510 static struct sem_array *sem_alloc(size_t nsems)  in sem_alloc()  argument
514 	if (nsems > (INT_MAX - sizeof(*sma)) / sizeof(sma->sems[0]))  in sem_alloc()
517 	sma = kvzalloc(struct_size(sma, sems, nsems), GFP_KERNEL_ACCOUNT);  in sem_alloc()
536 	int nsems = params->u.nsems;  in newary()  local
540 	if (!nsems)  in newary()
542 	if (ns->used_sems + nsems > ns->sc_semmns)  in newary()
545 	sma = sem_alloc(nsems);  in newary()
559 	for (i = 0; i < nsems; i++) {  in newary()
570 	sma->sem_nsems = nsems;  in newary()
579 	ns->used_sems += nsems;  in newary()
596 	if (params->u.nsems > sma->sem_nsems)  in sem_more_checks()
602 long ksys_semget(key_t key, int nsems, int semflg)  in ksys_semget()  argument
614 	if (nsems < 0 || nsems > ns->sc_semmsl)  in ksys_semget()
619 	sem_params.u.nsems = nsems;  in ksys_semget()
624 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)  in SYSCALL_DEFINE3()  argument
626 	return ksys_semget(key, nsems, semflg);  in SYSCALL_DEFINE3()
1410 	int err, nsems;  in semctl_main()  local
1422 	nsems = sma->sem_nsems;  in semctl_main()
1443 		if (nsems > SEMMSL_FAST) {  in semctl_main()
1450 			sem_io = kvmalloc_array(nsems, sizeof(ushort),  in semctl_main()
1469 		if (copy_to_user(array, sem_io, nsems*sizeof(ushort)))  in semctl_main()
1484 		if (nsems > SEMMSL_FAST) {  in semctl_main()
1485 			sem_io = kvmalloc_array(nsems, sizeof(ushort),  in semctl_main()
1493 		if (copy_from_user(sem_io, p, nsems*sizeof(ushort))) {  in semctl_main()
1499 		for (i = 0; i < nsems; i++) {  in semctl_main()
1513 		for (i = 0; i < nsems; i++) {  in semctl_main()
1520 			for (i = 0; i < nsems; i++)  in semctl_main()
1532 	if (semnum < 0 || semnum >= nsems)  in semctl_main()
1541 	semnum = array_index_nospec(semnum, nsems);  in semctl_main()
1911 	int nsems, error;  in find_alloc_undo()  local
1932 	nsems = sma->sem_nsems;  in find_alloc_undo()
1941 	new = kvzalloc(struct_size(new, semadj, nsems), GFP_KERNEL_ACCOUNT);  in find_alloc_undo()