVBUF,
-	    M_NOWAIT | M_ZERO);
+	ring->data = mallocarray(count, sizeof (struct rt2661_tx_data),
+	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (ring->data == NULL) {
 		printf("%s: could not allocate soft data\n",
 		    sc->sc_dev.dv_xname);
@@ -614,8 +614,8 @@ rt2661_alloc_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring,
 
 	ring->physaddr = ring->map->dm_segs->ds_addr;
 
-	ring->data = malloc(count * sizeof (struct rt2661_rx_data), M_DEVBUF,
-	    M_NOWAIT | M_ZERO);
+	ring->data = mallocarray(count, sizeof (struct rt2661_rx_data),
+	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (ring->data == NULL) {
 		printf("%s: could not allocate soft data\n",
 		    sc->sc_dev.dv_xname);
diff --git a/sys/dev/ic/rtw.c b/sys/dev/ic/rtw.c
index f63657cd3bf..7bb81932970 100644
--- a/sys/dev/ic/rtw.c
+++ b/sys/dev/ic/rtw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtw.c,v 1.86 2014/07/12 18:48:17 tedu Exp $	*/
+/*	$OpenBSD: rtw.c,v 1.87 2014/07/13 23:10:23 deraadt Exp $	*/
 /*	$NetBSD: rtw.c,v 1.29 2004/12/27 19:49:16 dyoung Exp $ */
 
 /*-
@@ -3614,7 +3614,7 @@ rtw_txsoft_blk_setup(struct rtw_txsoft_blk *tsb, u_int qlen)
 	SIMPLEQ_INIT(&tsb->tsb_dirtyq);
 	SIMPLEQ_INIT(&tsb->tsb_freeq);
 	tsb->tsb_ndesc = qlen;
-	tsb->tsb_desc = malloc(qlen * sizeof(*tsb->tsb_desc), M_DEVBUF,
+	tsb->tsb_desc = mallocarray(qlen, sizeof(*tsb->tsb_desc), M_DEVBUF,
 	    M_NOWAIT);
 	if (tsb->tsb_desc == NULL)
 		return ENOMEM;
diff --git a/sys/dev/ic/sili.c b/sys/dev/ic/sili.c
index 49be864def4..4f6f0771568 100644
--- a/sys/dev/ic/sili.c
+++ b/sys/dev/ic/sili.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sili.c,v 1.52 2014/07/12 18:48:17 tedu Exp $ */
+/*	$OpenBSD: sili.c,v 1.53 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2007 David Gwynne <dlg@openbsd.org>
@@ -748,7 +748,7 @@ sili_ports_alloc(struct sili_softc *sc)
 	struct sili_port		*sp;
 	int				i;
 
-	sc->sc_ports = malloc(sizeof(struct sili_port) * sc->sc_nports,
+	sc->sc_ports = mallocarray(sc->sc_nports, sizeof(struct sili_port),
 	    M_DEVBUF, M_WAITOK | M_ZERO);
 
 	for (i = 0; i < sc->sc_nports; i++) {
@@ -808,7 +808,7 @@ sili_ccb_alloc(struct sili_port *sp)
 	TAILQ_INIT(&sp->sp_active_ccbs);
 	TAILQ_INIT(&sp->sp_deferred_ccbs);
 
-	sp->sp_ccbs = malloc(sizeof(struct sili_ccb) * SILI_MAX_CMDS,
+	sp->sp_ccbs = mallocarray(SILI_MAX_CMDS, sizeof(struct sili_ccb),
 	    M_DEVBUF, M_WAITOK);
 	sp->sp_cmds = sili_dmamem_alloc(sc, SILI_CMD_LEN * SILI_MAX_CMDS,
 	    SILI_PRB_ALIGN);
diff --git a/sys/dev/ic/siop.c b/sys/dev/ic/siop.c
index d7d4a22d9b2..dcb6ab77c9e 100644
--- a/sys/dev/ic/siop.c
+++ b/sys/dev/ic/siop.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: siop.c,v 1.67 2014/07/12 18:48:17 tedu Exp $ */
+/*	$OpenBSD: siop.c,v 1.68 2014/07/13 23:10:23 deraadt Exp $ */
 /*	$NetBSD: siop.c,v 1.79 2005/11/18 23:10:32 bouyer Exp $	*/
 
 /*
@@ -1833,7 +1833,7 @@ siop_morecbd(sc)
 	}
 
 	/* allocate cmd list */
-	newcbd->cmds = malloc(sizeof(struct siop_cmd) * SIOP_NCMDPB,
+	newcbd->cmds = mallocarray(SIOP_NCMDPB, sizeof(struct siop_cmd),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (newcbd->cmds == NULL) {
 		printf("%s: can't allocate memory for command descriptors\n",
diff --git a/sys/dev/ic/vga.c b/sys/dev/ic/vga.c
index 4561404e111..688fbfd2349 100644
--- a/sys/dev/ic/vga.c
+++ b/sys/dev/ic/vga.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: vga.c,v 1.62 2014/07/12 18:48:17 tedu Exp $ */
+/* $OpenBSD: vga.c,v 1.63 2014/07/13 23:10:23 deraadt Exp $ */
 /* $NetBSD: vga.c,v 1.28.2.1 2000/06/30 16:27:47 simonb Exp $ */
 
 /*-
@@ -663,9 +663,8 @@ vga_alloc_screen(void *v, const struct wsscreen_descr *type, void **cookiep,
 		 * XXX We could be more clever and use video RAM.
 		 */
 		scr = LIST_FIRST(&vc->screens);
-		scr->pcs.mem =
-		  malloc(scr->pcs.type->ncols * scr->pcs.type->nrows * 2,
-		    M_DEVBUF, M_WAITOK);
+		scr->pcs.mem = mallocarray(scr->pcs.type->ncols,
+		    scr->pcs.type->nrows * 2, M_DEVBUF, M_WAITOK);
 	}
 
 	scr = malloc(sizeof(struct vgascreen), M_DEVBUF, M_WAITOK);
@@ -676,8 +675,8 @@ vga_alloc_screen(void *v, const struct wsscreen_descr *type, void **cookiep,
 		vc->active = scr;
 		vc->currenttype = type;
 	} else {
-		scr->pcs.mem = malloc(type->ncols * type->nrows * 2,
-				      M_DEVBUF, M_WAITOK);
+		scr->pcs.mem = mallocarray(type->ncols,
+		    type->nrows * 2, M_DEVBUF, M_WAITOK);
 		pcdisplay_eraserows(&scr->pcs, 0, type->nrows, *defattrp);
 	}
 
diff --git a/sys/dev/ic/z8530tty.c b/sys/dev/ic/z8530tty.c
index c31c146b998..1d9bc0b6f25 100644
--- a/sys/dev/ic/z8530tty.c
+++ b/sys/dev/ic/z8530tty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: z8530tty.c,v 1.24 2013/04/21 14:44:16 sebastia Exp $	*/
+/*	$OpenBSD: z8530tty.c,v 1.25 2014/07/13 23:10:23 deraadt Exp $	*/
 /*	$NetBSD: z8530tty.c,v 1.77 2001/05/30 15:24:24 lukem Exp $	*/
 
 /*-
@@ -342,8 +342,8 @@ zstty_attach(struct device *parent, struct device *self, void *aux)
 	tp->t_hwiflow = zshwiflow;
 
 	zst->zst_tty = tp;
-	zst->zst_rbuf = malloc(zstty_rbuf_size << 1, M_DEVBUF, M_WAITOK);
-	zst->zst_ebuf = zst->zst_rbuf + (zstty_rbuf_size << 1);
+	zst->zst_rbuf = mallocarray(zstty_rbuf_size, 2, M_DEVBUF, M_WAITOK);
+	zst->zst_ebuf = zst->zst_rbuf + (zstty_rbuf_size * 2);
 	/* Disable the high water mark. */
 	zst->zst_r_hiwat = 0;
 	zst->zst_r_lowat = 0;
diff --git a/sys/dev/pci/agp.c b/sys/dev/pci/agp.c
index 3b515a2ca6a..decfe9b496d 100644
--- a/sys/dev/pci/agp.c
+++ b/sys/dev/pci/agp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: agp.c,v 1.44 2014/07/12 18:48:51 tedu Exp $ */
+/* $OpenBSD: agp.c,v 1.45 2014/07/13 23:10:23 deraadt Exp $ */
 /*-
  * Copyright (c) 2000 Doug Rabson
  * All rights reserved.
@@ -398,7 +398,7 @@ agp_generic_bind_memory(struct agp_softc *sc, struct agp_memory *mem,
 	 */
 
 	nseg = (mem->am_size + PAGE_SIZE - 1) / PAGE_SIZE;
-	segs = malloc(nseg * sizeof *segs, M_AGP, M_WAITOK);
+	segs = mallocarray(nseg, sizeof *segs, M_AGP, M_WAITOK);
 	if ((error = bus_dmamem_alloc(sc->sc_dmat, mem->am_size, PAGE_SIZE, 0,
 	    segs, nseg, &mem->am_nseg, BUS_DMA_ZERO | BUS_DMA_WAITOK)) != 0) {
 		free(segs, M_AGP, 0);
diff --git a/sys/dev/pci/arc.c b/sys/dev/pci/arc.c
index bc569d83b96..b3e2170064b 100644
--- a/sys/dev/pci/arc.c
+++ b/sys/dev/pci/arc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: arc.c,v 1.102 2014/07/12 18:48:51 tedu Exp $ */
+/*	$OpenBSD: arc.c,v 1.103 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2006 David Gwynne <dlg@openbsd.org>
@@ -2618,7 +2618,7 @@ arc_create_sensors(void *xsc, void *arg)
 	}
 	sc->sc_nsensors = bi.bi_novol;
 
-	sc->sc_sensors = malloc(sizeof(struct ksensor) * sc->sc_nsensors,
+	sc->sc_sensors = mallocarray(sc->sc_nsensors, sizeof(struct ksensor),
 	    M_DEVBUF, M_WAITOK | M_ZERO);
 
 	strlcpy(sc->sc_sensordev.xname, DEVNAME(sc),
diff --git a/sys/dev/pci/azalia.c b/sys/dev/pci/azalia.c
index 2882f55a622..9eaa4a16815 100644
--- a/sys/dev/pci/azalia.c
+++ b/sys/dev/pci/azalia.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: azalia.c,v 1.214 2014/07/12 18:48:51 tedu Exp $	*/
+/*	$OpenBSD: azalia.c,v 1.215 2014/07/13 23:10:23 deraadt Exp $	*/
 /*	$NetBSD: azalia.c,v 1.20 2006/05/07 08:31:44 kent Exp $	*/
 
 /*-
@@ -829,7 +829,7 @@ azalia_get_ctrlr_caps(azalia_t *az)
 		printf("%s: no HD-Audio codecs\n", XNAME(az));
 		return -1;
 	}
-	az->codecs = malloc(sizeof(codec_t) * az->ncodecs, M_DEVBUF,
+	az->codecs = mallocarray(az->ncodecs, sizeof(codec_t), M_DEVBUF,
 	    M_NOWAIT | M_ZERO);
 	if (az->codecs == NULL) {
 		printf("%s: can't allocate memory for codecs\n", XNAME(az));
@@ -1631,7 +1631,8 @@ azalia_codec_init(codec_t *this)
 		return -1;
 	}
 	this->wend = this->wstart + COP_NSUBNODES(result);
-	this->w = malloc(sizeof(widget_t) * this->wend, M_DEVBUF, M_NOWAIT | M_ZERO);
+	this->w = mallocarray(this->wend, sizeof(widget_t), M_DEVBUF,
+	    M_NOWAIT | M_ZERO);
 	if (this->w == NULL) {
 		printf("%s: out of memory\n", XNAME(this->az));
 		return ENOMEM;
@@ -2054,7 +2055,7 @@ azalia_codec_sort_pins(codec_t *this)
 		}
 	}
 
-	this->opins = malloc(nopins * sizeof(struct io_pin), M_DEVBUF,
+	this->opins = mallocarray(nopins, sizeof(struct io_pin), M_DEVBUF,
 	    M_NOWAIT | M_ZERO);
 	if (this->opins == NULL)
 		return(ENOMEM);
@@ -2072,7 +2073,7 @@ azalia_codec_sort_pins(codec_t *this)
 			break;
 	}
 
-	this->opins_d = malloc(nopins_d * sizeof(struct io_pin), M_DEVBUF,
+	this->opins_d = mallocarray(nopins_d, sizeof(struct io_pin), M_DEVBUF,
 	    M_NOWAIT | M_ZERO);
 	if (this->opins_d == NULL)
 		return(ENOMEM);
@@ -2090,7 +2091,7 @@ azalia_codec_sort_pins(codec_t *this)
 			break;
 	}
 
-	this->ipins = malloc(nipins * sizeof(struct io_pin), M_DEVBUF,
+	this->ipins = mallocarray(nipins, sizeof(struct io_pin), M_DEVBUF,
 	    M_NOWAIT | M_ZERO);
 	if (this->ipins == NULL)
 		return(ENOMEM);
@@ -2108,7 +2109,7 @@ azalia_codec_sort_pins(codec_t *this)
 			break;
 	}
 
-	this->ipins_d = malloc(nipins_d * sizeof(struct io_pin), M_DEVBUF,
+	this->ipins_d = mallocarray(nipins_d, sizeof(struct io_pin), M_DEVBUF,
 	    M_NOWAIT | M_ZERO);
 	if (this->ipins_d == NULL)
 		return(ENOMEM);
@@ -2161,7 +2162,7 @@ azalia_codec_select_dacs(codec_t *this)
 	int nconv, conv;
 	int i, j, k, err;
 
-	convs = malloc(this->na_dacs * sizeof(nid_t), M_DEVBUF,
+	convs = mallocarray(this->na_dacs, sizeof(nid_t), M_DEVBUF,
 	    M_NOWAIT | M_ZERO);
 	if (convs == NULL)
 		return(ENOMEM);
@@ -2724,7 +2725,7 @@ azalia_codec_construct_format(codec_t *this, int newdac, int newadc)
 	if (this->formats != NULL)
 		free(this->formats, M_DEVBUF, 0);
 	this->nformats = 0;
-	this->formats = malloc(sizeof(struct audio_format) * variation,
+	this->formats = mallocarray(variation, sizeof(struct audio_format),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (this->formats == NULL) {
 		printf("%s: out of memory in %s\n",
@@ -3411,7 +3412,7 @@ azalia_widget_init_connection(widget_t *this, const codec_t *codec)
 		}
 	}
 
-	this->connections = malloc(sizeof(nid_t) * nconn, M_DEVBUF, M_NOWAIT);
+	this->connections = mallocarray(nconn, sizeof(nid_t), M_DEVBUF, M_NOWAIT);
 	if (this->connections == NULL) {
 		printf("%s: out of memory\n", XNAME(codec->az));
 		return ENOMEM;
@@ -4427,7 +4428,7 @@ azalia_create_encodings(codec_t *this)
 	if (this->encs != NULL)
 		free(this->encs, M_DEVBUF, 0);
 	this->nencs = 0;
-	this->encs = malloc(sizeof(struct audio_encoding) * nencs,
+	this->encs = mallocarray(nencs, sizeof(struct audio_encoding),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (this->encs == NULL) {
 		printf("%s: out of memory in %s\n",
diff --git a/sys/dev/pci/azalia_codec.c b/sys/dev/pci/azalia_codec.c
index f12affe009d..046954a6a17 100644
--- a/sys/dev/pci/azalia_codec.c
+++ b/sys/dev/pci/azalia_codec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: azalia_codec.c,v 1.162 2014/07/12 18:48:51 tedu Exp $	*/
+/*	$OpenBSD: azalia_codec.c,v 1.163 2014/07/13 23:10:23 deraadt Exp $	*/
 /*	$NetBSD: azalia_codec.c,v 1.8 2006/05/10 11:17:27 kent Exp $	*/
 
 /*-
@@ -658,7 +658,7 @@ azalia_mixer_init(codec_t *this)
 
 	this->maxmixers = 10;
 	this->nmixers = 0;
-	this->mixers = malloc(sizeof(mixer_item_t) * this->maxmixers,
+	this->mixers = mallocarray(this->maxmixers, sizeof(mixer_item_t),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (this->mixers == NULL) {
 		printf("%s: out of memory in %s\n", XNAME(this), __func__);
@@ -1252,7 +1252,8 @@ azalia_mixer_ensure_capacity(codec_t *this, size_t newsize)
 	newmax = this->maxmixers + 10;
 	if (newmax < newsize)
 		newmax = newsize;
-	newbuf = malloc(sizeof(mixer_item_t) * newmax, M_DEVBUF, M_NOWAIT | M_ZERO);
+	newbuf = mallocarray(newmax, sizeof(mixer_item_t), M_DEVBUF,
+	    M_NOWAIT | M_ZERO);
 	if (newbuf == NULL) {
 		printf("%s: out of memory in %s\n", XNAME(this), __func__);
 		return ENOMEM;
diff --git a/sys/dev/pci/cz.c b/sys/dev/pci/cz.c
index 9f743932f0b..3703e6aabff 100644
--- a/sys/dev/pci/cz.c
+++ b/sys/dev/pci/cz.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cz.c,v 1.19 2012/03/26 16:23:22 deraadt Exp $ */
+/*	$OpenBSD: cz.c,v 1.20 2014/07/13 23:10:23 deraadt Exp $ */
 /*	$NetBSD: cz.c,v 1.15 2001/01/20 19:10:36 thorpej Exp $	*/
 
 /*-
@@ -388,8 +388,8 @@ cz_attach(parent, self, aux)
 		return;
 	}
 
-	cz->cz_ports = malloc(sizeof(struct cztty_softc) * cz->cz_nchannels,
-	    M_DEVBUF, M_WAITOK | M_ZERO);
+	cz->cz_ports = mallocarray(cz->cz_nchannels,
+	    sizeof(struct cztty_softc), M_DEVBUF, M_WAITOK | M_ZERO);
 	cztty_attached_ttys += cz->cz_nchannels;
 
 	for (i = 0; i < cz->cz_nchannels; i++) {
diff --git a/sys/dev/pci/emuxki.c b/sys/dev/pci/emuxki.c
index eca0c3cbfd4..740c0e74879 100644
--- a/sys/dev/pci/emuxki.c
+++ b/sys/dev/pci/emuxki.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: emuxki.c,v 1.45 2014/07/12 18:48:51 tedu Exp $	*/
+/*	$OpenBSD: emuxki.c,v 1.46 2014/07/13 23:10:23 deraadt Exp $	*/
 /*	$NetBSD: emuxki.c,v 1.1 2001/10/17 18:39:41 jdolecek Exp $	*/
 
 /*-
@@ -293,7 +293,7 @@ emuxki_dmamem_alloc(bus_dma_tag_t dmat, size_t size, bus_size_t align,
 	mem->nsegs = nsegs;
 	mem->bound = 0;
 
-	mem->segs = malloc(mem->nsegs * sizeof(*(mem->segs)), type, flags);
+	mem->segs = mallocarray(mem->nsegs, sizeof(*(mem->segs)), type, flags);
 	if (mem->segs == NULL) {
 		free(mem, type, 0);
 		return (NULL);
diff --git a/sys/dev/pci/hifn7751.c b/sys/dev/pci/hifn7751.c
index 766c7117037..d3ff0c5529d 100644
--- a/sys/dev/pci/hifn7751.c
+++ b/sys/dev/pci/hifn7751.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hifn7751.c,v 1.168 2014/07/12 18:48:51 tedu Exp $	*/
+/*	$OpenBSD: hifn7751.c,v 1.169 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*
  * Invertex AEON / Hifn 7751 driver
@@ -1847,8 +1847,8 @@ hifn_newsession(u_int32_t *sidp, struct cryptoini *cri)
 
 		if (ses == NULL) {
 			sesn = sc->sc_nsessions;
-			ses = (struct hifn_session *)malloc((sesn + 1) *
-			    sizeof(*ses), M_DEVBUF, M_NOWAIT);
+			ses = mallocarray((sesn + 1), sizeof(*ses),
+			    M_DEVBUF, M_NOWAIT);
 			if (ses == NULL)
 				return (ENOMEM);
 			bcopy(sc->sc_sessions, ses, sesn * sizeof(*ses));
diff --git a/sys/dev/pci/if_em.c b/sys/dev/pci/if_em.c
index 344087749bb..d6d7e8eaecc 100644
--- a/sys/dev/pci/if_em.c
+++ b/sys/dev/pci/if_em.c
@@ -31,7 +31,7 @@ POSSIBILITY OF SUCH DAMAGE.
 
 ***************************************************************************/
 
-/* $OpenBSD: if_em.c,v 1.286 2014/07/12 18:48:51 tedu Exp $ */
+/* $OpenBSD: if_em.c,v 1.287 2014/07/13 23:10:23 deraadt Exp $ */
 /* $FreeBSD: if_em.c,v 1.46 2004/09/29 18:28:28 mlaier Exp $ */
 
 #include <dev/pci/if_em.h>
@@ -2119,8 +2119,8 @@ em_dma_free(struct em_softc *sc, struct em_dma_alloc *dma)
 int
 em_allocate_transmit_structures(struct em_softc *sc)
 {
-	if (!(sc->tx_buffer_area = malloc(sizeof(struct em_buffer) *
-	    sc->num_tx_desc, M_DEVBUF, M_NOWAIT | M_ZERO))) {
+	if (!(sc->tx_buffer_area = mallocarray(sc->num_tx_desc,
+	    sizeof(struct em_buffer), M_DEVBUF, M_NOWAIT | M_ZERO))) {
 		printf("%s: Unable to allocate tx_buffer memory\n", 
 		       sc->sc_dv.dv_xname);
 		return (ENOMEM);
@@ -2553,8 +2553,8 @@ em_allocate_receive_structures(struct em_softc *sc)
 	int		i, error;
 	struct em_buffer *rx_buffer;
 
-	if (!(sc->rx_buffer_area = malloc(sizeof(struct em_buffer) *
-	    sc->num_rx_desc, M_DEVBUF, M_NOWAIT | M_ZERO))) {
+	if (!(sc->rx_buffer_area = mallocarray(sc->num_rx_desc,
+	    sizeof(struct em_buffer), M_DEVBUF, M_NOWAIT | M_ZERO))) {
 		printf("%s: Unable to allocate rx_buffer memory\n", 
 		       sc->sc_dv.dv_xname);
 		return (ENOMEM);
diff --git a/sys/dev/pci/if_ix.c b/sys/dev/pci/if_ix.c
index 500c15578cb..8467ed40c48 100644
--- a/sys/dev/pci/if_ix.c
+++ b/sys/dev/pci/if_ix.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ix.c,v 1.95 2014/07/12 18:48:51 tedu Exp $	*/
+/*	$OpenBSD: if_ix.c,v 1.96 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /******************************************************************************
 
@@ -1703,25 +1703,22 @@ ixgbe_allocate_queues(struct ix_softc *sc)
 	int txconf = 0, rxconf = 0, i;
 
 	/* First allocate the top level queue structs */
-	if (!(sc->queues =
-	    (struct ix_queue *) malloc(sizeof(struct ix_queue) *
-	    sc->num_queues, M_DEVBUF, M_NOWAIT | M_ZERO))) {
+	if (!(sc->queues = mallocarray(sc->num_queues,
+	    sizeof(struct ix_queue), M_DEVBUF, M_NOWAIT | M_ZERO))) {
 		printf("%s: Unable to allocate queue memory\n", ifp->if_xname);
 		goto fail;
 	}
 
 	/* Then allocate the TX ring struct memory */
-	if (!(sc->tx_rings =
-	    (struct tx_ring *) malloc(sizeof(struct tx_ring) *
-	    sc->num_queues, M_DEVBUF, M_NOWAIT | M_ZERO))) {
+	if (!(sc->tx_rings = mallocarray(sc->num_queues,
+	    sizeof(struct tx_ring), M_DEVBUF, M_NOWAIT | M_ZERO))) {
 		printf("%s: Unable to allocate TX ring memory\n", ifp->if_xname);
 		goto fail;
 	}
 
 	/* Next allocate the RX */
-	if (!(sc->rx_rings =
-	    (struct rx_ring *) malloc(sizeof(struct rx_ring) *
-	    sc->num_queues, M_DEVBUF, M_NOWAIT | M_ZERO))) {
+	if (!(sc->rx_rings = mallocarray(sc->num_queues,
+	    sizeof(struct rx_ring), M_DEVBUF, M_NOWAIT | M_ZERO))) {
 		printf("%s: Unable to allocate RX ring memory\n", ifp->if_xname);
 		goto rx_fail;
 	}
@@ -1814,9 +1811,8 @@ ixgbe_allocate_transmit_buffers(struct tx_ring *txr)
 	struct ixgbe_tx_buf	*txbuf;
 	int			 error, i;
 
-	if (!(txr->tx_buffers =
-	    (struct ixgbe_tx_buf *) malloc(sizeof(struct ixgbe_tx_buf) *
-	    sc->num_tx_desc, M_DEVBUF, M_NOWAIT | M_ZERO))) {
+	if (!(txr->tx_buffers = mallocarray(sc->num_tx_desc,
+	    sizeof(struct ixgbe_tx_buf), M_DEVBUF, M_NOWAIT | M_ZERO))) {
 		printf("%s: Unable to allocate tx_buffer memory\n",
 		    ifp->if_xname);
 		error = ENOMEM;
diff --git a/sys/dev/pci/if_ixgb.c b/sys/dev/pci/if_ixgb.c
index 01177056862..cac1a736a66 100644
--- a/sys/dev/pci/if_ixgb.c
+++ b/sys/dev/pci/if_ixgb.c
@@ -31,7 +31,7 @@ POSSIBILITY OF SUCH DAMAGE.
 
 ***************************************************************************/
 
-/* $OpenBSD: if_ixgb.c,v 1.61 2014/07/12 18:48:51 tedu Exp $ */
+/* $OpenBSD: if_ixgb.c,v 1.62 2014/07/13 23:10:23 deraadt Exp $ */
 
 #include <dev/pci/if_ixgb.h>
 
@@ -1135,8 +1135,8 @@ ixgb_dma_free(struct ixgb_softc *sc, struct ixgb_dma_alloc *dma)
 int
 ixgb_allocate_transmit_structures(struct ixgb_softc *sc)
 {
-	if (!(sc->tx_buffer_area = malloc(sizeof(struct ixgb_buffer) *
-	    sc->num_tx_desc, M_DEVBUF, M_NOWAIT | M_ZERO))) {
+	if (!(sc->tx_buffer_area = mallocarray(sc->num_tx_desc,
+	    sizeof(struct ixgb_buffer), M_DEVBUF, M_NOWAIT | M_ZERO))) {
 		printf("%s: Unable to allocate tx_buffer memory\n",
 		       sc->sc_dv.dv_xname);
 		return (ENOMEM);
@@ -1501,8 +1501,8 @@ ixgb_allocate_receive_structures(struct ixgb_softc *sc)
 	int             i, error;
 	struct ixgb_buffer *rx_buffer;
 
-	if (!(sc->rx_buffer_area = malloc(sizeof(struct ixgb_buffer) *
-	    sc->num_rx_desc, M_DEVBUF, M_NOWAIT | M_ZERO))) {
+	if (!(sc->rx_buffer_area = mallocarray(sc->num_rx_desc,
+	    sizeof(struct ixgb_buffer), M_DEVBUF, M_NOWAIT | M_ZERO))) {
 		printf("%s: Unable to allocate rx_buffer memory\n",
 		       sc->sc_dv.dv_xname);
 		return (ENOMEM);
diff --git a/sys/dev/pci/if_nxe.c b/sys/dev/pci/if_nxe.c
index 6258787258f..3f3e972626e 100644
--- a/sys/dev/pci/if_nxe.c
+++ b/sys/dev/pci/if_nxe.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_nxe.c,v 1.65 2014/07/12 18:48:51 tedu Exp $ */
+/*	$OpenBSD: if_nxe.c,v 1.66 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2007 David Gwynne <dlg@openbsd.org>
@@ -1926,7 +1926,7 @@ nxe_pkt_alloc(struct nxe_softc *sc, u_int npkts, int nsegs)
 	int				i;
 
 	npl = malloc(sizeof(*npl), M_DEVBUF, M_WAITOK | M_ZERO);
-	pkt = malloc(sizeof(*pkt) * npkts, M_DEVBUF, M_WAITOK | M_ZERO);
+	pkt = mallocarray(npkts, sizeof(*pkt), M_DEVBUF, M_WAITOK | M_ZERO);
 
 	npl->npl_pkts = pkt;
 	TAILQ_INIT(&npl->npl_free);
diff --git a/sys/dev/pci/if_tht.c b/sys/dev/pci/if_tht.c
index e8928f84196..75a6824788f 100644
--- a/sys/dev/pci/if_tht.c
+++ b/sys/dev/pci/if_tht.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_tht.c,v 1.127 2014/07/12 18:48:52 tedu Exp $ */
+/*	$OpenBSD: if_tht.c,v 1.128 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2007 David Gwynne <dlg@openbsd.org>
@@ -1879,8 +1879,8 @@ tht_pkt_alloc(struct tht_softc *sc, struct tht_pkt_list *tpl, int npkts,
 	struct tht_pkt			*pkt;
 	int				i;
 
-	tpl->tpl_pkts = malloc(sizeof(struct tht_pkt) * npkts, M_DEVBUF,
-	    M_WAITOK | M_ZERO);
+	tpl->tpl_pkts = mallocarray(npkts, sizeof(struct tht_pkt),
+	    M_DEVBUF, M_WAITOK | M_ZERO);
 
 	TAILQ_INIT(&tpl->tpl_free);
 	TAILQ_INIT(&tpl->tpl_used);
diff --git a/sys/dev/pci/if_txp.c b/sys/dev/pci/if_txp.c
index 726fe0dcc12..3fc6240caf5 100644
--- a/sys/dev/pci/if_txp.c
+++ b/sys/dev/pci/if_txp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_txp.c,v 1.109 2014/07/12 18:48:52 tedu Exp $	*/
+/*	$OpenBSD: if_txp.c,v 1.110 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2001
@@ -1585,9 +1585,8 @@ txp_response(struct txp_softc *sc, u_int32_t ridx, u_int16_t id,
 		rsp = (struct txp_rsp_desc *)(((u_int8_t *)sc->sc_rspring.base) + ridx);
 
 		if (id == letoh16(rsp->rsp_id) && letoh16(rsp->rsp_seq) == seq) {
-			*rspp = (struct txp_rsp_desc *)malloc(
-			    sizeof(struct txp_rsp_desc) * (rsp->rsp_numdesc + 1),
-			    M_DEVBUF, M_NOWAIT);
+			*rspp = mallocarray(rsp->rsp_numdesc + 1,
+			    sizeof(struct txp_rsp_desc), M_DEVBUF, M_NOWAIT);
 			if ((*rspp) == NULL)
 				return (-1);
 			txp_rsp_fixup(sc, rsp, *rspp);
diff --git a/sys/dev/pci/if_vic.c b/sys/dev/pci/if_vic.c
index 747be9a9efe..3fc1646415b 100644
--- a/sys/dev/pci/if_vic.c
+++ b/sys/dev/pci/if_vic.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_vic.c,v 1.80 2014/07/12 18:48:52 tedu Exp $	*/
+/*	$OpenBSD: if_vic.c,v 1.81 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2006 Reyk Floeter <reyk@openbsd.org>
@@ -567,15 +567,15 @@ vic_alloc_data(struct vic_softc *sc)
 	sc->sc_rxq[1].pktlen = 4096;
 
 	for (q = 0; q < VIC_NRXRINGS; q++) {
-		sc->sc_rxq[q].bufs = malloc(sizeof(struct vic_rxbuf) *
-		    sc->sc_nrxbuf, M_DEVBUF, M_NOWAIT | M_ZERO);
+		sc->sc_rxq[q].bufs = mallocarray(sc->sc_nrxbuf,
+		    sizeof(struct vic_rxbuf), M_DEVBUF, M_NOWAIT | M_ZERO);
 		if (sc->sc_rxq[q].bufs == NULL) {
 			printf(": unable to allocate rxbuf for ring %d\n", q);
 			goto freerx;
 		}
 	}
 
-	sc->sc_txbuf = malloc(sizeof(struct vic_txbuf) * sc->sc_ntxbuf,
+	sc->sc_txbuf = mallocarray(sc->sc_ntxbuf, sizeof(struct vic_txbuf),
 	    M_DEVBUF, M_NOWAIT);
 	if (sc->sc_txbuf == NULL) {
 		printf(": unable to allocate txbuf\n");
diff --git a/sys/dev/pci/ips.c b/sys/dev/pci/ips.c
index 9a2b5fc75cc..83c62d8a346 100644
--- a/sys/dev/pci/ips.c
+++ b/sys/dev/pci/ips.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ips.c,v 1.109 2014/07/12 18:48:52 tedu Exp $	*/
+/*	$OpenBSD: ips.c,v 1.110 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2006, 2007, 2009 Alexander Yurchenko <grange@openbsd.org>
@@ -796,7 +796,7 @@ ips_attach(struct device *parent, struct device *self, void *aux)
 
 #ifndef SMALL_KERNEL
 	/* Add sensors */
-	if ((sc->sc_sensors = malloc(sizeof(struct ksensor) * sc->sc_nunits,
+	if ((sc->sc_sensors = mallocarray(sc->sc_nunits, sizeof(struct ksensor),
 	    M_DEVBUF, M_NOWAIT | M_ZERO)) == NULL) {
 		printf(": can't alloc sensors\n");
 		return;
@@ -1981,7 +1981,7 @@ ips_ccb_alloc(struct ips_softc *sc, int n)
 	struct ips_ccb *ccb;
 	int i;
 
-	if ((ccb = malloc(n * sizeof(*ccb), M_DEVBUF,
+	if ((ccb = mallocarray(n, sizeof(*ccb), M_DEVBUF,
 	    M_NOWAIT | M_ZERO)) == NULL)
 		return (NULL);
 
diff --git a/sys/dev/pci/isp_pci.c b/sys/dev/pci/isp_pci.c
index 16e057ba912..5ec22bbb6fd 100644
--- a/sys/dev/pci/isp_pci.c
+++ b/sys/dev/pci/isp_pci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: isp_pci.c,v 1.60 2014/07/12 18:48:52 tedu Exp $	*/
+/*	$OpenBSD: isp_pci.c,v 1.61 2014/07/13 23:10:23 deraadt Exp $	*/
 /* $FreeBSD: src/sys/dev/isp/isp_pci.c,v 1.148 2007/06/26 23:08:57 mjacob Exp $*/
 /*-
  * Copyright (c) 1997-2006 by Matthew Jacob
@@ -560,7 +560,7 @@ isp_pci_attach(struct device *parent, struct device *self, void *aux)
 	if (pa->pa_id == PCI_QLOGIC_ISP1240) {
 		isp->isp_mdvec = &mdvec_1080;
 		isp->isp_type = ISP_HA_SCSI_1240;
-		isp->isp_param = malloc(2 * sizeof(sdparam), M_DEVBUF,
+		isp->isp_param = mallocarray(2, sizeof(sdparam), M_DEVBUF,
 		    M_NOWAIT | M_ZERO);
 		if (isp->isp_param == NULL) {
 			printf(nomem);
@@ -572,7 +572,7 @@ isp_pci_attach(struct device *parent, struct device *self, void *aux)
 	if (pa->pa_id == PCI_QLOGIC_ISP1280) {
 		isp->isp_mdvec = &mdvec_1080;
 		isp->isp_type = ISP_HA_SCSI_1280;
-		isp->isp_param = malloc(2 * sizeof(sdparam),
+		isp->isp_param = mallocarray(2, sizeof(sdparam),
 		    M_DEVBUF, M_NOWAIT | M_ZERO);
 		if (isp->isp_param == NULL) {
 			printf(nomem);
@@ -596,7 +596,7 @@ isp_pci_attach(struct device *parent, struct device *self, void *aux)
 	if (pa->pa_id == PCI_QLOGIC_ISP12160) {
 		isp->isp_mdvec = &mdvec_12160;
 		isp->isp_type = ISP_HA_SCSI_12160;
-		isp->isp_param = malloc(2 * sizeof(sdparam),
+		isp->isp_param = mallocarray(2, sizeof(sdparam),
 		    M_DEVBUF, M_NOWAIT | M_ZERO);
 		if (isp->isp_param == NULL) {
 			printf(nomem);
diff --git a/sys/dev/pci/mfii.c b/sys/dev/pci/mfii.c
index 72e736afaed..604c123eb93 100644
--- a/sys/dev/pci/mfii.c
+++ b/sys/dev/pci/mfii.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mfii.c,v 1.16 2014/07/12 18:48:52 tedu Exp $ */
+/* $OpenBSD: mfii.c,v 1.17 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2012 David Gwynne <dlg@openbsd.org>
@@ -1382,7 +1382,7 @@ mfii_init_ccb(struct mfii_softc *sc)
 	u_int i;
 	int error;
 
-	sc->sc_ccb = malloc(sizeof(struct mfii_ccb) * sc->sc_max_cmds,
+	sc->sc_ccb = mallocarray(sc->sc_max_cmds, sizeof(struct mfii_ccb),
 	    M_DEVBUF, M_WAITOK|M_ZERO);
 
 	for (i = 0; i < sc->sc_max_cmds; i++) {
diff --git a/sys/dev/pci/mpii.c b/sys/dev/pci/mpii.c
index d521b461d87..f160c96b81e 100644
--- a/sys/dev/pci/mpii.c
+++ b/sys/dev/pci/mpii.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mpii.c,v 1.95 2014/07/12 18:48:52 tedu Exp $	*/
+/*	$OpenBSD: mpii.c,v 1.96 2014/07/13 23:10:23 deraadt Exp $	*/
 /*
  * Copyright (c) 2010, 2012 Mike Belopuhov
  * Copyright (c) 2009 James Giannoules
@@ -553,7 +553,7 @@ mpii_attach(struct device *parent, struct device *self, void *aux)
 		}
 	}
 
-	sc->sc_devs = malloc(sc->sc_max_devices *
+	sc->sc_devs = mallocarray(sc->sc_max_devices,
 	    sizeof(struct mpii_device *), M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (sc->sc_devs == NULL) {
 		printf("%s: unable to allocate memory for mpii_device\n",
@@ -2366,7 +2366,7 @@ mpii_alloc_ccbs(struct mpii_softc *sc)
 	scsi_ioh_set(&sc->sc_ccb_tmo_handler, &sc->sc_iopool,
 	    mpii_scsi_cmd_tmo_handler, sc);
 
-	sc->sc_ccbs = malloc(sizeof(*ccb) * (sc->sc_max_cmds-1),
+	sc->sc_ccbs = mallocarray((sc->sc_max_cmds-1), sizeof(*ccb),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (sc->sc_ccbs == NULL) {
 		printf("%s: unable to allocate ccbs\n", DEVNAME(sc));
@@ -2471,8 +2471,8 @@ mpii_alloc_replies(struct mpii_softc *sc)
 {
 	DNPRINTF(MPII_D_MISC, "%s: mpii_alloc_replies\n", DEVNAME(sc));
 
-	sc->sc_rcbs = malloc(sc->sc_num_reply_frames * sizeof(struct mpii_rcb),
-	    M_DEVBUF, M_NOWAIT);
+	sc->sc_rcbs = mallocarray(sc->sc_num_reply_frames,
+	    sizeof(struct mpii_rcb), M_DEVBUF, M_NOWAIT);
 	if (sc->sc_rcbs == NULL)
 		return (1);
 
@@ -3530,7 +3530,7 @@ mpii_create_sensors(struct mpii_softc *sc)
 	struct scsi_link	*link;
 	int			i;
 
-	sc->sc_sensors = malloc(sizeof(struct ksensor) * sc->sc_vd_count,
+	sc->sc_sensors = mallocarray(sc->sc_vd_count, sizeof(struct ksensor),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (sc->sc_sensors == NULL)
 		return (1);
diff --git a/sys/dev/pci/musycc.c b/sys/dev/pci/musycc.c
index 6a57d691c9f..ae73a363f0b 100644
--- a/sys/dev/pci/musycc.c
+++ b/sys/dev/pci/musycc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: musycc.c,v 1.21 2010/05/19 15:27:35 oga Exp $ */
+/*	$OpenBSD: musycc.c,v 1.22 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2004,2005  Internet Business Solutions AG, Zurich, Switzerland
@@ -115,8 +115,8 @@ musycc_attach_common(struct musycc_softc *sc, u_int32_t portmap, u_int32_t mode)
 	    MUSYCC_CONF_BLAPSE_SET(3) | MUSYCC_CONF_INTB;
 
 	/* initialize group descriptors */
-	sc->mc_groups = malloc(sc->mc_ngroups * sizeof(struct musycc_group),
-	    M_DEVBUF, M_NOWAIT | M_ZERO);
+	sc->mc_groups = mallocarray(sc->mc_ngroups,
+	    sizeof(struct musycc_group), M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (sc->mc_groups == NULL) {
 		printf(": couldn't alloc group descriptors\n");
 		musycc_free_groupdesc(sc);
diff --git a/sys/dev/pci/qle.c b/sys/dev/pci/qle.c
index 91a1f6691d1..e15e49b92e6 100644
--- a/sys/dev/pci/qle.c
+++ b/sys/dev/pci/qle.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qle.c,v 1.30 2014/07/12 18:48:52 tedu Exp $ */
+/*	$OpenBSD: qle.c,v 1.31 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2013, 2014 Jonathan Matthew <jmatthew@openbsd.org>
@@ -2844,7 +2844,7 @@ qle_alloc_ccbs(struct qle_softc *sc)
 	mtx_init(&sc->sc_port_mtx, IPL_BIO);
 	mtx_init(&sc->sc_mbox_mtx, IPL_BIO);
 
-	sc->sc_ccbs = malloc(sizeof(struct qle_ccb) * sc->sc_maxcmds,
+	sc->sc_ccbs = mallocarray(sc->sc_maxcmds, sizeof(struct qle_ccb),
 	    M_DEVBUF, M_WAITOK | M_CANFAIL | M_ZERO);
 	if (sc->sc_ccbs == NULL) {
 		printf("%s: unable to allocate ccbs\n", DEVNAME(sc));
diff --git a/sys/dev/pci/safe.c b/sys/dev/pci/safe.c
index 25359933fd0..afcd42beacf 100644
--- a/sys/dev/pci/safe.c
+++ b/sys/dev/pci/safe.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: safe.c,v 1.36 2014/07/12 18:48:52 tedu Exp $	*/
+/*	$OpenBSD: safe.c,v 1.37 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 2003 Sam Leffler, Errno Consulting
@@ -1344,7 +1344,7 @@ safe_newsession(u_int32_t *sidp, struct cryptoini *cri)
 
 		if (ses == NULL) {
 			sesn = sc->sc_nsessions;
-			ses = (struct safe_session *)malloc((sesn + 1) *
+			ses = mallocarray((sesn + 1),
 			    sizeof(struct safe_session), M_DEVBUF, M_NOWAIT);
 			if (ses == NULL)
 				return (ENOMEM);
diff --git a/sys/dev/pci/sdhc_pci.c b/sys/dev/pci/sdhc_pci.c
index 77dc54d1627..b2fe50b4b96 100644
--- a/sys/dev/pci/sdhc_pci.c
+++ b/sys/dev/pci/sdhc_pci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sdhc_pci.c,v 1.14 2013/01/04 23:19:40 stsp Exp $	*/
+/*	$OpenBSD: sdhc_pci.c,v 1.15 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2006 Uwe Stuehler <uwe@openbsd.org>
@@ -158,8 +158,8 @@ sdhc_pci_attach(struct device *parent, struct device *self, void *aux)
 	nslots = SDHC_PCI_NUM_SLOTS(slotinfo);
 
 	/* Allocate an array big enough to hold all the possible hosts */
-	sc->sc.sc_host = malloc(sizeof(struct sdhc_host *) * nslots, M_DEVBUF,
-	    M_WAITOK);
+	sc->sc.sc_host = mallocarray(nslots, sizeof(struct sdhc_host *),
+	    M_DEVBUF, M_WAITOK);
 
 	/* XXX: handle 64-bit BARs */
 	for (reg = SDHC_PCI_BAR_START + SDHC_PCI_FIRST_BAR(slotinfo) *
diff --git a/sys/dev/pci/ubsec.c b/sys/dev/pci/ubsec.c
index 20f36157f2b..da16458bac9 100644
--- a/sys/dev/pci/ubsec.c
+++ b/sys/dev/pci/ubsec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ubsec.c,v 1.158 2014/07/12 18:48:52 tedu Exp $	*/
+/*	$OpenBSD: ubsec.c,v 1.159 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2000 Jason L. Wright (jason@thought.net)
@@ -693,7 +693,7 @@ ubsec_newsession(u_int32_t *sidp, struct cryptoini *cri)
 
 		if (ses == NULL) {
 			sesn = sc->sc_nsessions;
-			ses = (struct ubsec_session *)malloc((sesn + 1) *
+			ses = mallocarray((sesn + 1),
 			    sizeof(struct ubsec_session), M_DEVBUF, M_NOWAIT);
 			if (ses == NULL)
 				return (ENOMEM);
diff --git a/sys/dev/pci/virtio.c b/sys/dev/pci/virtio.c
index d353b15d401..553a6a7ee66 100644
--- a/sys/dev/pci/virtio.c
+++ b/sys/dev/pci/virtio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: virtio.c,v 1.8 2014/07/12 18:48:52 tedu Exp $	*/
+/*	$OpenBSD: virtio.c,v 1.9 2014/07/13 23:10:23 deraadt Exp $	*/
 /*	$NetBSD: virtio.c,v 1.3 2011/11/02 23:05:52 njoly Exp $	*/
 
 /*
@@ -379,8 +379,8 @@ virtio_alloc_vq(struct virtio_softc *sc,
 	vq->vq_maxnsegs = maxnsegs;
 
 	/* free slot management */
-	vq->vq_entries = malloc(sizeof(struct vq_entry)*vq_size,
-				     M_DEVBUF, M_NOWAIT | M_ZERO);
+	vq->vq_entries = mallocarray(vq_size, sizeof(struct vq_entry),
+	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (vq->vq_entries == NULL) {
 		r = ENOMEM;
 		goto err;
diff --git a/sys/dev/pci/vmwpvs.c b/sys/dev/pci/vmwpvs.c
index a1a90a17eef..e368d743ffd 100644
--- a/sys/dev/pci/vmwpvs.c
+++ b/sys/dev/pci/vmwpvs.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vmwpvs.c,v 1.9 2014/07/12 18:48:52 tedu Exp $ */
+/*	$OpenBSD: vmwpvs.c,v 1.10 2014/07/13 23:10:23 deraadt Exp $ */
 
 /*
  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
@@ -507,7 +507,8 @@ vmwpvs_attach(struct device *parent, struct device *self, void *aux)
 		goto free_sgl;
 	}
 
-	sc->sc_ccbs = malloc(sizeof(struct vmwpvs_ccb) * r, M_DEVBUF, M_WAITOK);
+	sc->sc_ccbs = mallocarray(r, sizeof(struct vmwpvs_ccb),
+	    M_DEVBUF, M_WAITOK);
 	/* cant fail */
 
 	sgls = VMWPVS_DMA_KVA(sc->sc_sgls);
diff --git a/sys/dev/rd.c b/sys/dev/rd.c
index bf2f63715e8..b37decb3e6b 100644
--- a/sys/dev/rd.c
+++ b/sys/dev/rd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rd.c,v 1.7 2014/07/12 18:48:51 tedu Exp $	*/
+/*	$OpenBSD: rd.c,v 1.8 2014/07/13 23:10:23 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2011 Matthew Dempsky <matthew@dempsky.org>
@@ -88,7 +88,7 @@ rdattach(int num)
 	cf.cf_driver = &rd_cd;
 
 	rd_cd.cd_ndevs = num;
-	rd_cd.cd_devs = malloc(num * sizeof(void *), M_DEVBUF, M_NOWAIT);
+	rd_cd.cd_devs = mallocarray(num, sizeof(void *), M_DEVBUF, M_NOWAIT);
 	if (rd_cd.cd_devs == NULL)
 		panic("rdattach: out of memory");
 
diff --git a/sys/dev/softraid.c b/sys/dev/softraid.c
index 042c3e7b208..8380bf75193 100644
--- a/sys/dev/softraid.c
+++ b/sys/dev/softraid.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: softraid.c,v 1.334 2014/07/12 18:48:51 tedu Exp $ */
+/* $OpenBSD: softraid.c,v 1.335 2014/07/13 23:10:23 deraadt Exp $ */
 /*
  * Copyright (c) 2007, 2008, 2009 Marco Peereboom <marco@peereboom.us>
  * Copyright (c) 2008 Chris Kuethe <ckuethe@openbsd.org>
@@ -252,7 +252,7 @@ sr_meta_attach(struct sr_discipline *sd, int chunk_no, int force)
 
 	/* we have a valid list now create an array index */
 	cl = &sd->sd_vol.sv_chunk_list;
-	sd->sd_vol.sv_chunks = malloc(sizeof(struct sr_chunk *) * chunk_no,
+	sd->sd_vol.sv_chunks = mallocarray(chunk_no, sizeof(struct sr_chunk *),
 	    M_DEVBUF, M_WAITOK | M_ZERO);
 
 	/* fill out chunk array */
@@ -1284,13 +1284,13 @@ sr_boot_assembly(struct sr_softc *sc)
 	}
 
 	/* Allocate memory for device and ondisk version arrays. */
-	devs = malloc(BIOC_CRMAXLEN * sizeof(dev_t), M_DEVBUF,
+	devs = mallocarray(BIOC_CRMAXLEN, sizeof(dev_t), M_DEVBUF,
 	    M_NOWAIT | M_CANFAIL);
 	if (devs == NULL) {
 		printf("%s: failed to allocate device array\n", DEVNAME(sc));
 		goto unwind;
 	}
-	ondisk = malloc(BIOC_CRMAXLEN * sizeof(u_int64_t), M_DEVBUF,
+	ondisk = mallocarray(BIOC_CRMAXLEN, sizeof(u_int64_t), M_DEVBUF,
 	    M_NOWAIT | M_CANFAIL);
 	if (ondisk == NULL) {
 		printf("%s: failed to allocate ondisk array\n", DEVNAME(sc));
@@ -1934,8 +1934,9 @@ sr_ccb_alloc(struct sr_discipline *sd)
 	if (sd->sd_ccb)
 		return (1);
 
-	sd->sd_ccb = malloc(sizeof(struct sr_ccb) *
-	    sd->sd_max_wu * sd->sd_max_ccb_per_wu, M_DEVBUF, M_WAITOK | M_ZERO);
+	sd->sd_ccb = mallocarray(sd->sd_max_wu,
+	    sd->sd_max_ccb_per_wu * sizeof(struct sr_ccb),
+	    M_DEVBUF, M_WAITOK | M_ZERO);
 	TAILQ_INIT(&sd->sd_ccb_freeq);
 	for (i = 0; i < sd->sd_max_wu * sd->sd_max_ccb_per_wu; i++) {
 		ccb = &sd->sd_ccb[i];
diff --git a/sys/dev/systrace.c b/sys/dev/systrace.c
index 67f83d9fc26..ade4097bed0 100644
--- a/sys/dev/systrace.c
+++ b/sys/dev/systrace.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: systrace.c,v 1.70 2014/07/12 18:48:51 tedu Exp $	*/
+/*	$OpenBSD: systrace.c,v 1.71 2014/07/13 23:10:23 deraadt Exp $	*/
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -1639,8 +1639,7 @@ systrace_newpolicy(struct fsystrace *fst, int maxents)
 	DPRINTF(("%s: allocating %d -> %lu\n", __func__,
 		     maxents, (u_long)maxents * sizeof(int)));
 
-	pol->sysent = (u_char *)malloc(maxents * sizeof(u_char),
-	    M_XDATA, M_WAITOK);
+	pol->sysent = malloc(maxents, M_XDATA, M_WAITOK);
 	pol->nsysent = maxents;
 	for (i = 0; i < maxents; i++)
 		pol->sysent[i] = SYSTR_POLICY_ASK;