507 static struct sem_array *sem_alloc(size_t nsems)  in sem_alloc()  argument
511 	if (nsems > (INT_MAX - sizeof(*sma)) / sizeof(sma->sems[0]))  in sem_alloc()
514 	sma = kvzalloc(struct_size(sma, sems, nsems), GFP_KERNEL);  in sem_alloc()
533 	int nsems = params->u.nsems;  in newary()  local
537 	if (!nsems)  in newary()
539 	if (ns->used_sems + nsems > ns->sc_semmns)  in newary()
542 	sma = sem_alloc(nsems);  in newary()
556 	for (i = 0; i < nsems; i++) {  in newary()
567 	sma->sem_nsems = nsems;  in newary()
576 	ns->used_sems += nsems;  in newary()
593 	if (params->u.nsems > sma->sem_nsems)  in sem_more_checks()
599 long ksys_semget(key_t key, int nsems, int semflg)  in ksys_semget()  argument
611 	if (nsems < 0 || nsems > ns->sc_semmsl)  in ksys_semget()
616 	sem_params.u.nsems = nsems;  in ksys_semget()
621 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)  in SYSCALL_DEFINE3()  argument
623 	return ksys_semget(key, nsems, semflg);  in SYSCALL_DEFINE3()
1406 	int err, nsems;  in semctl_main()  local
1418 	nsems = sma->sem_nsems;  in semctl_main()
1440 		if (nsems > SEMMSL_FAST) {  in semctl_main()
1447 			sem_io = kvmalloc_array(nsems, sizeof(ushort),  in semctl_main()
1466 		if (copy_to_user(array, sem_io, nsems*sizeof(ushort)))  in semctl_main()
1481 		if (nsems > SEMMSL_FAST) {  in semctl_main()
1482 			sem_io = kvmalloc_array(nsems, sizeof(ushort),  in semctl_main()
1490 		if (copy_from_user(sem_io, p, nsems*sizeof(ushort))) {  in semctl_main()
1496 		for (i = 0; i < nsems; i++) {  in semctl_main()
1510 		for (i = 0; i < nsems; i++) {  in semctl_main()
1517 			for (i = 0; i < nsems; i++)  in semctl_main()
1529 	if (semnum < 0 || semnum >= nsems)  in semctl_main()
1538 	semnum = array_index_nospec(semnum, nsems);  in semctl_main()
1908 	int nsems, error;  in find_alloc_undo()  local
1929 	nsems = sma->sem_nsems;  in find_alloc_undo()
1938 	new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);  in find_alloc_undo()