937 	u32 snap_count;  in rbd_dev_ondisk_valid()  local
957 	snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_dev_ondisk_valid()
959 	if (snap_count > size / sizeof (__le64))  in rbd_dev_ondisk_valid()
966 	size -= snap_count * sizeof (__le64);  in rbd_dev_ondisk_valid()
1019 	u32 snap_count;  in rbd_header_from_disk()  local
1035 	snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_header_from_disk()
1036 	snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);  in rbd_header_from_disk()
1040 	if (snap_count) {  in rbd_header_from_disk()
1053 		snap_sizes = kmalloc_array(snap_count,  in rbd_header_from_disk()
1068 		memcpy(snap_names, &ondisk->snaps[snap_count], snap_names_len);  in rbd_header_from_disk()
1070 		for (i = 0; i < snap_count; i++) {  in rbd_header_from_disk()
4885 	u32 snap_count = 0;  in rbd_dev_v1_header_info()  local
4903 		size += snap_count * sizeof (struct rbd_image_snap_ondisk);  in rbd_dev_v1_header_info()
4926 		want_count = snap_count;  in rbd_dev_v1_header_info()
4927 		snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_dev_v1_header_info()
4928 	} while (snap_count != want_count);  in rbd_dev_v1_header_info()
6066 	u32 snap_count;  in rbd_dev_v2_snap_context()  local
6093 	ceph_decode_32_safe(&p, end, snap_count, out);  in rbd_dev_v2_snap_context()
6101 	if (snap_count > (SIZE_MAX - sizeof (struct ceph_snap_context))  in rbd_dev_v2_snap_context()
6106 	if (!ceph_has_room(&p, end, snap_count * sizeof (__le64)))  in rbd_dev_v2_snap_context()
6110 	snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);  in rbd_dev_v2_snap_context()
6116 	for (i = 0; i < snap_count; i++)  in rbd_dev_v2_snap_context()
6121 		(unsigned long long)seq, (unsigned int)snap_count);  in rbd_dev_v2_snap_context()