952 	u32 snap_count;  in rbd_dev_ondisk_valid()  local
972 	snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_dev_ondisk_valid()
974 	if (snap_count > size / sizeof (__le64))  in rbd_dev_ondisk_valid()
981 	size -= snap_count * sizeof (__le64);  in rbd_dev_ondisk_valid()
1025 	u32 snap_count;  in rbd_header_from_disk()  local
1041 	snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_header_from_disk()
1042 	snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);  in rbd_header_from_disk()
1046 	if (snap_count) {  in rbd_header_from_disk()
1059 		snap_sizes = kmalloc_array(snap_count,  in rbd_header_from_disk()
1074 		memcpy(snap_names, &ondisk->snaps[snap_count], snap_names_len);  in rbd_header_from_disk()
1076 		for (i = 0; i < snap_count; i++) {  in rbd_header_from_disk()
3819 	u32 snap_count = 0;  in rbd_dev_v1_header_info()  local
3837 		size += snap_count * sizeof (struct rbd_image_snap_ondisk);  in rbd_dev_v1_header_info()
3860 		want_count = snap_count;  in rbd_dev_v1_header_info()
3861 		snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_dev_v1_header_info()
3862 	} while (snap_count != want_count);  in rbd_dev_v1_header_info()
5076 	u32 snap_count;  in rbd_dev_v2_snap_context()  local
5103 	ceph_decode_32_safe(&p, end, snap_count, out);  in rbd_dev_v2_snap_context()
5111 	if (snap_count > (SIZE_MAX - sizeof (struct ceph_snap_context))  in rbd_dev_v2_snap_context()
5116 	if (!ceph_has_room(&p, end, snap_count * sizeof (__le64)))  in rbd_dev_v2_snap_context()
5120 	snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);  in rbd_dev_v2_snap_context()
5126 	for (i = 0; i < snap_count; i++)  in rbd_dev_v2_snap_context()
5133 		(unsigned long long)seq, (unsigned int)snap_count);  in rbd_dev_v2_snap_context()