From f8238f3e71a8eb02e65b90db598fa2664cb0a2c7 Mon Sep 17 00:00:00 2001
From: doug <doug@openbsd.org>
Date: Sat, 13 Dec 2014 21:05:32 +0000
Subject: [PATCH] yet more mallocarray() changes.

ok tedu@ deraadt@
---
 sys/arch/alpha/tc/tc_dma_3000_500.c |  7 +++----
 sys/arch/arm/cortex/ampintc.c       |  7 +++----
 sys/arch/sgi/dev/impact.c           |  9 ++++-----
 sys/dev/ic/aic79xx.c                |  9 +++++----
 sys/dev/ic/aic7xxx.c                | 11 ++++++-----
 sys/dev/pci/if_ix.c                 |  4 ++--
 sys/dev/pci/if_oce.c                |  4 ++--
 sys/dev/pci/if_vio.c                | 10 ++++++----
 sys/dev/pci/isp_pci.c               | 13 ++++++++-----
 sys/dev/pcmcia/cfxga.c              |  7 ++++---
 sys/dev/rasops/rasops.c             |  8 +++++---
 sys/dev/usb/uaudio.c                | 13 ++++++++-----
 sys/dev/usb/uhidev.c                |  4 ++--
 sys/dev/usb/usb_subr.c              |  9 +++++----
 sys/dev/vnd.c                       |  7 +++----
 sys/dev/wscons/wskbd.c              |  6 ++++--
 sys/dev/wsfont/wsfont.c             |  4 ++--
 sys/kern/sched_bsd.c                |  6 +++---
 sys/kern/subr_log.c                 |  5 +++--
 sys/kern/uipc_syscalls.c            |  8 +++++---
 sys/net/if_enc.c                    | 12 +++++++-----
 sys/net/if_ppp.c                    |  7 ++++---
 22 files changed, 94 insertions(+), 76 deletions(-)

diff --git a/sys/arch/alpha/tc/tc_dma_3000_500.c b/sys/arch/alpha/tc/tc_dma_3000_500.c
index a38a848121f..c21e0f54452 100644
--- a/sys/arch/alpha/tc/tc_dma_3000_500.c
+++ b/sys/arch/alpha/tc/tc_dma_3000_500.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tc_dma_3000_500.c,v 1.5 2009/02/01 14:34:02 miod Exp $ */
+/* $OpenBSD: tc_dma_3000_500.c,v 1.6 2014/12/13 21:05:32 doug Exp $ */
 /* $NetBSD: tc_dma_3000_500.c,v 1.13 2001/07/19 06:40:03 thorpej Exp $ */
 
 /*-
@@ -81,12 +81,11 @@ tc_dma_init_3000_500(nslots)
 	int nslots;
 {
 	extern struct alpha_bus_dma_tag tc_dmat_direct;
-	size_t sisize;
 	int i;
 
 	/* Allocate per-slot DMA info. */
-	sisize = nslots * sizeof(struct tc_dma_slot_info);
-	tc_dma_slot_info = malloc(sisize, M_DEVBUF, M_NOWAIT | M_ZERO);
+	tc_dma_slot_info = mallocarray(nslots, sizeof(struct tc_dma_slot_info),
+	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (tc_dma_slot_info == NULL)
 		panic("tc_dma_init: can't allocate per-slot DMA info");
 
diff --git a/sys/arch/arm/cortex/ampintc.c b/sys/arch/arm/cortex/ampintc.c
index 7a7b2d1f567..d9aa90d71fc 100644
--- a/sys/arch/arm/cortex/ampintc.c
+++ b/sys/arch/arm/cortex/ampintc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ampintc.c,v 1.4 2014/10/08 14:53:36 rapha Exp $ */
+/* $OpenBSD: ampintc.c,v 1.5 2014/12/13 21:05:32 doug Exp $ */
 /*
  * Copyright (c) 2007,2009,2011 Dale Rahn <drahn@openbsd.org>
  *
@@ -268,9 +268,8 @@ ampintc_attach(struct device *parent, struct device *self, void *args)
 	/* XXX - check power saving bit */
 
 
-	sc->sc_ampintc_handler = malloc(
-	    (sizeof (*sc->sc_ampintc_handler) * nintr),
-	    M_DEVBUF, M_ZERO | M_NOWAIT);
+	sc->sc_ampintc_handler = mallocarray(nintr,
+	    sizeof(*sc->sc_ampintc_handler), M_DEVBUF, M_ZERO | M_NOWAIT);
 	for (i = 0; i < nintr; i++) {
 		TAILQ_INIT(&sc->sc_ampintc_handler[i].iq_list);
 	}
diff --git a/sys/arch/sgi/dev/impact.c b/sys/arch/sgi/dev/impact.c
index 633f85888d8..dc5481fcbb9 100644
--- a/sys/arch/sgi/dev/impact.c
+++ b/sys/arch/sgi/dev/impact.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: impact.c,v 1.6 2014/07/12 18:44:42 tedu Exp $	*/
+/*	$OpenBSD: impact.c,v 1.7 2014/12/13 21:05:32 doug Exp $	*/
 
 /*
  * Copyright (c) 2010, 2012 Miodrag Vallat.
@@ -192,7 +192,6 @@ int
 impact_init_screen(struct impact_screen *scr)
 {
 	struct rasops_info *ri = &scr->ri;
-	size_t bssize;
 	int i;
 	uint32_t c, r, g, b;
 
@@ -211,9 +210,9 @@ impact_init_screen(struct impact_screen *scr)
 	 * be able to fulfill scrolling requests.
 	 */
 	if (scr->bs == NULL) {
-		bssize = ri->ri_rows * ri->ri_cols *
-		    sizeof(struct wsdisplay_charcell);
-		scr->bs = malloc(bssize, M_DEVBUF, M_NOWAIT | M_ZERO);
+		scr->bs = mallocarray(ri->ri_rows,
+		    ri->ri_cols * sizeof(struct wsdisplay_charcell), M_DEVBUF,
+		    M_NOWAIT | M_ZERO);
 		if (scr->bs == NULL)
 			return ENOMEM;
 	}
diff --git a/sys/dev/ic/aic79xx.c b/sys/dev/ic/aic79xx.c
index 95c88722334..ee2f1301b59 100644
--- a/sys/dev/ic/aic79xx.c
+++ b/sys/dev/ic/aic79xx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aic79xx.c,v 1.54 2014/07/13 23:10:23 deraadt Exp $	*/
+/*	$OpenBSD: aic79xx.c,v 1.55 2014/12/13 21:05:33 doug Exp $	*/
 
 /*
  * Copyright (c) 2004 Milos Urbanek, Kenneth R. Westerback & Marco Peereboom
@@ -8584,11 +8584,12 @@ ahd_loadseq(struct ahd_softc *ahd)
 
 	ahd->num_critical_sections = cs_count;
 	if (cs_count != 0) {
-
-		cs_count *= sizeof(struct cs);
-		ahd->critical_sections = malloc(cs_count, M_DEVBUF, M_NOWAIT);
+		ahd->critical_sections = mallocarray(cs_count,
+		    sizeof(struct cs), M_DEVBUF, M_NOWAIT);
 		if (ahd->critical_sections == NULL)
 			panic("ahd_loadseq: Could not malloc");
+		cs_count *= sizeof(struct cs);
+
 		memcpy(ahd->critical_sections, cs_table, cs_count);
 	}
 	ahd_outb(ahd, SEQCTL0, PERRORDIS|FAILDIS|FASTMODE);
diff --git a/sys/dev/ic/aic7xxx.c b/sys/dev/ic/aic7xxx.c
index 723af0416fd..79db0908c1c 100644
--- a/sys/dev/ic/aic7xxx.c
+++ b/sys/dev/ic/aic7xxx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aic7xxx.c,v 1.88 2014/07/13 23:10:23 deraadt Exp $	*/
+/*	$OpenBSD: aic7xxx.c,v 1.89 2014/12/13 21:05:33 doug Exp $	*/
 /*	$NetBSD: aic7xxx.c,v 1.108 2003/11/02 11:07:44 wiz Exp $	*/
 
 /*
@@ -40,7 +40,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGES.
  *
- * $Id: aic7xxx.c,v 1.88 2014/07/13 23:10:23 deraadt Exp $
+ * $Id: aic7xxx.c,v 1.89 2014/12/13 21:05:33 doug Exp $
  */
 /*
  * Ported from FreeBSD by Pascal Renauld, Network Storage Solutions, Inc. - April 2003
@@ -6232,11 +6232,12 @@ ahc_loadseq(struct ahc_softc *ahc)
 
 	ahc->num_critical_sections = cs_count;
 	if (cs_count != 0) {
-
-		cs_count *= sizeof(struct cs);
-		ahc->critical_sections = malloc(cs_count, M_DEVBUF, M_NOWAIT);
+		ahc->critical_sections = mallocarray(cs_count,
+		    sizeof(struct cs), M_DEVBUF, M_NOWAIT);
 		if (ahc->critical_sections == NULL)
 			panic("ahc_loadseq: Could not malloc");
+		cs_count *= sizeof(struct cs);
+
 		memcpy(ahc->critical_sections, cs_table, cs_count);
 	}
 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE);
diff --git a/sys/dev/pci/if_ix.c b/sys/dev/pci/if_ix.c
index 7ea613c6735..34ead4aba1c 100644
--- a/sys/dev/pci/if_ix.c
+++ b/sys/dev/pci/if_ix.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ix.c,v 1.111 2014/11/27 15:49:13 brad Exp $	*/
+/*	$OpenBSD: if_ix.c,v 1.112 2014/12/13 21:05:33 doug Exp $	*/
 
 /******************************************************************************
 
@@ -490,7 +490,7 @@ ixgbe_rxrinfo(struct ix_softc *sc, struct if_rxrinfo *ifri)
 	u_int n = 0;
 
 	if (sc->num_queues > 1) {
-		if ((ifr = malloc(sc->num_queues * sizeof(*ifr), M_DEVBUF,
+		if ((ifr = mallocarray(sc->num_queues, sizeof(*ifr), M_DEVBUF,
 		    M_WAITOK | M_ZERO)) == NULL)
 			return (ENOMEM);
 	} else
diff --git a/sys/dev/pci/if_oce.c b/sys/dev/pci/if_oce.c
index eec2e1556be..09371a0675e 100644
--- a/sys/dev/pci/if_oce.c
+++ b/sys/dev/pci/if_oce.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_oce.c,v 1.79 2014/08/30 09:48:23 dlg Exp $	*/
+/*	$OpenBSD: if_oce.c,v 1.80 2014/12/13 21:05:33 doug Exp $	*/
 
 /*
  * Copyright (c) 2012 Mike Belopuhov
@@ -911,7 +911,7 @@ oce_rxrinfo(struct oce_softc *sc, struct if_rxrinfo *ifri)
 	u_int n = 0;
 
 	if (sc->sc_nrq > 1) {
-		if ((ifr = malloc(sc->sc_nrq * sizeof(*ifr), M_DEVBUF,
+		if ((ifr = mallocarray(sc->sc_nrq, sizeof(*ifr), M_DEVBUF,
 		    M_WAITOK | M_ZERO)) == NULL)
 			return (ENOMEM);
 	} else
diff --git a/sys/dev/pci/if_vio.c b/sys/dev/pci/if_vio.c
index f48e7eedc7a..742bf13d5f2 100644
--- a/sys/dev/pci/if_vio.c
+++ b/sys/dev/pci/if_vio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_vio.c,v 1.20 2014/12/06 10:09:10 sf Exp $	*/
+/*	$OpenBSD: if_vio.c,v 1.21 2014/12/13 21:05:33 doug Exp $	*/
 
 /*
  * Copyright (c) 2012 Stefan Fritsch, Alexander Fiveg.
@@ -431,13 +431,15 @@ vio_alloc_mem(struct vio_softc *sc)
 		sc->sc_ctrl_mac_tbl_mc = (void*)(kva + offset);
 	}
 
-	allocsize = (rxqsize + txqsize) *
-	    (2 * sizeof(bus_dmamap_t) + sizeof(struct mbuf *));
-	sc->sc_arrays = malloc(allocsize, M_DEVBUF, M_WAITOK|M_CANFAIL|M_ZERO);
+	sc->sc_arrays = mallocarray(rxqsize + txqsize,
+	    2 * sizeof(bus_dmamap_t) + sizeof(struct mbuf *), M_DEVBUF,
+	    M_WAITOK | M_CANFAIL | M_ZERO);
 	if (sc->sc_arrays == NULL) {
 		printf("unable to allocate mem for dmamaps\n");
 		goto err_hdr;
 	}
+	allocsize = (rxqsize + txqsize) *
+	    (2 * sizeof(bus_dmamap_t) + sizeof(struct mbuf *));
 
 	sc->sc_tx_dmamaps = sc->sc_arrays + rxqsize;
 	sc->sc_rx_mbufs = (void*) (sc->sc_tx_dmamaps + txqsize);
diff --git a/sys/dev/pci/isp_pci.c b/sys/dev/pci/isp_pci.c
index 5ec22bbb6fd..f559edeb4f9 100644
--- a/sys/dev/pci/isp_pci.c
+++ b/sys/dev/pci/isp_pci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: isp_pci.c,v 1.61 2014/07/13 23:10:23 deraadt Exp $	*/
+/*	$OpenBSD: isp_pci.c,v 1.62 2014/12/13 21:05:33 doug Exp $	*/
 /* $FreeBSD: src/sys/dev/isp/isp_pci.c,v 1.148 2007/06/26 23:08:57 mjacob Exp $*/
 /*-
  * Copyright (c) 1997-2006 by Matthew Jacob
@@ -1075,20 +1075,23 @@ isp_pci_mbxdma(struct ispsoftc *isp)
 	if (isp->isp_rquest_dma)	/* been here before? */
 		return (0);
 
-	len = isp->isp_maxcmds * sizeof (XS_T *);
-	isp->isp_xflist = malloc(len, M_DEVBUF, M_NOWAIT | M_ZERO);
+	isp->isp_xflist = mallocarray(isp->isp_maxcmds, sizeof(XS_T *),
+	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (isp->isp_xflist == NULL) {
 		isp_prt(isp, ISP_LOGERR, "cannot malloc xflist array");
 		return (1);
 	}
-	len = isp->isp_maxcmds * sizeof (bus_dmamap_t);
-	pcs->pci_xfer_dmap = (bus_dmamap_t *) malloc(len, M_DEVBUF, M_NOWAIT);
+	len = isp->isp_maxcmds * sizeof(XS_T *);
+
+	pcs->pci_xfer_dmap = mallocarray(isp->isp_maxcmds, sizeof(bus_dmamap_t),
+	    M_DEVBUF, M_NOWAIT);
 	if (pcs->pci_xfer_dmap == NULL) {
 		free(isp->isp_xflist, M_DEVBUF, 0);
 		isp->isp_xflist = NULL;
 		isp_prt(isp, ISP_LOGERR, "cannot malloc dma map array");
 		return (1);
 	}
+	len = isp->isp_maxcmds * sizeof(bus_dmamap_t);
 
 	for (i = 0; i < isp->isp_maxcmds; i++) {
 		if (bus_dmamap_create(dmat, MAXPHYS, (MAXPHYS / NBPG) + 1,
diff --git a/sys/dev/pcmcia/cfxga.c b/sys/dev/pcmcia/cfxga.c
index 88593d1fd33..318710d9c14 100644
--- a/sys/dev/pcmcia/cfxga.c
+++ b/sys/dev/pcmcia/cfxga.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cfxga.c,v 1.28 2014/07/12 18:48:52 tedu Exp $	*/
+/*	$OpenBSD: cfxga.c,v 1.29 2014/12/13 21:05:33 doug Exp $	*/
 
 /*
  * Copyright (c) 2005, 2006, Matthieu Herrb and Miodrag Vallat
@@ -501,13 +501,14 @@ cfxga_alloc_screen(void *v, const struct wsscreen_descr *type, void **cookiep,
 	 * Allocate backing store to remember non-visible screen contents in
 	 * emulation mode.
 	 */
-	scrsize = ri->ri_rows * ri->ri_cols * sizeof(struct wsdisplay_charcell);
-	scr->scr_mem = malloc(scrsize, M_DEVBUF,
+	scr->scr_mem = mallocarray(ri->ri_rows,
+	    ri->ri_cols * sizeof(struct wsdisplay_charcell), M_DEVBUF,
 	    (cold ? M_NOWAIT : M_WAITOK) | M_ZERO);
 	if (scr->scr_mem == NULL) {
 		free(scr, M_DEVBUF, 0);
 		return (ENOMEM);
 	}
+	scrsize = ri->ri_rows * ri->ri_cols * sizeof(struct wsdisplay_charcell);
 
 	ri->ri_ops.copycols = cfxga_copycols;
 	ri->ri_ops.copyrows = cfxga_copyrows;
diff --git a/sys/dev/rasops/rasops.c b/sys/dev/rasops/rasops.c
index 89630578739..ba1f8bf2c20 100644
--- a/sys/dev/rasops/rasops.c
+++ b/sys/dev/rasops/rasops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rasops.c,v 1.34 2014/11/20 10:37:21 landry Exp $	*/
+/*	$OpenBSD: rasops.c,v 1.35 2014/12/13 21:05:33 doug Exp $	*/
 /*	$NetBSD: rasops.c,v 1.35 2001/02/02 06:01:01 marcus Exp $	*/
 
 /*-
@@ -1377,12 +1377,14 @@ rasops_alloc_screen(void *v, void **cookiep,
 	if (scr == NULL)
 		return (ENOMEM);
 
-	size = ri->ri_rows * ri->ri_cols * sizeof(struct wsdisplay_charcell);
-	scr->rs_bs = malloc(size, M_DEVBUF, M_NOWAIT);
+	scr->rs_bs = mallocarray(ri->ri_rows,
+	    ri->ri_cols * sizeof(struct wsdisplay_charcell), M_DEVBUF,
+	    M_NOWAIT);
 	if (scr->rs_bs == NULL) {
 		free(scr, M_DEVBUF, 0);
 		return (ENOMEM);
 	}
+	size = ri->ri_rows * ri->ri_cols * sizeof(struct wsdisplay_charcell);
 
 	*cookiep = scr;
 	*curxp = 0;
diff --git a/sys/dev/usb/uaudio.c b/sys/dev/usb/uaudio.c
index 893190dd1ae..3a81988f685 100644
--- a/sys/dev/usb/uaudio.c
+++ b/sys/dev/usb/uaudio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uaudio.c,v 1.107 2014/12/09 07:05:06 doug Exp $ */
+/*	$OpenBSD: uaudio.c,v 1.108 2014/12/13 21:05:33 doug Exp $ */
 /*	$NetBSD: uaudio.c,v 1.90 2004/10/29 17:12:53 kent Exp $	*/
 
 /*
@@ -649,12 +649,14 @@ uaudio_mixer_add_ctl(struct uaudio_softc *sc, struct mixerctl *mc)
 	} else {
 		DPRINTF(("%s: adding %s\n", __func__, mc->ctlname));
 	}
-	len = sizeof(*mc) * (sc->sc_nctls + 1);
-	nmc = malloc(len, M_USBDEV, M_NOWAIT);
+
+	nmc = mallocarray(sc->sc_nctls + 1, sizeof(*mc), M_USBDEV, M_NOWAIT);
 	if (nmc == NULL) {
 		printf("uaudio_mixer_add_ctl: no memory\n");
 		return;
 	}
+	len = sizeof(*mc) * (sc->sc_nctls + 1);
+
 	/* Copy old data, if there was any */
 	if (sc->sc_nctls != 0) {
 		bcopy(sc->sc_ctls, nmc, sizeof(*mc) * (sc->sc_nctls));
@@ -1524,12 +1526,13 @@ uaudio_add_alt(struct uaudio_softc *sc, const struct as_info *ai)
 	size_t len;
 	struct as_info *nai;
 
-	len = sizeof(*ai) * (sc->sc_nalts + 1);
-	nai = malloc(len, M_USBDEV, M_NOWAIT);
+	nai = mallocarray(sc->sc_nalts + 1, sizeof(*ai), M_USBDEV, M_NOWAIT);
 	if (nai == NULL) {
 		printf("uaudio_add_alt: no memory\n");
 		return;
 	}
+	len = sizeof(*ai) * (sc->sc_nalts + 1);
+
 	/* Copy old data, if there was any */
 	if (sc->sc_nalts != 0) {
 		bcopy(sc->sc_alts, nai, sizeof(*ai) * (sc->sc_nalts));
diff --git a/sys/dev/usb/uhidev.c b/sys/dev/usb/uhidev.c
index c4ef58db6cd..7144b5f7094 100644
--- a/sys/dev/usb/uhidev.c
+++ b/sys/dev/usb/uhidev.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uhidev.c,v 1.65 2014/12/11 18:39:27 mpi Exp $	*/
+/*	$OpenBSD: uhidev.c,v 1.66 2014/12/13 21:05:33 doug Exp $	*/
 /*	$NetBSD: uhidev.c,v 1.14 2003/03/11 16:44:00 augustss Exp $	*/
 
 /*
@@ -215,7 +215,7 @@ uhidev_attach(struct device *parent, struct device *self, void *aux)
 		printf(", %d report id%s", nrepid, nrepid > 1 ? "s" : "");
 	printf("\n");
 	nrepid++;
-	sc->sc_subdevs = malloc(nrepid * sizeof(struct uhidev *),
+	sc->sc_subdevs = mallocarray(nrepid, sizeof(struct uhidev *),
 	    M_USBDEV, M_NOWAIT | M_ZERO);
 	if (sc->sc_subdevs == NULL) {
 		printf("%s: no memory\n", DEVNAME(sc));
diff --git a/sys/dev/usb/usb_subr.c b/sys/dev/usb/usb_subr.c
index c9f48b13ccb..606e795c6ce 100644
--- a/sys/dev/usb/usb_subr.c
+++ b/sys/dev/usb/usb_subr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usb_subr.c,v 1.114 2014/12/09 07:05:06 doug Exp $ */
+/*	$OpenBSD: usb_subr.c,v 1.115 2014/12/13 21:05:33 doug Exp $ */
 /*	$NetBSD: usb_subr.c,v 1.103 2003/01/10 11:19:13 augustss Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $	*/
 
@@ -894,7 +894,7 @@ usbd_probe_and_attach(struct device *parent, struct usbd_device *dev, int port,
 		}
 		nifaces = dev->cdesc->bNumInterface;
 		uaa.configno = dev->cdesc->bConfigurationValue;
-		ifaces = malloc(nifaces * sizeof(*ifaces), M_USB, M_NOWAIT);
+		ifaces = mallocarray(nifaces, sizeof(*ifaces), M_USB, M_NOWAIT);
 		if (ifaces == NULL) {
 			err = USBD_NOMEM;
 			goto fail;
@@ -905,13 +905,14 @@ usbd_probe_and_attach(struct device *parent, struct usbd_device *dev, int port,
 		uaa.nifaces = nifaces;
 
 		/* add 1 for possible ugen and 1 for NULL terminator */
-		len = (nifaces + 2) * sizeof dv;
-		dev->subdevs = malloc(len, M_USB, M_NOWAIT | M_ZERO);
+		dev->subdevs = mallocarray(nifaces + 2, sizeof(dv), M_USB,
+		    M_NOWAIT | M_ZERO);
 		if (dev->subdevs == NULL) {
 			free(ifaces, M_USB, 0);
 			err = USBD_NOMEM;
 			goto fail;
 		}
+		len = (nifaces + 2) * sizeof(dv);
 
 		for (i = 0; i < nifaces; i++) {
 			if (usbd_iface_claimed(dev, i))
diff --git a/sys/dev/vnd.c b/sys/dev/vnd.c
index d266f81e05c..a73042dce23 100644
--- a/sys/dev/vnd.c
+++ b/sys/dev/vnd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vnd.c,v 1.154 2014/10/17 02:05:06 tedu Exp $	*/
+/*	$OpenBSD: vnd.c,v 1.155 2014/12/13 21:05:32 doug Exp $	*/
 /*	$NetBSD: vnd.c,v 1.26 1996/03/30 23:06:11 christos Exp $	*/
 
 /*
@@ -146,13 +146,12 @@ void
 vndattach(int num)
 {
 	char *mem;
-	u_long size;
 	int i;
 
 	if (num <= 0)
 		return;
-	size = num * sizeof(struct vnd_softc);
-	mem = malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
+	mem = mallocarray(num, sizeof(struct vnd_softc), M_DEVBUF,
+	    M_NOWAIT | M_ZERO);
 	if (mem == NULL) {
 		printf("WARNING: no memory for vnode disks\n");
 		return;
diff --git a/sys/dev/wscons/wskbd.c b/sys/dev/wscons/wskbd.c
index f5ccf1075a8..ea36d9d21e5 100644
--- a/sys/dev/wscons/wskbd.c
+++ b/sys/dev/wscons/wskbd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wskbd.c,v 1.80 2014/07/12 18:48:53 tedu Exp $ */
+/* $OpenBSD: wskbd.c,v 1.81 2014/12/13 21:05:33 doug Exp $ */
 /* $NetBSD: wskbd.c,v 1.80 2005/05/04 01:52:16 augustss Exp $ */
 
 /*
@@ -1104,8 +1104,10 @@ getkeyrepeat:
 		if (umdp->maplen > WSKBDIO_MAXMAPLEN)
 			return (EINVAL);
 
+		buf = mallocarray(umdp->maplen, sizeof(struct wscons_keymap),
+		    M_TEMP, M_WAITOK);
 		len = umdp->maplen * sizeof(struct wscons_keymap);
-		buf = malloc(len, M_TEMP, M_WAITOK);
+
 		error = copyin(umdp->map, buf, len);
 		if (error == 0) {
 			wskbd_init_keymap(umdp->maplen,
diff --git a/sys/dev/wsfont/wsfont.c b/sys/dev/wsfont/wsfont.c
index 958f4418a2c..e2c4acbbd8c 100644
--- a/sys/dev/wsfont/wsfont.c
+++ b/sys/dev/wsfont/wsfont.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: wsfont.c,v 1.37 2014/12/07 13:07:18 miod Exp $ */
+/*	$OpenBSD: wsfont.c,v 1.38 2014/12/13 21:05:33 doug Exp $ */
 /*	$NetBSD: wsfont.c,v 1.17 2001/02/07 13:59:24 ad Exp $	*/
 
 /*-
@@ -303,7 +303,7 @@ wsfont_rotate_internal(struct wsdisplay_font *font)
 
 	/* Allocate a buffer big enough for the rotated font. */
 	newstride = (font->fontheight + 7) / 8;
-	newbits = malloc(newstride * font->fontwidth * font->numchars,
+	newbits = mallocarray(font->numchars, newstride * font->fontwidth,
 	    M_DEVBUF, M_WAITOK | M_ZERO);
 
 	/* Rotate the font a bit at a time. */
diff --git a/sys/kern/sched_bsd.c b/sys/kern/sched_bsd.c
index 113b3017dd0..3472681590f 100644
--- a/sys/kern/sched_bsd.c
+++ b/sys/kern/sched_bsd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sched_bsd.c,v 1.39 2014/11/12 22:27:45 tedu Exp $	*/
+/*	$OpenBSD: sched_bsd.c,v 1.40 2014/12/13 21:05:33 doug Exp $	*/
 /*	$NetBSD: kern_synch.c,v 1.37 1996/04/22 01:38:37 christos Exp $	*/
 
 /*-
@@ -598,11 +598,11 @@ setperf_auto(void *v)
 		return;
 
 	if (!idleticks)
-		if (!(idleticks = malloc(sizeof(*idleticks) * ncpusfound,
+		if (!(idleticks = mallocarray(ncpusfound, sizeof(*idleticks),
 		    M_DEVBUF, M_NOWAIT | M_ZERO)))
 			return;
 	if (!totalticks)
-		if (!(totalticks = malloc(sizeof(*totalticks) * ncpusfound,
+		if (!(totalticks = mallocarray(ncpusfound, sizeof(*totalticks),
 		    M_DEVBUF, M_NOWAIT | M_ZERO))) {
 			free(idleticks, M_DEVBUF,
 			    sizeof(*idleticks) * ncpusfound);
diff --git a/sys/kern/subr_log.c b/sys/kern/subr_log.c
index 6603f7d24a2..ec1e2ebb850 100644
--- a/sys/kern/subr_log.c
+++ b/sys/kern/subr_log.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: subr_log.c,v 1.24 2014/12/10 02:44:47 tedu Exp $	*/
+/*	$OpenBSD: subr_log.c,v 1.25 2014/12/13 21:05:33 doug Exp $	*/
 /*	$NetBSD: subr_log.c,v 1.11 1996/03/30 22:24:44 christos Exp $	*/
 
 /*
@@ -369,9 +369,10 @@ sys_sendsyslog(struct proc *p, void *v, register_t *retval)
 	auio.uio_resid = aiov.iov_len;
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_GENIO)) {
+		ktriov = mallocarray(auio.uio_iovcnt, sizeof(struct iovec),
+		    M_TEMP, M_WAITOK);
 		iovlen = auio.uio_iovcnt * sizeof (struct iovec);
 
-		ktriov = malloc(iovlen, M_TEMP, M_WAITOK);
 		memcpy(ktriov, auio.uio_iov, iovlen);
 	}
 #endif
diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
index 03824de6000..2d382e3e4a1 100644
--- a/sys/kern/uipc_syscalls.c
+++ b/sys/kern/uipc_syscalls.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_syscalls.c,v 1.96 2014/12/11 19:21:57 tedu Exp $	*/
+/*	$OpenBSD: uipc_syscalls.c,v 1.97 2014/12/13 21:05:33 doug Exp $	*/
 /*	$NetBSD: uipc_syscalls.c,v 1.19 1996/02/09 19:00:48 christos Exp $	*/
 
 /*
@@ -562,9 +562,10 @@ sendit(struct proc *p, int s, struct msghdr *mp, int flags, register_t *retsize)
 		control = 0;
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_GENIO)) {
+		ktriov = mallocarray(auio.uio_iovcnt, sizeof(struct iovec),
+		    M_TEMP, M_WAITOK);
 		iovlen = auio.uio_iovcnt * sizeof (struct iovec);
 
-		ktriov = malloc(iovlen, M_TEMP, M_WAITOK);
 		memcpy(ktriov, auio.uio_iov, iovlen);
 	}
 #endif
@@ -706,9 +707,10 @@ recvit(struct proc *p, int s, struct msghdr *mp, caddr_t namelenp,
 	}
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_GENIO)) {
+		ktriov = mallocarray(auio.uio_iovcnt, sizeof(struct iovec),
+		    M_TEMP, M_WAITOK);
 		iovlen = auio.uio_iovcnt * sizeof (struct iovec);
 
-		ktriov = malloc(iovlen, M_TEMP, M_WAITOK);
 		memcpy(ktriov, auio.uio_iov, iovlen);
 	}
 #endif
diff --git a/sys/net/if_enc.c b/sys/net/if_enc.c
index cd38b1e0160..aaf82b2b351 100644
--- a/sys/net/if_enc.c
+++ b/sys/net/if_enc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_enc.c,v 1.58 2014/12/08 10:46:14 mpi Exp $	*/
+/*	$OpenBSD: if_enc.c,v 1.59 2014/12/13 21:05:33 doug Exp $	*/
 
 /*
  * Copyright (c) 2010 Reyk Floeter <reyk@vantronix.net>
@@ -119,10 +119,11 @@ enc_clone_create(struct if_clone *ifc, int unit)
 	}
 
 	if (unit == 0 || unit > enc_max_unit) {
+		if ((new = mallocarray(unit + 1, sizeof(struct ifnet *),
+		    M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL)
+			return (ENOBUFS);
 		newlen = sizeof(struct ifnet *) * (unit + 1);
 
-		if ((new = malloc(newlen, M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL)
-			return (ENOBUFS);
 		if (enc_allifps != NULL) {
 			memcpy(new, enc_allifps,
 			    sizeof(struct ifnet *) * (enc_max_unit + 1));
@@ -264,10 +265,11 @@ enc_setif(struct ifnet *ifp, u_int id)
 		return (EINVAL);
 
 	if (id == 0 || id > enc_max_id) {
+		if ((new = mallocarray(id + 1, sizeof(struct ifnet *),
+		    M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL)
+			return (ENOBUFS);
 		newlen = sizeof(struct ifnet *) * (id + 1);
 
-		if ((new = malloc(newlen, M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL)
-			return (ENOBUFS);
 		if (enc_ifps != NULL) {
 			memcpy(new, enc_ifps,
 			    sizeof(struct ifnet *) * (enc_max_id + 1));
diff --git a/sys/net/if_ppp.c b/sys/net/if_ppp.c
index 6f67445802d..ce8471271f9 100644
--- a/sys/net/if_ppp.c
+++ b/sys/net/if_ppp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ppp.c,v 1.78 2014/12/05 15:50:04 mpi Exp $	*/
+/*	$OpenBSD: if_ppp.c,v 1.79 2014/12/13 21:05:33 doug Exp $	*/
 /*	$NetBSD: if_ppp.c,v 1.39 1997/05/17 21:11:59 christos Exp $	*/
 
 /*
@@ -562,8 +562,9 @@ pppioctl(struct ppp_softc *sc, u_long cmd, caddr_t data, int flag,
 	if ((unsigned) nbp->bf_len > BPF_MAXINSNS)
 	    return EINVAL;
 	newcodelen = nbp->bf_len * sizeof(struct bpf_insn);
-	if (newcodelen != 0) {
-	    newcode = malloc(newcodelen, M_DEVBUF, M_WAITOK);
+	if (nbp->bf_len != 0) {
+	    newcode = mallocarray(nbp->bf_len, sizeof(struct bpf_insn),
+		M_DEVBUF, M_WAITOK);
 	    if ((error = copyin((caddr_t)nbp->bf_insns, (caddr_t)newcode,
 			       newcodelen)) != 0) {
 		free(newcode, M_DEVBUF, 0);
-- 
2.20.1