873 	u32 snap_count;  in rbd_dev_ondisk_valid()  local
893 	snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_dev_ondisk_valid()
895 	if (snap_count > size / sizeof (__le64))  in rbd_dev_ondisk_valid()
902 	size -= snap_count * sizeof (__le64);  in rbd_dev_ondisk_valid()
922 	u32 snap_count;  in rbd_header_from_disk()  local
943 	snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_header_from_disk()
944 	snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);  in rbd_header_from_disk()
948 	if (snap_count) {  in rbd_header_from_disk()
962 		size = snap_count * sizeof (*header->snap_sizes);  in rbd_header_from_disk()
976 		memcpy(snap_names, &ondisk->snaps[snap_count], snap_names_len);  in rbd_header_from_disk()
978 		for (i = 0; i < snap_count; i++) {  in rbd_header_from_disk()
3573 	u32 snap_count = 0;  in rbd_dev_v1_header_info()  local
3591 		size += snap_count * sizeof (struct rbd_image_snap_ondisk);  in rbd_dev_v1_header_info()
3614 		want_count = snap_count;  in rbd_dev_v1_header_info()
3615 		snap_count = le32_to_cpu(ondisk->snap_count);  in rbd_dev_v1_header_info()
3616 	} while (snap_count != want_count);  in rbd_dev_v1_header_info()
4593 	u32 snap_count;  in rbd_dev_v2_snap_context()  local
4620 	ceph_decode_32_safe(&p, end, snap_count, out);  in rbd_dev_v2_snap_context()
4628 	if (snap_count > (SIZE_MAX - sizeof (struct ceph_snap_context))  in rbd_dev_v2_snap_context()
4633 	if (!ceph_has_room(&p, end, snap_count * sizeof (__le64)))  in rbd_dev_v2_snap_context()
4637 	snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);  in rbd_dev_v2_snap_context()
4643 	for (i = 0; i < snap_count; i++)  in rbd_dev_v2_snap_context()
4650 		(unsigned long long)seq, (unsigned int)snap_count);  in rbd_dev_v2_snap_context()