More malloc() -> mallocarray() in the kernel.

ok deraadt@ tedu@

21 files changed, 84 insertions, 83 deletions

diff --git a/sys/dev/ata/atascsi.c b/sys/dev/ata/atascsi.c
index 0bb75405cd3..eaa2653bd3b 100644
--- a/sys/dev/ata/atascsi.c
+++ b/sys/dev/ata/atascsi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: atascsi.c,v 1.120 2014/09/14 14:17:24 jsg Exp $ */
+/*	$OpenBSD: atascsi.c,v 1.121 2014/12/09 07:05:06 doug Exp $ */
 
 /*
  * Copyright (c) 2007 David Gwynne <dlg@openbsd.org>
@@ -193,8 +193,8 @@ atascsi_attach(struct device *self, struct atascsi_attach_args *aaa)
 	as->as_link.adapter_target = aaa->aaa_nports;
 	as->as_link.openings = 1;
 
-	as->as_host_ports = malloc(sizeof(struct atascsi_host_port *) *
-	    aaa->aaa_nports, M_DEVBUF, M_WAITOK | M_ZERO);
+	as->as_host_ports = mallocarray(aaa->aaa_nports,
+	    sizeof(struct atascsi_host_port *),	M_DEVBUF, M_WAITOK | M_ZERO);
 
 	bzero(&saa, sizeof(saa));
 	saa.saa_sc_link = &as->as_link;
@@ -320,8 +320,8 @@ atascsi_probe(struct scsi_link *link)
 			ahp->ahp_nports = 1;
 			ap->ap_pmp_port = 0;
 		}
-		ahp->ahp_ports = malloc(sizeof(struct atascsi_port *) *
-		    ahp->ahp_nports, M_DEVBUF, M_WAITOK | M_ZERO);
+		ahp->ahp_ports = mallocarray(ahp->ahp_nports,
+		    sizeof(struct atascsi_port *), M_DEVBUF, M_WAITOK | M_ZERO);
 	} else {
 		ahp = as->as_host_ports[port];
 		ap->ap_pmp_port = link->lun - 1;
diff --git a/sys/dev/pci/drm/i915/i915_gem_execbuffer.c b/sys/dev/pci/drm/i915/i915_gem_execbuffer.c
index 279596dca0a..00c7b31b2d1 100644
--- a/sys/dev/pci/drm/i915/i915_gem_execbuffer.c
+++ b/sys/dev/pci/drm/i915/i915_gem_execbuffer.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: i915_gem_execbuffer.c,v 1.30 2014/09/20 16:15:16 kettenis Exp $	*/
+/*	$OpenBSD: i915_gem_execbuffer.c,v 1.31 2014/12/09 07:05:06 doug Exp $	*/
 /*
  * Copyright (c) 2008-2009 Owain G. Ainsworth <oga@openbsd.org>
  *
@@ -542,8 +542,9 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
 	for (i = 0; i < count; i++)
 		total += exec[i].relocation_count;
 
-	reloc_offset = malloc(count * sizeof(*reloc_offset), M_DRM, M_WAITOK);
-	reloc = malloc(total * sizeof(*reloc), M_DRM, M_WAITOK);
+	reloc_offset = mallocarray(count, sizeof(*reloc_offset), M_DRM,
+	    M_WAITOK);
+	reloc = mallocarray(total, sizeof(*reloc), M_DRM, M_WAITOK);
 	if (reloc == NULL || reloc_offset == NULL) {
 		drm_free(reloc);
 		drm_free(reloc_offset);
diff --git a/sys/dev/pci/drm/radeon/radeon_ttm.c b/sys/dev/pci/drm/radeon/radeon_ttm.c
index ac86db98b0f..3fd4f3e8fa3 100644
--- a/sys/dev/pci/drm/radeon/radeon_ttm.c
+++ b/sys/dev/pci/drm/radeon/radeon_ttm.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: radeon_ttm.c,v 1.6 2014/07/12 18:48:52 tedu Exp $	*/
+/*	$OpenBSD: radeon_ttm.c,v 1.7 2014/12/09 07:05:06 doug Exp $	*/
 /*
  * Copyright 2009 Jerome Glisse.
  * All Rights Reserved.
@@ -627,8 +627,8 @@ struct ttm_tt *radeon_ttm_tt_create(struct ttm_bo_device *bdev,
 		return NULL;
 	}
 
-	gtt->segs = malloc(gtt->ttm.ttm.num_pages * sizeof(bus_dma_segment_t),
-			   M_DRM, M_WAITOK | M_ZERO);
+	gtt->segs = mallocarray(gtt->ttm.ttm.num_pages,
+	    sizeof(bus_dma_segment_t), M_DRM, M_WAITOK | M_ZERO);
 	if (gtt->segs == NULL) {
 		ttm_dma_tt_fini(&gtt->ttm);
 		free(gtt, M_DRM, 0);
diff --git a/sys/dev/sdmmc/sdmmc_scsi.c b/sys/dev/sdmmc/sdmmc_scsi.c
index 942ced1d8af..02b15991258 100644
--- a/sys/dev/sdmmc/sdmmc_scsi.c
+++ b/sys/dev/sdmmc/sdmmc_scsi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sdmmc_scsi.c,v 1.33 2014/11/01 16:32:06 jsg Exp $	*/
+/*	$OpenBSD: sdmmc_scsi.c,v 1.34 2014/12/09 07:05:06 doug Exp $	*/
 
 /*
  * Copyright (c) 2006 Uwe Stuehler <uwe@openbsd.org>
@@ -197,7 +197,7 @@ sdmmc_alloc_ccbs(struct sdmmc_scsi_softc *scbus, int nccbs)
 	struct sdmmc_ccb *ccb;
 	int i;
 
-	scbus->sc_ccbs = malloc(sizeof(struct sdmmc_ccb) * nccbs,
+	scbus->sc_ccbs = mallocarray(nccbs, sizeof(struct sdmmc_ccb),
 	    M_DEVBUF, M_NOWAIT);
 	if (scbus->sc_ccbs == NULL)
 		return 1;
diff --git a/sys/dev/usb/ehci.c b/sys/dev/usb/ehci.c
index d46fa003ba0..704f3da76d2 100644
--- a/sys/dev/usb/ehci.c
+++ b/sys/dev/usb/ehci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ehci.c,v 1.170 2014/11/18 02:37:30 tedu Exp $ */
+/*	$OpenBSD: ehci.c,v 1.171 2014/12/09 07:05:06 doug Exp $ */
 /*	$NetBSD: ehci.c,v 1.66 2004/06/30 03:11:56 mycroft Exp $	*/
 
 /*
@@ -362,8 +362,8 @@ ehci_init(struct ehci_softc *sc)
 
 	EOWRITE4(sc, EHCI_PERIODICLISTBASE, DMAADDR(&sc->sc_fldma, 0));
 
-	sc->sc_softitds = malloc(sc->sc_flsize * sizeof(struct ehci_soft_itd *),
-	    M_USB, M_NOWAIT | M_ZERO);
+	sc->sc_softitds = mallocarray(sc->sc_flsize,
+	    sizeof(struct ehci_soft_itd *), M_USB, M_NOWAIT | M_ZERO);
 	if (sc->sc_softitds == NULL)
 		return (ENOMEM);
 	LIST_INIT(&sc->sc_freeitds);
diff --git a/sys/dev/usb/uaudio.c b/sys/dev/usb/uaudio.c
index 062d519cc17..893190dd1ae 100644
--- a/sys/dev/usb/uaudio.c
+++ b/sys/dev/usb/uaudio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uaudio.c,v 1.106 2014/11/18 23:55:01 krw Exp $ */
+/*	$OpenBSD: uaudio.c,v 1.107 2014/12/09 07:05:06 doug Exp $ */
 /*	$NetBSD: uaudio.c,v 1.90 2004/10/29 17:12:53 kent Exp $	*/
 
 /*
@@ -1443,8 +1443,8 @@ uaudio_io_terminaltype(int outtype, struct io_terminal *iot, int id)
 		return NULL;
 	case UDESCSUB_AC_MIXER:
 		it->inputs_size = 0;
-		it->inputs = malloc(sizeof(struct terminal_list *)
-				    * it->d.mu->bNrInPins, M_TEMP, M_NOWAIT);
+		it->inputs = mallocarray(it->d.mu->bNrInPins,
+		    sizeof(struct terminal_list *), M_TEMP, M_NOWAIT);
 		if (it->inputs == NULL) {
 			printf("uaudio_io_terminaltype: no memory\n");
 			return NULL;
@@ -1458,8 +1458,8 @@ uaudio_io_terminaltype(int outtype, struct io_terminal *iot, int id)
 		return uaudio_merge_terminal_list(it);
 	case UDESCSUB_AC_SELECTOR:
 		it->inputs_size = 0;
-		it->inputs = malloc(sizeof(struct terminal_list *)
-				    * it->d.su->bNrInPins, M_TEMP, M_NOWAIT);
+		it->inputs = mallocarray(it->d.su->bNrInPins,
+		    sizeof(struct terminal_list *), M_TEMP, M_NOWAIT);
 		if (it->inputs == NULL) {
 			printf("uaudio_io_terminaltype: no memory\n");
 			return NULL;
@@ -1473,8 +1473,8 @@ uaudio_io_terminaltype(int outtype, struct io_terminal *iot, int id)
 		return uaudio_merge_terminal_list(it);
 	case UDESCSUB_AC_PROCESSING:
 		it->inputs_size = 0;
-		it->inputs = malloc(sizeof(struct terminal_list *)
-				    * it->d.pu->bNrInPins, M_TEMP, M_NOWAIT);
+		it->inputs = mallocarray(it->d.pu->bNrInPins,
+		    sizeof(struct terminal_list *), M_TEMP, M_NOWAIT);
 		if (it->inputs == NULL) {
 			printf("uaudio_io_terminaltype: no memory\n");
 			return NULL;
@@ -1488,8 +1488,8 @@ uaudio_io_terminaltype(int outtype, struct io_terminal *iot, int id)
 		return uaudio_merge_terminal_list(it);
 	case UDESCSUB_AC_EXTENSION:
 		it->inputs_size = 0;
-		it->inputs = malloc(sizeof(struct terminal_list *)
-				    * it->d.eu->bNrInPins, M_TEMP, M_NOWAIT);
+		it->inputs = mallocarray(it->d.eu->bNrInPins,
+		    sizeof(struct terminal_list *), M_TEMP, M_NOWAIT);
 		if (it->inputs == NULL) {
 			printf("uaudio_io_terminaltype: no memory\n");
 			return NULL;
@@ -1562,7 +1562,7 @@ uaudio_create_encodings(struct uaudio_softc *sc)
 	}
 
 	sc->sc_nencs = 0;
-	sc->sc_encs = malloc(sizeof(struct audio_encoding) * nencs,
+	sc->sc_encs = mallocarray(nencs, sizeof(struct audio_encoding),
 	    M_USBDEV, M_NOWAIT);
 	if (sc->sc_encs == NULL) {
 		printf("%s: no memory\n", __func__);
diff --git a/sys/dev/usb/udl.c b/sys/dev/usb/udl.c
index abe5400f833..167648e2cb2 100644
--- a/sys/dev/usb/udl.c
+++ b/sys/dev/usb/udl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udl.c,v 1.80 2014/07/12 18:48:52 tedu Exp $ */
+/*	$OpenBSD: udl.c,v 1.81 2014/12/09 07:05:06 doug Exp $ */
 
 /*
  * Copyright (c) 2009 Marcus Glocker <mglocker@openbsd.org>
@@ -652,7 +652,7 @@ udl_alloc_screen(void *v, const struct wsscreen_descr *type,
 	*curyp = 0;
 
 	/* allocate character backing store */
-	sc->sc_cbs = malloc((sc->sc_ri.ri_rows * sc->sc_ri.ri_cols) *
+	sc->sc_cbs = mallocarray(sc->sc_ri.ri_rows, sc->sc_ri.ri_cols *
 	    sizeof(*sc->sc_cbs), M_DEVBUF, M_NOWAIT|M_ZERO);
 	if (sc->sc_cbs == NULL) {
 		printf("%s: can't allocate mem for character backing store!\n",
diff --git a/sys/dev/usb/uhci.c b/sys/dev/usb/uhci.c
index 5d5a990d0b4..bcccbd5b444 100644
--- a/sys/dev/usb/uhci.c
+++ b/sys/dev/usb/uhci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uhci.c,v 1.132 2014/10/30 23:50:25 mpi Exp $	*/
+/*	$OpenBSD: uhci.c,v 1.133 2014/12/09 07:05:06 doug Exp $	*/
 /*	$NetBSD: uhci.c,v 1.172 2003/02/23 04:19:26 simonb Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/uhci.c,v 1.33 1999/11/17 22:33:41 n_hibma Exp $	*/
 
@@ -2610,7 +2610,8 @@ uhci_device_setintr(struct uhci_softc *sc, struct uhci_pipe *upipe, int ival)
 	npoll = (UHCI_VFRAMELIST_COUNT + ival - 1) / ival;
 	DPRINTFN(2, ("uhci_device_setintr: ival=%d npoll=%d\n", ival, npoll));
 
-	qhs = malloc(npoll * sizeof(struct uhci_soft_qh *), M_USBHC, M_NOWAIT);
+	qhs = mallocarray(npoll, sizeof(struct uhci_soft_qh *), M_USBHC,
+	    M_NOWAIT);
 	if (qhs == NULL)
 		return (USBD_NOMEM);
 
diff --git a/sys/dev/usb/uhub.c b/sys/dev/usb/uhub.c
index abec212b8a8..593ea693a8f 100644
--- a/sys/dev/usb/uhub.c
+++ b/sys/dev/usb/uhub.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uhub.c,v 1.80 2014/11/23 12:19:08 mpi Exp $ */
+/*	$OpenBSD: uhub.c,v 1.81 2014/12/09 07:05:06 doug Exp $ */
 /*	$NetBSD: uhub.c,v 1.64 2003/02/08 03:32:51 ichiro Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/uhub.c,v 1.18 1999/11/17 22:33:43 n_hibma Exp $	*/
 
@@ -209,7 +209,7 @@ uhub_attach(struct device *parent, struct device *self, void *aux)
 	hub = malloc(sizeof(*hub), M_USBDEV, M_NOWAIT);
 	if (hub == NULL)
 		return;
-	hub->ports = malloc(sizeof(struct usbd_port) * nports,
+	hub->ports = mallocarray(nports, sizeof(struct usbd_port),
 	    M_USBDEV, M_NOWAIT);
 	if (hub->ports == NULL) {
 		free(hub, M_USBDEV, 0);
@@ -288,7 +288,7 @@ uhub_attach(struct device *parent, struct device *self, void *aux)
 	 */
 
 	if (UHUB_IS_HIGH_SPEED(sc)) {
-		tts = malloc((UHUB_IS_SINGLE_TT(sc) ? 1 : nports) *
+		tts = mallocarray((UHUB_IS_SINGLE_TT(sc) ? 1 : nports),
 		    sizeof (struct usbd_tt), M_USBDEV, M_NOWAIT);
 		if (!tts)
 			goto bad;
diff --git a/sys/dev/usb/umidi.c b/sys/dev/usb/umidi.c
index 141cef9a86f..1b567e89bd6 100644
--- a/sys/dev/usb/umidi.c
+++ b/sys/dev/usb/umidi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: umidi.c,v 1.39 2014/07/12 18:48:52 tedu Exp $	*/
+/*	$OpenBSD: umidi.c,v 1.40 2014/12/09 07:05:06 doug Exp $	*/
 /*	$NetBSD: umidi.c,v 1.16 2002/07/11 21:14:32 augustss Exp $	*/
 /*
  * Copyright (c) 2001 The NetBSD Foundation, Inc.
@@ -449,10 +449,9 @@ alloc_all_endpoints_fixed_ep(struct umidi_softc *sc)
 	sc->sc_in_num_jacks = 0;
 	sc->sc_out_num_endpoints = fp->num_out_ep;
 	sc->sc_in_num_endpoints = fp->num_in_ep;
-	sc->sc_endpoints = malloc(sizeof(*sc->sc_out_ep)*
-				  (sc->sc_out_num_endpoints+
-				   sc->sc_in_num_endpoints),
-				  M_USBDEV, M_WAITOK | M_CANFAIL);
+	sc->sc_endpoints = mallocarray(sc->sc_out_num_endpoints +
+	    sc->sc_in_num_endpoints, sizeof(*sc->sc_out_ep), M_USBDEV,
+	    M_WAITOK | M_CANFAIL);
 	if (!sc->sc_endpoints) {
 		return USBD_NOMEM;
 	}
@@ -592,10 +591,9 @@ alloc_all_endpoints_yamaha(struct umidi_softc *sc)
 		sc->sc_in_num_endpoints = 0;
 		sc->sc_in_num_jacks = 0;
 	}
-	sc->sc_endpoints = malloc(sizeof(struct umidi_endpoint)*
-				  (sc->sc_out_num_endpoints+
-				   sc->sc_in_num_endpoints),
-				  M_USBDEV, M_WAITOK | M_CANFAIL);
+	sc->sc_endpoints = mallocarray(sc->sc_out_num_endpoints +
+	    sc->sc_in_num_endpoints, sizeof(struct umidi_endpoint),
+	    M_USBDEV, M_WAITOK | M_CANFAIL);
 	if (!sc->sc_endpoints)
 		return USBD_NOMEM;
 	if (sc->sc_out_num_endpoints) {
@@ -636,8 +634,8 @@ alloc_all_endpoints_genuine(struct umidi_softc *sc)
 
 	interface_desc = usbd_get_interface_descriptor(sc->sc_iface);
 	num_ep = interface_desc->bNumEndpoints;
-	sc->sc_endpoints = p = malloc(sizeof(struct umidi_endpoint) * num_ep,
-				      M_USBDEV, M_WAITOK | M_CANFAIL);
+	sc->sc_endpoints = p = mallocarray(num_ep,
+	    sizeof(struct umidi_endpoint), M_USBDEV, M_WAITOK | M_CANFAIL);
 	if (!p)
 		return USBD_NOMEM;
 
@@ -727,10 +725,8 @@ alloc_all_jacks(struct umidi_softc *sc)
 	struct umidi_jack *jack, **rjack;
 
 	/* allocate/initialize structures */
-	sc->sc_jacks =
-	    malloc(sizeof(*sc->sc_out_jacks)*(sc->sc_in_num_jacks+
-					      sc->sc_out_num_jacks),
-		   M_USBDEV, M_WAITOK | M_CANFAIL);
+	sc->sc_jacks = mallocarray(sc->sc_in_num_jacks + sc->sc_out_num_jacks,
+	    sizeof(*sc->sc_out_jacks), M_USBDEV, M_WAITOK | M_CANFAIL);
 	if (!sc->sc_jacks)
 		return USBD_NOMEM;
 	sc->sc_out_jacks =
@@ -968,8 +964,8 @@ static usbd_status
 alloc_all_mididevs(struct umidi_softc *sc, int nmidi)
 {
 	sc->sc_num_mididevs = nmidi;
-	sc->sc_mididevs = malloc(sizeof(*sc->sc_mididevs)*nmidi, M_USBDEV,
-	    M_WAITOK | M_CANFAIL | M_ZERO);
+	sc->sc_mididevs = mallocarray(nmidi, sizeof(*sc->sc_mididevs),
+	    M_USBDEV, M_WAITOK | M_CANFAIL | M_ZERO);
 	if (!sc->sc_mididevs)
 		return USBD_NOMEM;
 
diff --git a/sys/dev/usb/usb_subr.c b/sys/dev/usb/usb_subr.c
index 63819d8e092..c9f48b13ccb 100644
--- a/sys/dev/usb/usb_subr.c
+++ b/sys/dev/usb/usb_subr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usb_subr.c,v 1.113 2014/11/10 11:01:13 mpi Exp $ */
+/*	$OpenBSD: usb_subr.c,v 1.114 2014/12/09 07:05:06 doug Exp $ */
 /*	$NetBSD: usb_subr.c,v 1.103 2003/01/10 11:19:13 augustss Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $	*/
 
@@ -491,8 +491,8 @@ usbd_fill_iface_data(struct usbd_device *dev, int ifaceidx, int altidx)
 	nendpt = ifc->idesc->bNumEndpoints;
 	DPRINTFN(4,("usbd_fill_iface_data: found idesc nendpt=%d\n", nendpt));
 	if (nendpt != 0) {
-		ifc->endpoints = malloc(nendpt * sizeof(struct usbd_endpoint),
-					M_USB, M_NOWAIT);
+		ifc->endpoints = mallocarray(nendpt,
+		    sizeof(struct usbd_endpoint), M_USB, M_NOWAIT);
 		if (ifc->endpoints == NULL)
 			return (USBD_NOMEM);
 	} else
@@ -744,7 +744,7 @@ usbd_set_config_index(struct usbd_device *dev, int index, int msg)
 
 	/* Allocate and fill interface data. */
 	nifc = cdp->bNumInterface;
-	dev->ifaces = malloc(nifc * sizeof(struct usbd_interface),
+	dev->ifaces = mallocarray(nifc, sizeof(struct usbd_interface),
 	    M_USB, M_NOWAIT | M_ZERO);
 	if (dev->ifaces == NULL) {
 		err = USBD_NOMEM;
diff --git a/sys/dev/wscons/wskbdutil.c b/sys/dev/wscons/wskbdutil.c
index e0341bd54fb..a0159c6f31f 100644
--- a/sys/dev/wscons/wskbdutil.c
+++ b/sys/dev/wscons/wskbdutil.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: wskbdutil.c,v 1.13 2014/07/12 18:48:53 tedu Exp $	*/
+/*	$OpenBSD: wskbdutil.c,v 1.14 2014/12/09 07:05:06 doug Exp $	*/
 /*	$NetBSD: wskbdutil.c,v 1.7 1999/12/21 11:59:13 drochner Exp $	*/
 
 /*-
@@ -381,7 +381,7 @@ wskbd_init_keymap(int newlen, struct wscons_keymap **map, int *maplen)
 		if (*maplen > 0)
 			free(*map, M_DEVBUF, 0);
 		*maplen = newlen;
-		*map = malloc(newlen*sizeof(struct wscons_keymap),
+		*map = mallocarray(newlen, sizeof(struct wscons_keymap),
 		    M_DEVBUF, M_WAITOK);
 	}
 
diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c
index 8553b099286..691aa9ca61a 100644
--- a/sys/kern/kern_event.c
+++ b/sys/kern/kern_event.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_event.c,v 1.59 2014/11/03 03:08:00 deraadt Exp $	*/
+/*	$OpenBSD: kern_event.c,v 1.60 2014/12/09 07:05:06 doug Exp $	*/
 
 /*-
  * Copyright (c) 1999,2000,2001 Jonathan Lemon <jlemon@FreeBSD.org>
@@ -1021,7 +1021,8 @@ knote_attach(struct knote *kn, struct filedesc *fdp)
 		size = fdp->fd_knlistsize;
 		while (size <= kn->kn_id)
 			size += KQEXTENT;
-		list = malloc(size * sizeof(struct klist), M_TEMP, M_WAITOK);
+		list = mallocarray(size, sizeof(struct klist), M_TEMP,
+		    M_WAITOK);
 		memcpy(list, fdp->fd_knlist,
 		    fdp->fd_knlistsize * sizeof(struct klist));
 		memset(&list[fdp->fd_knlistsize], 0,
diff --git a/sys/kern/sysv_shm.c b/sys/kern/sysv_shm.c
index 8b5adf88c10..10b806b922a 100644
--- a/sys/kern/sysv_shm.c
+++ b/sys/kern/sysv_shm.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sysv_shm.c,v 1.59 2014/11/16 12:31:00 deraadt Exp $	*/
+/*	$OpenBSD: sysv_shm.c,v 1.60 2014/12/09 07:05:06 doug Exp $	*/
 /*	$NetBSD: sysv_shm.c,v 1.50 1998/10/21 22:24:29 tron Exp $	*/
 
 /*
@@ -528,9 +528,9 @@ shminit(void)
 	pool_init(&shm_pool, sizeof(struct shmid_ds) +
 	    sizeof(struct shm_handle), 0, 0, 0, "shmpl",
 	    &pool_allocator_nointr);
-	shmsegs = malloc(shminfo.shmmni * sizeof(struct shmid_ds *),
+	shmsegs = mallocarray(shminfo.shmmni, sizeof(struct shmid_ds *),
 	    M_SHM, M_WAITOK|M_ZERO);
-	shmseqs = malloc(shminfo.shmmni * sizeof(unsigned short),
+	shmseqs = mallocarray(shminfo.shmmni, sizeof(unsigned short),
 	    M_SHM, M_WAITOK|M_ZERO);
 
 	shminfo.shmmax *= PAGE_SIZE;	/* actually in pages */
diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
index af0a3fcfc49..4f0e451720b 100644
--- a/sys/kern/uipc_syscalls.c
+++ b/sys/kern/uipc_syscalls.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_syscalls.c,v 1.94 2014/12/02 01:21:35 guenther Exp $	*/
+/*	$OpenBSD: uipc_syscalls.c,v 1.95 2014/12/09 07:05:06 doug Exp $	*/
 /*	$NetBSD: uipc_syscalls.c,v 1.19 1996/02/09 19:00:48 christos Exp $	*/
 
 /*
@@ -487,7 +487,7 @@ sys_sendmsg(struct proc *p, void *v, register_t *retval)
 	if (msg.msg_iovlen > IOV_MAX)
 		return (EMSGSIZE);
 	if (msg.msg_iovlen > UIO_SMALLIOV)
-		iov = malloc(sizeof(struct iovec) * msg.msg_iovlen,
+		iov = mallocarray(msg.msg_iovlen, sizeof(struct iovec),
 		    M_IOV, M_WAITOK);
 	else
 		iov = aiov;
@@ -647,7 +647,7 @@ sys_recvmsg(struct proc *p, void *v, register_t *retval)
 	if (msg.msg_iovlen > IOV_MAX)
 		return (EMSGSIZE);
 	if (msg.msg_iovlen > UIO_SMALLIOV)
-		iov = malloc(sizeof(struct iovec) * msg.msg_iovlen,
+		iov = mallocarray(msg.msg_iovlen, sizeof(struct iovec),
 		    M_IOV, M_WAITOK);
 	else
 		iov = aiov;
diff --git a/sys/msdosfs/msdosfs_vfsops.c b/sys/msdosfs/msdosfs_vfsops.c
index a96382bb1bf..ae58709c208 100644
--- a/sys/msdosfs/msdosfs_vfsops.c
+++ b/sys/msdosfs/msdosfs_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: msdosfs_vfsops.c,v 1.68 2014/07/12 18:50:41 tedu Exp $	*/
+/*	$OpenBSD: msdosfs_vfsops.c,v 1.69 2014/12/09 07:05:06 doug Exp $	*/
 /*	$NetBSD: msdosfs_vfsops.c,v 1.48 1997/10/18 02:54:57 briggs Exp $	*/
 
 /*-
@@ -524,7 +524,7 @@ msdosfs_mountfs(struct vnode *devvp, struct mount *mp, struct proc *p,
 		error = EINVAL;
 		goto error_exit;
 	}
-	pmp->pm_inusemap = malloc(bmapsiz * sizeof(*pmp->pm_inusemap),
+	pmp->pm_inusemap = mallocarray(bmapsiz, sizeof(*pmp->pm_inusemap),
 	    M_MSDOSFSFAT, M_WAITOK | M_CANFAIL);
 	if (pmp->pm_inusemap == NULL) {
 		error = EINVAL;
diff --git a/sys/net/hfsc.c b/sys/net/hfsc.c
index 2e8d27594ca..c990ff503f3 100644
--- a/sys/net/hfsc.c
+++ b/sys/net/hfsc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hfsc.c,v 1.12 2014/12/05 15:50:04 mpi Exp $	*/
+/*	$OpenBSD: hfsc.c,v 1.13 2014/12/09 07:05:06 doug Exp $	*/
 
 /*
  * Copyright (c) 2012-2013 Henning Brauer <henning@openbsd.org>
@@ -144,7 +144,8 @@ hfsc_grow_class_tbl(struct hfsc_if *hif, u_int howmany)
 {
 	struct hfsc_class **newtbl, **old;
 
-	newtbl = malloc(howmany * sizeof(void *), M_DEVBUF, M_WAITOK | M_ZERO);
+	newtbl = mallocarray(howmany, sizeof(void *), M_DEVBUF,
+	    M_WAITOK | M_ZERO);
 	old = hif->hif_class_tbl;
 
 	memcpy(newtbl, old, hif->hif_allocated * sizeof(void *));
diff --git a/sys/net/if_media.c b/sys/net/if_media.c
index 9755591cdeb..ac6f50a4725 100644
--- a/sys/net/if_media.c
+++ b/sys/net/if_media.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_media.c,v 1.23 2014/07/12 18:44:22 tedu Exp $	*/
+/*	$OpenBSD: if_media.c,v 1.24 2014/12/09 07:05:06 doug Exp $	*/
 /*	$NetBSD: if_media.c,v 1.10 2000/03/13 23:52:39 soren Exp $	*/
 
 /*-
@@ -313,7 +313,7 @@ ifmedia_ioctl(struct ifnet *ifp, struct ifreq *ifr, struct ifmedia *ifm,
 
 			minwords = nwords > (size_t)ifmr->ifm_count ?
 			    (size_t)ifmr->ifm_count : nwords;
-			kptr = malloc(nwords * sizeof(int), M_TEMP,
+			kptr = mallocarray(nwords, sizeof(int), M_TEMP,
 			    M_WAITOK | M_ZERO);
 			/*
 			 * Get the media words from the interface's list.
diff --git a/sys/net/pf_ioctl.c b/sys/net/pf_ioctl.c
index eea75e94409..b84e900a91b 100644
--- a/sys/net/pf_ioctl.c
+++ b/sys/net/pf_ioctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf_ioctl.c,v 1.278 2014/12/05 15:50:04 mpi Exp $ */
+/*	$OpenBSD: pf_ioctl.c,v 1.279 2014/12/09 07:05:06 doug Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -759,8 +759,9 @@ pf_setup_pfsync_matching(struct pf_ruleset *rs)
 	rs->rules.inactive.ptr_array = NULL;
 
 	if (rs->rules.inactive.rcount) {
-		rs->rules.inactive.ptr_array = malloc(sizeof(caddr_t) *
-		    rs->rules.inactive.rcount,  M_TEMP, M_NOWAIT);
+		rs->rules.inactive.ptr_array =
+		    mallocarray(rs->rules.inactive.rcount, sizeof(caddr_t),
+		    M_TEMP, M_NOWAIT);
 
 		if (!rs->rules.inactive.ptr_array)
 			return (ENOMEM);
diff --git a/sys/net/pfkey.c b/sys/net/pfkey.c
index d4f646a588a..fbced37f738 100644
--- a/sys/net/pfkey.c
+++ b/sys/net/pfkey.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfkey.c,v 1.23 2014/11/23 07:39:02 deraadt Exp $	*/
+/*	$OpenBSD: pfkey.c,v 1.24 2014/12/09 07:05:06 doug Exp $	*/
 
 /*
  *	@(#)COPYRIGHT	1.1 (NRL) 17 January 1995
@@ -303,7 +303,7 @@ pfkey_buildprotosw(void)
 			j++;
 
 	if (j) {
-		if (!(protosw = malloc(j * sizeof(struct protosw),
+		if (!(protosw = mallocarray(j, sizeof(struct protosw),
 		    M_PFKEY, M_DONTWAIT)))
 			return (ENOMEM);
 
diff --git a/sys/netinet/ip_ipsp.c b/sys/netinet/ip_ipsp.c
index 8c8daf67531..d785d1cf7e8 100644
--- a/sys/netinet/ip_ipsp.c
+++ b/sys/netinet/ip_ipsp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_ipsp.c,v 1.200 2014/11/18 02:37:31 tedu Exp $	*/
+/*	$OpenBSD: ip_ipsp.c,v 1.201 2014/12/09 07:05:06 doug Exp $	*/
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr),
@@ -598,11 +598,11 @@ tdb_rehash(void)
 
 	tdb_hashmask = (tdb_hashmask << 1) | 1;
 
-	new_tdbh = malloc(sizeof(struct tdb *) * (tdb_hashmask + 1), M_TDB,
+	new_tdbh = mallocarray(tdb_hashmask + 1, sizeof(struct tdb *), M_TDB,
 	    M_WAITOK | M_ZERO);
-	new_tdbaddr = malloc(sizeof(struct tdb *) * (tdb_hashmask + 1), M_TDB,
+	new_tdbaddr = mallocarray(tdb_hashmask + 1, sizeof(struct tdb *), M_TDB,
 	    M_WAITOK | M_ZERO);
-	new_srcaddr = malloc(sizeof(struct tdb *) * (tdb_hashmask + 1), M_TDB,
+	new_srcaddr = mallocarray(tdb_hashmask + 1, sizeof(struct tdb *), M_TDB,
 	    M_WAITOK | M_ZERO);
 
 	for (i = 0; i <= old_hashmask; i++) {
@@ -654,11 +654,11 @@ puttdb(struct tdb *tdbp)
 	int s = splsoftnet();
 
 	if (tdbh == NULL) {
-		tdbh = malloc(sizeof(struct tdb *) * (tdb_hashmask + 1), M_TDB,
-		    M_WAITOK | M_ZERO);
-		tdbaddr = malloc(sizeof(struct tdb *) * (tdb_hashmask + 1),
+		tdbh = mallocarray(tdb_hashmask + 1, sizeof(struct tdb *),
 		    M_TDB, M_WAITOK | M_ZERO);
-		tdbsrc = malloc(sizeof(struct tdb *) * (tdb_hashmask + 1),
+		tdbaddr = mallocarray(tdb_hashmask + 1, sizeof(struct tdb *),
+		    M_TDB, M_WAITOK | M_ZERO);
+		tdbsrc = mallocarray(tdb_hashmask + 1, sizeof(struct tdb *),
 		    M_TDB, M_WAITOK | M_ZERO);
 	}