990 	u32 snap_count;  in rbd_dev_ondisk_valid()  local
1010 	snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_dev_ondisk_valid()
1012 	if (snap_count > size / sizeof (__le64))  in rbd_dev_ondisk_valid()
1019 	size -= snap_count * sizeof (__le64);  in rbd_dev_ondisk_valid()
1063 	u32 snap_count;  in rbd_header_from_disk()  local
1079 	snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_header_from_disk()
1080 	snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);  in rbd_header_from_disk()
1084 	if (snap_count) {  in rbd_header_from_disk()
1097 		snap_sizes = kmalloc_array(snap_count,  in rbd_header_from_disk()
1112 		memcpy(snap_names, &ondisk->snaps[snap_count], snap_names_len);  in rbd_header_from_disk()
1114 		for (i = 0; i < snap_count; i++) {  in rbd_header_from_disk()
4858 	u32 snap_count = 0;  in rbd_dev_v1_header_info()  local
4876 		size += snap_count * sizeof (struct rbd_image_snap_ondisk);  in rbd_dev_v1_header_info()
4899 		want_count = snap_count;  in rbd_dev_v1_header_info()
4900 		snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_dev_v1_header_info()
4901 	} while (snap_count != want_count);  in rbd_dev_v1_header_info()
6125 	u32 snap_count;  in rbd_dev_v2_snap_context()  local
6152 	ceph_decode_32_safe(&p, end, snap_count, out);  in rbd_dev_v2_snap_context()
6160 	if (snap_count > (SIZE_MAX - sizeof (struct ceph_snap_context))  in rbd_dev_v2_snap_context()
6165 	if (!ceph_has_room(&p, end, snap_count * sizeof (__le64)))  in rbd_dev_v2_snap_context()
6169 	snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);  in rbd_dev_v2_snap_context()
6175 	for (i = 0; i < snap_count; i++)  in rbd_dev_v2_snap_context()
6182 		(unsigned long long)seq, (unsigned int)snap_count);  in rbd_dev_v2_snap_context()