488 static struct sem_array *sem_alloc(size_t nsems)  in sem_alloc()  argument
493 	if (nsems > (INT_MAX - sizeof(*sma)) / sizeof(sma->sems[0]))  in sem_alloc()
496 	size = sizeof(*sma) + nsems * sizeof(sma->sems[0]);  in sem_alloc()
518 	int nsems = params->u.nsems;  in newary()  local
522 	if (!nsems)  in newary()
524 	if (ns->used_sems + nsems > ns->sc_semmns)  in newary()
527 	sma = sem_alloc(nsems);  in newary()
541 	for (i = 0; i < nsems; i++) {  in newary()
552 	sma->sem_nsems = nsems;  in newary()
561 	ns->used_sems += nsems;  in newary()
579 	if (params->u.nsems > sma->sem_nsems)  in sem_more_checks()
585 long ksys_semget(key_t key, int nsems, int semflg)  in ksys_semget()  argument
597 	if (nsems < 0 || nsems > ns->sc_semmsl)  in ksys_semget()
602 	sem_params.u.nsems = nsems;  in ksys_semget()
607 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)  in SYSCALL_DEFINE3()  argument
609 	return ksys_semget(key, nsems, semflg);  in SYSCALL_DEFINE3()
1395 	int err, nsems;  in semctl_main()  local
1407 	nsems = sma->sem_nsems;  in semctl_main()
1429 		if (nsems > SEMMSL_FAST) {  in semctl_main()
1436 			sem_io = kvmalloc_array(nsems, sizeof(ushort),  in semctl_main()
1455 		if (copy_to_user(array, sem_io, nsems*sizeof(ushort)))  in semctl_main()
1470 		if (nsems > SEMMSL_FAST) {  in semctl_main()
1471 			sem_io = kvmalloc_array(nsems, sizeof(ushort),  in semctl_main()
1479 		if (copy_from_user(sem_io, p, nsems*sizeof(ushort))) {  in semctl_main()
1485 		for (i = 0; i < nsems; i++) {  in semctl_main()
1499 		for (i = 0; i < nsems; i++) {  in semctl_main()
1506 			for (i = 0; i < nsems; i++)  in semctl_main()
1518 	if (semnum < 0 || semnum >= nsems)  in semctl_main()
1527 	semnum = array_index_nospec(semnum, nsems);  in semctl_main()
1870 	int nsems, error;  in find_alloc_undo()  local
1891 	nsems = sma->sem_nsems;  in find_alloc_undo()
1900 	new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);  in find_alloc_undo()