871 	u32 snap_count;  in rbd_dev_ondisk_valid()  local
891 	snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_dev_ondisk_valid()
893 	if (snap_count > size / sizeof (__le64))  in rbd_dev_ondisk_valid()
900 	size -= snap_count * sizeof (__le64);  in rbd_dev_ondisk_valid()
920 	u32 snap_count;  in rbd_header_from_disk()  local
941 	snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_header_from_disk()
942 	snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);  in rbd_header_from_disk()
946 	if (snap_count) {  in rbd_header_from_disk()
960 		size = snap_count * sizeof (*header->snap_sizes);  in rbd_header_from_disk()
974 		memcpy(snap_names, &ondisk->snaps[snap_count], snap_names_len);  in rbd_header_from_disk()
976 		for (i = 0; i < snap_count; i++) {  in rbd_header_from_disk()
3594 	u32 snap_count = 0;  in rbd_dev_v1_header_info()  local
3612 		size += snap_count * sizeof (struct rbd_image_snap_ondisk);  in rbd_dev_v1_header_info()
3635 		want_count = snap_count;  in rbd_dev_v1_header_info()
3636 		snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_dev_v1_header_info()
3637 	} while (snap_count != want_count);  in rbd_dev_v1_header_info()
4583 	u32 snap_count;  in rbd_dev_v2_snap_context()  local
4610 	ceph_decode_32_safe(&p, end, snap_count, out);  in rbd_dev_v2_snap_context()
4618 	if (snap_count > (SIZE_MAX - sizeof (struct ceph_snap_context))  in rbd_dev_v2_snap_context()
4623 	if (!ceph_has_room(&p, end, snap_count * sizeof (__le64)))  in rbd_dev_v2_snap_context()
4627 	snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);  in rbd_dev_v2_snap_context()
4633 	for (i = 0; i < snap_count; i++)  in rbd_dev_v2_snap_context()
4640 		(unsigned long long)seq, (unsigned int)snap_count);  in rbd_dev_v2_snap_context()