157 files changed, 1798 insertions, 1768 deletions

diff --git a/net/9p/client.c b/net/9p/client.c
index 34d417670935..8eb75425e6e6 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -1100,7 +1100,7 @@ void p9_client_begin_disconnect(struct p9_client *clnt)
 EXPORT_SYMBOL(p9_client_begin_disconnect);
 
 struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
-        char *uname, u32 n_uname, char *aname)
+        char *uname, kuid_t n_uname, char *aname)
 {
         int err = 0;
         struct p9_req_t *req;
@@ -1117,7 +1117,7 @@ struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
                 goto error;
         }
 
-        req = p9_client_rpc(clnt, P9_TATTACH, "ddss?d", fid->fid,
+        req = p9_client_rpc(clnt, P9_TATTACH, "ddss?u", fid->fid,
                         afid ? afid->fid : P9_NOFID, uname, aname, n_uname);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
@@ -1270,7 +1270,7 @@ error:
 EXPORT_SYMBOL(p9_client_open);
 
 int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
-                gid_t gid, struct p9_qid *qid)
+                kgid_t gid, struct p9_qid *qid)
 {
         int err = 0;
         struct p9_client *clnt;
@@ -1279,13 +1279,14 @@ int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
 
         p9_debug(P9_DEBUG_9P,
                         ">>> TLCREATE fid %d name %s flags %d mode %d gid %d\n",
-                        ofid->fid, name, flags, mode, gid);
+                        ofid->fid, name, flags, mode,
+                        from_kgid(&init_user_ns, gid));
         clnt = ofid->clnt;
 
         if (ofid->mode != -1)
                 return -EINVAL;
 
-        req = p9_client_rpc(clnt, P9_TLCREATE, "dsddd", ofid->fid, name, flags,
+        req = p9_client_rpc(clnt, P9_TLCREATE, "dsddg", ofid->fid, name, flags,
                         mode, gid);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
@@ -1358,7 +1359,7 @@ error:
 }
 EXPORT_SYMBOL(p9_client_fcreate);
 
-int p9_client_symlink(struct p9_fid *dfid, char *name, char *symtgt, gid_t gid,
+int p9_client_symlink(struct p9_fid *dfid, char *name, char *symtgt, kgid_t gid,
                 struct p9_qid *qid)
 {
         int err = 0;
@@ -1369,7 +1370,7 @@ int p9_client_symlink(struct p9_fid *dfid, char *name, char *symtgt, gid_t gid,
                         dfid->fid, name, symtgt);
         clnt = dfid->clnt;
 
-        req = p9_client_rpc(clnt, P9_TSYMLINK, "dssd", dfid->fid, name, symtgt,
+        req = p9_client_rpc(clnt, P9_TSYMLINK, "dssg", dfid->fid, name, symtgt,
                         gid);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
@@ -1710,7 +1711,9 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
                 (unsigned long long)ret->qid.path, ret->qid.version, ret->mode,
                 ret->atime, ret->mtime, (unsigned long long)ret->length,
                 ret->name, ret->uid, ret->gid, ret->muid, ret->extension,
-                ret->n_uid, ret->n_gid, ret->n_muid);
+                from_kuid(&init_user_ns, ret->n_uid),
+                from_kgid(&init_user_ns, ret->n_gid),
+                from_kuid(&init_user_ns, ret->n_muid));
 
         p9_free_req(clnt, req);
         return ret;
@@ -1764,8 +1767,10 @@ struct p9_stat_dotl *p9_client_getattr_dotl(struct p9_fid *fid,
                 "<<< st_btime_sec=%lld st_btime_nsec=%lld\n"
                 "<<< st_gen=%lld st_data_version=%lld",
                 ret->st_result_mask, ret->qid.type, ret->qid.path,
-                ret->qid.version, ret->st_mode, ret->st_nlink, ret->st_uid,
-                ret->st_gid, ret->st_rdev, ret->st_size, ret->st_blksize,
+                ret->qid.version, ret->st_mode, ret->st_nlink,
+                from_kuid(&init_user_ns, ret->st_uid),
+                from_kgid(&init_user_ns, ret->st_gid),
+                ret->st_rdev, ret->st_size, ret->st_blksize,
                 ret->st_blocks, ret->st_atime_sec, ret->st_atime_nsec,
                 ret->st_mtime_sec, ret->st_mtime_nsec, ret->st_ctime_sec,
                 ret->st_ctime_nsec, ret->st_btime_sec, ret->st_btime_nsec,
@@ -1828,7 +1833,9 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
                 (unsigned long long)wst->qid.path, wst->qid.version, wst->mode,
                 wst->atime, wst->mtime, (unsigned long long)wst->length,
                 wst->name, wst->uid, wst->gid, wst->muid, wst->extension,
-                wst->n_uid, wst->n_gid, wst->n_muid);
+                from_kuid(&init_user_ns, wst->n_uid),
+                from_kgid(&init_user_ns, wst->n_gid),
+                from_kuid(&init_user_ns, wst->n_muid));
 
         req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size+2, wst);
         if (IS_ERR(req)) {
@@ -1857,7 +1864,9 @@ int p9_client_setattr(struct p9_fid *fid, struct p9_iattr_dotl *p9attr)
                 "    valid=%x mode=%x uid=%d gid=%d size=%lld\n"
                 "    atime_sec=%lld atime_nsec=%lld\n"
                 "    mtime_sec=%lld mtime_nsec=%lld\n",
-                p9attr->valid, p9attr->mode, p9attr->uid, p9attr->gid,
+                p9attr->valid, p9attr->mode,
+                from_kuid(&init_user_ns, p9attr->uid),
+                from_kgid(&init_user_ns, p9attr->gid),
                 p9attr->size, p9attr->atime_sec, p9attr->atime_nsec,
                 p9attr->mtime_sec, p9attr->mtime_nsec);
 
@@ -2106,7 +2115,7 @@ error:
 EXPORT_SYMBOL(p9_client_readdir);
 
 int p9_client_mknod_dotl(struct p9_fid *fid, char *name, int mode,
-                        dev_t rdev, gid_t gid, struct p9_qid *qid)
+                        dev_t rdev, kgid_t gid, struct p9_qid *qid)
 {
         int err;
         struct p9_client *clnt;
@@ -2116,7 +2125,7 @@ int p9_client_mknod_dotl(struct p9_fid *fid, char *name, int mode,
         clnt = fid->clnt;
         p9_debug(P9_DEBUG_9P, ">>> TMKNOD fid %d name %s mode %d major %d "
                 "minor %d\n", fid->fid, name, mode, MAJOR(rdev), MINOR(rdev));
-        req = p9_client_rpc(clnt, P9_TMKNOD, "dsdddd", fid->fid, name, mode,
+        req = p9_client_rpc(clnt, P9_TMKNOD, "dsdddg", fid->fid, name, mode,
                 MAJOR(rdev), MINOR(rdev), gid);
         if (IS_ERR(req))
                 return PTR_ERR(req);
@@ -2137,7 +2146,7 @@ error:
 EXPORT_SYMBOL(p9_client_mknod_dotl);
 
 int p9_client_mkdir_dotl(struct p9_fid *fid, char *name, int mode,
-                                gid_t gid, struct p9_qid *qid)
+                                kgid_t gid, struct p9_qid *qid)
 {
         int err;
         struct p9_client *clnt;
@@ -2146,8 +2155,8 @@ int p9_client_mkdir_dotl(struct p9_fid *fid, char *name, int mode,
         err = 0;
         clnt = fid->clnt;
         p9_debug(P9_DEBUG_9P, ">>> TMKDIR fid %d name %s mode %d gid %d\n",
-                 fid->fid, name, mode, gid);
-        req = p9_client_rpc(clnt, P9_TMKDIR, "dsdd", fid->fid, name, mode,
+                 fid->fid, name, mode, from_kgid(&init_user_ns, gid));
+        req = p9_client_rpc(clnt, P9_TMKDIR, "dsdg", fid->fid, name, mode,
                 gid);
         if (IS_ERR(req))
                 return PTR_ERR(req);
diff --git a/net/9p/error.c b/net/9p/error.c
index 2ab2de76010f..126fd0dceea2 100644
--- a/net/9p/error.c
+++ b/net/9p/error.c
@@ -221,15 +221,13 @@ EXPORT_SYMBOL(p9_error_init);
 int p9_errstr2errno(char *errstr, int len)
 {
         int errno;
-        struct hlist_node *p;
         struct errormap *c;
         int bucket;
 
         errno = 0;
-        p = NULL;
         c = NULL;
         bucket = jhash(errstr, len, 0) % ERRHASHSZ;
-        hlist_for_each_entry(c, p, &hash_errmap[bucket], list) {
+        hlist_for_each_entry(c, &hash_errmap[bucket], list) {
                 if (c->namelen == len && !memcmp(c->name, errstr, len)) {
                         errno = c->val;
                         break;
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 3d33ecf13327..ab9127ec5b7a 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -85,6 +85,8 @@ pdu_write_u(struct p9_fcall *pdu, const char __user *udata, size_t size)
         d - int32_t
         q - int64_t
         s - string
+        u - numeric uid
+        g - numeric gid
         S - stat
         Q - qid
         D - data blob (int32_t size followed by void *, results are not freed)
@@ -163,6 +165,26 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                         (*sptr)[len] = 0;
                         }
                         break;
+                case 'u': {
+                                kuid_t *uid = va_arg(ap, kuid_t *);
+                                __le32 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
+                                        errcode = -EFAULT;
+                                        break;
+                                }
+                                *uid = make_kuid(&init_user_ns,
+                                                 le32_to_cpu(le_val));
+                        } break;
+                case 'g': {
+                                kgid_t *gid = va_arg(ap, kgid_t *);
+                                __le32 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
+                                        errcode = -EFAULT;
+                                        break;
+                                }
+                                *gid = make_kgid(&init_user_ns,
+                                                 le32_to_cpu(le_val));
+                        } break;
                 case 'Q':{
                                 struct p9_qid *qid =
                                     va_arg(ap, struct p9_qid *);
@@ -177,11 +199,12 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                     va_arg(ap, struct p9_wstat *);
 
                                 memset(stbuf, 0, sizeof(struct p9_wstat));
-                                stbuf->n_uid = stbuf->n_gid = stbuf->n_muid =
-                                                                        -1;
+                                stbuf->n_uid = stbuf->n_muid = INVALID_UID;
+                                stbuf->n_gid = INVALID_GID;
+
                                 errcode =
                                     p9pdu_readf(pdu, proto_version,
-                                                "wwdQdddqssss?sddd",
+                                                "wwdQdddqssss?sugu",
                                                 &stbuf->size, &stbuf->type,
                                                 &stbuf->dev, &stbuf->qid,
                                                 &stbuf->mode, &stbuf->atime,
@@ -294,7 +317,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                 memset(stbuf, 0, sizeof(struct p9_stat_dotl));
                                 errcode =
                                     p9pdu_readf(pdu, proto_version,
-                                        "qQdddqqqqqqqqqqqqqqq",
+                                        "qQdugqqqqqqqqqqqqqqq",
                                         &stbuf->st_result_mask,
                                         &stbuf->qid,
                                         &stbuf->st_mode,
@@ -377,6 +400,20 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                         errcode = -EFAULT;
                         }
                         break;
+                case 'u': {
+                                kuid_t uid = va_arg(ap, kuid_t);
+                                __le32 val = cpu_to_le32(
+                                                from_kuid(&init_user_ns, uid));
+                                if (pdu_write(pdu, &val, sizeof(val)))
+                                        errcode = -EFAULT;
+                        } break;
+                case 'g': {
+                                kgid_t gid = va_arg(ap, kgid_t);
+                                __le32 val = cpu_to_le32(
+                                                from_kgid(&init_user_ns, gid));
+                                if (pdu_write(pdu, &val, sizeof(val)))
+                                        errcode = -EFAULT;
+                        } break;
                 case 'Q':{
                                 const struct p9_qid *qid =
                                     va_arg(ap, const struct p9_qid *);
@@ -390,7 +427,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                     va_arg(ap, const struct p9_wstat *);
                                 errcode =
                                     p9pdu_writef(pdu, proto_version,
-                                                 "wwdQdddqssss?sddd",
+                                                 "wwdQdddqssss?sugu",
                                                  stbuf->size, stbuf->type,
                                                  stbuf->dev, &stbuf->qid,
                                                  stbuf->mode, stbuf->atime,
@@ -468,7 +505,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                                         struct p9_iattr_dotl *);
 
                                 errcode = p9pdu_writef(pdu, proto_version,
-                                                        "ddddqqqqq",
+                                                        "ddugqqqqq",
                                                         p9attr->valid,
                                                         p9attr->mode,
                                                         p9attr->uid,
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index de2e950a0a7a..74dea377fe5b 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -655,7 +655,7 @@ static struct p9_trans_module p9_virtio_trans = {
         .create = p9_virtio_create,
         .close = p9_virtio_close,
         .request = p9_virtio_request,
-        .zc_request = p9_virtio_zc_request,
+        //.zc_request = p9_virtio_zc_request,
         .cancel = p9_virtio_cancel,
         /*
          * We leave one entry for input and one entry for response
diff --git a/net/9p/util.c b/net/9p/util.c
index 6ceeeb384de7..59f278e64f58 100644
--- a/net/9p/util.c
+++ b/net/9p/util.c
@@ -87,23 +87,18 @@ EXPORT_SYMBOL(p9_idpool_destroy);
 
 int p9_idpool_get(struct p9_idpool *p)
 {
-        int i = 0;
-        int error;
+        int i;
         unsigned long flags;
 
-retry:
-        if (idr_pre_get(&p->pool, GFP_NOFS) == 0)
-                return -1;
-
+        idr_preload(GFP_NOFS);
         spin_lock_irqsave(&p->lock, flags);
 
         /* no need to store exactly p, we just need something non-null */
-        error = idr_get_new(&p->pool, p, &i);
-        spin_unlock_irqrestore(&p->lock, flags);
+        i = idr_alloc(&p->pool, p, 0, 0, GFP_NOWAIT);
 
-        if (error == -EAGAIN)
-                goto retry;
-        else if (error)
+        spin_unlock_irqrestore(&p->lock, flags);
+        idr_preload_end();
+        if (i < 0)
                 return -1;
 
         p9_debug(P9_DEBUG_MUX, " id %d pool %p\n", i, p);
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 33475291c9c1..4a141e3cf076 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -93,10 +93,9 @@ static struct sock *atalk_search_socket(struct sockaddr_at *to,
                                         struct atalk_iface *atif)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         read_lock_bh(&atalk_sockets_lock);
-        sk_for_each(s, node, &atalk_sockets) {
+        sk_for_each(s, &atalk_sockets) {
                 struct atalk_sock *at = at_sk(s);
 
                 if (to->sat_port != at->src_port)
@@ -141,11 +140,10 @@ static struct sock *atalk_find_or_insert_socket(struct sock *sk,
                                                 struct sockaddr_at *sat)
 {
         struct sock *s;
-        struct hlist_node *node;
         struct atalk_sock *at;
 
         write_lock_bh(&atalk_sockets_lock);
-        sk_for_each(s, node, &atalk_sockets) {
+        sk_for_each(s, &atalk_sockets) {
                 at = at_sk(s);
 
                 if (at->src_net == sat->sat_addr.s_net &&
@@ -1084,9 +1082,8 @@ static int atalk_pick_and_bind_port(struct sock *sk, struct sockaddr_at *sat)
              sat->sat_port < ATPORT_LAST;
              sat->sat_port++) {
                 struct sock *s;
-                struct hlist_node *node;
 
-                sk_for_each(s, node, &atalk_sockets) {
+                sk_for_each(s, &atalk_sockets) {
                         struct atalk_sock *at = at_sk(s);
 
                         if (at->src_net == sat->sat_addr.s_net &&
diff --git a/net/atm/common.c b/net/atm/common.c
index 806fc0a40051..7b491006eaf4 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -270,11 +270,11 @@ void atm_dev_release_vccs(struct atm_dev *dev)
         write_lock_irq(&vcc_sklist_lock);
         for (i = 0; i < VCC_HTABLE_SIZE; i++) {
                 struct hlist_head *head = &vcc_hash[i];
-                struct hlist_node *node, *tmp;
+                struct hlist_node *tmp;
                 struct sock *s;
                 struct atm_vcc *vcc;
 
-                sk_for_each_safe(s, node, tmp, head) {
+                sk_for_each_safe(s, tmp, head) {
                         vcc = atm_sk(s);
                         if (vcc->dev == dev) {
                                 vcc_release_async(vcc, -EPIPE);
@@ -317,11 +317,10 @@ static int adjust_tp(struct atm_trafprm *tp, unsigned char aal)
 static int check_ci(const struct atm_vcc *vcc, short vpi, int vci)
 {
         struct hlist_head *head = &vcc_hash[vci & (VCC_HTABLE_SIZE - 1)];
-        struct hlist_node *node;
         struct sock *s;
         struct atm_vcc *walk;
 
-        sk_for_each(s, node, head) {
+        sk_for_each(s, head) {
                 walk = atm_sk(s);
                 if (walk->dev != vcc->dev)
                         continue;
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 2e3d942e77f1..f23916be18fb 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -842,7 +842,9 @@ static void *lec_tbl_walk(struct lec_state *state, struct hlist_head *tbl,
                 --*l;
         }
 
-        hlist_for_each_entry_from(tmp, e, next) {
+        tmp = container_of(e, struct lec_arp_table, next);
+
+        hlist_for_each_entry_from(tmp, next) {
                 if (--*l < 0)
                         break;
         }
@@ -1307,7 +1309,6 @@ lec_arp_add(struct lec_priv *priv, struct lec_arp_table *entry)
 static int
 lec_arp_remove(struct lec_priv *priv, struct lec_arp_table *to_remove)
 {
-        struct hlist_node *node;
         struct lec_arp_table *entry;
         int i, remove_vcc = 1;
 
@@ -1326,7 +1327,7 @@ lec_arp_remove(struct lec_priv *priv, struct lec_arp_table *to_remove)
                  * ESI_FLUSH_PENDING, ESI_FORWARD_DIRECT
                  */
                 for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                        hlist_for_each_entry(entry, node,
+                        hlist_for_each_entry(entry,
                                              &priv->lec_arp_tables[i], next) {
                                 if (memcmp(to_remove->atm_addr,
                                            entry->atm_addr, ATM_ESA_LEN) == 0) {
@@ -1364,14 +1365,13 @@ static const char *get_status_string(unsigned char st)
 
 static void dump_arp_table(struct lec_priv *priv)
 {
-        struct hlist_node *node;
         struct lec_arp_table *rulla;
         char buf[256];
         int i, j, offset;
 
         pr_info("Dump %p:\n", priv);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(rulla, node,
+                hlist_for_each_entry(rulla,
                                      &priv->lec_arp_tables[i], next) {
                         offset = 0;
                         offset += sprintf(buf, "%d: %p\n", i, rulla);
@@ -1403,7 +1403,7 @@ static void dump_arp_table(struct lec_priv *priv)
 
         if (!hlist_empty(&priv->lec_no_forward))
                 pr_info("No forward\n");
-        hlist_for_each_entry(rulla, node, &priv->lec_no_forward, next) {
+        hlist_for_each_entry(rulla, &priv->lec_no_forward, next) {
                 offset = 0;
                 offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
                 offset += sprintf(buf + offset, " Atm:");
@@ -1428,7 +1428,7 @@ static void dump_arp_table(struct lec_priv *priv)
 
         if (!hlist_empty(&priv->lec_arp_empty_ones))
                 pr_info("Empty ones\n");
-        hlist_for_each_entry(rulla, node, &priv->lec_arp_empty_ones, next) {
+        hlist_for_each_entry(rulla, &priv->lec_arp_empty_ones, next) {
                 offset = 0;
                 offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
                 offset += sprintf(buf + offset, " Atm:");
@@ -1453,7 +1453,7 @@ static void dump_arp_table(struct lec_priv *priv)
 
         if (!hlist_empty(&priv->mcast_fwds))
                 pr_info("Multicast Forward VCCs\n");
-        hlist_for_each_entry(rulla, node, &priv->mcast_fwds, next) {
+        hlist_for_each_entry(rulla, &priv->mcast_fwds, next) {
                 offset = 0;
                 offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
                 offset += sprintf(buf + offset, " Atm:");
@@ -1487,7 +1487,7 @@ static void dump_arp_table(struct lec_priv *priv)
 static void lec_arp_destroy(struct lec_priv *priv)
 {
         unsigned long flags;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry;
         int i;
 
@@ -1499,7 +1499,7 @@ static void lec_arp_destroy(struct lec_priv *priv)
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next,
+                hlist_for_each_entry_safe(entry, next,
                                           &priv->lec_arp_tables[i], next) {
                         lec_arp_remove(priv, entry);
                         lec_arp_put(entry);
@@ -1507,7 +1507,7 @@ static void lec_arp_destroy(struct lec_priv *priv)
                 INIT_HLIST_HEAD(&priv->lec_arp_tables[i]);
         }
 
-        hlist_for_each_entry_safe(entry, node, next,
+        hlist_for_each_entry_safe(entry, next,
                                   &priv->lec_arp_empty_ones, next) {
                 del_timer_sync(&entry->timer);
                 lec_arp_clear_vccs(entry);
@@ -1516,7 +1516,7 @@ static void lec_arp_destroy(struct lec_priv *priv)
         }
         INIT_HLIST_HEAD(&priv->lec_arp_empty_ones);
 
-        hlist_for_each_entry_safe(entry, node, next,
+        hlist_for_each_entry_safe(entry, next,
                                   &priv->lec_no_forward, next) {
                 del_timer_sync(&entry->timer);
                 lec_arp_clear_vccs(entry);
@@ -1525,7 +1525,7 @@ static void lec_arp_destroy(struct lec_priv *priv)
         }
         INIT_HLIST_HEAD(&priv->lec_no_forward);
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->mcast_fwds, next) {
+        hlist_for_each_entry_safe(entry, next, &priv->mcast_fwds, next) {
                 /* No timer, LANEv2 7.1.20 and 2.3.5.3 */
                 lec_arp_clear_vccs(entry);
                 hlist_del(&entry->next);
@@ -1542,14 +1542,13 @@ static void lec_arp_destroy(struct lec_priv *priv)
 static struct lec_arp_table *lec_arp_find(struct lec_priv *priv,
                                           const unsigned char *mac_addr)
 {
-        struct hlist_node *node;
         struct hlist_head *head;
         struct lec_arp_table *entry;
 
         pr_debug("%pM\n", mac_addr);
 
         head = &priv->lec_arp_tables[HASH(mac_addr[ETH_ALEN - 1])];
-        hlist_for_each_entry(entry, node, head, next) {
+        hlist_for_each_entry(entry, head, next) {
                 if (ether_addr_equal(mac_addr, entry->mac_addr))
                         return entry;
         }
@@ -1686,7 +1685,7 @@ static void lec_arp_check_expire(struct work_struct *work)
         unsigned long flags;
         struct lec_priv *priv =
                 container_of(work, struct lec_priv, lec_arp_work.work);
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry;
         unsigned long now;
         int i;
@@ -1696,7 +1695,7 @@ static void lec_arp_check_expire(struct work_struct *work)
 restart:
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next,
+                hlist_for_each_entry_safe(entry, next,
                                           &priv->lec_arp_tables[i], next) {
                         if (__lec_arp_check_expire(entry, now, priv)) {
                                 struct sk_buff *skb;
@@ -1823,14 +1822,14 @@ lec_addr_delete(struct lec_priv *priv, const unsigned char *atm_addr,
                 unsigned long permanent)
 {
         unsigned long flags;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry;
         int i;
 
         pr_debug("\n");
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next,
+                hlist_for_each_entry_safe(entry, next,
                                           &priv->lec_arp_tables[i], next) {
                         if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN) &&
                             (permanent ||
@@ -1855,7 +1854,7 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
                unsigned int targetless_le_arp)
 {
         unsigned long flags;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry, *tmp;
         int i;
 
@@ -1870,7 +1869,7 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
                                  * we have no entry in the cache. 7.1.30
                                  */
         if (!hlist_empty(&priv->lec_arp_empty_ones)) {
-                hlist_for_each_entry_safe(entry, node, next,
+                hlist_for_each_entry_safe(entry, next,
                                           &priv->lec_arp_empty_ones, next) {
                         if (memcmp(entry->atm_addr, atm_addr, ATM_ESA_LEN) == 0) {
                                 hlist_del(&entry->next);
@@ -1915,7 +1914,7 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
         memcpy(entry->atm_addr, atm_addr, ATM_ESA_LEN);
         del_timer(&entry->timer);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(tmp, node,
+                hlist_for_each_entry(tmp,
                                      &priv->lec_arp_tables[i], next) {
                         if (entry != tmp &&
                             !memcmp(tmp->atm_addr, atm_addr, ATM_ESA_LEN)) {
@@ -1956,7 +1955,6 @@ lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
               void (*old_push) (struct atm_vcc *vcc, struct sk_buff *skb))
 {
         unsigned long flags;
-        struct hlist_node *node;
         struct lec_arp_table *entry;
         int i, found_entry = 0;
 
@@ -2026,7 +2024,7 @@ lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
                  ioc_data->atm_addr[16], ioc_data->atm_addr[17],
                  ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(entry, node,
+                hlist_for_each_entry(entry,
                                      &priv->lec_arp_tables[i], next) {
                         if (memcmp
                             (ioc_data->atm_addr, entry->atm_addr,
@@ -2103,7 +2101,6 @@ out:
 static void lec_flush_complete(struct lec_priv *priv, unsigned long tran_id)
 {
         unsigned long flags;
-        struct hlist_node *node;
         struct lec_arp_table *entry;
         int i;
 
@@ -2111,7 +2108,7 @@ static void lec_flush_complete(struct lec_priv *priv, unsigned long tran_id)
 restart:
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(entry, node,
+                hlist_for_each_entry(entry,
                                      &priv->lec_arp_tables[i], next) {
                         if (entry->flush_tran_id == tran_id &&
                             entry->status == ESI_FLUSH_PENDING) {
@@ -2140,13 +2137,12 @@ lec_set_flush_tran_id(struct lec_priv *priv,
                       const unsigned char *atm_addr, unsigned long tran_id)
 {
         unsigned long flags;
-        struct hlist_node *node;
         struct lec_arp_table *entry;
         int i;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++)
-                hlist_for_each_entry(entry, node,
+                hlist_for_each_entry(entry,
                                      &priv->lec_arp_tables[i], next) {
                         if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN)) {
                                 entry->flush_tran_id = tran_id;
@@ -2198,7 +2194,7 @@ out:
 static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
 {
         unsigned long flags;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry;
         int i;
 
@@ -2208,7 +2204,7 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
 
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next,
+                hlist_for_each_entry_safe(entry, next,
                                           &priv->lec_arp_tables[i], next) {
                         if (vcc == entry->vcc) {
                                 lec_arp_remove(priv, entry);
@@ -2219,7 +2215,7 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
                 }
         }
 
-        hlist_for_each_entry_safe(entry, node, next,
+        hlist_for_each_entry_safe(entry, next,
                                   &priv->lec_arp_empty_ones, next) {
                 if (entry->vcc == vcc) {
                         lec_arp_clear_vccs(entry);
@@ -2229,7 +2225,7 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
                 }
         }
 
-        hlist_for_each_entry_safe(entry, node, next,
+        hlist_for_each_entry_safe(entry, next,
                                   &priv->lec_no_forward, next) {
                 if (entry->recv_vcc == vcc) {
                         lec_arp_clear_vccs(entry);
@@ -2239,7 +2235,7 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
                 }
         }
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->mcast_fwds, next) {
+        hlist_for_each_entry_safe(entry, next, &priv->mcast_fwds, next) {
                 if (entry->recv_vcc == vcc) {
                         lec_arp_clear_vccs(entry);
                         /* No timer, LANEv2 7.1.20 and 2.3.5.3 */
@@ -2257,13 +2253,13 @@ lec_arp_check_empties(struct lec_priv *priv,
                       struct atm_vcc *vcc, struct sk_buff *skb)
 {
         unsigned long flags;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry, *tmp;
         struct lecdatahdr_8023 *hdr = (struct lecdatahdr_8023 *)skb->data;
         unsigned char *src = hdr->h_source;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        hlist_for_each_entry_safe(entry, node, next,
+        hlist_for_each_entry_safe(entry, next,
                                   &priv->lec_arp_empty_ones, next) {
                 if (vcc == entry->vcc) {
                         del_timer(&entry->timer);
diff --git a/net/atm/proc.c b/net/atm/proc.c
index b4e75340b162..6ac35ff0d6b9 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -385,7 +385,7 @@ static ssize_t proc_dev_atm_read(struct file *file, char __user *buf,
         page = get_zeroed_page(GFP_KERNEL);
         if (!page)
                 return -ENOMEM;
-        dev = PDE(file->f_path.dentry->d_inode)->data;
+        dev = PDE(file_inode(file))->data;
         if (!dev->ops->proc_read)
                 length = -EINVAL;
         else {
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index 86767ca908a3..4176887e72eb 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -217,7 +217,6 @@ static void purge_vcc(struct atm_vcc *vcc)
 
 static void sigd_close(struct atm_vcc *vcc)
 {
-        struct hlist_node *node;
         struct sock *s;
         int i;
 
@@ -231,7 +230,7 @@ static void sigd_close(struct atm_vcc *vcc)
         for (i = 0; i < VCC_HTABLE_SIZE; ++i) {
                 struct hlist_head *head = &vcc_hash[i];
 
-                sk_for_each(s, node, head) {
+                sk_for_each(s, head) {
                         vcc = atm_sk(s);
 
                         purge_vcc(vcc);
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 69a06c47b648..7b11f8bc5071 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -81,14 +81,13 @@ static void ax25_kill_by_device(struct net_device *dev)
 {
         ax25_dev *ax25_dev;
         ax25_cb *s;
-        struct hlist_node *node;
 
         if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
                 return;
 
         spin_lock_bh(&ax25_list_lock);
 again:
-        ax25_for_each(s, node, &ax25_list) {
+        ax25_for_each(s, &ax25_list) {
                 if (s->ax25_dev == ax25_dev) {
                         s->ax25_dev = NULL;
                         spin_unlock_bh(&ax25_list_lock);
@@ -158,10 +157,9 @@ struct sock *ax25_find_listener(ax25_address *addr, int digi,
         struct net_device *dev, int type)
 {
         ax25_cb *s;
-        struct hlist_node *node;
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(s, node, &ax25_list) {
+        ax25_for_each(s, &ax25_list) {
                 if ((s->iamdigi && !digi) || (!s->iamdigi && digi))
                         continue;
                 if (s->sk && !ax25cmp(&s->source_addr, addr) &&
@@ -187,10 +185,9 @@ struct sock *ax25_get_socket(ax25_address *my_addr, ax25_address *dest_addr,
 {
         struct sock *sk = NULL;
         ax25_cb *s;
-        struct hlist_node *node;
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(s, node, &ax25_list) {
+        ax25_for_each(s, &ax25_list) {
                 if (s->sk && !ax25cmp(&s->source_addr, my_addr) &&
                     !ax25cmp(&s->dest_addr, dest_addr) &&
                     s->sk->sk_type == type) {
@@ -213,10 +210,9 @@ ax25_cb *ax25_find_cb(ax25_address *src_addr, ax25_address *dest_addr,
         ax25_digi *digi, struct net_device *dev)
 {
         ax25_cb *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&ax25_list_lock);
-        ax25_for_each(s, node, &ax25_list) {
+        ax25_for_each(s, &ax25_list) {
                 if (s->sk && s->sk->sk_type != SOCK_SEQPACKET)
                         continue;
                 if (s->ax25_dev == NULL)
@@ -248,10 +244,9 @@ void ax25_send_to_raw(ax25_address *addr, struct sk_buff *skb, int proto)
 {
         ax25_cb *s;
         struct sk_buff *copy;
-        struct hlist_node *node;
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(s, node, &ax25_list) {
+        ax25_for_each(s, &ax25_list) {
                 if (s->sk != NULL && ax25cmp(&s->source_addr, addr) == 0 &&
                     s->sk->sk_type == SOCK_RAW &&
                     s->sk->sk_protocol == proto &&
diff --git a/net/ax25/ax25_ds_subr.c b/net/ax25/ax25_ds_subr.c
index 5ea7fd3e2af9..e05bd57b5afd 100644
--- a/net/ax25/ax25_ds_subr.c
+++ b/net/ax25/ax25_ds_subr.c
@@ -39,7 +39,6 @@ void ax25_ds_nr_error_recovery(ax25_cb *ax25)
 void ax25_ds_enquiry_response(ax25_cb *ax25)
 {
         ax25_cb *ax25o;
-        struct hlist_node *node;
 
         /* Please note that neither DK4EG's nor DG2FEF's
          * DAMA spec mention the following behaviour as seen
@@ -80,7 +79,7 @@ void ax25_ds_enquiry_response(ax25_cb *ax25)
         ax25_ds_set_timer(ax25->ax25_dev);
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(ax25o, node, &ax25_list) {
+        ax25_for_each(ax25o, &ax25_list) {
                 if (ax25o == ax25)
                         continue;
 
@@ -159,10 +158,9 @@ static int ax25_check_dama_slave(ax25_dev *ax25_dev)
 {
         ax25_cb *ax25;
         int res = 0;
-        struct hlist_node *node;
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(ax25, node, &ax25_list)
+        ax25_for_each(ax25, &ax25_list)
                 if (ax25->ax25_dev == ax25_dev && (ax25->condition & AX25_COND_DAMA_MODE) && ax25->state > AX25_STATE_1) {
                         res = 1;
                         break;
diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
index 993c439b4f71..951cd57bb07d 100644
--- a/net/ax25/ax25_ds_timer.c
+++ b/net/ax25/ax25_ds_timer.c
@@ -70,7 +70,6 @@ static void ax25_ds_timeout(unsigned long arg)
 {
         ax25_dev *ax25_dev = (struct ax25_dev *) arg;
         ax25_cb *ax25;
-        struct hlist_node *node;
 
         if (ax25_dev == NULL || !ax25_dev->dama.slave)
                 return;                 /* Yikes! */
@@ -81,7 +80,7 @@ static void ax25_ds_timeout(unsigned long arg)
         }
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(ax25, node, &ax25_list) {
+        ax25_for_each(ax25, &ax25_list) {
                 if (ax25->ax25_dev != ax25_dev || !(ax25->condition & AX25_COND_DAMA_MODE))
                         continue;
 
diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c
index 7d5f24b82cc8..7f16e8a931b2 100644
--- a/net/ax25/ax25_iface.c
+++ b/net/ax25/ax25_iface.c
@@ -193,10 +193,9 @@ int ax25_listen_mine(ax25_address *callsign, struct net_device *dev)
 void ax25_link_failed(ax25_cb *ax25, int reason)
 {
         struct ax25_linkfail *lf;
-        struct hlist_node *node;
 
         spin_lock_bh(&linkfail_lock);
-        hlist_for_each_entry(lf, node, &ax25_linkfail_list, lf_node)
+        hlist_for_each_entry(lf, &ax25_linkfail_list, lf_node)
                 lf->func(ax25, reason);
         spin_unlock_bh(&linkfail_lock);
 }
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index 957999e43ff7..71c4badbc807 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -54,10 +54,9 @@ EXPORT_SYMBOL(ax25_uid_policy);
 ax25_uid_assoc *ax25_findbyuid(kuid_t uid)
 {
         ax25_uid_assoc *ax25_uid, *res = NULL;
-        struct hlist_node *node;
 
         read_lock(&ax25_uid_lock);
-        ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+        ax25_uid_for_each(ax25_uid, &ax25_uid_list) {
                 if (uid_eq(ax25_uid->uid, uid)) {
                         ax25_uid_hold(ax25_uid);
                         res = ax25_uid;
@@ -74,7 +73,6 @@ EXPORT_SYMBOL(ax25_findbyuid);
 int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 {
         ax25_uid_assoc *ax25_uid;
-        struct hlist_node *node;
         ax25_uid_assoc *user;
         unsigned long res;
 
@@ -82,7 +80,7 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
         case SIOCAX25GETUID:
                 res = -ENOENT;
                 read_lock(&ax25_uid_lock);
-                ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+                ax25_uid_for_each(ax25_uid, &ax25_uid_list) {
                         if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0) {
                                 res = from_kuid_munged(current_user_ns(), ax25_uid->uid);
                                 break;
@@ -126,7 +124,7 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 
                 ax25_uid = NULL;
                 write_lock(&ax25_uid_lock);
-                ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+                ax25_uid_for_each(ax25_uid, &ax25_uid_list) {
                         if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0)
                                 break;
                 }
@@ -212,11 +210,10 @@ const struct file_operations ax25_uid_fops = {
 void __exit ax25_uid_free(void)
 {
         ax25_uid_assoc *ax25_uid;
-        struct hlist_node *node;
 
         write_lock(&ax25_uid_lock);
 again:
-        ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+        ax25_uid_for_each(ax25_uid, &ax25_uid_list) {
                 hlist_del_init(&ax25_uid->uid_node);
                 ax25_uid_put(ax25_uid);
                 goto again;
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 72fe1bbf7721..a0b253ecadaf 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -487,7 +487,6 @@ static void batadv_iv_ogm_queue_add(struct batadv_priv *bat_priv,
          */
         struct batadv_forw_packet *forw_packet_aggr = NULL;
         struct batadv_forw_packet *forw_packet_pos = NULL;
-        struct hlist_node *tmp_node;
         struct batadv_ogm_packet *batadv_ogm_packet;
         bool direct_link;
         unsigned long max_aggregation_jiffies;
@@ -500,7 +499,7 @@ static void batadv_iv_ogm_queue_add(struct batadv_priv *bat_priv,
         spin_lock_bh(&bat_priv->forw_bat_list_lock);
         /* own packets are not to be aggregated */
         if ((atomic_read(&bat_priv->aggregated_ogms)) && (!own_packet)) {
-                hlist_for_each_entry(forw_packet_pos, tmp_node,
+                hlist_for_each_entry(forw_packet_pos,
                                      &bat_priv->forw_bat_list, list) {
                         if (batadv_iv_ogm_can_aggregate(batadv_ogm_packet,
                                                         bat_priv, packet_len,
@@ -655,7 +654,6 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         struct batadv_neigh_node *neigh_node = NULL, *tmp_neigh_node = NULL;
         struct batadv_neigh_node *router = NULL;
         struct batadv_orig_node *orig_node_tmp;
-        struct hlist_node *node;
         int if_num;
         uint8_t sum_orig, sum_neigh;
         uint8_t *neigh_addr;
@@ -665,7 +663,7 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
                    "update_originator(): Searching and updating originator entry of received packet\n");
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(tmp_neigh_node, node,
+        hlist_for_each_entry_rcu(tmp_neigh_node,
                                  &orig_node->neigh_list, list) {
                 neigh_addr = tmp_neigh_node->addr;
                 if (batadv_compare_eth(neigh_addr, ethhdr->h_source) &&
@@ -801,7 +799,6 @@ static int batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
 {
         struct batadv_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct batadv_neigh_node *neigh_node = NULL, *tmp_neigh_node;
-        struct hlist_node *node;
         uint8_t total_count;
         uint8_t orig_eq_count, neigh_rq_count, neigh_rq_inv, tq_own;
         unsigned int neigh_rq_inv_cube, neigh_rq_max_cube;
@@ -810,7 +807,7 @@ static int batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
 
         /* find corresponding one hop neighbor */
         rcu_read_lock();
-        hlist_for_each_entry_rcu(tmp_neigh_node, node,
+        hlist_for_each_entry_rcu(tmp_neigh_node,
                                  &orig_neigh_node->neigh_list, list) {
                 if (!batadv_compare_eth(tmp_neigh_node->addr,
                                         orig_neigh_node->orig))
@@ -920,7 +917,6 @@ batadv_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
         struct batadv_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct batadv_orig_node *orig_node;
         struct batadv_neigh_node *tmp_neigh_node;
-        struct hlist_node *node;
         int is_duplicate = 0;
         int32_t seq_diff;
         int need_update = 0;
@@ -943,7 +939,7 @@ batadv_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
                 goto out;
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(tmp_neigh_node, node,
+        hlist_for_each_entry_rcu(tmp_neigh_node,
                                  &orig_node->neigh_list, list) {
                 is_duplicate |= batadv_test_bit(tmp_neigh_node->real_bits,
                                                 orig_node->last_real_seqno,
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 30f46526cbbd..6a4f728680ae 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -144,7 +144,6 @@ static struct batadv_bla_claim
 {
         struct batadv_hashtable *hash = bat_priv->bla.claim_hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_bla_claim *claim;
         struct batadv_bla_claim *claim_tmp = NULL;
         int index;
@@ -156,7 +155,7 @@ static struct batadv_bla_claim
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(claim, head, hash_entry) {
                 if (!batadv_compare_claim(&claim->hash_entry, data))
                         continue;
 
@@ -185,7 +184,6 @@ batadv_backbone_hash_find(struct batadv_priv *bat_priv,
 {
         struct batadv_hashtable *hash = bat_priv->bla.backbone_hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_bla_backbone_gw search_entry, *backbone_gw;
         struct batadv_bla_backbone_gw *backbone_gw_tmp = NULL;
         int index;
@@ -200,7 +198,7 @@ batadv_backbone_hash_find(struct batadv_priv *bat_priv,
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                 if (!batadv_compare_backbone_gw(&backbone_gw->hash_entry,
                                                 &search_entry))
                         continue;
@@ -221,7 +219,7 @@ static void
 batadv_bla_del_backbone_claims(struct batadv_bla_backbone_gw *backbone_gw)
 {
         struct batadv_hashtable *hash;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         struct batadv_bla_claim *claim;
         int i;
@@ -236,13 +234,13 @@ batadv_bla_del_backbone_claims(struct batadv_bla_backbone_gw *backbone_gw)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(claim, node, node_tmp,
+                hlist_for_each_entry_safe(claim, node_tmp,
                                           head, hash_entry) {
                         if (claim->backbone_gw != backbone_gw)
                                 continue;
 
                         batadv_claim_free_ref(claim);
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&claim->hash_entry);
                 }
                 spin_unlock_bh(list_lock);
         }
@@ -460,7 +458,6 @@ static void batadv_bla_answer_request(struct batadv_priv *bat_priv,
                                       struct batadv_hard_iface *primary_if,
                                       short vid)
 {
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_hashtable *hash;
         struct batadv_bla_claim *claim;
@@ -481,7 +478,7 @@ static void batadv_bla_answer_request(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(claim, head, hash_entry) {
                         /* only own claims are interesting */
                         if (claim->backbone_gw != backbone_gw)
                                 continue;
@@ -958,7 +955,7 @@ static int batadv_bla_process_claim(struct batadv_priv *bat_priv,
 static void batadv_bla_purge_backbone_gw(struct batadv_priv *bat_priv, int now)
 {
         struct batadv_bla_backbone_gw *backbone_gw;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         struct batadv_hashtable *hash;
         spinlock_t *list_lock;  /* protects write access to the hash lists */
@@ -973,7 +970,7 @@ static void batadv_bla_purge_backbone_gw(struct batadv_priv *bat_priv, int now)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(backbone_gw, node, node_tmp,
+                hlist_for_each_entry_safe(backbone_gw, node_tmp,
                                           head, hash_entry) {
                         if (now)
                                 goto purge_now;
@@ -992,7 +989,7 @@ purge_now:
 
                         batadv_bla_del_backbone_claims(backbone_gw);
 
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&backbone_gw->hash_entry);
                         batadv_backbone_gw_free_ref(backbone_gw);
                 }
                 spin_unlock_bh(list_lock);
@@ -1013,7 +1010,6 @@ static void batadv_bla_purge_claims(struct batadv_priv *bat_priv,
                                     int now)
 {
         struct batadv_bla_claim *claim;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_hashtable *hash;
         int i;
@@ -1026,7 +1022,7 @@ static void batadv_bla_purge_claims(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(claim, head, hash_entry) {
                         if (now)
                                 goto purge_now;
                         if (!batadv_compare_eth(claim->backbone_gw->orig,
@@ -1062,7 +1058,6 @@ void batadv_bla_update_orig_address(struct batadv_priv *bat_priv,
                                     struct batadv_hard_iface *oldif)
 {
         struct batadv_bla_backbone_gw *backbone_gw;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_hashtable *hash;
         __be16 group;
@@ -1086,7 +1081,7 @@ void batadv_bla_update_orig_address(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                         /* own orig still holds the old value. */
                         if (!batadv_compare_eth(backbone_gw->orig,
                                                 oldif->net_dev->dev_addr))
@@ -1112,7 +1107,6 @@ static void batadv_bla_periodic_work(struct work_struct *work)
         struct delayed_work *delayed_work;
         struct batadv_priv *bat_priv;
         struct batadv_priv_bla *priv_bla;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_bla_backbone_gw *backbone_gw;
         struct batadv_hashtable *hash;
@@ -1140,7 +1134,7 @@ static void batadv_bla_periodic_work(struct work_struct *work)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                         if (!batadv_compare_eth(backbone_gw->orig,
                                                 primary_if->net_dev->dev_addr))
                                 continue;
@@ -1322,7 +1316,6 @@ int batadv_bla_is_backbone_gw_orig(struct batadv_priv *bat_priv, uint8_t *orig)
 {
         struct batadv_hashtable *hash = bat_priv->bla.backbone_hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_bla_backbone_gw *backbone_gw;
         int i;
 
@@ -1336,7 +1329,7 @@ int batadv_bla_is_backbone_gw_orig(struct batadv_priv *bat_priv, uint8_t *orig)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                         if (batadv_compare_eth(backbone_gw->orig, orig)) {
                                 rcu_read_unlock();
                                 return 1;
@@ -1607,7 +1600,6 @@ int batadv_bla_claim_table_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_hashtable *hash = bat_priv->bla.claim_hash;
         struct batadv_bla_claim *claim;
         struct batadv_hard_iface *primary_if;
-        struct hlist_node *node;
         struct hlist_head *head;
         uint32_t i;
         bool is_own;
@@ -1628,7 +1620,7 @@ int batadv_bla_claim_table_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(claim, head, hash_entry) {
                         is_own = batadv_compare_eth(claim->backbone_gw->orig,
                                                     primary_addr);
                         seq_printf(seq, " * %pM on % 5d by %pM [%c] (%#.4x)\n",
@@ -1652,7 +1644,6 @@ int batadv_bla_backbone_table_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_hashtable *hash = bat_priv->bla.backbone_hash;
         struct batadv_bla_backbone_gw *backbone_gw;
         struct batadv_hard_iface *primary_if;
-        struct hlist_node *node;
         struct hlist_head *head;
         int secs, msecs;
         uint32_t i;
@@ -1674,7 +1665,7 @@ int batadv_bla_backbone_table_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                         msecs = jiffies_to_msecs(jiffies -
                                                  backbone_gw->lasttime);
                         secs = msecs / 1000;
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 761a59002e34..d54188a112ea 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -83,7 +83,7 @@ static void __batadv_dat_purge(struct batadv_priv *bat_priv,
 {
         spinlock_t *list_lock; /* protects write access to the hash lists */
         struct batadv_dat_entry *dat_entry;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         uint32_t i;
 
@@ -95,7 +95,7 @@ static void __batadv_dat_purge(struct batadv_priv *bat_priv,
                 list_lock = &bat_priv->dat.hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(dat_entry, node, node_tmp, head,
+                hlist_for_each_entry_safe(dat_entry, node_tmp, head,
                                           hash_entry) {
                         /* if an helper function has been passed as parameter,
                          * ask it if the entry has to be purged or not
@@ -103,7 +103,7 @@ static void __batadv_dat_purge(struct batadv_priv *bat_priv,
                         if (to_purge && !to_purge(dat_entry))
                                 continue;
 
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&dat_entry->hash_entry);
                         batadv_dat_entry_free_ref(dat_entry);
                 }
                 spin_unlock_bh(list_lock);
@@ -235,7 +235,6 @@ static struct batadv_dat_entry *
 batadv_dat_entry_hash_find(struct batadv_priv *bat_priv, __be32 ip)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_dat_entry *dat_entry, *dat_entry_tmp = NULL;
         struct batadv_hashtable *hash = bat_priv->dat.hash;
         uint32_t index;
@@ -247,7 +246,7 @@ batadv_dat_entry_hash_find(struct batadv_priv *bat_priv, __be32 ip)
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(dat_entry, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(dat_entry, head, hash_entry) {
                 if (dat_entry->ip != ip)
                         continue;
 
@@ -465,7 +464,6 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,
         batadv_dat_addr_t max = 0, tmp_max = 0;
         struct batadv_orig_node *orig_node, *max_orig_node = NULL;
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         int i;
 
@@ -481,7 +479,7 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         /* the dht space is a ring and addresses are unsigned */
                         tmp_max = BATADV_DAT_ADDR_MAX - orig_node->dat_addr +
                                   ip_key;
@@ -686,7 +684,6 @@ int batadv_dat_cache_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_hashtable *hash = bat_priv->dat.hash;
         struct batadv_dat_entry *dat_entry;
         struct batadv_hard_iface *primary_if;
-        struct hlist_node *node;
         struct hlist_head *head;
         unsigned long last_seen_jiffies;
         int last_seen_msecs, last_seen_secs, last_seen_mins;
@@ -704,7 +701,7 @@ int batadv_dat_cache_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(dat_entry, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(dat_entry, head, hash_entry) {
                         last_seen_jiffies = jiffies - dat_entry->last_update;
                         last_seen_msecs = jiffies_to_msecs(last_seen_jiffies);
                         last_seen_mins = last_seen_msecs / 60000;
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index 074107f2cfaa..34f99a46ec1d 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -114,7 +114,6 @@ static struct batadv_gw_node *
 batadv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
 {
         struct batadv_neigh_node *router;
-        struct hlist_node *node;
         struct batadv_gw_node *gw_node, *curr_gw = NULL;
         uint32_t max_gw_factor = 0, tmp_gw_factor = 0;
         uint32_t gw_divisor;
@@ -127,7 +126,7 @@ batadv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
         gw_divisor *= 64;
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw.list, list) {
+        hlist_for_each_entry_rcu(gw_node, &bat_priv->gw.list, list) {
                 if (gw_node->deleted)
                         continue;
 
@@ -344,7 +343,6 @@ void batadv_gw_node_update(struct batadv_priv *bat_priv,
                            struct batadv_orig_node *orig_node,
                            uint8_t new_gwflags)
 {
-        struct hlist_node *node;
         struct batadv_gw_node *gw_node, *curr_gw;
 
         /* Note: We don't need a NULL check here, since curr_gw never gets
@@ -355,7 +353,7 @@ void batadv_gw_node_update(struct batadv_priv *bat_priv,
         curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw.list, list) {
+        hlist_for_each_entry_rcu(gw_node, &bat_priv->gw.list, list) {
                 if (gw_node->orig_node != orig_node)
                         continue;
 
@@ -403,7 +401,7 @@ void batadv_gw_node_delete(struct batadv_priv *bat_priv,
 void batadv_gw_node_purge(struct batadv_priv *bat_priv)
 {
         struct batadv_gw_node *gw_node, *curr_gw;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         unsigned long timeout = msecs_to_jiffies(2 * BATADV_PURGE_TIMEOUT);
         int do_deselect = 0;
 
@@ -411,7 +409,7 @@ void batadv_gw_node_purge(struct batadv_priv *bat_priv)
 
         spin_lock_bh(&bat_priv->gw.list_lock);
 
-        hlist_for_each_entry_safe(gw_node, node, node_tmp,
+        hlist_for_each_entry_safe(gw_node, node_tmp,
                                   &bat_priv->gw.list, list) {
                 if (((!gw_node->deleted) ||
                      (time_before(jiffies, gw_node->deleted + timeout))) &&
@@ -476,7 +474,6 @@ int batadv_gw_client_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_priv *bat_priv = netdev_priv(net_dev);
         struct batadv_hard_iface *primary_if;
         struct batadv_gw_node *gw_node;
-        struct hlist_node *node;
         int gw_count = 0;
 
         primary_if = batadv_seq_print_text_primary_if_get(seq);
@@ -490,7 +487,7 @@ int batadv_gw_client_seq_print_text(struct seq_file *seq, void *offset)
                    primary_if->net_dev->dev_addr, net_dev->name);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw.list, list) {
+        hlist_for_each_entry_rcu(gw_node, &bat_priv->gw.list, list) {
                 if (gw_node->deleted)
                         continue;
 
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 21fe6987733b..0488d70c8c35 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -345,9 +345,8 @@ void batadv_recv_handler_unregister(uint8_t packet_type)
 static struct batadv_algo_ops *batadv_algo_get(char *name)
 {
         struct batadv_algo_ops *bat_algo_ops = NULL, *bat_algo_ops_tmp;
-        struct hlist_node *node;
 
-        hlist_for_each_entry(bat_algo_ops_tmp, node, &batadv_algo_list, list) {
+        hlist_for_each_entry(bat_algo_ops_tmp, &batadv_algo_list, list) {
                 if (strcmp(bat_algo_ops_tmp->name, name) != 0)
                         continue;
 
@@ -411,11 +410,10 @@ out:
 int batadv_algo_seq_print_text(struct seq_file *seq, void *offset)
 {
         struct batadv_algo_ops *bat_algo_ops;
-        struct hlist_node *node;
 
         seq_printf(seq, "Available routing algorithms:\n");
 
-        hlist_for_each_entry(bat_algo_ops, node, &batadv_algo_list, list) {
+        hlist_for_each_entry(bat_algo_ops, &batadv_algo_list, list) {
                 seq_printf(seq, "%s\n", bat_algo_ops->name);
         }
 
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 457ea445217c..96fb80b724dc 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -118,7 +118,7 @@ out:
 
 static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
 {
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct batadv_neigh_node *neigh_node, *tmp_neigh_node;
         struct batadv_orig_node *orig_node;
 
@@ -134,7 +134,7 @@ static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
         }
 
         /* for all neighbors towards this originator ... */
-        hlist_for_each_entry_safe(neigh_node, node, node_tmp,
+        hlist_for_each_entry_safe(neigh_node, node_tmp,
                                   &orig_node->neigh_list, list) {
                 hlist_del_rcu(&neigh_node->list);
                 batadv_neigh_node_free_ref(neigh_node);
@@ -161,7 +161,7 @@ void batadv_orig_node_free_ref(struct batadv_orig_node *orig_node)
 void batadv_originator_free(struct batadv_priv *bat_priv)
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         spinlock_t *list_lock; /* spinlock to protect write access */
         struct batadv_orig_node *orig_node;
@@ -179,9 +179,9 @@ void batadv_originator_free(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(orig_node, node, node_tmp,
+                hlist_for_each_entry_safe(orig_node, node_tmp,
                                           head, hash_entry) {
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&orig_node->hash_entry);
                         batadv_orig_node_free_ref(orig_node);
                 }
                 spin_unlock_bh(list_lock);
@@ -274,7 +274,7 @@ batadv_purge_orig_neighbors(struct batadv_priv *bat_priv,
                             struct batadv_orig_node *orig_node,
                             struct batadv_neigh_node **best_neigh_node)
 {
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct batadv_neigh_node *neigh_node;
         bool neigh_purged = false;
         unsigned long last_seen;
@@ -285,7 +285,7 @@ batadv_purge_orig_neighbors(struct batadv_priv *bat_priv,
         spin_lock_bh(&orig_node->neigh_list_lock);
 
         /* for all neighbors towards this originator ... */
-        hlist_for_each_entry_safe(neigh_node, node, node_tmp,
+        hlist_for_each_entry_safe(neigh_node, node_tmp,
                                   &orig_node->neigh_list, list) {
                 last_seen = neigh_node->last_seen;
                 if_incoming = neigh_node->if_incoming;
@@ -348,7 +348,7 @@ static bool batadv_purge_orig_node(struct batadv_priv *bat_priv,
 static void _batadv_purge_orig(struct batadv_priv *bat_priv)
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         spinlock_t *list_lock; /* spinlock to protect write access */
         struct batadv_orig_node *orig_node;
@@ -363,13 +363,13 @@ static void _batadv_purge_orig(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(orig_node, node, node_tmp,
+                hlist_for_each_entry_safe(orig_node, node_tmp,
                                           head, hash_entry) {
                         if (batadv_purge_orig_node(bat_priv, orig_node)) {
                                 if (orig_node->gw_flags)
                                         batadv_gw_node_delete(bat_priv,
                                                               orig_node);
-                                hlist_del_rcu(node);
+                                hlist_del_rcu(&orig_node->hash_entry);
                                 batadv_orig_node_free_ref(orig_node);
                                 continue;
                         }
@@ -408,7 +408,6 @@ int batadv_orig_seq_print_text(struct seq_file *seq, void *offset)
         struct net_device *net_dev = (struct net_device *)seq->private;
         struct batadv_priv *bat_priv = netdev_priv(net_dev);
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node, *node_tmp;
         struct hlist_head *head;
         struct batadv_hard_iface *primary_if;
         struct batadv_orig_node *orig_node;
@@ -434,7 +433,7 @@ int batadv_orig_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         neigh_node = batadv_orig_node_get_router(orig_node);
                         if (!neigh_node)
                                 continue;
@@ -453,7 +452,7 @@ int batadv_orig_seq_print_text(struct seq_file *seq, void *offset)
                                    neigh_node->addr,
                                    neigh_node->if_incoming->net_dev->name);
 
-                        hlist_for_each_entry_rcu(neigh_node_tmp, node_tmp,
+                        hlist_for_each_entry_rcu(neigh_node_tmp,
                                                  &orig_node->neigh_list, list) {
                                 seq_printf(seq, " %pM (%3i)",
                                            neigh_node_tmp->addr,
@@ -511,7 +510,6 @@ int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface,
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_orig_node *orig_node;
         uint32_t i;
@@ -524,7 +522,7 @@ int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         spin_lock_bh(&orig_node->ogm_cnt_lock);
                         ret = batadv_orig_node_add_if(orig_node, max_if_num);
                         spin_unlock_bh(&orig_node->ogm_cnt_lock);
@@ -595,7 +593,6 @@ int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface,
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_hard_iface *hard_iface_tmp;
         struct batadv_orig_node *orig_node;
@@ -609,7 +606,7 @@ int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         spin_lock_bh(&orig_node->ogm_cnt_lock);
                         ret = batadv_orig_node_del_if(orig_node, max_if_num,
                                                       hard_iface->if_num);
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 286bf743e76a..7df48fa7669d 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -68,7 +68,6 @@ batadv_orig_hash_find(struct batadv_priv *bat_priv, const void *data)
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_orig_node *orig_node, *orig_node_tmp = NULL;
         int index;
 
@@ -79,7 +78,7 @@ batadv_orig_hash_find(struct batadv_priv *bat_priv, const void *data)
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                 if (!batadv_compare_eth(orig_node, data))
                         continue;
 
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 60ba03fc8390..5ee21cebbbb0 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -37,7 +37,6 @@ void batadv_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_orig_node *orig_node;
         unsigned long *word;
@@ -49,7 +48,7 @@ void batadv_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         spin_lock_bh(&orig_node->ogm_cnt_lock);
                         word_index = hard_iface->if_num * BATADV_NUM_WORDS;
                         word = &(orig_node->bcast_own[word_index]);
@@ -146,7 +145,6 @@ out:
 void batadv_bonding_candidate_add(struct batadv_orig_node *orig_node,
                                   struct batadv_neigh_node *neigh_node)
 {
-        struct hlist_node *node;
         struct batadv_neigh_node *tmp_neigh_node, *router = NULL;
         uint8_t interference_candidate = 0;
 
@@ -169,7 +167,7 @@ void batadv_bonding_candidate_add(struct batadv_orig_node *orig_node,
          * interface. If we do, we won't select this candidate because of
          * possible interference.
          */
-        hlist_for_each_entry_rcu(tmp_neigh_node, node,
+        hlist_for_each_entry_rcu(tmp_neigh_node,
                                  &orig_node->neigh_list, list) {
                 if (tmp_neigh_node == neigh_node)
                         continue;
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 80ca65fc89a1..a67cffde37ae 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -316,7 +316,7 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
                                  const struct batadv_hard_iface *hard_iface)
 {
         struct batadv_forw_packet *forw_packet;
-        struct hlist_node *tmp_node, *safe_tmp_node;
+        struct hlist_node *safe_tmp_node;
         bool pending;
 
         if (hard_iface)
@@ -329,7 +329,7 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
 
         /* free bcast list */
         spin_lock_bh(&bat_priv->forw_bcast_list_lock);
-        hlist_for_each_entry_safe(forw_packet, tmp_node, safe_tmp_node,
+        hlist_for_each_entry_safe(forw_packet, safe_tmp_node,
                                   &bat_priv->forw_bcast_list, list) {
                 /* if purge_outstanding_packets() was called with an argument
                  * we delete only packets belonging to the given interface
@@ -355,7 +355,7 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
 
         /* free batman packet list */
         spin_lock_bh(&bat_priv->forw_bat_list_lock);
-        hlist_for_each_entry_safe(forw_packet, tmp_node, safe_tmp_node,
+        hlist_for_each_entry_safe(forw_packet, safe_tmp_node,
                                   &bat_priv->forw_bat_list, list) {
                 /* if purge_outstanding_packets() was called with an argument
                  * we delete only packets belonging to the given interface
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index d44672f4a349..98a66a021a60 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -56,7 +56,6 @@ static struct batadv_tt_common_entry *
 batadv_tt_hash_find(struct batadv_hashtable *hash, const void *data)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_common_entry *tt_common_entry_tmp = NULL;
         uint32_t index;
@@ -68,7 +67,7 @@ batadv_tt_hash_find(struct batadv_hashtable *hash, const void *data)
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(tt_common_entry, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(tt_common_entry, head, hash_entry) {
                 if (!batadv_compare_eth(tt_common_entry, data))
                         continue;
 
@@ -257,7 +256,6 @@ void batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
         struct batadv_tt_local_entry *tt_local;
         struct batadv_tt_global_entry *tt_global;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_orig_list_entry *orig_entry;
         int hash_added;
         bool roamed_back = false;
@@ -339,7 +337,7 @@ check_roaming:
                 /* These node are probably going to update their tt table */
                 head = &tt_global->orig_list;
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+                hlist_for_each_entry_rcu(orig_entry, head, list) {
                         batadv_send_roam_adv(bat_priv, tt_global->common.addr,
                                              orig_entry->orig_node);
                 }
@@ -470,7 +468,6 @@ int batadv_tt_local_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_local_entry *tt_local;
         struct batadv_hard_iface *primary_if;
-        struct hlist_node *node;
         struct hlist_head *head;
         uint32_t i;
         int last_seen_secs;
@@ -494,7 +491,7 @@ int batadv_tt_local_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common_entry, node,
+                hlist_for_each_entry_rcu(tt_common_entry,
                                          head, hash_entry) {
                         tt_local = container_of(tt_common_entry,
                                                 struct batadv_tt_local_entry,
@@ -605,9 +602,9 @@ static void batadv_tt_local_purge_list(struct batadv_priv *bat_priv,
 {
         struct batadv_tt_local_entry *tt_local_entry;
         struct batadv_tt_common_entry *tt_common_entry;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
 
-        hlist_for_each_entry_safe(tt_common_entry, node, node_tmp, head,
+        hlist_for_each_entry_safe(tt_common_entry, node_tmp, head,
                                   hash_entry) {
                 tt_local_entry = container_of(tt_common_entry,
                                               struct batadv_tt_local_entry,
@@ -651,7 +648,7 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
         spinlock_t *list_lock; /* protects write access to the hash lists */
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_local_entry *tt_local;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         uint32_t i;
 
@@ -665,9 +662,9 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(tt_common_entry, node, node_tmp,
+                hlist_for_each_entry_safe(tt_common_entry, node_tmp,
                                           head, hash_entry) {
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&tt_common_entry->hash_entry);
                         tt_local = container_of(tt_common_entry,
                                                 struct batadv_tt_local_entry,
                                                 common);
@@ -724,11 +721,10 @@ batadv_tt_global_orig_entry_find(const struct batadv_tt_global_entry *entry,
 {
         struct batadv_tt_orig_list_entry *tmp_orig_entry, *orig_entry = NULL;
         const struct hlist_head *head;
-        struct hlist_node *node;
 
         rcu_read_lock();
         head = &entry->orig_list;
-        hlist_for_each_entry_rcu(tmp_orig_entry, node, head, list) {
+        hlist_for_each_entry_rcu(tmp_orig_entry, head, list) {
                 if (tmp_orig_entry->orig_node != orig_node)
                         continue;
                 if (!atomic_inc_not_zero(&tmp_orig_entry->refcount))
@@ -940,12 +936,11 @@ batadv_transtable_best_orig(struct batadv_tt_global_entry *tt_global_entry)
 {
         struct batadv_neigh_node *router = NULL;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_orig_list_entry *orig_entry, *best_entry = NULL;
         int best_tq = 0;
 
         head = &tt_global_entry->orig_list;
-        hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+        hlist_for_each_entry_rcu(orig_entry, head, list) {
                 router = batadv_orig_node_get_router(orig_entry->orig_node);
                 if (!router)
                         continue;
@@ -973,7 +968,6 @@ batadv_tt_global_print_entry(struct batadv_tt_global_entry *tt_global_entry,
                              struct seq_file *seq)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_orig_list_entry *orig_entry, *best_entry;
         struct batadv_tt_common_entry *tt_common_entry;
         uint16_t flags;
@@ -997,7 +991,7 @@ batadv_tt_global_print_entry(struct batadv_tt_global_entry *tt_global_entry,
 
         head = &tt_global_entry->orig_list;
 
-        hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+        hlist_for_each_entry_rcu(orig_entry, head, list) {
                 if (best_entry == orig_entry)
                         continue;
 
@@ -1020,7 +1014,6 @@ int batadv_tt_global_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_global_entry *tt_global;
         struct batadv_hard_iface *primary_if;
-        struct hlist_node *node;
         struct hlist_head *head;
         uint32_t i;
 
@@ -1039,7 +1032,7 @@ int batadv_tt_global_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common_entry, node,
+                hlist_for_each_entry_rcu(tt_common_entry,
                                          head, hash_entry) {
                         tt_global = container_of(tt_common_entry,
                                                  struct batadv_tt_global_entry,
@@ -1059,13 +1052,13 @@ static void
 batadv_tt_global_del_orig_list(struct batadv_tt_global_entry *tt_global_entry)
 {
         struct hlist_head *head;
-        struct hlist_node *node, *safe;
+        struct hlist_node *safe;
         struct batadv_tt_orig_list_entry *orig_entry;
 
         spin_lock_bh(&tt_global_entry->list_lock);
         head = &tt_global_entry->orig_list;
-        hlist_for_each_entry_safe(orig_entry, node, safe, head, list) {
-                hlist_del_rcu(node);
+        hlist_for_each_entry_safe(orig_entry, safe, head, list) {
+                hlist_del_rcu(&orig_entry->list);
                 batadv_tt_orig_list_entry_free_ref(orig_entry);
         }
         spin_unlock_bh(&tt_global_entry->list_lock);
@@ -1078,18 +1071,18 @@ batadv_tt_global_del_orig_entry(struct batadv_priv *bat_priv,
                                 const char *message)
 {
         struct hlist_head *head;
-        struct hlist_node *node, *safe;
+        struct hlist_node *safe;
         struct batadv_tt_orig_list_entry *orig_entry;
 
         spin_lock_bh(&tt_global_entry->list_lock);
         head = &tt_global_entry->orig_list;
-        hlist_for_each_entry_safe(orig_entry, node, safe, head, list) {
+        hlist_for_each_entry_safe(orig_entry, safe, head, list) {
                 if (orig_entry->orig_node == orig_node) {
                         batadv_dbg(BATADV_DBG_TT, bat_priv,
                                    "Deleting %pM from global tt entry %pM: %s\n",
                                    orig_node->orig,
                                    tt_global_entry->common.addr, message);
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&orig_entry->list);
                         batadv_tt_orig_list_entry_free_ref(orig_entry);
                 }
         }
@@ -1108,7 +1101,6 @@ batadv_tt_global_del_roaming(struct batadv_priv *bat_priv,
 {
         bool last_entry = true;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_orig_list_entry *orig_entry;
 
         /* no local entry exists, case 1:
@@ -1117,7 +1109,7 @@ batadv_tt_global_del_roaming(struct batadv_priv *bat_priv,
 
         rcu_read_lock();
         head = &tt_global_entry->orig_list;
-        hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+        hlist_for_each_entry_rcu(orig_entry, head, list) {
                 if (orig_entry->orig_node != orig_node) {
                         last_entry = false;
                         break;
@@ -1202,7 +1194,7 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
         struct batadv_tt_common_entry *tt_common_entry;
         uint32_t i;
         struct batadv_hashtable *hash = bat_priv->tt.global_hash;
-        struct hlist_node *node, *safe;
+        struct hlist_node *safe;
         struct hlist_head *head;
         spinlock_t *list_lock; /* protects write access to the hash lists */
 
@@ -1214,7 +1206,7 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(tt_common_entry, node, safe,
+                hlist_for_each_entry_safe(tt_common_entry, safe,
                                           head, hash_entry) {
                         tt_global = container_of(tt_common_entry,
                                                  struct batadv_tt_global_entry,
@@ -1227,7 +1219,7 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
                                 batadv_dbg(BATADV_DBG_TT, bat_priv,
                                            "Deleting global tt entry %pM: %s\n",
                                            tt_global->common.addr, message);
-                                hlist_del_rcu(node);
+                                hlist_del_rcu(&tt_common_entry->hash_entry);
                                 batadv_tt_global_entry_free_ref(tt_global);
                         }
                 }
@@ -1262,7 +1254,7 @@ static void batadv_tt_global_purge(struct batadv_priv *bat_priv)
 {
         struct batadv_hashtable *hash = bat_priv->tt.global_hash;
         struct hlist_head *head;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         spinlock_t *list_lock; /* protects write access to the hash lists */
         uint32_t i;
         char *msg = NULL;
@@ -1274,7 +1266,7 @@ static void batadv_tt_global_purge(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(tt_common, node, node_tmp, head,
+                hlist_for_each_entry_safe(tt_common, node_tmp, head,
                                           hash_entry) {
                         tt_global = container_of(tt_common,
                                                  struct batadv_tt_global_entry,
@@ -1287,7 +1279,7 @@ static void batadv_tt_global_purge(struct batadv_priv *bat_priv)
                                    "Deleting global tt entry (%pM): %s\n",
                                    tt_global->common.addr, msg);
 
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&tt_common->hash_entry);
 
                         batadv_tt_global_entry_free_ref(tt_global);
                 }
@@ -1301,7 +1293,7 @@ static void batadv_tt_global_table_free(struct batadv_priv *bat_priv)
         spinlock_t *list_lock; /* protects write access to the hash lists */
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_global_entry *tt_global;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         uint32_t i;
 
@@ -1315,9 +1307,9 @@ static void batadv_tt_global_table_free(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(tt_common_entry, node, node_tmp,
+                hlist_for_each_entry_safe(tt_common_entry, node_tmp,
                                           head, hash_entry) {
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&tt_common_entry->hash_entry);
                         tt_global = container_of(tt_common_entry,
                                                  struct batadv_tt_global_entry,
                                                  common);
@@ -1397,7 +1389,6 @@ static uint16_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
         struct batadv_hashtable *hash = bat_priv->tt.global_hash;
         struct batadv_tt_common_entry *tt_common;
         struct batadv_tt_global_entry *tt_global;
-        struct hlist_node *node;
         struct hlist_head *head;
         uint32_t i;
         int j;
@@ -1406,7 +1397,7 @@ static uint16_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(tt_common, head, hash_entry) {
                         tt_global = container_of(tt_common,
                                                  struct batadv_tt_global_entry,
                                                  common);
@@ -1449,7 +1440,6 @@ static uint16_t batadv_tt_local_crc(struct batadv_priv *bat_priv)
         uint16_t total = 0, total_one;
         struct batadv_hashtable *hash = bat_priv->tt.local_hash;
         struct batadv_tt_common_entry *tt_common;
-        struct hlist_node *node;
         struct hlist_head *head;
         uint32_t i;
         int j;
@@ -1458,7 +1448,7 @@ static uint16_t batadv_tt_local_crc(struct batadv_priv *bat_priv)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(tt_common, head, hash_entry) {
                         /* not yet committed clients have not to be taken into
                          * account while computing the CRC
                          */
@@ -1597,7 +1587,6 @@ batadv_tt_response_fill_table(uint16_t tt_len, uint8_t ttvn,
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_query_packet *tt_response;
         struct batadv_tt_change *tt_change;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct sk_buff *skb = NULL;
         uint16_t tt_tot, tt_count;
@@ -1627,7 +1616,7 @@ batadv_tt_response_fill_table(uint16_t tt_len, uint8_t ttvn,
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
 
-                hlist_for_each_entry_rcu(tt_common_entry, node,
+                hlist_for_each_entry_rcu(tt_common_entry,
                                          head, hash_entry) {
                         if (tt_count == tt_tot)
                                 break;
@@ -2307,7 +2296,6 @@ static uint16_t batadv_tt_set_flags(struct batadv_hashtable *hash,
         uint32_t i;
         uint16_t changed_num = 0;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_common_entry *tt_common_entry;
 
         if (!hash)
@@ -2317,7 +2305,7 @@ static uint16_t batadv_tt_set_flags(struct batadv_hashtable *hash,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common_entry, node,
+                hlist_for_each_entry_rcu(tt_common_entry,
                                          head, hash_entry) {
                         if (enable) {
                                 if ((tt_common_entry->flags & flags) == flags)
@@ -2342,7 +2330,7 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
         struct batadv_hashtable *hash = bat_priv->tt.local_hash;
         struct batadv_tt_common_entry *tt_common;
         struct batadv_tt_local_entry *tt_local;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         spinlock_t *list_lock; /* protects write access to the hash lists */
         uint32_t i;
@@ -2355,7 +2343,7 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(tt_common, node, node_tmp, head,
+                hlist_for_each_entry_safe(tt_common, node_tmp, head,
                                           hash_entry) {
                         if (!(tt_common->flags & BATADV_TT_CLIENT_PENDING))
                                 continue;
@@ -2365,7 +2353,7 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
                                    tt_common->addr);
 
                         atomic_dec(&bat_priv->tt.local_entry_num);
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&tt_common->hash_entry);
                         tt_local = container_of(tt_common,
                                                 struct batadv_tt_local_entry,
                                                 common);
diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c
index 22d2785177d1..c053244b97bd 100644
--- a/net/batman-adv/vis.c
+++ b/net/batman-adv/vis.c
@@ -97,7 +97,6 @@ batadv_vis_hash_find(struct batadv_priv *bat_priv, const void *data)
 {
         struct batadv_hashtable *hash = bat_priv->vis.hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_vis_info *vis_info, *vis_info_tmp = NULL;
         uint32_t index;
 
@@ -108,8 +107,8 @@ batadv_vis_hash_find(struct batadv_priv *bat_priv, const void *data)
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(vis_info, node, head, hash_entry) {
-                if (!batadv_vis_info_cmp(node, data))
+        hlist_for_each_entry_rcu(vis_info, head, hash_entry) {
+                if (!batadv_vis_info_cmp(&vis_info->hash_entry, data))
                         continue;
 
                 vis_info_tmp = vis_info;
@@ -128,9 +127,8 @@ static void batadv_vis_data_insert_interface(const uint8_t *interface,
                                              bool primary)
 {
         struct batadv_vis_if_list_entry *entry;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry(entry, pos, if_list, list) {
+        hlist_for_each_entry(entry, if_list, list) {
                 if (batadv_compare_eth(entry->addr, interface))
                         return;
         }
@@ -148,9 +146,8 @@ static void batadv_vis_data_read_prim_sec(struct seq_file *seq,
                                           const struct hlist_head *if_list)
 {
         struct batadv_vis_if_list_entry *entry;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry(entry, pos, if_list, list) {
+        hlist_for_each_entry(entry, if_list, list) {
                 if (entry->primary)
                         seq_printf(seq, "PRIMARY, ");
                 else
@@ -198,9 +195,8 @@ static void batadv_vis_data_read_entries(struct seq_file *seq,
 {
         int i;
         struct batadv_vis_if_list_entry *entry;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry(entry, pos, list, list) {
+        hlist_for_each_entry(entry, list, list) {
                 seq_printf(seq, "%pM,", entry->addr);
 
                 for (i = 0; i < packet->entries; i++)
@@ -218,17 +214,16 @@ static void batadv_vis_data_read_entries(struct seq_file *seq,
 static void batadv_vis_seq_print_text_bucket(struct seq_file *seq,
                                              const struct hlist_head *head)
 {
-        struct hlist_node *node;
         struct batadv_vis_info *info;
         struct batadv_vis_packet *packet;
         uint8_t *entries_pos;
         struct batadv_vis_info_entry *entries;
         struct batadv_vis_if_list_entry *entry;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
 
         HLIST_HEAD(vis_if_list);
 
-        hlist_for_each_entry_rcu(info, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(info, head, hash_entry) {
                 packet = (struct batadv_vis_packet *)info->skb_packet->data;
                 entries_pos = (uint8_t *)packet + sizeof(*packet);
                 entries = (struct batadv_vis_info_entry *)entries_pos;
@@ -240,7 +235,7 @@ static void batadv_vis_seq_print_text_bucket(struct seq_file *seq,
                 batadv_vis_data_read_entries(seq, &vis_if_list, packet,
                                              entries);
 
-                hlist_for_each_entry_safe(entry, pos, n, &vis_if_list, list) {
+                hlist_for_each_entry_safe(entry, n, &vis_if_list, list) {
                         hlist_del(&entry->list);
                         kfree(entry);
                 }
@@ -519,7 +514,6 @@ static int batadv_find_best_vis_server(struct batadv_priv *bat_priv,
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
         struct batadv_neigh_node *router;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_orig_node *orig_node;
         struct batadv_vis_packet *packet;
@@ -532,7 +526,7 @@ static int batadv_find_best_vis_server(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         router = batadv_orig_node_get_router(orig_node);
                         if (!router)
                                 continue;
@@ -571,7 +565,6 @@ static bool batadv_vis_packet_full(const struct batadv_vis_info *info)
 static int batadv_generate_vis_packet(struct batadv_priv *bat_priv)
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_orig_node *orig_node;
         struct batadv_neigh_node *router;
@@ -605,7 +598,7 @@ static int batadv_generate_vis_packet(struct batadv_priv *bat_priv)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         router = batadv_orig_node_get_router(orig_node);
                         if (!router)
                                 continue;
@@ -644,7 +637,7 @@ next:
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common_entry, node, head,
+                hlist_for_each_entry_rcu(tt_common_entry, head,
                                          hash_entry) {
                         packet_pos = skb_put(info->skb_packet, sizeof(*entry));
                         entry = (struct batadv_vis_info_entry *)packet_pos;
@@ -673,14 +666,14 @@ static void batadv_purge_vis_packets(struct batadv_priv *bat_priv)
 {
         uint32_t i;
         struct batadv_hashtable *hash = bat_priv->vis.hash;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         struct batadv_vis_info *info;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
 
-                hlist_for_each_entry_safe(info, node, node_tmp,
+                hlist_for_each_entry_safe(info, node_tmp,
                                           head, hash_entry) {
                         /* never purge own data. */
                         if (info == bat_priv->vis.my_info)
@@ -688,7 +681,7 @@ static void batadv_purge_vis_packets(struct batadv_priv *bat_priv)
 
                         if (batadv_has_timed_out(info->first_seen,
                                                  BATADV_VIS_TIMEOUT)) {
-                                hlist_del(node);
+                                hlist_del(&info->hash_entry);
                                 batadv_send_list_del(info);
                                 kref_put(&info->refcount, batadv_free_info);
                         }
@@ -700,7 +693,6 @@ static void batadv_broadcast_vis_packet(struct batadv_priv *bat_priv,
                                         struct batadv_vis_info *info)
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_orig_node *orig_node;
         struct batadv_vis_packet *packet;
@@ -715,7 +707,7 @@ static void batadv_broadcast_vis_packet(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         /* if it's a vis server and reachable, send it. */
                         if (!(orig_node->flags & BATADV_VIS_SERVER))
                                 continue;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 07f073935811..6a93614f2c49 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -70,14 +70,13 @@ static struct bt_sock_list hci_sk_list = {
 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct sk_buff *skb_copy = NULL;
 
         BT_DBG("hdev %p len %d", hdev, skb->len);
 
         read_lock(&hci_sk_list.lock);
 
-        sk_for_each(sk, node, &hci_sk_list.head) {
+        sk_for_each(sk, &hci_sk_list.head) {
                 struct hci_filter *flt;
                 struct sk_buff *nskb;
 
@@ -142,13 +141,12 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 void hci_send_to_control(struct sk_buff *skb, struct sock *skip_sk)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         BT_DBG("len %d", skb->len);
 
         read_lock(&hci_sk_list.lock);
 
-        sk_for_each(sk, node, &hci_sk_list.head) {
+        sk_for_each(sk, &hci_sk_list.head) {
                 struct sk_buff *nskb;
 
                 /* Skip the original socket */
@@ -176,7 +174,6 @@ void hci_send_to_control(struct sk_buff *skb, struct sock *skip_sk)
 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct sk_buff *skb_copy = NULL;
         __le16 opcode;
 
@@ -210,7 +207,7 @@ void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
 
         read_lock(&hci_sk_list.lock);
 
-        sk_for_each(sk, node, &hci_sk_list.head) {
+        sk_for_each(sk, &hci_sk_list.head) {
                 struct sk_buff *nskb;
 
                 if (sk->sk_state != BT_BOUND)
@@ -251,13 +248,12 @@ void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
 static void send_monitor_event(struct sk_buff *skb)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         BT_DBG("len %d", skb->len);
 
         read_lock(&hci_sk_list.lock);
 
-        sk_for_each(sk, node, &hci_sk_list.head) {
+        sk_for_each(sk, &hci_sk_list.head) {
                 struct sk_buff *nskb;
 
                 if (sk->sk_state != BT_BOUND)
@@ -393,11 +389,10 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event)
 
         if (event == HCI_DEV_UNREG) {
                 struct sock *sk;
-                struct hlist_node *node;
 
                 /* Detach sockets from device */
                 read_lock(&hci_sk_list.lock);
-                sk_for_each(sk, node, &hci_sk_list.head) {
+                sk_for_each(sk, &hci_sk_list.head) {
                         bh_lock_sock_nested(sk);
                         if (hci_pi(sk)->hdev == hdev) {
                                 hci_pi(sk)->hdev = NULL;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index ce3f6658f4b2..c23bae86263b 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -107,15 +107,14 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 {
         struct sock *sk = NULL;
-        struct hlist_node *node;
 
-        sk_for_each(sk, node, &rfcomm_sk_list.head) {
+        sk_for_each(sk, &rfcomm_sk_list.head) {
                 if (rfcomm_pi(sk)->channel == channel &&
                                 !bacmp(&bt_sk(sk)->src, src))
                         break;
         }
 
-        return node ? sk : NULL;
+        return sk ? sk : NULL;
 }
 
 /* Find socket with channel and source bdaddr.
@@ -124,11 +123,10 @@ static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 {
         struct sock *sk = NULL, *sk1 = NULL;
-        struct hlist_node *node;
 
         read_lock(&rfcomm_sk_list.lock);
 
-        sk_for_each(sk, node, &rfcomm_sk_list.head) {
+        sk_for_each(sk, &rfcomm_sk_list.head) {
                 if (state && sk->sk_state != state)
                         continue;
 
@@ -145,7 +143,7 @@ static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *
 
         read_unlock(&rfcomm_sk_list.lock);
 
-        return node ? sk : sk1;
+        return sk ? sk : sk1;
 }
 
 static void rfcomm_sock_destruct(struct sock *sk)
@@ -970,11 +968,10 @@ done:
 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         read_lock(&rfcomm_sk_list.lock);
 
-        sk_for_each(sk, node, &rfcomm_sk_list.head) {
+        sk_for_each(sk, &rfcomm_sk_list.head) {
                 seq_printf(f, "%pMR %pMR %d %d\n",
                            &bt_sk(sk)->src, &bt_sk(sk)->dst,
                            sk->sk_state, rfcomm_pi(sk)->channel);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index b5178d62064e..79d87d8d4f51 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -259,10 +259,9 @@ drop:
 /* -------- Socket interface ---------- */
 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
 {
-        struct hlist_node *node;
         struct sock *sk;
 
-        sk_for_each(sk, node, &sco_sk_list.head) {
+        sk_for_each(sk, &sco_sk_list.head) {
                 if (sk->sk_state != BT_LISTEN)
                         continue;
 
@@ -279,11 +278,10 @@ static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
 static struct sock *sco_get_sock_listen(bdaddr_t *src)
 {
         struct sock *sk = NULL, *sk1 = NULL;
-        struct hlist_node *node;
 
         read_lock(&sco_sk_list.lock);
 
-        sk_for_each(sk, node, &sco_sk_list.head) {
+        sk_for_each(sk, &sco_sk_list.head) {
                 if (sk->sk_state != BT_LISTEN)
                         continue;
 
@@ -298,7 +296,7 @@ static struct sock *sco_get_sock_listen(bdaddr_t *src)
 
         read_unlock(&sco_sk_list.lock);
 
-        return node ? sk : sk1;
+        return sk ? sk : sk1;
 }
 
 static void sco_sock_destruct(struct sock *sk)
@@ -951,14 +949,13 @@ static void sco_conn_ready(struct sco_conn *conn)
 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
 {
         struct sock *sk;
-        struct hlist_node *node;
         int lm = 0;
 
         BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
 
         /* Find listening sockets */
         read_lock(&sco_sk_list.lock);
-        sk_for_each(sk, node, &sco_sk_list.head) {
+        sk_for_each(sk, &sco_sk_list.head) {
                 if (sk->sk_state != BT_LISTEN)
                         continue;
 
@@ -1018,11 +1015,10 @@ drop:
 static int sco_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         read_lock(&sco_sk_list.lock);
 
-        sk_for_each(sk, node, &sco_sk_list.head) {
+        sk_for_each(sk, &sco_sk_list.head) {
                 seq_printf(f, "%pMR %pMR %d\n", &bt_sk(sk)->src,
                            &bt_sk(sk)->dst, sk->sk_state);
         }
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 8117900af4de..b0812c91c0f0 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -181,9 +181,9 @@ void br_fdb_cleanup(unsigned long _data)
         spin_lock(&br->hash_lock);
         for (i = 0; i < BR_HASH_SIZE; i++) {
                 struct net_bridge_fdb_entry *f;
-                struct hlist_node *h, *n;
+                struct hlist_node *n;
 
-                hlist_for_each_entry_safe(f, h, n, &br->hash[i], hlist) {
+                hlist_for_each_entry_safe(f, n, &br->hash[i], hlist) {
                         unsigned long this_timer;
                         if (f->is_static)
                                 continue;
@@ -207,8 +207,8 @@ void br_fdb_flush(struct net_bridge *br)
         spin_lock_bh(&br->hash_lock);
         for (i = 0; i < BR_HASH_SIZE; i++) {
                 struct net_bridge_fdb_entry *f;
-                struct hlist_node *h, *n;
-                hlist_for_each_entry_safe(f, h, n, &br->hash[i], hlist) {
+                struct hlist_node *n;
+                hlist_for_each_entry_safe(f, n, &br->hash[i], hlist) {
                         if (!f->is_static)
                                 fdb_delete(br, f);
                 }
@@ -266,10 +266,9 @@ struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
                                           const unsigned char *addr,
                                           __u16 vid)
 {
-        struct hlist_node *h;
         struct net_bridge_fdb_entry *fdb;
 
-        hlist_for_each_entry_rcu(fdb, h,
+        hlist_for_each_entry_rcu(fdb,
                                 &br->hash[br_mac_hash(addr, vid)], hlist) {
                 if (ether_addr_equal(fdb->addr.addr, addr) &&
                     fdb->vlan_id == vid) {
@@ -315,14 +314,13 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf,
 {
         struct __fdb_entry *fe = buf;
         int i, num = 0;
-        struct hlist_node *h;
         struct net_bridge_fdb_entry *f;
 
         memset(buf, 0, maxnum*sizeof(struct __fdb_entry));
 
         rcu_read_lock();
         for (i = 0; i < BR_HASH_SIZE; i++) {
-                hlist_for_each_entry_rcu(f, h, &br->hash[i], hlist) {
+                hlist_for_each_entry_rcu(f, &br->hash[i], hlist) {
                         if (num >= maxnum)
                                 goto out;
 
@@ -363,10 +361,9 @@ static struct net_bridge_fdb_entry *fdb_find(struct hlist_head *head,
                                              const unsigned char *addr,
                                              __u16 vid)
 {
-        struct hlist_node *h;
         struct net_bridge_fdb_entry *fdb;
 
-        hlist_for_each_entry(fdb, h, head, hlist) {
+        hlist_for_each_entry(fdb, head, hlist) {
                 if (ether_addr_equal(fdb->addr.addr, addr) &&
                     fdb->vlan_id == vid)
                         return fdb;
@@ -378,10 +375,9 @@ static struct net_bridge_fdb_entry *fdb_find_rcu(struct hlist_head *head,
                                                  const unsigned char *addr,
                                                  __u16 vid)
 {
-        struct hlist_node *h;
         struct net_bridge_fdb_entry *fdb;
 
-        hlist_for_each_entry_rcu(fdb, h, head, hlist) {
+        hlist_for_each_entry_rcu(fdb, head, hlist) {
                 if (ether_addr_equal(fdb->addr.addr, addr) &&
                     fdb->vlan_id == vid)
                         return fdb;
@@ -593,10 +589,9 @@ int br_fdb_dump(struct sk_buff *skb,
                 goto out;
 
         for (i = 0; i < BR_HASH_SIZE; i++) {
-                struct hlist_node *h;
                 struct net_bridge_fdb_entry *f;
 
-                hlist_for_each_entry_rcu(f, h, &br->hash[i], hlist) {
+                hlist_for_each_entry_rcu(f, &br->hash[i], hlist) {
                         if (idx < cb->args[0])
                                 goto skip;
 
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 38991e03646d..9f97b850fc65 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -18,7 +18,6 @@ static int br_rports_fill_info(struct sk_buff *skb, struct netlink_callback *cb,
 {
         struct net_bridge *br = netdev_priv(dev);
         struct net_bridge_port *p;
-        struct hlist_node *n;
         struct nlattr *nest;
 
         if (!br->multicast_router || hlist_empty(&br->router_list))
@@ -28,7 +27,7 @@ static int br_rports_fill_info(struct sk_buff *skb, struct netlink_callback *cb,
         if (nest == NULL)
                 return -EMSGSIZE;
 
-        hlist_for_each_entry_rcu(p, n, &br->router_list, rlist) {
+        hlist_for_each_entry_rcu(p, &br->router_list, rlist) {
                 if (p && nla_put_u32(skb, MDBA_ROUTER_PORT, p->dev->ifindex))
                         goto fail;
         }
@@ -61,12 +60,11 @@ static int br_mdb_fill_info(struct sk_buff *skb, struct netlink_callback *cb,
                 return -EMSGSIZE;
 
         for (i = 0; i < mdb->max; i++) {
-                struct hlist_node *h;
                 struct net_bridge_mdb_entry *mp;
                 struct net_bridge_port_group *p, **pp;
                 struct net_bridge_port *port;
 
-                hlist_for_each_entry_rcu(mp, h, &mdb->mhash[i], hlist[mdb->ver]) {
+                hlist_for_each_entry_rcu(mp, &mdb->mhash[i], hlist[mdb->ver]) {
                         if (idx < s_idx)
                                 goto skip;
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 7d886b0a8b7b..10e6fce1bb62 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -86,9 +86,8 @@ static struct net_bridge_mdb_entry *__br_mdb_ip_get(
         struct net_bridge_mdb_htable *mdb, struct br_ip *dst, int hash)
 {
         struct net_bridge_mdb_entry *mp;
-        struct hlist_node *p;
 
-        hlist_for_each_entry_rcu(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
+        hlist_for_each_entry_rcu(mp, &mdb->mhash[hash], hlist[mdb->ver]) {
                 if (br_ip_equal(&mp->addr, dst))
                         return mp;
         }
@@ -178,13 +177,12 @@ static int br_mdb_copy(struct net_bridge_mdb_htable *new,
                        int elasticity)
 {
         struct net_bridge_mdb_entry *mp;
-        struct hlist_node *p;
         int maxlen;
         int len;
         int i;
 
         for (i = 0; i < old->max; i++)
-                hlist_for_each_entry(mp, p, &old->mhash[i], hlist[old->ver])
+                hlist_for_each_entry(mp, &old->mhash[i], hlist[old->ver])
                         hlist_add_head(&mp->hlist[new->ver],
                                        &new->mhash[br_ip_hash(new, &mp->addr)]);
 
@@ -194,7 +192,7 @@ static int br_mdb_copy(struct net_bridge_mdb_htable *new,
         maxlen = 0;
         for (i = 0; i < new->max; i++) {
                 len = 0;
-                hlist_for_each_entry(mp, p, &new->mhash[i], hlist[new->ver])
+                hlist_for_each_entry(mp, &new->mhash[i], hlist[new->ver])
                         len++;
                 if (len > maxlen)
                         maxlen = len;
@@ -510,14 +508,13 @@ static struct net_bridge_mdb_entry *br_multicast_get_group(
 {
         struct net_bridge_mdb_htable *mdb;
         struct net_bridge_mdb_entry *mp;
-        struct hlist_node *p;
         unsigned int count = 0;
         unsigned int max;
         int elasticity;
         int err;
 
         mdb = rcu_dereference_protected(br->mdb, 1);
-        hlist_for_each_entry(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
+        hlist_for_each_entry(mp, &mdb->mhash[hash], hlist[mdb->ver]) {
                 count++;
                 if (unlikely(br_ip_equal(group, &mp->addr)))
                         return mp;
@@ -882,10 +879,10 @@ void br_multicast_disable_port(struct net_bridge_port *port)
 {
         struct net_bridge *br = port->br;
         struct net_bridge_port_group *pg;
-        struct hlist_node *p, *n;
+        struct hlist_node *n;
 
         spin_lock(&br->multicast_lock);
-        hlist_for_each_entry_safe(pg, p, n, &port->mglist, mglist)
+        hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
                 br_multicast_del_pg(br, pg);
 
         if (!hlist_unhashed(&port->rlist))
@@ -1025,12 +1022,12 @@ static void br_multicast_add_router(struct net_bridge *br,
                                     struct net_bridge_port *port)
 {
         struct net_bridge_port *p;
-        struct hlist_node *n, *slot = NULL;
+        struct hlist_node *slot = NULL;
 
-        hlist_for_each_entry(p, n, &br->router_list, rlist) {
+        hlist_for_each_entry(p, &br->router_list, rlist) {
                 if ((unsigned long) port >= (unsigned long) p)
                         break;
-                slot = n;
+                slot = &p->rlist;
         }
 
         if (slot)
@@ -1653,7 +1650,7 @@ void br_multicast_stop(struct net_bridge *br)
 {
         struct net_bridge_mdb_htable *mdb;
         struct net_bridge_mdb_entry *mp;
-        struct hlist_node *p, *n;
+        struct hlist_node *n;
         u32 ver;
         int i;
 
@@ -1670,7 +1667,7 @@ void br_multicast_stop(struct net_bridge *br)
 
         ver = mdb->ver;
         for (i = 0; i < mdb->max; i++) {
-                hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
+                hlist_for_each_entry_safe(mp, n, &mdb->mhash[i],
                                           hlist[ver]) {
                         del_timer(&mp->timer);
                         call_rcu_bh(&mp->rcu, br_multicast_free_group);
diff --git a/net/can/af_can.c b/net/can/af_can.c
index ddac1ee2ed20..c48e5220bbac 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -516,7 +516,6 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
 {
         struct receiver *r = NULL;
         struct hlist_head *rl;
-        struct hlist_node *next;
         struct dev_rcv_lists *d;
 
         if (dev && dev->type != ARPHRD_CAN)
@@ -540,7 +539,7 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
          * been registered before.
          */
 
-        hlist_for_each_entry_rcu(r, next, rl, list) {
+        hlist_for_each_entry_rcu(r, rl, list) {
                 if (r->can_id == can_id && r->mask == mask &&
                     r->func == func && r->data == data)
                         break;
@@ -552,7 +551,7 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
          * will be NULL, while r will point to the last item of the list.
          */
 
-        if (!next) {
+        if (!r) {
                 printk(KERN_ERR "BUG: receive list entry not found for "
                        "dev %s, id %03X, mask %03X\n",
                        DNAME(dev), can_id, mask);
@@ -590,7 +589,6 @@ static inline void deliver(struct sk_buff *skb, struct receiver *r)
 static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
 {
         struct receiver *r;
-        struct hlist_node *n;
         int matches = 0;
         struct can_frame *cf = (struct can_frame *)skb->data;
         canid_t can_id = cf->can_id;
@@ -600,7 +598,7 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
 
         if (can_id & CAN_ERR_FLAG) {
                 /* check for error message frame entries only */
-                hlist_for_each_entry_rcu(r, n, &d->rx[RX_ERR], list) {
+                hlist_for_each_entry_rcu(r, &d->rx[RX_ERR], list) {
                         if (can_id & r->mask) {
                                 deliver(skb, r);
                                 matches++;
@@ -610,13 +608,13 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
         }
 
         /* check for unfiltered entries */
-        hlist_for_each_entry_rcu(r, n, &d->rx[RX_ALL], list) {
+        hlist_for_each_entry_rcu(r, &d->rx[RX_ALL], list) {
                 deliver(skb, r);
                 matches++;
         }
 
         /* check for can_id/mask entries */
-        hlist_for_each_entry_rcu(r, n, &d->rx[RX_FIL], list) {
+        hlist_for_each_entry_rcu(r, &d->rx[RX_FIL], list) {
                 if ((can_id & r->mask) == r->can_id) {
                         deliver(skb, r);
                         matches++;
@@ -624,7 +622,7 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
         }
 
         /* check for inverted can_id/mask entries */
-        hlist_for_each_entry_rcu(r, n, &d->rx[RX_INV], list) {
+        hlist_for_each_entry_rcu(r, &d->rx[RX_INV], list) {
                 if ((can_id & r->mask) != r->can_id) {
                         deliver(skb, r);
                         matches++;
@@ -636,7 +634,7 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
                 return matches;
 
         if (can_id & CAN_EFF_FLAG) {
-                hlist_for_each_entry_rcu(r, n, &d->rx[RX_EFF], list) {
+                hlist_for_each_entry_rcu(r, &d->rx[RX_EFF], list) {
                         if (r->can_id == can_id) {
                                 deliver(skb, r);
                                 matches++;
@@ -644,7 +642,7 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
                 }
         } else {
                 can_id &= CAN_SFF_MASK;
-                hlist_for_each_entry_rcu(r, n, &d->rx_sff[can_id], list) {
+                hlist_for_each_entry_rcu(r, &d->rx_sff[can_id], list) {
                         deliver(skb, r);
                         matches++;
                 }
diff --git a/net/can/gw.c b/net/can/gw.c
index c185fcd5e828..2d117dc5ebea 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -457,11 +457,11 @@ static int cgw_notifier(struct notifier_block *nb,
         if (msg == NETDEV_UNREGISTER) {
 
                 struct cgw_job *gwj = NULL;
-                struct hlist_node *n, *nx;
+                struct hlist_node *nx;
 
                 ASSERT_RTNL();
 
-                hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
+                hlist_for_each_entry_safe(gwj, nx, &cgw_list, list) {
 
                         if (gwj->src.dev == dev || gwj->dst.dev == dev) {
                                 hlist_del(&gwj->list);
@@ -575,12 +575,11 @@ cancel:
 static int cgw_dump_jobs(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct cgw_job *gwj = NULL;
-        struct hlist_node *n;
         int idx = 0;
         int s_idx = cb->args[0];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(gwj, n, &cgw_list, list) {
+        hlist_for_each_entry_rcu(gwj, &cgw_list, list) {
                 if (idx < s_idx)
                         goto cont;
 
@@ -858,11 +857,11 @@ out:
 static void cgw_remove_all_jobs(void)
 {
         struct cgw_job *gwj = NULL;
-        struct hlist_node *n, *nx;
+        struct hlist_node *nx;
 
         ASSERT_RTNL();
 
-        hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
+        hlist_for_each_entry_safe(gwj, nx, &cgw_list, list) {
                 hlist_del(&gwj->list);
                 cgw_unregister_filter(gwj);
                 kfree(gwj);
@@ -872,7 +871,7 @@ static void cgw_remove_all_jobs(void)
 static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
 {
         struct cgw_job *gwj = NULL;
-        struct hlist_node *n, *nx;
+        struct hlist_node *nx;
         struct rtcanmsg *r;
         struct cf_mod mod;
         struct can_can_gw ccgw;
@@ -907,7 +906,7 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
         ASSERT_RTNL();
 
         /* remove only the first matching entry */
-        hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
+        hlist_for_each_entry_safe(gwj, nx, &cgw_list, list) {
 
                 if (gwj->flags != r->flags)
                         continue;
diff --git a/net/can/proc.c b/net/can/proc.c
index 497335892146..1ab8c888f102 100644
--- a/net/can/proc.c
+++ b/net/can/proc.c
@@ -195,9 +195,8 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
                               struct net_device *dev)
 {
         struct receiver *r;
-        struct hlist_node *n;
 
-        hlist_for_each_entry_rcu(r, n, rx_list, list) {
+        hlist_for_each_entry_rcu(r, rx_list, list) {
                 char *fmt = (r->can_id & CAN_EFF_FLAG)?
                         "   %-5s  %08x  %08x  %pK  %pK  %8ld  %s\n" :
                         "   %-5s     %03x    %08x  %pK  %pK  %8ld  %s\n";
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index ee71ea26777a..e65e6e4be38b 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -15,6 +15,8 @@
 #include <linux/slab.h>
 #include <linux/statfs.h>
 #include <linux/string.h>
+#include <linux/nsproxy.h>
+#include <net/net_namespace.h>
 
 
 #include <linux/ceph/ceph_features.h>
@@ -26,6 +28,22 @@
 #include "crypto.h"
 
 
+/*
+ * Module compatibility interface.  For now it doesn't do anything,
+ * but its existence signals a certain level of functionality.
+ *
+ * The data buffer is used to pass information both to and from
+ * libceph.  The return value indicates whether libceph determines
+ * it is compatible with the caller (from another kernel module),
+ * given the provided data.
+ *
+ * The data pointer can be null.
+ */
+bool libceph_compatible(void *data)
+{
+        return true;
+}
+EXPORT_SYMBOL(libceph_compatible);
 
 /*
  * find filename portion of a path (/foo/bar/baz -> baz)
@@ -292,6 +310,9 @@ ceph_parse_options(char *options, const char *dev_name,
         int err = -ENOMEM;
         substring_t argstr[MAX_OPT_ARGS];
 
+        if (current->nsproxy->net_ns != &init_net)
+                return ERR_PTR(-EINVAL);
+
         opt = kzalloc(sizeof(*opt), GFP_KERNEL);
         if (!opt)
                 return ERR_PTR(-ENOMEM);
@@ -585,10 +606,8 @@ static int __init init_ceph_lib(void)
         if (ret < 0)
                 goto out_crypto;
 
-        pr_info("loaded (mon/osd proto %d/%d, osdmap %d/%d %d/%d)\n",
-                CEPH_MONC_PROTOCOL, CEPH_OSDC_PROTOCOL,
-                CEPH_OSDMAP_VERSION, CEPH_OSDMAP_VERSION_EXT,
-                CEPH_OSDMAP_INC_VERSION, CEPH_OSDMAP_INC_VERSION_EXT);
+        pr_info("loaded (mon/osd proto %d/%d)\n",
+                CEPH_MONC_PROTOCOL, CEPH_OSDC_PROTOCOL);
 
         return 0;
 
diff --git a/net/ceph/ceph_strings.c b/net/ceph/ceph_strings.c
index 3fbda04de29c..1348df96fe15 100644
--- a/net/ceph/ceph_strings.c
+++ b/net/ceph/ceph_strings.c
@@ -21,9 +21,15 @@ const char *ceph_osd_op_name(int op)
         switch (op) {
         case CEPH_OSD_OP_READ: return "read";
         case CEPH_OSD_OP_STAT: return "stat";
+        case CEPH_OSD_OP_MAPEXT: return "mapext";
+        case CEPH_OSD_OP_SPARSE_READ: return "sparse-read";
+        case CEPH_OSD_OP_NOTIFY: return "notify";
+        case CEPH_OSD_OP_NOTIFY_ACK: return "notify-ack";
+        case CEPH_OSD_OP_ASSERT_VER: return "assert-version";
 
         case CEPH_OSD_OP_MASKTRUNC: return "masktrunc";
 
+        case CEPH_OSD_OP_CREATE: return "create";
         case CEPH_OSD_OP_WRITE: return "write";
         case CEPH_OSD_OP_DELETE: return "delete";
         case CEPH_OSD_OP_TRUNCATE: return "truncate";
@@ -39,6 +45,11 @@ const char *ceph_osd_op_name(int op)
         case CEPH_OSD_OP_TMAPUP: return "tmapup";
         case CEPH_OSD_OP_TMAPGET: return "tmapget";
         case CEPH_OSD_OP_TMAPPUT: return "tmapput";
+        case CEPH_OSD_OP_WATCH: return "watch";
+
+        case CEPH_OSD_OP_CLONERANGE: return "clonerange";
+        case CEPH_OSD_OP_ASSERT_SRC_VERSION: return "assert-src-version";
+        case CEPH_OSD_OP_SRC_CMPXATTR: return "src-cmpxattr";
 
         case CEPH_OSD_OP_GETXATTR: return "getxattr";
         case CEPH_OSD_OP_GETXATTRS: return "getxattrs";
@@ -53,6 +64,10 @@ const char *ceph_osd_op_name(int op)
         case CEPH_OSD_OP_BALANCEREADS: return "balance-reads";
         case CEPH_OSD_OP_UNBALANCEREADS: return "unbalance-reads";
         case CEPH_OSD_OP_SCRUB: return "scrub";
+        case CEPH_OSD_OP_SCRUB_RESERVE: return "scrub-reserve";
+        case CEPH_OSD_OP_SCRUB_UNRESERVE: return "scrub-unreserve";
+        case CEPH_OSD_OP_SCRUB_STOP: return "scrub-stop";
+        case CEPH_OSD_OP_SCRUB_MAP: return "scrub-map";
 
         case CEPH_OSD_OP_WRLOCK: return "wrlock";
         case CEPH_OSD_OP_WRUNLOCK: return "wrunlock";
@@ -64,10 +79,34 @@ const char *ceph_osd_op_name(int op)
         case CEPH_OSD_OP_CALL: return "call";
 
         case CEPH_OSD_OP_PGLS: return "pgls";
+        case CEPH_OSD_OP_PGLS_FILTER: return "pgls-filter";
+        case CEPH_OSD_OP_OMAPGETKEYS: return "omap-get-keys";
+        case CEPH_OSD_OP_OMAPGETVALS: return "omap-get-vals";
+        case CEPH_OSD_OP_OMAPGETHEADER: return "omap-get-header";
+        case CEPH_OSD_OP_OMAPGETVALSBYKEYS: return "omap-get-vals-by-keys";
+        case CEPH_OSD_OP_OMAPSETVALS: return "omap-set-vals";
+        case CEPH_OSD_OP_OMAPSETHEADER: return "omap-set-header";
+        case CEPH_OSD_OP_OMAPCLEAR: return "omap-clear";
+        case CEPH_OSD_OP_OMAPRMKEYS: return "omap-rm-keys";
         }
         return "???";
 }
 
+const char *ceph_osd_state_name(int s)
+{
+        switch (s) {
+        case CEPH_OSD_EXISTS:
+                return "exists";
+        case CEPH_OSD_UP:
+                return "up";
+        case CEPH_OSD_AUTOOUT:
+                return "autoout";
+        case CEPH_OSD_NEW:
+                return "new";
+        default:
+                return "???";
+        }
+}
 
 const char *ceph_pool_op_name(int op)
 {
diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c
index 35fce755ce10..cbd06a91941c 100644
--- a/net/ceph/crush/mapper.c
+++ b/net/ceph/crush/mapper.c
@@ -287,6 +287,7 @@ static int is_out(const struct crush_map *map, const __u32 *weight, int item, in
  * @outpos: our position in that vector
  * @firstn: true if choosing "first n" items, false if choosing "indep"
  * @recurse_to_leaf: true if we want one device under each item of given type
+ * @descend_once: true if we should only try one descent before giving up
  * @out2: second output vector for leaf items (if @recurse_to_leaf)
  */
 static int crush_choose(const struct crush_map *map,
@@ -295,7 +296,7 @@ static int crush_choose(const struct crush_map *map,
                         int x, int numrep, int type,
                         int *out, int outpos,
                         int firstn, int recurse_to_leaf,
-                        int *out2)
+                        int descend_once, int *out2)
 {
         int rep;
         unsigned int ftotal, flocal;
@@ -391,7 +392,7 @@ static int crush_choose(const struct crush_map *map,
                                 }
 
                                 reject = 0;
-                                if (recurse_to_leaf) {
+                                if (!collide && recurse_to_leaf) {
                                         if (item < 0) {
                                                 if (crush_choose(map,
                                                          map->buckets[-1-item],
@@ -399,6 +400,7 @@ static int crush_choose(const struct crush_map *map,
                                                          x, outpos+1, 0,
                                                          out2, outpos,
                                                          firstn, 0,
+                                                         map->chooseleaf_descend_once,
                                                          NULL) <= outpos)
                                                         /* didn't get leaf */
                                                         reject = 1;
@@ -422,7 +424,10 @@ reject:
                                         ftotal++;
                                         flocal++;
 
-                                        if (collide && flocal <= map->choose_local_tries)
+                                        if (reject && descend_once)
+                                                /* let outer call try again */
+                                                skip_rep = 1;
+                                        else if (collide && flocal <= map->choose_local_tries)
                                                 /* retry locally a few times */
                                                 retry_bucket = 1;
                                         else if (map->choose_local_fallback_tries > 0 &&
@@ -485,6 +490,7 @@ int crush_do_rule(const struct crush_map *map,
         int i, j;
         int numrep;
         int firstn;
+        const int descend_once = 0;
 
         if ((__u32)ruleno >= map->max_rules) {
                 dprintk(" bad ruleno %d\n", ruleno);
@@ -544,7 +550,8 @@ int crush_do_rule(const struct crush_map *map,
                                                       curstep->arg2,
                                                       o+osize, j,
                                                       firstn,
-                                                      recurse_to_leaf, c+osize);
+                                                      recurse_to_leaf,
+                                                      descend_once, c+osize);
                         }
 
                         if (recurse_to_leaf)
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index af14cb425164..6e7a236525b6 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -423,7 +423,8 @@ int ceph_encrypt2(struct ceph_crypto_key *secret, void *dst, size_t *dst_len,
         }
 }
 
-int ceph_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
+static int ceph_key_instantiate(struct key *key,
+                                struct key_preparsed_payload *prep)
 {
         struct ceph_crypto_key *ckey;
         size_t datalen = prep->datalen;
@@ -458,12 +459,12 @@ err:
         return ret;
 }
 
-int ceph_key_match(const struct key *key, const void *description)
+static int ceph_key_match(const struct key *key, const void *description)
 {
         return strcmp(key->description, description) == 0;
 }
 
-void ceph_key_destroy(struct key *key) {
+static void ceph_key_destroy(struct key *key) {
         struct ceph_crypto_key *ckey = key->payload.data;
 
         ceph_crypto_key_destroy(ckey);
diff --git a/net/ceph/debugfs.c b/net/ceph/debugfs.c
index 38b5dc1823d4..00d051f4894e 100644
--- a/net/ceph/debugfs.c
+++ b/net/ceph/debugfs.c
@@ -66,9 +66,9 @@ static int osdmap_show(struct seq_file *s, void *p)
         for (n = rb_first(&client->osdc.osdmap->pg_pools); n; n = rb_next(n)) {
                 struct ceph_pg_pool_info *pool =
                         rb_entry(n, struct ceph_pg_pool_info, node);
-                seq_printf(s, "pg_pool %d pg_num %d / %d, lpg_num %d / %d\n",
-                           pool->id, pool->v.pg_num, pool->pg_num_mask,
-                           pool->v.lpg_num, pool->lpg_num_mask);
+                seq_printf(s, "pg_pool %llu pg_num %d / %d\n",
+                           (unsigned long long)pool->id, pool->pg_num,
+                           pool->pg_num_mask);
         }
         for (i = 0; i < client->osdc.osdmap->max_osd; i++) {
                 struct ceph_entity_addr *addr =
@@ -123,26 +123,16 @@ static int osdc_show(struct seq_file *s, void *pp)
         mutex_lock(&osdc->request_mutex);
         for (p = rb_first(&osdc->requests); p; p = rb_next(p)) {
                 struct ceph_osd_request *req;
-                struct ceph_osd_request_head *head;
-                struct ceph_osd_op *op;
-                int num_ops;
-                int opcode, olen;
+                int opcode;
                 int i;
 
                 req = rb_entry(p, struct ceph_osd_request, r_node);
 
-                seq_printf(s, "%lld\tosd%d\t%d.%x\t", req->r_tid,
+                seq_printf(s, "%lld\tosd%d\t%lld.%x\t", req->r_tid,
                            req->r_osd ? req->r_osd->o_osd : -1,
-                           le32_to_cpu(req->r_pgid.pool),
-                           le16_to_cpu(req->r_pgid.ps));
+                           req->r_pgid.pool, req->r_pgid.seed);
 
-                head = req->r_request->front.iov_base;
-                op = (void *)(head + 1);
-
-                num_ops = le16_to_cpu(head->num_ops);
-                olen = le32_to_cpu(head->object_len);
-                seq_printf(s, "%.*s", olen,
-                           (const char *)(head->ops + num_ops));
+                seq_printf(s, "%.*s", req->r_oid_len, req->r_oid);
 
                 if (req->r_reassert_version.epoch)
                         seq_printf(s, "\t%u'%llu",
@@ -151,10 +141,9 @@ static int osdc_show(struct seq_file *s, void *pp)
                 else
                         seq_printf(s, "\t");
 
-                for (i = 0; i < num_ops; i++) {
-                        opcode = le16_to_cpu(op->op);
+                for (i = 0; i < req->r_num_ops; i++) {
+                        opcode = le16_to_cpu(req->r_request_ops[i].op);
                         seq_printf(s, "\t%s", ceph_osd_op_name(opcode));
-                        op++;
                 }
 
                 seq_printf(s, "\n");
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 5ccf87ed8d68..2c0669fb54e3 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -9,8 +9,9 @@
 #include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/string.h>
+#ifdef  CONFIG_BLOCK
 #include <linux/bio.h>
-#include <linux/blkdev.h>
+#endif  /* CONFIG_BLOCK */
 #include <linux/dns_resolver.h>
 #include <net/tcp.h>
 
@@ -97,6 +98,57 @@
 #define CON_FLAG_SOCK_CLOSED       3  /* socket state changed to closed */
 #define CON_FLAG_BACKOFF           4  /* need to retry queuing delayed work */
 
+static bool con_flag_valid(unsigned long con_flag)
+{
+        switch (con_flag) {
+        case CON_FLAG_LOSSYTX:
+        case CON_FLAG_KEEPALIVE_PENDING:
+        case CON_FLAG_WRITE_PENDING:
+        case CON_FLAG_SOCK_CLOSED:
+        case CON_FLAG_BACKOFF:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static void con_flag_clear(struct ceph_connection *con, unsigned long con_flag)
+{
+        BUG_ON(!con_flag_valid(con_flag));
+
+        clear_bit(con_flag, &con->flags);
+}
+
+static void con_flag_set(struct ceph_connection *con, unsigned long con_flag)
+{
+        BUG_ON(!con_flag_valid(con_flag));
+
+        set_bit(con_flag, &con->flags);
+}
+
+static bool con_flag_test(struct ceph_connection *con, unsigned long con_flag)
+{
+        BUG_ON(!con_flag_valid(con_flag));
+
+        return test_bit(con_flag, &con->flags);
+}
+
+static bool con_flag_test_and_clear(struct ceph_connection *con,
+                                        unsigned long con_flag)
+{
+        BUG_ON(!con_flag_valid(con_flag));
+
+        return test_and_clear_bit(con_flag, &con->flags);
+}
+
+static bool con_flag_test_and_set(struct ceph_connection *con,
+                                        unsigned long con_flag)
+{
+        BUG_ON(!con_flag_valid(con_flag));
+
+        return test_and_set_bit(con_flag, &con->flags);
+}
+
 /* static tag bytes (protocol control messages) */
 static char tag_msg = CEPH_MSGR_TAG_MSG;
 static char tag_ack = CEPH_MSGR_TAG_ACK;
@@ -114,7 +166,7 @@ static struct lock_class_key socket_class;
 
 static void queue_con(struct ceph_connection *con);
 static void con_work(struct work_struct *);
-static void ceph_fault(struct ceph_connection *con);
+static void con_fault(struct ceph_connection *con);
 
 /*
  * Nicely render a sockaddr as a string.  An array of formatted
@@ -171,7 +223,7 @@ static void encode_my_addr(struct ceph_messenger *msgr)
  */
 static struct workqueue_struct *ceph_msgr_wq;
 
-void _ceph_msgr_exit(void)
+static void _ceph_msgr_exit(void)
 {
         if (ceph_msgr_wq) {
                 destroy_workqueue(ceph_msgr_wq);
@@ -308,7 +360,7 @@ static void ceph_sock_write_space(struct sock *sk)
          * buffer. See net/ipv4/tcp_input.c:tcp_check_space()
          * and net/core/stream.c:sk_stream_write_space().
          */
-        if (test_bit(CON_FLAG_WRITE_PENDING, &con->flags)) {
+        if (con_flag_test(con, CON_FLAG_WRITE_PENDING)) {
                 if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk)) {
                         dout("%s %p queueing write work\n", __func__, con);
                         clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
@@ -333,7 +385,7 @@ static void ceph_sock_state_change(struct sock *sk)
         case TCP_CLOSE_WAIT:
                 dout("%s TCP_CLOSE_WAIT\n", __func__);
                 con_sock_state_closing(con);
-                set_bit(CON_FLAG_SOCK_CLOSED, &con->flags);
+                con_flag_set(con, CON_FLAG_SOCK_CLOSED);
                 queue_con(con);
                 break;
         case TCP_ESTABLISHED:
@@ -474,7 +526,7 @@ static int con_close_socket(struct ceph_connection *con)
          * received a socket close event before we had the chance to
          * shut the socket down.
          */
-        clear_bit(CON_FLAG_SOCK_CLOSED, &con->flags);
+        con_flag_clear(con, CON_FLAG_SOCK_CLOSED);
 
         con_sock_state_closed(con);
         return rc;
@@ -538,11 +590,10 @@ void ceph_con_close(struct ceph_connection *con)
              ceph_pr_addr(&con->peer_addr.in_addr));
         con->state = CON_STATE_CLOSED;
 
-        clear_bit(CON_FLAG_LOSSYTX, &con->flags); /* so we retry next connect */
-        clear_bit(CON_FLAG_KEEPALIVE_PENDING, &con->flags);
-        clear_bit(CON_FLAG_WRITE_PENDING, &con->flags);
-        clear_bit(CON_FLAG_KEEPALIVE_PENDING, &con->flags);
-        clear_bit(CON_FLAG_BACKOFF, &con->flags);
+        con_flag_clear(con, CON_FLAG_LOSSYTX);  /* so we retry next connect */
+        con_flag_clear(con, CON_FLAG_KEEPALIVE_PENDING);
+        con_flag_clear(con, CON_FLAG_WRITE_PENDING);
+        con_flag_clear(con, CON_FLAG_BACKOFF);
 
         reset_connection(con);
         con->peer_global_seq = 0;
@@ -798,7 +849,7 @@ static void prepare_write_message(struct ceph_connection *con)
                 /* no, queue up footer too and be done */
                 prepare_write_message_footer(con);
 
-        set_bit(CON_FLAG_WRITE_PENDING, &con->flags);
+        con_flag_set(con, CON_FLAG_WRITE_PENDING);
 }
 
 /*
@@ -819,7 +870,7 @@ static void prepare_write_ack(struct ceph_connection *con)
                                 &con->out_temp_ack);
 
         con->out_more = 1;  /* more will follow.. eventually.. */
-        set_bit(CON_FLAG_WRITE_PENDING, &con->flags);
+        con_flag_set(con, CON_FLAG_WRITE_PENDING);
 }
 
 /*
@@ -830,7 +881,7 @@ static void prepare_write_keepalive(struct ceph_connection *con)
         dout("prepare_write_keepalive %p\n", con);
         con_out_kvec_reset(con);
         con_out_kvec_add(con, sizeof (tag_keepalive), &tag_keepalive);
-        set_bit(CON_FLAG_WRITE_PENDING, &con->flags);
+        con_flag_set(con, CON_FLAG_WRITE_PENDING);
 }
 
 /*
@@ -873,7 +924,7 @@ static void prepare_write_banner(struct ceph_connection *con)
                                         &con->msgr->my_enc_addr);
 
         con->out_more = 0;
-        set_bit(CON_FLAG_WRITE_PENDING, &con->flags);
+        con_flag_set(con, CON_FLAG_WRITE_PENDING);
 }
 
 static int prepare_write_connect(struct ceph_connection *con)
@@ -923,7 +974,7 @@ static int prepare_write_connect(struct ceph_connection *con)
                                         auth->authorizer_buf);
 
         con->out_more = 0;
-        set_bit(CON_FLAG_WRITE_PENDING, &con->flags);
+        con_flag_set(con, CON_FLAG_WRITE_PENDING);
 
         return 0;
 }
@@ -1643,7 +1694,7 @@ static int process_connect(struct ceph_connection *con)
                         le32_to_cpu(con->in_reply.connect_seq));
 
                 if (con->in_reply.flags & CEPH_MSG_CONNECT_LOSSY)
-                        set_bit(CON_FLAG_LOSSYTX, &con->flags);
+                        con_flag_set(con, CON_FLAG_LOSSYTX);
 
                 con->delay = 0;      /* reset backoff memory */
 
@@ -2080,15 +2131,14 @@ do_next:
                         prepare_write_ack(con);
                         goto more;
                 }
-                if (test_and_clear_bit(CON_FLAG_KEEPALIVE_PENDING,
-                                       &con->flags)) {
+                if (con_flag_test_and_clear(con, CON_FLAG_KEEPALIVE_PENDING)) {
                         prepare_write_keepalive(con);
                         goto more;
                 }
         }
 
         /* Nothing to do! */
-        clear_bit(CON_FLAG_WRITE_PENDING, &con->flags);
+        con_flag_clear(con, CON_FLAG_WRITE_PENDING);
         dout("try_write nothing else to write.\n");
         ret = 0;
 out:
@@ -2268,7 +2318,7 @@ static void queue_con(struct ceph_connection *con)
 
 static bool con_sock_closed(struct ceph_connection *con)
 {
-        if (!test_and_clear_bit(CON_FLAG_SOCK_CLOSED, &con->flags))
+        if (!con_flag_test_and_clear(con, CON_FLAG_SOCK_CLOSED))
                 return false;
 
 #define CASE(x)                                                         \
@@ -2295,6 +2345,41 @@ static bool con_sock_closed(struct ceph_connection *con)
         return true;
 }
 
+static bool con_backoff(struct ceph_connection *con)
+{
+        int ret;
+
+        if (!con_flag_test_and_clear(con, CON_FLAG_BACKOFF))
+                return false;
+
+        ret = queue_con_delay(con, round_jiffies_relative(con->delay));
+        if (ret) {
+                dout("%s: con %p FAILED to back off %lu\n", __func__,
+                        con, con->delay);
+                BUG_ON(ret == -ENOENT);
+                con_flag_set(con, CON_FLAG_BACKOFF);
+        }
+
+        return true;
+}
+
+/* Finish fault handling; con->mutex must *not* be held here */
+
+static void con_fault_finish(struct ceph_connection *con)
+{
+        /*
+         * in case we faulted due to authentication, invalidate our
+         * current tickets so that we can get new ones.
+         */
+        if (con->auth_retry && con->ops->invalidate_authorizer) {
+                dout("calling invalidate_authorizer()\n");
+                con->ops->invalidate_authorizer(con);
+        }
+
+        if (con->ops->fault)
+                con->ops->fault(con);
+}
+
 /*
  * Do some work on a connection.  Drop a connection ref when we're done.
  */
@@ -2302,73 +2387,68 @@ static void con_work(struct work_struct *work)
 {
         struct ceph_connection *con = container_of(work, struct ceph_connection,
                                                    work.work);
-        int ret;
+        bool fault;
 
         mutex_lock(&con->mutex);
-restart:
-        if (con_sock_closed(con))
-                goto fault;
+        while (true) {
+                int ret;
 
-        if (test_and_clear_bit(CON_FLAG_BACKOFF, &con->flags)) {
-                dout("con_work %p backing off\n", con);
-                ret = queue_con_delay(con, round_jiffies_relative(con->delay));
-                if (ret) {
-                        dout("con_work %p FAILED to back off %lu\n", con,
-                             con->delay);
-                        BUG_ON(ret == -ENOENT);
-                        set_bit(CON_FLAG_BACKOFF, &con->flags);
+                if ((fault = con_sock_closed(con))) {
+                        dout("%s: con %p SOCK_CLOSED\n", __func__, con);
+                        break;
+                }
+                if (con_backoff(con)) {
+                        dout("%s: con %p BACKOFF\n", __func__, con);
+                        break;
+                }
+                if (con->state == CON_STATE_STANDBY) {
+                        dout("%s: con %p STANDBY\n", __func__, con);
+                        break;
+                }
+                if (con->state == CON_STATE_CLOSED) {
+                        dout("%s: con %p CLOSED\n", __func__, con);
+                        BUG_ON(con->sock);
+                        break;
+                }
+                if (con->state == CON_STATE_PREOPEN) {
+                        dout("%s: con %p PREOPEN\n", __func__, con);
+                        BUG_ON(con->sock);
                 }
-                goto done;
-        }
 
-        if (con->state == CON_STATE_STANDBY) {
-                dout("con_work %p STANDBY\n", con);
-                goto done;
-        }
-        if (con->state == CON_STATE_CLOSED) {
-                dout("con_work %p CLOSED\n", con);
-                BUG_ON(con->sock);
-                goto done;
-        }
-        if (con->state == CON_STATE_PREOPEN) {
-                dout("con_work OPENING\n");
-                BUG_ON(con->sock);
-        }
+                ret = try_read(con);
+                if (ret < 0) {
+                        if (ret == -EAGAIN)
+                                continue;
+                        con->error_msg = "socket error on read";
+                        fault = true;
+                        break;
+                }
 
-        ret = try_read(con);
-        if (ret == -EAGAIN)
-                goto restart;
-        if (ret < 0) {
-                con->error_msg = "socket error on read";
-                goto fault;
-        }
+                ret = try_write(con);
+                if (ret < 0) {
+                        if (ret == -EAGAIN)
+                                continue;
+                        con->error_msg = "socket error on write";
+                        fault = true;
+                }
 
-        ret = try_write(con);
-        if (ret == -EAGAIN)
-                goto restart;
-        if (ret < 0) {
-                con->error_msg = "socket error on write";
-                goto fault;
+                break;  /* If we make it to here, we're done */
         }
-
-done:
+        if (fault)
+                con_fault(con);
         mutex_unlock(&con->mutex);
-done_unlocked:
-        con->ops->put(con);
-        return;
 
-fault:
-        ceph_fault(con);     /* error/fault path */
-        goto done_unlocked;
-}
+        if (fault)
+                con_fault_finish(con);
 
+        con->ops->put(con);
+}
 
 /*
  * Generic error/fault handler.  A retry mechanism is used with
  * exponential backoff
  */
-static void ceph_fault(struct ceph_connection *con)
-        __releases(con->mutex)
+static void con_fault(struct ceph_connection *con)
 {
         pr_warning("%s%lld %s %s\n", ENTITY_NAME(con->peer_name),
                ceph_pr_addr(&con->peer_addr.in_addr), con->error_msg);
@@ -2381,10 +2461,10 @@ static void ceph_fault(struct ceph_connection *con)
 
         con_close_socket(con);
 
-        if (test_bit(CON_FLAG_LOSSYTX, &con->flags)) {
+        if (con_flag_test(con, CON_FLAG_LOSSYTX)) {
                 dout("fault on LOSSYTX channel, marking CLOSED\n");
                 con->state = CON_STATE_CLOSED;
-                goto out_unlock;
+                return;
         }
 
         if (con->in_msg) {
@@ -2401,9 +2481,9 @@ static void ceph_fault(struct ceph_connection *con)
         /* If there are no messages queued or keepalive pending, place
          * the connection in a STANDBY state */
         if (list_empty(&con->out_queue) &&
-            !test_bit(CON_FLAG_KEEPALIVE_PENDING, &con->flags)) {
+            !con_flag_test(con, CON_FLAG_KEEPALIVE_PENDING)) {
                 dout("fault %p setting STANDBY clearing WRITE_PENDING\n", con);
-                clear_bit(CON_FLAG_WRITE_PENDING, &con->flags);
+                con_flag_clear(con, CON_FLAG_WRITE_PENDING);
                 con->state = CON_STATE_STANDBY;
         } else {
                 /* retry after a delay. */
@@ -2412,23 +2492,9 @@ static void ceph_fault(struct ceph_connection *con)
                         con->delay = BASE_DELAY_INTERVAL;
                 else if (con->delay < MAX_DELAY_INTERVAL)
                         con->delay *= 2;
-                set_bit(CON_FLAG_BACKOFF, &con->flags);
+                con_flag_set(con, CON_FLAG_BACKOFF);
                 queue_con(con);
         }
-
-out_unlock:
-        mutex_unlock(&con->mutex);
-        /*
-         * in case we faulted due to authentication, invalidate our
-         * current tickets so that we can get new ones.
-         */
-        if (con->auth_retry && con->ops->invalidate_authorizer) {
-                dout("calling invalidate_authorizer()\n");
-                con->ops->invalidate_authorizer(con);
-        }
-
-        if (con->ops->fault)
-                con->ops->fault(con);
 }
 
 
@@ -2469,8 +2535,8 @@ static void clear_standby(struct ceph_connection *con)
                 dout("clear_standby %p and ++connect_seq\n", con);
                 con->state = CON_STATE_PREOPEN;
                 con->connect_seq++;
-                WARN_ON(test_bit(CON_FLAG_WRITE_PENDING, &con->flags));
-                WARN_ON(test_bit(CON_FLAG_KEEPALIVE_PENDING, &con->flags));
+                WARN_ON(con_flag_test(con, CON_FLAG_WRITE_PENDING));
+                WARN_ON(con_flag_test(con, CON_FLAG_KEEPALIVE_PENDING));
         }
 }
 
@@ -2511,7 +2577,7 @@ void ceph_con_send(struct ceph_connection *con, struct ceph_msg *msg)
 
         /* if there wasn't anything waiting to send before, queue
          * new work */
-        if (test_and_set_bit(CON_FLAG_WRITE_PENDING, &con->flags) == 0)
+        if (con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
                 queue_con(con);
 }
 EXPORT_SYMBOL(ceph_con_send);
@@ -2600,8 +2666,8 @@ void ceph_con_keepalive(struct ceph_connection *con)
         mutex_lock(&con->mutex);
         clear_standby(con);
         mutex_unlock(&con->mutex);
-        if (test_and_set_bit(CON_FLAG_KEEPALIVE_PENDING, &con->flags) == 0 &&
-            test_and_set_bit(CON_FLAG_WRITE_PENDING, &con->flags) == 0)
+        if (con_flag_test_and_set(con, CON_FLAG_KEEPALIVE_PENDING) == 0 &&
+            con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
                 queue_con(con);
 }
 EXPORT_SYMBOL(ceph_con_keepalive);
@@ -2651,9 +2717,11 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags,
         m->page_alignment = 0;
         m->pages = NULL;
         m->pagelist = NULL;
+#ifdef  CONFIG_BLOCK
         m->bio = NULL;
         m->bio_iter = NULL;
         m->bio_seg = 0;
+#endif  /* CONFIG_BLOCK */
         m->trail = NULL;
 
         /* front */
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 812eb3b46c1f..aef5b1062bee 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -697,7 +697,7 @@ int ceph_monc_delete_snapid(struct ceph_mon_client *monc,
                             u32 pool, u64 snapid)
 {
         return do_poolop(monc,  POOL_OP_CREATE_UNMANAGED_SNAP,
-                                   pool, snapid, 0, 0);
+                                   pool, snapid, NULL, 0);
 
 }
 
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index eb9a44478764..d730dd4d8eb2 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -23,7 +23,7 @@
 
 static const struct ceph_connection_operations osd_con_ops;
 
-static void send_queued(struct ceph_osd_client *osdc);
+static void __send_queued(struct ceph_osd_client *osdc);
 static int __reset_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd);
 static void __register_request(struct ceph_osd_client *osdc,
                                struct ceph_osd_request *req);
@@ -32,64 +32,12 @@ static void __unregister_linger_request(struct ceph_osd_client *osdc,
 static void __send_request(struct ceph_osd_client *osdc,
                            struct ceph_osd_request *req);
 
-static int op_needs_trail(int op)
-{
-        switch (op) {
-        case CEPH_OSD_OP_GETXATTR:
-        case CEPH_OSD_OP_SETXATTR:
-        case CEPH_OSD_OP_CMPXATTR:
-        case CEPH_OSD_OP_CALL:
-        case CEPH_OSD_OP_NOTIFY:
-                return 1;
-        default:
-                return 0;
-        }
-}
-
 static int op_has_extent(int op)
 {
         return (op == CEPH_OSD_OP_READ ||
                 op == CEPH_OSD_OP_WRITE);
 }
 
-int ceph_calc_raw_layout(struct ceph_osd_client *osdc,
-                        struct ceph_file_layout *layout,
-                        u64 snapid,
-                        u64 off, u64 *plen, u64 *bno,
-                        struct ceph_osd_request *req,
-                        struct ceph_osd_req_op *op)
-{
-        struct ceph_osd_request_head *reqhead = req->r_request->front.iov_base;
-        u64 orig_len = *plen;
-        u64 objoff, objlen;    /* extent in object */
-        int r;
-
-        reqhead->snapid = cpu_to_le64(snapid);
-
-        /* object extent? */
-        r = ceph_calc_file_object_mapping(layout, off, plen, bno,
-                                          &objoff, &objlen);
-        if (r < 0)
-                return r;
-        if (*plen < orig_len)
-                dout(" skipping last %llu, final file extent %llu~%llu\n",
-                     orig_len - *plen, off, *plen);
-
-        if (op_has_extent(op->op)) {
-                op->extent.offset = objoff;
-                op->extent.length = objlen;
-        }
-        req->r_num_pages = calc_pages_for(off, *plen);
-        req->r_page_alignment = off & ~PAGE_MASK;
-        if (op->op == CEPH_OSD_OP_WRITE)
-                op->payload_len = *plen;
-
-        dout("calc_layout bno=%llx %llu~%llu (%d pages)\n",
-             *bno, objoff, objlen, req->r_num_pages);
-        return 0;
-}
-EXPORT_SYMBOL(ceph_calc_raw_layout);
-
 /*
  * Implement client access to distributed object storage cluster.
  *
@@ -115,20 +63,48 @@ EXPORT_SYMBOL(ceph_calc_raw_layout);
  *
  * fill osd op in request message.
  */
-static int calc_layout(struct ceph_osd_client *osdc,
-                       struct ceph_vino vino,
+static int calc_layout(struct ceph_vino vino,
                        struct ceph_file_layout *layout,
                        u64 off, u64 *plen,
                        struct ceph_osd_request *req,
                        struct ceph_osd_req_op *op)
 {
-        u64 bno;
+        u64 orig_len = *plen;
+        u64 bno = 0;
+        u64 objoff = 0;
+        u64 objlen = 0;
         int r;
 
-        r = ceph_calc_raw_layout(osdc, layout, vino.snap, off,
-                                 plen, &bno, req, op);
+        /* object extent? */
+        r = ceph_calc_file_object_mapping(layout, off, orig_len, &bno,
+                                          &objoff, &objlen);
         if (r < 0)
                 return r;
+        if (objlen < orig_len) {
+                *plen = objlen;
+                dout(" skipping last %llu, final file extent %llu~%llu\n",
+                     orig_len - *plen, off, *plen);
+        }
+
+        if (op_has_extent(op->op)) {
+                u32 osize = le32_to_cpu(layout->fl_object_size);
+                op->extent.offset = objoff;
+                op->extent.length = objlen;
+                if (op->extent.truncate_size <= off - objoff) {
+                        op->extent.truncate_size = 0;
+                } else {
+                        op->extent.truncate_size -= off - objoff;
+                        if (op->extent.truncate_size > osize)
+                                op->extent.truncate_size = osize;
+                }
+        }
+        req->r_num_pages = calc_pages_for(off, *plen);
+        req->r_page_alignment = off & ~PAGE_MASK;
+        if (op->op == CEPH_OSD_OP_WRITE)
+                op->payload_len = *plen;
+
+        dout("calc_layout bno=%llx %llu~%llu (%d pages)\n",
+             bno, objoff, objlen, req->r_num_pages);
 
         snprintf(req->r_oid, sizeof(req->r_oid), "%llx.%08llx", vino.ino, bno);
         req->r_oid_len = strlen(req->r_oid);
@@ -148,25 +124,19 @@ void ceph_osdc_release_request(struct kref *kref)
         if (req->r_request)
                 ceph_msg_put(req->r_request);
         if (req->r_con_filling_msg) {
-                dout("%s revoking pages %p from con %p\n", __func__,
-                     req->r_pages, req->r_con_filling_msg);
+                dout("%s revoking msg %p from con %p\n", __func__,
+                     req->r_reply, req->r_con_filling_msg);
                 ceph_msg_revoke_incoming(req->r_reply);
                 req->r_con_filling_msg->ops->put(req->r_con_filling_msg);
+                req->r_con_filling_msg = NULL;
         }
         if (req->r_reply)
                 ceph_msg_put(req->r_reply);
         if (req->r_own_pages)
                 ceph_release_page_vector(req->r_pages,
                                          req->r_num_pages);
-#ifdef CONFIG_BLOCK
-        if (req->r_bio)
-                bio_put(req->r_bio);
-#endif
         ceph_put_snap_context(req->r_snapc);
-        if (req->r_trail) {
-                ceph_pagelist_release(req->r_trail);
-                kfree(req->r_trail);
-        }
+        ceph_pagelist_release(&req->r_trail);
         if (req->r_mempool)
                 mempool_free(req, req->r_osdc->req_mempool);
         else
@@ -174,37 +144,25 @@ void ceph_osdc_release_request(struct kref *kref)
 }
 EXPORT_SYMBOL(ceph_osdc_release_request);
 
-static int get_num_ops(struct ceph_osd_req_op *ops, int *needs_trail)
-{
-        int i = 0;
-
-        if (needs_trail)
-                *needs_trail = 0;
-        while (ops[i].op) {
-                if (needs_trail && op_needs_trail(ops[i].op))
-                        *needs_trail = 1;
-                i++;
-        }
-
-        return i;
-}
-
 struct ceph_osd_request *ceph_osdc_alloc_request(struct ceph_osd_client *osdc,
-                                               int flags,
                                                struct ceph_snap_context *snapc,
-                                               struct ceph_osd_req_op *ops,
+                                               unsigned int num_ops,
                                                bool use_mempool,
-                                               gfp_t gfp_flags,
-                                               struct page **pages,
-                                               struct bio *bio)
+                                               gfp_t gfp_flags)
 {
         struct ceph_osd_request *req;
         struct ceph_msg *msg;
-        int needs_trail;
-        int num_op = get_num_ops(ops, &needs_trail);
-        size_t msg_size = sizeof(struct ceph_osd_request_head);
-
-        msg_size += num_op*sizeof(struct ceph_osd_op);
+        size_t msg_size;
+
+        msg_size = 4 + 4 + 8 + 8 + 4+8;
+        msg_size += 2 + 4 + 8 + 4 + 4; /* oloc */
+        msg_size += 1 + 8 + 4 + 4;     /* pg_t */
+        msg_size += 4 + MAX_OBJ_NAME_SIZE;
+        msg_size += 2 + num_ops*sizeof(struct ceph_osd_op);
+        msg_size += 8;  /* snapid */
+        msg_size += 8;  /* snap_seq */
+        msg_size += 8 * (snapc ? snapc->num_snaps : 0);  /* snaps */
+        msg_size += 4;
 
         if (use_mempool) {
                 req = mempool_alloc(osdc->req_mempool, gfp_flags);
@@ -228,10 +186,6 @@ struct ceph_osd_request *ceph_osdc_alloc_request(struct ceph_osd_client *osdc,
         INIT_LIST_HEAD(&req->r_req_lru_item);
         INIT_LIST_HEAD(&req->r_osd_item);
 
-        req->r_flags = flags;
-
-        WARN_ON((flags & (CEPH_OSD_FLAG_READ|CEPH_OSD_FLAG_WRITE)) == 0);
-
         /* create reply message */
         if (use_mempool)
                 msg = ceph_msgpool_get(&osdc->msgpool_op_reply, 0);
@@ -244,20 +198,9 @@ struct ceph_osd_request *ceph_osdc_alloc_request(struct ceph_osd_client *osdc,
         }
         req->r_reply = msg;
 
-        /* allocate space for the trailing data */
-        if (needs_trail) {
-                req->r_trail = kmalloc(sizeof(struct ceph_pagelist), gfp_flags);
-                if (!req->r_trail) {
-                        ceph_osdc_put_request(req);
-                        return NULL;
-                }
-                ceph_pagelist_init(req->r_trail);
-        }
+        ceph_pagelist_init(&req->r_trail);
 
         /* create request message; allow space for oid */
-        msg_size += MAX_OBJ_NAME_SIZE;
-        if (snapc)
-                msg_size += sizeof(u64) * snapc->num_snaps;
         if (use_mempool)
                 msg = ceph_msgpool_get(&osdc->msgpool_op, 0);
         else
@@ -270,13 +213,6 @@ struct ceph_osd_request *ceph_osdc_alloc_request(struct ceph_osd_client *osdc,
         memset(msg->front.iov_base, 0, msg->front.iov_len);
 
         req->r_request = msg;
-        req->r_pages = pages;
-#ifdef CONFIG_BLOCK
-        if (bio) {
-                req->r_bio = bio;
-                bio_get(req->r_bio);
-        }
-#endif
 
         return req;
 }
@@ -289,6 +225,8 @@ static void osd_req_encode_op(struct ceph_osd_request *req,
         dst->op = cpu_to_le16(src->op);
 
         switch (src->op) {
+        case CEPH_OSD_OP_STAT:
+                break;
         case CEPH_OSD_OP_READ:
         case CEPH_OSD_OP_WRITE:
                 dst->extent.offset =
@@ -300,52 +238,20 @@ static void osd_req_encode_op(struct ceph_osd_request *req,
                 dst->extent.truncate_seq =
                         cpu_to_le32(src->extent.truncate_seq);
                 break;
-
-        case CEPH_OSD_OP_GETXATTR:
-        case CEPH_OSD_OP_SETXATTR:
-        case CEPH_OSD_OP_CMPXATTR:
-                BUG_ON(!req->r_trail);
-
-                dst->xattr.name_len = cpu_to_le32(src->xattr.name_len);
-                dst->xattr.value_len = cpu_to_le32(src->xattr.value_len);
-                dst->xattr.cmp_op = src->xattr.cmp_op;
-                dst->xattr.cmp_mode = src->xattr.cmp_mode;
-                ceph_pagelist_append(req->r_trail, src->xattr.name,
-                                     src->xattr.name_len);
-                ceph_pagelist_append(req->r_trail, src->xattr.val,
-                                     src->xattr.value_len);
-                break;
         case CEPH_OSD_OP_CALL:
-                BUG_ON(!req->r_trail);
-
                 dst->cls.class_len = src->cls.class_len;
                 dst->cls.method_len = src->cls.method_len;
                 dst->cls.indata_len = cpu_to_le32(src->cls.indata_len);
 
-                ceph_pagelist_append(req->r_trail, src->cls.class_name,
+                ceph_pagelist_append(&req->r_trail, src->cls.class_name,
                                      src->cls.class_len);
-                ceph_pagelist_append(req->r_trail, src->cls.method_name,
+                ceph_pagelist_append(&req->r_trail, src->cls.method_name,
                                      src->cls.method_len);
-                ceph_pagelist_append(req->r_trail, src->cls.indata,
+                ceph_pagelist_append(&req->r_trail, src->cls.indata,
                                      src->cls.indata_len);
                 break;
-        case CEPH_OSD_OP_ROLLBACK:
-                dst->snap.snapid = cpu_to_le64(src->snap.snapid);
-                break;
         case CEPH_OSD_OP_STARTSYNC:
                 break;
-        case CEPH_OSD_OP_NOTIFY:
-                {
-                        __le32 prot_ver = cpu_to_le32(src->watch.prot_ver);
-                        __le32 timeout = cpu_to_le32(src->watch.timeout);
-
-                        BUG_ON(!req->r_trail);
-
-                        ceph_pagelist_append(req->r_trail,
-                                                &prot_ver, sizeof(prot_ver));
-                        ceph_pagelist_append(req->r_trail,
-                                                &timeout, sizeof(timeout));
-                }
         case CEPH_OSD_OP_NOTIFY_ACK:
         case CEPH_OSD_OP_WATCH:
                 dst->watch.cookie = cpu_to_le64(src->watch.cookie);
@@ -356,6 +262,64 @@ static void osd_req_encode_op(struct ceph_osd_request *req,
                 pr_err("unrecognized osd opcode %d\n", dst->op);
                 WARN_ON(1);
                 break;
+        case CEPH_OSD_OP_MAPEXT:
+        case CEPH_OSD_OP_MASKTRUNC:
+        case CEPH_OSD_OP_SPARSE_READ:
+        case CEPH_OSD_OP_NOTIFY:
+        case CEPH_OSD_OP_ASSERT_VER:
+        case CEPH_OSD_OP_WRITEFULL:
+        case CEPH_OSD_OP_TRUNCATE:
+        case CEPH_OSD_OP_ZERO:
+        case CEPH_OSD_OP_DELETE:
+        case CEPH_OSD_OP_APPEND:
+        case CEPH_OSD_OP_SETTRUNC:
+        case CEPH_OSD_OP_TRIMTRUNC:
+        case CEPH_OSD_OP_TMAPUP:
+        case CEPH_OSD_OP_TMAPPUT:
+        case CEPH_OSD_OP_TMAPGET:
+        case CEPH_OSD_OP_CREATE:
+        case CEPH_OSD_OP_ROLLBACK:
+        case CEPH_OSD_OP_OMAPGETKEYS:
+        case CEPH_OSD_OP_OMAPGETVALS:
+        case CEPH_OSD_OP_OMAPGETHEADER:
+        case CEPH_OSD_OP_OMAPGETVALSBYKEYS:
+        case CEPH_OSD_OP_MODE_RD:
+        case CEPH_OSD_OP_OMAPSETVALS:
+        case CEPH_OSD_OP_OMAPSETHEADER:
+        case CEPH_OSD_OP_OMAPCLEAR:
+        case CEPH_OSD_OP_OMAPRMKEYS:
+        case CEPH_OSD_OP_OMAP_CMP:
+        case CEPH_OSD_OP_CLONERANGE:
+        case CEPH_OSD_OP_ASSERT_SRC_VERSION:
+        case CEPH_OSD_OP_SRC_CMPXATTR:
+        case CEPH_OSD_OP_GETXATTR:
+        case CEPH_OSD_OP_GETXATTRS:
+        case CEPH_OSD_OP_CMPXATTR:
+        case CEPH_OSD_OP_SETXATTR:
+        case CEPH_OSD_OP_SETXATTRS:
+        case CEPH_OSD_OP_RESETXATTRS:
+        case CEPH_OSD_OP_RMXATTR:
+        case CEPH_OSD_OP_PULL:
+        case CEPH_OSD_OP_PUSH:
+        case CEPH_OSD_OP_BALANCEREADS:
+        case CEPH_OSD_OP_UNBALANCEREADS:
+        case CEPH_OSD_OP_SCRUB:
+        case CEPH_OSD_OP_SCRUB_RESERVE:
+        case CEPH_OSD_OP_SCRUB_UNRESERVE:
+        case CEPH_OSD_OP_SCRUB_STOP:
+        case CEPH_OSD_OP_SCRUB_MAP:
+        case CEPH_OSD_OP_WRLOCK:
+        case CEPH_OSD_OP_WRUNLOCK:
+        case CEPH_OSD_OP_RDLOCK:
+        case CEPH_OSD_OP_RDUNLOCK:
+        case CEPH_OSD_OP_UPLOCK:
+        case CEPH_OSD_OP_DNLOCK:
+        case CEPH_OSD_OP_PGLS:
+        case CEPH_OSD_OP_PGLS_FILTER:
+                pr_err("unsupported osd opcode %s\n",
+                        ceph_osd_op_name(dst->op));
+                WARN_ON(1);
+                break;
         }
         dst->payload_len = cpu_to_le32(src->payload_len);
 }
@@ -365,75 +329,95 @@ static void osd_req_encode_op(struct ceph_osd_request *req,
  *
  */
 void ceph_osdc_build_request(struct ceph_osd_request *req,
-                             u64 off, u64 *plen,
+                             u64 off, u64 len, unsigned int num_ops,
                              struct ceph_osd_req_op *src_ops,
-                             struct ceph_snap_context *snapc,
-                             struct timespec *mtime,
-                             const char *oid,
-                             int oid_len)
+                             struct ceph_snap_context *snapc, u64 snap_id,
+                             struct timespec *mtime)
 {
         struct ceph_msg *msg = req->r_request;
-        struct ceph_osd_request_head *head;
         struct ceph_osd_req_op *src_op;
-        struct ceph_osd_op *op;
         void *p;
-        int num_op = get_num_ops(src_ops, NULL);
-        size_t msg_size = sizeof(*head) + num_op*sizeof(*op);
+        size_t msg_size;
         int flags = req->r_flags;
-        u64 data_len = 0;
+        u64 data_len;
         int i;
 
-        head = msg->front.iov_base;
-        op = (void *)(head + 1);
-        p = (void *)(op + num_op);
-
+        req->r_num_ops = num_ops;
+        req->r_snapid = snap_id;
         req->r_snapc = ceph_get_snap_context(snapc);
 
-        head->client_inc = cpu_to_le32(1); /* always, for now. */
-        head->flags = cpu_to_le32(flags);
-        if (flags & CEPH_OSD_FLAG_WRITE)
-                ceph_encode_timespec(&head->mtime, mtime);
-        head->num_ops = cpu_to_le16(num_op);
-
-
-        /* fill in oid */
-        head->object_len = cpu_to_le32(oid_len);
-        memcpy(p, oid, oid_len);
-        p += oid_len;
+        /* encode request */
+        msg->hdr.version = cpu_to_le16(4);
 
+        p = msg->front.iov_base;
+        ceph_encode_32(&p, 1);   /* client_inc  is always 1 */
+        req->r_request_osdmap_epoch = p;
+        p += 4;
+        req->r_request_flags = p;
+        p += 4;
+        if (req->r_flags & CEPH_OSD_FLAG_WRITE)
+                ceph_encode_timespec(p, mtime);
+        p += sizeof(struct ceph_timespec);
+        req->r_request_reassert_version = p;
+        p += sizeof(struct ceph_eversion); /* will get filled in */
+
+        /* oloc */
+        ceph_encode_8(&p, 4);
+        ceph_encode_8(&p, 4);
+        ceph_encode_32(&p, 8 + 4 + 4);
+        req->r_request_pool = p;
+        p += 8;
+        ceph_encode_32(&p, -1);  /* preferred */
+        ceph_encode_32(&p, 0);   /* key len */
+
+        ceph_encode_8(&p, 1);
+        req->r_request_pgid = p;
+        p += 8 + 4;
+        ceph_encode_32(&p, -1);  /* preferred */
+
+        /* oid */
+        ceph_encode_32(&p, req->r_oid_len);
+        memcpy(p, req->r_oid, req->r_oid_len);
+        dout("oid '%.*s' len %d\n", req->r_oid_len, req->r_oid, req->r_oid_len);
+        p += req->r_oid_len;
+
+        /* ops */
+        ceph_encode_16(&p, num_ops);
         src_op = src_ops;
-        while (src_op->op) {
-                osd_req_encode_op(req, op, src_op);
-                src_op++;
-                op++;
+        req->r_request_ops = p;
+        for (i = 0; i < num_ops; i++, src_op++) {
+                osd_req_encode_op(req, p, src_op);
+                p += sizeof(struct ceph_osd_op);
         }
 
-        if (req->r_trail)
-                data_len += req->r_trail->length;
-
-        if (snapc) {
-                head->snap_seq = cpu_to_le64(snapc->seq);
-                head->num_snaps = cpu_to_le32(snapc->num_snaps);
+        /* snaps */
+        ceph_encode_64(&p, req->r_snapid);
+        ceph_encode_64(&p, req->r_snapc ? req->r_snapc->seq : 0);
+        ceph_encode_32(&p, req->r_snapc ? req->r_snapc->num_snaps : 0);
+        if (req->r_snapc) {
                 for (i = 0; i < snapc->num_snaps; i++) {
-                        put_unaligned_le64(snapc->snaps[i], p);
-                        p += sizeof(u64);
+                        ceph_encode_64(&p, req->r_snapc->snaps[i]);
                 }
         }
 
+        req->r_request_attempts = p;
+        p += 4;
+
+        data_len = req->r_trail.length;
         if (flags & CEPH_OSD_FLAG_WRITE) {
                 req->r_request->hdr.data_off = cpu_to_le16(off);
-                req->r_request->hdr.data_len = cpu_to_le32(*plen + data_len);
-        } else if (data_len) {
-                req->r_request->hdr.data_off = 0;
-                req->r_request->hdr.data_len = cpu_to_le32(data_len);
+                data_len += len;
         }
-
+        req->r_request->hdr.data_len = cpu_to_le32(data_len);
         req->r_request->page_alignment = req->r_page_alignment;
 
         BUG_ON(p > msg->front.iov_base + msg->front.iov_len);
         msg_size = p - msg->front.iov_base;
         msg->front.iov_len = msg_size;
         msg->hdr.front_len = cpu_to_le32(msg_size);
+
+        dout("build_request msg_size was %d num_ops %d\n", (int)msg_size,
+             num_ops);
         return;
 }
 EXPORT_SYMBOL(ceph_osdc_build_request);
@@ -459,34 +443,33 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
                                                u32 truncate_seq,
                                                u64 truncate_size,
                                                struct timespec *mtime,
-                                               bool use_mempool, int num_reply,
+                                               bool use_mempool,
                                                int page_align)
 {
-        struct ceph_osd_req_op ops[3];
+        struct ceph_osd_req_op ops[2];
         struct ceph_osd_request *req;
+        unsigned int num_op = 1;
         int r;
 
+        memset(&ops, 0, sizeof ops);
+
         ops[0].op = opcode;
         ops[0].extent.truncate_seq = truncate_seq;
         ops[0].extent.truncate_size = truncate_size;
-        ops[0].payload_len = 0;
 
         if (do_sync) {
                 ops[1].op = CEPH_OSD_OP_STARTSYNC;
-                ops[1].payload_len = 0;
-                ops[2].op = 0;
-        } else
-                ops[1].op = 0;
-
-        req = ceph_osdc_alloc_request(osdc, flags,
-                                         snapc, ops,
-                                         use_mempool,
-                                         GFP_NOFS, NULL, NULL);
+                num_op++;
+        }
+
+        req = ceph_osdc_alloc_request(osdc, snapc, num_op, use_mempool,
+                                        GFP_NOFS);
         if (!req)
                 return ERR_PTR(-ENOMEM);
+        req->r_flags = flags;
 
         /* calculate max write size */
-        r = calc_layout(osdc, vino, layout, off, plen, req, ops);
+        r = calc_layout(vino, layout, off, plen, req, ops);
         if (r < 0)
                 return ERR_PTR(r);
         req->r_file_layout = *layout;  /* keep a copy */
@@ -496,10 +479,8 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
         req->r_num_pages = calc_pages_for(page_align, *plen);
         req->r_page_alignment = page_align;
 
-        ceph_osdc_build_request(req, off, plen, ops,
-                                snapc,
-                                mtime,
-                                req->r_oid, req->r_oid_len);
+        ceph_osdc_build_request(req, off, *plen, num_op, ops,
+                                snapc, vino.snap, mtime);
 
         return req;
 }
@@ -623,8 +604,8 @@ static void osd_reset(struct ceph_connection *con)
         down_read(&osdc->map_sem);
         mutex_lock(&osdc->request_mutex);
         __kick_osd_requests(osdc, osd);
+        __send_queued(osdc);
         mutex_unlock(&osdc->request_mutex);
-        send_queued(osdc);
         up_read(&osdc->map_sem);
 }
 
@@ -739,31 +720,35 @@ static void remove_old_osds(struct ceph_osd_client *osdc)
  */
 static int __reset_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
 {
-        struct ceph_osd_request *req;
-        int ret = 0;
+        struct ceph_entity_addr *peer_addr;
 
         dout("__reset_osd %p osd%d\n", osd, osd->o_osd);
         if (list_empty(&osd->o_requests) &&
             list_empty(&osd->o_linger_requests)) {
                 __remove_osd(osdc, osd);
-                ret = -ENODEV;
-        } else if (memcmp(&osdc->osdmap->osd_addr[osd->o_osd],
-                          &osd->o_con.peer_addr,
-                          sizeof(osd->o_con.peer_addr)) == 0 &&
-                   !ceph_con_opened(&osd->o_con)) {
+
+                return -ENODEV;
+        }
+
+        peer_addr = &osdc->osdmap->osd_addr[osd->o_osd];
+        if (!memcmp(peer_addr, &osd->o_con.peer_addr, sizeof (*peer_addr)) &&
+                        !ceph_con_opened(&osd->o_con)) {
+                struct ceph_osd_request *req;
+
                 dout(" osd addr hasn't changed and connection never opened,"
                      " letting msgr retry");
                 /* touch each r_stamp for handle_timeout()'s benfit */
                 list_for_each_entry(req, &osd->o_requests, r_osd_item)
                         req->r_stamp = jiffies;
-                ret = -EAGAIN;
-        } else {
-                ceph_con_close(&osd->o_con);
-                ceph_con_open(&osd->o_con, CEPH_ENTITY_TYPE_OSD, osd->o_osd,
-                              &osdc->osdmap->osd_addr[osd->o_osd]);
-                osd->o_incarnation++;
+
+                return -EAGAIN;
         }
-        return ret;
+
+        ceph_con_close(&osd->o_con);
+        ceph_con_open(&osd->o_con, CEPH_ENTITY_TYPE_OSD, osd->o_osd, peer_addr);
+        osd->o_incarnation++;
+
+        return 0;
 }
 
 static void __insert_osd(struct ceph_osd_client *osdc, struct ceph_osd *new)
@@ -961,20 +946,18 @@ EXPORT_SYMBOL(ceph_osdc_set_request_linger);
 static int __map_request(struct ceph_osd_client *osdc,
                          struct ceph_osd_request *req, int force_resend)
 {
-        struct ceph_osd_request_head *reqhead = req->r_request->front.iov_base;
         struct ceph_pg pgid;
         int acting[CEPH_PG_MAX_SIZE];
         int o = -1, num = 0;
         int err;
 
         dout("map_request %p tid %lld\n", req, req->r_tid);
-        err = ceph_calc_object_layout(&reqhead->layout, req->r_oid,
+        err = ceph_calc_object_layout(&pgid, req->r_oid,
                                       &req->r_file_layout, osdc->osdmap);
         if (err) {
                 list_move(&req->r_req_lru_item, &osdc->req_notarget);
                 return err;
         }
-        pgid = reqhead->layout.ol_pgid;
         req->r_pgid = pgid;
 
         err = ceph_calc_pg_acting(osdc->osdmap, pgid, acting);
@@ -991,8 +974,8 @@ static int __map_request(struct ceph_osd_client *osdc,
             (req->r_osd == NULL && o == -1))
                 return 0;  /* no change */
 
-        dout("map_request tid %llu pgid %d.%x osd%d (was osd%d)\n",
-             req->r_tid, le32_to_cpu(pgid.pool), le16_to_cpu(pgid.ps), o,
+        dout("map_request tid %llu pgid %lld.%x osd%d (was osd%d)\n",
+             req->r_tid, pgid.pool, pgid.seed, o,
              req->r_osd ? req->r_osd->o_osd : -1);
 
         /* record full pg acting set */
@@ -1041,15 +1024,22 @@ out:
 static void __send_request(struct ceph_osd_client *osdc,
                            struct ceph_osd_request *req)
 {
-        struct ceph_osd_request_head *reqhead;
-
-        dout("send_request %p tid %llu to osd%d flags %d\n",
-             req, req->r_tid, req->r_osd->o_osd, req->r_flags);
+        void *p;
 
-        reqhead = req->r_request->front.iov_base;
-        reqhead->osdmap_epoch = cpu_to_le32(osdc->osdmap->epoch);
-        reqhead->flags |= cpu_to_le32(req->r_flags);  /* e.g., RETRY */
-        reqhead->reassert_version = req->r_reassert_version;
+        dout("send_request %p tid %llu to osd%d flags %d pg %lld.%x\n",
+             req, req->r_tid, req->r_osd->o_osd, req->r_flags,
+             (unsigned long long)req->r_pgid.pool, req->r_pgid.seed);
+
+        /* fill in message content that changes each time we send it */
+        put_unaligned_le32(osdc->osdmap->epoch, req->r_request_osdmap_epoch);
+        put_unaligned_le32(req->r_flags, req->r_request_flags);
+        put_unaligned_le64(req->r_pgid.pool, req->r_request_pool);
+        p = req->r_request_pgid;
+        ceph_encode_64(&p, req->r_pgid.pool);
+        ceph_encode_32(&p, req->r_pgid.seed);
+        put_unaligned_le64(1, req->r_request_attempts);  /* FIXME */
+        memcpy(req->r_request_reassert_version, &req->r_reassert_version,
+               sizeof(req->r_reassert_version));
 
         req->r_stamp = jiffies;
         list_move_tail(&req->r_req_lru_item, &osdc->req_lru);
@@ -1062,16 +1052,13 @@ static void __send_request(struct ceph_osd_client *osdc,
 /*
  * Send any requests in the queue (req_unsent).
  */
-static void send_queued(struct ceph_osd_client *osdc)
+static void __send_queued(struct ceph_osd_client *osdc)
 {
         struct ceph_osd_request *req, *tmp;
 
-        dout("send_queued\n");
-        mutex_lock(&osdc->request_mutex);
-        list_for_each_entry_safe(req, tmp, &osdc->req_unsent, r_req_lru_item) {
+        dout("__send_queued\n");
+        list_for_each_entry_safe(req, tmp, &osdc->req_unsent, r_req_lru_item)
                 __send_request(osdc, req);
-        }
-        mutex_unlock(&osdc->request_mutex);
 }
 
 /*
@@ -1123,8 +1110,8 @@ static void handle_timeout(struct work_struct *work)
         }
 
         __schedule_osd_timeout(osdc);
+        __send_queued(osdc);
         mutex_unlock(&osdc->request_mutex);
-        send_queued(osdc);
         up_read(&osdc->map_sem);
 }
 
@@ -1152,6 +1139,26 @@ static void complete_request(struct ceph_osd_request *req)
         complete_all(&req->r_safe_completion);  /* fsync waiter */
 }
 
+static int __decode_pgid(void **p, void *end, struct ceph_pg *pgid)
+{
+        __u8 v;
+
+        ceph_decode_need(p, end, 1 + 8 + 4 + 4, bad);
+        v = ceph_decode_8(p);
+        if (v > 1) {
+                pr_warning("do not understand pg encoding %d > 1", v);
+                return -EINVAL;
+        }
+        pgid->pool = ceph_decode_64(p);
+        pgid->seed = ceph_decode_32(p);
+        *p += 4;
+        return 0;
+
+bad:
+        pr_warning("incomplete pg encoding");
+        return -EINVAL;
+}
+
 /*
  * handle osd op reply.  either call the callback if it is specified,
  * or do the completion to wake up the waiting thread.
@@ -1159,22 +1166,42 @@ static void complete_request(struct ceph_osd_request *req)
 static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
                          struct ceph_connection *con)
 {
-        struct ceph_osd_reply_head *rhead = msg->front.iov_base;
+        void *p, *end;
         struct ceph_osd_request *req;
         u64 tid;
-        int numops, object_len, flags;
+        int object_len;
+        int numops, payload_len, flags;
         s32 result;
+        s32 retry_attempt;
+        struct ceph_pg pg;
+        int err;
+        u32 reassert_epoch;
+        u64 reassert_version;
+        u32 osdmap_epoch;
+        int i;
 
         tid = le64_to_cpu(msg->hdr.tid);
-        if (msg->front.iov_len < sizeof(*rhead))
-                goto bad;
-        numops = le32_to_cpu(rhead->num_ops);
-        object_len = le32_to_cpu(rhead->object_len);
-        result = le32_to_cpu(rhead->result);
-        if (msg->front.iov_len != sizeof(*rhead) + object_len +
-            numops * sizeof(struct ceph_osd_op))
+        dout("handle_reply %p tid %llu\n", msg, tid);
+
+        p = msg->front.iov_base;
+        end = p + msg->front.iov_len;
+
+        ceph_decode_need(&p, end, 4, bad);
+        object_len = ceph_decode_32(&p);
+        ceph_decode_need(&p, end, object_len, bad);
+        p += object_len;
+
+        err = __decode_pgid(&p, end, &pg);
+        if (err)
                 goto bad;
-        dout("handle_reply %p tid %llu result %d\n", msg, tid, (int)result);
+
+        ceph_decode_need(&p, end, 8 + 4 + 4 + 8 + 4, bad);
+        flags = ceph_decode_64(&p);
+        result = ceph_decode_32(&p);
+        reassert_epoch = ceph_decode_32(&p);
+        reassert_version = ceph_decode_64(&p);
+        osdmap_epoch = ceph_decode_32(&p);
+
         /* lookup */
         mutex_lock(&osdc->request_mutex);
         req = __lookup_request(osdc, tid);
@@ -1184,7 +1211,38 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
                 return;
         }
         ceph_osdc_get_request(req);
-        flags = le32_to_cpu(rhead->flags);
+
+        dout("handle_reply %p tid %llu req %p result %d\n", msg, tid,
+             req, result);
+
+        ceph_decode_need(&p, end, 4, bad);
+        numops = ceph_decode_32(&p);
+        if (numops > CEPH_OSD_MAX_OP)
+                goto bad_put;
+        if (numops != req->r_num_ops)
+                goto bad_put;
+        payload_len = 0;
+        ceph_decode_need(&p, end, numops * sizeof(struct ceph_osd_op), bad);
+        for (i = 0; i < numops; i++) {
+                struct ceph_osd_op *op = p;
+                int len;
+
+                len = le32_to_cpu(op->payload_len);
+                req->r_reply_op_len[i] = len;
+                dout(" op %d has %d bytes\n", i, len);
+                payload_len += len;
+                p += sizeof(*op);
+        }
+        if (payload_len != le32_to_cpu(msg->hdr.data_len)) {
+                pr_warning("sum of op payload lens %d != data_len %d",
+                           payload_len, le32_to_cpu(msg->hdr.data_len));
+                goto bad_put;
+        }
+
+        ceph_decode_need(&p, end, 4 + numops * 4, bad);
+        retry_attempt = ceph_decode_32(&p);
+        for (i = 0; i < numops; i++)
+                req->r_reply_op_result[i] = ceph_decode_32(&p);
 
         /*
          * if this connection filled our message, drop our reference now, to
@@ -1199,7 +1257,7 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
         if (!req->r_got_reply) {
                 unsigned int bytes;
 
-                req->r_result = le32_to_cpu(rhead->result);
+                req->r_result = result;
                 bytes = le32_to_cpu(msg->hdr.data_len);
                 dout("handle_reply result %d bytes %d\n", req->r_result,
                      bytes);
@@ -1207,7 +1265,8 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
                         req->r_result = bytes;
 
                 /* in case this is a write and we need to replay, */
-                req->r_reassert_version = rhead->reassert_version;
+                req->r_reassert_version.epoch = cpu_to_le32(reassert_epoch);
+                req->r_reassert_version.version = cpu_to_le64(reassert_version);
 
                 req->r_got_reply = 1;
         } else if ((flags & CEPH_OSD_FLAG_ONDISK) == 0) {
@@ -1242,10 +1301,11 @@ done:
         ceph_osdc_put_request(req);
         return;
 
+bad_put:
+        ceph_osdc_put_request(req);
 bad:
-        pr_err("corrupt osd_op_reply got %d %d expected %d\n",
-               (int)msg->front.iov_len, le32_to_cpu(msg->hdr.front_len),
-               (int)sizeof(*rhead));
+        pr_err("corrupt osd_op_reply got %d %d\n",
+               (int)msg->front.iov_len, le32_to_cpu(msg->hdr.front_len));
         ceph_msg_dump(msg);
 }
 
@@ -1462,7 +1522,9 @@ done:
         if (ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL))
                 ceph_monc_request_next_osdmap(&osdc->client->monc);
 
-        send_queued(osdc);
+        mutex_lock(&osdc->request_mutex);
+        __send_queued(osdc);
+        mutex_unlock(&osdc->request_mutex);
         up_read(&osdc->map_sem);
         wake_up_all(&osdc->client->auth_wq);
         return;
@@ -1556,8 +1618,7 @@ static void __remove_event(struct ceph_osd_event *event)
 
 int ceph_osdc_create_event(struct ceph_osd_client *osdc,
                            void (*event_cb)(u64, u64, u8, void *),
-                           int one_shot, void *data,
-                           struct ceph_osd_event **pevent)
+                           void *data, struct ceph_osd_event **pevent)
 {
         struct ceph_osd_event *event;
 
@@ -1567,14 +1628,13 @@ int ceph_osdc_create_event(struct ceph_osd_client *osdc,
 
         dout("create_event %p\n", event);
         event->cb = event_cb;
-        event->one_shot = one_shot;
+        event->one_shot = 0;
         event->data = data;
         event->osdc = osdc;
         INIT_LIST_HEAD(&event->osd_node);
         RB_CLEAR_NODE(&event->node);
         kref_init(&event->kref);   /* one ref for us */
         kref_get(&event->kref);    /* one ref for the caller */
-        init_completion(&event->completion);
 
         spin_lock(&osdc->event_lock);
         event->cookie = ++osdc->event_count;
@@ -1610,7 +1670,6 @@ static void do_event_work(struct work_struct *work)
 
         dout("do_event_work completing %p\n", event);
         event->cb(ver, notify_id, opcode, event->data);
-        complete(&event->completion);
         dout("do_event_work completed %p\n", event);
         ceph_osdc_put_event(event);
         kfree(event_work);
@@ -1620,7 +1679,8 @@ static void do_event_work(struct work_struct *work)
 /*
  * Process osd watch notifications
  */
-void handle_watch_notify(struct ceph_osd_client *osdc, struct ceph_msg *msg)
+static void handle_watch_notify(struct ceph_osd_client *osdc,
+                                struct ceph_msg *msg)
 {
         void *p, *end;
         u8 proto_ver;
@@ -1641,9 +1701,8 @@ void handle_watch_notify(struct ceph_osd_client *osdc, struct ceph_msg *msg)
         spin_lock(&osdc->event_lock);
         event = __find_event(osdc, cookie);
         if (event) {
+                BUG_ON(event->one_shot);
                 get_event(event);
-                if (event->one_shot)
-                        __remove_event(event);
         }
         spin_unlock(&osdc->event_lock);
         dout("handle_watch_notify cookie %lld ver %lld event %p\n",
@@ -1668,7 +1727,6 @@ void handle_watch_notify(struct ceph_osd_client *osdc, struct ceph_msg *msg)
         return;
 
 done_err:
-        complete(&event->completion);
         ceph_osdc_put_event(event);
         return;
 
@@ -1677,21 +1735,6 @@ bad:
         return;
 }
 
-int ceph_osdc_wait_event(struct ceph_osd_event *event, unsigned long timeout)
-{
-        int err;
-
-        dout("wait_event %p\n", event);
-        err = wait_for_completion_interruptible_timeout(&event->completion,
-                                                        timeout * HZ);
-        ceph_osdc_put_event(event);
-        if (err > 0)
-                err = 0;
-        dout("wait_event %p returns %d\n", event, err);
-        return err;
-}
-EXPORT_SYMBOL(ceph_osdc_wait_event);
-
 /*
  * Register request, send initial attempt.
  */
@@ -1706,7 +1749,7 @@ int ceph_osdc_start_request(struct ceph_osd_client *osdc,
 #ifdef CONFIG_BLOCK
         req->r_request->bio = req->r_bio;
 #endif
-        req->r_request->trail = req->r_trail;
+        req->r_request->trail = &req->r_trail;
 
         register_request(osdc, req);
 
@@ -1865,7 +1908,6 @@ out_mempool:
 out:
         return err;
 }
-EXPORT_SYMBOL(ceph_osdc_init);
 
 void ceph_osdc_stop(struct ceph_osd_client *osdc)
 {
@@ -1882,7 +1924,6 @@ void ceph_osdc_stop(struct ceph_osd_client *osdc)
         ceph_msgpool_destroy(&osdc->msgpool_op);
         ceph_msgpool_destroy(&osdc->msgpool_op_reply);
 }
-EXPORT_SYMBOL(ceph_osdc_stop);
 
 /*
  * Read some contiguous pages.  If we cross a stripe boundary, shorten
@@ -1902,7 +1943,7 @@ int ceph_osdc_readpages(struct ceph_osd_client *osdc,
         req = ceph_osdc_new_request(osdc, layout, vino, off, plen,
                                     CEPH_OSD_OP_READ, CEPH_OSD_FLAG_READ,
                                     NULL, 0, truncate_seq, truncate_size, NULL,
-                                    false, 1, page_align);
+                                    false, page_align);
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
@@ -1931,8 +1972,7 @@ int ceph_osdc_writepages(struct ceph_osd_client *osdc, struct ceph_vino vino,
                          u64 off, u64 len,
                          u32 truncate_seq, u64 truncate_size,
                          struct timespec *mtime,
-                         struct page **pages, int num_pages,
-                         int flags, int do_sync, bool nofail)
+                         struct page **pages, int num_pages)
 {
         struct ceph_osd_request *req;
         int rc = 0;
@@ -1941,11 +1981,10 @@ int ceph_osdc_writepages(struct ceph_osd_client *osdc, struct ceph_vino vino,
         BUG_ON(vino.snap != CEPH_NOSNAP);
         req = ceph_osdc_new_request(osdc, layout, vino, off, &len,
                                     CEPH_OSD_OP_WRITE,
-                                    flags | CEPH_OSD_FLAG_ONDISK |
-                                            CEPH_OSD_FLAG_WRITE,
-                                    snapc, do_sync,
+                                    CEPH_OSD_FLAG_ONDISK | CEPH_OSD_FLAG_WRITE,
+                                    snapc, 0,
                                     truncate_seq, truncate_size, mtime,
-                                    nofail, 1, page_align);
+                                    true, page_align);
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
@@ -1954,7 +1993,7 @@ int ceph_osdc_writepages(struct ceph_osd_client *osdc, struct ceph_vino vino,
         dout("writepages %llu~%llu (%d pages)\n", off, len,
              req->r_num_pages);
 
-        rc = ceph_osdc_start_request(osdc, req, nofail);
+        rc = ceph_osdc_start_request(osdc, req, true);
         if (!rc)
                 rc = ceph_osdc_wait_request(osdc, req);
 
@@ -2047,7 +2086,7 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
         if (data_len > 0) {
                 int want = calc_pages_for(req->r_page_alignment, data_len);
 
-                if (unlikely(req->r_num_pages < want)) {
+                if (req->r_pages && unlikely(req->r_num_pages < want)) {
                         pr_warning("tid %lld reply has %d bytes %d pages, we"
                                    " had only %d pages ready\n", tid, data_len,
                                    want, req->r_num_pages);
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index de73214b5d26..69bc4bf89e3e 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -13,26 +13,18 @@
 
 char *ceph_osdmap_state_str(char *str, int len, int state)
 {
-        int flag = 0;
-
         if (!len)
-                goto done;
-
-        *str = '\0';
-        if (state) {
-                if (state & CEPH_OSD_EXISTS) {
-                        snprintf(str, len, "exists");
-                        flag = 1;
-                }
-                if (state & CEPH_OSD_UP) {
-                        snprintf(str, len, "%s%s%s", str, (flag ? ", " : ""),
-                                 "up");
-                        flag = 1;
-                }
-        } else {
+                return str;
+
+        if ((state & CEPH_OSD_EXISTS) && (state & CEPH_OSD_UP))
+                snprintf(str, len, "exists, up");
+        else if (state & CEPH_OSD_EXISTS)
+                snprintf(str, len, "exists");
+        else if (state & CEPH_OSD_UP)
+                snprintf(str, len, "up");
+        else
                 snprintf(str, len, "doesn't exist");
-        }
-done:
+
         return str;
 }
 
@@ -53,13 +45,8 @@ static int calc_bits_of(unsigned int t)
  */
 static void calc_pg_masks(struct ceph_pg_pool_info *pi)
 {
-        pi->pg_num_mask = (1 << calc_bits_of(le32_to_cpu(pi->v.pg_num)-1)) - 1;
-        pi->pgp_num_mask =
-                (1 << calc_bits_of(le32_to_cpu(pi->v.pgp_num)-1)) - 1;
-        pi->lpg_num_mask =
-                (1 << calc_bits_of(le32_to_cpu(pi->v.lpg_num)-1)) - 1;
-        pi->lpgp_num_mask =
-                (1 << calc_bits_of(le32_to_cpu(pi->v.lpgp_num)-1)) - 1;
+        pi->pg_num_mask = (1 << calc_bits_of(pi->pg_num-1)) - 1;
+        pi->pgp_num_mask = (1 << calc_bits_of(pi->pgp_num-1)) - 1;
 }
 
 /*
@@ -170,6 +157,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
         c->choose_local_tries = 2;
         c->choose_local_fallback_tries = 5;
         c->choose_total_tries = 19;
+        c->chooseleaf_descend_once = 0;
 
         ceph_decode_need(p, end, 4*sizeof(u32), bad);
         magic = ceph_decode_32(p);
@@ -336,6 +324,11 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
         dout("crush decode tunable choose_total_tries = %d",
              c->choose_total_tries);
 
+        ceph_decode_need(p, end, sizeof(u32), done);
+        c->chooseleaf_descend_once = ceph_decode_32(p);
+        dout("crush decode tunable chooseleaf_descend_once = %d",
+             c->chooseleaf_descend_once);
+
 done:
         dout("crush_decode success\n");
         return c;
@@ -354,12 +347,13 @@ bad:
  */
 static int pgid_cmp(struct ceph_pg l, struct ceph_pg r)
 {
-        u64 a = *(u64 *)&l;
-        u64 b = *(u64 *)&r;
-
-        if (a < b)
+        if (l.pool < r.pool)
+                return -1;
+        if (l.pool > r.pool)
+                return 1;
+        if (l.seed < r.seed)
                 return -1;
-        if (a > b)
+        if (l.seed > r.seed)
                 return 1;
         return 0;
 }
@@ -405,8 +399,8 @@ static struct ceph_pg_mapping *__lookup_pg_mapping(struct rb_root *root,
                 } else if (c > 0) {
                         n = n->rb_right;
                 } else {
-                        dout("__lookup_pg_mapping %llx got %p\n",
-                             *(u64 *)&pgid, pg);
+                        dout("__lookup_pg_mapping %lld.%x got %p\n",
+                             pgid.pool, pgid.seed, pg);
                         return pg;
                 }
         }
@@ -418,12 +412,13 @@ static int __remove_pg_mapping(struct rb_root *root, struct ceph_pg pgid)
         struct ceph_pg_mapping *pg = __lookup_pg_mapping(root, pgid);
 
         if (pg) {
-                dout("__remove_pg_mapping %llx %p\n", *(u64 *)&pgid, pg);
+                dout("__remove_pg_mapping %lld.%x %p\n", pgid.pool, pgid.seed,
+                     pg);
                 rb_erase(&pg->node, root);
                 kfree(pg);
                 return 0;
         }
-        dout("__remove_pg_mapping %llx dne\n", *(u64 *)&pgid);
+        dout("__remove_pg_mapping %lld.%x dne\n", pgid.pool, pgid.seed);
         return -ENOENT;
 }
 
@@ -452,7 +447,7 @@ static int __insert_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *new)
         return 0;
 }
 
-static struct ceph_pg_pool_info *__lookup_pg_pool(struct rb_root *root, int id)
+static struct ceph_pg_pool_info *__lookup_pg_pool(struct rb_root *root, u64 id)
 {
         struct ceph_pg_pool_info *pi;
         struct rb_node *n = root->rb_node;
@@ -508,24 +503,57 @@ static void __remove_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *pi)
 
 static int __decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi)
 {
-        unsigned int n, m;
+        u8 ev, cv;
+        unsigned len, num;
+        void *pool_end;
+
+        ceph_decode_need(p, end, 2 + 4, bad);
+        ev = ceph_decode_8(p);  /* encoding version */
+        cv = ceph_decode_8(p); /* compat version */
+        if (ev < 5) {
+                pr_warning("got v %d < 5 cv %d of ceph_pg_pool\n", ev, cv);
+                return -EINVAL;
+        }
+        if (cv > 7) {
+                pr_warning("got v %d cv %d > 7 of ceph_pg_pool\n", ev, cv);
+                return -EINVAL;
+        }
+        len = ceph_decode_32(p);
+        ceph_decode_need(p, end, len, bad);
+        pool_end = *p + len;
 
-        ceph_decode_copy(p, &pi->v, sizeof(pi->v));
-        calc_pg_masks(pi);
+        pi->type = ceph_decode_8(p);
+        pi->size = ceph_decode_8(p);
+        pi->crush_ruleset = ceph_decode_8(p);
+        pi->object_hash = ceph_decode_8(p);
+
+        pi->pg_num = ceph_decode_32(p);
+        pi->pgp_num = ceph_decode_32(p);
+
+        *p += 4 + 4;  /* skip lpg* */
+        *p += 4;      /* skip last_change */
+        *p += 8 + 4;  /* skip snap_seq, snap_epoch */
 
-        /* num_snaps * snap_info_t */
-        n = le32_to_cpu(pi->v.num_snaps);
-        while (n--) {
-                ceph_decode_need(p, end, sizeof(u64) + 1 + sizeof(u64) +
-                                 sizeof(struct ceph_timespec), bad);
-                *p += sizeof(u64) +       /* key */
-                        1 + sizeof(u64) + /* u8, snapid */
-                        sizeof(struct ceph_timespec);
-                m = ceph_decode_32(p);    /* snap name */
-                *p += m;
+        /* skip snaps */
+        num = ceph_decode_32(p);
+        while (num--) {
+                *p += 8;  /* snapid key */
+                *p += 1 + 1; /* versions */
+                len = ceph_decode_32(p);
+                *p += len;
         }
 
-        *p += le32_to_cpu(pi->v.num_removed_snap_intervals) * sizeof(u64) * 2;
+        /* skip removed snaps */
+        num = ceph_decode_32(p);
+        *p += num * (8 + 8);
+
+        *p += 8;  /* skip auid */
+        pi->flags = ceph_decode_64(p);
+
+        /* ignore the rest */
+
+        *p = pool_end;
+        calc_pg_masks(pi);
         return 0;
 
 bad:
@@ -535,14 +563,15 @@ bad:
 static int __decode_pool_names(void **p, void *end, struct ceph_osdmap *map)
 {
         struct ceph_pg_pool_info *pi;
-        u32 num, len, pool;
+        u32 num, len;
+        u64 pool;
 
         ceph_decode_32_safe(p, end, num, bad);
         dout(" %d pool names\n", num);
         while (num--) {
-                ceph_decode_32_safe(p, end, pool, bad);
+                ceph_decode_64_safe(p, end, pool, bad);
                 ceph_decode_32_safe(p, end, len, bad);
-                dout("  pool %d len %d\n", pool, len);
+                dout("  pool %llu len %d\n", pool, len);
                 ceph_decode_need(p, end, len, bad);
                 pi = __lookup_pg_pool(&map->pg_pools, pool);
                 if (pi) {
@@ -633,7 +662,6 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
         struct ceph_osdmap *map;
         u16 version;
         u32 len, max, i;
-        u8 ev;
         int err = -EINVAL;
         void *start = *p;
         struct ceph_pg_pool_info *pi;
@@ -646,9 +674,12 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
         map->pg_temp = RB_ROOT;
 
         ceph_decode_16_safe(p, end, version, bad);
-        if (version > CEPH_OSDMAP_VERSION) {
-                pr_warning("got unknown v %d > %d of osdmap\n", version,
-                           CEPH_OSDMAP_VERSION);
+        if (version > 6) {
+                pr_warning("got unknown v %d > 6 of osdmap\n", version);
+                goto bad;
+        }
+        if (version < 6) {
+                pr_warning("got old v %d < 6 of osdmap\n", version);
                 goto bad;
         }
 
@@ -660,20 +691,12 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
 
         ceph_decode_32_safe(p, end, max, bad);
         while (max--) {
-                ceph_decode_need(p, end, 4 + 1 + sizeof(pi->v), bad);
+                ceph_decode_need(p, end, 8 + 2, bad);
                 err = -ENOMEM;
                 pi = kzalloc(sizeof(*pi), GFP_NOFS);
                 if (!pi)
                         goto bad;
-                pi->id = ceph_decode_32(p);
-                err = -EINVAL;
-                ev = ceph_decode_8(p); /* encoding version */
-                if (ev > CEPH_PG_POOL_VERSION) {
-                        pr_warning("got unknown v %d > %d of ceph_pg_pool\n",
-                                   ev, CEPH_PG_POOL_VERSION);
-                        kfree(pi);
-                        goto bad;
-                }
+                pi->id = ceph_decode_64(p);
                 err = __decode_pool(p, end, pi);
                 if (err < 0) {
                         kfree(pi);
@@ -682,12 +705,10 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
                 __insert_pg_pool(&map->pg_pools, pi);
         }
 
-        if (version >= 5) {
-                err = __decode_pool_names(p, end, map);
-                if (err < 0) {
-                        dout("fail to decode pool names");
-                        goto bad;
-                }
+        err = __decode_pool_names(p, end, map);
+        if (err < 0) {
+                dout("fail to decode pool names");
+                goto bad;
         }
 
         ceph_decode_32_safe(p, end, map->pool_max, bad);
@@ -724,10 +745,13 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
         for (i = 0; i < len; i++) {
                 int n, j;
                 struct ceph_pg pgid;
+                struct ceph_pg_v1 pgid_v1;
                 struct ceph_pg_mapping *pg;
 
                 ceph_decode_need(p, end, sizeof(u32) + sizeof(u64), bad);
-                ceph_decode_copy(p, &pgid, sizeof(pgid));
+                ceph_decode_copy(p, &pgid_v1, sizeof(pgid_v1));
+                pgid.pool = le32_to_cpu(pgid_v1.pool);
+                pgid.seed = le16_to_cpu(pgid_v1.ps);
                 n = ceph_decode_32(p);
                 err = -EINVAL;
                 if (n > (UINT_MAX - sizeof(*pg)) / sizeof(u32))
@@ -745,7 +769,8 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
                 err = __insert_pg_mapping(pg, &map->pg_temp);
                 if (err)
                         goto bad;
-                dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid, len);
+                dout(" added pg_temp %lld.%x len %d\n", pgid.pool, pgid.seed,
+                     len);
         }
 
         /* crush */
@@ -784,16 +809,17 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         struct ceph_fsid fsid;
         u32 epoch = 0;
         struct ceph_timespec modified;
-        u32 len, pool;
-        __s32 new_pool_max, new_flags, max;
+        s32 len;
+        u64 pool;
+        __s64 new_pool_max;
+        __s32 new_flags, max;
         void *start = *p;
         int err = -EINVAL;
         u16 version;
 
         ceph_decode_16_safe(p, end, version, bad);
-        if (version > CEPH_OSDMAP_INC_VERSION) {
-                pr_warning("got unknown v %d > %d of inc osdmap\n", version,
-                           CEPH_OSDMAP_INC_VERSION);
+        if (version > 6) {
+                pr_warning("got unknown v %d > %d of inc osdmap\n", version, 6);
                 goto bad;
         }
 
@@ -803,7 +829,7 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         epoch = ceph_decode_32(p);
         BUG_ON(epoch != map->epoch+1);
         ceph_decode_copy(p, &modified, sizeof(modified));
-        new_pool_max = ceph_decode_32(p);
+        new_pool_max = ceph_decode_64(p);
         new_flags = ceph_decode_32(p);
 
         /* full map? */
@@ -853,18 +879,9 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         /* new_pool */
         ceph_decode_32_safe(p, end, len, bad);
         while (len--) {
-                __u8 ev;
                 struct ceph_pg_pool_info *pi;
 
-                ceph_decode_32_safe(p, end, pool, bad);
-                ceph_decode_need(p, end, 1 + sizeof(pi->v), bad);
-                ev = ceph_decode_8(p);  /* encoding version */
-                if (ev > CEPH_PG_POOL_VERSION) {
-                        pr_warning("got unknown v %d > %d of ceph_pg_pool\n",
-                                   ev, CEPH_PG_POOL_VERSION);
-                        err = -EINVAL;
-                        goto bad;
-                }
+                ceph_decode_64_safe(p, end, pool, bad);
                 pi = __lookup_pg_pool(&map->pg_pools, pool);
                 if (!pi) {
                         pi = kzalloc(sizeof(*pi), GFP_NOFS);
@@ -890,7 +907,7 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         while (len--) {
                 struct ceph_pg_pool_info *pi;
 
-                ceph_decode_32_safe(p, end, pool, bad);
+                ceph_decode_64_safe(p, end, pool, bad);
                 pi = __lookup_pg_pool(&map->pg_pools, pool);
                 if (pi)
                         __remove_pg_pool(&map->pg_pools, pi);
@@ -946,10 +963,13 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         while (len--) {
                 struct ceph_pg_mapping *pg;
                 int j;
+                struct ceph_pg_v1 pgid_v1;
                 struct ceph_pg pgid;
                 u32 pglen;
                 ceph_decode_need(p, end, sizeof(u64) + sizeof(u32), bad);
-                ceph_decode_copy(p, &pgid, sizeof(pgid));
+                ceph_decode_copy(p, &pgid_v1, sizeof(pgid_v1));
+                pgid.pool = le32_to_cpu(pgid_v1.pool);
+                pgid.seed = le16_to_cpu(pgid_v1.ps);
                 pglen = ceph_decode_32(p);
 
                 if (pglen) {
@@ -975,8 +995,8 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                                 kfree(pg);
                                 goto bad;
                         }
-                        dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid,
-                             pglen);
+                        dout(" added pg_temp %lld.%x len %d\n", pgid.pool,
+                             pgid.seed, pglen);
                 } else {
                         /* remove */
                         __remove_pg_mapping(&map->pg_temp, pgid);
@@ -1010,7 +1030,7 @@ bad:
  * pass a stride back to the caller.
  */
 int ceph_calc_file_object_mapping(struct ceph_file_layout *layout,
-                                   u64 off, u64 *plen,
+                                   u64 off, u64 len,
                                    u64 *ono,
                                    u64 *oxoff, u64 *oxlen)
 {
@@ -1021,7 +1041,7 @@ int ceph_calc_file_object_mapping(struct ceph_file_layout *layout,
         u32 su_per_object;
         u64 t, su_offset;
 
-        dout("mapping %llu~%llu  osize %u fl_su %u\n", off, *plen,
+        dout("mapping %llu~%llu  osize %u fl_su %u\n", off, len,
              osize, su);
         if (su == 0 || sc == 0)
                 goto invalid;
@@ -1054,11 +1074,10 @@ int ceph_calc_file_object_mapping(struct ceph_file_layout *layout,
 
         /*
          * Calculate the length of the extent being written to the selected
-         * object. This is the minimum of the full length requested (plen) or
+         * object. This is the minimum of the full length requested (len) or
          * the remainder of the current stripe being written to.
          */
-        *oxlen = min_t(u64, *plen, su - su_offset);
-        *plen = *oxlen;
+        *oxlen = min_t(u64, len, su - su_offset);
 
         dout(" obj extent %llu~%llu\n", *oxoff, *oxlen);
         return 0;
@@ -1076,33 +1095,24 @@ EXPORT_SYMBOL(ceph_calc_file_object_mapping);
  * calculate an object layout (i.e. pgid) from an oid,
  * file_layout, and osdmap
  */
-int ceph_calc_object_layout(struct ceph_object_layout *ol,
+int ceph_calc_object_layout(struct ceph_pg *pg,
                             const char *oid,
                             struct ceph_file_layout *fl,
                             struct ceph_osdmap *osdmap)
 {
         unsigned int num, num_mask;
-        struct ceph_pg pgid;
-        int poolid = le32_to_cpu(fl->fl_pg_pool);
         struct ceph_pg_pool_info *pool;
-        unsigned int ps;
 
         BUG_ON(!osdmap);
-
-        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
+        pg->pool = le32_to_cpu(fl->fl_pg_pool);
+        pool = __lookup_pg_pool(&osdmap->pg_pools, pg->pool);
         if (!pool)
                 return -EIO;
-        ps = ceph_str_hash(pool->v.object_hash, oid, strlen(oid));
-        num = le32_to_cpu(pool->v.pg_num);
+        pg->seed = ceph_str_hash(pool->object_hash, oid, strlen(oid));
+        num = pool->pg_num;
         num_mask = pool->pg_num_mask;
 
-        pgid.ps = cpu_to_le16(ps);
-        pgid.preferred = cpu_to_le16(-1);
-        pgid.pool = fl->fl_pg_pool;
-        dout("calc_object_layout '%s' pgid %d.%x\n", oid, poolid, ps);
-
-        ol->ol_pgid = pgid;
-        ol->ol_stripe_unit = fl->fl_object_stripe_unit;
+        dout("calc_object_layout '%s' pgid %lld.%x\n", oid, pg->pool, pg->seed);
         return 0;
 }
 EXPORT_SYMBOL(ceph_calc_object_layout);
@@ -1117,19 +1127,16 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
         struct ceph_pg_mapping *pg;
         struct ceph_pg_pool_info *pool;
         int ruleno;
-        unsigned int poolid, ps, pps, t, r;
-
-        poolid = le32_to_cpu(pgid.pool);
-        ps = le16_to_cpu(pgid.ps);
+        int r;
+        u32 pps;
 
-        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
+        pool = __lookup_pg_pool(&osdmap->pg_pools, pgid.pool);
         if (!pool)
                 return NULL;
 
         /* pg_temp? */
-        t = ceph_stable_mod(ps, le32_to_cpu(pool->v.pg_num),
-                            pool->pgp_num_mask);
-        pgid.ps = cpu_to_le16(t);
+        pgid.seed = ceph_stable_mod(pgid.seed, pool->pg_num,
+                                    pool->pgp_num_mask);
         pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
         if (pg) {
                 *num = pg->len;
@@ -1137,26 +1144,39 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
         }
 
         /* crush */
-        ruleno = crush_find_rule(osdmap->crush, pool->v.crush_ruleset,
-                                 pool->v.type, pool->v.size);
+        ruleno = crush_find_rule(osdmap->crush, pool->crush_ruleset,
+                                 pool->type, pool->size);
         if (ruleno < 0) {
-                pr_err("no crush rule pool %d ruleset %d type %d size %d\n",
-                       poolid, pool->v.crush_ruleset, pool->v.type,
-                       pool->v.size);
+                pr_err("no crush rule pool %lld ruleset %d type %d size %d\n",
+                       pgid.pool, pool->crush_ruleset, pool->type,
+                       pool->size);
                 return NULL;
         }
 
-        pps = ceph_stable_mod(ps,
-                              le32_to_cpu(pool->v.pgp_num),
-                              pool->pgp_num_mask);
-        pps += poolid;
+        if (pool->flags & CEPH_POOL_FLAG_HASHPSPOOL) {
+                /* hash pool id and seed sothat pool PGs do not overlap */
+                pps = crush_hash32_2(CRUSH_HASH_RJENKINS1,
+                                     ceph_stable_mod(pgid.seed, pool->pgp_num,
+                                                     pool->pgp_num_mask),
+                                     pgid.pool);
+        } else {
+                /*
+                 * legacy ehavior: add ps and pool together.  this is
+                 * not a great approach because the PGs from each pool
+                 * will overlap on top of each other: 0.5 == 1.4 ==
+                 * 2.3 == ...
+                 */
+                pps = ceph_stable_mod(pgid.seed, pool->pgp_num,
+                                      pool->pgp_num_mask) +
+                        (unsigned)pgid.pool;
+        }
         r = crush_do_rule(osdmap->crush, ruleno, pps, osds,
-                          min_t(int, pool->v.size, *num),
+                          min_t(int, pool->size, *num),
                           osdmap->osd_weight);
         if (r < 0) {
-                pr_err("error %d from crush rule: pool %d ruleset %d type %d"
-                       " size %d\n", r, poolid, pool->v.crush_ruleset,
-                       pool->v.type, pool->v.size);
+                pr_err("error %d from crush rule: pool %lld ruleset %d type %d"
+                       " size %d\n", r, pgid.pool, pool->crush_ruleset,
+                       pool->type, pool->size);
                 return NULL;
         }
         *num = r;
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
index cd9c21df87d1..815a2249cfa9 100644
--- a/net/ceph/pagevec.c
+++ b/net/ceph/pagevec.c
@@ -12,7 +12,7 @@
 /*
  * build a vector of user pages
  */
-struct page **ceph_get_direct_page_vector(const char __user *data,
+struct page **ceph_get_direct_page_vector(const void __user *data,
                                           int num_pages, bool write_page)
 {
         struct page **pages;
@@ -93,7 +93,7 @@ EXPORT_SYMBOL(ceph_alloc_page_vector);
  * copy user data into a page vector
  */
 int ceph_copy_user_to_page_vector(struct page **pages,
-                                         const char __user *data,
+                                         const void __user *data,
                                          loff_t off, size_t len)
 {
         int i = 0;
@@ -118,17 +118,17 @@ int ceph_copy_user_to_page_vector(struct page **pages,
 }
 EXPORT_SYMBOL(ceph_copy_user_to_page_vector);
 
-int ceph_copy_to_page_vector(struct page **pages,
-                                    const char *data,
+void ceph_copy_to_page_vector(struct page **pages,
+                                    const void *data,
                                     loff_t off, size_t len)
 {
         int i = 0;
         size_t po = off & ~PAGE_CACHE_MASK;
         size_t left = len;
-        size_t l;
 
         while (left > 0) {
-                l = min_t(size_t, PAGE_CACHE_SIZE-po, left);
+                size_t l = min_t(size_t, PAGE_CACHE_SIZE-po, left);
+
                 memcpy(page_address(pages[i]) + po, data, l);
                 data += l;
                 left -= l;
@@ -138,21 +138,20 @@ int ceph_copy_to_page_vector(struct page **pages,
                         i++;
                 }
         }
-        return len;
 }
 EXPORT_SYMBOL(ceph_copy_to_page_vector);
 
-int ceph_copy_from_page_vector(struct page **pages,
-                                    char *data,
+void ceph_copy_from_page_vector(struct page **pages,
+                                    void *data,
                                     loff_t off, size_t len)
 {
         int i = 0;
         size_t po = off & ~PAGE_CACHE_MASK;
         size_t left = len;
-        size_t l;
 
         while (left > 0) {
-                l = min_t(size_t, PAGE_CACHE_SIZE-po, left);
+                size_t l = min_t(size_t, PAGE_CACHE_SIZE-po, left);
+
                 memcpy(data, page_address(pages[i]) + po, l);
                 data += l;
                 left -= l;
@@ -162,7 +161,6 @@ int ceph_copy_from_page_vector(struct page **pages,
                         i++;
                 }
         }
-        return len;
 }
 EXPORT_SYMBOL(ceph_copy_from_page_vector);
 
@@ -170,7 +168,7 @@ EXPORT_SYMBOL(ceph_copy_from_page_vector);
  * copy user data from a page vector into a user pointer
  */
 int ceph_copy_page_vector_to_user(struct page **pages,
-                                         char __user *data,
+                                         void __user *data,
                                          loff_t off, size_t len)
 {
         int i = 0;
diff --git a/net/core/dev.c b/net/core/dev.c
index 17bc535115d3..a06a7a58dd11 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -658,11 +658,10 @@ __setup("netdev=", netdev_boot_setup);
 
 struct net_device *__dev_get_by_name(struct net *net, const char *name)
 {
-        struct hlist_node *p;
         struct net_device *dev;
         struct hlist_head *head = dev_name_hash(net, name);
 
-        hlist_for_each_entry(dev, p, head, name_hlist)
+        hlist_for_each_entry(dev, head, name_hlist)
                 if (!strncmp(dev->name, name, IFNAMSIZ))
                         return dev;
 
@@ -684,11 +683,10 @@ EXPORT_SYMBOL(__dev_get_by_name);
 
 struct net_device *dev_get_by_name_rcu(struct net *net, const char *name)
 {
-        struct hlist_node *p;
         struct net_device *dev;
         struct hlist_head *head = dev_name_hash(net, name);
 
-        hlist_for_each_entry_rcu(dev, p, head, name_hlist)
+        hlist_for_each_entry_rcu(dev, head, name_hlist)
                 if (!strncmp(dev->name, name, IFNAMSIZ))
                         return dev;
 
@@ -735,11 +733,10 @@ EXPORT_SYMBOL(dev_get_by_name);
 
 struct net_device *__dev_get_by_index(struct net *net, int ifindex)
 {
-        struct hlist_node *p;
         struct net_device *dev;
         struct hlist_head *head = dev_index_hash(net, ifindex);
 
-        hlist_for_each_entry(dev, p, head, index_hlist)
+        hlist_for_each_entry(dev, head, index_hlist)
                 if (dev->ifindex == ifindex)
                         return dev;
 
@@ -760,11 +757,10 @@ EXPORT_SYMBOL(__dev_get_by_index);
 
 struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex)
 {
-        struct hlist_node *p;
         struct net_device *dev;
         struct hlist_head *head = dev_index_hash(net, ifindex);
 
-        hlist_for_each_entry_rcu(dev, p, head, index_hlist)
+        hlist_for_each_entry_rcu(dev, head, index_hlist)
                 if (dev->ifindex == ifindex)
                         return dev;
 
@@ -1882,8 +1878,10 @@ int netif_set_xps_queue(struct net_device *dev, struct cpumask *mask, u16 index)
 
                 if (!new_dev_maps)
                         new_dev_maps = kzalloc(maps_sz, GFP_KERNEL);
-                if (!new_dev_maps)
+                if (!new_dev_maps) {
+                        mutex_unlock(&xps_map_mutex);
                         return -ENOMEM;
+                }
 
                 map = dev_maps ? xmap_dereference(dev_maps->cpu_map[cpu]) :
                                  NULL;
diff --git a/net/core/flow.c b/net/core/flow.c
index 43f7495df27a..c56ea6f7f6c7 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -132,14 +132,14 @@ static void __flow_cache_shrink(struct flow_cache *fc,
                                 int shrink_to)
 {
         struct flow_cache_entry *fle;
-        struct hlist_node *entry, *tmp;
+        struct hlist_node *tmp;
         LIST_HEAD(gc_list);
         int i, deleted = 0;
 
         for (i = 0; i < flow_cache_hash_size(fc); i++) {
                 int saved = 0;
 
-                hlist_for_each_entry_safe(fle, entry, tmp,
+                hlist_for_each_entry_safe(fle, tmp,
                                           &fcp->hash_table[i], u.hlist) {
                         if (saved < shrink_to &&
                             flow_entry_valid(fle)) {
@@ -211,7 +211,6 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
         struct flow_cache *fc = &flow_cache_global;
         struct flow_cache_percpu *fcp;
         struct flow_cache_entry *fle, *tfle;
-        struct hlist_node *entry;
         struct flow_cache_object *flo;
         size_t keysize;
         unsigned int hash;
@@ -235,7 +234,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
                 flow_new_hash_rnd(fc, fcp);
 
         hash = flow_hash_code(fc, fcp, key, keysize);
-        hlist_for_each_entry(tfle, entry, &fcp->hash_table[hash], u.hlist) {
+        hlist_for_each_entry(tfle, &fcp->hash_table[hash], u.hlist) {
                 if (tfle->net == net &&
                     tfle->family == family &&
                     tfle->dir == dir &&
@@ -301,13 +300,13 @@ static void flow_cache_flush_tasklet(unsigned long data)
         struct flow_cache *fc = info->cache;
         struct flow_cache_percpu *fcp;
         struct flow_cache_entry *fle;
-        struct hlist_node *entry, *tmp;
+        struct hlist_node *tmp;
         LIST_HEAD(gc_list);
         int i, deleted = 0;
 
         fcp = this_cpu_ptr(fc->percpu);
         for (i = 0; i < flow_cache_hash_size(fc); i++) {
-                hlist_for_each_entry_safe(fle, entry, tmp,
+                hlist_for_each_entry_safe(fle, tmp,
                                           &fcp->hash_table[i], u.hlist) {
                         if (flow_entry_valid(fle))
                                 continue;
diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c
index 0f6bb6f8d391..3174f1998ee6 100644
--- a/net/core/net-procfs.c
+++ b/net/core/net-procfs.c
@@ -16,12 +16,11 @@ static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff
 {
         struct net *net = seq_file_net(seq);
         struct net_device *dev;
-        struct hlist_node *p;
         struct hlist_head *h;
         unsigned int count = 0, offset = get_offset(*pos);
 
         h = &net->dev_name_head[get_bucket(*pos)];
-        hlist_for_each_entry_rcu(dev, p, h, name_hlist) {
+        hlist_for_each_entry_rcu(dev, h, name_hlist) {
                 if (++count == offset)
                         return dev;
         }
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 8acce01b6dab..80e271d9e64b 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -344,7 +344,7 @@ struct net *get_net_ns_by_fd(int fd)
         if (IS_ERR(file))
                 return ERR_CAST(file);
 
-        ei = PROC_I(file->f_dentry->d_inode);
+        ei = PROC_I(file_inode(file));
         if (ei->ns_ops == &netns_operations)
                 net = get_net(ei->ns);
         else
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d8aa20f6a46e..b376410ff259 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1060,7 +1060,6 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         int idx = 0, s_idx;
         struct net_device *dev;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct nlattr *tb[IFLA_MAX+1];
         u32 ext_filter_mask = 0;
 
@@ -1080,7 +1079,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
-                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                hlist_for_each_entry_rcu(dev, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
diff --git a/net/core/sock.c b/net/core/sock.c
index fe96c5d34299..b261a7977746 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -186,8 +186,10 @@ void mem_cgroup_sockets_destroy(struct mem_cgroup *memcg)
 static struct lock_class_key af_family_keys[AF_MAX];
 static struct lock_class_key af_family_slock_keys[AF_MAX];
 
+#if defined(CONFIG_MEMCG_KMEM)
 struct static_key memcg_socket_limit_enabled;
 EXPORT_SYMBOL(memcg_socket_limit_enabled);
+#endif
 
 /*
  * Make lock validator output more readable. (we pre-construct these
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index 602cd637182e..a29e90cf36b7 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -97,21 +97,6 @@ void sock_diag_unregister(const struct sock_diag_handler *hnld)
 }
 EXPORT_SYMBOL_GPL(sock_diag_unregister);
 
-static const inline struct sock_diag_handler *sock_diag_lock_handler(int family)
-{
-        if (sock_diag_handlers[family] == NULL)
-                request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-                                NETLINK_SOCK_DIAG, family);
-
-        mutex_lock(&sock_diag_table_mutex);
-        return sock_diag_handlers[family];
-}
-
-static inline void sock_diag_unlock_handler(const struct sock_diag_handler *h)
-{
-        mutex_unlock(&sock_diag_table_mutex);
-}
-
 static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         int err;
@@ -121,12 +106,20 @@ static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (nlmsg_len(nlh) < sizeof(*req))
                 return -EINVAL;
 
-        hndl = sock_diag_lock_handler(req->sdiag_family);
+        if (req->sdiag_family >= AF_MAX)
+                return -EINVAL;
+
+        if (sock_diag_handlers[req->sdiag_family] == NULL)
+                request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+                                NETLINK_SOCK_DIAG, req->sdiag_family);
+
+        mutex_lock(&sock_diag_table_mutex);
+        hndl = sock_diag_handlers[req->sdiag_family];
         if (hndl == NULL)
                 err = -ENOENT;
         else
                 err = hndl->dump(skb, nlh);
-        sock_diag_unlock_handler(hndl);
+        mutex_unlock(&sock_diag_table_mutex);
 
         return err;
 }
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index c4a2def5b7bd..c21f200eed93 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -175,12 +175,11 @@ static struct hlist_head *dn_find_list(struct sock *sk)
 static int check_port(__le16 port)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         if (port == 0)
                 return -1;
 
-        sk_for_each(sk, node, &dn_sk_hash[le16_to_cpu(port) & DN_SK_HASH_MASK]) {
+        sk_for_each(sk, &dn_sk_hash[le16_to_cpu(port) & DN_SK_HASH_MASK]) {
                 struct dn_scp *scp = DN_SK(sk);
                 if (scp->addrloc == port)
                         return -1;
@@ -374,11 +373,10 @@ int dn_username2sockaddr(unsigned char *data, int len, struct sockaddr_dn *sdn,
 struct sock *dn_sklist_find_listener(struct sockaddr_dn *addr)
 {
         struct hlist_head *list = listen_hash(addr);
-        struct hlist_node *node;
         struct sock *sk;
 
         read_lock(&dn_hash_lock);
-        sk_for_each(sk, node, list) {
+        sk_for_each(sk, list) {
                 struct dn_scp *scp = DN_SK(sk);
                 if (sk->sk_state != TCP_LISTEN)
                         continue;
@@ -414,11 +412,10 @@ struct sock *dn_find_by_skb(struct sk_buff *skb)
 {
         struct dn_skb_cb *cb = DN_SKB_CB(skb);
         struct sock *sk;
-        struct hlist_node *node;
         struct dn_scp *scp;
 
         read_lock(&dn_hash_lock);
-        sk_for_each(sk, node, &dn_sk_hash[le16_to_cpu(cb->dst_port) & DN_SK_HASH_MASK]) {
+        sk_for_each(sk, &dn_sk_hash[le16_to_cpu(cb->dst_port) & DN_SK_HASH_MASK]) {
                 scp = DN_SK(sk);
                 if (cb->src != dn_saddr2dn(&scp->peer))
                         continue;
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index f968c1b58f47..6c2445bcaba1 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -483,7 +483,6 @@ int dn_fib_dump(struct sk_buff *skb, struct netlink_callback *cb)
         unsigned int h, s_h;
         unsigned int e = 0, s_e;
         struct dn_fib_table *tb;
-        struct hlist_node *node;
         int dumped = 0;
 
         if (!net_eq(net, &init_net))
@@ -498,7 +497,7 @@ int dn_fib_dump(struct sk_buff *skb, struct netlink_callback *cb)
 
         for (h = s_h; h < DN_FIB_TABLE_HASHSZ; h++, s_h = 0) {
                 e = 0;
-                hlist_for_each_entry(tb, node, &dn_fib_table_hash[h], hlist) {
+                hlist_for_each_entry(tb, &dn_fib_table_hash[h], hlist) {
                         if (e < s_e)
                                 goto next;
                         if (dumped)
@@ -828,7 +827,6 @@ out:
 struct dn_fib_table *dn_fib_get_table(u32 n, int create)
 {
         struct dn_fib_table *t;
-        struct hlist_node *node;
         unsigned int h;
 
         if (n < RT_TABLE_MIN)
@@ -839,7 +837,7 @@ struct dn_fib_table *dn_fib_get_table(u32 n, int create)
 
         h = n & (DN_FIB_TABLE_HASHSZ - 1);
         rcu_read_lock();
-        hlist_for_each_entry_rcu(t, node, &dn_fib_table_hash[h], hlist) {
+        hlist_for_each_entry_rcu(t, &dn_fib_table_hash[h], hlist) {
                 if (t->n == n) {
                         rcu_read_unlock();
                         return t;
@@ -885,11 +883,10 @@ void dn_fib_flush(void)
 {
         int flushed = 0;
         struct dn_fib_table *tb;
-        struct hlist_node *node;
         unsigned int h;
 
         for (h = 0; h < DN_FIB_TABLE_HASHSZ; h++) {
-                hlist_for_each_entry(tb, node, &dn_fib_table_hash[h], hlist)
+                hlist_for_each_entry(tb, &dn_fib_table_hash[h], hlist)
                         flushed += tb->flush(tb);
         }
 
@@ -908,12 +905,12 @@ void __init dn_fib_table_init(void)
 void __exit dn_fib_table_cleanup(void)
 {
         struct dn_fib_table *t;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         unsigned int h;
 
         write_lock(&dn_fib_tables_lock);
         for (h = 0; h < DN_FIB_TABLE_HASHSZ; h++) {
-                hlist_for_each_entry_safe(t, node, next, &dn_fib_table_hash[h],
+                hlist_for_each_entry_safe(t, next, &dn_fib_table_hash[h],
                                           hlist) {
                         hlist_del(&t->hlist);
                         kfree(t);
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 16705611589a..e0da175f8e5b 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -350,7 +350,6 @@ static inline int ieee802154_match_sock(u8 *hw_addr, u16 pan_id,
 int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
 {
         struct sock *sk, *prev = NULL;
-        struct hlist_node *node;
         int ret = NET_RX_SUCCESS;
         u16 pan_id, short_addr;
 
@@ -361,7 +360,7 @@ int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
         short_addr = ieee802154_mlme_ops(dev)->get_short_addr(dev);
 
         read_lock(&dgram_lock);
-        sk_for_each(sk, node, &dgram_head) {
+        sk_for_each(sk, &dgram_head) {
                 if (ieee802154_match_sock(dev->dev_addr, pan_id, short_addr,
                                         dgram_sk(sk))) {
                         if (prev) {
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index 50e823927d49..41f538b8e59c 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -221,10 +221,9 @@ static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
 void ieee802154_raw_deliver(struct net_device *dev, struct sk_buff *skb)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         read_lock(&raw_lock);
-        sk_for_each(sk, node, &raw_head) {
+        sk_for_each(sk, &raw_head) {
                 bh_lock_sock(sk);
                 if (!sk->sk_bound_dev_if ||
                     sk->sk_bound_dev_if == dev->ifindex) {
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index e225a4e5b572..68f6a94f7661 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -248,8 +248,12 @@ EXPORT_SYMBOL(inet_listen);
 u32 inet_ehash_secret __read_mostly;
 EXPORT_SYMBOL(inet_ehash_secret);
 
+u32 ipv6_hash_secret __read_mostly;
+EXPORT_SYMBOL(ipv6_hash_secret);
+
 /*
- * inet_ehash_secret must be set exactly once
+ * inet_ehash_secret must be set exactly once, and to a non nul value
+ * ipv6_hash_secret must be set exactly once.
  */
 void build_ehash_secret(void)
 {
@@ -259,7 +263,8 @@ void build_ehash_secret(void)
                 get_random_bytes(&rnd, sizeof(rnd));
         } while (rnd == 0);
 
-        cmpxchg(&inet_ehash_secret, 0, rnd);
+        if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0)
+                get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret));
 }
 EXPORT_SYMBOL(build_ehash_secret);
 
@@ -1327,8 +1332,10 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb,
                         if (skb->next != NULL)
                                 iph->frag_off |= htons(IP_MF);
                         offset += (skb->len - skb->mac_len - iph->ihl * 4);
-                } else
-                        iph->id = htons(id++);
+                } else  {
+                        if (!(iph->frag_off & htons(IP_DF)))
+                                iph->id = htons(id++);
+                }
                 iph->tot_len = htons(skb->len - skb->mac_len);
                 iph->check = 0;
                 iph->check = ip_fast_csum(skb_network_header(skb), iph->ihl);
@@ -1572,7 +1579,7 @@ static const struct net_offload udp_offload = {
 
 static const struct net_protocol icmp_protocol = {
         .handler =      icmp_rcv,
-        .err_handler =  ping_err,
+        .err_handler =  icmp_err,
         .no_policy =    1,
         .netns_ok =     1,
 };
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 5281314886c1..f678507bc829 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -139,10 +139,9 @@ struct net_device *__ip_dev_find(struct net *net, __be32 addr, bool devref)
         u32 hash = inet_addr_hash(net, addr);
         struct net_device *result = NULL;
         struct in_ifaddr *ifa;
-        struct hlist_node *node;
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(ifa, node, &inet_addr_lst[hash], hash) {
+        hlist_for_each_entry_rcu(ifa, &inet_addr_lst[hash], hash) {
                 if (ifa->ifa_local == addr) {
                         struct net_device *dev = ifa->ifa_dev->dev;
 
@@ -588,7 +587,6 @@ static void check_lifetime(struct work_struct *work)
 {
         unsigned long now, next, next_sec, next_sched;
         struct in_ifaddr *ifa;
-        struct hlist_node *node;
         int i;
 
         now = jiffies;
@@ -596,8 +594,7 @@ static void check_lifetime(struct work_struct *work)
 
         rcu_read_lock();
         for (i = 0; i < IN4_ADDR_HSIZE; i++) {
-                hlist_for_each_entry_rcu(ifa, node,
-                                         &inet_addr_lst[i], hash) {
+                hlist_for_each_entry_rcu(ifa, &inet_addr_lst[i], hash) {
                         unsigned long age;
 
                         if (ifa->ifa_flags & IFA_F_PERMANENT)
@@ -1493,7 +1490,6 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
         struct in_device *in_dev;
         struct in_ifaddr *ifa;
         struct hlist_head *head;
-        struct hlist_node *node;
 
         s_h = cb->args[0];
         s_idx = idx = cb->args[1];
@@ -1503,7 +1499,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                 idx = 0;
                 head = &net->dev_index_head[h];
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                hlist_for_each_entry_rcu(dev, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         if (h > s_h || idx > s_idx)
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 99f00d39d10b..eb4bb12b3eb4 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -112,7 +112,6 @@ struct fib_table *fib_new_table(struct net *net, u32 id)
 struct fib_table *fib_get_table(struct net *net, u32 id)
 {
         struct fib_table *tb;
-        struct hlist_node *node;
         struct hlist_head *head;
         unsigned int h;
 
@@ -122,7 +121,7 @@ struct fib_table *fib_get_table(struct net *net, u32 id)
 
         rcu_read_lock();
         head = &net->ipv4.fib_table_hash[h];
-        hlist_for_each_entry_rcu(tb, node, head, tb_hlist) {
+        hlist_for_each_entry_rcu(tb, head, tb_hlist) {
                 if (tb->tb_id == id) {
                         rcu_read_unlock();
                         return tb;
@@ -137,13 +136,12 @@ static void fib_flush(struct net *net)
 {
         int flushed = 0;
         struct fib_table *tb;
-        struct hlist_node *node;
         struct hlist_head *head;
         unsigned int h;
 
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
                 head = &net->ipv4.fib_table_hash[h];
-                hlist_for_each_entry(tb, node, head, tb_hlist)
+                hlist_for_each_entry(tb, head, tb_hlist)
                         flushed += fib_table_flush(tb);
         }
 
@@ -656,7 +654,6 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         unsigned int h, s_h;
         unsigned int e = 0, s_e;
         struct fib_table *tb;
-        struct hlist_node *node;
         struct hlist_head *head;
         int dumped = 0;
 
@@ -670,7 +667,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
                 e = 0;
                 head = &net->ipv4.fib_table_hash[h];
-                hlist_for_each_entry(tb, node, head, tb_hlist) {
+                hlist_for_each_entry(tb, head, tb_hlist) {
                         if (e < s_e)
                                 goto next;
                         if (dumped)
@@ -1117,11 +1114,11 @@ static void ip_fib_net_exit(struct net *net)
         for (i = 0; i < FIB_TABLE_HASHSZ; i++) {
                 struct fib_table *tb;
                 struct hlist_head *head;
-                struct hlist_node *node, *tmp;
+                struct hlist_node *tmp;
 
                 head = &net->ipv4.fib_table_hash[i];
-                hlist_for_each_entry_safe(tb, node, tmp, head, tb_hlist) {
-                        hlist_del(node);
+                hlist_for_each_entry_safe(tb, tmp, head, tb_hlist) {
+                        hlist_del(&tb->tb_hlist);
                         fib_table_flush(tb);
                         fib_free_table(tb);
                 }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 4797a800faf8..8f6cb7a87cd6 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -298,14 +298,13 @@ static inline unsigned int fib_info_hashfn(const struct fib_info *fi)
 static struct fib_info *fib_find_info(const struct fib_info *nfi)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct fib_info *fi;
         unsigned int hash;
 
         hash = fib_info_hashfn(nfi);
         head = &fib_info_hash[hash];
 
-        hlist_for_each_entry(fi, node, head, fib_hash) {
+        hlist_for_each_entry(fi, head, fib_hash) {
                 if (!net_eq(fi->fib_net, nfi->fib_net))
                         continue;
                 if (fi->fib_nhs != nfi->fib_nhs)
@@ -331,7 +330,6 @@ static struct fib_info *fib_find_info(const struct fib_info *nfi)
 int ip_fib_check_default(__be32 gw, struct net_device *dev)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct fib_nh *nh;
         unsigned int hash;
 
@@ -339,7 +337,7 @@ int ip_fib_check_default(__be32 gw, struct net_device *dev)
 
         hash = fib_devindex_hashfn(dev->ifindex);
         head = &fib_info_devhash[hash];
-        hlist_for_each_entry(nh, node, head, nh_hash) {
+        hlist_for_each_entry(nh, head, nh_hash) {
                 if (nh->nh_dev == dev &&
                     nh->nh_gw == gw &&
                     !(nh->nh_flags & RTNH_F_DEAD)) {
@@ -721,10 +719,10 @@ static void fib_info_hash_move(struct hlist_head *new_info_hash,
 
         for (i = 0; i < old_size; i++) {
                 struct hlist_head *head = &fib_info_hash[i];
-                struct hlist_node *node, *n;
+                struct hlist_node *n;
                 struct fib_info *fi;
 
-                hlist_for_each_entry_safe(fi, node, n, head, fib_hash) {
+                hlist_for_each_entry_safe(fi, n, head, fib_hash) {
                         struct hlist_head *dest;
                         unsigned int new_hash;
 
@@ -739,10 +737,10 @@ static void fib_info_hash_move(struct hlist_head *new_info_hash,
 
         for (i = 0; i < old_size; i++) {
                 struct hlist_head *lhead = &fib_info_laddrhash[i];
-                struct hlist_node *node, *n;
+                struct hlist_node *n;
                 struct fib_info *fi;
 
-                hlist_for_each_entry_safe(fi, node, n, lhead, fib_lhash) {
+                hlist_for_each_entry_safe(fi, n, lhead, fib_lhash) {
                         struct hlist_head *ldest;
                         unsigned int new_hash;
 
@@ -1096,13 +1094,12 @@ int fib_sync_down_addr(struct net *net, __be32 local)
         int ret = 0;
         unsigned int hash = fib_laddr_hashfn(local);
         struct hlist_head *head = &fib_info_laddrhash[hash];
-        struct hlist_node *node;
         struct fib_info *fi;
 
         if (fib_info_laddrhash == NULL || local == 0)
                 return 0;
 
-        hlist_for_each_entry(fi, node, head, fib_lhash) {
+        hlist_for_each_entry(fi, head, fib_lhash) {
                 if (!net_eq(fi->fib_net, net))
                         continue;
                 if (fi->fib_prefsrc == local) {
@@ -1120,13 +1117,12 @@ int fib_sync_down_dev(struct net_device *dev, int force)
         struct fib_info *prev_fi = NULL;
         unsigned int hash = fib_devindex_hashfn(dev->ifindex);
         struct hlist_head *head = &fib_info_devhash[hash];
-        struct hlist_node *node;
         struct fib_nh *nh;
 
         if (force)
                 scope = -1;
 
-        hlist_for_each_entry(nh, node, head, nh_hash) {
+        hlist_for_each_entry(nh, head, nh_hash) {
                 struct fib_info *fi = nh->nh_parent;
                 int dead;
 
@@ -1232,7 +1228,6 @@ int fib_sync_up(struct net_device *dev)
         struct fib_info *prev_fi;
         unsigned int hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct fib_nh *nh;
         int ret;
 
@@ -1244,7 +1239,7 @@ int fib_sync_up(struct net_device *dev)
         head = &fib_info_devhash[hash];
         ret = 0;
 
-        hlist_for_each_entry(nh, node, head, nh_hash) {
+        hlist_for_each_entry(nh, head, nh_hash) {
                 struct fib_info *fi = nh->nh_parent;
                 int alive;
 
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 61e03da3e1f5..ff06b7543d9f 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -920,10 +920,9 @@ nomem:
 static struct leaf_info *find_leaf_info(struct leaf *l, int plen)
 {
         struct hlist_head *head = &l->list;
-        struct hlist_node *node;
         struct leaf_info *li;
 
-        hlist_for_each_entry_rcu(li, node, head, hlist)
+        hlist_for_each_entry_rcu(li, head, hlist)
                 if (li->plen == plen)
                         return li;
 
@@ -943,12 +942,11 @@ static inline struct list_head *get_fa_head(struct leaf *l, int plen)
 static void insert_leaf_info(struct hlist_head *head, struct leaf_info *new)
 {
         struct leaf_info *li = NULL, *last = NULL;
-        struct hlist_node *node;
 
         if (hlist_empty(head)) {
                 hlist_add_head_rcu(&new->hlist, head);
         } else {
-                hlist_for_each_entry(li, node, head, hlist) {
+                hlist_for_each_entry(li, head, hlist) {
                         if (new->plen > li->plen)
                                 break;
 
@@ -1354,9 +1352,8 @@ static int check_leaf(struct fib_table *tb, struct trie *t, struct leaf *l,
 {
         struct leaf_info *li;
         struct hlist_head *hhead = &l->list;
-        struct hlist_node *node;
 
-        hlist_for_each_entry_rcu(li, node, hhead, hlist) {
+        hlist_for_each_entry_rcu(li, hhead, hlist) {
                 struct fib_alias *fa;
 
                 if (l->key != (key & li->mask_plen))
@@ -1740,10 +1737,10 @@ static int trie_flush_leaf(struct leaf *l)
 {
         int found = 0;
         struct hlist_head *lih = &l->list;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         struct leaf_info *li = NULL;
 
-        hlist_for_each_entry_safe(li, node, tmp, lih, hlist) {
+        hlist_for_each_entry_safe(li, tmp, lih, hlist) {
                 found += trie_flush_list(&li->falh);
 
                 if (list_empty(&li->falh)) {
@@ -1895,14 +1892,13 @@ static int fn_trie_dump_leaf(struct leaf *l, struct fib_table *tb,
                         struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct leaf_info *li;
-        struct hlist_node *node;
         int i, s_i;
 
         s_i = cb->args[4];
         i = 0;
 
         /* rcu_read_lock is hold by caller */
-        hlist_for_each_entry_rcu(li, node, &l->list, hlist) {
+        hlist_for_each_entry_rcu(li, &l->list, hlist) {
                 if (i < s_i) {
                         i++;
                         continue;
@@ -2092,14 +2088,13 @@ static void trie_collect_stats(struct trie *t, struct trie_stat *s)
                 if (IS_LEAF(n)) {
                         struct leaf *l = (struct leaf *)n;
                         struct leaf_info *li;
-                        struct hlist_node *tmp;
 
                         s->leaves++;
                         s->totdepth += iter.depth;
                         if (iter.depth > s->maxdepth)
                                 s->maxdepth = iter.depth;
 
-                        hlist_for_each_entry_rcu(li, tmp, &l->list, hlist)
+                        hlist_for_each_entry_rcu(li, &l->list, hlist)
                                 ++s->prefixes;
                 } else {
                         const struct tnode *tn = (const struct tnode *) n;
@@ -2200,10 +2195,9 @@ static int fib_triestat_seq_show(struct seq_file *seq, void *v)
 
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
                 struct hlist_head *head = &net->ipv4.fib_table_hash[h];
-                struct hlist_node *node;
                 struct fib_table *tb;
 
-                hlist_for_each_entry_rcu(tb, node, head, tb_hlist) {
+                hlist_for_each_entry_rcu(tb, head, tb_hlist) {
                         struct trie *t = (struct trie *) tb->tb_data;
                         struct trie_stat stat;
 
@@ -2245,10 +2239,9 @@ static struct rt_trie_node *fib_trie_get_idx(struct seq_file *seq, loff_t pos)
 
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
                 struct hlist_head *head = &net->ipv4.fib_table_hash[h];
-                struct hlist_node *node;
                 struct fib_table *tb;
 
-                hlist_for_each_entry_rcu(tb, node, head, tb_hlist) {
+                hlist_for_each_entry_rcu(tb, head, tb_hlist) {
                         struct rt_trie_node *n;
 
                         for (n = fib_trie_get_first(iter,
@@ -2298,7 +2291,7 @@ static void *fib_trie_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         /* new hash chain */
         while (++h < FIB_TABLE_HASHSZ) {
                 struct hlist_head *head = &net->ipv4.fib_table_hash[h];
-                hlist_for_each_entry_rcu(tb, tb_node, head, tb_hlist) {
+                hlist_for_each_entry_rcu(tb, head, tb_hlist) {
                         n = fib_trie_get_first(iter, (struct trie *) tb->tb_data);
                         if (n)
                                 goto found;
@@ -2381,13 +2374,12 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
         } else {
                 struct leaf *l = (struct leaf *) n;
                 struct leaf_info *li;
-                struct hlist_node *node;
                 __be32 val = htonl(l->key);
 
                 seq_indent(seq, iter->depth);
                 seq_printf(seq, "  |-- %pI4\n", &val);
 
-                hlist_for_each_entry_rcu(li, node, &l->list, hlist) {
+                hlist_for_each_entry_rcu(li, &l->list, hlist) {
                         struct fib_alias *fa;
 
                         list_for_each_entry_rcu(fa, &li->falh, fa_list) {
@@ -2532,7 +2524,6 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
 {
         struct leaf *l = v;
         struct leaf_info *li;
-        struct hlist_node *node;
 
         if (v == SEQ_START_TOKEN) {
                 seq_printf(seq, "%-127s\n", "Iface\tDestination\tGateway "
@@ -2541,7 +2532,7 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
                 return 0;
         }
 
-        hlist_for_each_entry_rcu(li, node, &l->list, hlist) {
+        hlist_for_each_entry_rcu(li, &l->list, hlist) {
                 struct fib_alias *fa;
                 __be32 mask, prefix;
 
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 17ff9fd7cdda..3ac5dff79627 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -934,6 +934,29 @@ error:
         goto drop;
 }
 
+void icmp_err(struct sk_buff *skb, u32 info)
+{
+        struct iphdr *iph = (struct iphdr *)skb->data;
+        struct icmphdr *icmph = (struct icmphdr *)(skb->data+(iph->ihl<<2));
+        int type = icmp_hdr(skb)->type;
+        int code = icmp_hdr(skb)->code;
+        struct net *net = dev_net(skb->dev);
+
+        /*
+         * Use ping_err to handle all icmp errors except those
+         * triggered by ICMP_ECHOREPLY which sent from kernel.
+         */
+        if (icmph->type != ICMP_ECHOREPLY) {
+                ping_err(skb, info);
+                return;
+        }
+
+        if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
+                ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ICMP, 0);
+        else if (type == ICMP_REDIRECT)
+                ipv4_redirect(skb, net, 0, 0, IPPROTO_ICMP, 0);
+}
+
 /*
  *      This table is the definition of how we handle ICMP.
  */
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 11cb4979a465..7d1874be1df3 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -57,7 +57,6 @@ int inet_csk_bind_conflict(const struct sock *sk,
                            const struct inet_bind_bucket *tb, bool relax)
 {
         struct sock *sk2;
-        struct hlist_node *node;
         int reuse = sk->sk_reuse;
         int reuseport = sk->sk_reuseport;
         kuid_t uid = sock_i_uid((struct sock *)sk);
@@ -69,7 +68,7 @@ int inet_csk_bind_conflict(const struct sock *sk,
          * one this bucket belongs to.
          */
 
-        sk_for_each_bound(sk2, node, &tb->owners) {
+        sk_for_each_bound(sk2, &tb->owners) {
                 if (sk != sk2 &&
                     !inet_v6_ipv6only(sk2) &&
                     (!sk->sk_bound_dev_if ||
@@ -95,7 +94,7 @@ int inet_csk_bind_conflict(const struct sock *sk,
                         }
                 }
         }
-        return node != NULL;
+        return sk2 != NULL;
 }
 EXPORT_SYMBOL_GPL(inet_csk_bind_conflict);
 
@@ -106,7 +105,6 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
         struct inet_bind_hashbucket *head;
-        struct hlist_node *node;
         struct inet_bind_bucket *tb;
         int ret, attempts = 5;
         struct net *net = sock_net(sk);
@@ -129,7 +127,7 @@ again:
                         head = &hashinfo->bhash[inet_bhashfn(net, rover,
                                         hashinfo->bhash_size)];
                         spin_lock(&head->lock);
-                        inet_bind_bucket_for_each(tb, node, &head->chain)
+                        inet_bind_bucket_for_each(tb, &head->chain)
                                 if (net_eq(ib_net(tb), net) && tb->port == rover) {
                                         if (((tb->fastreuse > 0 &&
                                               sk->sk_reuse &&
@@ -183,7 +181,7 @@ have_snum:
                 head = &hashinfo->bhash[inet_bhashfn(net, snum,
                                 hashinfo->bhash_size)];
                 spin_lock(&head->lock);
-                inet_bind_bucket_for_each(tb, node, &head->chain)
+                inet_bind_bucket_for_each(tb, &head->chain)
                         if (net_eq(ib_net(tb), net) && tb->port == snum)
                                 goto tb_found;
         }
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 2e453bde6992..245ae078a07f 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -33,9 +33,9 @@ static void inet_frag_secret_rebuild(unsigned long dummy)
         get_random_bytes(&f->rnd, sizeof(u32));
         for (i = 0; i < INETFRAGS_HASHSZ; i++) {
                 struct inet_frag_queue *q;
-                struct hlist_node *p, *n;
+                struct hlist_node *n;
 
-                hlist_for_each_entry_safe(q, p, n, &f->hash[i], list) {
+                hlist_for_each_entry_safe(q, n, &f->hash[i], list) {
                         unsigned int hval = f->hashfn(q);
 
                         if (hval != i) {
@@ -203,7 +203,6 @@ static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,
 {
         struct inet_frag_queue *qp;
 #ifdef CONFIG_SMP
-        struct hlist_node *n;
 #endif
         unsigned int hash;
 
@@ -219,7 +218,7 @@ static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,
          * such entry could be created on other cpu, while we
          * promoted read lock to write lock.
          */
-        hlist_for_each_entry(qp, n, &f->hash[hash], list) {
+        hlist_for_each_entry(qp, &f->hash[hash], list) {
                 if (qp->net == nf && f->match(qp, arg)) {
                         atomic_inc(&qp->refcnt);
                         write_unlock(&f->lock);
@@ -278,9 +277,8 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
         __releases(&f->lock)
 {
         struct inet_frag_queue *q;
-        struct hlist_node *n;
 
-        hlist_for_each_entry(q, n, &f->hash[hash], list) {
+        hlist_for_each_entry(q, &f->hash[hash], list) {
                 if (q->net == nf && f->match(q, key)) {
                         atomic_inc(&q->refcnt);
                         read_unlock(&f->lock);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 0ce0595d9861..6af375afeeef 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -120,13 +120,12 @@ int __inet_inherit_port(struct sock *sk, struct sock *child)
                  * that the listener socket's icsk_bind_hash is the same
                  * as that of the child socket. We have to look up or
                  * create a new bind bucket for the child here. */
-                struct hlist_node *node;
-                inet_bind_bucket_for_each(tb, node, &head->chain) {
+                inet_bind_bucket_for_each(tb, &head->chain) {
                         if (net_eq(ib_net(tb), sock_net(sk)) &&
                             tb->port == port)
                                 break;
                 }
-                if (!node) {
+                if (!tb) {
                         tb = inet_bind_bucket_create(table->bind_bucket_cachep,
                                                      sock_net(sk), head, port);
                         if (!tb) {
@@ -493,7 +492,6 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                 int i, remaining, low, high, port;
                 static u32 hint;
                 u32 offset = hint + port_offset;
-                struct hlist_node *node;
                 struct inet_timewait_sock *tw = NULL;
 
                 inet_get_local_port_range(&low, &high);
@@ -512,7 +510,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                          * because the established check is already
                          * unique enough.
                          */
-                        inet_bind_bucket_for_each(tb, node, &head->chain) {
+                        inet_bind_bucket_for_each(tb, &head->chain) {
                                 if (net_eq(ib_net(tb), net) &&
                                     tb->port == port) {
                                         if (tb->fastreuse >= 0 ||
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 2784db3155fb..1f27c9f4afd0 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -216,7 +216,6 @@ static int inet_twdr_do_twkill_work(struct inet_timewait_death_row *twdr,
                                     const int slot)
 {
         struct inet_timewait_sock *tw;
-        struct hlist_node *node;
         unsigned int killed;
         int ret;
 
@@ -229,7 +228,7 @@ static int inet_twdr_do_twkill_work(struct inet_timewait_death_row *twdr,
         killed = 0;
         ret = 0;
 rescan:
-        inet_twsk_for_each_inmate(tw, node, &twdr->cells[slot]) {
+        inet_twsk_for_each_inmate(tw, &twdr->cells[slot]) {
                 __inet_twsk_del_dead_node(tw);
                 spin_unlock(&twdr->death_lock);
                 __inet_twsk_kill(tw, twdr->hashinfo);
@@ -438,10 +437,10 @@ void inet_twdr_twcal_tick(unsigned long data)
 
         for (n = 0; n < INET_TWDR_RECYCLE_SLOTS; n++) {
                 if (time_before_eq(j, now)) {
-                        struct hlist_node *node, *safe;
+                        struct hlist_node *safe;
                         struct inet_timewait_sock *tw;
 
-                        inet_twsk_for_each_inmate_safe(tw, node, safe,
+                        inet_twsk_for_each_inmate_safe(tw, safe,
                                                        &twdr->twcal_row[slot]) {
                                 __inet_twsk_del_dead_node(tw);
                                 __inet_twsk_kill(tw, twdr->hashinfo);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 5ef4da780ac1..d0ef0e674ec5 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -735,7 +735,7 @@ drop:
         return 0;
 }
 
-static struct sk_buff *handle_offloads(struct sk_buff *skb)
+static struct sk_buff *handle_offloads(struct ip_tunnel *tunnel, struct sk_buff *skb)
 {
         int err;
 
@@ -745,8 +745,12 @@ static struct sk_buff *handle_offloads(struct sk_buff *skb)
                         goto error;
                 skb_shinfo(skb)->gso_type |= SKB_GSO_GRE;
                 return skb;
-        }
-        if (skb->ip_summed != CHECKSUM_PARTIAL)
+        } else if (skb->ip_summed == CHECKSUM_PARTIAL &&
+                   tunnel->parms.o_flags&GRE_CSUM) {
+                err = skb_checksum_help(skb);
+                if (unlikely(err))
+                        goto error;
+        } else if (skb->ip_summed != CHECKSUM_PARTIAL)
                 skb->ip_summed = CHECKSUM_NONE;
 
         return skb;
@@ -776,7 +780,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         int    err;
         int    pkt_len;
 
-        skb = handle_offloads(skb);
+        skb = handle_offloads(tunnel, skb);
         if (IS_ERR(skb)) {
                 dev->stats.tx_dropped++;
                 return NETDEV_TX_OK;
@@ -970,7 +974,8 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         iph->daddr              =       fl4.daddr;
         iph->saddr              =       fl4.saddr;
         iph->ttl                =       ttl;
-        iph->id                 =       0;
+
+        tunnel_ip_select_ident(skb, old_iph, &rt->dst);
 
         if (ttl == 0) {
                 if (skb->protocol == htons(ETH_P_IP))
@@ -1101,14 +1106,8 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
         tunnel->hlen = addend;
         /* TCP offload with GRE SEQ is not supported. */
         if (!(tunnel->parms.o_flags & GRE_SEQ)) {
-                /* device supports enc gso offload*/
-                if (tdev->hw_enc_features & NETIF_F_GRE_GSO) {
-                        dev->features           |= NETIF_F_TSO;
-                        dev->hw_features        |= NETIF_F_TSO;
-                } else {
-                        dev->features           |= NETIF_F_GSO_SOFTWARE;
-                        dev->hw_features        |= NETIF_F_GSO_SOFTWARE;
-                }
+                dev->features           |= NETIF_F_GSO_SOFTWARE;
+                dev->hw_features        |= NETIF_F_GSO_SOFTWARE;
         }
 
         return mtu;
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 75e33a7048f8..5852b249054f 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -657,7 +657,7 @@ static int clusterip_proc_release(struct inode *inode, struct file *file)
 static ssize_t clusterip_proc_write(struct file *file, const char __user *input,
                                 size_t size, loff_t *ofs)
 {
-        struct clusterip_config *c = PDE(file->f_path.dentry->d_inode)->data;
+        struct clusterip_config *c = PDE(file_inode(file))->data;
 #define PROC_WRITELEN   10
         char buffer[PROC_WRITELEN+1];
         unsigned long nodenum;
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 55c4ee1bba06..2e91006d6076 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -322,8 +322,8 @@ void ping_err(struct sk_buff *skb, u32 info)
         struct iphdr *iph = (struct iphdr *)skb->data;
         struct icmphdr *icmph = (struct icmphdr *)(skb->data+(iph->ihl<<2));
         struct inet_sock *inet_sock;
-        int type = icmph->type;
-        int code = icmph->code;
+        int type = icmp_hdr(skb)->type;
+        int code = icmp_hdr(skb)->code;
         struct net *net = dev_net(skb->dev);
         struct sock *sk;
         int harderr;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 53ddebc292b6..dd44e0ab600c 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -111,9 +111,7 @@ EXPORT_SYMBOL_GPL(raw_unhash_sk);
 static struct sock *__raw_v4_lookup(struct net *net, struct sock *sk,
                 unsigned short num, __be32 raddr, __be32 laddr, int dif)
 {
-        struct hlist_node *node;
-
-        sk_for_each_from(sk, node) {
+        sk_for_each_from(sk) {
                 struct inet_sock *inet = inet_sk(sk);
 
                 if (net_eq(sock_net(sk), net) && inet->inet_num == num  &&
@@ -914,9 +912,7 @@ static struct sock *raw_get_first(struct seq_file *seq)
 
         for (state->bucket = 0; state->bucket < RAW_HTABLE_SIZE;
                         ++state->bucket) {
-                struct hlist_node *node;
-
-                sk_for_each(sk, node, &state->h->ht[state->bucket])
+                sk_for_each(sk, &state->h->ht[state->bucket])
                         if (sock_net(sk) == seq_file_net(seq))
                                 goto found;
         }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 7a5ba48c2cc9..47e854fcae24 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1409,10 +1409,10 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
                 return;
 
         last_issued = tp->ucopy.dma_cookie;
-        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+        dma_async_issue_pending(tp->ucopy.dma_chan);
 
         do {
-                if (dma_async_memcpy_complete(tp->ucopy.dma_chan,
+                if (dma_async_is_tx_complete(tp->ucopy.dma_chan,
                                               last_issued, &done,
                                               &used) == DMA_SUCCESS) {
                         /* Safe to free early-copied skbs now */
@@ -1754,7 +1754,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                 tcp_service_net_dma(sk, true);
                                 tcp_cleanup_rbuf(sk, copied);
                         } else
-                                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+                                dma_async_issue_pending(tp->ucopy.dma_chan);
                 }
 #endif
                 if (copied >= target) {
@@ -1847,7 +1847,7 @@ do_prequeue:
                                         break;
                                 }
 
-                                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+                                dma_async_issue_pending(tp->ucopy.dma_chan);
 
                                 if ((offset + used) == skb->len)
                                         copied_early = true;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 145d3bf8df86..4a8ec457310f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -954,7 +954,6 @@ struct tcp_md5sig_key *tcp_md5_do_lookup(struct sock *sk,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_md5sig_key *key;
-        struct hlist_node *pos;
         unsigned int size = sizeof(struct in_addr);
         struct tcp_md5sig_info *md5sig;
 
@@ -968,7 +967,7 @@ struct tcp_md5sig_key *tcp_md5_do_lookup(struct sock *sk,
         if (family == AF_INET6)
                 size = sizeof(struct in6_addr);
 #endif
-        hlist_for_each_entry_rcu(key, pos, &md5sig->head, node) {
+        hlist_for_each_entry_rcu(key, &md5sig->head, node) {
                 if (key->family != family)
                         continue;
                 if (!memcmp(&key->addr, addr, size))
@@ -1069,14 +1068,14 @@ static void tcp_clear_md5_list(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_md5sig_key *key;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
         struct tcp_md5sig_info *md5sig;
 
         md5sig = rcu_dereference_protected(tp->md5sig_info, 1);
 
         if (!hlist_empty(&md5sig->head))
                 tcp_free_md5sig_pool();
-        hlist_for_each_entry_safe(key, pos, n, &md5sig->head, node) {
+        hlist_for_each_entry_safe(key, n, &md5sig->head, node) {
                 hlist_del_rcu(&key->node);
                 atomic_sub(sizeof(*key), &sk->sk_omem_alloc);
                 kfree_rcu(key, rcu);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index fd0cea114b5d..e2b4461074da 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1351,8 +1351,8 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
         return 0;
 }
 
-/* Calculate MSS. Not accounting for SACKs here.  */
-int tcp_mtu_to_mss(struct sock *sk, int pmtu)
+/* Calculate MSS not accounting any TCP options.  */
+static inline int __tcp_mtu_to_mss(struct sock *sk, int pmtu)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -1381,13 +1381,17 @@ int tcp_mtu_to_mss(struct sock *sk, int pmtu)
         /* Then reserve room for full set of TCP options and 8 bytes of data */
         if (mss_now < 48)
                 mss_now = 48;
-
-        /* Now subtract TCP options size, not including SACKs */
-        mss_now -= tp->tcp_header_len - sizeof(struct tcphdr);
-
         return mss_now;
 }
 
+/* Calculate MSS. Not accounting for SACKs here.  */
+int tcp_mtu_to_mss(struct sock *sk, int pmtu)
+{
+        /* Subtract TCP options size, not including SACKs */
+        return __tcp_mtu_to_mss(sk, pmtu) -
+               (tcp_sk(sk)->tcp_header_len - sizeof(struct tcphdr));
+}
+
 /* Inverse of above */
 int tcp_mss_to_mtu(struct sock *sk, int mss)
 {
@@ -2930,7 +2934,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
          */
         if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < tp->rx_opt.mss_clamp)
                 tp->rx_opt.mss_clamp = tp->rx_opt.user_mss;
-        space = tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
+        space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
                 MAX_TCP_OPTION_SPACE;
 
         syn_data = skb_copy_expand(syn, skb_headroom(syn), space,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 4dc0d44a5d31..f2c7e615f902 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1419,11 +1419,10 @@ int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
                   struct net_device *dev, int strict)
 {
         struct inet6_ifaddr *ifp;
-        struct hlist_node *node;
         unsigned int hash = inet6_addr_hash(addr);
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu(ifp, node, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr) &&
@@ -1445,9 +1444,8 @@ static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
 {
         unsigned int hash = inet6_addr_hash(addr);
         struct inet6_ifaddr *ifp;
-        struct hlist_node *node;
 
-        hlist_for_each_entry(ifp, node, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr)) {
@@ -1487,10 +1485,9 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add
 {
         struct inet6_ifaddr *ifp, *result = NULL;
         unsigned int hash = inet6_addr_hash(addr);
-        struct hlist_node *node;
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu_bh(ifp, node, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr)) {
@@ -2907,11 +2904,10 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         /* Step 2: clear hash table */
         for (i = 0; i < IN6_ADDR_HSIZE; i++) {
                 struct hlist_head *h = &inet6_addr_lst[i];
-                struct hlist_node *n;
 
                 spin_lock_bh(&addrconf_hash_lock);
         restart:
-                hlist_for_each_entry_rcu(ifa, n, h, addr_lst) {
+                hlist_for_each_entry_rcu(ifa, h, addr_lst) {
                         if (ifa->idev == idev) {
                                 hlist_del_init_rcu(&ifa->addr_lst);
                                 addrconf_del_timer(ifa);
@@ -3218,8 +3214,7 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
         }
 
         for (; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
-                struct hlist_node *n;
-                hlist_for_each_entry_rcu_bh(ifa, n, &inet6_addr_lst[state->bucket],
+                hlist_for_each_entry_rcu_bh(ifa, &inet6_addr_lst[state->bucket],
                                          addr_lst) {
                         if (!net_eq(dev_net(ifa->idev->dev), net))
                                 continue;
@@ -3244,9 +3239,8 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
 {
         struct if6_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
-        struct hlist_node *n = &ifa->addr_lst;
 
-        hlist_for_each_entry_continue_rcu_bh(ifa, n, addr_lst) {
+        hlist_for_each_entry_continue_rcu_bh(ifa, addr_lst) {
                 if (!net_eq(dev_net(ifa->idev->dev), net))
                         continue;
                 state->offset++;
@@ -3255,7 +3249,7 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
 
         while (++state->bucket < IN6_ADDR_HSIZE) {
                 state->offset = 0;
-                hlist_for_each_entry_rcu_bh(ifa, n,
+                hlist_for_each_entry_rcu_bh(ifa,
                                      &inet6_addr_lst[state->bucket], addr_lst) {
                         if (!net_eq(dev_net(ifa->idev->dev), net))
                                 continue;
@@ -3357,11 +3351,10 @@ int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
 {
         int ret = 0;
         struct inet6_ifaddr *ifp = NULL;
-        struct hlist_node *n;
         unsigned int hash = inet6_addr_hash(addr);
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu_bh(ifp, n, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr) &&
@@ -3383,7 +3376,6 @@ static void addrconf_verify(unsigned long foo)
 {
         unsigned long now, next, next_sec, next_sched;
         struct inet6_ifaddr *ifp;
-        struct hlist_node *node;
         int i;
 
         rcu_read_lock_bh();
@@ -3395,7 +3387,7 @@ static void addrconf_verify(unsigned long foo)
 
         for (i = 0; i < IN6_ADDR_HSIZE; i++) {
 restart:
-                hlist_for_each_entry_rcu_bh(ifp, node,
+                hlist_for_each_entry_rcu_bh(ifp,
                                          &inet6_addr_lst[i], addr_lst) {
                         unsigned long age;
 
@@ -3866,7 +3858,6 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
         struct net_device *dev;
         struct inet6_dev *idev;
         struct hlist_head *head;
-        struct hlist_node *node;
 
         s_h = cb->args[0];
         s_idx = idx = cb->args[1];
@@ -3876,7 +3867,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
-                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                hlist_for_each_entry_rcu(dev, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         if (h > s_h || idx > s_idx)
@@ -4222,7 +4213,6 @@ static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         struct net_device *dev;
         struct inet6_dev *idev;
         struct hlist_head *head;
-        struct hlist_node *node;
 
         s_h = cb->args[0];
         s_idx = cb->args[1];
@@ -4231,7 +4221,7 @@ static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
-                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                hlist_for_each_entry_rcu(dev, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         idev = __in6_dev_get(dev);
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index ff76eecfd622..aad64352cb60 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -173,9 +173,8 @@ static struct ip6addrlbl_entry *__ipv6_addr_label(struct net *net,
                                                   const struct in6_addr *addr,
                                                   int type, int ifindex)
 {
-        struct hlist_node *pos;
         struct ip6addrlbl_entry *p;
-        hlist_for_each_entry_rcu(p, pos, &ip6addrlbl_table.head, list) {
+        hlist_for_each_entry_rcu(p, &ip6addrlbl_table.head, list) {
                 if (__ip6addrlbl_match(net, p, addr, type, ifindex))
                         return p;
         }
@@ -261,9 +260,9 @@ static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace)
         if (hlist_empty(&ip6addrlbl_table.head)) {
                 hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head);
         } else {
-                struct hlist_node *pos, *n;
+                struct hlist_node *n;
                 struct ip6addrlbl_entry *p = NULL;
-                hlist_for_each_entry_safe(p, pos, n,
+                hlist_for_each_entry_safe(p, n,
                                           &ip6addrlbl_table.head, list) {
                         if (p->prefixlen == newp->prefixlen &&
                             net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) &&
@@ -319,13 +318,13 @@ static int __ip6addrlbl_del(struct net *net,
                             int ifindex)
 {
         struct ip6addrlbl_entry *p = NULL;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
         int ret = -ESRCH;
 
         ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d)\n",
                   __func__, prefix, prefixlen, ifindex);
 
-        hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) {
+        hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) {
                 if (p->prefixlen == prefixlen &&
                     net_eq(ip6addrlbl_net(p), net) &&
                     p->ifindex == ifindex &&
@@ -380,11 +379,11 @@ static int __net_init ip6addrlbl_net_init(struct net *net)
 static void __net_exit ip6addrlbl_net_exit(struct net *net)
 {
         struct ip6addrlbl_entry *p = NULL;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
 
         /* Remove all labels belonging to the exiting net */
         spin_lock(&ip6addrlbl_table.lock);
-        hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) {
+        hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) {
                 if (net_eq(ip6addrlbl_net(p), net)) {
                         hlist_del_rcu(&p->list);
                         ip6addrlbl_put(p);
@@ -505,12 +504,11 @@ static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
         struct ip6addrlbl_entry *p;
-        struct hlist_node *pos;
         int idx = 0, s_idx = cb->args[0];
         int err;
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(p, pos, &ip6addrlbl_table.head, list) {
+        hlist_for_each_entry_rcu(p, &ip6addrlbl_table.head, list) {
                 if (idx >= s_idx &&
                     net_eq(ip6addrlbl_net(p), net)) {
                         if ((err = ip6addrlbl_fill(skb, p,
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index b386a2ce4c6f..9bfab19ff3c0 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -31,7 +31,6 @@ int inet6_csk_bind_conflict(const struct sock *sk,
                             const struct inet_bind_bucket *tb, bool relax)
 {
         const struct sock *sk2;
-        const struct hlist_node *node;
         int reuse = sk->sk_reuse;
         int reuseport = sk->sk_reuseport;
         kuid_t uid = sock_i_uid((struct sock *)sk);
@@ -41,7 +40,7 @@ int inet6_csk_bind_conflict(const struct sock *sk,
          * See comment in inet_csk_bind_conflict about sock lookup
          * vs net namespaces issues.
          */
-        sk_for_each_bound(sk2, node, &tb->owners) {
+        sk_for_each_bound(sk2, &tb->owners) {
                 if (sk != sk2 &&
                     (!sk->sk_bound_dev_if ||
                      !sk2->sk_bound_dev_if ||
@@ -58,7 +57,7 @@ int inet6_csk_bind_conflict(const struct sock *sk,
                 }
         }
 
-        return node != NULL;
+        return sk2 != NULL;
 }
 
 EXPORT_SYMBOL_GPL(inet6_csk_bind_conflict);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 710cafd2e1a9..192dd1a0e188 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -224,7 +224,6 @@ struct fib6_table *fib6_get_table(struct net *net, u32 id)
 {
         struct fib6_table *tb;
         struct hlist_head *head;
-        struct hlist_node *node;
         unsigned int h;
 
         if (id == 0)
@@ -232,7 +231,7 @@ struct fib6_table *fib6_get_table(struct net *net, u32 id)
         h = id & (FIB6_TABLE_HASHSZ - 1);
         rcu_read_lock();
         head = &net->ipv6.fib_table_hash[h];
-        hlist_for_each_entry_rcu(tb, node, head, tb6_hlist) {
+        hlist_for_each_entry_rcu(tb, head, tb6_hlist) {
                 if (tb->tb6_id == id) {
                         rcu_read_unlock();
                         return tb;
@@ -363,7 +362,6 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         struct rt6_rtnl_dump_arg arg;
         struct fib6_walker_t *w;
         struct fib6_table *tb;
-        struct hlist_node *node;
         struct hlist_head *head;
         int res = 0;
 
@@ -398,7 +396,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         for (h = s_h; h < FIB6_TABLE_HASHSZ; h++, s_e = 0) {
                 e = 0;
                 head = &net->ipv6.fib_table_hash[h];
-                hlist_for_each_entry_rcu(tb, node, head, tb6_hlist) {
+                hlist_for_each_entry_rcu(tb, head, tb6_hlist) {
                         if (e < s_e)
                                 goto next;
                         res = fib6_dump_table(tb, skb, cb);
@@ -1520,14 +1518,13 @@ void fib6_clean_all_ro(struct net *net, int (*func)(struct rt6_info *, void *arg
                     int prune, void *arg)
 {
         struct fib6_table *table;
-        struct hlist_node *node;
         struct hlist_head *head;
         unsigned int h;
 
         rcu_read_lock();
         for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
                 head = &net->ipv6.fib_table_hash[h];
-                hlist_for_each_entry_rcu(table, node, head, tb6_hlist) {
+                hlist_for_each_entry_rcu(table, head, tb6_hlist) {
                         read_lock_bh(&table->tb6_lock);
                         fib6_clean_tree(net, &table->tb6_root,
                                         func, prune, arg);
@@ -1540,14 +1537,13 @@ void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *arg),
                     int prune, void *arg)
 {
         struct fib6_table *table;
-        struct hlist_node *node;
         struct hlist_head *head;
         unsigned int h;
 
         rcu_read_lock();
         for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
                 head = &net->ipv6.fib_table_hash[h];
-                hlist_for_each_entry_rcu(table, node, head, tb6_hlist) {
+                hlist_for_each_entry_rcu(table, head, tb6_hlist) {
                         write_lock_bh(&table->tb6_lock);
                         fib6_clean_tree(net, &table->tb6_root,
                                         func, prune, arg);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index c65907db8c44..330b5e7b7df6 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -71,10 +71,9 @@ static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
                 unsigned short num, const struct in6_addr *loc_addr,
                 const struct in6_addr *rmt_addr, int dif)
 {
-        struct hlist_node *node;
         bool is_multicast = ipv6_addr_is_multicast(loc_addr);
 
-        sk_for_each_from(sk, node)
+        sk_for_each_from(sk)
                 if (inet_sk(sk)->inet_num == num) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
 
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 6cc48012b730..de2bcfaaf759 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -89,9 +89,8 @@ static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(struct net *net, const
 {
         struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
         struct xfrm6_tunnel_spi *x6spi;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry_rcu(x6spi, pos,
+        hlist_for_each_entry_rcu(x6spi,
                              &xfrm6_tn->spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                              list_byaddr) {
                 if (xfrm6_addr_equal(&x6spi->addr, saddr))
@@ -120,9 +119,8 @@ static int __xfrm6_tunnel_spi_check(struct net *net, u32 spi)
         struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
         struct xfrm6_tunnel_spi *x6spi;
         int index = xfrm6_tunnel_spi_hash_byspi(spi);
-        struct hlist_node *pos;
 
-        hlist_for_each_entry(x6spi, pos,
+        hlist_for_each_entry(x6spi,
                              &xfrm6_tn->spi_byspi[index],
                              list_byspi) {
                 if (x6spi->spi == spi)
@@ -203,11 +201,11 @@ static void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr)
 {
         struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
         struct xfrm6_tunnel_spi *x6spi;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
 
         spin_lock_bh(&xfrm6_tunnel_spi_lock);
 
-        hlist_for_each_entry_safe(x6spi, pos, n,
+        hlist_for_each_entry_safe(x6spi, n,
                                   &xfrm6_tn->spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                                   list_byaddr)
         {
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index dfd6faaf0ea7..f547a47d381c 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -228,9 +228,8 @@ static struct sock *__ipxitf_find_socket(struct ipx_interface *intrfc,
                                          __be16 port)
 {
         struct sock *s;
-        struct hlist_node *node;
 
-        sk_for_each(s, node, &intrfc->if_sklist)
+        sk_for_each(s, &intrfc->if_sklist)
                 if (ipx_sk(s)->port == port)
                         goto found;
         s = NULL;
@@ -259,12 +258,11 @@ static struct sock *ipxitf_find_internal_socket(struct ipx_interface *intrfc,
                                                 __be16 port)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         ipxitf_hold(intrfc);
         spin_lock_bh(&intrfc->if_sklist_lock);
 
-        sk_for_each(s, node, &intrfc->if_sklist) {
+        sk_for_each(s, &intrfc->if_sklist) {
                 struct ipx_sock *ipxs = ipx_sk(s);
 
                 if (ipxs->port == port &&
@@ -282,14 +280,14 @@ found:
 static void __ipxitf_down(struct ipx_interface *intrfc)
 {
         struct sock *s;
-        struct hlist_node *node, *t;
+        struct hlist_node *t;
 
         /* Delete all routes associated with this interface */
         ipxrtr_del_routes(intrfc);
 
         spin_lock_bh(&intrfc->if_sklist_lock);
         /* error sockets */
-        sk_for_each_safe(s, node, t, &intrfc->if_sklist) {
+        sk_for_each_safe(s, t, &intrfc->if_sklist) {
                 struct ipx_sock *ipxs = ipx_sk(s);
 
                 s->sk_err = ENOLINK;
@@ -385,12 +383,11 @@ static int ipxitf_demux_socket(struct ipx_interface *intrfc,
         int is_broadcast = !memcmp(ipx->ipx_dest.node, ipx_broadcast_node,
                                    IPX_NODE_LEN);
         struct sock *s;
-        struct hlist_node *node;
         int rc;
 
         spin_lock_bh(&intrfc->if_sklist_lock);
 
-        sk_for_each(s, node, &intrfc->if_sklist) {
+        sk_for_each(s, &intrfc->if_sklist) {
                 struct ipx_sock *ipxs = ipx_sk(s);
 
                 if (ipxs->port == ipx->ipx_dest.sock &&
@@ -446,12 +443,11 @@ static struct sock *ncp_connection_hack(struct ipx_interface *intrfc,
                 connection = (((int) *(ncphdr + 9)) << 8) | (int) *(ncphdr + 8);
 
         if (connection) {
-                struct hlist_node *node;
                 /* Now we have to look for a special NCP connection handling
                  * socket. Only these sockets have ipx_ncp_conn != 0, set by
                  * SIOCIPXNCPCONN. */
                 spin_lock_bh(&intrfc->if_sklist_lock);
-                sk_for_each(sk, node, &intrfc->if_sklist)
+                sk_for_each(sk, &intrfc->if_sklist)
                         if (ipx_sk(sk)->ipx_ncp_conn == connection) {
                                 sock_hold(sk);
                                 goto found;
diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c
index 02ff7f2f60d4..65e8833a2510 100644
--- a/net/ipx/ipx_proc.c
+++ b/net/ipx/ipx_proc.c
@@ -103,19 +103,18 @@ out:
 static __inline__ struct sock *ipx_get_socket_idx(loff_t pos)
 {
         struct sock *s = NULL;
-        struct hlist_node *node;
         struct ipx_interface *i;
 
         list_for_each_entry(i, &ipx_interfaces, node) {
                 spin_lock_bh(&i->if_sklist_lock);
-                sk_for_each(s, node, &i->if_sklist) {
+                sk_for_each(s, &i->if_sklist) {
                         if (!pos)
                                 break;
                         --pos;
                 }
                 spin_unlock_bh(&i->if_sklist_lock);
                 if (!pos) {
-                        if (node)
+                        if (s)
                                 goto found;
                         break;
                 }
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index cd6f7a991d80..a7d11ffe4284 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -156,14 +156,13 @@ static int afiucv_pm_freeze(struct device *dev)
 {
         struct iucv_sock *iucv;
         struct sock *sk;
-        struct hlist_node *node;
         int err = 0;
 
 #ifdef CONFIG_PM_DEBUG
         printk(KERN_WARNING "afiucv_pm_freeze\n");
 #endif
         read_lock(&iucv_sk_list.lock);
-        sk_for_each(sk, node, &iucv_sk_list.head) {
+        sk_for_each(sk, &iucv_sk_list.head) {
                 iucv = iucv_sk(sk);
                 switch (sk->sk_state) {
                 case IUCV_DISCONN:
@@ -194,13 +193,12 @@ static int afiucv_pm_freeze(struct device *dev)
 static int afiucv_pm_restore_thaw(struct device *dev)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
 #ifdef CONFIG_PM_DEBUG
         printk(KERN_WARNING "afiucv_pm_restore_thaw\n");
 #endif
         read_lock(&iucv_sk_list.lock);
-        sk_for_each(sk, node, &iucv_sk_list.head) {
+        sk_for_each(sk, &iucv_sk_list.head) {
                 switch (sk->sk_state) {
                 case IUCV_CONNECTED:
                         sk->sk_err = EPIPE;
@@ -390,9 +388,8 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
 static struct sock *__iucv_get_sock_by_name(char *nm)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
-        sk_for_each(sk, node, &iucv_sk_list.head)
+        sk_for_each(sk, &iucv_sk_list.head)
                 if (!memcmp(&iucv_sk(sk)->src_name, nm, 8))
                         return sk;
 
@@ -1678,7 +1675,6 @@ static int iucv_callback_connreq(struct iucv_path *path,
         unsigned char user_data[16];
         unsigned char nuser_data[16];
         unsigned char src_name[8];
-        struct hlist_node *node;
         struct sock *sk, *nsk;
         struct iucv_sock *iucv, *niucv;
         int err;
@@ -1689,7 +1685,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
         read_lock(&iucv_sk_list.lock);
         iucv = NULL;
         sk = NULL;
-        sk_for_each(sk, node, &iucv_sk_list.head)
+        sk_for_each(sk, &iucv_sk_list.head)
                 if (sk->sk_state == IUCV_LISTEN &&
                     !memcmp(&iucv_sk(sk)->src_name, src_name, 8)) {
                         /*
@@ -2115,7 +2111,6 @@ static int afiucv_hs_callback_rx(struct sock *sk, struct sk_buff *skb)
 static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
         struct packet_type *pt, struct net_device *orig_dev)
 {
-        struct hlist_node *node;
         struct sock *sk;
         struct iucv_sock *iucv;
         struct af_iucv_trans_hdr *trans_hdr;
@@ -2132,7 +2127,7 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
         iucv = NULL;
         sk = NULL;
         read_lock(&iucv_sk_list.lock);
-        sk_for_each(sk, node, &iucv_sk_list.head) {
+        sk_for_each(sk, &iucv_sk_list.head) {
                 if (trans_hdr->flags == AF_IUCV_FLAG_SYN) {
                         if ((!memcmp(&iucv_sk(sk)->src_name,
                                      trans_hdr->destAppName, 8)) &&
@@ -2225,10 +2220,9 @@ static void afiucv_hs_callback_txnotify(struct sk_buff *skb,
         struct sk_buff *list_skb;
         struct sk_buff *nskb;
         unsigned long flags;
-        struct hlist_node *node;
 
         read_lock_irqsave(&iucv_sk_list.lock, flags);
-        sk_for_each(sk, node, &iucv_sk_list.head)
+        sk_for_each(sk, &iucv_sk_list.head)
                 if (sk == isk) {
                         iucv = iucv_sk(sk);
                         break;
@@ -2299,14 +2293,13 @@ static int afiucv_netdev_event(struct notifier_block *this,
                                unsigned long event, void *ptr)
 {
         struct net_device *event_dev = (struct net_device *)ptr;
-        struct hlist_node *node;
         struct sock *sk;
         struct iucv_sock *iucv;
 
         switch (event) {
         case NETDEV_REBOOT:
         case NETDEV_GOING_DOWN:
-                sk_for_each(sk, node, &iucv_sk_list.head) {
+                sk_for_each(sk, &iucv_sk_list.head) {
                         iucv = iucv_sk(sk);
                         if ((iucv->hs_dev == event_dev) &&
                             (sk->sk_state == IUCV_CONNECTED)) {
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9ef79851f297..556fdafdd1ea 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -225,7 +225,6 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
 {
         struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
         struct sock *sk;
-        struct hlist_node *node;
         struct sk_buff *skb2 = NULL;
         int err = -ESRCH;
 
@@ -236,7 +235,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                 return -ENOMEM;
 
         rcu_read_lock();
-        sk_for_each_rcu(sk, node, &net_pfkey->table) {
+        sk_for_each_rcu(sk, &net_pfkey->table) {
                 struct pfkey_sock *pfk = pfkey_sk(sk);
                 int err2;
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index dcfd64e83ab7..d36875f3427e 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -221,10 +221,9 @@ static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
         struct hlist_head *session_list =
                 l2tp_session_id_hash_2(pn, session_id);
         struct l2tp_session *session;
-        struct hlist_node *walk;
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu(session, walk, session_list, global_hlist) {
+        hlist_for_each_entry_rcu(session, session_list, global_hlist) {
                 if (session->session_id == session_id) {
                         rcu_read_unlock_bh();
                         return session;
@@ -253,7 +252,6 @@ struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunn
 {
         struct hlist_head *session_list;
         struct l2tp_session *session;
-        struct hlist_node *walk;
 
         /* In L2TPv3, session_ids are unique over all tunnels and we
          * sometimes need to look them up before we know the
@@ -264,7 +262,7 @@ struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunn
 
         session_list = l2tp_session_id_hash(tunnel, session_id);
         read_lock_bh(&tunnel->hlist_lock);
-        hlist_for_each_entry(session, walk, session_list, hlist) {
+        hlist_for_each_entry(session, session_list, hlist) {
                 if (session->session_id == session_id) {
                         read_unlock_bh(&tunnel->hlist_lock);
                         return session;
@@ -279,13 +277,12 @@ EXPORT_SYMBOL_GPL(l2tp_session_find);
 struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
 {
         int hash;
-        struct hlist_node *walk;
         struct l2tp_session *session;
         int count = 0;
 
         read_lock_bh(&tunnel->hlist_lock);
         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
-                hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) {
+                hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
                         if (++count > nth) {
                                 read_unlock_bh(&tunnel->hlist_lock);
                                 return session;
@@ -306,12 +303,11 @@ struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
 {
         struct l2tp_net *pn = l2tp_pernet(net);
         int hash;
-        struct hlist_node *walk;
         struct l2tp_session *session;
 
         rcu_read_lock_bh();
         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
-                hlist_for_each_entry_rcu(session, walk, &pn->l2tp_session_hlist[hash], global_hlist) {
+                hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
                         if (!strcmp(session->ifname, ifname)) {
                                 rcu_read_unlock_bh();
                                 return session;
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index f7ac8f42fee2..7f41b7051269 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -49,10 +49,9 @@ static inline struct l2tp_ip_sock *l2tp_ip_sk(const struct sock *sk)
 
 static struct sock *__l2tp_ip_bind_lookup(struct net *net, __be32 laddr, int dif, u32 tunnel_id)
 {
-        struct hlist_node *node;
         struct sock *sk;
 
-        sk_for_each_bound(sk, node, &l2tp_ip_bind_table) {
+        sk_for_each_bound(sk, &l2tp_ip_bind_table) {
                 struct inet_sock *inet = inet_sk(sk);
                 struct l2tp_ip_sock *l2tp = l2tp_ip_sk(sk);
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 8ee4a86ae996..41f2f8126ebc 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -60,10 +60,9 @@ static struct sock *__l2tp_ip6_bind_lookup(struct net *net,
                                            struct in6_addr *laddr,
                                            int dif, u32 tunnel_id)
 {
-        struct hlist_node *node;
         struct sock *sk;
 
-        sk_for_each_bound(sk, node, &l2tp_ip6_bind_table) {
+        sk_for_each_bound(sk, &l2tp_ip6_bind_table) {
                 struct in6_addr *addr = inet6_rcv_saddr(sk);
                 struct l2tp_ip6_sock *l2tp = l2tp_ip6_sk(sk);
 
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 7c5073badc73..78be45cda5c1 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -393,12 +393,11 @@ static void llc_sap_mcast(struct llc_sap *sap,
 {
         int i = 0, count = 256 / sizeof(struct sock *);
         struct sock *sk, *stack[count];
-        struct hlist_node *node;
         struct llc_sock *llc;
         struct hlist_head *dev_hb = llc_sk_dev_hash(sap, skb->dev->ifindex);
 
         spin_lock_bh(&sap->sk_lock);
-        hlist_for_each_entry(llc, node, dev_hb, dev_hash_node) {
+        hlist_for_each_entry(llc, dev_hb, dev_hash_node) {
 
                 sk = &llc->sk;
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index d0dd11153a6c..1a8591b77a13 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -647,8 +647,6 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         spin_lock_init(&local->ack_status_lock);
         idr_init(&local->ack_status_frames);
-        /* preallocate at least one entry */
-        idr_pre_get(&local->ack_status_frames, GFP_KERNEL);
 
         sta_info_init(local);
 
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 6b3c4e119c63..dc7c8df40c2c 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -72,9 +72,9 @@ static inline struct mesh_table *resize_dereference_mpp_paths(void)
  * it's used twice. So it is illegal to do
  *      for_each_mesh_entry(rcu_dereference(...), ...)
  */
-#define for_each_mesh_entry(tbl, p, node, i) \
+#define for_each_mesh_entry(tbl, node, i) \
         for (i = 0; i <= tbl->hash_mask; i++) \
-                hlist_for_each_entry_rcu(node, p, &tbl->hash_buckets[i], list)
+                hlist_for_each_entry_rcu(node, &tbl->hash_buckets[i], list)
 
 
 static struct mesh_table *mesh_table_alloc(int size_order)
@@ -139,7 +139,7 @@ static void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
         }
         if (free_leafs) {
                 spin_lock_bh(&tbl->gates_lock);
-                hlist_for_each_entry_safe(gate, p, q,
+                hlist_for_each_entry_safe(gate, q,
                                          tbl->known_gates, list) {
                         hlist_del(&gate->list);
                         kfree(gate);
@@ -333,12 +333,11 @@ static struct mesh_path *mpath_lookup(struct mesh_table *tbl, const u8 *dst,
                                       struct ieee80211_sub_if_data *sdata)
 {
         struct mesh_path *mpath;
-        struct hlist_node *n;
         struct hlist_head *bucket;
         struct mpath_node *node;
 
         bucket = &tbl->hash_buckets[mesh_table_hash(dst, sdata, tbl)];
-        hlist_for_each_entry_rcu(node, n, bucket, list) {
+        hlist_for_each_entry_rcu(node, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
                     ether_addr_equal(dst, mpath->dst)) {
@@ -389,11 +388,10 @@ mesh_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx)
 {
         struct mesh_table *tbl = rcu_dereference(mesh_paths);
         struct mpath_node *node;
-        struct hlist_node *p;
         int i;
         int j = 0;
 
-        for_each_mesh_entry(tbl, p, node, i) {
+        for_each_mesh_entry(tbl, node, i) {
                 if (sdata && node->mpath->sdata != sdata)
                         continue;
                 if (j++ == idx) {
@@ -417,13 +415,12 @@ int mesh_path_add_gate(struct mesh_path *mpath)
 {
         struct mesh_table *tbl;
         struct mpath_node *gate, *new_gate;
-        struct hlist_node *n;
         int err;
 
         rcu_read_lock();
         tbl = rcu_dereference(mesh_paths);
 
-        hlist_for_each_entry_rcu(gate, n, tbl->known_gates, list)
+        hlist_for_each_entry_rcu(gate, tbl->known_gates, list)
                 if (gate->mpath == mpath) {
                         err = -EEXIST;
                         goto err_rcu;
@@ -460,9 +457,9 @@ err_rcu:
 static void mesh_gate_del(struct mesh_table *tbl, struct mesh_path *mpath)
 {
         struct mpath_node *gate;
-        struct hlist_node *p, *q;
+        struct hlist_node *q;
 
-        hlist_for_each_entry_safe(gate, p, q, tbl->known_gates, list) {
+        hlist_for_each_entry_safe(gate, q, tbl->known_gates, list) {
                 if (gate->mpath != mpath)
                         continue;
                 spin_lock_bh(&tbl->gates_lock);
@@ -504,7 +501,6 @@ int mesh_path_add(struct ieee80211_sub_if_data *sdata, const u8 *dst)
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
-        struct hlist_node *n;
         int grow = 0;
         int err = 0;
         u32 hash_idx;
@@ -550,7 +546,7 @@ int mesh_path_add(struct ieee80211_sub_if_data *sdata, const u8 *dst)
         spin_lock(&tbl->hashwlock[hash_idx]);
 
         err = -EEXIST;
-        hlist_for_each_entry(node, n, bucket, list) {
+        hlist_for_each_entry(node, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
                     ether_addr_equal(dst, mpath->dst))
@@ -640,7 +636,6 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
-        struct hlist_node *n;
         int grow = 0;
         int err = 0;
         u32 hash_idx;
@@ -680,7 +675,7 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
         spin_lock(&tbl->hashwlock[hash_idx]);
 
         err = -EEXIST;
-        hlist_for_each_entry(node, n, bucket, list) {
+        hlist_for_each_entry(node, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
                     ether_addr_equal(dst, mpath->dst))
@@ -725,14 +720,13 @@ void mesh_plink_broken(struct sta_info *sta)
         static const u8 bcast[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
         struct mesh_path *mpath;
         struct mpath_node *node;
-        struct hlist_node *p;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         int i;
         __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_DEST_UNREACHABLE);
 
         rcu_read_lock();
         tbl = rcu_dereference(mesh_paths);
-        for_each_mesh_entry(tbl, p, node, i) {
+        for_each_mesh_entry(tbl, node, i) {
                 mpath = node->mpath;
                 if (rcu_dereference(mpath->next_hop) == sta &&
                     mpath->flags & MESH_PATH_ACTIVE &&
@@ -792,13 +786,12 @@ void mesh_path_flush_by_nexthop(struct sta_info *sta)
         struct mesh_table *tbl;
         struct mesh_path *mpath;
         struct mpath_node *node;
-        struct hlist_node *p;
         int i;
 
         rcu_read_lock();
         read_lock_bh(&pathtbl_resize_lock);
         tbl = resize_dereference_mesh_paths();
-        for_each_mesh_entry(tbl, p, node, i) {
+        for_each_mesh_entry(tbl, node, i) {
                 mpath = node->mpath;
                 if (rcu_dereference(mpath->next_hop) == sta) {
                         spin_lock(&tbl->hashwlock[i]);
@@ -815,11 +808,10 @@ static void table_flush_by_iface(struct mesh_table *tbl,
 {
         struct mesh_path *mpath;
         struct mpath_node *node;
-        struct hlist_node *p;
         int i;
 
         WARN_ON(!rcu_read_lock_held());
-        for_each_mesh_entry(tbl, p, node, i) {
+        for_each_mesh_entry(tbl, node, i) {
                 mpath = node->mpath;
                 if (mpath->sdata != sdata)
                         continue;
@@ -865,7 +857,6 @@ int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
         struct mesh_path *mpath;
         struct mpath_node *node;
         struct hlist_head *bucket;
-        struct hlist_node *n;
         int hash_idx;
         int err = 0;
 
@@ -875,7 +866,7 @@ int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
         bucket = &tbl->hash_buckets[hash_idx];
 
         spin_lock(&tbl->hashwlock[hash_idx]);
-        hlist_for_each_entry(node, n, bucket, list) {
+        hlist_for_each_entry(node, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
                     ether_addr_equal(addr, mpath->dst)) {
@@ -920,7 +911,6 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
 int mesh_path_send_to_gates(struct mesh_path *mpath)
 {
         struct ieee80211_sub_if_data *sdata = mpath->sdata;
-        struct hlist_node *n;
         struct mesh_table *tbl;
         struct mesh_path *from_mpath = mpath;
         struct mpath_node *gate = NULL;
@@ -935,7 +925,7 @@ int mesh_path_send_to_gates(struct mesh_path *mpath)
         if (!known_gates)
                 return -EHOSTUNREACH;
 
-        hlist_for_each_entry_rcu(gate, n, known_gates, list) {
+        hlist_for_each_entry_rcu(gate, known_gates, list) {
                 if (gate->mpath->sdata != sdata)
                         continue;
 
@@ -951,7 +941,7 @@ int mesh_path_send_to_gates(struct mesh_path *mpath)
                 }
         }
 
-        hlist_for_each_entry_rcu(gate, n, known_gates, list)
+        hlist_for_each_entry_rcu(gate, known_gates, list)
                 if (gate->mpath->sdata == sdata) {
                         mpath_dbg(sdata, "Sending to %pM\n", gate->mpath->dst);
                         mesh_path_tx_pending(gate->mpath);
@@ -1096,12 +1086,11 @@ void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
         struct mesh_table *tbl;
         struct mesh_path *mpath;
         struct mpath_node *node;
-        struct hlist_node *p;
         int i;
 
         rcu_read_lock();
         tbl = rcu_dereference(mesh_paths);
-        for_each_mesh_entry(tbl, p, node, i) {
+        for_each_mesh_entry(tbl, node, i) {
                 if (node->mpath->sdata != sdata)
                         continue;
                 mpath = node->mpath;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5b9602b62405..de8548bf0a7f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2017,24 +2017,14 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 skb = skb_clone(skb, GFP_ATOMIC);
                 if (skb) {
                         unsigned long flags;
-                        int id, r;
+                        int id;
 
                         spin_lock_irqsave(&local->ack_status_lock, flags);
-                        r = idr_get_new_above(&local->ack_status_frames,
-                                              orig_skb, 1, &id);
-                        if (r == -EAGAIN) {
-                                idr_pre_get(&local->ack_status_frames,
-                                            GFP_ATOMIC);
-                                r = idr_get_new_above(&local->ack_status_frames,
-                                                      orig_skb, 1, &id);
-                        }
-                        if (WARN_ON(!id) || id > 0xffff) {
-                                idr_remove(&local->ack_status_frames, id);
-                                r = -ERANGE;
-                        }
+                        id = idr_alloc(&local->ack_status_frames, orig_skb,
+                                       1, 0x10000, GFP_ATOMIC);
                         spin_unlock_irqrestore(&local->ack_status_lock, flags);
 
-                        if (!r) {
+                        if (id >= 0) {
                                 info_id = id;
                                 info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
                         } else if (skb_shared(skb)) {
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 9f00db7e03f2..704e514e02ab 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -259,13 +259,12 @@ __ip_vs_conn_in_get(const struct ip_vs_conn_param *p)
 {
         unsigned int hash;
         struct ip_vs_conn *cp;
-        struct hlist_node *n;
 
         hash = ip_vs_conn_hashkey_param(p, false);
 
         ct_read_lock(hash);
 
-        hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {
+        hlist_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                 if (cp->af == p->af &&
                     p->cport == cp->cport && p->vport == cp->vport &&
                     ip_vs_addr_equal(p->af, p->caddr, &cp->caddr) &&
@@ -344,13 +343,12 @@ struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p)
 {
         unsigned int hash;
         struct ip_vs_conn *cp;
-        struct hlist_node *n;
 
         hash = ip_vs_conn_hashkey_param(p, false);
 
         ct_read_lock(hash);
 
-        hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {
+        hlist_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                 if (!ip_vs_conn_net_eq(cp, p->net))
                         continue;
                 if (p->pe_data && p->pe->ct_match) {
@@ -394,7 +392,6 @@ struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p)
 {
         unsigned int hash;
         struct ip_vs_conn *cp, *ret=NULL;
-        struct hlist_node *n;
 
         /*
          *      Check for "full" addressed entries
@@ -403,7 +400,7 @@ struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p)
 
         ct_read_lock(hash);
 
-        hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {
+        hlist_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                 if (cp->af == p->af &&
                     p->vport == cp->cport && p->cport == cp->dport &&
                     ip_vs_addr_equal(p->af, p->vaddr, &cp->caddr) &&
@@ -953,11 +950,10 @@ static void *ip_vs_conn_array(struct seq_file *seq, loff_t pos)
         int idx;
         struct ip_vs_conn *cp;
         struct ip_vs_iter_state *iter = seq->private;
-        struct hlist_node *n;
 
         for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {
                 ct_read_lock_bh(idx);
-                hlist_for_each_entry(cp, n, &ip_vs_conn_tab[idx], c_list) {
+                hlist_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
                         if (pos-- == 0) {
                                 iter->l = &ip_vs_conn_tab[idx];
                                 return cp;
@@ -981,7 +977,6 @@ static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct ip_vs_conn *cp = v;
         struct ip_vs_iter_state *iter = seq->private;
-        struct hlist_node *e;
         struct hlist_head *l = iter->l;
         int idx;
 
@@ -990,15 +985,15 @@ static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                 return ip_vs_conn_array(seq, 0);
 
         /* more on same hash chain? */
-        if ((e = cp->c_list.next))
-                return hlist_entry(e, struct ip_vs_conn, c_list);
+        if (cp->c_list.next)
+                return hlist_entry(cp->c_list.next, struct ip_vs_conn, c_list);
 
         idx = l - ip_vs_conn_tab;
         ct_read_unlock_bh(idx);
 
         while (++idx < ip_vs_conn_tab_size) {
                 ct_read_lock_bh(idx);
-                hlist_for_each_entry(cp, e, &ip_vs_conn_tab[idx], c_list) {
+                hlist_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
                         iter->l = &ip_vs_conn_tab[idx];
                         return cp;
                 }
@@ -1200,14 +1195,13 @@ void ip_vs_random_dropentry(struct net *net)
          */
         for (idx = 0; idx < (ip_vs_conn_tab_size>>5); idx++) {
                 unsigned int hash = net_random() & ip_vs_conn_tab_mask;
-                struct hlist_node *n;
 
                 /*
                  *  Lock is actually needed in this loop.
                  */
                 ct_write_lock_bh(hash);
 
-                hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {
+                hlist_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                         if (cp->flags & IP_VS_CONN_F_TEMPLATE)
                                 /* connection template */
                                 continue;
@@ -1255,14 +1249,12 @@ static void ip_vs_conn_flush(struct net *net)
 
 flush_again:
         for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {
-                struct hlist_node *n;
-
                 /*
                  *  Lock is actually needed in this loop.
                  */
                 ct_write_lock_bh(idx);
 
-                hlist_for_each_entry(cp, n, &ip_vs_conn_tab[idx], c_list) {
+                hlist_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
                         if (!ip_vs_conn_net_eq(cp, net))
                                 continue;
                         IP_VS_DBG(4, "del connection\n");
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 3921e5bc1235..8c10e3db3d9b 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -90,14 +90,13 @@ __nf_ct_expect_find(struct net *net, u16 zone,
                     const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_expect *i;
-        struct hlist_node *n;
         unsigned int h;
 
         if (!net->ct.expect_count)
                 return NULL;
 
         h = nf_ct_expect_dst_hash(tuple);
-        hlist_for_each_entry_rcu(i, n, &net->ct.expect_hash[h], hnode) {
+        hlist_for_each_entry_rcu(i, &net->ct.expect_hash[h], hnode) {
                 if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
                     nf_ct_zone(i->master) == zone)
                         return i;
@@ -130,14 +129,13 @@ nf_ct_find_expectation(struct net *net, u16 zone,
                        const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_expect *i, *exp = NULL;
-        struct hlist_node *n;
         unsigned int h;
 
         if (!net->ct.expect_count)
                 return NULL;
 
         h = nf_ct_expect_dst_hash(tuple);
-        hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) {
+        hlist_for_each_entry(i, &net->ct.expect_hash[h], hnode) {
                 if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&
                     nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
                     nf_ct_zone(i->master) == zone) {
@@ -172,13 +170,13 @@ void nf_ct_remove_expectations(struct nf_conn *ct)
 {
         struct nf_conn_help *help = nfct_help(ct);
         struct nf_conntrack_expect *exp;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
 
         /* Optimization: most connection never expect any others. */
         if (!help)
                 return;
 
-        hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
+        hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
                 if (del_timer(&exp->timeout)) {
                         nf_ct_unlink_expect(exp);
                         nf_ct_expect_put(exp);
@@ -348,9 +346,8 @@ static void evict_oldest_expect(struct nf_conn *master,
 {
         struct nf_conn_help *master_help = nfct_help(master);
         struct nf_conntrack_expect *exp, *last = NULL;
-        struct hlist_node *n;
 
-        hlist_for_each_entry(exp, n, &master_help->expectations, lnode) {
+        hlist_for_each_entry(exp, &master_help->expectations, lnode) {
                 if (exp->class == new->class)
                         last = exp;
         }
@@ -369,7 +366,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
         struct nf_conn_help *master_help = nfct_help(master);
         struct nf_conntrack_helper *helper;
         struct net *net = nf_ct_exp_net(expect);
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         unsigned int h;
         int ret = 1;
 
@@ -378,7 +375,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
                 goto out;
         }
         h = nf_ct_expect_dst_hash(&expect->tuple);
-        hlist_for_each_entry_safe(i, n, next, &net->ct.expect_hash[h], hnode) {
+        hlist_for_each_entry_safe(i, next, &net->ct.expect_hash[h], hnode) {
                 if (expect_matches(i, expect)) {
                         if (del_timer(&i->timeout)) {
                                 nf_ct_unlink_expect(i);
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 013cdf69fe29..a9740bd6fe54 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -116,14 +116,13 @@ __nf_ct_helper_find(const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_helper *helper;
         struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) };
-        struct hlist_node *n;
         unsigned int h;
 
         if (!nf_ct_helper_count)
                 return NULL;
 
         h = helper_hash(tuple);
-        hlist_for_each_entry_rcu(helper, n, &nf_ct_helper_hash[h], hnode) {
+        hlist_for_each_entry_rcu(helper, &nf_ct_helper_hash[h], hnode) {
                 if (nf_ct_tuple_src_mask_cmp(tuple, &helper->tuple, &mask))
                         return helper;
         }
@@ -134,11 +133,10 @@ struct nf_conntrack_helper *
 __nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum)
 {
         struct nf_conntrack_helper *h;
-        struct hlist_node *n;
         unsigned int i;
 
         for (i = 0; i < nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_rcu(h, n, &nf_ct_helper_hash[i], hnode) {
+                hlist_for_each_entry_rcu(h, &nf_ct_helper_hash[i], hnode) {
                         if (!strcmp(h->name, name) &&
                             h->tuple.src.l3num == l3num &&
                             h->tuple.dst.protonum == protonum)
@@ -357,7 +355,6 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
 {
         int ret = 0;
         struct nf_conntrack_helper *cur;
-        struct hlist_node *n;
         unsigned int h = helper_hash(&me->tuple);
 
         BUG_ON(me->expect_policy == NULL);
@@ -365,7 +362,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
         BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1);
 
         mutex_lock(&nf_ct_helper_mutex);
-        hlist_for_each_entry(cur, n, &nf_ct_helper_hash[h], hnode) {
+        hlist_for_each_entry(cur, &nf_ct_helper_hash[h], hnode) {
                 if (strncmp(cur->name, me->name, NF_CT_HELPER_NAME_LEN) == 0 &&
                     cur->tuple.src.l3num == me->tuple.src.l3num &&
                     cur->tuple.dst.protonum == me->tuple.dst.protonum) {
@@ -386,13 +383,13 @@ static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
 {
         struct nf_conntrack_tuple_hash *h;
         struct nf_conntrack_expect *exp;
-        const struct hlist_node *n, *next;
+        const struct hlist_node *next;
         const struct hlist_nulls_node *nn;
         unsigned int i;
 
         /* Get rid of expectations */
         for (i = 0; i < nf_ct_expect_hsize; i++) {
-                hlist_for_each_entry_safe(exp, n, next,
+                hlist_for_each_entry_safe(exp, next,
                                           &net->ct.expect_hash[i], hnode) {
                         struct nf_conn_help *help = nfct_help(exp->master);
                         if ((rcu_dereference_protected(
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 5d60e04f9679..9904b15f600e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2370,14 +2370,13 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct net *net = sock_net(skb->sk);
         struct nf_conntrack_expect *exp, *last;
         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
-        struct hlist_node *n;
         u_int8_t l3proto = nfmsg->nfgen_family;
 
         rcu_read_lock();
         last = (struct nf_conntrack_expect *)cb->args[1];
         for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
 restart:
-                hlist_for_each_entry(exp, n, &net->ct.expect_hash[cb->args[0]],
+                hlist_for_each_entry(exp, &net->ct.expect_hash[cb->args[0]],
                                      hnode) {
                         if (l3proto && exp->tuple.src.l3num != l3proto)
                                 continue;
@@ -2510,7 +2509,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
         struct nf_conntrack_expect *exp;
         struct nf_conntrack_tuple tuple;
         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         u_int8_t u3 = nfmsg->nfgen_family;
         unsigned int i;
         u16 zone;
@@ -2557,7 +2556,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                 /* delete all expectations for this helper */
                 spin_lock_bh(&nf_conntrack_lock);
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
-                        hlist_for_each_entry_safe(exp, n, next,
+                        hlist_for_each_entry_safe(exp, next,
                                                   &net->ct.expect_hash[i],
                                                   hnode) {
                                 m_help = nfct_help(exp->master);
@@ -2575,7 +2574,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                 /* This basically means we have to flush everything*/
                 spin_lock_bh(&nf_conntrack_lock);
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
-                        hlist_for_each_entry_safe(exp, n, next,
+                        hlist_for_each_entry_safe(exp, next,
                                                   &net->ct.expect_hash[i],
                                                   hnode) {
                                 if (del_timer(&exp->timeout)) {
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 069229d919b6..0e7d423324c3 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -855,11 +855,11 @@ static int refresh_signalling_expectation(struct nf_conn *ct,
 {
         struct nf_conn_help *help = nfct_help(ct);
         struct nf_conntrack_expect *exp;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         int found = 0;
 
         spin_lock_bh(&nf_conntrack_lock);
-        hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
+        hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
                 if (exp->class != SIP_EXPECT_SIGNALLING ||
                     !nf_inet_addr_cmp(&exp->tuple.dst.u3, addr) ||
                     exp->tuple.dst.protonum != proto ||
@@ -881,10 +881,10 @@ static void flush_expectations(struct nf_conn *ct, bool media)
 {
         struct nf_conn_help *help = nfct_help(ct);
         struct nf_conntrack_expect *exp;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
 
         spin_lock_bh(&nf_conntrack_lock);
-        hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
+        hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
                 if ((exp->class != SIP_EXPECT_SIGNALLING) ^ media)
                         continue;
                 if (!del_timer(&exp->timeout))
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 5f2f9109f461..8d5769c6d16e 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -191,9 +191,8 @@ find_appropriate_src(struct net *net, u16 zone,
         unsigned int h = hash_by_src(net, zone, tuple);
         const struct nf_conn_nat *nat;
         const struct nf_conn *ct;
-        const struct hlist_node *n;
 
-        hlist_for_each_entry_rcu(nat, n, &net->ct.nat_bysource[h], bysource) {
+        hlist_for_each_entry_rcu(nat, &net->ct.nat_bysource[h], bysource) {
                 ct = nat->ct;
                 if (same_src(ct, tuple) && nf_ct_zone(ct) == zone) {
                         /* Copy source part from reply tuple. */
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 945950a8b1f1..a191b6db657e 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -282,7 +282,6 @@ nfnl_cthelper_new(struct sock *nfnl, struct sk_buff *skb,
         const char *helper_name;
         struct nf_conntrack_helper *cur, *helper = NULL;
         struct nf_conntrack_tuple tuple;
-        struct hlist_node *n;
         int ret = 0, i;
 
         if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])
@@ -296,7 +295,7 @@ nfnl_cthelper_new(struct sock *nfnl, struct sk_buff *skb,
 
         rcu_read_lock();
         for (i = 0; i < nf_ct_helper_hsize && !helper; i++) {
-                hlist_for_each_entry_rcu(cur, n, &nf_ct_helper_hash[i], hnode) {
+                hlist_for_each_entry_rcu(cur, &nf_ct_helper_hash[i], hnode) {
 
                         /* skip non-userspace conntrack helpers. */
                         if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
@@ -452,13 +451,12 @@ static int
 nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct nf_conntrack_helper *cur, *last;
-        struct hlist_node *n;
 
         rcu_read_lock();
         last = (struct nf_conntrack_helper *)cb->args[1];
         for (; cb->args[0] < nf_ct_helper_hsize; cb->args[0]++) {
 restart:
-                hlist_for_each_entry_rcu(cur, n,
+                hlist_for_each_entry_rcu(cur,
                                 &nf_ct_helper_hash[cb->args[0]], hnode) {
 
                         /* skip non-userspace conntrack helpers. */
@@ -495,7 +493,6 @@ nfnl_cthelper_get(struct sock *nfnl, struct sk_buff *skb,
 {
         int ret = -ENOENT, i;
         struct nf_conntrack_helper *cur;
-        struct hlist_node *n;
         struct sk_buff *skb2;
         char *helper_name = NULL;
         struct nf_conntrack_tuple tuple;
@@ -520,7 +517,7 @@ nfnl_cthelper_get(struct sock *nfnl, struct sk_buff *skb,
         }
 
         for (i = 0; i < nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_rcu(cur, n, &nf_ct_helper_hash[i], hnode) {
+                hlist_for_each_entry_rcu(cur, &nf_ct_helper_hash[i], hnode) {
 
                         /* skip non-userspace conntrack helpers. */
                         if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
@@ -568,7 +565,7 @@ nfnl_cthelper_del(struct sock *nfnl, struct sk_buff *skb,
 {
         char *helper_name = NULL;
         struct nf_conntrack_helper *cur;
-        struct hlist_node *n, *tmp;
+        struct hlist_node *tmp;
         struct nf_conntrack_tuple tuple;
         bool tuple_set = false, found = false;
         int i, j = 0, ret;
@@ -585,7 +582,7 @@ nfnl_cthelper_del(struct sock *nfnl, struct sk_buff *skb,
         }
 
         for (i = 0; i < nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_safe(cur, n, tmp, &nf_ct_helper_hash[i],
+                hlist_for_each_entry_safe(cur, tmp, &nf_ct_helper_hash[i],
                                                                 hnode) {
                         /* skip non-userspace conntrack helpers. */
                         if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
@@ -654,13 +651,13 @@ err_out:
 static void __exit nfnl_cthelper_exit(void)
 {
         struct nf_conntrack_helper *cur;
-        struct hlist_node *n, *tmp;
+        struct hlist_node *tmp;
         int i;
 
         nfnetlink_subsys_unregister(&nfnl_cthelper_subsys);
 
         for (i=0; i<nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_safe(cur, n, tmp, &nf_ct_helper_hash[i],
+                hlist_for_each_entry_safe(cur, tmp, &nf_ct_helper_hash[i],
                                                                         hnode) {
                         /* skip non-userspace conntrack helpers. */
                         if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 92fd8eca0d31..f248db572972 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -87,11 +87,10 @@ static struct nfulnl_instance *
 __instance_lookup(u_int16_t group_num)
 {
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct nfulnl_instance *inst;
 
         head = &instance_table[instance_hashfn(group_num)];
-        hlist_for_each_entry_rcu(inst, pos, head, hlist) {
+        hlist_for_each_entry_rcu(inst, head, hlist) {
                 if (inst->group_num == group_num)
                         return inst;
         }
@@ -717,11 +716,11 @@ nfulnl_rcv_nl_event(struct notifier_block *this,
                 /* destroy all instances for this portid */
                 spin_lock_bh(&instances_lock);
                 for  (i = 0; i < INSTANCE_BUCKETS; i++) {
-                        struct hlist_node *tmp, *t2;
+                        struct hlist_node *t2;
                         struct nfulnl_instance *inst;
                         struct hlist_head *head = &instance_table[i];
 
-                        hlist_for_each_entry_safe(inst, tmp, t2, head, hlist) {
+                        hlist_for_each_entry_safe(inst, t2, head, hlist) {
                                 if ((net_eq(n->net, &init_net)) &&
                                     (n->portid == inst->peer_portid))
                                         __instance_destroy(inst);
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 3158d87b56a8..858fd52c1040 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -80,11 +80,10 @@ static struct nfqnl_instance *
 instance_lookup(u_int16_t queue_num)
 {
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct nfqnl_instance *inst;
 
         head = &instance_table[instance_hashfn(queue_num)];
-        hlist_for_each_entry_rcu(inst, pos, head, hlist) {
+        hlist_for_each_entry_rcu(inst, head, hlist) {
                 if (inst->queue_num == queue_num)
                         return inst;
         }
@@ -583,11 +582,10 @@ nfqnl_dev_drop(int ifindex)
         rcu_read_lock();
 
         for (i = 0; i < INSTANCE_BUCKETS; i++) {
-                struct hlist_node *tmp;
                 struct nfqnl_instance *inst;
                 struct hlist_head *head = &instance_table[i];
 
-                hlist_for_each_entry_rcu(inst, tmp, head, hlist)
+                hlist_for_each_entry_rcu(inst, head, hlist)
                         nfqnl_flush(inst, dev_cmp, ifindex);
         }
 
@@ -627,11 +625,11 @@ nfqnl_rcv_nl_event(struct notifier_block *this,
                 /* destroy all instances for this portid */
                 spin_lock(&instances_lock);
                 for (i = 0; i < INSTANCE_BUCKETS; i++) {
-                        struct hlist_node *tmp, *t2;
+                        struct hlist_node *t2;
                         struct nfqnl_instance *inst;
                         struct hlist_head *head = &instance_table[i];
 
-                        hlist_for_each_entry_safe(inst, tmp, t2, head, hlist) {
+                        hlist_for_each_entry_safe(inst, t2, head, hlist) {
                                 if ((n->net == &init_net) &&
                                     (n->portid == inst->peer_portid))
                                         __instance_destroy(inst);
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index f264032b8c56..370adf622cef 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -43,12 +43,11 @@ static void xt_rateest_hash_insert(struct xt_rateest *est)
 struct xt_rateest *xt_rateest_lookup(const char *name)
 {
         struct xt_rateest *est;
-        struct hlist_node *n;
         unsigned int h;
 
         h = xt_rateest_hash(name);
         mutex_lock(&xt_rateest_mutex);
-        hlist_for_each_entry(est, n, &rateest_hash[h], list) {
+        hlist_for_each_entry(est, &rateest_hash[h], list) {
                 if (strcmp(est->name, name) == 0) {
                         est->refcnt++;
                         mutex_unlock(&xt_rateest_mutex);
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 70b5591a2586..c40b2695633b 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -101,7 +101,7 @@ static int count_them(struct net *net,
 {
         const struct nf_conntrack_tuple_hash *found;
         struct xt_connlimit_conn *conn;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
         struct nf_conn *found_ct;
         struct hlist_head *hash;
         bool addit = true;
@@ -115,7 +115,7 @@ static int count_them(struct net *net,
         rcu_read_lock();
 
         /* check the saved connections */
-        hlist_for_each_entry_safe(conn, pos, n, hash, node) {
+        hlist_for_each_entry_safe(conn, n, hash, node) {
                 found    = nf_conntrack_find_get(net, NF_CT_DEFAULT_ZONE,
                                                  &conn->tuple);
                 found_ct = NULL;
@@ -258,14 +258,14 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
 {
         const struct xt_connlimit_info *info = par->matchinfo;
         struct xt_connlimit_conn *conn;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
         struct hlist_head *hash = info->data->iphash;
         unsigned int i;
 
         nf_ct_l3proto_module_put(par->family);
 
         for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {
-                hlist_for_each_entry_safe(conn, pos, n, &hash[i], node) {
+                hlist_for_each_entry_safe(conn, n, &hash[i], node) {
                         hlist_del(&conn->node);
                         kfree(conn);
                 }
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 98218c896d2e..f330e8beaf69 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -141,11 +141,10 @@ dsthash_find(const struct xt_hashlimit_htable *ht,
              const struct dsthash_dst *dst)
 {
         struct dsthash_ent *ent;
-        struct hlist_node *pos;
         u_int32_t hash = hash_dst(ht, dst);
 
         if (!hlist_empty(&ht->hash[hash])) {
-                hlist_for_each_entry_rcu(ent, pos, &ht->hash[hash], node)
+                hlist_for_each_entry_rcu(ent, &ht->hash[hash], node)
                         if (dst_cmp(ent, dst)) {
                                 spin_lock(&ent->lock);
                                 return ent;
@@ -297,8 +296,8 @@ static void htable_selective_cleanup(struct xt_hashlimit_htable *ht,
         spin_lock_bh(&ht->lock);
         for (i = 0; i < ht->cfg.size; i++) {
                 struct dsthash_ent *dh;
-                struct hlist_node *pos, *n;
-                hlist_for_each_entry_safe(dh, pos, n, &ht->hash[i], node) {
+                struct hlist_node *n;
+                hlist_for_each_entry_safe(dh, n, &ht->hash[i], node) {
                         if ((*select)(ht, dh))
                                 dsthash_free(ht, dh);
                 }
@@ -343,9 +342,8 @@ static struct xt_hashlimit_htable *htable_find_get(struct net *net,
 {
         struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
         struct xt_hashlimit_htable *hinfo;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry(hinfo, pos, &hashlimit_net->htables, node) {
+        hlist_for_each_entry(hinfo, &hashlimit_net->htables, node) {
                 if (!strcmp(name, hinfo->pde->name) &&
                     hinfo->family == family) {
                         hinfo->use++;
@@ -821,10 +819,9 @@ static int dl_seq_show(struct seq_file *s, void *v)
         struct xt_hashlimit_htable *htable = s->private;
         unsigned int *bucket = (unsigned int *)v;
         struct dsthash_ent *ent;
-        struct hlist_node *pos;
 
         if (!hlist_empty(&htable->hash[*bucket])) {
-                hlist_for_each_entry(ent, pos, &htable->hash[*bucket], node)
+                hlist_for_each_entry(ent, &htable->hash[*bucket], node)
                         if (dl_seq_real_show(ent, htable->family, s))
                                 return -1;
         }
@@ -877,7 +874,6 @@ static int __net_init hashlimit_proc_net_init(struct net *net)
 static void __net_exit hashlimit_proc_net_exit(struct net *net)
 {
         struct xt_hashlimit_htable *hinfo;
-        struct hlist_node *pos;
         struct proc_dir_entry *pde;
         struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
 
@@ -890,7 +886,7 @@ static void __net_exit hashlimit_proc_net_exit(struct net *net)
         if (pde == NULL)
                 pde = hashlimit_net->ip6t_hashlimit;
 
-        hlist_for_each_entry(hinfo, pos, &hashlimit_net->htables, node)
+        hlist_for_each_entry(hinfo, &hashlimit_net->htables, node)
                 remove_proc_entry(hinfo->pde->name, pde);
 
         hashlimit_net->ipt_hashlimit = NULL;
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 31bf233dae97..d9cad315229d 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -540,7 +540,7 @@ static ssize_t
 recent_mt_proc_write(struct file *file, const char __user *input,
                      size_t size, loff_t *loff)
 {
-        const struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
+        const struct proc_dir_entry *pde = PDE(file_inode(file));
         struct recent_table *t = pde->data;
         struct recent_entry *e;
         char buf[sizeof("+b335:1d35:1e55:dead:c0de:1715:5afe:c0de")];
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 3d55e0c713e2..1e3fd5bfcd86 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -248,11 +248,10 @@ static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
         struct nl_portid_hash *hash = &nl_table[protocol].hash;
         struct hlist_head *head;
         struct sock *sk;
-        struct hlist_node *node;
 
         read_lock(&nl_table_lock);
         head = nl_portid_hashfn(hash, portid);
-        sk_for_each(sk, node, head) {
+        sk_for_each(sk, head) {
                 if (net_eq(sock_net(sk), net) && (nlk_sk(sk)->portid == portid)) {
                         sock_hold(sk);
                         goto found;
@@ -312,9 +311,9 @@ static int nl_portid_hash_rehash(struct nl_portid_hash *hash, int grow)
 
         for (i = 0; i <= omask; i++) {
                 struct sock *sk;
-                struct hlist_node *node, *tmp;
+                struct hlist_node *tmp;
 
-                sk_for_each_safe(sk, node, tmp, &otable[i])
+                sk_for_each_safe(sk, tmp, &otable[i])
                         __sk_add_node(sk, nl_portid_hashfn(hash, nlk_sk(sk)->portid));
         }
 
@@ -344,7 +343,6 @@ static void
 netlink_update_listeners(struct sock *sk)
 {
         struct netlink_table *tbl = &nl_table[sk->sk_protocol];
-        struct hlist_node *node;
         unsigned long mask;
         unsigned int i;
         struct listeners *listeners;
@@ -355,7 +353,7 @@ netlink_update_listeners(struct sock *sk)
 
         for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
                 mask = 0;
-                sk_for_each_bound(sk, node, &tbl->mc_list) {
+                sk_for_each_bound(sk, &tbl->mc_list) {
                         if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
                                 mask |= nlk_sk(sk)->groups[i];
                 }
@@ -371,18 +369,17 @@ static int netlink_insert(struct sock *sk, struct net *net, u32 portid)
         struct hlist_head *head;
         int err = -EADDRINUSE;
         struct sock *osk;
-        struct hlist_node *node;
         int len;
 
         netlink_table_grab();
         head = nl_portid_hashfn(hash, portid);
         len = 0;
-        sk_for_each(osk, node, head) {
+        sk_for_each(osk, head) {
                 if (net_eq(sock_net(osk), net) && (nlk_sk(osk)->portid == portid))
                         break;
                 len++;
         }
-        if (node)
+        if (osk)
                 goto err;
 
         err = -EBUSY;
@@ -575,7 +572,6 @@ static int netlink_autobind(struct socket *sock)
         struct nl_portid_hash *hash = &nl_table[sk->sk_protocol].hash;
         struct hlist_head *head;
         struct sock *osk;
-        struct hlist_node *node;
         s32 portid = task_tgid_vnr(current);
         int err;
         static s32 rover = -4097;
@@ -584,7 +580,7 @@ retry:
         cond_resched();
         netlink_table_grab();
         head = nl_portid_hashfn(hash, portid);
-        sk_for_each(osk, node, head) {
+        sk_for_each(osk, head) {
                 if (!net_eq(sock_net(osk), net))
                         continue;
                 if (nlk_sk(osk)->portid == portid) {
@@ -809,7 +805,7 @@ static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
 
 struct sock *netlink_getsockbyfilp(struct file *filp)
 {
-        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(filp);
         struct sock *sock;
 
         if (!S_ISSOCK(inode->i_mode))
@@ -1101,7 +1097,6 @@ int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid
 {
         struct net *net = sock_net(ssk);
         struct netlink_broadcast_data info;
-        struct hlist_node *node;
         struct sock *sk;
 
         skb = netlink_trim(skb, allocation);
@@ -1124,7 +1119,7 @@ int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid
 
         netlink_lock_table();
 
-        sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
+        sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
                 do_one_broadcast(sk, &info);
 
         consume_skb(skb);
@@ -1200,7 +1195,6 @@ out:
 int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
 {
         struct netlink_set_err_data info;
-        struct hlist_node *node;
         struct sock *sk;
         int ret = 0;
 
@@ -1212,7 +1206,7 @@ int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
 
         read_lock(&nl_table_lock);
 
-        sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
+        sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
                 ret += do_one_set_err(sk, &info);
 
         read_unlock(&nl_table_lock);
@@ -1676,10 +1670,9 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
 void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
 
-        sk_for_each_bound(sk, node, &tbl->mc_list)
+        sk_for_each_bound(sk, &tbl->mc_list)
                 netlink_update_socket_mc(nlk_sk(sk), group, 0);
 }
 
@@ -1974,14 +1967,13 @@ static struct sock *netlink_seq_socket_idx(struct seq_file *seq, loff_t pos)
         struct nl_seq_iter *iter = seq->private;
         int i, j;
         struct sock *s;
-        struct hlist_node *node;
         loff_t off = 0;
 
         for (i = 0; i < MAX_LINKS; i++) {
                 struct nl_portid_hash *hash = &nl_table[i].hash;
 
                 for (j = 0; j <= hash->mask; j++) {
-                        sk_for_each(s, node, &hash->table[j]) {
+                        sk_for_each(s, &hash->table[j]) {
                                 if (sock_net(s) != seq_file_net(seq))
                                         continue;
                                 if (off == pos) {
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 297b07a029de..d1fa1d9ffd2e 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -104,10 +104,9 @@ static void nr_remove_socket(struct sock *sk)
 static void nr_kill_by_device(struct net_device *dev)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_list_lock);
-        sk_for_each(s, node, &nr_list)
+        sk_for_each(s, &nr_list)
                 if (nr_sk(s)->device == dev)
                         nr_disconnect(s, ENETUNREACH);
         spin_unlock_bh(&nr_list_lock);
@@ -149,10 +148,9 @@ static void nr_insert_socket(struct sock *sk)
 static struct sock *nr_find_listener(ax25_address *addr)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_list_lock);
-        sk_for_each(s, node, &nr_list)
+        sk_for_each(s, &nr_list)
                 if (!ax25cmp(&nr_sk(s)->source_addr, addr) &&
                     s->sk_state == TCP_LISTEN) {
                         bh_lock_sock(s);
@@ -170,10 +168,9 @@ found:
 static struct sock *nr_find_socket(unsigned char index, unsigned char id)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_list_lock);
-        sk_for_each(s, node, &nr_list) {
+        sk_for_each(s, &nr_list) {
                 struct nr_sock *nr = nr_sk(s);
 
                 if (nr->my_index == index && nr->my_id == id) {
@@ -194,10 +191,9 @@ static struct sock *nr_find_peer(unsigned char index, unsigned char id,
         ax25_address *dest)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_list_lock);
-        sk_for_each(s, node, &nr_list) {
+        sk_for_each(s, &nr_list) {
                 struct nr_sock *nr = nr_sk(s);
 
                 if (nr->your_index == index && nr->your_id == id &&
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 70ffff76a967..b976d5eff2de 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -49,10 +49,9 @@ static struct nr_node *nr_node_get(ax25_address *callsign)
 {
         struct nr_node *found = NULL;
         struct nr_node *nr_node;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_node_list_lock);
-        nr_node_for_each(nr_node, node, &nr_node_list)
+        nr_node_for_each(nr_node, &nr_node_list)
                 if (ax25cmp(callsign, &nr_node->callsign) == 0) {
                         nr_node_hold(nr_node);
                         found = nr_node;
@@ -67,10 +66,9 @@ static struct nr_neigh *nr_neigh_get_dev(ax25_address *callsign,
 {
         struct nr_neigh *found = NULL;
         struct nr_neigh *nr_neigh;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_neigh_list_lock);
-        nr_neigh_for_each(nr_neigh, node, &nr_neigh_list)
+        nr_neigh_for_each(nr_neigh, &nr_neigh_list)
                 if (ax25cmp(callsign, &nr_neigh->callsign) == 0 &&
                     nr_neigh->dev == dev) {
                         nr_neigh_hold(nr_neigh);
@@ -114,10 +112,9 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,
          */
         if (nr_neigh != NULL && nr_neigh->failed != 0 && quality == 0) {
                 struct nr_node *nr_nodet;
-                struct hlist_node *node;
 
                 spin_lock_bh(&nr_node_list_lock);
-                nr_node_for_each(nr_nodet, node, &nr_node_list) {
+                nr_node_for_each(nr_nodet, &nr_node_list) {
                         nr_node_lock(nr_nodet);
                         for (i = 0; i < nr_nodet->count; i++)
                                 if (nr_nodet->routes[i].neighbour == nr_neigh)
@@ -485,11 +482,11 @@ static int nr_dec_obs(void)
 {
         struct nr_neigh *nr_neigh;
         struct nr_node  *s;
-        struct hlist_node *node, *nodet;
+        struct hlist_node *nodet;
         int i;
 
         spin_lock_bh(&nr_node_list_lock);
-        nr_node_for_each_safe(s, node, nodet, &nr_node_list) {
+        nr_node_for_each_safe(s, nodet, &nr_node_list) {
                 nr_node_lock(s);
                 for (i = 0; i < s->count; i++) {
                         switch (s->routes[i].obs_count) {
@@ -540,15 +537,15 @@ static int nr_dec_obs(void)
 void nr_rt_device_down(struct net_device *dev)
 {
         struct nr_neigh *s;
-        struct hlist_node *node, *nodet, *node2, *node2t;
+        struct hlist_node *nodet, *node2t;
         struct nr_node  *t;
         int i;
 
         spin_lock_bh(&nr_neigh_list_lock);
-        nr_neigh_for_each_safe(s, node, nodet, &nr_neigh_list) {
+        nr_neigh_for_each_safe(s, nodet, &nr_neigh_list) {
                 if (s->dev == dev) {
                         spin_lock_bh(&nr_node_list_lock);
-                        nr_node_for_each_safe(t, node2, node2t, &nr_node_list) {
+                        nr_node_for_each_safe(t, node2t, &nr_node_list) {
                                 nr_node_lock(t);
                                 for (i = 0; i < t->count; i++) {
                                         if (t->routes[i].neighbour == s) {
@@ -737,11 +734,10 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
 void nr_link_failed(ax25_cb *ax25, int reason)
 {
         struct nr_neigh *s, *nr_neigh = NULL;
-        struct hlist_node *node;
         struct nr_node  *nr_node = NULL;
 
         spin_lock_bh(&nr_neigh_list_lock);
-        nr_neigh_for_each(s, node, &nr_neigh_list) {
+        nr_neigh_for_each(s, &nr_neigh_list) {
                 if (s->ax25 == ax25) {
                         nr_neigh_hold(s);
                         nr_neigh = s;
@@ -761,7 +757,7 @@ void nr_link_failed(ax25_cb *ax25, int reason)
                 return;
         }
         spin_lock_bh(&nr_node_list_lock);
-        nr_node_for_each(nr_node, node, &nr_node_list) {
+        nr_node_for_each(nr_node, &nr_node_list) {
                 nr_node_lock(nr_node);
                 if (nr_node->which < nr_node->count &&
                     nr_node->routes[nr_node->which].neighbour == nr_neigh)
@@ -1013,16 +1009,16 @@ void __exit nr_rt_free(void)
 {
         struct nr_neigh *s = NULL;
         struct nr_node  *t = NULL;
-        struct hlist_node *node, *nodet;
+        struct hlist_node *nodet;
 
         spin_lock_bh(&nr_neigh_list_lock);
         spin_lock_bh(&nr_node_list_lock);
-        nr_node_for_each_safe(t, node, nodet, &nr_node_list) {
+        nr_node_for_each_safe(t, nodet, &nr_node_list) {
                 nr_node_lock(t);
                 nr_remove_node_locked(t);
                 nr_node_unlock(t);
         }
-        nr_neigh_for_each_safe(s, node, nodet, &nr_neigh_list) {
+        nr_neigh_for_each_safe(s, nodet, &nr_neigh_list) {
                 while(s->count) {
                         s->count--;
                         nr_neigh_put(s);
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 746f5a2f9804..7f8266dd14cb 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -71,14 +71,14 @@ static void nfc_llcp_socket_purge(struct nfc_llcp_sock *sock)
 static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
 {
         struct sock *sk;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         struct nfc_llcp_sock *llcp_sock;
 
         skb_queue_purge(&local->tx_queue);
 
         write_lock(&local->sockets.lock);
 
-        sk_for_each_safe(sk, node, tmp, &local->sockets.head) {
+        sk_for_each_safe(sk, tmp, &local->sockets.head) {
                 llcp_sock = nfc_llcp_sock(sk);
 
                 bh_lock_sock(sk);
@@ -171,7 +171,6 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
                                                u8 ssap, u8 dsap)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct nfc_llcp_sock *llcp_sock, *tmp_sock;
 
         pr_debug("ssap dsap %d %d\n", ssap, dsap);
@@ -183,7 +182,7 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
 
         llcp_sock = NULL;
 
-        sk_for_each(sk, node, &local->sockets.head) {
+        sk_for_each(sk, &local->sockets.head) {
                 tmp_sock = nfc_llcp_sock(sk);
 
                 if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) {
@@ -272,7 +271,6 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
                                             u8 *sn, size_t sn_len)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct nfc_llcp_sock *llcp_sock, *tmp_sock;
 
         pr_debug("sn %zd %p\n", sn_len, sn);
@@ -284,7 +282,7 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
 
         llcp_sock = NULL;
 
-        sk_for_each(sk, node, &local->sockets.head) {
+        sk_for_each(sk, &local->sockets.head) {
                 tmp_sock = nfc_llcp_sock(sk);
 
                 pr_debug("llcp sock %p\n", tmp_sock);
@@ -601,14 +599,13 @@ static void nfc_llcp_set_nrns(struct nfc_llcp_sock *sock, struct sk_buff *pdu)
 void nfc_llcp_send_to_raw_sock(struct nfc_llcp_local *local,
                                struct sk_buff *skb, u8 direction)
 {
-        struct hlist_node *node;
         struct sk_buff *skb_copy = NULL, *nskb;
         struct sock *sk;
         u8 *data;
 
         read_lock(&local->raw_sockets.lock);
 
-        sk_for_each(sk, node, &local->raw_sockets.head) {
+        sk_for_each(sk, &local->raw_sockets.head) {
                 if (sk->sk_state != LLCP_BOUND)
                         continue;
 
@@ -697,11 +694,10 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local
 {
         struct sock *sk;
         struct nfc_llcp_sock *llcp_sock;
-        struct hlist_node *node;
 
         read_lock(&local->connecting_sockets.lock);
 
-        sk_for_each(sk, node, &local->connecting_sockets.head) {
+        sk_for_each(sk, &local->connecting_sockets.head) {
                 llcp_sock = nfc_llcp_sock(sk);
 
                 if (llcp_sock->ssap == ssap) {
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 9dc537df46c4..e87a26506dba 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -158,11 +158,10 @@ static struct hlist_head *vport_hash_bucket(const struct datapath *dp,
 struct vport *ovs_lookup_vport(const struct datapath *dp, u16 port_no)
 {
         struct vport *vport;
-        struct hlist_node *n;
         struct hlist_head *head;
 
         head = vport_hash_bucket(dp, port_no);
-        hlist_for_each_entry_rcu(vport, n, head, dp_hash_node) {
+        hlist_for_each_entry_rcu(vport, head, dp_hash_node) {
                 if (vport->port_no == port_no)
                         return vport;
         }
@@ -1386,9 +1385,9 @@ static void __dp_destroy(struct datapath *dp)
 
         for (i = 0; i < DP_VPORT_HASH_BUCKETS; i++) {
                 struct vport *vport;
-                struct hlist_node *node, *n;
+                struct hlist_node *n;
 
-                hlist_for_each_entry_safe(vport, node, n, &dp->ports[i], dp_hash_node)
+                hlist_for_each_entry_safe(vport, n, &dp->ports[i], dp_hash_node)
                         if (vport->port_no != OVSP_LOCAL)
                                 ovs_dp_detach_port(vport);
         }
@@ -1825,10 +1824,9 @@ static int ovs_vport_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
         rcu_read_lock();
         for (i = bucket; i < DP_VPORT_HASH_BUCKETS; i++) {
                 struct vport *vport;
-                struct hlist_node *n;
 
                 j = 0;
-                hlist_for_each_entry_rcu(vport, n, &dp->ports[i], dp_hash_node) {
+                hlist_for_each_entry_rcu(vport, &dp->ports[i], dp_hash_node) {
                         if (j >= skip &&
                             ovs_vport_cmd_fill_info(vport, skb,
                                                     NETLINK_CB(cb->skb).portid,
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index c3294cebc4f2..20605ecf100b 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -299,10 +299,10 @@ void ovs_flow_tbl_destroy(struct flow_table *table)
         for (i = 0; i < table->n_buckets; i++) {
                 struct sw_flow *flow;
                 struct hlist_head *head = flex_array_get(table->buckets, i);
-                struct hlist_node *node, *n;
+                struct hlist_node *n;
                 int ver = table->node_ver;
 
-                hlist_for_each_entry_safe(flow, node, n, head, hash_node[ver]) {
+                hlist_for_each_entry_safe(flow, n, head, hash_node[ver]) {
                         hlist_del_rcu(&flow->hash_node[ver]);
                         ovs_flow_free(flow);
                 }
@@ -332,7 +332,6 @@ struct sw_flow *ovs_flow_tbl_next(struct flow_table *table, u32 *bucket, u32 *la
 {
         struct sw_flow *flow;
         struct hlist_head *head;
-        struct hlist_node *n;
         int ver;
         int i;
 
@@ -340,7 +339,7 @@ struct sw_flow *ovs_flow_tbl_next(struct flow_table *table, u32 *bucket, u32 *la
         while (*bucket < table->n_buckets) {
                 i = 0;
                 head = flex_array_get(table->buckets, *bucket);
-                hlist_for_each_entry_rcu(flow, n, head, hash_node[ver]) {
+                hlist_for_each_entry_rcu(flow, head, hash_node[ver]) {
                         if (i < *last) {
                                 i++;
                                 continue;
@@ -367,11 +366,10 @@ static void flow_table_copy_flows(struct flow_table *old, struct flow_table *new
         for (i = 0; i < old->n_buckets; i++) {
                 struct sw_flow *flow;
                 struct hlist_head *head;
-                struct hlist_node *n;
 
                 head = flex_array_get(old->buckets, i);
 
-                hlist_for_each_entry(flow, n, head, hash_node[old_ver])
+                hlist_for_each_entry(flow, head, hash_node[old_ver])
                         ovs_flow_tbl_insert(new, flow);
         }
         old->keep_flows = true;
@@ -766,14 +764,13 @@ struct sw_flow *ovs_flow_tbl_lookup(struct flow_table *table,
                                 struct sw_flow_key *key, int key_len)
 {
         struct sw_flow *flow;
-        struct hlist_node *n;
         struct hlist_head *head;
         u32 hash;
 
         hash = ovs_flow_hash(key, key_len);
 
         head = find_bucket(table, hash);
-        hlist_for_each_entry_rcu(flow, n, head, hash_node[table->node_ver]) {
+        hlist_for_each_entry_rcu(flow, head, hash_node[table->node_ver]) {
 
                 if (flow->hash == hash &&
                     !memcmp(&flow->key, key, key_len)) {
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 70af0bedbac4..ba717cc038b3 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -86,9 +86,8 @@ struct vport *ovs_vport_locate(struct net *net, const char *name)
 {
         struct hlist_head *bucket = hash_bucket(net, name);
         struct vport *vport;
-        struct hlist_node *node;
 
-        hlist_for_each_entry_rcu(vport, node, bucket, hash_node)
+        hlist_for_each_entry_rcu(vport, bucket, hash_node)
                 if (!strcmp(name, vport->ops->get_name(vport)) &&
                     net_eq(ovs_dp_get_net(vport->dp), net))
                         return vport;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c7bfeff10767..1d6793dbfbae 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3263,12 +3263,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct net_device *dev = data;
         struct net *net = dev_net(dev);
 
         rcu_read_lock();
-        sk_for_each_rcu(sk, node, &net->packet.sklist) {
+        sk_for_each_rcu(sk, &net->packet.sklist) {
                 struct packet_sock *po = pkt_sk(sk);
 
                 switch (msg) {
diff --git a/net/packet/diag.c b/net/packet/diag.c
index 8db6e21c46bd..d3fcd1ebef7e 100644
--- a/net/packet/diag.c
+++ b/net/packet/diag.c
@@ -172,13 +172,12 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
         struct packet_diag_req *req;
         struct net *net;
         struct sock *sk;
-        struct hlist_node *node;
 
         net = sock_net(skb->sk);
         req = nlmsg_data(cb->nlh);
 
         mutex_lock(&net->packet.sklist_lock);
-        sk_for_each(sk, node, &net->packet.sklist) {
+        sk_for_each(sk, &net->packet.sklist) {
                 if (!net_eq(sock_net(sk), net))
                         continue;
                 if (num < s_num)
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 576f22c9c76e..e77411735de8 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -640,11 +640,10 @@ static struct sock *pep_find_pipe(const struct hlist_head *hlist,
                                         const struct sockaddr_pn *dst,
                                         u8 pipe_handle)
 {
-        struct hlist_node *node;
         struct sock *sknode;
         u16 dobj = pn_sockaddr_get_object(dst);
 
-        sk_for_each(sknode, node, hlist) {
+        sk_for_each(sknode, hlist) {
                 struct pep_sock *pnnode = pep_sk(sknode);
 
                 /* Ports match, but addresses might not: */
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index b7e982782255..1afd1381cdc7 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -76,7 +76,6 @@ static struct hlist_head *pn_hash_list(u16 obj)
  */
 struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
 {
-        struct hlist_node *node;
         struct sock *sknode;
         struct sock *rval = NULL;
         u16 obj = pn_sockaddr_get_object(spn);
@@ -84,7 +83,7 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
         struct hlist_head *hlist = pn_hash_list(obj);
 
         rcu_read_lock();
-        sk_for_each_rcu(sknode, node, hlist) {
+        sk_for_each_rcu(sknode, hlist) {
                 struct pn_sock *pn = pn_sk(sknode);
                 BUG_ON(!pn->sobject); /* unbound socket */
 
@@ -120,10 +119,9 @@ void pn_deliver_sock_broadcast(struct net *net, struct sk_buff *skb)
 
         rcu_read_lock();
         for (h = 0; h < PN_HASHSIZE; h++) {
-                struct hlist_node *node;
                 struct sock *sknode;
 
-                sk_for_each(sknode, node, hlist) {
+                sk_for_each(sknode, hlist) {
                         struct sk_buff *clone;
 
                         if (!net_eq(sock_net(sknode), net))
@@ -543,12 +541,11 @@ static struct sock *pn_sock_get_idx(struct seq_file *seq, loff_t pos)
 {
         struct net *net = seq_file_net(seq);
         struct hlist_head *hlist = pnsocks.hlist;
-        struct hlist_node *node;
         struct sock *sknode;
         unsigned int h;
 
         for (h = 0; h < PN_HASHSIZE; h++) {
-                sk_for_each_rcu(sknode, node, hlist) {
+                sk_for_each_rcu(sknode, hlist) {
                         if (!net_eq(net, sock_net(sknode)))
                                 continue;
                         if (!pos)
diff --git a/net/rds/bind.c b/net/rds/bind.c
index 637bde56c9db..b5ad65a0067e 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -52,13 +52,12 @@ static struct rds_sock *rds_bind_lookup(__be32 addr, __be16 port,
                                         struct rds_sock *insert)
 {
         struct rds_sock *rs;
-        struct hlist_node *node;
         struct hlist_head *head = hash_to_bucket(addr, port);
         u64 cmp;
         u64 needle = ((u64)be32_to_cpu(addr) << 32) | be16_to_cpu(port);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(rs, node, head, rs_bound_node) {
+        hlist_for_each_entry_rcu(rs, head, rs_bound_node) {
                 cmp = ((u64)be32_to_cpu(rs->rs_bound_addr) << 32) |
                       be16_to_cpu(rs->rs_bound_port);
 
diff --git a/net/rds/connection.c b/net/rds/connection.c
index 9e07c756d1f9..642ad42c416b 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -69,9 +69,8 @@ static struct rds_connection *rds_conn_lookup(struct hlist_head *head,
                                               struct rds_transport *trans)
 {
         struct rds_connection *conn, *ret = NULL;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry_rcu(conn, pos, head, c_hash_node) {
+        hlist_for_each_entry_rcu(conn, head, c_hash_node) {
                 if (conn->c_faddr == faddr && conn->c_laddr == laddr &&
                                 conn->c_trans == trans) {
                         ret = conn;
@@ -376,7 +375,6 @@ static void rds_conn_message_info(struct socket *sock, unsigned int len,
                                   int want_send)
 {
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct list_head *list;
         struct rds_connection *conn;
         struct rds_message *rm;
@@ -390,7 +388,7 @@ static void rds_conn_message_info(struct socket *sock, unsigned int len,
 
         for (i = 0, head = rds_conn_hash; i < ARRAY_SIZE(rds_conn_hash);
              i++, head++) {
-                hlist_for_each_entry_rcu(conn, pos, head, c_hash_node) {
+                hlist_for_each_entry_rcu(conn, head, c_hash_node) {
                         if (want_send)
                                 list = &conn->c_send_queue;
                         else
@@ -439,7 +437,6 @@ void rds_for_each_conn_info(struct socket *sock, unsigned int len,
 {
         uint64_t buffer[(item_len + 7) / 8];
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct rds_connection *conn;
         size_t i;
 
@@ -450,7 +447,7 @@ void rds_for_each_conn_info(struct socket *sock, unsigned int len,
 
         for (i = 0, head = rds_conn_hash; i < ARRAY_SIZE(rds_conn_hash);
              i++, head++) {
-                hlist_for_each_entry_rcu(conn, pos, head, c_hash_node) {
+                hlist_for_each_entry_rcu(conn, head, c_hash_node) {
 
                         /* XXX no c_lock usage.. */
                         if (!visitor(conn, buffer))
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index b768fe9d5e7a..cf68e6e4054a 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -165,10 +165,9 @@ static void rose_remove_socket(struct sock *sk)
 void rose_kill_by_neigh(struct rose_neigh *neigh)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&rose_list_lock);
-        sk_for_each(s, node, &rose_list) {
+        sk_for_each(s, &rose_list) {
                 struct rose_sock *rose = rose_sk(s);
 
                 if (rose->neighbour == neigh) {
@@ -186,10 +185,9 @@ void rose_kill_by_neigh(struct rose_neigh *neigh)
 static void rose_kill_by_device(struct net_device *dev)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&rose_list_lock);
-        sk_for_each(s, node, &rose_list) {
+        sk_for_each(s, &rose_list) {
                 struct rose_sock *rose = rose_sk(s);
 
                 if (rose->device == dev) {
@@ -246,10 +244,9 @@ static void rose_insert_socket(struct sock *sk)
 static struct sock *rose_find_listener(rose_address *addr, ax25_address *call)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&rose_list_lock);
-        sk_for_each(s, node, &rose_list) {
+        sk_for_each(s, &rose_list) {
                 struct rose_sock *rose = rose_sk(s);
 
                 if (!rosecmp(&rose->source_addr, addr) &&
@@ -258,7 +255,7 @@ static struct sock *rose_find_listener(rose_address *addr, ax25_address *call)
                         goto found;
         }
 
-        sk_for_each(s, node, &rose_list) {
+        sk_for_each(s, &rose_list) {
                 struct rose_sock *rose = rose_sk(s);
 
                 if (!rosecmp(&rose->source_addr, addr) &&
@@ -278,10 +275,9 @@ found:
 struct sock *rose_find_socket(unsigned int lci, struct rose_neigh *neigh)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&rose_list_lock);
-        sk_for_each(s, node, &rose_list) {
+        sk_for_each(s, &rose_list) {
                 struct rose_sock *rose = rose_sk(s);
 
                 if (rose->lci == lci && rose->neighbour == neigh)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index a181b484812a..c297e2a8e2a1 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -545,7 +545,7 @@ static void qdisc_class_hash_free(struct hlist_head *h, unsigned int n)
 void qdisc_class_hash_grow(struct Qdisc *sch, struct Qdisc_class_hash *clhash)
 {
         struct Qdisc_class_common *cl;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         struct hlist_head *nhash, *ohash;
         unsigned int nsize, nmask, osize;
         unsigned int i, h;
@@ -564,7 +564,7 @@ void qdisc_class_hash_grow(struct Qdisc *sch, struct Qdisc_class_hash *clhash)
 
         sch_tree_lock(sch);
         for (i = 0; i < osize; i++) {
-                hlist_for_each_entry_safe(cl, n, next, &ohash[i], hnode) {
+                hlist_for_each_entry_safe(cl, next, &ohash[i], hnode) {
                         h = qdisc_class_hash(cl->classid, nmask);
                         hlist_add_head(&cl->hnode, &nhash[h]);
                 }
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 0e19948470b8..13aa47aa2ffb 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1041,14 +1041,13 @@ static void cbq_adjust_levels(struct cbq_class *this)
 static void cbq_normalize_quanta(struct cbq_sched_data *q, int prio)
 {
         struct cbq_class *cl;
-        struct hlist_node *n;
         unsigned int h;
 
         if (q->quanta[prio] == 0)
                 return;
 
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[h], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
                         /* BUGGGG... Beware! This expression suffer of
                          * arithmetic overflows!
                          */
@@ -1087,10 +1086,9 @@ static void cbq_sync_defmap(struct cbq_class *cl)
                         continue;
 
                 for (h = 0; h < q->clhash.hashsize; h++) {
-                        struct hlist_node *n;
                         struct cbq_class *c;
 
-                        hlist_for_each_entry(c, n, &q->clhash.hash[h],
+                        hlist_for_each_entry(c, &q->clhash.hash[h],
                                              common.hnode) {
                                 if (c->split == split && c->level < level &&
                                     c->defmap & (1<<i)) {
@@ -1210,7 +1208,6 @@ cbq_reset(struct Qdisc *sch)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
         struct cbq_class *cl;
-        struct hlist_node *n;
         int prio;
         unsigned int h;
 
@@ -1228,7 +1225,7 @@ cbq_reset(struct Qdisc *sch)
                 q->active[prio] = NULL;
 
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[h], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
                         qdisc_reset(cl->q);
 
                         cl->next_alive = NULL;
@@ -1697,7 +1694,7 @@ static void cbq_destroy_class(struct Qdisc *sch, struct cbq_class *cl)
 static void cbq_destroy(struct Qdisc *sch)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         struct cbq_class *cl;
         unsigned int h;
 
@@ -1710,11 +1707,11 @@ static void cbq_destroy(struct Qdisc *sch)
          * be bound to classes which have been destroyed already. --TGR '04
          */
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[h], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode)
                         tcf_destroy_chain(&cl->filter_list);
         }
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[h],
+                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[h],
                                           common.hnode)
                         cbq_destroy_class(sch, cl);
         }
@@ -2013,14 +2010,13 @@ static void cbq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
         struct cbq_class *cl;
-        struct hlist_node *n;
         unsigned int h;
 
         if (arg->stop)
                 return;
 
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[h], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
                         if (arg->count < arg->skip) {
                                 arg->count++;
                                 continue;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 71e50c80315f..759b308d1a8d 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -293,14 +293,13 @@ static void drr_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 {
         struct drr_sched *q = qdisc_priv(sch);
         struct drr_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         if (arg->stop)
                 return;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (arg->count < arg->skip) {
                                 arg->count++;
                                 continue;
@@ -451,11 +450,10 @@ static void drr_reset_qdisc(struct Qdisc *sch)
 {
         struct drr_sched *q = qdisc_priv(sch);
         struct drr_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (cl->qdisc->q.qlen)
                                 list_del(&cl->alist);
                         qdisc_reset(cl->qdisc);
@@ -468,13 +466,13 @@ static void drr_destroy_qdisc(struct Qdisc *sch)
 {
         struct drr_sched *q = qdisc_priv(sch);
         struct drr_class *cl;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         unsigned int i;
 
         tcf_destroy_chain(&q->filter_list);
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[i],
+                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
                                           common.hnode)
                         drr_destroy_class(sch, cl);
         }
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 6c2ec4510540..9facea03faeb 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1389,7 +1389,6 @@ static void
 hfsc_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 {
         struct hfsc_sched *q = qdisc_priv(sch);
-        struct hlist_node *n;
         struct hfsc_class *cl;
         unsigned int i;
 
@@ -1397,7 +1396,7 @@ hfsc_walk(struct Qdisc *sch, struct qdisc_walker *arg)
                 return;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i],
+                hlist_for_each_entry(cl, &q->clhash.hash[i],
                                      cl_common.hnode) {
                         if (arg->count < arg->skip) {
                                 arg->count++;
@@ -1523,11 +1522,10 @@ hfsc_reset_qdisc(struct Qdisc *sch)
 {
         struct hfsc_sched *q = qdisc_priv(sch);
         struct hfsc_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], cl_common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
                         hfsc_reset_class(cl);
         }
         q->eligible = RB_ROOT;
@@ -1540,16 +1538,16 @@ static void
 hfsc_destroy_qdisc(struct Qdisc *sch)
 {
         struct hfsc_sched *q = qdisc_priv(sch);
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         struct hfsc_class *cl;
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], cl_common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
                         tcf_destroy_chain(&cl->filter_list);
         }
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[i],
+                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
                                           cl_common.hnode)
                         hfsc_destroy_class(sch, cl);
         }
@@ -1564,12 +1562,11 @@ hfsc_dump_qdisc(struct Qdisc *sch, struct sk_buff *skb)
         unsigned char *b = skb_tail_pointer(skb);
         struct tc_hfsc_qopt qopt;
         struct hfsc_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         sch->qstats.backlog = 0;
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], cl_common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
                         sch->qstats.backlog += cl->qdisc->qstats.backlog;
         }
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 03c2692ca01e..571f1d211f4d 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -949,11 +949,10 @@ static void htb_reset(struct Qdisc *sch)
 {
         struct htb_sched *q = qdisc_priv(sch);
         struct htb_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (cl->level)
                                 memset(&cl->un.inner, 0, sizeof(cl->un.inner));
                         else {
@@ -1218,7 +1217,7 @@ static void htb_destroy_class(struct Qdisc *sch, struct htb_class *cl)
 static void htb_destroy(struct Qdisc *sch)
 {
         struct htb_sched *q = qdisc_priv(sch);
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         struct htb_class *cl;
         unsigned int i;
 
@@ -1232,11 +1231,11 @@ static void htb_destroy(struct Qdisc *sch)
         tcf_destroy_chain(&q->filter_list);
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode)
                         tcf_destroy_chain(&cl->filter_list);
         }
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[i],
+                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
                                           common.hnode)
                         htb_destroy_class(sch, cl);
         }
@@ -1516,14 +1515,13 @@ static void htb_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 {
         struct htb_sched *q = qdisc_priv(sch);
         struct htb_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         if (arg->stop)
                 return;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (arg->count < arg->skip) {
                                 arg->count++;
                                 continue;
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 6ed37652a4c3..e9a77f621c3d 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -276,9 +276,8 @@ static struct qfq_aggregate *qfq_find_agg(struct qfq_sched *q,
                                           u32 lmax, u32 weight)
 {
         struct qfq_aggregate *agg;
-        struct hlist_node *n;
 
-        hlist_for_each_entry(agg, n, &q->nonfull_aggs, nonfull_next)
+        hlist_for_each_entry(agg, &q->nonfull_aggs, nonfull_next)
                 if (agg->lmax == lmax && agg->class_weight == weight)
                         return agg;
 
@@ -670,14 +669,13 @@ static void qfq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 {
         struct qfq_sched *q = qdisc_priv(sch);
         struct qfq_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         if (arg->stop)
                 return;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (arg->count < arg->skip) {
                                 arg->count++;
                                 continue;
@@ -1376,11 +1374,10 @@ static unsigned int qfq_drop_from_slot(struct qfq_sched *q,
                                        struct hlist_head *slot)
 {
         struct qfq_aggregate *agg;
-        struct hlist_node *n;
         struct qfq_class *cl;
         unsigned int len;
 
-        hlist_for_each_entry(agg, n, slot, next) {
+        hlist_for_each_entry(agg, slot, next) {
                 list_for_each_entry(cl, &agg->active, alist) {
 
                         if (!cl->qdisc->ops->drop)
@@ -1459,11 +1456,10 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
 {
         struct qfq_sched *q = qdisc_priv(sch);
         struct qfq_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (cl->qdisc->q.qlen > 0)
                                 qfq_deactivate_class(q, cl);
 
@@ -1477,13 +1473,13 @@ static void qfq_destroy_qdisc(struct Qdisc *sch)
 {
         struct qfq_sched *q = qdisc_priv(sch);
         struct qfq_class *cl;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         unsigned int i;
 
         tcf_destroy_chain(&q->filter_list);
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[i],
+                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
                                           common.hnode) {
                         qfq_destroy_class(sch, cl);
                 }
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 2f95f5a5145d..43cd0dd9149d 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1591,32 +1591,31 @@ int sctp_assoc_lookup_laddr(struct sctp_association *asoc,
 /* Set an association id for a given association */
 int sctp_assoc_set_id(struct sctp_association *asoc, gfp_t gfp)
 {
-        int assoc_id;
-        int error = 0;
+        bool preload = gfp & __GFP_WAIT;
+        int ret;
 
         /* If the id is already assigned, keep it. */
         if (asoc->assoc_id)
-                return error;
-retry:
-        if (unlikely(!idr_pre_get(&sctp_assocs_id, gfp)))
-                return -ENOMEM;
+                return 0;
 
+        if (preload)
+                idr_preload(gfp);
         spin_lock_bh(&sctp_assocs_id_lock);
-        error = idr_get_new_above(&sctp_assocs_id, (void *)asoc,
-                                    idr_low, &assoc_id);
-        if (!error) {
-                idr_low = assoc_id + 1;
+        /* 0 is not a valid id, idr_low is always >= 1 */
+        ret = idr_alloc(&sctp_assocs_id, asoc, idr_low, 0, GFP_NOWAIT);
+        if (ret >= 0) {
+                idr_low = ret + 1;
                 if (idr_low == INT_MAX)
                         idr_low = 1;
         }
         spin_unlock_bh(&sctp_assocs_id_lock);
-        if (error == -EAGAIN)
-                goto retry;
-        else if (error)
-                return error;
+        if (preload)
+                idr_preload_end();
+        if (ret < 0)
+                return ret;
 
-        asoc->assoc_id = (sctp_assoc_t) assoc_id;
-        return error;
+        asoc->assoc_id = (sctp_assoc_t)ret;
+        return 0;
 }
 
 /* Free the ASCONF queue */
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 73aad3d16a45..2b3ef03c6098 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -332,7 +332,6 @@ static struct sctp_association *__sctp_endpoint_lookup_assoc(
         struct sctp_transport *t = NULL;
         struct sctp_hashbucket *head;
         struct sctp_ep_common *epb;
-        struct hlist_node *node;
         int hash;
         int rport;
 
@@ -350,7 +349,7 @@ static struct sctp_association *__sctp_endpoint_lookup_assoc(
                                  rport);
         head = &sctp_assoc_hashtable[hash];
         read_lock(&head->lock);
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 tmp = sctp_assoc(epb);
                 if (tmp->ep != ep || rport != tmp->peer.port)
                         continue;
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 965bbbbe48d4..4b2c83146aa7 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -784,13 +784,12 @@ static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(struct net *net,
         struct sctp_hashbucket *head;
         struct sctp_ep_common *epb;
         struct sctp_endpoint *ep;
-        struct hlist_node *node;
         int hash;
 
         hash = sctp_ep_hashfn(net, ntohs(laddr->v4.sin_port));
         head = &sctp_ep_hashtable[hash];
         read_lock(&head->lock);
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 ep = sctp_ep(epb);
                 if (sctp_endpoint_is_match(ep, net, laddr))
                         goto hit;
@@ -876,7 +875,6 @@ static struct sctp_association *__sctp_lookup_association(
         struct sctp_ep_common *epb;
         struct sctp_association *asoc;
         struct sctp_transport *transport;
-        struct hlist_node *node;
         int hash;
 
         /* Optimize here for direct hit, only listening connections can
@@ -886,7 +884,7 @@ static struct sctp_association *__sctp_lookup_association(
                                  ntohs(peer->v4.sin_port));
         head = &sctp_assoc_hashtable[hash];
         read_lock(&head->lock);
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 asoc = sctp_assoc(epb);
                 transport = sctp_assoc_is_match(asoc, net, local, peer);
                 if (transport)
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 8c19e97262ca..ab3bba8cb0a8 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -213,7 +213,6 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
         struct sctp_ep_common *epb;
         struct sctp_endpoint *ep;
         struct sock *sk;
-        struct hlist_node *node;
         int    hash = *(loff_t *)v;
 
         if (hash >= sctp_ep_hashsize)
@@ -222,7 +221,7 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
         head = &sctp_ep_hashtable[hash];
         sctp_local_bh_disable();
         read_lock(&head->lock);
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 ep = sctp_ep(epb);
                 sk = epb->sk;
                 if (!net_eq(sock_net(sk), seq_file_net(seq)))
@@ -321,7 +320,6 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
         struct sctp_ep_common *epb;
         struct sctp_association *assoc;
         struct sock *sk;
-        struct hlist_node *node;
         int    hash = *(loff_t *)v;
 
         if (hash >= sctp_assoc_hashsize)
@@ -330,7 +328,7 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
         head = &sctp_assoc_hashtable[hash];
         sctp_local_bh_disable();
         read_lock(&head->lock);
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 assoc = sctp_assoc(epb);
                 sk = epb->sk;
                 if (!net_eq(sock_net(sk), seq_file_net(seq)))
@@ -436,7 +434,6 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
         struct sctp_hashbucket *head;
         struct sctp_ep_common *epb;
         struct sctp_association *assoc;
-        struct hlist_node *node;
         struct sctp_transport *tsp;
         int    hash = *(loff_t *)v;
 
@@ -447,7 +444,7 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
         sctp_local_bh_disable();
         read_lock(&head->lock);
         rcu_read_lock();
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 if (!net_eq(sock_net(epb->sk), seq_file_net(seq)))
                         continue;
                 assoc = sctp_assoc(epb);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index cedd9bf67b8c..c99458df3f3f 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5882,8 +5882,7 @@ static struct sctp_bind_bucket *sctp_bucket_create(
 static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
 {
         struct sctp_bind_hashbucket *head; /* hash list */
-        struct sctp_bind_bucket *pp; /* hash list port iterator */
-        struct hlist_node *node;
+        struct sctp_bind_bucket *pp;
         unsigned short snum;
         int ret;
 
@@ -5910,7 +5909,7 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
                         index = sctp_phashfn(sock_net(sk), rover);
                         head = &sctp_port_hashtable[index];
                         sctp_spin_lock(&head->lock);
-                        sctp_for_each_hentry(pp, node, &head->chain)
+                        sctp_for_each_hentry(pp, &head->chain)
                                 if ((pp->port == rover) &&
                                     net_eq(sock_net(sk), pp->net))
                                         goto next;
@@ -5938,7 +5937,7 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
                  */
                 head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
                 sctp_spin_lock(&head->lock);
-                sctp_for_each_hentry(pp, node, &head->chain) {
+                sctp_for_each_hentry(pp, &head->chain) {
                         if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))
                                 goto pp_found;
                 }
@@ -5970,7 +5969,7 @@ pp_found:
                  * that this port/socket (sk) combination are already
                  * in an endpoint.
                  */
-                sk_for_each_bound(sk2, node, &pp->owner) {
+                sk_for_each_bound(sk2, &pp->owner) {
                         struct sctp_endpoint *ep2;
                         ep2 = sctp_sk(sk2)->ep;
 
diff --git a/net/socket.c b/net/socket.c
index ee0d029e5130..88f759adf3af 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -369,16 +369,15 @@ struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
 
         file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
                   &socket_file_ops);
-        if (unlikely(!file)) {
+        if (unlikely(IS_ERR(file))) {
                 /* drop dentry, keep inode */
                 ihold(path.dentry->d_inode);
                 path_put(&path);
-                return ERR_PTR(-ENFILE);
+                return file;
         }
 
         sock->file = file;
         file->f_flags = O_RDWR | (flags & O_NONBLOCK);
-        file->f_pos = 0;
         file->private_data = sock;
         return file;
 }
diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index d11418f97f1f..a622ad64acd8 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -17,7 +17,8 @@
  */
 
 #include <net/ipv6.h>
-#include <linux/sunrpc/clnt.h>
+#include <linux/sunrpc/addr.h>
+#include <linux/sunrpc/msg_prot.h>
 #include <linux/slab.h>
 #include <linux/export.h>
 
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index b5c067bccc45..f5294047df77 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -407,15 +407,14 @@ rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
 {
         LIST_HEAD(free);
         struct rpc_cred_cache *cache = auth->au_credcache;
-        struct hlist_node *pos;
         struct rpc_cred *cred = NULL,
                         *entry, *new;
         unsigned int nr;
 
-        nr = hash_long(acred->uid, cache->hashbits);
+        nr = hash_long(from_kuid(&init_user_ns, acred->uid), cache->hashbits);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(entry, pos, &cache->hashtable[nr], cr_hash) {
+        hlist_for_each_entry_rcu(entry, &cache->hashtable[nr], cr_hash) {
                 if (!entry->cr_ops->crmatch(acred, entry, flags))
                         continue;
                 spin_lock(&cache->lock);
@@ -439,7 +438,7 @@ rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
         }
 
         spin_lock(&cache->lock);
-        hlist_for_each_entry(entry, pos, &cache->hashtable[nr], cr_hash) {
+        hlist_for_each_entry(entry, &cache->hashtable[nr], cr_hash) {
                 if (!entry->cr_ops->crmatch(acred, entry, flags))
                         continue;
                 cred = get_rpccred(entry);
@@ -519,8 +518,8 @@ rpcauth_bind_root_cred(struct rpc_task *task, int lookupflags)
 {
         struct rpc_auth *auth = task->tk_client->cl_auth;
         struct auth_cred acred = {
-                .uid = 0,
-                .gid = 0,
+                .uid = GLOBAL_ROOT_UID,
+                .gid = GLOBAL_ROOT_GID,
         };
 
         dprintk("RPC: %5u looking up %s cred\n",
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 6ed6f201b022..b6badafc6494 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -18,8 +18,8 @@
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
-#define RPC_MACHINE_CRED_USERID         ((uid_t)0)
-#define RPC_MACHINE_CRED_GROUPID        ((gid_t)0)
+#define RPC_MACHINE_CRED_USERID         GLOBAL_ROOT_UID
+#define RPC_MACHINE_CRED_GROUPID        GLOBAL_ROOT_GID
 
 struct generic_cred {
         struct rpc_cred gc_base;
@@ -96,7 +96,9 @@ generic_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
 
         dprintk("RPC:       allocated %s cred %p for uid %d gid %d\n",
                         gcred->acred.machine_cred ? "machine" : "generic",
-                        gcred, acred->uid, acred->gid);
+                        gcred,
+                        from_kuid(&init_user_ns, acred->uid),
+                        from_kgid(&init_user_ns, acred->gid));
         return &gcred->gc_base;
 }
 
@@ -129,8 +131,8 @@ machine_cred_match(struct auth_cred *acred, struct generic_cred *gcred, int flag
 {
         if (!gcred->acred.machine_cred ||
             gcred->acred.principal != acred->principal ||
-            gcred->acred.uid != acred->uid ||
-            gcred->acred.gid != acred->gid)
+            !uid_eq(gcred->acred.uid, acred->uid) ||
+            !gid_eq(gcred->acred.gid, acred->gid))
                 return 0;
         return 1;
 }
@@ -147,8 +149,8 @@ generic_match(struct auth_cred *acred, struct rpc_cred *cred, int flags)
         if (acred->machine_cred)
                 return machine_cred_match(acred, gcred, flags);
 
-        if (gcred->acred.uid != acred->uid ||
-            gcred->acred.gid != acred->gid ||
+        if (!uid_eq(gcred->acred.uid, acred->uid) ||
+            !gid_eq(gcred->acred.gid, acred->gid) ||
             gcred->acred.machine_cred != 0)
                 goto out_nomatch;
 
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 911ef008b701..5257d2982ba5 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -255,7 +255,7 @@ err:
 
 struct gss_upcall_msg {
         atomic_t count;
-        uid_t   uid;
+        kuid_t  uid;
         struct rpc_pipe_msg msg;
         struct list_head list;
         struct gss_auth *auth;
@@ -302,11 +302,11 @@ gss_release_msg(struct gss_upcall_msg *gss_msg)
 }
 
 static struct gss_upcall_msg *
-__gss_find_upcall(struct rpc_pipe *pipe, uid_t uid)
+__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid)
 {
         struct gss_upcall_msg *pos;
         list_for_each_entry(pos, &pipe->in_downcall, list) {
-                if (pos->uid != uid)
+                if (!uid_eq(pos->uid, uid))
                         continue;
                 atomic_inc(&pos->count);
                 dprintk("RPC:       %s found msg %p\n", __func__, pos);
@@ -394,8 +394,11 @@ gss_upcall_callback(struct rpc_task *task)
 
 static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg)
 {
-        gss_msg->msg.data = &gss_msg->uid;
-        gss_msg->msg.len = sizeof(gss_msg->uid);
+        uid_t uid = from_kuid(&init_user_ns, gss_msg->uid);
+        memcpy(gss_msg->databuf, &uid, sizeof(uid));
+        gss_msg->msg.data = gss_msg->databuf;
+        gss_msg->msg.len = sizeof(uid);
+        BUG_ON(sizeof(uid) > UPCALL_BUF_LEN);
 }
 
 static void gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
@@ -408,7 +411,7 @@ static void gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
 
         gss_msg->msg.len = sprintf(gss_msg->databuf, "mech=%s uid=%d ",
                                    mech->gm_name,
-                                   gss_msg->uid);
+                                   from_kuid(&init_user_ns, gss_msg->uid));
         p += gss_msg->msg.len;
         if (clnt->cl_principal) {
                 len = sprintf(p, "target=%s ", clnt->cl_principal);
@@ -444,7 +447,7 @@ static void gss_encode_msg(struct gss_upcall_msg *gss_msg,
 
 static struct gss_upcall_msg *
 gss_alloc_msg(struct gss_auth *gss_auth, struct rpc_clnt *clnt,
-                uid_t uid, const char *service_name)
+                kuid_t uid, const char *service_name)
 {
         struct gss_upcall_msg *gss_msg;
         int vers;
@@ -474,7 +477,7 @@ gss_setup_upcall(struct rpc_clnt *clnt, struct gss_auth *gss_auth, struct rpc_cr
         struct gss_cred *gss_cred = container_of(cred,
                         struct gss_cred, gc_base);
         struct gss_upcall_msg *gss_new, *gss_msg;
-        uid_t uid = cred->cr_uid;
+        kuid_t uid = cred->cr_uid;
 
         gss_new = gss_alloc_msg(gss_auth, clnt, uid, gss_cred->gc_principal);
         if (IS_ERR(gss_new))
@@ -516,7 +519,7 @@ gss_refresh_upcall(struct rpc_task *task)
         int err = 0;
 
         dprintk("RPC: %5u %s for uid %u\n",
-                task->tk_pid, __func__, cred->cr_uid);
+                task->tk_pid, __func__, from_kuid(&init_user_ns, cred->cr_uid));
         gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred);
         if (PTR_ERR(gss_msg) == -EAGAIN) {
                 /* XXX: warning on the first, under the assumption we
@@ -548,7 +551,8 @@ gss_refresh_upcall(struct rpc_task *task)
         gss_release_msg(gss_msg);
 out:
         dprintk("RPC: %5u %s for uid %u result %d\n",
-                task->tk_pid, __func__, cred->cr_uid, err);
+                task->tk_pid, __func__,
+                from_kuid(&init_user_ns, cred->cr_uid), err);
         return err;
 }
 
@@ -561,7 +565,8 @@ gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
         DEFINE_WAIT(wait);
         int err = 0;
 
-        dprintk("RPC:       %s for uid %u\n", __func__, cred->cr_uid);
+        dprintk("RPC:       %s for uid %u\n",
+                __func__, from_kuid(&init_user_ns, cred->cr_uid));
 retry:
         gss_msg = gss_setup_upcall(gss_auth->client, gss_auth, cred);
         if (PTR_ERR(gss_msg) == -EAGAIN) {
@@ -603,7 +608,7 @@ out_intr:
         gss_release_msg(gss_msg);
 out:
         dprintk("RPC:       %s for uid %u result %d\n",
-                __func__, cred->cr_uid, err);
+                __func__, from_kuid(&init_user_ns, cred->cr_uid), err);
         return err;
 }
 
@@ -615,9 +620,10 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
         const void *p, *end;
         void *buf;
         struct gss_upcall_msg *gss_msg;
-        struct rpc_pipe *pipe = RPC_I(filp->f_dentry->d_inode)->pipe;
+        struct rpc_pipe *pipe = RPC_I(file_inode(filp))->pipe;
         struct gss_cl_ctx *ctx;
-        uid_t uid;
+        uid_t id;
+        kuid_t uid;
         ssize_t err = -EFBIG;
 
         if (mlen > MSG_BUF_MAXSIZE)
@@ -632,12 +638,18 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
                 goto err;
 
         end = (const void *)((char *)buf + mlen);
-        p = simple_get_bytes(buf, end, &uid, sizeof(uid));
+        p = simple_get_bytes(buf, end, &id, sizeof(id));
         if (IS_ERR(p)) {
                 err = PTR_ERR(p);
                 goto err;
         }
 
+        uid = make_kuid(&init_user_ns, id);
+        if (!uid_valid(uid)) {
+                err = -EINVAL;
+                goto err;
+        }
+
         err = -ENOMEM;
         ctx = gss_alloc_context();
         if (ctx == NULL)
@@ -1058,7 +1070,8 @@ gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
         int err = -ENOMEM;
 
         dprintk("RPC:       %s for uid %d, flavor %d\n",
-                __func__, acred->uid, auth->au_flavor);
+                __func__, from_kuid(&init_user_ns, acred->uid),
+                auth->au_flavor);
 
         if (!(cred = kzalloc(sizeof(*cred), GFP_NOFS)))
                 goto out_err;
@@ -1114,7 +1127,7 @@ out:
         }
         if (gss_cred->gc_principal != NULL)
                 return 0;
-        return rc->cr_uid == acred->uid;
+        return uid_eq(rc->cr_uid, acred->uid);
 }
 
 /*
diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
index 107c4528654f..88edec929d73 100644
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -574,6 +574,8 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
         buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
         buf->len -= GSS_KRB5_TOK_HDR_LEN + headskip;
 
+        /* Trim off the checksum blob */
+        xdr_buf_trim(buf, GSS_KRB5_TOK_HDR_LEN + tailskip);
         return GSS_S_COMPLETE;
 }
 
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 73e957386600..f7d34e7b6f81 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -182,12 +182,6 @@ static void rsi_request(struct cache_detail *cd,
         (*bpp)[-1] = '\n';
 }
 
-static int rsi_upcall(struct cache_detail *cd, struct cache_head *h)
-{
-        return sunrpc_cache_pipe_upcall(cd, h, rsi_request);
-}
-
-
 static int rsi_parse(struct cache_detail *cd,
                     char *mesg, int mlen)
 {
@@ -275,7 +269,7 @@ static struct cache_detail rsi_cache_template = {
         .hash_size      = RSI_HASHMAX,
         .name           = "auth.rpcsec.init",
         .cache_put      = rsi_put,
-        .cache_upcall   = rsi_upcall,
+        .cache_request  = rsi_request,
         .cache_parse    = rsi_parse,
         .match          = rsi_match,
         .init           = rsi_init,
@@ -418,6 +412,7 @@ static int rsc_parse(struct cache_detail *cd,
 {
         /* contexthandle expiry [ uid gid N <n gids> mechname ...mechdata... ] */
         char *buf = mesg;
+        int id;
         int len, rv;
         struct rsc rsci, *rscp = NULL;
         time_t expiry;
@@ -444,7 +439,7 @@ static int rsc_parse(struct cache_detail *cd,
                 goto out;
 
         /* uid, or NEGATIVE */
-        rv = get_int(&mesg, &rsci.cred.cr_uid);
+        rv = get_int(&mesg, &id);
         if (rv == -EINVAL)
                 goto out;
         if (rv == -ENOENT)
@@ -452,8 +447,16 @@ static int rsc_parse(struct cache_detail *cd,
         else {
                 int N, i;
 
+                /* uid */
+                rsci.cred.cr_uid = make_kuid(&init_user_ns, id);
+                if (!uid_valid(rsci.cred.cr_uid))
+                        goto out;
+
                 /* gid */
-                if (get_int(&mesg, &rsci.cred.cr_gid))
+                if (get_int(&mesg, &id))
+                        goto out;
+                rsci.cred.cr_gid = make_kgid(&init_user_ns, id);
+                if (!gid_valid(rsci.cred.cr_gid))
                         goto out;
 
                 /* number of additional gid's */
@@ -467,11 +470,10 @@ static int rsc_parse(struct cache_detail *cd,
                 /* gid's */
                 status = -EINVAL;
                 for (i=0; i<N; i++) {
-                        gid_t gid;
                         kgid_t kgid;
-                        if (get_int(&mesg, &gid))
+                        if (get_int(&mesg, &id))
                                 goto out;
-                        kgid = make_kgid(&init_user_ns, gid);
+                        kgid = make_kgid(&init_user_ns, id);
                         if (!gid_valid(kgid))
                                 goto out;
                         GROUP_AT(rsci.cred.cr_group_info, i) = kgid;
@@ -817,13 +819,17 @@ read_u32_from_xdr_buf(struct xdr_buf *buf, int base, u32 *obj)
  *      The server uses base of head iovec as read pointer, while the
  *      client uses separate pointer. */
 static int
-unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
+unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
 {
         int stat = -EINVAL;
         u32 integ_len, maj_stat;
         struct xdr_netobj mic;
         struct xdr_buf integ_buf;
 
+        /* Did we already verify the signature on the original pass through? */
+        if (rqstp->rq_deferred)
+                return 0;
+
         integ_len = svc_getnl(&buf->head[0]);
         if (integ_len & 3)
                 return stat;
@@ -846,6 +852,8 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
                 goto out;
         if (svc_getnl(&buf->head[0]) != seq)
                 goto out;
+        /* trim off the mic at the end before returning */
+        xdr_buf_trim(buf, mic.len + 4);
         stat = 0;
 out:
         kfree(mic.data);
@@ -1190,7 +1198,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
                         /* placeholders for length and seq. number: */
                         svc_putnl(resv, 0);
                         svc_putnl(resv, 0);
-                        if (unwrap_integ_data(&rqstp->rq_arg,
+                        if (unwrap_integ_data(rqstp, &rqstp->rq_arg,
                                         gc->gc_seq, rsci->mechctx))
                                 goto garbage_args;
                         break;
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index 52c5abdee211..dc37021fc3e5 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -18,8 +18,8 @@
 
 struct unx_cred {
         struct rpc_cred         uc_base;
-        gid_t                   uc_gid;
-        gid_t                   uc_gids[NFS_NGROUPS];
+        kgid_t                  uc_gid;
+        kgid_t                  uc_gids[NFS_NGROUPS];
 };
 #define uc_uid                  uc_base.cr_uid
 
@@ -65,7 +65,8 @@ unx_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
         unsigned int i;
 
         dprintk("RPC:       allocating UNIX cred for uid %d gid %d\n",
-                        acred->uid, acred->gid);
+                        from_kuid(&init_user_ns, acred->uid),
+                        from_kgid(&init_user_ns, acred->gid));
 
         if (!(cred = kmalloc(sizeof(*cred), GFP_NOFS)))
                 return ERR_PTR(-ENOMEM);
@@ -79,13 +80,10 @@ unx_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
                 groups = NFS_NGROUPS;
 
         cred->uc_gid = acred->gid;
-        for (i = 0; i < groups; i++) {
-                gid_t gid;
-                gid = from_kgid(&init_user_ns, GROUP_AT(acred->group_info, i));
-                cred->uc_gids[i] = gid;
-        }
+        for (i = 0; i < groups; i++)
+                cred->uc_gids[i] = GROUP_AT(acred->group_info, i);
         if (i < NFS_NGROUPS)
-                cred->uc_gids[i] = NOGROUP;
+                cred->uc_gids[i] = INVALID_GID;
 
         return &cred->uc_base;
 }
@@ -123,21 +121,17 @@ unx_match(struct auth_cred *acred, struct rpc_cred *rcred, int flags)
         unsigned int i;
 
 
-        if (cred->uc_uid != acred->uid || cred->uc_gid != acred->gid)
+        if (!uid_eq(cred->uc_uid, acred->uid) || !gid_eq(cred->uc_gid, acred->gid))
                 return 0;
 
         if (acred->group_info != NULL)
                 groups = acred->group_info->ngroups;
         if (groups > NFS_NGROUPS)
                 groups = NFS_NGROUPS;
-        for (i = 0; i < groups ; i++) {
-                gid_t gid;
-                gid = from_kgid(&init_user_ns, GROUP_AT(acred->group_info, i));
-                if (cred->uc_gids[i] != gid)
+        for (i = 0; i < groups ; i++)
+                if (!gid_eq(cred->uc_gids[i], GROUP_AT(acred->group_info, i)))
                         return 0;
-        }
-        if (groups < NFS_NGROUPS &&
-            cred->uc_gids[groups] != NOGROUP)
+        if (groups < NFS_NGROUPS && gid_valid(cred->uc_gids[groups]))
                 return 0;
         return 1;
 }
@@ -163,11 +157,11 @@ unx_marshal(struct rpc_task *task, __be32 *p)
          */
         p = xdr_encode_array(p, clnt->cl_nodename, clnt->cl_nodelen);
 
-        *p++ = htonl((u32) cred->uc_uid);
-        *p++ = htonl((u32) cred->uc_gid);
+        *p++ = htonl((u32) from_kuid(&init_user_ns, cred->uc_uid));
+        *p++ = htonl((u32) from_kgid(&init_user_ns, cred->uc_gid));
         hold = p++;
-        for (i = 0; i < 16 && cred->uc_gids[i] != (gid_t) NOGROUP; i++)
-                *p++ = htonl((u32) cred->uc_gids[i]);
+        for (i = 0; i < 16 && gid_valid(cred->uc_gids[i]); i++)
+                *p++ = htonl((u32) from_kgid(&init_user_ns, cred->uc_gids[i]));
         *hold = htonl(p - hold - 1);            /* gid array length */
         *base = htonl((p - base - 1) << 2);     /* cred length */
 
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 9afa4393c217..25d58e766014 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -196,9 +196,9 @@ EXPORT_SYMBOL_GPL(sunrpc_cache_update);
 
 static int cache_make_upcall(struct cache_detail *cd, struct cache_head *h)
 {
-        if (!cd->cache_upcall)
-                return -EINVAL;
-        return cd->cache_upcall(cd, h);
+        if (cd->cache_upcall)
+                return cd->cache_upcall(cd, h);
+        return sunrpc_cache_pipe_upcall(cd, h);
 }
 
 static inline int cache_is_valid(struct cache_detail *detail, struct cache_head *h)
@@ -670,13 +670,13 @@ static void cache_revisit_request(struct cache_head *item)
 {
         struct cache_deferred_req *dreq;
         struct list_head pending;
-        struct hlist_node *lp, *tmp;
+        struct hlist_node *tmp;
         int hash = DFR_HASH(item);
 
         INIT_LIST_HEAD(&pending);
         spin_lock(&cache_defer_lock);
 
-        hlist_for_each_entry_safe(dreq, lp, tmp, &cache_defer_hash[hash], hash)
+        hlist_for_each_entry_safe(dreq, tmp, &cache_defer_hash[hash], hash)
                 if (dreq->item == item) {
                         __unhash_deferred_req(dreq);
                         list_add(&dreq->recent, &pending);
@@ -750,12 +750,24 @@ struct cache_reader {
         int                     offset; /* if non-0, we have a refcnt on next request */
 };
 
+static int cache_request(struct cache_detail *detail,
+                               struct cache_request *crq)
+{
+        char *bp = crq->buf;
+        int len = PAGE_SIZE;
+
+        detail->cache_request(detail, crq->item, &bp, &len);
+        if (len < 0)
+                return -EAGAIN;
+        return PAGE_SIZE - len;
+}
+
 static ssize_t cache_read(struct file *filp, char __user *buf, size_t count,
                           loff_t *ppos, struct cache_detail *cd)
 {
         struct cache_reader *rp = filp->private_data;
         struct cache_request *rq;
-        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(filp);
         int err;
 
         if (count == 0)
@@ -784,6 +796,13 @@ static ssize_t cache_read(struct file *filp, char __user *buf, size_t count,
                 rq->readers++;
         spin_unlock(&queue_lock);
 
+        if (rq->len == 0) {
+                err = cache_request(cd, rq);
+                if (err < 0)
+                        goto out;
+                rq->len = err;
+        }
+
         if (rp->offset == 0 && !test_bit(CACHE_PENDING, &rq->item->flags)) {
                 err = -EAGAIN;
                 spin_lock(&queue_lock);
@@ -886,7 +905,7 @@ static ssize_t cache_write(struct file *filp, const char __user *buf,
                            struct cache_detail *cd)
 {
         struct address_space *mapping = filp->f_mapping;
-        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(filp);
         ssize_t ret = -EINVAL;
 
         if (!cd->cache_parse)
@@ -1140,17 +1159,14 @@ static bool cache_listeners_exist(struct cache_detail *detail)
  *
  * Each request is at most one page long.
  */
-int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h,
-                void (*cache_request)(struct cache_detail *,
-                                      struct cache_head *,
-                                      char **,
-                                      int *))
+int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h)
 {
 
         char *buf;
         struct cache_request *crq;
-        char *bp;
-        int len;
+
+        if (!detail->cache_request)
+                return -EINVAL;
 
         if (!cache_listeners_exist(detail)) {
                 warn_no_listener(detail);
@@ -1167,19 +1183,10 @@ int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h,
                 return -EAGAIN;
         }
 
-        bp = buf; len = PAGE_SIZE;
-
-        cache_request(detail, h, &bp, &len);
-
-        if (len < 0) {
-                kfree(buf);
-                kfree(crq);
-                return -EAGAIN;
-        }
         crq->q.reader = 0;
         crq->item = cache_get(h);
         crq->buf = buf;
-        crq->len = PAGE_SIZE - len;
+        crq->len = 0;
         crq->readers = 0;
         spin_lock(&queue_lock);
         list_add_tail(&crq->q.list, &detail->queue);
@@ -1454,7 +1461,7 @@ static ssize_t write_flush(struct file *file, const char __user *buf,
 static ssize_t cache_read_procfs(struct file *filp, char __user *buf,
                                  size_t count, loff_t *ppos)
 {
-        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+        struct cache_detail *cd = PDE(file_inode(filp))->data;
 
         return cache_read(filp, buf, count, ppos, cd);
 }
@@ -1462,14 +1469,14 @@ static ssize_t cache_read_procfs(struct file *filp, char __user *buf,
 static ssize_t cache_write_procfs(struct file *filp, const char __user *buf,
                                   size_t count, loff_t *ppos)
 {
-        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+        struct cache_detail *cd = PDE(file_inode(filp))->data;
 
         return cache_write(filp, buf, count, ppos, cd);
 }
 
 static unsigned int cache_poll_procfs(struct file *filp, poll_table *wait)
 {
-        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+        struct cache_detail *cd = PDE(file_inode(filp))->data;
 
         return cache_poll(filp, wait, cd);
 }
@@ -1477,7 +1484,7 @@ static unsigned int cache_poll_procfs(struct file *filp, poll_table *wait)
 static long cache_ioctl_procfs(struct file *filp,
                                unsigned int cmd, unsigned long arg)
 {
-        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(filp);
         struct cache_detail *cd = PDE(inode)->data;
 
         return cache_ioctl(inode, filp, cmd, arg, cd);
@@ -1546,7 +1553,7 @@ static int release_flush_procfs(struct inode *inode, struct file *filp)
 static ssize_t read_flush_procfs(struct file *filp, char __user *buf,
                             size_t count, loff_t *ppos)
 {
-        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+        struct cache_detail *cd = PDE(file_inode(filp))->data;
 
         return read_flush(filp, buf, count, ppos, cd);
 }
@@ -1555,7 +1562,7 @@ static ssize_t write_flush_procfs(struct file *filp,
                                   const char __user *buf,
                                   size_t count, loff_t *ppos)
 {
-        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+        struct cache_detail *cd = PDE(file_inode(filp))->data;
 
         return write_flush(filp, buf, count, ppos, cd);
 }
@@ -1605,7 +1612,7 @@ static int create_cache_proc_entries(struct cache_detail *cd, struct net *net)
         if (p == NULL)
                 goto out_nomem;
 
-        if (cd->cache_upcall || cd->cache_parse) {
+        if (cd->cache_request || cd->cache_parse) {
                 p = proc_create_data("channel", S_IFREG|S_IRUSR|S_IWUSR,
                                      cd->u.procfs.proc_ent,
                                      &cache_file_operations_procfs, cd);
@@ -1614,7 +1621,7 @@ static int create_cache_proc_entries(struct cache_detail *cd, struct net *net)
                         goto out_nomem;
         }
         if (cd->cache_show) {
-                p = proc_create_data("content", S_IFREG|S_IRUSR|S_IWUSR,
+                p = proc_create_data("content", S_IFREG|S_IRUSR,
                                 cd->u.procfs.proc_ent,
                                 &content_file_operations_procfs, cd);
                 cd->u.procfs.content_ent = p;
@@ -1686,7 +1693,7 @@ EXPORT_SYMBOL_GPL(cache_destroy_net);
 static ssize_t cache_read_pipefs(struct file *filp, char __user *buf,
                                  size_t count, loff_t *ppos)
 {
-        struct cache_detail *cd = RPC_I(filp->f_path.dentry->d_inode)->private;
+        struct cache_detail *cd = RPC_I(file_inode(filp))->private;
 
         return cache_read(filp, buf, count, ppos, cd);
 }
@@ -1694,14 +1701,14 @@ static ssize_t cache_read_pipefs(struct file *filp, char __user *buf,
 static ssize_t cache_write_pipefs(struct file *filp, const char __user *buf,
                                   size_t count, loff_t *ppos)
 {
-        struct cache_detail *cd = RPC_I(filp->f_path.dentry->d_inode)->private;
+        struct cache_detail *cd = RPC_I(file_inode(filp))->private;
 
         return cache_write(filp, buf, count, ppos, cd);
 }
 
 static unsigned int cache_poll_pipefs(struct file *filp, poll_table *wait)
 {
-        struct cache_detail *cd = RPC_I(filp->f_path.dentry->d_inode)->private;
+        struct cache_detail *cd = RPC_I(file_inode(filp))->private;
 
         return cache_poll(filp, wait, cd);
 }
@@ -1709,7 +1716,7 @@ static unsigned int cache_poll_pipefs(struct file *filp, poll_table *wait)
 static long cache_ioctl_pipefs(struct file *filp,
                               unsigned int cmd, unsigned long arg)
 {
-        struct inode *inode = filp->f_dentry->d_inode;
+        struct inode *inode = file_inode(filp);
         struct cache_detail *cd = RPC_I(inode)->private;
 
         return cache_ioctl(inode, filp, cmd, arg, cd);
@@ -1778,7 +1785,7 @@ static int release_flush_pipefs(struct inode *inode, struct file *filp)
 static ssize_t read_flush_pipefs(struct file *filp, char __user *buf,
                             size_t count, loff_t *ppos)
 {
-        struct cache_detail *cd = RPC_I(filp->f_path.dentry->d_inode)->private;
+        struct cache_detail *cd = RPC_I(file_inode(filp))->private;
 
         return read_flush(filp, buf, count, ppos, cd);
 }
@@ -1787,7 +1794,7 @@ static ssize_t write_flush_pipefs(struct file *filp,
                                   const char __user *buf,
                                   size_t count, loff_t *ppos)
 {
-        struct cache_detail *cd = RPC_I(filp->f_path.dentry->d_inode)->private;
+        struct cache_detail *cd = RPC_I(file_inode(filp))->private;
 
         return write_flush(filp, buf, count, ppos, cd);
 }
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index a9f7906c1a6a..dcc446e7fbf6 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -33,6 +33,7 @@
 #include <linux/rcupdate.h>
 
 #include <linux/sunrpc/clnt.h>
+#include <linux/sunrpc/addr.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
 #include <linux/sunrpc/metrics.h>
 #include <linux/sunrpc/bc_xprt.h>
@@ -1196,6 +1197,21 @@ size_t rpc_max_payload(struct rpc_clnt *clnt)
 EXPORT_SYMBOL_GPL(rpc_max_payload);
 
 /**
+ * rpc_get_timeout - Get timeout for transport in units of HZ
+ * @clnt: RPC client to query
+ */
+unsigned long rpc_get_timeout(struct rpc_clnt *clnt)
+{
+        unsigned long ret;
+
+        rcu_read_lock();
+        ret = rcu_dereference(clnt->cl_xprt)->timeout->to_initval;
+        rcu_read_unlock();
+        return ret;
+}
+EXPORT_SYMBOL_GPL(rpc_get_timeout);
+
+/**
  * rpc_force_rebind - force transport to check that remote port is unchanged
  * @clnt: client to rebind
  *
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index fd10981ea792..7b9b40224a27 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -284,7 +284,7 @@ out:
 static ssize_t
 rpc_pipe_read(struct file *filp, char __user *buf, size_t len, loff_t *offset)
 {
-        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(filp);
         struct rpc_pipe *pipe;
         struct rpc_pipe_msg *msg;
         int res = 0;
@@ -328,7 +328,7 @@ out_unlock:
 static ssize_t
 rpc_pipe_write(struct file *filp, const char __user *buf, size_t len, loff_t *offset)
 {
-        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(filp);
         int res;
 
         mutex_lock(&inode->i_mutex);
@@ -342,7 +342,7 @@ rpc_pipe_write(struct file *filp, const char __user *buf, size_t len, loff_t *of
 static unsigned int
 rpc_pipe_poll(struct file *filp, struct poll_table_struct *wait)
 {
-        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(filp);
         struct rpc_inode *rpci = RPC_I(inode);
         unsigned int mask = POLLOUT | POLLWRNORM;
 
@@ -360,7 +360,7 @@ rpc_pipe_poll(struct file *filp, struct poll_table_struct *wait)
 static long
 rpc_pipe_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
-        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(filp);
         struct rpc_pipe *pipe;
         int len;
 
@@ -830,7 +830,7 @@ static int rpc_rmdir_depopulate(struct dentry *dentry,
  * responses to upcalls.  They will result in calls to @msg->downcall.
  *
  * The @private argument passed here will be available to all these methods
- * from the file pointer, via RPC_I(file->f_dentry->d_inode)->private.
+ * from the file pointer, via RPC_I(file_inode(file))->private.
  */
 struct dentry *rpc_mkpipe_dentry(struct dentry *parent, const char *name,
                                  void *private, struct rpc_pipe *pipe)
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 795a0f4e920b..3df764dc330c 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -26,6 +26,7 @@
 #include <net/ipv6.h>
 
 #include <linux/sunrpc/clnt.h>
+#include <linux/sunrpc/addr.h>
 #include <linux/sunrpc/sched.h>
 #include <linux/sunrpc/xprtsock.h>
 
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index dbf12ac5ecb7..89a588b4478b 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -515,15 +515,6 @@ EXPORT_SYMBOL_GPL(svc_create_pooled);
 
 void svc_shutdown_net(struct svc_serv *serv, struct net *net)
 {
-        /*
-         * The set of xprts (contained in the sv_tempsocks and
-         * sv_permsocks lists) is now constant, since it is modified
-         * only by accepting new sockets (done by service threads in
-         * svc_recv) or aging old ones (done by sv_temptimer), or
-         * configuration changes (excluded by whatever locking the
-         * caller is using--nfsd_mutex in the case of nfsd).  So it's
-         * safe to traverse those lists and shut everything down:
-         */
         svc_close_net(serv, net);
 
         if (serv->sv_shutdown)
@@ -1042,6 +1033,7 @@ static void svc_unregister(const struct svc_serv *serv, struct net *net)
 /*
  * dprintk the given error with the address of the client that caused it.
  */
+#ifdef RPC_DEBUG
 static __printf(2, 3)
 void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
 {
@@ -1058,6 +1050,9 @@ void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
 
         va_end(args);
 }
+#else
+static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {}
+#endif
 
 /*
  * Common routine for processing the RPC request.
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index b8e47fac7315..80a6640f329b 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -499,7 +499,8 @@ void svc_wake_up(struct svc_serv *serv)
                         rqstp->rq_xprt = NULL;
                          */
                         wake_up(&rqstp->rq_wait);
-                }
+                } else
+                        pool->sp_task_pending = 1;
                 spin_unlock_bh(&pool->sp_lock);
         }
 }
@@ -634,7 +635,13 @@ struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout)
                  * long for cache updates.
                  */
                 rqstp->rq_chandle.thread_wait = 1*HZ;
+                pool->sp_task_pending = 0;
         } else {
+                if (pool->sp_task_pending) {
+                        pool->sp_task_pending = 0;
+                        spin_unlock_bh(&pool->sp_lock);
+                        return ERR_PTR(-EAGAIN);
+                }
                 /* No data pending. Go to sleep */
                 svc_thread_enqueue(pool, rqstp);
 
@@ -856,7 +863,6 @@ static void svc_age_temp_xprts(unsigned long closure)
         struct svc_serv *serv = (struct svc_serv *)closure;
         struct svc_xprt *xprt;
         struct list_head *le, *next;
-        LIST_HEAD(to_be_aged);
 
         dprintk("svc_age_temp_xprts\n");
 
@@ -877,25 +883,15 @@ static void svc_age_temp_xprts(unsigned long closure)
                 if (atomic_read(&xprt->xpt_ref.refcount) > 1 ||
                     test_bit(XPT_BUSY, &xprt->xpt_flags))
                         continue;
-                svc_xprt_get(xprt);
-                list_move(le, &to_be_aged);
+                list_del_init(le);
                 set_bit(XPT_CLOSE, &xprt->xpt_flags);
                 set_bit(XPT_DETACHED, &xprt->xpt_flags);
-        }
-        spin_unlock_bh(&serv->sv_lock);
-
-        while (!list_empty(&to_be_aged)) {
-                le = to_be_aged.next;
-                /* fiddling the xpt_list node is safe 'cos we're XPT_DETACHED */
-                list_del_init(le);
-                xprt = list_entry(le, struct svc_xprt, xpt_list);
-
                 dprintk("queuing xprt %p for closing\n", xprt);
 
                 /* a thread will dequeue and close it soon */
                 svc_xprt_enqueue(xprt);
-                svc_xprt_put(xprt);
         }
+        spin_unlock_bh(&serv->sv_lock);
 
         mod_timer(&serv->sv_temptimer, jiffies + svc_conn_age_period * HZ);
 }
@@ -959,21 +955,24 @@ void svc_close_xprt(struct svc_xprt *xprt)
 }
 EXPORT_SYMBOL_GPL(svc_close_xprt);
 
-static void svc_close_list(struct svc_serv *serv, struct list_head *xprt_list, struct net *net)
+static int svc_close_list(struct svc_serv *serv, struct list_head *xprt_list, struct net *net)
 {
         struct svc_xprt *xprt;
+        int ret = 0;
 
         spin_lock(&serv->sv_lock);
         list_for_each_entry(xprt, xprt_list, xpt_list) {
                 if (xprt->xpt_net != net)
                         continue;
+                ret++;
                 set_bit(XPT_CLOSE, &xprt->xpt_flags);
-                set_bit(XPT_BUSY, &xprt->xpt_flags);
+                svc_xprt_enqueue(xprt);
         }
         spin_unlock(&serv->sv_lock);
+        return ret;
 }
 
-static void svc_clear_pools(struct svc_serv *serv, struct net *net)
+static struct svc_xprt *svc_dequeue_net(struct svc_serv *serv, struct net *net)
 {
         struct svc_pool *pool;
         struct svc_xprt *xprt;
@@ -988,42 +987,46 @@ static void svc_clear_pools(struct svc_serv *serv, struct net *net)
                         if (xprt->xpt_net != net)
                                 continue;
                         list_del_init(&xprt->xpt_ready);
+                        spin_unlock_bh(&pool->sp_lock);
+                        return xprt;
                 }
                 spin_unlock_bh(&pool->sp_lock);
         }
+        return NULL;
 }
 
-static void svc_clear_list(struct svc_serv *serv, struct list_head *xprt_list, struct net *net)
+static void svc_clean_up_xprts(struct svc_serv *serv, struct net *net)
 {
         struct svc_xprt *xprt;
-        struct svc_xprt *tmp;
-        LIST_HEAD(victims);
 
-        spin_lock(&serv->sv_lock);
-        list_for_each_entry_safe(xprt, tmp, xprt_list, xpt_list) {
-                if (xprt->xpt_net != net)
-                        continue;
-                list_move(&xprt->xpt_list, &victims);
-        }
-        spin_unlock(&serv->sv_lock);
-
-        list_for_each_entry_safe(xprt, tmp, &victims, xpt_list)
+        while ((xprt = svc_dequeue_net(serv, net))) {
+                set_bit(XPT_CLOSE, &xprt->xpt_flags);
                 svc_delete_xprt(xprt);
+        }
 }
 
+/*
+ * Server threads may still be running (especially in the case where the
+ * service is still running in other network namespaces).
+ *
+ * So we shut down sockets the same way we would on a running server, by
+ * setting XPT_CLOSE, enqueuing, and letting a thread pick it up to do
+ * the close.  In the case there are no such other threads,
+ * threads running, svc_clean_up_xprts() does a simple version of a
+ * server's main event loop, and in the case where there are other
+ * threads, we may need to wait a little while and then check again to
+ * see if they're done.
+ */
 void svc_close_net(struct svc_serv *serv, struct net *net)
 {
-        svc_close_list(serv, &serv->sv_tempsocks, net);
-        svc_close_list(serv, &serv->sv_permsocks, net);
+        int delay = 0;
 
-        svc_clear_pools(serv, net);
-        /*
-         * At this point the sp_sockets lists will stay empty, since
-         * svc_xprt_enqueue will not add new entries without taking the
-         * sp_lock and checking XPT_BUSY.
-         */
-        svc_clear_list(serv, &serv->sv_tempsocks, net);
-        svc_clear_list(serv, &serv->sv_permsocks, net);
+        while (svc_close_list(serv, &serv->sv_permsocks, net) +
+               svc_close_list(serv, &serv->sv_tempsocks, net)) {
+
+                svc_clean_up_xprts(serv, net);
+                msleep(delay++);
+        }
 }
 
 /*
diff --git a/net/sunrpc/svcauth.c b/net/sunrpc/svcauth.c
index 7963569fc04f..2af7b0cba43a 100644
--- a/net/sunrpc/svcauth.c
+++ b/net/sunrpc/svcauth.c
@@ -138,13 +138,12 @@ auth_domain_lookup(char *name, struct auth_domain *new)
 {
         struct auth_domain *hp;
         struct hlist_head *head;
-        struct hlist_node *np;
 
         head = &auth_domain_table[hash_str(name, DN_HASHBITS)];
 
         spin_lock(&auth_domain_lock);
 
-        hlist_for_each_entry(hp, np, head, hash) {
+        hlist_for_each_entry(hp, head, hash) {
                 if (strcmp(hp->name, name)==0) {
                         kref_get(&hp->ref);
                         spin_unlock(&auth_domain_lock);
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 4d0129203733..c3f9e1ef7f53 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -6,6 +6,7 @@
 #include <linux/sunrpc/svcsock.h>
 #include <linux/sunrpc/svcauth.h>
 #include <linux/sunrpc/gss_api.h>
+#include <linux/sunrpc/addr.h>
 #include <linux/err.h>
 #include <linux/seq_file.h>
 #include <linux/hash.h>
@@ -17,7 +18,6 @@
 #include <linux/user_namespace.h>
 #define RPCDBG_FACILITY RPCDBG_AUTH
 
-#include <linux/sunrpc/clnt.h>
 
 #include "netns.h"
 
@@ -157,11 +157,6 @@ static void ip_map_request(struct cache_detail *cd,
         (*bpp)[-1] = '\n';
 }
 
-static int ip_map_upcall(struct cache_detail *cd, struct cache_head *h)
-{
-        return sunrpc_cache_pipe_upcall(cd, h, ip_map_request);
-}
-
 static struct ip_map *__ip_map_lookup(struct cache_detail *cd, char *class, struct in6_addr *addr);
 static int __ip_map_update(struct cache_detail *cd, struct ip_map *ipm, struct unix_domain *udom, time_t expiry);
 
@@ -415,10 +410,15 @@ svcauth_unix_info_release(struct svc_xprt *xpt)
 
 struct unix_gid {
         struct cache_head       h;
-        uid_t                   uid;
+        kuid_t                  uid;
         struct group_info       *gi;
 };
 
+static int unix_gid_hash(kuid_t uid)
+{
+        return hash_long(from_kuid(&init_user_ns, uid), GID_HASHBITS);
+}
+
 static void unix_gid_put(struct kref *kref)
 {
         struct cache_head *item = container_of(kref, struct cache_head, ref);
@@ -433,7 +433,7 @@ static int unix_gid_match(struct cache_head *corig, struct cache_head *cnew)
 {
         struct unix_gid *orig = container_of(corig, struct unix_gid, h);
         struct unix_gid *new = container_of(cnew, struct unix_gid, h);
-        return orig->uid == new->uid;
+        return uid_eq(orig->uid, new->uid);
 }
 static void unix_gid_init(struct cache_head *cnew, struct cache_head *citem)
 {
@@ -465,23 +465,19 @@ static void unix_gid_request(struct cache_detail *cd,
         char tuid[20];
         struct unix_gid *ug = container_of(h, struct unix_gid, h);
 
-        snprintf(tuid, 20, "%u", ug->uid);
+        snprintf(tuid, 20, "%u", from_kuid(&init_user_ns, ug->uid));
         qword_add(bpp, blen, tuid);
         (*bpp)[-1] = '\n';
 }
 
-static int unix_gid_upcall(struct cache_detail *cd, struct cache_head *h)
-{
-        return sunrpc_cache_pipe_upcall(cd, h, unix_gid_request);
-}
-
-static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, uid_t uid);
+static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, kuid_t uid);
 
 static int unix_gid_parse(struct cache_detail *cd,
                         char *mesg, int mlen)
 {
         /* uid expiry Ngid gid0 gid1 ... gidN-1 */
-        int uid;
+        int id;
+        kuid_t uid;
         int gids;
         int rv;
         int i;
@@ -493,9 +489,12 @@ static int unix_gid_parse(struct cache_detail *cd,
                 return -EINVAL;
         mesg[mlen-1] = 0;
 
-        rv = get_int(&mesg, &uid);
+        rv = get_int(&mesg, &id);
         if (rv)
                 return -EINVAL;
+        uid = make_kuid(&init_user_ns, id);
+        if (!uid_valid(uid))
+                return -EINVAL;
         ug.uid = uid;
 
         expiry = get_expiry(&mesg);
@@ -530,7 +529,7 @@ static int unix_gid_parse(struct cache_detail *cd,
                 ug.h.expiry_time = expiry;
                 ch = sunrpc_cache_update(cd,
                                          &ug.h, &ugp->h,
-                                         hash_long(uid, GID_HASHBITS));
+                                         unix_gid_hash(uid));
                 if (!ch)
                         err = -ENOMEM;
                 else {
@@ -549,7 +548,7 @@ static int unix_gid_show(struct seq_file *m,
                          struct cache_detail *cd,
                          struct cache_head *h)
 {
-        struct user_namespace *user_ns = current_user_ns();
+        struct user_namespace *user_ns = &init_user_ns;
         struct unix_gid *ug;
         int i;
         int glen;
@@ -565,7 +564,7 @@ static int unix_gid_show(struct seq_file *m,
         else
                 glen = 0;
 
-        seq_printf(m, "%u %d:", ug->uid, glen);
+        seq_printf(m, "%u %d:", from_kuid_munged(user_ns, ug->uid), glen);
         for (i = 0; i < glen; i++)
                 seq_printf(m, " %d", from_kgid_munged(user_ns, GROUP_AT(ug->gi, i)));
         seq_printf(m, "\n");
@@ -577,7 +576,7 @@ static struct cache_detail unix_gid_cache_template = {
         .hash_size      = GID_HASHMAX,
         .name           = "auth.unix.gid",
         .cache_put      = unix_gid_put,
-        .cache_upcall   = unix_gid_upcall,
+        .cache_request  = unix_gid_request,
         .cache_parse    = unix_gid_parse,
         .cache_show     = unix_gid_show,
         .match          = unix_gid_match,
@@ -615,20 +614,20 @@ void unix_gid_cache_destroy(struct net *net)
         cache_destroy_net(cd, net);
 }
 
-static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, uid_t uid)
+static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, kuid_t uid)
 {
         struct unix_gid ug;
         struct cache_head *ch;
 
         ug.uid = uid;
-        ch = sunrpc_cache_lookup(cd, &ug.h, hash_long(uid, GID_HASHBITS));
+        ch = sunrpc_cache_lookup(cd, &ug.h, unix_gid_hash(uid));
         if (ch)
                 return container_of(ch, struct unix_gid, h);
         else
                 return NULL;
 }
 
-static struct group_info *unix_gid_find(uid_t uid, struct svc_rqst *rqstp)
+static struct group_info *unix_gid_find(kuid_t uid, struct svc_rqst *rqstp)
 {
         struct unix_gid *ug;
         struct group_info *gi;
@@ -750,8 +749,8 @@ svcauth_null_accept(struct svc_rqst *rqstp, __be32 *authp)
         }
 
         /* Signal that mapping to nobody uid/gid is required */
-        cred->cr_uid = (uid_t) -1;
-        cred->cr_gid = (gid_t) -1;
+        cred->cr_uid = INVALID_UID;
+        cred->cr_gid = INVALID_GID;
         cred->cr_group_info = groups_alloc(0);
         if (cred->cr_group_info == NULL)
                 return SVC_CLOSE; /* kmalloc failure - client must retry */
@@ -812,8 +811,10 @@ svcauth_unix_accept(struct svc_rqst *rqstp, __be32 *authp)
         argv->iov_base = (void*)((__be32*)argv->iov_base + slen);       /* skip machname */
         argv->iov_len -= slen*4;
 
-        cred->cr_uid = svc_getnl(argv);         /* uid */
-        cred->cr_gid = svc_getnl(argv);         /* gid */
+        cred->cr_uid = make_kuid(&init_user_ns, svc_getnl(argv)); /* uid */
+        cred->cr_gid = make_kgid(&init_user_ns, svc_getnl(argv)); /* gid */
+        if (!uid_valid(cred->cr_uid) || !gid_valid(cred->cr_gid))
+                goto badcred;
         slen = svc_getnl(argv);                 /* gids length */
         if (slen > 16 || (len -= (slen + 2)*4) < 0)
                 goto badcred;
@@ -874,7 +875,7 @@ static struct cache_detail ip_map_cache_template = {
         .hash_size      = IP_HASHMAX,
         .name           = "auth.unix.ip",
         .cache_put      = ip_map_put,
-        .cache_upcall   = ip_map_upcall,
+        .cache_request  = ip_map_request,
         .cache_parse    = ip_map_parse,
         .cache_show     = ip_map_show,
         .match          = ip_map_match,
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 56055632f151..75edcfad6e26 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -879,6 +879,47 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
 }
 EXPORT_SYMBOL_GPL(xdr_buf_subsegment);
 
+/**
+ * xdr_buf_trim - lop at most "len" bytes off the end of "buf"
+ * @buf: buf to be trimmed
+ * @len: number of bytes to reduce "buf" by
+ *
+ * Trim an xdr_buf by the given number of bytes by fixing up the lengths. Note
+ * that it's possible that we'll trim less than that amount if the xdr_buf is
+ * too small, or if (for instance) it's all in the head and the parser has
+ * already read too far into it.
+ */
+void xdr_buf_trim(struct xdr_buf *buf, unsigned int len)
+{
+        size_t cur;
+        unsigned int trim = len;
+
+        if (buf->tail[0].iov_len) {
+                cur = min_t(size_t, buf->tail[0].iov_len, trim);
+                buf->tail[0].iov_len -= cur;
+                trim -= cur;
+                if (!trim)
+                        goto fix_len;
+        }
+
+        if (buf->page_len) {
+                cur = min_t(unsigned int, buf->page_len, trim);
+                buf->page_len -= cur;
+                trim -= cur;
+                if (!trim)
+                        goto fix_len;
+        }
+
+        if (buf->head[0].iov_len) {
+                cur = min_t(size_t, buf->head[0].iov_len, trim);
+                buf->head[0].iov_len -= cur;
+                trim -= cur;
+        }
+fix_len:
+        buf->len -= (len - trim);
+}
+EXPORT_SYMBOL_GPL(xdr_buf_trim);
+
 static void __read_bytes_from_xdr_buf(struct xdr_buf *subbuf, void *obj, unsigned int len)
 {
         unsigned int this_len;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 846c34fdee9f..b7478d5e7ffd 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -487,13 +487,17 @@ EXPORT_SYMBOL_GPL(xprt_wake_pending_tasks);
  * xprt_wait_for_buffer_space - wait for transport output buffer to clear
  * @task: task to be put to sleep
  * @action: function pointer to be executed after wait
+ *
+ * Note that we only set the timer for the case of RPC_IS_SOFT(), since
+ * we don't in general want to force a socket disconnection due to
+ * an incomplete RPC call transmission.
  */
 void xprt_wait_for_buffer_space(struct rpc_task *task, rpc_action action)
 {
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = req->rq_xprt;
 
-        task->tk_timeout = req->rq_timeout;
+        task->tk_timeout = RPC_IS_SOFT(task) ? req->rq_timeout : 0;
         rpc_sleep_on(&xprt->pending, task, action);
 }
 EXPORT_SYMBOL_GPL(xprt_wait_for_buffer_space);
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index d0074289708e..794312f22b9b 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -51,6 +51,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/seq_file.h>
+#include <linux/sunrpc/addr.h>
 
 #include "xprt_rdma.h"
 
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 745973b729af..93726560eaa8 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1086,7 +1086,7 @@ rpcrdma_buffer_create(struct rpcrdma_buffer *buf, struct rpcrdma_ep *ep,
         case RPCRDMA_MEMWINDOWS:
                 /* Allocate one extra request's worth, for full cycling */
                 for (i = (buf->rb_max_requests+1) * RPCRDMA_MAX_SEGS; i; i--) {
-                        r->r.mw = ib_alloc_mw(ia->ri_pd);
+                        r->r.mw = ib_alloc_mw(ia->ri_pd, IB_MW_TYPE_1);
                         if (IS_ERR(r->r.mw)) {
                                 rc = PTR_ERR(r->r.mw);
                                 dprintk("RPC:       %s: ib_alloc_mw"
@@ -1673,12 +1673,12 @@ rpcrdma_register_memwin_external(struct rpcrdma_mr_seg *seg,
 
         *nsegs = 1;
         rpcrdma_map_one(ia, seg, writing);
-        param.mr = ia->ri_bind_mem;
+        param.bind_info.mr = ia->ri_bind_mem;
         param.wr_id = 0ULL;     /* no send cookie */
-        param.addr = seg->mr_dma;
-        param.length = seg->mr_len;
+        param.bind_info.addr = seg->mr_dma;
+        param.bind_info.length = seg->mr_len;
         param.send_flags = 0;
-        param.mw_access_flags = mem_priv;
+        param.bind_info.mw_access_flags = mem_priv;
 
         DECR_CQCOUNT(&r_xprt->rx_ep);
         rc = ib_bind_mw(ia->ri_id->qp, seg->mr_chunk.rl_mw->r.mw, &param);
@@ -1690,7 +1690,7 @@ rpcrdma_register_memwin_external(struct rpcrdma_mr_seg *seg,
                 rpcrdma_unmap_one(ia, seg);
         } else {
                 seg->mr_rkey = seg->mr_chunk.rl_mw->r.mw->rkey;
-                seg->mr_base = param.addr;
+                seg->mr_base = param.bind_info.addr;
                 seg->mr_nsegs = 1;
         }
         return rc;
@@ -1706,10 +1706,10 @@ rpcrdma_deregister_memwin_external(struct rpcrdma_mr_seg *seg,
         int rc;
 
         BUG_ON(seg->mr_nsegs != 1);
-        param.mr = ia->ri_bind_mem;
-        param.addr = 0ULL;      /* unbind */
-        param.length = 0;
-        param.mw_access_flags = 0;
+        param.bind_info.mr = ia->ri_bind_mem;
+        param.bind_info.addr = 0ULL;    /* unbind */
+        param.bind_info.length = 0;
+        param.bind_info.mw_access_flags = 0;
         if (*r) {
                 param.wr_id = (u64) (unsigned long) *r;
                 param.send_flags = IB_SEND_SIGNALED;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 37cbda63f45c..c1d8476b7692 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -33,6 +33,7 @@
 #include <linux/udp.h>
 #include <linux/tcp.h>
 #include <linux/sunrpc/clnt.h>
+#include <linux/sunrpc/addr.h>
 #include <linux/sunrpc/sched.h>
 #include <linux/sunrpc/svcsock.h>
 #include <linux/sunrpc/xprtsock.h>
@@ -1867,13 +1868,9 @@ static int xs_local_finish_connecting(struct rpc_xprt *xprt,
  * @xprt: RPC transport to connect
  * @transport: socket transport to connect
  * @create_sock: function to create a socket of the correct type
- *
- * Invoked by a work queue tasklet.
  */
-static void xs_local_setup_socket(struct work_struct *work)
+static int xs_local_setup_socket(struct sock_xprt *transport)
 {
-        struct sock_xprt *transport =
-                container_of(work, struct sock_xprt, connect_worker.work);
         struct rpc_xprt *xprt = &transport->xprt;
         struct socket *sock;
         int status = -EIO;
@@ -1918,6 +1915,30 @@ out:
         xprt_clear_connecting(xprt);
         xprt_wake_pending_tasks(xprt, status);
         current->flags &= ~PF_FSTRANS;
+        return status;
+}
+
+static void xs_local_connect(struct rpc_xprt *xprt, struct rpc_task *task)
+{
+        struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+        int ret;
+
+         if (RPC_IS_ASYNC(task)) {
+                /*
+                 * We want the AF_LOCAL connect to be resolved in the
+                 * filesystem namespace of the process making the rpc
+                 * call.  Thus we connect synchronously.
+                 *
+                 * If we want to support asynchronous AF_LOCAL calls,
+                 * we'll need to figure out how to pass a namespace to
+                 * connect.
+                 */
+                rpc_exit(task, -ENOTCONN);
+                return;
+        }
+        ret = xs_local_setup_socket(transport);
+        if (ret && !RPC_IS_SOFTCONN(task))
+                msleep_interruptible(15000);
 }
 
 #ifdef CONFIG_SUNRPC_SWAP
@@ -2455,7 +2476,7 @@ static struct rpc_xprt_ops xs_local_ops = {
         .alloc_slot             = xprt_alloc_slot,
         .rpcbind                = xs_local_rpcbind,
         .set_port               = xs_local_set_port,
-        .connect                = xs_connect,
+        .connect                = xs_local_connect,
         .buf_alloc              = rpc_malloc,
         .buf_free               = rpc_free,
         .send_request           = xs_local_send_request,
@@ -2628,8 +2649,6 @@ static struct rpc_xprt *xs_setup_local(struct xprt_create *args)
                         goto out_err;
                 }
                 xprt_set_bound(xprt);
-                INIT_DELAYED_WORK(&transport->connect_worker,
-                                        xs_local_setup_socket);
                 xs_format_peer_addresses(xprt, "local", RPCBIND_NETID_LOCAL);
                 break;
         default:
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 46754779fd3d..24b167914311 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -473,11 +473,10 @@ static void tipc_nameseq_subscribe(struct name_seq *nseq,
 static struct name_seq *nametbl_find_seq(u32 type)
 {
         struct hlist_head *seq_head;
-        struct hlist_node *seq_node;
         struct name_seq *ns;
 
         seq_head = &table.types[hash(type)];
-        hlist_for_each_entry(ns, seq_node, seq_head, ns_list) {
+        hlist_for_each_entry(ns, seq_head, ns_list) {
                 if (ns->type == type)
                         return ns;
         }
@@ -853,7 +852,6 @@ static int nametbl_list(char *buf, int len, u32 depth_info,
                          u32 type, u32 lowbound, u32 upbound)
 {
         struct hlist_head *seq_head;
-        struct hlist_node *seq_node;
         struct name_seq *seq;
         int all_types;
         int ret = 0;
@@ -873,7 +871,7 @@ static int nametbl_list(char *buf, int len, u32 depth_info,
                 upbound = ~0;
                 for (i = 0; i < TIPC_NAMETBL_SIZE; i++) {
                         seq_head = &table.types[i];
-                        hlist_for_each_entry(seq, seq_node, seq_head, ns_list) {
+                        hlist_for_each_entry(seq, seq_head, ns_list) {
                                 ret += nameseq_list(seq, buf + ret, len - ret,
                                                    depth, seq->type,
                                                    lowbound, upbound, i);
@@ -889,7 +887,7 @@ static int nametbl_list(char *buf, int len, u32 depth_info,
                 ret += nametbl_header(buf + ret, len - ret, depth);
                 i = hash(type);
                 seq_head = &table.types[i];
-                hlist_for_each_entry(seq, seq_node, seq_head, ns_list) {
+                hlist_for_each_entry(seq, seq_head, ns_list) {
                         if (seq->type == type) {
                                 ret += nameseq_list(seq, buf + ret, len - ret,
                                                    depth, type,
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 48f39dd3eae8..6e6c434872e8 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -69,12 +69,11 @@ static unsigned int tipc_hashfn(u32 addr)
 struct tipc_node *tipc_node_find(u32 addr)
 {
         struct tipc_node *node;
-        struct hlist_node *pos;
 
         if (unlikely(!in_own_cluster_exact(addr)))
                 return NULL;
 
-        hlist_for_each_entry(node, pos, &node_htable[tipc_hashfn(addr)], hash) {
+        hlist_for_each_entry(node, &node_htable[tipc_hashfn(addr)], hash) {
                 if (node->addr == addr)
                         return node;
         }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 87d284289012..51be64f163ec 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -263,9 +263,8 @@ static struct sock *__unix_find_socket_byname(struct net *net,
                                               int len, int type, unsigned int hash)
 {
         struct sock *s;
-        struct hlist_node *node;
 
-        sk_for_each(s, node, &unix_socket_table[hash ^ type]) {
+        sk_for_each(s, &unix_socket_table[hash ^ type]) {
                 struct unix_sock *u = unix_sk(s);
 
                 if (!net_eq(sock_net(s), net))
@@ -298,10 +297,9 @@ static inline struct sock *unix_find_socket_byname(struct net *net,
 static struct sock *unix_find_socket_byinode(struct inode *i)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock(&unix_table_lock);
-        sk_for_each(s, node,
+        sk_for_each(s,
                     &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {
                 struct dentry *dentry = unix_sk(s)->path.dentry;
 
diff --git a/net/unix/diag.c b/net/unix/diag.c
index 5ac19dc1d5e4..d591091603bf 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -192,10 +192,9 @@ static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
              slot < ARRAY_SIZE(unix_socket_table);
              s_num = 0, slot++) {
                 struct sock *sk;
-                struct hlist_node *node;
 
                 num = 0;
-                sk_for_each(sk, node, &unix_socket_table[slot]) {
+                sk_for_each(sk, &unix_socket_table[slot]) {
                         if (!net_eq(sock_net(sk), net))
                                 continue;
                         if (num < s_num)
@@ -226,9 +225,7 @@ static struct sock *unix_lookup_by_ino(int ino)
 
         spin_lock(&unix_table_lock);
         for (i = 0; i < ARRAY_SIZE(unix_socket_table); i++) {
-                struct hlist_node *node;
-
-                sk_for_each(sk, node, &unix_socket_table[i])
+                sk_for_each(sk, &unix_socket_table[i])
                         if (ino == sock_i_ino(sk)) {
                                 sock_hold(sk);
                                 spin_unlock(&unix_table_lock);
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index b6f4b994eb35..d0f6545b0010 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -99,7 +99,7 @@ unsigned int unix_tot_inflight;
 struct sock *unix_get_socket(struct file *filp)
 {
         struct sock *u_sock = NULL;
-        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(filp);
 
         /*
          *      Socket ?
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index a306bc66000e..37ca9694aabe 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -208,11 +208,10 @@ static void x25_remove_socket(struct sock *sk)
 static void x25_kill_by_device(struct net_device *dev)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         write_lock_bh(&x25_list_lock);
 
-        sk_for_each(s, node, &x25_list)
+        sk_for_each(s, &x25_list)
                 if (x25_sk(s)->neighbour && x25_sk(s)->neighbour->dev == dev)
                         x25_disconnect(s, ENETUNREACH, 0, 0);
 
@@ -280,12 +279,11 @@ static struct sock *x25_find_listener(struct x25_address *addr,
 {
         struct sock *s;
         struct sock *next_best;
-        struct hlist_node *node;
 
         read_lock_bh(&x25_list_lock);
         next_best = NULL;
 
-        sk_for_each(s, node, &x25_list)
+        sk_for_each(s, &x25_list)
                 if ((!strcmp(addr->x25_addr,
                         x25_sk(s)->source_addr.x25_addr) ||
                                 !strcmp(addr->x25_addr,
@@ -323,9 +321,8 @@ found:
 static struct sock *__x25_find_socket(unsigned int lci, struct x25_neigh *nb)
 {
         struct sock *s;
-        struct hlist_node *node;
 
-        sk_for_each(s, node, &x25_list)
+        sk_for_each(s, &x25_list)
                 if (x25_sk(s)->lci == lci && x25_sk(s)->neighbour == nb) {
                         sock_hold(s);
                         goto found;
@@ -1782,11 +1779,10 @@ static struct notifier_block x25_dev_notifier = {
 void x25_kill_by_neigh(struct x25_neigh *nb)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         write_lock_bh(&x25_list_lock);
 
-        sk_for_each(s, node, &x25_list)
+        sk_for_each(s, &x25_list)
                 if (x25_sk(s)->neighbour == nb)
                         x25_disconnect(s, ENETUNREACH, 0, 0);
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 5b47180986f8..167c67d46c6a 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -379,27 +379,27 @@ static void xfrm_dst_hash_transfer(struct hlist_head *list,
                                    struct hlist_head *ndsttable,
                                    unsigned int nhashmask)
 {
-        struct hlist_node *entry, *tmp, *entry0 = NULL;
+        struct hlist_node *tmp, *entry0 = NULL;
         struct xfrm_policy *pol;
         unsigned int h0 = 0;
 
 redo:
-        hlist_for_each_entry_safe(pol, entry, tmp, list, bydst) {
+        hlist_for_each_entry_safe(pol, tmp, list, bydst) {
                 unsigned int h;
 
                 h = __addr_hash(&pol->selector.daddr, &pol->selector.saddr,
                                 pol->family, nhashmask);
                 if (!entry0) {
-                        hlist_del(entry);
+                        hlist_del(&pol->bydst);
                         hlist_add_head(&pol->bydst, ndsttable+h);
                         h0 = h;
                 } else {
                         if (h != h0)
                                 continue;
-                        hlist_del(entry);
+                        hlist_del(&pol->bydst);
                         hlist_add_after(entry0, &pol->bydst);
                 }
-                entry0 = entry;
+                entry0 = &pol->bydst;
         }
         if (!hlist_empty(list)) {
                 entry0 = NULL;
@@ -411,10 +411,10 @@ static void xfrm_idx_hash_transfer(struct hlist_head *list,
                                    struct hlist_head *nidxtable,
                                    unsigned int nhashmask)
 {
-        struct hlist_node *entry, *tmp;
+        struct hlist_node *tmp;
         struct xfrm_policy *pol;
 
-        hlist_for_each_entry_safe(pol, entry, tmp, list, byidx) {
+        hlist_for_each_entry_safe(pol, tmp, list, byidx) {
                 unsigned int h;
 
                 h = __idx_hash(pol->index, nhashmask);
@@ -544,7 +544,6 @@ static u32 xfrm_gen_index(struct net *net, int dir)
         static u32 idx_generator;
 
         for (;;) {
-                struct hlist_node *entry;
                 struct hlist_head *list;
                 struct xfrm_policy *p;
                 u32 idx;
@@ -556,7 +555,7 @@ static u32 xfrm_gen_index(struct net *net, int dir)
                         idx = 8;
                 list = net->xfrm.policy_byidx + idx_hash(net, idx);
                 found = 0;
-                hlist_for_each_entry(p, entry, list, byidx) {
+                hlist_for_each_entry(p, list, byidx) {
                         if (p->index == idx) {
                                 found = 1;
                                 break;
@@ -628,13 +627,13 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         struct xfrm_policy *pol;
         struct xfrm_policy *delpol;
         struct hlist_head *chain;
-        struct hlist_node *entry, *newpos;
+        struct hlist_node *newpos;
 
         write_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_bysel(net, &policy->selector, policy->family, dir);
         delpol = NULL;
         newpos = NULL;
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 if (pol->type == policy->type &&
                     !selector_cmp(&pol->selector, &policy->selector) &&
                     xfrm_policy_mark_match(policy, pol) &&
@@ -691,13 +690,12 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type,
 {
         struct xfrm_policy *pol, *ret;
         struct hlist_head *chain;
-        struct hlist_node *entry;
 
         *err = 0;
         write_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_bysel(net, sel, sel->family, dir);
         ret = NULL;
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 if (pol->type == type &&
                     (mark & pol->mark.m) == pol->mark.v &&
                     !selector_cmp(sel, &pol->selector) &&
@@ -729,7 +727,6 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
 {
         struct xfrm_policy *pol, *ret;
         struct hlist_head *chain;
-        struct hlist_node *entry;
 
         *err = -ENOENT;
         if (xfrm_policy_id2dir(id) != dir)
@@ -739,7 +736,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
         write_lock_bh(&xfrm_policy_lock);
         chain = net->xfrm.policy_byidx + idx_hash(net, id);
         ret = NULL;
-        hlist_for_each_entry(pol, entry, chain, byidx) {
+        hlist_for_each_entry(pol, chain, byidx) {
                 if (pol->type == type && pol->index == id &&
                     (mark & pol->mark.m) == pol->mark.v) {
                         xfrm_pol_hold(pol);
@@ -772,10 +769,9 @@ xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audi
 
         for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
                 struct xfrm_policy *pol;
-                struct hlist_node *entry;
                 int i;
 
-                hlist_for_each_entry(pol, entry,
+                hlist_for_each_entry(pol,
                                      &net->xfrm.policy_inexact[dir], bydst) {
                         if (pol->type != type)
                                 continue;
@@ -789,7 +785,7 @@ xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audi
                         }
                 }
                 for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) {
-                        hlist_for_each_entry(pol, entry,
+                        hlist_for_each_entry(pol,
                                              net->xfrm.policy_bydst[dir].table + i,
                                              bydst) {
                                 if (pol->type != type)
@@ -828,11 +824,10 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
 
         for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
                 struct xfrm_policy *pol;
-                struct hlist_node *entry;
                 int i;
 
         again1:
-                hlist_for_each_entry(pol, entry,
+                hlist_for_each_entry(pol,
                                      &net->xfrm.policy_inexact[dir], bydst) {
                         if (pol->type != type)
                                 continue;
@@ -852,7 +847,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
 
                 for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) {
         again2:
-                        hlist_for_each_entry(pol, entry,
+                        hlist_for_each_entry(pol,
                                              net->xfrm.policy_bydst[dir].table + i,
                                              bydst) {
                                 if (pol->type != type)
@@ -980,7 +975,6 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
         int err;
         struct xfrm_policy *pol, *ret;
         const xfrm_address_t *daddr, *saddr;
-        struct hlist_node *entry;
         struct hlist_head *chain;
         u32 priority = ~0U;
 
@@ -992,7 +986,7 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
         read_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_direct(net, daddr, saddr, family, dir);
         ret = NULL;
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 err = xfrm_policy_match(pol, fl, type, family, dir);
                 if (err) {
                         if (err == -ESRCH)
@@ -1008,7 +1002,7 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
                 }
         }
         chain = &net->xfrm.policy_inexact[dir];
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 err = xfrm_policy_match(pol, fl, type, family, dir);
                 if (err) {
                         if (err == -ESRCH)
@@ -3041,13 +3035,12 @@ static struct xfrm_policy * xfrm_migrate_policy_find(const struct xfrm_selector
                                                      u8 dir, u8 type)
 {
         struct xfrm_policy *pol, *ret = NULL;
-        struct hlist_node *entry;
         struct hlist_head *chain;
         u32 priority = ~0U;
 
         read_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_direct(&init_net, &sel->daddr, &sel->saddr, sel->family, dir);
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 if (xfrm_migrate_selector_match(sel, &pol->selector) &&
                     pol->type == type) {
                         ret = pol;
@@ -3056,7 +3049,7 @@ static struct xfrm_policy * xfrm_migrate_policy_find(const struct xfrm_selector
                 }
         }
         chain = &init_net.xfrm.policy_inexact[dir];
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 if (xfrm_migrate_selector_match(sel, &pol->selector) &&
                     pol->type == type &&
                     pol->priority < priority) {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index ae01bdbcb294..2c341bdaf47c 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -72,10 +72,10 @@ static void xfrm_hash_transfer(struct hlist_head *list,
                                struct hlist_head *nspitable,
                                unsigned int nhashmask)
 {
-        struct hlist_node *entry, *tmp;
+        struct hlist_node *tmp;
         struct xfrm_state *x;
 
-        hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
+        hlist_for_each_entry_safe(x, tmp, list, bydst) {
                 unsigned int h;
 
                 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
@@ -368,14 +368,14 @@ static void xfrm_state_gc_task(struct work_struct *work)
 {
         struct net *net = container_of(work, struct net, xfrm.state_gc_work);
         struct xfrm_state *x;
-        struct hlist_node *entry, *tmp;
+        struct hlist_node *tmp;
         struct hlist_head gc_list;
 
         spin_lock_bh(&xfrm_state_gc_lock);
         hlist_move_list(&net->xfrm.state_gc_list, &gc_list);
         spin_unlock_bh(&xfrm_state_gc_lock);
 
-        hlist_for_each_entry_safe(x, entry, tmp, &gc_list, gclist)
+        hlist_for_each_entry_safe(x, tmp, &gc_list, gclist)
                 xfrm_state_gc_destroy(x);
 
         wake_up(&net->xfrm.km_waitq);
@@ -577,10 +577,9 @@ xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audi
         int i, err = 0;
 
         for (i = 0; i <= net->xfrm.state_hmask; i++) {
-                struct hlist_node *entry;
                 struct xfrm_state *x;
 
-                hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
+                hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
                         if (xfrm_id_proto_match(x->id.proto, proto) &&
                            (err = security_xfrm_state_delete(x)) != 0) {
                                 xfrm_audit_state_delete(x, 0,
@@ -613,10 +612,9 @@ int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info)
 
         err = -ESRCH;
         for (i = 0; i <= net->xfrm.state_hmask; i++) {
-                struct hlist_node *entry;
                 struct xfrm_state *x;
 restart:
-                hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
+                hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
                         if (!xfrm_state_kern(x) &&
                             xfrm_id_proto_match(x->id.proto, proto)) {
                                 xfrm_state_hold(x);
@@ -685,9 +683,8 @@ static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark,
 {
         unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
         struct xfrm_state *x;
-        struct hlist_node *entry;
 
-        hlist_for_each_entry(x, entry, net->xfrm.state_byspi+h, byspi) {
+        hlist_for_each_entry(x, net->xfrm.state_byspi+h, byspi) {
                 if (x->props.family != family ||
                     x->id.spi       != spi ||
                     x->id.proto     != proto ||
@@ -710,9 +707,8 @@ static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark,
 {
         unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
         struct xfrm_state *x;
-        struct hlist_node *entry;
 
-        hlist_for_each_entry(x, entry, net->xfrm.state_bysrc+h, bysrc) {
+        hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) {
                 if (x->props.family != family ||
                     x->id.proto     != proto ||
                     !xfrm_addr_equal(&x->id.daddr, daddr, family) ||
@@ -798,7 +794,6 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
         static xfrm_address_t saddr_wildcard = { };
         struct net *net = xp_net(pol);
         unsigned int h, h_wildcard;
-        struct hlist_node *entry;
         struct xfrm_state *x, *x0, *to_put;
         int acquire_in_progress = 0;
         int error = 0;
@@ -810,7 +805,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
 
         spin_lock_bh(&xfrm_state_lock);
         h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
-        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
+        hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.family == encap_family &&
                     x->props.reqid == tmpl->reqid &&
                     (mark & x->mark.m) == x->mark.v &&
@@ -826,7 +821,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
                 goto found;
 
         h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family);
-        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) {
+        hlist_for_each_entry(x, net->xfrm.state_bydst+h_wildcard, bydst) {
                 if (x->props.family == encap_family &&
                     x->props.reqid == tmpl->reqid &&
                     (mark & x->mark.m) == x->mark.v &&
@@ -906,11 +901,10 @@ xfrm_stateonly_find(struct net *net, u32 mark,
 {
         unsigned int h;
         struct xfrm_state *rx = NULL, *x = NULL;
-        struct hlist_node *entry;
 
         spin_lock(&xfrm_state_lock);
         h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
-        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
+        hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.family == family &&
                     x->props.reqid == reqid &&
                     (mark & x->mark.m) == x->mark.v &&
@@ -972,12 +966,11 @@ static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
         unsigned short family = xnew->props.family;
         u32 reqid = xnew->props.reqid;
         struct xfrm_state *x;
-        struct hlist_node *entry;
         unsigned int h;
         u32 mark = xnew->mark.v & xnew->mark.m;
 
         h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
-        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
+        hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.family     == family &&
                     x->props.reqid      == reqid &&
                     (mark & x->mark.m) == x->mark.v &&
@@ -1004,11 +997,10 @@ static struct xfrm_state *__find_acq_core(struct net *net, struct xfrm_mark *m,
                                           const xfrm_address_t *saddr, int create)
 {
         unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
-        struct hlist_node *entry;
         struct xfrm_state *x;
         u32 mark = m->v & m->m;
 
-        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
+        hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.reqid  != reqid ||
                     x->props.mode   != mode ||
                     x->props.family != family ||
@@ -1215,12 +1207,11 @@ struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
 {
         unsigned int h;
         struct xfrm_state *x;
-        struct hlist_node *entry;
 
         if (m->reqid) {
                 h = xfrm_dst_hash(&init_net, &m->old_daddr, &m->old_saddr,
                                   m->reqid, m->old_family);
-                hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) {
+                hlist_for_each_entry(x, init_net.xfrm.state_bydst+h, bydst) {
                         if (x->props.mode != m->mode ||
                             x->id.proto != m->proto)
                                 continue;
@@ -1237,7 +1228,7 @@ struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
         } else {
                 h = xfrm_src_hash(&init_net, &m->old_daddr, &m->old_saddr,
                                   m->old_family);
-                hlist_for_each_entry(x, entry, init_net.xfrm.state_bysrc+h, bysrc) {
+                hlist_for_each_entry(x, init_net.xfrm.state_bysrc+h, bysrc) {
                         if (x->props.mode != m->mode ||
                             x->id.proto != m->proto)
                                 continue;
@@ -1466,10 +1457,9 @@ static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 s
         int i;
 
         for (i = 0; i <= net->xfrm.state_hmask; i++) {
-                struct hlist_node *entry;
                 struct xfrm_state *x;
 
-                hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
+                hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
                         if (x->km.seq == seq &&
                             (mark & x->mark.m) == x->mark.v &&
                             x->km.state == XFRM_STATE_ACQ) {