Merge branch 'akpm' (final batch from Andrew)

Merge third patch-bumb from Andrew Morton:
 "This wraps me up for -rc1.
   - Lots of misc stuff and things which were deferred/missed from
     patchbombings 1 & 2.
   - ocfs2 things
   - lib/scatterlist
   - hfsplus
   - fatfs
   - documentation
   - signals
   - procfs
   - lockdep
   - coredump
   - seqfile core
   - kexec
   - Tejun's large IDR tree reworkings
   - ipmi
   - partitions
   - nbd
   - random() things
   - kfifo
   - tools/testing/selftests updates
   - Sasha's large and pointless hlist cleanup"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (163 commits)
  hlist: drop the node parameter from iterators
  kcmp: make it depend on CHECKPOINT_RESTORE
  selftests: add a simple doc
  tools/testing/selftests/Makefile: rearrange targets
  selftests/efivarfs: add create-read test
  selftests/efivarfs: add empty file creation test
  selftests: add tests for efivarfs
  kfifo: fix kfifo_alloc() and kfifo_init()
  kfifo: move kfifo.c from kernel/ to lib/
  arch Kconfig: centralise CONFIG_ARCH_NO_VIRT_TO_BUS
  w1: add support for DS2413 Dual Channel Addressable Switch
  memstick: move the dereference below the NULL test
  drivers/pps/clients/pps-gpio.c: use devm_kzalloc
  Documentation/DMA-API-HOWTO.txt: fix typo
  include/linux/eventfd.h: fix incorrect filename is a comment
  mtd: mtd_stresstest: use prandom_bytes()
  mtd: mtd_subpagetest: convert to use prandom library
  mtd: mtd_speedtest: use prandom_bytes
  mtd: mtd_pagetest: convert to use prandom library
  mtd: mtd_oobtest: convert to use prandom library
  ...

429 files changed, 5226 insertions, 3493 deletions

diff --git a/Documentation/DMA-API-HOWTO.txt b/Documentation/DMA-API-HOWTO.txt
index 4a4fb295ceef..14129f149a75 100644
--- a/Documentation/DMA-API-HOWTO.txt
+++ b/Documentation/DMA-API-HOWTO.txt
@@ -488,9 +488,10 @@ will invoke the generic mapping error check interface. Doing so will ensure
 that the mapping code will work correctly on all dma implementations without
 any dependency on the specifics of the underlying implementation. Using the
 returned address without checking for errors could result in failures ranging
-from panics to silent data corruption. Couple of example of incorrect ways to
-check for errors that make assumptions about the underlying dma implementation
-are as follows and these are applicable to dma_map_page() as well.
+from panics to silent data corruption. A couple of examples of incorrect ways
+to check for errors that make assumptions about the underlying dma
+implementation are as follows and these are applicable to dma_map_page() as
+well.
 
 Incorrect example 1:
         dma_addr_t dma_handle;
@@ -751,7 +752,7 @@ Example 1:
                 dma_unmap_single(dma_handle1);
         map_error_handling1:
 
-Example 2: (if buffers are allocated a loop, unmap all mapped buffers when
+Example 2: (if buffers are allocated in a loop, unmap all mapped buffers when
             mapping error is detected in the middle)
 
         dma_addr_t dma_addr;
diff --git a/Documentation/IPMI.txt b/Documentation/IPMI.txt
index 16eb4c9e9233..f13c9132e9f2 100644
--- a/Documentation/IPMI.txt
+++ b/Documentation/IPMI.txt
@@ -348,34 +348,40 @@ You can change this at module load time (for a module) with:
 
   modprobe ipmi_si.o type=<type1>,<type2>....
        ports=<port1>,<port2>... addrs=<addr1>,<addr2>...
-       irqs=<irq1>,<irq2>... trydefaults=[0|1]
+       irqs=<irq1>,<irq2>...
        regspacings=<sp1>,<sp2>,... regsizes=<size1>,<size2>,...
        regshifts=<shift1>,<shift2>,...
        slave_addrs=<addr1>,<addr2>,...
        force_kipmid=<enable1>,<enable2>,...
        kipmid_max_busy_us=<ustime1>,<ustime2>,...
        unload_when_empty=[0|1]
+       trydefaults=[0|1] trydmi=[0|1] tryacpi=[0|1]
+       tryplatform=[0|1] trypci=[0|1]
 
-Each of these except si_trydefaults is a list, the first item for the
+Each of these except try... items is a list, the first item for the
 first interface, second item for the second interface, etc.
 
 The si_type may be either "kcs", "smic", or "bt".  If you leave it blank, it
 defaults to "kcs".
 
-If you specify si_addrs as non-zero for an interface, the driver will
+If you specify addrs as non-zero for an interface, the driver will
 use the memory address given as the address of the device.  This
 overrides si_ports.
 
-If you specify si_ports as non-zero for an interface, the driver will
+If you specify ports as non-zero for an interface, the driver will
 use the I/O port given as the device address.
 
-If you specify si_irqs as non-zero for an interface, the driver will
+If you specify irqs as non-zero for an interface, the driver will
 attempt to use the given interrupt for the device.
 
-si_trydefaults sets whether the standard IPMI interface at 0xca2 and
+trydefaults sets whether the standard IPMI interface at 0xca2 and
 any interfaces specified by ACPE are tried.  By default, the driver
 tries it, set this value to zero to turn this off.
 
+The other try... items disable discovery by their corresponding
+names.  These are all enabled by default, set them to zero to disable
+them.  The tryplatform disables openfirmware.
+
 The next three parameters have to do with register layout.  The
 registers used by the interfaces may not appear at successive
 locations and they may not be in 8-bit registers.  These parameters
diff --git a/Documentation/blockdev/nbd.txt b/Documentation/blockdev/nbd.txt
index aeb93ffe6416..271e607304da 100644
--- a/Documentation/blockdev/nbd.txt
+++ b/Documentation/blockdev/nbd.txt
@@ -4,43 +4,13 @@
    can use a remote server as one of its block devices. So every time
    the client computer wants to read, e.g., /dev/nb0, it sends a
    request over TCP to the server, which will reply with the data read.
-   This can be used for stations with low disk space (or even diskless -
-   if you boot from floppy) to borrow disk space from another computer.
-   Unlike NFS, it is possible to put any filesystem on it, etc. It should
-   even be possible to use NBD as a root filesystem (I've never tried),
-   but it requires a user-level program to be in the initrd to start.
-   It also allows you to run block-device in user land (making server
-   and client physically the same computer, communicating using loopback).
-   
-   Current state: It currently works. Network block device is stable.
-   I originally thought that it was impossible to swap over TCP. It
-   turned out not to be true - swapping over TCP now works and seems
-   to be deadlock-free, but it requires heavy patches into Linux's
-   network layer.
-   
+   This can be used for stations with low disk space (or even diskless)
+   to borrow disk space from another computer.
+   Unlike NFS, it is possible to put any filesystem on it, etc.
+
    For more information, or to download the nbd-client and nbd-server
    tools, go to http://nbd.sf.net/.
 
-   Howto: To setup nbd, you can simply do the following:
-
-   First, serve a device or file from a remote server:
-
-   nbd-server <port-number> <device-or-file-to-serve-to-client>
-
-   e.g.,
-        root@server1 # nbd-server 1234 /dev/sdb1
-
-        (serves sdb1 partition on TCP port 1234)
-
-   Then, on the local (client) system:
-
-   nbd-client <server-name-or-IP> <server-port-number> /dev/nb[0-n]
-
-   e.g.,
-        root@client1 # nbd-client server1 1234 /dev/nb0
-
-        (creates the nb0 device on client1)
-
    The nbd kernel module need only be installed on the client
    system, as the nbd-server is completely in userspace. In fact,
    the nbd-server has been successfully ported to other operating
diff --git a/Documentation/cgroups/blkio-controller.txt b/Documentation/cgroups/blkio-controller.txt
index b4b1fb3a83f0..a794ce91a2d5 100644
--- a/Documentation/cgroups/blkio-controller.txt
+++ b/Documentation/cgroups/blkio-controller.txt
@@ -75,7 +75,7 @@ Throttling/Upper Limit policy
         mount -t cgroup -o blkio none /sys/fs/cgroup/blkio
 
 - Specify a bandwidth rate on particular device for root group. The format
-  for policy is "<major>:<minor>  <byes_per_second>".
+  for policy is "<major>:<minor>  <bytes_per_second>".
 
         echo "8:16  1048576" > /sys/fs/cgroup/blkio/blkio.throttle.read_bps_device
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 1e5c3a4ece7b..0b4bb157a482 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -97,12 +97,13 @@ Descriptions of section entries:
            X:   net/ipv6/
            matches all files in and below net excluding net/ipv6/
         K: Keyword perl extended regex pattern to match content in a
-           patch or file.  For instance:
+           patch or file, or an affected filename.  For instance:
            K: of_get_profile
-              matches patches or files that contain "of_get_profile"
+              matches patch or file content, or filenames, that contain
+              "of_get_profile"
            K: \b(printk|pr_(info|err))\b
-              matches patches or files that contain one or more of the words
-              printk, pr_info or pr_err
+              matches patch or file content, or filenames, that contain one or
+              more of the words printk, pr_info or pr_err
            One regex pattern per line.  Multiple K: lines acceptable.
 
 Note: For the hard of thinking, this list is meant to remain in alphabetical
@@ -5437,6 +5438,7 @@ F:	net/netrom/
 NETWORK BLOCK DEVICE (NBD)
 M:      Paul Clements <Paul.Clements@steeleye.com>
 S:      Maintained
+L:      nbd-general@lists.sourceforge.net
 F:      Documentation/blockdev/nbd.txt
 F:      drivers/block/nbd.c
 F:      include/linux/nbd.h
@@ -7539,6 +7541,7 @@ STAGING - NVIDIA COMPLIANT EMBEDDED CONTROLLER INTERFACE (nvec)
 M:      Julian Andres Klode <jak@jak-linux.org>
 M:      Marc Dietrich <marvin24@gmx.de>
 L:      ac100@lists.launchpad.net (moderated for non-subscribers)
+L:      linux-tegra@vger.kernel.org
 S:      Maintained
 F:      drivers/staging/nvec/
 
@@ -7831,9 +7834,7 @@ L:	linux-tegra@vger.kernel.org
 Q:      http://patchwork.ozlabs.org/project/linux-tegra/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-tegra.git
 S:      Supported
-F:      arch/arm/mach-tegra
-F:      arch/arm/boot/dts/tegra*
-F:      arch/arm/configs/tegra_defconfig
+K:      (?i)[^a-z]tegra
 
 TEHUTI ETHERNET DRIVER
 M:      Andy Gospodarek <andy@greyhouse.net>
diff --git a/arch/Kconfig b/arch/Kconfig
index 40e2b12c7916..dcd91a85536a 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -303,6 +303,13 @@ config ARCH_WANT_OLD_COMPAT_IPC
         select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
         bool
 
+config HAVE_VIRT_TO_BUS
+        bool
+        help
+          An architecture should select this if it implements the
+          deprecated interface virt_to_bus().  All new architectures
+          should probably not select this.
+
 config HAVE_ARCH_SECCOMP_FILTER
         bool
         help
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 1ecbf7a1b677..5833aa441481 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -9,6 +9,7 @@ config ALPHA
         select HAVE_PERF_EVENTS
         select HAVE_DMA_ATTRS
         select HAVE_GENERIC_HARDIRQS
+        select HAVE_VIRT_TO_BUS
         select GENERIC_IRQ_PROBE
         select AUTO_IRQ_AFFINITY if SMP
         select GENERIC_IRQ_SHOW
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 6ec8eb3149ea..0e16cca1d011 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -49,6 +49,7 @@ config ARM
         select HAVE_REGS_AND_STACK_ACCESS_API
         select HAVE_SYSCALL_TRACEPOINTS
         select HAVE_UID16
+        select HAVE_VIRT_TO_BUS
         select KTIME_SCALAR
         select PERF_USE_VMALLOC
         select RTC_LIB
diff --git a/arch/arm/kernel/kprobes.c b/arch/arm/kernel/kprobes.c
index 4dd41fc9e235..170e9f34003f 100644
--- a/arch/arm/kernel/kprobes.c
+++ b/arch/arm/kernel/kprobes.c
@@ -395,7 +395,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
 
@@ -415,7 +415,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -442,7 +442,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
         kretprobe_assert(ri, orig_ret_address, trampoline_address);
         kretprobe_hash_unlock(current, &flags);
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/avr32/Kconfig b/arch/avr32/Kconfig
index 2ae6591b3a55..9b89257b2cfd 100644
--- a/arch/avr32/Kconfig
+++ b/arch/avr32/Kconfig
@@ -7,6 +7,7 @@ config AVR32
         select HAVE_OPROFILE
         select HAVE_KPROBES
         select HAVE_GENERIC_HARDIRQS
+        select HAVE_VIRT_TO_BUS
         select GENERIC_IRQ_PROBE
         select GENERIC_ATOMIC64
         select HARDIRQS_SW_RESEND
diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig
index e98f3248c8aa..600494c70e96 100644
--- a/arch/blackfin/Kconfig
+++ b/arch/blackfin/Kconfig
@@ -33,6 +33,7 @@ config BLACKFIN
         select ARCH_HAVE_CUSTOM_GPIO_H
         select ARCH_WANT_OPTIONAL_GPIOLIB
         select HAVE_UID16
+        select HAVE_VIRT_TO_BUS
         select ARCH_WANT_IPC_PARSE_VERSION
         select HAVE_GENERIC_HARDIRQS
         select GENERIC_ATOMIC64
diff --git a/arch/cris/Kconfig b/arch/cris/Kconfig
index 0e5c187ac7d2..bb0ac66cf533 100644
--- a/arch/cris/Kconfig
+++ b/arch/cris/Kconfig
@@ -43,6 +43,7 @@ config CRIS
         select GENERIC_ATOMIC64
         select HAVE_GENERIC_HARDIRQS
         select HAVE_UID16
+        select HAVE_VIRT_TO_BUS
         select ARCH_WANT_IPC_PARSE_VERSION
         select GENERIC_IRQ_SHOW
         select GENERIC_IOMAP
diff --git a/arch/frv/Kconfig b/arch/frv/Kconfig
index 2d0509d4cfee..12369b194c7b 100644
--- a/arch/frv/Kconfig
+++ b/arch/frv/Kconfig
@@ -6,6 +6,7 @@ config FRV
         select HAVE_PERF_EVENTS
         select HAVE_UID16
         select HAVE_GENERIC_HARDIRQS
+        select HAVE_VIRT_TO_BUS
         select GENERIC_IRQ_SHOW
         select HAVE_DEBUG_BUGVERBOSE
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
index 385fd30b142f..836f14707a62 100644
--- a/arch/frv/mm/elf-fdpic.c
+++ b/arch/frv/mm/elf-fdpic.c
@@ -60,7 +60,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
                                      unsigned long pgoff, unsigned long flags)
 {
         struct vm_area_struct *vma;
-        unsigned long limit;
+        struct vm_unmapped_area_info info;
 
         if (len > TASK_SIZE)
                 return -ENOMEM;
@@ -79,39 +79,24 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
         }
 
         /* search between the bottom of user VM and the stack grow area */
-        addr = PAGE_SIZE;
-        limit = (current->mm->start_stack - 0x00200000);
-        if (addr + len <= limit) {
-                limit -= len;
-
-                if (addr <= limit) {
-                        vma = find_vma(current->mm, PAGE_SIZE);
-                        for (; vma; vma = vma->vm_next) {
-                                if (addr > limit)
-                                        break;
-                                if (addr + len <= vma->vm_start)
-                                        goto success;
-                                addr = vma->vm_end;
-                        }
-                }
-        }
+        info.flags = 0;
+        info.length = len;
+        info.low_limit = PAGE_SIZE;
+        info.high_limit = (current->mm->start_stack - 0x00200000);
+        info.align_mask = 0;
+        info.align_offset = 0;
+        addr = vm_unmapped_area(&info);
+        if (!(addr & ~PAGE_MASK))
+                goto success;
+        VM_BUG_ON(addr != -ENOMEM);
 
         /* search from just above the WorkRAM area to the top of memory */
-        addr = PAGE_ALIGN(0x80000000);
-        limit = TASK_SIZE - len;
-        if (addr <= limit) {
-                vma = find_vma(current->mm, addr);
-                for (; vma; vma = vma->vm_next) {
-                        if (addr > limit)
-                                break;
-                        if (addr + len <= vma->vm_start)
-                                goto success;
-                        addr = vma->vm_end;
-                }
-
-                if (!vma && addr <= limit)
-                        goto success;
-        }
+        info.low_limit = PAGE_ALIGN(0x80000000);
+        info.high_limit = TASK_SIZE;
+        addr = vm_unmapped_area(&info);
+        if (!(addr & ~PAGE_MASK))
+                goto success;
+        VM_BUG_ON(addr != -ENOMEM);
 
 #if 0
         printk("[area] l=%lx (ENOMEM) f='%s'\n",
diff --git a/arch/h8300/Kconfig b/arch/h8300/Kconfig
index 05b613af223a..ae8551eb3736 100644
--- a/arch/h8300/Kconfig
+++ b/arch/h8300/Kconfig
@@ -5,6 +5,7 @@ config H8300
         select HAVE_GENERIC_HARDIRQS
         select GENERIC_ATOMIC64
         select HAVE_UID16
+        select HAVE_VIRT_TO_BUS
         select ARCH_WANT_IPC_PARSE_VERSION
         select GENERIC_IRQ_SHOW
         select GENERIC_CPU_DEVICES
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index c90366ef7183..33f3fdc0b214 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -26,6 +26,7 @@ config IA64
         select HAVE_MEMBLOCK
         select HAVE_MEMBLOCK_NODE_MAP
         select HAVE_VIRT_CPU_ACCOUNTING
+        select HAVE_VIRT_TO_BUS
         select ARCH_DISCARD_MEMBLOCK
         select GENERIC_IRQ_PROBE
         select GENERIC_PENDING_IRQ if SMP
diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c
index 7026b29e277a..f8280a766a78 100644
--- a/arch/ia64/kernel/kprobes.c
+++ b/arch/ia64/kernel/kprobes.c
@@ -423,7 +423,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address =
                 ((struct fnptr *)kretprobe_trampoline)->ip;
@@ -444,7 +444,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -461,7 +461,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 
         regs->cr_iip = orig_ret_address;
 
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -487,7 +487,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
         kretprobe_hash_unlock(current, &flags);
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index f807721e19a5..92623818a1fe 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -10,6 +10,7 @@ config M32R
         select ARCH_WANT_IPC_PARSE_VERSION
         select HAVE_DEBUG_BUGVERBOSE
         select HAVE_GENERIC_HARDIRQS
+        select HAVE_VIRT_TO_BUS
         select GENERIC_IRQ_PROBE
         select GENERIC_IRQ_SHOW
         select GENERIC_ATOMIC64
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index efb1ce1f14a3..0e708c78e01c 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -8,6 +8,7 @@ config M68K
         select GENERIC_IRQ_SHOW
         select GENERIC_ATOMIC64
         select HAVE_UID16
+        select HAVE_VIRT_TO_BUS
         select ARCH_HAVE_NMI_SAFE_CMPXCHG if RMW_INSNS
         select GENERIC_CPU_DEVICES
         select GENERIC_STRNCPY_FROM_USER if MMU
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index ba3b7c8c04b8..7843d11156e6 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -19,6 +19,7 @@ config MICROBLAZE
         select HAVE_DEBUG_KMEMLEAK
         select IRQ_DOMAIN
         select HAVE_GENERIC_HARDIRQS
+        select HAVE_VIRT_TO_BUS
         select GENERIC_IRQ_PROBE
         select GENERIC_IRQ_SHOW
         select GENERIC_PCI_IOMAP
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 198641589bb5..1eabe5753215 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -38,6 +38,7 @@ config MIPS
         select GENERIC_CLOCKEVENTS
         select GENERIC_CMOS_UPDATE
         select HAVE_MOD_ARCH_SPECIFIC
+        select HAVE_VIRT_TO_BUS
         select MODULES_USE_ELF_REL if MODULES
         select MODULES_USE_ELF_RELA if MODULES && 64BIT
         select CLONE_BACKWARDS
diff --git a/arch/mips/kernel/kprobes.c b/arch/mips/kernel/kprobes.c
index 158467da9bc1..ce3f0807ad1e 100644
--- a/arch/mips/kernel/kprobes.c
+++ b/arch/mips/kernel/kprobes.c
@@ -598,7 +598,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)kretprobe_trampoline;
 
@@ -618,7 +618,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -645,7 +645,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
         kretprobe_hash_unlock(current, &flags);
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig
index ad0caea0bfea..b06c7360b1c6 100644
--- a/arch/mn10300/Kconfig
+++ b/arch/mn10300/Kconfig
@@ -8,6 +8,7 @@ config MN10300
         select HAVE_ARCH_KGDB
         select GENERIC_ATOMIC64
         select HAVE_NMI_WATCHDOG if MN10300_WD_TIMER
+        select HAVE_VIRT_TO_BUS
         select GENERIC_CLOCKEVENTS
         select MODULES_USE_ELF_RELA
         select OLD_SIGSUSPEND3
diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
index 35a4e5f6e71c..014a6482ed4c 100644
--- a/arch/openrisc/Kconfig
+++ b/arch/openrisc/Kconfig
@@ -12,6 +12,7 @@ config OPENRISC
         select ARCH_WANT_OPTIONAL_GPIOLIB
         select HAVE_ARCH_TRACEHOOK
         select HAVE_GENERIC_HARDIRQS
+        select HAVE_VIRT_TO_BUS
         select GENERIC_IRQ_CHIP
         select GENERIC_IRQ_PROBE
         select GENERIC_IRQ_SHOW
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index 7f9b3c53f74a..4d5ea7648574 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -19,6 +19,7 @@ config PARISC
         select GENERIC_SMP_IDLE_THREAD
         select GENERIC_STRNCPY_FROM_USER
         select HAVE_MOD_ARCH_SPECIFIC
+        select HAVE_VIRT_TO_BUS
         select MODULES_USE_ELF_RELA
         select CLONE_BACKWARDS
         select TTY # Needed for pdc_cons.c
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index 54d619d4cac6..5dfd248e3f1a 100644
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -35,22 +35,17 @@
 
 static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
 {
-        struct vm_area_struct *vma;
+        struct vm_unmapped_area_info info;
 
-        addr = PAGE_ALIGN(addr);
-
-        for (vma = find_vma(current->mm, addr); ; vma = vma->vm_next) {
-                /* At this point:  (!vma || addr < vma->vm_end). */
-                if (TASK_SIZE - len < addr)
-                        return -ENOMEM;
-                if (!vma || addr + len <= vma->vm_start)
-                        return addr;
-                addr = vma->vm_end;
-        }
+        info.flags = 0;
+        info.length = len;
+        info.low_limit = PAGE_ALIGN(addr);
+        info.high_limit = TASK_SIZE;
+        info.align_mask = 0;
+        info.align_offset = 0;
+        return vm_unmapped_area(&info);
 }
 
-#define DCACHE_ALIGN(addr) (((addr) + (SHMLBA - 1)) &~ (SHMLBA - 1))
-
 /*
  * We need to know the offset to use.  Old scheme was to look for
  * existing mapping and use the same offset.  New scheme is to use the
@@ -63,30 +58,21 @@ static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
  */
 static int get_offset(struct address_space *mapping)
 {
-        int offset = (unsigned long) mapping << (PAGE_SHIFT - 8);
-        return offset & 0x3FF000;
+        return (unsigned long) mapping >> 8;
 }
 
 static unsigned long get_shared_area(struct address_space *mapping,
                 unsigned long addr, unsigned long len, unsigned long pgoff)
 {
-        struct vm_area_struct *vma;
-        int offset = mapping ? get_offset(mapping) : 0;
+        struct vm_unmapped_area_info info;
 
-        offset = (offset + (pgoff << PAGE_SHIFT)) & 0x3FF000;
-
-        addr = DCACHE_ALIGN(addr - offset) + offset;
-
-        for (vma = find_vma(current->mm, addr); ; vma = vma->vm_next) {
-                /* At this point:  (!vma || addr < vma->vm_end). */
-                if (TASK_SIZE - len < addr)
-                        return -ENOMEM;
-                if (!vma || addr + len <= vma->vm_start)
-                        return addr;
-                addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
-                if (addr < vma->vm_end) /* handle wraparound */
-                        return -ENOMEM;
-        }
+        info.flags = 0;
+        info.length = len;
+        info.low_limit = PAGE_ALIGN(addr);
+        info.high_limit = TASK_SIZE;
+        info.align_mask = PAGE_MASK & (SHMLBA - 1);
+        info.align_offset = (get_offset(mapping) + pgoff) << PAGE_SHIFT;
+        return vm_unmapped_area(&info);
 }
 
 unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 5c7470689a10..b89d7eb730a2 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -87,9 +87,6 @@ config GENERIC_GPIO
         help
           Generic GPIO API support
 
-config ARCH_NO_VIRT_TO_BUS
-        def_bool PPC64
-
 config PPC
         bool
         default y
@@ -101,6 +98,7 @@ config PPC
         select HAVE_FUNCTION_GRAPH_TRACER
         select SYSCTL_EXCEPTION_TRACE
         select ARCH_WANT_OPTIONAL_GPIOLIB
+        select HAVE_VIRT_TO_BUS if !PPC64
         select HAVE_IDE
         select HAVE_IOREMAP_PROT
         select HAVE_EFFICIENT_UNALIGNED_ACCESS
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index e88c64331819..11f5b03a0b06 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -310,7 +310,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
 
@@ -330,7 +330,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -357,7 +357,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
         kretprobe_hash_unlock(current, &flags);
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/powerpc/kvm/book3s_mmu_hpte.c b/arch/powerpc/kvm/book3s_mmu_hpte.c
index 2c86b0d63714..da8b13c4b776 100644
--- a/arch/powerpc/kvm/book3s_mmu_hpte.c
+++ b/arch/powerpc/kvm/book3s_mmu_hpte.c
@@ -124,7 +124,6 @@ static void kvmppc_mmu_pte_flush_all(struct kvm_vcpu *vcpu)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
         struct hpte_cache *pte;
-        struct hlist_node *node;
         int i;
 
         rcu_read_lock();
@@ -132,7 +131,7 @@ static void kvmppc_mmu_pte_flush_all(struct kvm_vcpu *vcpu)
         for (i = 0; i < HPTEG_HASH_NUM_VPTE_LONG; i++) {
                 struct hlist_head *list = &vcpu3s->hpte_hash_vpte_long[i];
 
-                hlist_for_each_entry_rcu(pte, node, list, list_vpte_long)
+                hlist_for_each_entry_rcu(pte, list, list_vpte_long)
                         invalidate_pte(vcpu, pte);
         }
 
@@ -143,7 +142,6 @@ static void kvmppc_mmu_pte_flush_page(struct kvm_vcpu *vcpu, ulong guest_ea)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
         struct hlist_head *list;
-        struct hlist_node *node;
         struct hpte_cache *pte;
 
         /* Find the list of entries in the map */
@@ -152,7 +150,7 @@ static void kvmppc_mmu_pte_flush_page(struct kvm_vcpu *vcpu, ulong guest_ea)
         rcu_read_lock();
 
         /* Check the list for matching entries and invalidate */
-        hlist_for_each_entry_rcu(pte, node, list, list_pte)
+        hlist_for_each_entry_rcu(pte, list, list_pte)
                 if ((pte->pte.eaddr & ~0xfffUL) == guest_ea)
                         invalidate_pte(vcpu, pte);
 
@@ -163,7 +161,6 @@ static void kvmppc_mmu_pte_flush_long(struct kvm_vcpu *vcpu, ulong guest_ea)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
         struct hlist_head *list;
-        struct hlist_node *node;
         struct hpte_cache *pte;
 
         /* Find the list of entries in the map */
@@ -173,7 +170,7 @@ static void kvmppc_mmu_pte_flush_long(struct kvm_vcpu *vcpu, ulong guest_ea)
         rcu_read_lock();
 
         /* Check the list for matching entries and invalidate */
-        hlist_for_each_entry_rcu(pte, node, list, list_pte_long)
+        hlist_for_each_entry_rcu(pte, list, list_pte_long)
                 if ((pte->pte.eaddr & 0x0ffff000UL) == guest_ea)
                         invalidate_pte(vcpu, pte);
 
@@ -207,7 +204,6 @@ static void kvmppc_mmu_pte_vflush_short(struct kvm_vcpu *vcpu, u64 guest_vp)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
         struct hlist_head *list;
-        struct hlist_node *node;
         struct hpte_cache *pte;
         u64 vp_mask = 0xfffffffffULL;
 
@@ -216,7 +212,7 @@ static void kvmppc_mmu_pte_vflush_short(struct kvm_vcpu *vcpu, u64 guest_vp)
         rcu_read_lock();
 
         /* Check the list for matching entries and invalidate */
-        hlist_for_each_entry_rcu(pte, node, list, list_vpte)
+        hlist_for_each_entry_rcu(pte, list, list_vpte)
                 if ((pte->pte.vpage & vp_mask) == guest_vp)
                         invalidate_pte(vcpu, pte);
 
@@ -228,7 +224,6 @@ static void kvmppc_mmu_pte_vflush_long(struct kvm_vcpu *vcpu, u64 guest_vp)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
         struct hlist_head *list;
-        struct hlist_node *node;
         struct hpte_cache *pte;
         u64 vp_mask = 0xffffff000ULL;
 
@@ -238,7 +233,7 @@ static void kvmppc_mmu_pte_vflush_long(struct kvm_vcpu *vcpu, u64 guest_vp)
         rcu_read_lock();
 
         /* Check the list for matching entries and invalidate */
-        hlist_for_each_entry_rcu(pte, node, list, list_vpte_long)
+        hlist_for_each_entry_rcu(pte, list, list_vpte_long)
                 if ((pte->pte.vpage & vp_mask) == guest_vp)
                         invalidate_pte(vcpu, pte);
 
@@ -266,7 +261,6 @@ void kvmppc_mmu_pte_vflush(struct kvm_vcpu *vcpu, u64 guest_vp, u64 vp_mask)
 void kvmppc_mmu_pte_pflush(struct kvm_vcpu *vcpu, ulong pa_start, ulong pa_end)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
-        struct hlist_node *node;
         struct hpte_cache *pte;
         int i;
 
@@ -277,7 +271,7 @@ void kvmppc_mmu_pte_pflush(struct kvm_vcpu *vcpu, ulong pa_start, ulong pa_end)
         for (i = 0; i < HPTEG_HASH_NUM_VPTE_LONG; i++) {
                 struct hlist_head *list = &vcpu3s->hpte_hash_vpte_long[i];
 
-                hlist_for_each_entry_rcu(pte, node, list, list_vpte_long)
+                hlist_for_each_entry_rcu(pte, list, list_vpte_long)
                         if ((pte->pte.raddr >= pa_start) &&
                             (pte->pte.raddr < pa_end))
                                 invalidate_pte(vcpu, pte);
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index f09ae7b0b4c5..4b505370a1d5 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -134,6 +134,7 @@ config S390
         select HAVE_SYSCALL_WRAPPERS
         select HAVE_UID16 if 32BIT
         select HAVE_VIRT_CPU_ACCOUNTING
+        select HAVE_VIRT_TO_BUS
         select INIT_ALL_POSSIBLE
         select KTIME_SCALAR if 32BIT
         select MODULES_USE_ELF_RELA
diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index d1c7214e157c..3388b2b2a07d 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -354,7 +354,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
 {
         struct kretprobe_instance *ri;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address;
         unsigned long trampoline_address;
         kprobe_opcode_t *correct_ret_addr;
@@ -379,7 +379,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
         orig_ret_address = 0;
         correct_ret_addr = NULL;
         trampoline_address = (unsigned long) &kretprobe_trampoline;
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -398,7 +398,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
         kretprobe_assert(ri, orig_ret_address, trampoline_address);
 
         correct_ret_addr = ri->ret_addr;
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -427,7 +427,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
         kretprobe_hash_unlock(current, &flags);
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/s390/pci/pci_msi.c b/arch/s390/pci/pci_msi.c
index 90fd3482b9e2..0297931335e1 100644
--- a/arch/s390/pci/pci_msi.c
+++ b/arch/s390/pci/pci_msi.c
@@ -25,10 +25,9 @@ static DEFINE_SPINLOCK(msi_map_lock);
 
 struct msi_desc *__irq_get_msi_desc(unsigned int irq)
 {
-        struct hlist_node *entry;
         struct msi_map *map;
 
-        hlist_for_each_entry_rcu(map, entry,
+        hlist_for_each_entry_rcu(map,
                         &msi_hash[msi_hashfn(irq)], msi_chain)
                 if (map->irq == irq)
                         return map->msi;
diff --git a/arch/score/Kconfig b/arch/score/Kconfig
index 3b1482e7afac..e569aa1fd2ba 100644
--- a/arch/score/Kconfig
+++ b/arch/score/Kconfig
@@ -12,6 +12,7 @@ config SCORE
        select GENERIC_CPU_DEVICES
        select GENERIC_CLOCKEVENTS
        select HAVE_MOD_ARCH_SPECIFIC
+        select HAVE_VIRT_TO_BUS
         select MODULES_USE_ELF_REL
         select CLONE_BACKWARDS
 
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index ef6717a64bc7..5e859633ce69 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -148,9 +148,6 @@ config ARCH_HAS_ILOG2_U32
 config ARCH_HAS_ILOG2_U64
         def_bool n
 
-config ARCH_NO_VIRT_TO_BUS
-        def_bool y
-
 config ARCH_HAS_DEFAULT_IDLE
         def_bool y
 
diff --git a/arch/sh/kernel/kprobes.c b/arch/sh/kernel/kprobes.c
index 1208b09e95c3..42b46e61a2d5 100644
--- a/arch/sh/kernel/kprobes.c
+++ b/arch/sh/kernel/kprobes.c
@@ -310,7 +310,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
 
@@ -330,7 +330,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -360,7 +360,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 58fb1e3f631d..289127d5241c 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -146,9 +146,6 @@ config GENERIC_GPIO
         help
           Generic GPIO API support
 
-config ARCH_NO_VIRT_TO_BUS
-        def_bool y
-
 config ARCH_SUPPORTS_DEBUG_PAGEALLOC
         def_bool y if SPARC64
 
diff --git a/arch/sparc/kernel/kprobes.c b/arch/sparc/kernel/kprobes.c
index a39d1ba5a119..e72212148d2a 100644
--- a/arch/sparc/kernel/kprobes.c
+++ b/arch/sparc/kernel/kprobes.c
@@ -511,7 +511,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
 
@@ -531,7 +531,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -559,7 +559,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
         kretprobe_hash_unlock(current, &flags);
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
index 9fcc6b4e93b3..54df554b82d9 100644
--- a/arch/sparc/kernel/ldc.c
+++ b/arch/sparc/kernel/ldc.c
@@ -953,9 +953,8 @@ static HLIST_HEAD(ldc_channel_list);
 static int __ldc_channel_exists(unsigned long id)
 {
         struct ldc_channel *lp;
-        struct hlist_node *n;
 
-        hlist_for_each_entry(lp, n, &ldc_channel_list, list) {
+        hlist_for_each_entry(lp, &ldc_channel_list, list) {
                 if (lp->id == id)
                         return 1;
         }
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 4ce6e4c390e0..ff496ab1e794 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -17,6 +17,7 @@ config TILE
         select GENERIC_IRQ_SHOW
         select HAVE_DEBUG_BUGVERBOSE
         select HAVE_SYSCALL_WRAPPERS if TILEGX
+        select HAVE_VIRT_TO_BUS
         select SYS_HYPERVISOR
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select GENERIC_CLOCKEVENTS
diff --git a/arch/unicore32/Kconfig b/arch/unicore32/Kconfig
index 60651df5f952..dc50b157fc83 100644
--- a/arch/unicore32/Kconfig
+++ b/arch/unicore32/Kconfig
@@ -9,6 +9,7 @@ config UNICORE32
         select GENERIC_ATOMIC64
         select HAVE_KERNEL_LZO
         select HAVE_KERNEL_LZMA
+        select HAVE_VIRT_TO_BUS
         select ARCH_HAVE_CUSTOM_GPIO_H
         select GENERIC_FIND_FIRST_BIT
         select GENERIC_IRQ_PROBE
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 6a9383370311..a4f24f5b1218 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -112,6 +112,7 @@ config X86
         select GENERIC_STRNLEN_USER
         select HAVE_CONTEXT_TRACKING if X86_64
         select HAVE_IRQ_TIME_ACCOUNTING
+        select HAVE_VIRT_TO_BUS
         select MODULES_USE_ELF_REL if X86_32
         select MODULES_USE_ELF_RELA if X86_64
         select CLONE_BACKWARDS if X86_32
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index e124554598ee..3f06e6149981 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -652,7 +652,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
         kprobe_opcode_t *correct_ret_addr = NULL;
@@ -682,7 +682,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
          *       will be the real return address, and all the rest will
          *       point to kretprobe_trampoline.
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -701,7 +701,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
         kretprobe_assert(ri, orig_ret_address, trampoline_address);
 
         correct_ret_addr = ri->ret_addr;
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -728,7 +728,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
 
         kretprobe_hash_unlock(current, &flags);
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 4ed3edbe06bd..956ca358108a 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -1644,13 +1644,13 @@ static int kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
 static void kvm_mmu_commit_zap_page(struct kvm *kvm,
                                     struct list_head *invalid_list);
 
-#define for_each_gfn_sp(kvm, sp, gfn, pos)                              \
-  hlist_for_each_entry(sp, pos,                                         \
+#define for_each_gfn_sp(kvm, sp, gfn)                                   \
+  hlist_for_each_entry(sp,                                              \
    &(kvm)->arch.mmu_page_hash[kvm_page_table_hashfn(gfn)], hash_link)   \
         if ((sp)->gfn != (gfn)) {} else
 
-#define for_each_gfn_indirect_valid_sp(kvm, sp, gfn, pos)               \
-  hlist_for_each_entry(sp, pos,                                         \
+#define for_each_gfn_indirect_valid_sp(kvm, sp, gfn)                    \
+  hlist_for_each_entry(sp,                                              \
    &(kvm)->arch.mmu_page_hash[kvm_page_table_hashfn(gfn)], hash_link)   \
                 if ((sp)->gfn != (gfn) || (sp)->role.direct ||          \
                         (sp)->role.invalid) {} else
@@ -1706,11 +1706,10 @@ static int kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
 static void kvm_sync_pages(struct kvm_vcpu *vcpu,  gfn_t gfn)
 {
         struct kvm_mmu_page *s;
-        struct hlist_node *node;
         LIST_HEAD(invalid_list);
         bool flush = false;
 
-        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn, node) {
+        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn) {
                 if (!s->unsync)
                         continue;
 
@@ -1848,7 +1847,6 @@ static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
         union kvm_mmu_page_role role;
         unsigned quadrant;
         struct kvm_mmu_page *sp;
-        struct hlist_node *node;
         bool need_sync = false;
 
         role = vcpu->arch.mmu.base_role;
@@ -1863,7 +1861,7 @@ static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
                 quadrant &= (1 << ((PT32_PT_BITS - PT64_PT_BITS) * level)) - 1;
                 role.quadrant = quadrant;
         }
-        for_each_gfn_sp(vcpu->kvm, sp, gfn, node) {
+        for_each_gfn_sp(vcpu->kvm, sp, gfn) {
                 if (!need_sync && sp->unsync)
                         need_sync = true;
 
@@ -2151,14 +2149,13 @@ void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int goal_nr_mmu_pages)
 int kvm_mmu_unprotect_page(struct kvm *kvm, gfn_t gfn)
 {
         struct kvm_mmu_page *sp;
-        struct hlist_node *node;
         LIST_HEAD(invalid_list);
         int r;
 
         pgprintk("%s: looking for gfn %llx\n", __func__, gfn);
         r = 0;
         spin_lock(&kvm->mmu_lock);
-        for_each_gfn_indirect_valid_sp(kvm, sp, gfn, node) {
+        for_each_gfn_indirect_valid_sp(kvm, sp, gfn) {
                 pgprintk("%s: gfn %llx role %x\n", __func__, gfn,
                          sp->role.word);
                 r = 1;
@@ -2288,9 +2285,8 @@ static void __kvm_unsync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
 static void kvm_unsync_pages(struct kvm_vcpu *vcpu,  gfn_t gfn)
 {
         struct kvm_mmu_page *s;
-        struct hlist_node *node;
 
-        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn, node) {
+        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn) {
                 if (s->unsync)
                         continue;
                 WARN_ON(s->role.level != PT_PAGE_TABLE_LEVEL);
@@ -2302,10 +2298,9 @@ static int mmu_need_write_protect(struct kvm_vcpu *vcpu, gfn_t gfn,
                                   bool can_unsync)
 {
         struct kvm_mmu_page *s;
-        struct hlist_node *node;
         bool need_unsync = false;
 
-        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn, node) {
+        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn) {
                 if (!can_unsync)
                         return 1;
 
@@ -3933,7 +3928,6 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
         gfn_t gfn = gpa >> PAGE_SHIFT;
         union kvm_mmu_page_role mask = { .word = 0 };
         struct kvm_mmu_page *sp;
-        struct hlist_node *node;
         LIST_HEAD(invalid_list);
         u64 entry, gentry, *spte;
         int npte;
@@ -3964,7 +3958,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
         kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
 
         mask.cr0_wp = mask.cr4_pae = mask.nxe = 1;
-        for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) {
+        for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) {
                 if (detect_write_misaligned(sp, gpa, bytes) ||
                       detect_write_flooding(sp)) {
                         zap_page |= !!kvm_mmu_prepare_zap_page(vcpu->kvm, sp,
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index a5c0663c2cdc..35876ffac11d 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -9,6 +9,7 @@ config XTENSA
         select HAVE_IDE
         select GENERIC_ATOMIC64
         select HAVE_GENERIC_HARDIRQS
+        select HAVE_VIRT_TO_BUS
         select GENERIC_IRQ_SHOW
         select GENERIC_CPU_DEVICES
         select MODULES_USE_ELF_RELA
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index b8858fb0cafa..8bdebb6781e1 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -357,7 +357,6 @@ static int blkcg_reset_stats(struct cgroup *cgroup, struct cftype *cftype,
 {
         struct blkcg *blkcg = cgroup_to_blkcg(cgroup);
         struct blkcg_gq *blkg;
-        struct hlist_node *n;
         int i;
 
         mutex_lock(&blkcg_pol_mutex);
@@ -368,7 +367,7 @@ static int blkcg_reset_stats(struct cgroup *cgroup, struct cftype *cftype,
          * stat updates.  This is a debug feature which shouldn't exist
          * anyway.  If you get hit by a race, retry.
          */
-        hlist_for_each_entry(blkg, n, &blkcg->blkg_list, blkcg_node) {
+        hlist_for_each_entry(blkg, &blkcg->blkg_list, blkcg_node) {
                 for (i = 0; i < BLKCG_MAX_POLS; i++) {
                         struct blkcg_policy *pol = blkcg_policy[i];
 
@@ -415,11 +414,10 @@ void blkcg_print_blkgs(struct seq_file *sf, struct blkcg *blkcg,
                        bool show_total)
 {
         struct blkcg_gq *blkg;
-        struct hlist_node *n;
         u64 total = 0;
 
         spin_lock_irq(&blkcg->lock);
-        hlist_for_each_entry(blkg, n, &blkcg->blkg_list, blkcg_node)
+        hlist_for_each_entry(blkg, &blkcg->blkg_list, blkcg_node)
                 if (blkcg_policy_enabled(blkg->q, pol))
                         total += prfill(sf, blkg->pd[pol->plid], data);
         spin_unlock_irq(&blkcg->lock);
diff --git a/block/blk-ioc.c b/block/blk-ioc.c
index fab4cdd3f7bb..9c4bb8266bc8 100644
--- a/block/blk-ioc.c
+++ b/block/blk-ioc.c
@@ -164,7 +164,6 @@ EXPORT_SYMBOL(put_io_context);
  */
 void put_io_context_active(struct io_context *ioc)
 {
-        struct hlist_node *n;
         unsigned long flags;
         struct io_cq *icq;
 
@@ -180,7 +179,7 @@ void put_io_context_active(struct io_context *ioc)
          */
 retry:
         spin_lock_irqsave_nested(&ioc->lock, flags, 1);
-        hlist_for_each_entry(icq, n, &ioc->icq_list, ioc_node) {
+        hlist_for_each_entry(icq, &ioc->icq_list, ioc_node) {
                 if (icq->flags & ICQ_EXITED)
                         continue;
                 if (spin_trylock(icq->q->queue_lock)) {
diff --git a/block/bsg.c b/block/bsg.c
index ff64ae3bacee..420a5a9f1b23 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -800,11 +800,10 @@ static struct bsg_device *bsg_add_device(struct inode *inode,
 static struct bsg_device *__bsg_get_device(int minor, struct request_queue *q)
 {
         struct bsg_device *bd;
-        struct hlist_node *entry;
 
         mutex_lock(&bsg_mutex);
 
-        hlist_for_each_entry(bd, entry, bsg_dev_idx_hash(minor), dev_list) {
+        hlist_for_each_entry(bd, bsg_dev_idx_hash(minor), dev_list) {
                 if (bd->queue == q) {
                         atomic_inc(&bd->ref_count);
                         goto found;
@@ -997,7 +996,7 @@ int bsg_register_queue(struct request_queue *q, struct device *parent,
 {
         struct bsg_class_device *bcd;
         dev_t dev;
-        int ret, minor;
+        int ret;
         struct device *class_dev = NULL;
         const char *devname;
 
@@ -1017,23 +1016,16 @@ int bsg_register_queue(struct request_queue *q, struct device *parent,
 
         mutex_lock(&bsg_mutex);
 
-        ret = idr_pre_get(&bsg_minor_idr, GFP_KERNEL);
-        if (!ret) {
-                ret = -ENOMEM;
-                goto unlock;
-        }
-
-        ret = idr_get_new(&bsg_minor_idr, bcd, &minor);
-        if (ret < 0)
+        ret = idr_alloc(&bsg_minor_idr, bcd, 0, BSG_MAX_DEVS, GFP_KERNEL);
+        if (ret < 0) {
+                if (ret == -ENOSPC) {
+                        printk(KERN_ERR "bsg: too many bsg devices\n");
+                        ret = -EINVAL;
+                }
                 goto unlock;
-
-        if (minor >= BSG_MAX_DEVS) {
-                printk(KERN_ERR "bsg: too many bsg devices\n");
-                ret = -EINVAL;
-                goto remove_idr;
         }
 
-        bcd->minor = minor;
+        bcd->minor = ret;
         bcd->queue = q;
         bcd->parent = get_device(parent);
         bcd->release = release;
@@ -1059,8 +1051,7 @@ unregister_class_dev:
         device_unregister(class_dev);
 put_dev:
         put_device(parent);
-remove_idr:
-        idr_remove(&bsg_minor_idr, minor);
+        idr_remove(&bsg_minor_idr, bcd->minor);
 unlock:
         mutex_unlock(&bsg_mutex);
         return ret;
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index e62e9205b80a..ec52807cdd09 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -1435,7 +1435,6 @@ static int cfq_set_weight(struct cgroup *cgrp, struct cftype *cft, u64 val)
 {
         struct blkcg *blkcg = cgroup_to_blkcg(cgrp);
         struct blkcg_gq *blkg;
-        struct hlist_node *n;
 
         if (val < CFQ_WEIGHT_MIN || val > CFQ_WEIGHT_MAX)
                 return -EINVAL;
@@ -1443,7 +1442,7 @@ static int cfq_set_weight(struct cgroup *cgrp, struct cftype *cft, u64 val)
         spin_lock_irq(&blkcg->lock);
         blkcg->cfq_weight = (unsigned int)val;
 
-        hlist_for_each_entry(blkg, n, &blkcg->blkg_list, blkcg_node) {
+        hlist_for_each_entry(blkg, &blkcg->blkg_list, blkcg_node) {
                 struct cfq_group *cfqg = blkg_to_cfqg(blkg);
 
                 if (cfqg && !cfqg->dev_weight)
diff --git a/block/elevator.c b/block/elevator.c
index 603b2c178740..d0acb31cc083 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -288,10 +288,10 @@ static struct request *elv_rqhash_find(struct request_queue *q, sector_t offset)
 {
         struct elevator_queue *e = q->elevator;
         struct hlist_head *hash_list = &e->hash[ELV_HASH_FN(offset)];
-        struct hlist_node *entry, *next;
+        struct hlist_node *next;
         struct request *rq;
 
-        hlist_for_each_entry_safe(rq, entry, next, hash_list, hash) {
+        hlist_for_each_entry_safe(rq, next, hash_list, hash) {
                 BUG_ON(!ELV_ON_HASH(rq));
 
                 if (unlikely(!rq_mergeable(rq))) {
diff --git a/block/genhd.c b/block/genhd.c
index 5f73c2435fde..3c001fba80c7 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -26,7 +26,7 @@ static DEFINE_MUTEX(block_class_lock);
 struct kobject *block_depr;
 
 /* for extended dynamic devt allocation, currently only one major is used */
-#define MAX_EXT_DEVT            (1 << MINORBITS)
+#define NR_EXT_DEVT             (1 << MINORBITS)
 
 /* For extended devt allocation.  ext_devt_mutex prevents look up
  * results from going away underneath its user.
@@ -411,7 +411,7 @@ static int blk_mangle_minor(int minor)
 int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
 {
         struct gendisk *disk = part_to_disk(part);
-        int idx, rc;
+        int idx;
 
         /* in consecutive minor range? */
         if (part->partno < disk->minors) {
@@ -420,19 +420,11 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
         }
 
         /* allocate ext devt */
-        do {
-                if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL))
-                        return -ENOMEM;
-                rc = idr_get_new(&ext_devt_idr, part, &idx);
-        } while (rc == -EAGAIN);
-
-        if (rc)
-                return rc;
-
-        if (idx > MAX_EXT_DEVT) {
-                idr_remove(&ext_devt_idr, idx);
-                return -EBUSY;
-        }
+        mutex_lock(&ext_devt_mutex);
+        idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_KERNEL);
+        mutex_unlock(&ext_devt_mutex);
+        if (idx < 0)
+                return idx == -ENOSPC ? -EBUSY : idx;
 
         *devt = MKDEV(BLOCK_EXT_MAJOR, blk_mangle_minor(idx));
         return 0;
@@ -655,7 +647,6 @@ void del_gendisk(struct gendisk *disk)
         disk_part_iter_exit(&piter);
 
         invalidate_partition(disk, 0);
-        blk_free_devt(disk_to_dev(disk)->devt);
         set_capacity(disk, 0);
         disk->flags &= ~GENHD_FL_UP;
 
@@ -674,6 +665,7 @@ void del_gendisk(struct gendisk *disk)
                 sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk)));
         pm_runtime_set_memalloc_noio(disk_to_dev(disk), false);
         device_del(disk_to_dev(disk));
+        blk_free_devt(disk_to_dev(disk)->devt);
 }
 EXPORT_SYMBOL(del_gendisk);
 
diff --git a/block/partition-generic.c b/block/partition-generic.c
index f1d14519cc04..789cdea05893 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -249,11 +249,11 @@ void delete_partition(struct gendisk *disk, int partno)
         if (!part)
                 return;
 
-        blk_free_devt(part_devt(part));
         rcu_assign_pointer(ptbl->part[partno], NULL);
         rcu_assign_pointer(ptbl->last_lookup, NULL);
         kobject_put(part->holder_dir);
         device_del(part_to_dev(part));
+        blk_free_devt(part_devt(part));
 
         hd_struct_put(part);
 }
@@ -418,7 +418,7 @@ int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
         int p, highest, res;
 rescan:
         if (state && !IS_ERR(state)) {
-                kfree(state);
+                free_partitions(state);
                 state = NULL;
         }
 
@@ -525,7 +525,7 @@ rescan:
                         md_autodetect_dev(part_to_dev(part)->devt);
 #endif
         }
-        kfree(state);
+        free_partitions(state);
         return 0;
 }
 
diff --git a/block/partitions/check.c b/block/partitions/check.c
index bc908672c976..19ba207ea7d1 100644
--- a/block/partitions/check.c
+++ b/block/partitions/check.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include <linux/ctype.h>
 #include <linux/genhd.h>
 
@@ -106,18 +107,45 @@ static int (*check_part[])(struct parsed_partitions *) = {
         NULL
 };
 
+static struct parsed_partitions *allocate_partitions(struct gendisk *hd)
+{
+        struct parsed_partitions *state;
+        int nr;
+
+        state = kzalloc(sizeof(*state), GFP_KERNEL);
+        if (!state)
+                return NULL;
+
+        nr = disk_max_parts(hd);
+        state->parts = vzalloc(nr * sizeof(state->parts[0]));
+        if (!state->parts) {
+                kfree(state);
+                return NULL;
+        }
+
+        state->limit = nr;
+
+        return state;
+}
+
+void free_partitions(struct parsed_partitions *state)
+{
+        vfree(state->parts);
+        kfree(state);
+}
+
 struct parsed_partitions *
 check_partition(struct gendisk *hd, struct block_device *bdev)
 {
         struct parsed_partitions *state;
         int i, res, err;
 
-        state = kzalloc(sizeof(struct parsed_partitions), GFP_KERNEL);
+        state = allocate_partitions(hd);
         if (!state)
                 return NULL;
         state->pp_buf = (char *)__get_free_page(GFP_KERNEL);
         if (!state->pp_buf) {
-                kfree(state);
+                free_partitions(state);
                 return NULL;
         }
         state->pp_buf[0] = '\0';
@@ -128,10 +156,9 @@ check_partition(struct gendisk *hd, struct block_device *bdev)
         if (isdigit(state->name[strlen(state->name)-1]))
                 sprintf(state->name, "p");
 
-        state->limit = disk_max_parts(hd);
         i = res = err = 0;
         while (!res && check_part[i]) {
-                memset(&state->parts, 0, sizeof(state->parts));
+                memset(state->parts, 0, state->limit * sizeof(state->parts[0]));
                 res = check_part[i++](state);
                 if (res < 0) {
                         /* We have hit an I/O error which we don't report now.
@@ -161,6 +188,6 @@ check_partition(struct gendisk *hd, struct block_device *bdev)
         printk(KERN_INFO "%s", state->pp_buf);
 
         free_page((unsigned long)state->pp_buf);
-        kfree(state);
+        free_partitions(state);
         return ERR_PTR(res);
 }
diff --git a/block/partitions/check.h b/block/partitions/check.h
index 52b100311ec3..eade17ea910b 100644
--- a/block/partitions/check.h
+++ b/block/partitions/check.h
@@ -15,13 +15,15 @@ struct parsed_partitions {
                 int flags;
                 bool has_info;
                 struct partition_meta_info info;
-        } parts[DISK_MAX_PARTS];
+        } *parts;
         int next;
         int limit;
         bool access_beyond_eod;
         char *pp_buf;
 };
 
+void free_partitions(struct parsed_partitions *state);
+
 struct parsed_partitions *
 check_partition(struct gendisk *, struct block_device *);
 
diff --git a/block/partitions/efi.c b/block/partitions/efi.c
index b62fb88b8711..ff5804e2f1d2 100644
--- a/block/partitions/efi.c
+++ b/block/partitions/efi.c
@@ -310,15 +310,23 @@ static int is_gpt_valid(struct parsed_partitions *state, u64 lba,
                 goto fail;
         }
 
-        /* Check the GUID Partition Table header size */
+        /* Check the GUID Partition Table header size is too big */
         if (le32_to_cpu((*gpt)->header_size) >
                         bdev_logical_block_size(state->bdev)) {
-                pr_debug("GUID Partition Table Header size is wrong: %u > %u\n",
+                pr_debug("GUID Partition Table Header size is too large: %u > %u\n",
                         le32_to_cpu((*gpt)->header_size),
                         bdev_logical_block_size(state->bdev));
                 goto fail;
         }
 
+        /* Check the GUID Partition Table header size is too small */
+        if (le32_to_cpu((*gpt)->header_size) < sizeof(gpt_header)) {
+                pr_debug("GUID Partition Table Header size is too small: %u < %zu\n",
+                        le32_to_cpu((*gpt)->header_size),
+                        sizeof(gpt_header));
+                goto fail;
+        }
+
         /* Check the GUID Partition Table CRC */
         origcrc = le32_to_cpu((*gpt)->header_crc32);
         (*gpt)->header_crc32 = 0;
diff --git a/block/partitions/mac.c b/block/partitions/mac.c
index 11f688bd76c5..76d8ba6379a9 100644
--- a/block/partitions/mac.c
+++ b/block/partitions/mac.c
@@ -63,6 +63,10 @@ int mac_partition(struct parsed_partitions *state)
                 put_dev_sector(sect);
                 return 0;
         }
+
+        if (blocks_in_map >= state->limit)
+                blocks_in_map = state->limit - 1;
+
         strlcat(state->pp_buf, " [mac]", PAGE_SIZE);
         for (slot = 1; slot <= blocks_in_map; ++slot) {
                 int pos = slot * secsize;
diff --git a/block/partitions/msdos.c b/block/partitions/msdos.c
index 8752a5d26565..7681cd295ab8 100644
--- a/block/partitions/msdos.c
+++ b/block/partitions/msdos.c
@@ -455,14 +455,19 @@ int msdos_partition(struct parsed_partitions *state)
         data = read_part_sector(state, 0, &sect);
         if (!data)
                 return -1;
-        if (!msdos_magic_present(data + 510)) {
+
+        /*
+         * Note order! (some AIX disks, e.g. unbootable kind,
+         * have no MSDOS 55aa)
+         */
+        if (aix_magic_present(state, data)) {
                 put_dev_sector(sect);
+                strlcat(state->pp_buf, " [AIX]", PAGE_SIZE);
                 return 0;
         }
 
-        if (aix_magic_present(state, data)) {
+        if (!msdos_magic_present(data + 510)) {
                 put_dev_sector(sect);
-                strlcat(state->pp_buf, " [AIX]", PAGE_SIZE);
                 return 0;
         }
 
diff --git a/crypto/algapi.c b/crypto/algapi.c
index 08c57c8aec95..6149a6e09643 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -447,7 +447,7 @@ EXPORT_SYMBOL_GPL(crypto_register_template);
 void crypto_unregister_template(struct crypto_template *tmpl)
 {
         struct crypto_instance *inst;
-        struct hlist_node *p, *n;
+        struct hlist_node *n;
         struct hlist_head *list;
         LIST_HEAD(users);
 
@@ -457,7 +457,7 @@ void crypto_unregister_template(struct crypto_template *tmpl)
         list_del_init(&tmpl->list);
 
         list = &tmpl->instances;
-        hlist_for_each_entry(inst, p, list, list) {
+        hlist_for_each_entry(inst, list, list) {
                 int err = crypto_remove_alg(&inst->alg, &users);
                 BUG_ON(err);
         }
@@ -466,7 +466,7 @@ void crypto_unregister_template(struct crypto_template *tmpl)
 
         up_write(&crypto_alg_sem);
 
-        hlist_for_each_entry_safe(inst, p, n, list, list) {
+        hlist_for_each_entry_safe(inst, n, list, list) {
                 BUG_ON(atomic_read(&inst->alg.cra_refcnt) != 1);
                 tmpl->free(inst);
         }
diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
index b22d71cac54c..0e3f8f9dcd29 100644
--- a/drivers/atm/atmtcp.c
+++ b/drivers/atm/atmtcp.c
@@ -157,7 +157,6 @@ static int atmtcp_v_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
 {
         struct atm_cirange ci;
         struct atm_vcc *vcc;
-        struct hlist_node *node;
         struct sock *s;
         int i;
 
@@ -171,7 +170,7 @@ static int atmtcp_v_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
         for(i = 0; i < VCC_HTABLE_SIZE; ++i) {
                 struct hlist_head *head = &vcc_hash[i];
 
-                sk_for_each(s, node, head) {
+                sk_for_each(s, head) {
                         vcc = atm_sk(s);
                         if (vcc->dev != dev)
                                 continue;
@@ -264,12 +263,11 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci)
 {
         struct hlist_head *head;
         struct atm_vcc *vcc;
-        struct hlist_node *node;
         struct sock *s;
 
         head = &vcc_hash[vci & (VCC_HTABLE_SIZE -1)];
 
-        sk_for_each(s, node, head) {
+        sk_for_each(s, head) {
                 vcc = atm_sk(s);
                 if (vcc->dev == dev &&
                     vcc->vci == vci && vcc->vpi == vpi &&
diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
index c1eb6fa8ac35..b1955ba40d63 100644
--- a/drivers/atm/eni.c
+++ b/drivers/atm/eni.c
@@ -2093,7 +2093,6 @@ static unsigned char eni_phy_get(struct atm_dev *dev,unsigned long addr)
 
 static int eni_proc_read(struct atm_dev *dev,loff_t *pos,char *page)
 {
-        struct hlist_node *node;
         struct sock *s;
         static const char *signal[] = { "LOST","unknown","okay" };
         struct eni_dev *eni_dev = ENI_DEV(dev);
@@ -2171,7 +2170,7 @@ static int eni_proc_read(struct atm_dev *dev,loff_t *pos,char *page)
         for(i = 0; i < VCC_HTABLE_SIZE; ++i) {
                 struct hlist_head *head = &vcc_hash[i];
 
-                sk_for_each(s, node, head) {
+                sk_for_each(s, head) {
                         struct eni_vcc *eni_vcc;
                         int length;
 
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 72b6960fa95f..d6891267f5bb 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -329,7 +329,6 @@ __find_vcc(struct he_dev *he_dev, unsigned cid)
 {
         struct hlist_head *head;
         struct atm_vcc *vcc;
-        struct hlist_node *node;
         struct sock *s;
         short vpi;
         int vci;
@@ -338,7 +337,7 @@ __find_vcc(struct he_dev *he_dev, unsigned cid)
         vci = cid & ((1 << he_dev->vcibits) - 1);
         head = &vcc_hash[vci & (VCC_HTABLE_SIZE -1)];
 
-        sk_for_each(s, node, head) {
+        sk_for_each(s, head) {
                 vcc = atm_sk(s);
                 if (vcc->dev == he_dev->atm_dev &&
                     vcc->vci == vci && vcc->vpi == vpi &&
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index ed1d2b7f923b..6587dc295eb0 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -251,7 +251,6 @@ static void nicstar_remove_one(struct pci_dev *pcidev)
                 if (card->scd2vc[j] != NULL)
                         free_scq(card, card->scd2vc[j]->scq, card->scd2vc[j]->tx_vcc);
         }
-        idr_remove_all(&card->idr);
         idr_destroy(&card->idr);
         pci_free_consistent(card->pcidev, NS_RSQSIZE + NS_RSQ_ALIGNMENT,
                             card->rsq.org, card->rsq.dma);
@@ -950,11 +949,10 @@ static void free_scq(ns_dev *card, scq_info *scq, struct atm_vcc *vcc)
 static void push_rxbufs(ns_dev * card, struct sk_buff *skb)
 {
         struct sk_buff *handle1, *handle2;
-        u32 id1 = 0, id2 = 0;
+        int id1, id2;
         u32 addr1, addr2;
         u32 stat;
         unsigned long flags;
-        int err;
 
         /* *BARF* */
         handle2 = NULL;
@@ -1027,23 +1025,12 @@ static void push_rxbufs(ns_dev * card, struct sk_buff *skb)
                                 card->lbfqc += 2;
                 }
 
-                do {
-                        if (!idr_pre_get(&card->idr, GFP_ATOMIC)) {
-                                printk(KERN_ERR
-                                       "nicstar%d: no free memory for idr\n",
-                                       card->index);
-                                goto out;
-                        }
-
-                        if (!id1)
-                                err = idr_get_new_above(&card->idr, handle1, 0, &id1);
-
-                        if (!id2 && err == 0)
-                                err = idr_get_new_above(&card->idr, handle2, 0, &id2);
-
-                } while (err == -EAGAIN);
+                id1 = idr_alloc(&card->idr, handle1, 0, 0, GFP_ATOMIC);
+                if (id1 < 0)
+                        goto out;
 
-                if (err)
+                id2 = idr_alloc(&card->idr, handle2, 0, 0, GFP_ATOMIC);
+                if (id2 < 0)
                         goto out;
 
                 spin_lock_irqsave(&card->res_lock, flags);
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 0474a89170b9..32784d18d1f7 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -896,12 +896,11 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci)
 {
         struct hlist_head *head;
         struct atm_vcc *vcc = NULL;
-        struct hlist_node *node;
         struct sock *s;
 
         read_lock(&vcc_sklist_lock);
         head = &vcc_hash[vci & (VCC_HTABLE_SIZE -1)];
-        sk_for_each(s, node, head) {
+        sk_for_each(s, head) {
                 vcc = atm_sk(s);
                 if (vcc->dev == dev && vcc->vci == vci &&
                     vcc->vpi == vpi && vcc->qos.rxtp.traffic_class != ATM_NONE &&
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 8c13eeb83c53..e98da675f0c1 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -2660,25 +2660,24 @@ enum drbd_ret_code conn_new_minor(struct drbd_tconn *tconn, unsigned int minor,
         mdev->read_requests = RB_ROOT;
         mdev->write_requests = RB_ROOT;
 
-        if (!idr_pre_get(&minors, GFP_KERNEL))
-                goto out_no_minor_idr;
-        if (idr_get_new_above(&minors, mdev, minor, &minor_got))
+        minor_got = idr_alloc(&minors, mdev, minor, minor + 1, GFP_KERNEL);
+        if (minor_got < 0) {
+                if (minor_got == -ENOSPC) {
+                        err = ERR_MINOR_EXISTS;
+                        drbd_msg_put_info("requested minor exists already");
+                }
                 goto out_no_minor_idr;
-        if (minor_got != minor) {
-                err = ERR_MINOR_EXISTS;
-                drbd_msg_put_info("requested minor exists already");
-                goto out_idr_remove_minor;
         }
 
-        if (!idr_pre_get(&tconn->volumes, GFP_KERNEL))
-                goto out_idr_remove_minor;
-        if (idr_get_new_above(&tconn->volumes, mdev, vnr, &vnr_got))
+        vnr_got = idr_alloc(&tconn->volumes, mdev, vnr, vnr + 1, GFP_KERNEL);
+        if (vnr_got < 0) {
+                if (vnr_got == -ENOSPC) {
+                        err = ERR_INVALID_REQUEST;
+                        drbd_msg_put_info("requested volume exists already");
+                }
                 goto out_idr_remove_minor;
-        if (vnr_got != vnr) {
-                err = ERR_INVALID_REQUEST;
-                drbd_msg_put_info("requested volume exists already");
-                goto out_idr_remove_vol;
         }
+
         add_disk(disk);
         kref_init(&mdev->kref); /* one ref for both idrs and the the add_disk */
 
@@ -2689,8 +2688,6 @@ enum drbd_ret_code conn_new_minor(struct drbd_tconn *tconn, unsigned int minor,
 
         return NO_ERROR;
 
-out_idr_remove_vol:
-        idr_remove(&tconn->volumes, vnr_got);
 out_idr_remove_minor:
         idr_remove(&minors, minor_got);
         synchronize_rcu();
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 8031a8cdd698..f47dccbda1d4 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1624,30 +1624,17 @@ static int loop_add(struct loop_device **l, int i)
         if (!lo)
                 goto out;
 
-        if (!idr_pre_get(&loop_index_idr, GFP_KERNEL))
-                goto out_free_dev;
-
+        /* allocate id, if @id >= 0, we're requesting that specific id */
         if (i >= 0) {
-                int m;
-
-                /* create specific i in the index */
-                err = idr_get_new_above(&loop_index_idr, lo, i, &m);
-                if (err >= 0 && i != m) {
-                        idr_remove(&loop_index_idr, m);
+                err = idr_alloc(&loop_index_idr, lo, i, i + 1, GFP_KERNEL);
+                if (err == -ENOSPC)
                         err = -EEXIST;
-                }
-        } else if (i == -1) {
-                int m;
-
-                /* get next free nr */
-                err = idr_get_new(&loop_index_idr, lo, &m);
-                if (err >= 0)
-                        i = m;
         } else {
-                err = -EINVAL;
+                err = idr_alloc(&loop_index_idr, lo, 0, 0, GFP_KERNEL);
         }
         if (err < 0)
                 goto out_free_dev;
+        i = err;
 
         lo->lo_queue = blk_alloc_queue(GFP_KERNEL);
         if (!lo->lo_queue)
@@ -1911,7 +1898,6 @@ static void __exit loop_exit(void)
         range = max_loop ? max_loop << part_shift : 1UL << MINORBITS;
 
         idr_for_each(&loop_index_idr, &loop_exit_cb, NULL);
-        idr_remove_all(&loop_index_idr);
         idr_destroy(&loop_index_idr);
 
         blk_unregister_region(MKDEV(LOOP_MAJOR, 0), range);
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index ade146bf65e5..7fecc784be01 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -98,6 +98,7 @@ static const char *nbdcmd_to_ascii(int cmd)
         case  NBD_CMD_READ: return "read";
         case NBD_CMD_WRITE: return "write";
         case  NBD_CMD_DISC: return "disconnect";
+        case NBD_CMD_FLUSH: return "flush";
         case  NBD_CMD_TRIM: return "trim/discard";
         }
         return "invalid";
@@ -244,8 +245,15 @@ static int nbd_send_req(struct nbd_device *nbd, struct request *req)
 
         request.magic = htonl(NBD_REQUEST_MAGIC);
         request.type = htonl(nbd_cmd(req));
-        request.from = cpu_to_be64((u64)blk_rq_pos(req) << 9);
-        request.len = htonl(size);
+
+        if (nbd_cmd(req) == NBD_CMD_FLUSH) {
+                /* Other values are reserved for FLUSH requests.  */
+                request.from = 0;
+                request.len = 0;
+        } else {
+                request.from = cpu_to_be64((u64)blk_rq_pos(req) << 9);
+                request.len = htonl(size);
+        }
         memcpy(request.handle, &req, sizeof(req));
 
         dprintk(DBG_TX, "%s: request %p: sending control (%s@%llu,%uB)\n",
@@ -482,6 +490,11 @@ static void nbd_handle_req(struct nbd_device *nbd, struct request *req)
                 }
         }
 
+        if (req->cmd_flags & REQ_FLUSH) {
+                BUG_ON(unlikely(blk_rq_sectors(req)));
+                nbd_cmd(req) = NBD_CMD_FLUSH;
+        }
+
         req->errors = 0;
 
         mutex_lock(&nbd->tx_lock);
@@ -551,6 +564,7 @@ static int nbd_thread(void *data)
  */
 
 static void do_nbd_request(struct request_queue *q)
+                __releases(q->queue_lock) __acquires(q->queue_lock)
 {
         struct request *req;
         
@@ -595,12 +609,20 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                 struct request sreq;
 
                 dev_info(disk_to_dev(nbd->disk), "NBD_DISCONNECT\n");
+                if (!nbd->sock)
+                        return -EINVAL;
 
+                mutex_unlock(&nbd->tx_lock);
+                fsync_bdev(bdev);
+                mutex_lock(&nbd->tx_lock);
                 blk_rq_init(NULL, &sreq);
                 sreq.cmd_type = REQ_TYPE_SPECIAL;
                 nbd_cmd(&sreq) = NBD_CMD_DISC;
+
+                /* Check again after getting mutex back.  */
                 if (!nbd->sock)
                         return -EINVAL;
+
                 nbd_send_req(nbd, &sreq);
                 return 0;
         }
@@ -614,6 +636,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                 nbd_clear_que(nbd);
                 BUG_ON(!list_empty(&nbd->queue_head));
                 BUG_ON(!list_empty(&nbd->waiting_queue));
+                kill_bdev(bdev);
                 if (file)
                         fput(file);
                 return 0;
@@ -681,9 +704,15 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
 
                 mutex_unlock(&nbd->tx_lock);
 
+                if (nbd->flags & NBD_FLAG_READ_ONLY)
+                        set_device_ro(bdev, true);
                 if (nbd->flags & NBD_FLAG_SEND_TRIM)
                         queue_flag_set_unlocked(QUEUE_FLAG_DISCARD,
                                 nbd->disk->queue);
+                if (nbd->flags & NBD_FLAG_SEND_FLUSH)
+                        blk_queue_flush(nbd->disk->queue, REQ_FLUSH);
+                else
+                        blk_queue_flush(nbd->disk->queue, 0);
 
                 thread = kthread_create(nbd_thread, nbd, nbd->disk->disk_name);
                 if (IS_ERR(thread)) {
@@ -702,9 +731,12 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                 nbd->file = NULL;
                 nbd_clear_que(nbd);
                 dev_warn(disk_to_dev(nbd->disk), "queue cleared\n");
+                kill_bdev(bdev);
                 queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, nbd->disk->queue);
+                set_device_ro(bdev, false);
                 if (file)
                         fput(file);
+                nbd->flags = 0;
                 nbd->bytesize = 0;
                 bdev->bd_inode->i_size = 0;
                 set_capacity(nbd->disk, 0);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 1c7fdcd22a98..0ac9b45a585e 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -1208,6 +1208,16 @@ static int smi_num; /* Used to sequence the SMIs */
 #define DEFAULT_REGSPACING      1
 #define DEFAULT_REGSIZE         1
 
+#ifdef CONFIG_ACPI
+static bool          si_tryacpi = 1;
+#endif
+#ifdef CONFIG_DMI
+static bool          si_trydmi = 1;
+#endif
+static bool          si_tryplatform = 1;
+#ifdef CONFIG_PCI
+static bool          si_trypci = 1;
+#endif
 static bool          si_trydefaults = 1;
 static char          *si_type[SI_MAX_PARMS];
 #define MAX_SI_TYPE_STR 30
@@ -1238,6 +1248,25 @@ MODULE_PARM_DESC(hotmod, "Add and remove interfaces.  See"
                  " Documentation/IPMI.txt in the kernel sources for the"
                  " gory details.");
 
+#ifdef CONFIG_ACPI
+module_param_named(tryacpi, si_tryacpi, bool, 0);
+MODULE_PARM_DESC(tryacpi, "Setting this to zero will disable the"
+                 " default scan of the interfaces identified via ACPI");
+#endif
+#ifdef CONFIG_DMI
+module_param_named(trydmi, si_trydmi, bool, 0);
+MODULE_PARM_DESC(trydmi, "Setting this to zero will disable the"
+                 " default scan of the interfaces identified via DMI");
+#endif
+module_param_named(tryplatform, si_tryplatform, bool, 0);
+MODULE_PARM_DESC(tryacpi, "Setting this to zero will disable the"
+                 " default scan of the interfaces identified via platform"
+                 " interfaces like openfirmware");
+#ifdef CONFIG_PCI
+module_param_named(trypci, si_trypci, bool, 0);
+MODULE_PARM_DESC(tryacpi, "Setting this to zero will disable the"
+                 " default scan of the interfaces identified via pci");
+#endif
 module_param_named(trydefaults, si_trydefaults, bool, 0);
 MODULE_PARM_DESC(trydefaults, "Setting this to 'false' will disable the"
                  " default scan of the KCS and SMIC interface at the standard"
@@ -3371,13 +3400,15 @@ static int init_ipmi_si(void)
                 return 0;
         initialized = 1;
 
-        rv = platform_driver_register(&ipmi_driver);
-        if (rv) {
-                printk(KERN_ERR PFX "Unable to register driver: %d\n", rv);
-                return rv;
+        if (si_tryplatform) {
+                rv = platform_driver_register(&ipmi_driver);
+                if (rv) {
+                        printk(KERN_ERR PFX "Unable to register "
+                               "driver: %d\n", rv);
+                        return rv;
+                }
         }
 
-
         /* Parse out the si_type string into its components. */
         str = si_type_str;
         if (*str != '\0') {
@@ -3400,24 +3431,31 @@ static int init_ipmi_si(void)
                 return 0;
 
 #ifdef CONFIG_PCI
-        rv = pci_register_driver(&ipmi_pci_driver);
-        if (rv)
-                printk(KERN_ERR PFX "Unable to register PCI driver: %d\n", rv);
-        else
-                pci_registered = 1;
+        if (si_trypci) {
+                rv = pci_register_driver(&ipmi_pci_driver);
+                if (rv)
+                        printk(KERN_ERR PFX "Unable to register "
+                               "PCI driver: %d\n", rv);
+                else
+                        pci_registered = 1;
+        }
 #endif
 
 #ifdef CONFIG_ACPI
-        pnp_register_driver(&ipmi_pnp_driver);
-        pnp_registered = 1;
+        if (si_tryacpi) {
+                pnp_register_driver(&ipmi_pnp_driver);
+                pnp_registered = 1;
+        }
 #endif
 
 #ifdef CONFIG_DMI
-        dmi_find_bmc();
+        if (si_trydmi)
+                dmi_find_bmc();
 #endif
 
 #ifdef CONFIG_ACPI
-        spmi_find_bmc();
+        if (si_tryacpi)
+                spmi_find_bmc();
 #endif
 
         /* We prefer devices with interrupts, but in the case of a machine
diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index 522136d40843..190d4423653f 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -183,19 +183,12 @@ static const struct file_operations misc_fops = {
  
 int misc_register(struct miscdevice * misc)
 {
-        struct miscdevice *c;
         dev_t dev;
         int err = 0;
 
         INIT_LIST_HEAD(&misc->list);
 
         mutex_lock(&misc_mtx);
-        list_for_each_entry(c, &misc_list, list) {
-                if (c->minor == misc->minor) {
-                        mutex_unlock(&misc_mtx);
-                        return -EBUSY;
-                }
-        }
 
         if (misc->minor == MISC_DYNAMIC_MINOR) {
                 int i = find_first_zero_bit(misc_minors, DYNAMIC_MINORS);
@@ -205,6 +198,15 @@ int misc_register(struct miscdevice * misc)
                 }
                 misc->minor = DYNAMIC_MINORS - i - 1;
                 set_bit(i, misc_minors);
+        } else {
+                struct miscdevice *c;
+
+                list_for_each_entry(c, &misc_list, list) {
+                        if (c->minor == misc->minor) {
+                                mutex_unlock(&misc_mtx);
+                                return -EBUSY;
+                        }
+                }
         }
 
         dev = MKDEV(MISC_MAJOR, misc->minor);
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index fabbfe1a9253..ed87b2405806 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -52,31 +52,29 @@ static void clk_summary_show_subtree(struct seq_file *s, struct clk *c,
                                      int level)
 {
         struct clk *child;
-        struct hlist_node *tmp;
 
         if (!c)
                 return;
 
         clk_summary_show_one(s, c, level);
 
-        hlist_for_each_entry(child, tmp, &c->children, child_node)
+        hlist_for_each_entry(child, &c->children, child_node)
                 clk_summary_show_subtree(s, child, level + 1);
 }
 
 static int clk_summary_show(struct seq_file *s, void *data)
 {
         struct clk *c;
-        struct hlist_node *tmp;
 
         seq_printf(s, "   clock                        enable_cnt  prepare_cnt  rate\n");
         seq_printf(s, "---------------------------------------------------------------------\n");
 
         mutex_lock(&prepare_lock);
 
-        hlist_for_each_entry(c, tmp, &clk_root_list, child_node)
+        hlist_for_each_entry(c, &clk_root_list, child_node)
                 clk_summary_show_subtree(s, c, 0);
 
-        hlist_for_each_entry(c, tmp, &clk_orphan_list, child_node)
+        hlist_for_each_entry(c, &clk_orphan_list, child_node)
                 clk_summary_show_subtree(s, c, 0);
 
         mutex_unlock(&prepare_lock);
@@ -111,14 +109,13 @@ static void clk_dump_one(struct seq_file *s, struct clk *c, int level)
 static void clk_dump_subtree(struct seq_file *s, struct clk *c, int level)
 {
         struct clk *child;
-        struct hlist_node *tmp;
 
         if (!c)
                 return;
 
         clk_dump_one(s, c, level);
 
-        hlist_for_each_entry(child, tmp, &c->children, child_node) {
+        hlist_for_each_entry(child, &c->children, child_node) {
                 seq_printf(s, ",");
                 clk_dump_subtree(s, child, level + 1);
         }
@@ -129,21 +126,20 @@ static void clk_dump_subtree(struct seq_file *s, struct clk *c, int level)
 static int clk_dump(struct seq_file *s, void *data)
 {
         struct clk *c;
-        struct hlist_node *tmp;
         bool first_node = true;
 
         seq_printf(s, "{");
 
         mutex_lock(&prepare_lock);
 
-        hlist_for_each_entry(c, tmp, &clk_root_list, child_node) {
+        hlist_for_each_entry(c, &clk_root_list, child_node) {
                 if (!first_node)
                         seq_printf(s, ",");
                 first_node = false;
                 clk_dump_subtree(s, c, 0);
         }
 
-        hlist_for_each_entry(c, tmp, &clk_orphan_list, child_node) {
+        hlist_for_each_entry(c, &clk_orphan_list, child_node) {
                 seq_printf(s, ",");
                 clk_dump_subtree(s, c, 0);
         }
@@ -222,7 +218,6 @@ out:
 static int clk_debug_create_subtree(struct clk *clk, struct dentry *pdentry)
 {
         struct clk *child;
-        struct hlist_node *tmp;
         int ret = -EINVAL;;
 
         if (!clk || !pdentry)
@@ -233,7 +228,7 @@ static int clk_debug_create_subtree(struct clk *clk, struct dentry *pdentry)
         if (ret)
                 goto out;
 
-        hlist_for_each_entry(child, tmp, &clk->children, child_node)
+        hlist_for_each_entry(child, &clk->children, child_node)
                 clk_debug_create_subtree(child, clk->dentry);
 
         ret = 0;
@@ -299,7 +294,6 @@ out:
 static int __init clk_debug_init(void)
 {
         struct clk *clk;
-        struct hlist_node *tmp;
         struct dentry *d;
 
         rootdir = debugfs_create_dir("clk", NULL);
@@ -324,10 +318,10 @@ static int __init clk_debug_init(void)
 
         mutex_lock(&prepare_lock);
 
-        hlist_for_each_entry(clk, tmp, &clk_root_list, child_node)
+        hlist_for_each_entry(clk, &clk_root_list, child_node)
                 clk_debug_create_subtree(clk, rootdir);
 
-        hlist_for_each_entry(clk, tmp, &clk_orphan_list, child_node)
+        hlist_for_each_entry(clk, &clk_orphan_list, child_node)
                 clk_debug_create_subtree(clk, orphandir);
 
         inited = 1;
@@ -345,13 +339,12 @@ static inline int clk_debug_register(struct clk *clk) { return 0; }
 static void clk_disable_unused_subtree(struct clk *clk)
 {
         struct clk *child;
-        struct hlist_node *tmp;
         unsigned long flags;
 
         if (!clk)
                 goto out;
 
-        hlist_for_each_entry(child, tmp, &clk->children, child_node)
+        hlist_for_each_entry(child, &clk->children, child_node)
                 clk_disable_unused_subtree(child);
 
         spin_lock_irqsave(&enable_lock, flags);
@@ -384,14 +377,13 @@ out:
 static int clk_disable_unused(void)
 {
         struct clk *clk;
-        struct hlist_node *tmp;
 
         mutex_lock(&prepare_lock);
 
-        hlist_for_each_entry(clk, tmp, &clk_root_list, child_node)
+        hlist_for_each_entry(clk, &clk_root_list, child_node)
                 clk_disable_unused_subtree(clk);
 
-        hlist_for_each_entry(clk, tmp, &clk_orphan_list, child_node)
+        hlist_for_each_entry(clk, &clk_orphan_list, child_node)
                 clk_disable_unused_subtree(clk);
 
         mutex_unlock(&prepare_lock);
@@ -484,12 +476,11 @@ static struct clk *__clk_lookup_subtree(const char *name, struct clk *clk)
 {
         struct clk *child;
         struct clk *ret;
-        struct hlist_node *tmp;
 
         if (!strcmp(clk->name, name))
                 return clk;
 
-        hlist_for_each_entry(child, tmp, &clk->children, child_node) {
+        hlist_for_each_entry(child, &clk->children, child_node) {
                 ret = __clk_lookup_subtree(name, child);
                 if (ret)
                         return ret;
@@ -502,20 +493,19 @@ struct clk *__clk_lookup(const char *name)
 {
         struct clk *root_clk;
         struct clk *ret;
-        struct hlist_node *tmp;
 
         if (!name)
                 return NULL;
 
         /* search the 'proper' clk tree first */
-        hlist_for_each_entry(root_clk, tmp, &clk_root_list, child_node) {
+        hlist_for_each_entry(root_clk, &clk_root_list, child_node) {
                 ret = __clk_lookup_subtree(name, root_clk);
                 if (ret)
                         return ret;
         }
 
         /* if not found, then search the orphan tree */
-        hlist_for_each_entry(root_clk, tmp, &clk_orphan_list, child_node) {
+        hlist_for_each_entry(root_clk, &clk_orphan_list, child_node) {
                 ret = __clk_lookup_subtree(name, root_clk);
                 if (ret)
                         return ret;
@@ -812,7 +802,6 @@ static void __clk_recalc_rates(struct clk *clk, unsigned long msg)
 {
         unsigned long old_rate;
         unsigned long parent_rate = 0;
-        struct hlist_node *tmp;
         struct clk *child;
 
         old_rate = clk->rate;
@@ -832,7 +821,7 @@ static void __clk_recalc_rates(struct clk *clk, unsigned long msg)
         if (clk->notifier_count && msg)
                 __clk_notify(clk, msg, old_rate, clk->rate);
 
-        hlist_for_each_entry(child, tmp, &clk->children, child_node)
+        hlist_for_each_entry(child, &clk->children, child_node)
                 __clk_recalc_rates(child, msg);
 }
 
@@ -878,7 +867,6 @@ EXPORT_SYMBOL_GPL(clk_get_rate);
  */
 static int __clk_speculate_rates(struct clk *clk, unsigned long parent_rate)
 {
-        struct hlist_node *tmp;
         struct clk *child;
         unsigned long new_rate;
         int ret = NOTIFY_DONE;
@@ -895,7 +883,7 @@ static int __clk_speculate_rates(struct clk *clk, unsigned long parent_rate)
         if (ret == NOTIFY_BAD)
                 goto out;
 
-        hlist_for_each_entry(child, tmp, &clk->children, child_node) {
+        hlist_for_each_entry(child, &clk->children, child_node) {
                 ret = __clk_speculate_rates(child, new_rate);
                 if (ret == NOTIFY_BAD)
                         break;
@@ -908,11 +896,10 @@ out:
 static void clk_calc_subtree(struct clk *clk, unsigned long new_rate)
 {
         struct clk *child;
-        struct hlist_node *tmp;
 
         clk->new_rate = new_rate;
 
-        hlist_for_each_entry(child, tmp, &clk->children, child_node) {
+        hlist_for_each_entry(child, &clk->children, child_node) {
                 if (child->ops->recalc_rate)
                         child->new_rate = child->ops->recalc_rate(child->hw, new_rate);
                 else
@@ -983,7 +970,6 @@ out:
  */
 static struct clk *clk_propagate_rate_change(struct clk *clk, unsigned long event)
 {
-        struct hlist_node *tmp;
         struct clk *child, *fail_clk = NULL;
         int ret = NOTIFY_DONE;
 
@@ -996,7 +982,7 @@ static struct clk *clk_propagate_rate_change(struct clk *clk, unsigned long even
                         fail_clk = clk;
         }
 
-        hlist_for_each_entry(child, tmp, &clk->children, child_node) {
+        hlist_for_each_entry(child, &clk->children, child_node) {
                 clk = clk_propagate_rate_change(child, event);
                 if (clk)
                         fail_clk = clk;
@@ -1014,7 +1000,6 @@ static void clk_change_rate(struct clk *clk)
         struct clk *child;
         unsigned long old_rate;
         unsigned long best_parent_rate = 0;
-        struct hlist_node *tmp;
 
         old_rate = clk->rate;
 
@@ -1032,7 +1017,7 @@ static void clk_change_rate(struct clk *clk)
         if (clk->notifier_count && old_rate != clk->rate)
                 __clk_notify(clk, POST_RATE_CHANGE, old_rate, clk->rate);
 
-        hlist_for_each_entry(child, tmp, &clk->children, child_node)
+        hlist_for_each_entry(child, &clk->children, child_node)
                 clk_change_rate(child);
 }
 
@@ -1348,7 +1333,7 @@ int __clk_init(struct device *dev, struct clk *clk)
 {
         int i, ret = 0;
         struct clk *orphan;
-        struct hlist_node *tmp, *tmp2;
+        struct hlist_node *tmp2;
 
         if (!clk)
                 return -EINVAL;
@@ -1448,7 +1433,7 @@ int __clk_init(struct device *dev, struct clk *clk)
          * walk the list of orphan clocks and reparent any that are children of
          * this clock
          */
-        hlist_for_each_entry_safe(orphan, tmp, tmp2, &clk_orphan_list, child_node) {
+        hlist_for_each_entry_safe(orphan, tmp2, &clk_orphan_list, child_node) {
                 if (orphan->ops->get_parent) {
                         i = orphan->ops->get_parent(orphan->hw);
                         if (!strcmp(clk->name, orphan->parent_names[i]))
diff --git a/drivers/dca/dca-sysfs.c b/drivers/dca/dca-sysfs.c
index 591b6597c00a..126cf295b198 100644
--- a/drivers/dca/dca-sysfs.c
+++ b/drivers/dca/dca-sysfs.c
@@ -53,22 +53,19 @@ void dca_sysfs_remove_req(struct dca_provider *dca, int slot)
 int dca_sysfs_add_provider(struct dca_provider *dca, struct device *dev)
 {
         struct device *cd;
-        int err = 0;
+        int ret;
 
-idr_try_again:
-        if (!idr_pre_get(&dca_idr, GFP_KERNEL))
-                return -ENOMEM;
+        idr_preload(GFP_KERNEL);
         spin_lock(&dca_idr_lock);
-        err = idr_get_new(&dca_idr, dca, &dca->id);
+
+        ret = idr_alloc(&dca_idr, dca, 0, 0, GFP_NOWAIT);
+        if (ret >= 0)
+                dca->id = ret;
+
         spin_unlock(&dca_idr_lock);
-        switch (err) {
-        case 0:
-                break;
-        case -EAGAIN:
-                goto idr_try_again;
-        default:
-                return err;
-        }
+        idr_preload_end();
+        if (ret < 0)
+                return ret;
 
         cd = device_create(dca_class, dev, MKDEV(0, 0), NULL, "dca%d", dca->id);
         if (IS_ERR(cd)) {
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 242b8c0a3de8..b2728d6ba2fd 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -686,18 +686,14 @@ static int get_dma_id(struct dma_device *device)
 {
         int rc;
 
- idr_retry:
-        if (!idr_pre_get(&dma_idr, GFP_KERNEL))
-                return -ENOMEM;
         mutex_lock(&dma_list_mutex);
-        rc = idr_get_new(&dma_idr, NULL, &device->dev_id);
-        mutex_unlock(&dma_list_mutex);
-        if (rc == -EAGAIN)
-                goto idr_retry;
-        else if (rc != 0)
-                return rc;
 
-        return 0;
+        rc = idr_alloc(&dma_idr, NULL, 0, 0, GFP_KERNEL);
+        if (rc >= 0)
+                device->dev_id = rc;
+
+        mutex_unlock(&dma_list_mutex);
+        return rc < 0 ? rc : 0;
 }
 
 /**
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index f8d22872d753..27ac423ab25e 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -487,27 +487,28 @@ static int ioctl_get_info(struct client *client, union ioctl_arg *arg)
 static int add_client_resource(struct client *client,
                                struct client_resource *resource, gfp_t gfp_mask)
 {
+        bool preload = gfp_mask & __GFP_WAIT;
         unsigned long flags;
         int ret;
 
- retry:
-        if (idr_pre_get(&client->resource_idr, gfp_mask) == 0)
-                return -ENOMEM;
-
+        if (preload)
+                idr_preload(gfp_mask);
         spin_lock_irqsave(&client->lock, flags);
+
         if (client->in_shutdown)
                 ret = -ECANCELED;
         else
-                ret = idr_get_new(&client->resource_idr, resource,
-                                  &resource->handle);
+                ret = idr_alloc(&client->resource_idr, resource, 0, 0,
+                                GFP_NOWAIT);
         if (ret >= 0) {
+                resource->handle = ret;
                 client_get(client);
                 schedule_if_iso_resource(resource);
         }
-        spin_unlock_irqrestore(&client->lock, flags);
 
-        if (ret == -EAGAIN)
-                goto retry;
+        spin_unlock_irqrestore(&client->lock, flags);
+        if (preload)
+                idr_preload_end();
 
         return ret < 0 ? ret : 0;
 }
@@ -1779,7 +1780,6 @@ static int fw_device_op_release(struct inode *inode, struct file *file)
         wait_event(client->tx_flush_wait, !has_outbound_transactions(client));
 
         idr_for_each(&client->resource_idr, shutdown_resource, client);
-        idr_remove_all(&client->resource_idr);
         idr_destroy(&client->resource_idr);
 
         list_for_each_entry_safe(event, next_event, &client->event_list, link)
diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index 3873d535b28d..03ce7d980c6a 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -1017,12 +1017,11 @@ static void fw_device_init(struct work_struct *work)
 
         fw_device_get(device);
         down_write(&fw_device_rwsem);
-        ret = idr_pre_get(&fw_device_idr, GFP_KERNEL) ?
-              idr_get_new(&fw_device_idr, device, &minor) :
-              -ENOMEM;
+        minor = idr_alloc(&fw_device_idr, device, 0, 1 << MINORBITS,
+                        GFP_KERNEL);
         up_write(&fw_device_rwsem);
 
-        if (ret < 0)
+        if (minor < 0)
                 goto error;
 
         device->device.bus = &fw_bus_type;
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 4828fe7c66cb..fff9786cdc64 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -411,15 +411,10 @@ static int gpio_setup_irq(struct gpio_desc *desc, struct device *dev,
                         goto err_out;
                 }
 
-                do {
-                        ret = -ENOMEM;
-                        if (idr_pre_get(&dirent_idr, GFP_KERNEL))
-                                ret = idr_get_new_above(&dirent_idr, value_sd,
-                                                        1, &id);
-                } while (ret == -EAGAIN);
-
-                if (ret)
+                ret = idr_alloc(&dirent_idr, value_sd, 1, 0, GFP_KERNEL);
+                if (ret < 0)
                         goto free_sd;
+                id = ret;
 
                 desc->flags &= GPIO_FLAGS_MASK;
                 desc->flags |= (unsigned long)id << ID_SHIFT;
diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c
index 45adf97e678f..725968d38976 100644
--- a/drivers/gpu/drm/drm_context.c
+++ b/drivers/gpu/drm/drm_context.c
@@ -74,24 +74,13 @@ void drm_ctxbitmap_free(struct drm_device * dev, int ctx_handle)
  */
 static int drm_ctxbitmap_next(struct drm_device * dev)
 {
-        int new_id;
         int ret;
 
-again:
-        if (idr_pre_get(&dev->ctx_idr, GFP_KERNEL) == 0) {
-                DRM_ERROR("Out of memory expanding drawable idr\n");
-                return -ENOMEM;
-        }
         mutex_lock(&dev->struct_mutex);
-        ret = idr_get_new_above(&dev->ctx_idr, NULL,
-                                DRM_RESERVED_CONTEXTS, &new_id);
+        ret = idr_alloc(&dev->ctx_idr, NULL, DRM_RESERVED_CONTEXTS, 0,
+                        GFP_KERNEL);
         mutex_unlock(&dev->struct_mutex);
-        if (ret == -EAGAIN)
-                goto again;
-        else if (ret)
-                return ret;
-
-        return new_id;
+        return ret;
 }
 
 /**
@@ -118,7 +107,7 @@ int drm_ctxbitmap_init(struct drm_device * dev)
 void drm_ctxbitmap_cleanup(struct drm_device * dev)
 {
         mutex_lock(&dev->struct_mutex);
-        idr_remove_all(&dev->ctx_idr);
+        idr_destroy(&dev->ctx_idr);
         mutex_unlock(&dev->struct_mutex);
 }
 
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 3bdf2a650d9c..792c3e3795ca 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -266,32 +266,21 @@ char *drm_get_connector_status_name(enum drm_connector_status status)
 static int drm_mode_object_get(struct drm_device *dev,
                                struct drm_mode_object *obj, uint32_t obj_type)
 {
-        int new_id = 0;
         int ret;
 
-again:
-        if (idr_pre_get(&dev->mode_config.crtc_idr, GFP_KERNEL) == 0) {
-                DRM_ERROR("Ran out memory getting a mode number\n");
-                return -ENOMEM;
-        }
-
         mutex_lock(&dev->mode_config.idr_mutex);
-        ret = idr_get_new_above(&dev->mode_config.crtc_idr, obj, 1, &new_id);
-
-        if (!ret) {
+        ret = idr_alloc(&dev->mode_config.crtc_idr, obj, 1, 0, GFP_KERNEL);
+        if (ret >= 0) {
                 /*
                  * Set up the object linking under the protection of the idr
                  * lock so that other users can't see inconsistent state.
                  */
-                obj->id = new_id;
+                obj->id = ret;
                 obj->type = obj_type;
         }
         mutex_unlock(&dev->mode_config.idr_mutex);
 
-        if (ret == -EAGAIN)
-                goto again;
-
-        return ret;
+        return ret < 0 ? ret : 0;
 }
 
 /**
@@ -1272,7 +1261,6 @@ void drm_mode_config_cleanup(struct drm_device *dev)
                 crtc->funcs->destroy(crtc);
         }
 
-        idr_remove_all(&dev->mode_config.crtc_idr);
         idr_destroy(&dev->mode_config.crtc_idr);
 }
 EXPORT_SYMBOL(drm_mode_config_cleanup);
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index be174cab105a..25f91cd23e60 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -297,7 +297,6 @@ static void __exit drm_core_exit(void)
 
         unregister_chrdev(DRM_MAJOR, "drm");
 
-        idr_remove_all(&drm_minors_idr);
         idr_destroy(&drm_minors_idr);
 }
 
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 24efae464e2c..af779ae19ebf 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -270,21 +270,19 @@ drm_gem_handle_create(struct drm_file *file_priv,
         int ret;
 
         /*
-         * Get the user-visible handle using idr.
+         * Get the user-visible handle using idr.  Preload and perform
+         * allocation under our spinlock.
          */
-again:
-        /* ensure there is space available to allocate a handle */
-        if (idr_pre_get(&file_priv->object_idr, GFP_KERNEL) == 0)
-                return -ENOMEM;
-
-        /* do the allocation under our spinlock */
+        idr_preload(GFP_KERNEL);
         spin_lock(&file_priv->table_lock);
-        ret = idr_get_new_above(&file_priv->object_idr, obj, 1, (int *)handlep);
+
+        ret = idr_alloc(&file_priv->object_idr, obj, 1, 0, GFP_NOWAIT);
+
         spin_unlock(&file_priv->table_lock);
-        if (ret == -EAGAIN)
-                goto again;
-        else if (ret)
+        idr_preload_end();
+        if (ret < 0)
                 return ret;
+        *handlep = ret;
 
         drm_gem_object_handle_reference(obj);
 
@@ -451,29 +449,25 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
         if (obj == NULL)
                 return -ENOENT;
 
-again:
-        if (idr_pre_get(&dev->object_name_idr, GFP_KERNEL) == 0) {
-                ret = -ENOMEM;
-                goto err;
-        }
-
+        idr_preload(GFP_KERNEL);
         spin_lock(&dev->object_name_lock);
         if (!obj->name) {
-                ret = idr_get_new_above(&dev->object_name_idr, obj, 1,
-                                        &obj->name);
+                ret = idr_alloc(&dev->object_name_idr, obj, 1, 0, GFP_NOWAIT);
+                obj->name = ret;
                 args->name = (uint64_t) obj->name;
                 spin_unlock(&dev->object_name_lock);
+                idr_preload_end();
 
-                if (ret == -EAGAIN)
-                        goto again;
-                else if (ret)
+                if (ret < 0)
                         goto err;
+                ret = 0;
 
                 /* Allocate a reference for the name table.  */
                 drm_gem_object_reference(obj);
         } else {
                 args->name = (uint64_t) obj->name;
                 spin_unlock(&dev->object_name_lock);
+                idr_preload_end();
                 ret = 0;
         }
 
@@ -561,8 +555,6 @@ drm_gem_release(struct drm_device *dev, struct drm_file *file_private)
 {
         idr_for_each(&file_private->object_idr,
                      &drm_gem_object_release_handle, file_private);
-
-        idr_remove_all(&file_private->object_idr);
         idr_destroy(&file_private->object_idr);
 }
 
diff --git a/drivers/gpu/drm/drm_hashtab.c b/drivers/gpu/drm/drm_hashtab.c
index 80254547a3f8..7e4bae760e27 100644
--- a/drivers/gpu/drm/drm_hashtab.c
+++ b/drivers/gpu/drm/drm_hashtab.c
@@ -60,14 +60,13 @@ void drm_ht_verbose_list(struct drm_open_hash *ht, unsigned long key)
 {
         struct drm_hash_item *entry;
         struct hlist_head *h_list;
-        struct hlist_node *list;
         unsigned int hashed_key;
         int count = 0;
 
         hashed_key = hash_long(key, ht->order);
         DRM_DEBUG("Key is 0x%08lx, Hashed key is 0x%08x\n", key, hashed_key);
         h_list = &ht->table[hashed_key];
-        hlist_for_each_entry(entry, list, h_list, head)
+        hlist_for_each_entry(entry, h_list, head)
                 DRM_DEBUG("count %d, key: 0x%08lx\n", count++, entry->key);
 }
 
@@ -76,14 +75,13 @@ static struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht,
 {
         struct drm_hash_item *entry;
         struct hlist_head *h_list;
-        struct hlist_node *list;
         unsigned int hashed_key;
 
         hashed_key = hash_long(key, ht->order);
         h_list = &ht->table[hashed_key];
-        hlist_for_each_entry(entry, list, h_list, head) {
+        hlist_for_each_entry(entry, h_list, head) {
                 if (entry->key == key)
-                        return list;
+                        return &entry->head;
                 if (entry->key > key)
                         break;
         }
@@ -95,14 +93,13 @@ static struct hlist_node *drm_ht_find_key_rcu(struct drm_open_hash *ht,
 {
         struct drm_hash_item *entry;
         struct hlist_head *h_list;
-        struct hlist_node *list;
         unsigned int hashed_key;
 
         hashed_key = hash_long(key, ht->order);
         h_list = &ht->table[hashed_key];
-        hlist_for_each_entry_rcu(entry, list, h_list, head) {
+        hlist_for_each_entry_rcu(entry, h_list, head) {
                 if (entry->key == key)
-                        return list;
+                        return &entry->head;
                 if (entry->key > key)
                         break;
         }
@@ -113,19 +110,19 @@ int drm_ht_insert_item(struct drm_open_hash *ht, struct drm_hash_item *item)
 {
         struct drm_hash_item *entry;
         struct hlist_head *h_list;
-        struct hlist_node *list, *parent;
+        struct hlist_node *parent;
         unsigned int hashed_key;
         unsigned long key = item->key;
 
         hashed_key = hash_long(key, ht->order);
         h_list = &ht->table[hashed_key];
         parent = NULL;
-        hlist_for_each_entry(entry, list, h_list, head) {
+        hlist_for_each_entry(entry, h_list, head) {
                 if (entry->key == key)
                         return -EINVAL;
                 if (entry->key > key)
                         break;
-                parent = list;
+                parent = &entry->head;
         }
         if (parent) {
                 hlist_add_after_rcu(parent, &item->head);
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index 200e104f1fa0..7d30802a018f 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -109,7 +109,6 @@ EXPORT_SYMBOL(drm_ut_debug_printk);
 
 static int drm_minor_get_id(struct drm_device *dev, int type)
 {
-        int new_id;
         int ret;
         int base = 0, limit = 63;
 
@@ -121,25 +120,11 @@ static int drm_minor_get_id(struct drm_device *dev, int type)
                 limit = base + 255;
         }
 
-again:
-        if (idr_pre_get(&drm_minors_idr, GFP_KERNEL) == 0) {
-                DRM_ERROR("Out of memory expanding drawable idr\n");
-                return -ENOMEM;
-        }
         mutex_lock(&dev->struct_mutex);
-        ret = idr_get_new_above(&drm_minors_idr, NULL,
-                                base, &new_id);
+        ret = idr_alloc(&drm_minors_idr, NULL, base, limit, GFP_KERNEL);
         mutex_unlock(&dev->struct_mutex);
-        if (ret == -EAGAIN)
-                goto again;
-        else if (ret)
-                return ret;
 
-        if (new_id >= limit) {
-                idr_remove(&drm_minors_idr, new_id);
-                return -EINVAL;
-        }
-        return new_id;
+        return ret == -ENOSPC ? -EINVAL : ret;
 }
 
 struct drm_master *drm_master_create(struct drm_minor *minor)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index 1a556354e92f..1adce07ecb5b 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -137,21 +137,15 @@ static int ipp_create_id(struct idr *id_idr, struct mutex *lock, void *obj,
 
         DRM_DEBUG_KMS("%s\n", __func__);
 
-again:
-        /* ensure there is space available to allocate a handle */
-        if (idr_pre_get(id_idr, GFP_KERNEL) == 0) {
-                DRM_ERROR("failed to get idr.\n");
-                return -ENOMEM;
-        }
-
         /* do the allocation under our mutexlock */
         mutex_lock(lock);
-        ret = idr_get_new_above(id_idr, obj, 1, (int *)idp);
+        ret = idr_alloc(id_idr, obj, 1, 0, GFP_KERNEL);
         mutex_unlock(lock);
-        if (ret == -EAGAIN)
-                goto again;
+        if (ret < 0)
+                return ret;
 
-        return ret;
+        *idp = ret;
+        return 0;
 }
 
 static void *ipp_find_obj(struct idr *id_idr, struct mutex *lock, u32 id)
@@ -1786,8 +1780,6 @@ err_iommu:
                         drm_iommu_detach_device(drm_dev, ippdrv->dev);
 
 err_idr:
-        idr_remove_all(&ctx->ipp_idr);
-        idr_remove_all(&ctx->prop_idr);
         idr_destroy(&ctx->ipp_idr);
         idr_destroy(&ctx->prop_idr);
         return ret;
@@ -1965,8 +1957,6 @@ static int ipp_remove(struct platform_device *pdev)
         exynos_drm_subdrv_unregister(&ctx->subdrv);
 
         /* remove,destroy ipp idr */
-        idr_remove_all(&ctx->ipp_idr);
-        idr_remove_all(&ctx->prop_idr);
         idr_destroy(&ctx->ipp_idr);
         idr_destroy(&ctx->prop_idr);
 
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 21177d9df423..94d873a6cffb 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -139,7 +139,7 @@ create_hw_context(struct drm_device *dev,
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct i915_hw_context *ctx;
-        int ret, id;
+        int ret;
 
         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
         if (ctx == NULL)
@@ -164,22 +164,11 @@ create_hw_context(struct drm_device *dev,
 
         ctx->file_priv = file_priv;
 
-again:
-        if (idr_pre_get(&file_priv->context_idr, GFP_KERNEL) == 0) {
-                ret = -ENOMEM;
-                DRM_DEBUG_DRIVER("idr allocation failed\n");
-                goto err_out;
-        }
-
-        ret = idr_get_new_above(&file_priv->context_idr, ctx,
-                                DEFAULT_CONTEXT_ID + 1, &id);
-        if (ret == 0)
-                ctx->id = id;
-
-        if (ret == -EAGAIN)
-                goto again;
-        else if (ret)
+        ret = idr_alloc(&file_priv->context_idr, ctx, DEFAULT_CONTEXT_ID + 1, 0,
+                        GFP_KERNEL);
+        if (ret < 0)
                 goto err_out;
+        ctx->id = ret;
 
         return ctx;
 
diff --git a/drivers/gpu/drm/sis/sis_drv.c b/drivers/gpu/drm/sis/sis_drv.c
index 841065b998a1..5a5325e6b759 100644
--- a/drivers/gpu/drm/sis/sis_drv.c
+++ b/drivers/gpu/drm/sis/sis_drv.c
@@ -58,7 +58,6 @@ static int sis_driver_unload(struct drm_device *dev)
 {
         drm_sis_private_t *dev_priv = dev->dev_private;
 
-        idr_remove_all(&dev_priv->object_idr);
         idr_destroy(&dev_priv->object_idr);
 
         kfree(dev_priv);
diff --git a/drivers/gpu/drm/sis/sis_mm.c b/drivers/gpu/drm/sis/sis_mm.c
index 2b2f78c428af..9a43d98e5003 100644
--- a/drivers/gpu/drm/sis/sis_mm.c
+++ b/drivers/gpu/drm/sis/sis_mm.c
@@ -128,17 +128,10 @@ static int sis_drm_alloc(struct drm_device *dev, struct drm_file *file,
         if (retval)
                 goto fail_alloc;
 
-again:
-        if (idr_pre_get(&dev_priv->object_idr, GFP_KERNEL) == 0) {
-                retval = -ENOMEM;
-                goto fail_idr;
-        }
-
-        retval = idr_get_new_above(&dev_priv->object_idr, item, 1, &user_key);
-        if (retval == -EAGAIN)
-                goto again;
-        if (retval)
+        retval = idr_alloc(&dev_priv->object_idr, item, 1, 0, GFP_KERNEL);
+        if (retval < 0)
                 goto fail_idr;
+        user_key = retval;
 
         list_add(&item->owner_list, &file_priv->obj_list);
         mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/via/via_map.c b/drivers/gpu/drm/via/via_map.c
index c0f1cc7f5ca9..d0ab3fb32acd 100644
--- a/drivers/gpu/drm/via/via_map.c
+++ b/drivers/gpu/drm/via/via_map.c
@@ -120,7 +120,6 @@ int via_driver_unload(struct drm_device *dev)
 {
         drm_via_private_t *dev_priv = dev->dev_private;
 
-        idr_remove_all(&dev_priv->object_idr);
         idr_destroy(&dev_priv->object_idr);
 
         kfree(dev_priv);
diff --git a/drivers/gpu/drm/via/via_mm.c b/drivers/gpu/drm/via/via_mm.c
index 0d55432e02a2..0ab93ff09873 100644
--- a/drivers/gpu/drm/via/via_mm.c
+++ b/drivers/gpu/drm/via/via_mm.c
@@ -148,17 +148,10 @@ int via_mem_alloc(struct drm_device *dev, void *data,
         if (retval)
                 goto fail_alloc;
 
-again:
-        if (idr_pre_get(&dev_priv->object_idr, GFP_KERNEL) == 0) {
-                retval = -ENOMEM;
-                goto fail_idr;
-        }
-
-        retval = idr_get_new_above(&dev_priv->object_idr, item, 1, &user_key);
-        if (retval == -EAGAIN)
-                goto again;
-        if (retval)
+        retval = idr_alloc(&dev_priv->object_idr, item, 1, 0, GFP_KERNEL);
+        if (retval < 0)
                 goto fail_idr;
+        user_key = retval;
 
         list_add(&item->owner_list, &file_priv->obj_list);
         mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 16556170fb32..bc784254e78e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -177,17 +177,16 @@ int vmw_resource_alloc_id(struct vmw_resource *res)
 
         BUG_ON(res->id != -1);
 
-        do {
-                if (unlikely(idr_pre_get(idr, GFP_KERNEL) == 0))
-                        return -ENOMEM;
-
-                write_lock(&dev_priv->resource_lock);
-                ret = idr_get_new_above(idr, res, 1, &res->id);
-                write_unlock(&dev_priv->resource_lock);
+        idr_preload(GFP_KERNEL);
+        write_lock(&dev_priv->resource_lock);
 
-        } while (ret == -EAGAIN);
+        ret = idr_alloc(idr, res, 1, 0, GFP_NOWAIT);
+        if (ret >= 0)
+                res->id = ret;
 
-        return ret;
+        write_unlock(&dev_priv->resource_lock);
+        idr_preload_end();
+        return ret < 0 ? ret : 0;
 }
 
 /**
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 66a30f7ac882..991d38daa87d 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -935,25 +935,17 @@ out_list:
  */
 int i2c_add_adapter(struct i2c_adapter *adapter)
 {
-        int     id, res = 0;
-
-retry:
-        if (idr_pre_get(&i2c_adapter_idr, GFP_KERNEL) == 0)
-                return -ENOMEM;
+        int id;
 
         mutex_lock(&core_lock);
-        /* "above" here means "above or equal to", sigh */
-        res = idr_get_new_above(&i2c_adapter_idr, adapter,
-                                __i2c_first_dynamic_bus_num, &id);
+        id = idr_alloc(&i2c_adapter_idr, adapter,
+                       __i2c_first_dynamic_bus_num, 0, GFP_KERNEL);
         mutex_unlock(&core_lock);
-
-        if (res < 0) {
-                if (res == -EAGAIN)
-                        goto retry;
-                return res;
-        }
+        if (id < 0)
+                return id;
 
         adapter->nr = id;
+
         return i2c_register_adapter(adapter);
 }
 EXPORT_SYMBOL(i2c_add_adapter);
@@ -984,33 +976,17 @@ EXPORT_SYMBOL(i2c_add_adapter);
 int i2c_add_numbered_adapter(struct i2c_adapter *adap)
 {
         int     id;
-        int     status;
 
         if (adap->nr == -1) /* -1 means dynamically assign bus id */
                 return i2c_add_adapter(adap);
-        if (adap->nr & ~MAX_IDR_MASK)
-                return -EINVAL;
-
-retry:
-        if (idr_pre_get(&i2c_adapter_idr, GFP_KERNEL) == 0)
-                return -ENOMEM;
 
         mutex_lock(&core_lock);
-        /* "above" here means "above or equal to", sigh;
-         * we need the "equal to" result to force the result
-         */
-        status = idr_get_new_above(&i2c_adapter_idr, adap, adap->nr, &id);
-        if (status == 0 && id != adap->nr) {
-                status = -EBUSY;
-                idr_remove(&i2c_adapter_idr, id);
-        }
+        id = idr_alloc(&i2c_adapter_idr, adap, adap->nr, adap->nr + 1,
+                       GFP_KERNEL);
         mutex_unlock(&core_lock);
-        if (status == -EAGAIN)
-                goto retry;
-
-        if (status == 0)
-                status = i2c_register_adapter(adap);
-        return status;
+        if (id < 0)
+                return id == -ENOSPC ? -EBUSY : id;
+        return i2c_register_adapter(adap);
 }
 EXPORT_SYMBOL_GPL(i2c_add_numbered_adapter);
 
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 394fea2ba1bc..784b97cb05b0 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -382,20 +382,21 @@ static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
 static int cm_alloc_id(struct cm_id_private *cm_id_priv)
 {
         unsigned long flags;
-        int ret, id;
+        int id;
         static int next_id;
 
-        do {
-                spin_lock_irqsave(&cm.lock, flags);
-                ret = idr_get_new_above(&cm.local_id_table, cm_id_priv,
-                                        next_id, &id);
-                if (!ret)
-                        next_id = ((unsigned) id + 1) & MAX_IDR_MASK;
-                spin_unlock_irqrestore(&cm.lock, flags);
-        } while( (ret == -EAGAIN) && idr_pre_get(&cm.local_id_table, GFP_KERNEL) );
+        idr_preload(GFP_KERNEL);
+        spin_lock_irqsave(&cm.lock, flags);
+
+        id = idr_alloc(&cm.local_id_table, cm_id_priv, next_id, 0, GFP_NOWAIT);
+        if (id >= 0)
+                next_id = max(id + 1, 0);
+
+        spin_unlock_irqrestore(&cm.lock, flags);
+        idr_preload_end();
 
         cm_id_priv->id.local_id = (__force __be32)id ^ cm.random_id_operand;
-        return ret;
+        return id < 0 ? id : 0;
 }
 
 static void cm_free_id(__be32 local_id)
@@ -3844,7 +3845,6 @@ static int __init ib_cm_init(void)
         cm.remote_sidr_table = RB_ROOT;
         idr_init(&cm.local_id_table);
         get_random_bytes(&cm.random_id_operand, sizeof cm.random_id_operand);
-        idr_pre_get(&cm.local_id_table, GFP_KERNEL);
         INIT_LIST_HEAD(&cm.timewait_list);
 
         ret = class_register(&cm_class);
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index d789eea32168..71c2c7116802 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2143,33 +2143,23 @@ static int cma_alloc_port(struct idr *ps, struct rdma_id_private *id_priv,
                           unsigned short snum)
 {
         struct rdma_bind_list *bind_list;
-        int port, ret;
+        int ret;
 
         bind_list = kzalloc(sizeof *bind_list, GFP_KERNEL);
         if (!bind_list)
                 return -ENOMEM;
 
-        do {
-                ret = idr_get_new_above(ps, bind_list, snum, &port);
-        } while ((ret == -EAGAIN) && idr_pre_get(ps, GFP_KERNEL));
-
-        if (ret)
-                goto err1;
-
-        if (port != snum) {
-                ret = -EADDRNOTAVAIL;
-                goto err2;
-        }
+        ret = idr_alloc(ps, bind_list, snum, snum + 1, GFP_KERNEL);
+        if (ret < 0)
+                goto err;
 
         bind_list->ps = ps;
-        bind_list->port = (unsigned short) port;
+        bind_list->port = (unsigned short)ret;
         cma_bind_port(bind_list, id_priv);
         return 0;
-err2:
-        idr_remove(ps, port);
-err1:
+err:
         kfree(bind_list);
-        return ret;
+        return ret == -ENOSPC ? -EADDRNOTAVAIL : ret;
 }
 
 static int cma_alloc_any_port(struct idr *ps, struct rdma_id_private *id_priv)
@@ -2214,10 +2204,9 @@ static int cma_check_port(struct rdma_bind_list *bind_list,
 {
         struct rdma_id_private *cur_id;
         struct sockaddr *addr, *cur_addr;
-        struct hlist_node *node;
 
         addr = (struct sockaddr *) &id_priv->id.route.addr.src_addr;
-        hlist_for_each_entry(cur_id, node, &bind_list->owners, node) {
+        hlist_for_each_entry(cur_id, &bind_list->owners, node) {
                 if (id_priv == cur_id)
                         continue;
 
diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
index 176c8f90f2bb..9f5ad7cc33c8 100644
--- a/drivers/infiniband/core/fmr_pool.c
+++ b/drivers/infiniband/core/fmr_pool.c
@@ -118,14 +118,13 @@ static inline struct ib_pool_fmr *ib_fmr_cache_lookup(struct ib_fmr_pool *pool,
 {
         struct hlist_head *bucket;
         struct ib_pool_fmr *fmr;
-        struct hlist_node *pos;
 
         if (!pool->cache_bucket)
                 return NULL;
 
         bucket = pool->cache_bucket + ib_fmr_hash(*page_list);
 
-        hlist_for_each_entry(fmr, pos, bucket, cache_node)
+        hlist_for_each_entry(fmr, bucket, cache_node)
                 if (io_virtual_address == fmr->io_virtual_address &&
                     page_list_len      == fmr->page_list_len      &&
                     !memcmp(page_list, fmr->page_list,
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index a8905abc56e4..934f45e79e5e 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -611,19 +611,21 @@ static void init_mad(struct ib_sa_mad *mad, struct ib_mad_agent *agent)
 
 static int send_mad(struct ib_sa_query *query, int timeout_ms, gfp_t gfp_mask)
 {
+        bool preload = gfp_mask & __GFP_WAIT;
         unsigned long flags;
         int ret, id;
 
-retry:
-        if (!idr_pre_get(&query_idr, gfp_mask))
-                return -ENOMEM;
+        if (preload)
+                idr_preload(gfp_mask);
         spin_lock_irqsave(&idr_lock, flags);
-        ret = idr_get_new(&query_idr, query, &id);
+
+        id = idr_alloc(&query_idr, query, 0, 0, GFP_NOWAIT);
+
         spin_unlock_irqrestore(&idr_lock, flags);
-        if (ret == -EAGAIN)
-                goto retry;
-        if (ret)
-                return ret;
+        if (preload)
+                idr_preload_end();
+        if (id < 0)
+                return id;
 
         query->mad_buf->timeout_ms  = timeout_ms;
         query->mad_buf->context[0] = query;
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 49b15ac1987e..f2f63933e8a9 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -176,7 +176,6 @@ static void ib_ucm_cleanup_events(struct ib_ucm_context *ctx)
 static struct ib_ucm_context *ib_ucm_ctx_alloc(struct ib_ucm_file *file)
 {
         struct ib_ucm_context *ctx;
-        int result;
 
         ctx = kzalloc(sizeof *ctx, GFP_KERNEL);
         if (!ctx)
@@ -187,17 +186,10 @@ static struct ib_ucm_context *ib_ucm_ctx_alloc(struct ib_ucm_file *file)
         ctx->file = file;
         INIT_LIST_HEAD(&ctx->events);
 
-        do {
-                result = idr_pre_get(&ctx_id_table, GFP_KERNEL);
-                if (!result)
-                        goto error;
-
-                mutex_lock(&ctx_id_mutex);
-                result = idr_get_new(&ctx_id_table, ctx, &ctx->id);
-                mutex_unlock(&ctx_id_mutex);
-        } while (result == -EAGAIN);
-
-        if (result)
+        mutex_lock(&ctx_id_mutex);
+        ctx->id = idr_alloc(&ctx_id_table, ctx, 0, 0, GFP_KERNEL);
+        mutex_unlock(&ctx_id_mutex);
+        if (ctx->id < 0)
                 goto error;
 
         list_add_tail(&ctx->file_list, &file->ctxs);
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 2709ff581392..5ca44cd9b00c 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -145,7 +145,6 @@ static void ucma_put_ctx(struct ucma_context *ctx)
 static struct ucma_context *ucma_alloc_ctx(struct ucma_file *file)
 {
         struct ucma_context *ctx;
-        int ret;
 
         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
         if (!ctx)
@@ -156,17 +155,10 @@ static struct ucma_context *ucma_alloc_ctx(struct ucma_file *file)
         INIT_LIST_HEAD(&ctx->mc_list);
         ctx->file = file;
 
-        do {
-                ret = idr_pre_get(&ctx_idr, GFP_KERNEL);
-                if (!ret)
-                        goto error;
-
-                mutex_lock(&mut);
-                ret = idr_get_new(&ctx_idr, ctx, &ctx->id);
-                mutex_unlock(&mut);
-        } while (ret == -EAGAIN);
-
-        if (ret)
+        mutex_lock(&mut);
+        ctx->id = idr_alloc(&ctx_idr, ctx, 0, 0, GFP_KERNEL);
+        mutex_unlock(&mut);
+        if (ctx->id < 0)
                 goto error;
 
         list_add_tail(&ctx->list, &file->ctx_list);
@@ -180,23 +172,15 @@ error:
 static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx)
 {
         struct ucma_multicast *mc;
-        int ret;
 
         mc = kzalloc(sizeof(*mc), GFP_KERNEL);
         if (!mc)
                 return NULL;
 
-        do {
-                ret = idr_pre_get(&multicast_idr, GFP_KERNEL);
-                if (!ret)
-                        goto error;
-
-                mutex_lock(&mut);
-                ret = idr_get_new(&multicast_idr, mc, &mc->id);
-                mutex_unlock(&mut);
-        } while (ret == -EAGAIN);
-
-        if (ret)
+        mutex_lock(&mut);
+        mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL);
+        mutex_unlock(&mut);
+        if (mc->id < 0)
                 goto error;
 
         mc->ctx = ctx;
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index e71d834c922a..a7d00f6b3bc1 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -125,18 +125,17 @@ static int idr_add_uobj(struct idr *idr, struct ib_uobject *uobj)
 {
         int ret;
 
-retry:
-        if (!idr_pre_get(idr, GFP_KERNEL))
-                return -ENOMEM;
-
+        idr_preload(GFP_KERNEL);
         spin_lock(&ib_uverbs_idr_lock);
-        ret = idr_get_new(idr, uobj, &uobj->id);
-        spin_unlock(&ib_uverbs_idr_lock);
 
-        if (ret == -EAGAIN)
-                goto retry;
+        ret = idr_alloc(idr, uobj, 0, 0, GFP_NOWAIT);
+        if (ret >= 0)
+                uobj->id = ret;
 
-        return ret;
+        spin_unlock(&ib_uverbs_idr_lock);
+        idr_preload_end();
+
+        return ret < 0 ? ret : 0;
 }
 
 void idr_remove_uobj(struct idr *idr, struct ib_uobject *uobj)
diff --git a/drivers/infiniband/hw/amso1100/c2_qp.c b/drivers/infiniband/hw/amso1100/c2_qp.c
index 28cd5cb51859..0ab826b280b2 100644
--- a/drivers/infiniband/hw/amso1100/c2_qp.c
+++ b/drivers/infiniband/hw/amso1100/c2_qp.c
@@ -382,14 +382,17 @@ static int c2_alloc_qpn(struct c2_dev *c2dev, struct c2_qp *qp)
 {
         int ret;
 
-        do {
-                spin_lock_irq(&c2dev->qp_table.lock);
-                ret = idr_get_new_above(&c2dev->qp_table.idr, qp,
-                                        c2dev->qp_table.last++, &qp->qpn);
-                spin_unlock_irq(&c2dev->qp_table.lock);
-        } while ((ret == -EAGAIN) &&
-                 idr_pre_get(&c2dev->qp_table.idr, GFP_KERNEL));
-        return ret;
+        idr_preload(GFP_KERNEL);
+        spin_lock_irq(&c2dev->qp_table.lock);
+
+        ret = idr_alloc(&c2dev->qp_table.idr, qp, c2dev->qp_table.last++, 0,
+                        GFP_NOWAIT);
+        if (ret >= 0)
+                qp->qpn = ret;
+
+        spin_unlock_irq(&c2dev->qp_table.lock);
+        idr_preload_end();
+        return ret < 0 ? ret : 0;
 }
 
 static void c2_free_qpn(struct c2_dev *c2dev, int qpn)
diff --git a/drivers/infiniband/hw/cxgb3/iwch.h b/drivers/infiniband/hw/cxgb3/iwch.h
index a1c44578e039..837862287a29 100644
--- a/drivers/infiniband/hw/cxgb3/iwch.h
+++ b/drivers/infiniband/hw/cxgb3/iwch.h
@@ -153,19 +153,17 @@ static inline int insert_handle(struct iwch_dev *rhp, struct idr *idr,
                                 void *handle, u32 id)
 {
         int ret;
-        int newid;
-
-        do {
-                if (!idr_pre_get(idr, GFP_KERNEL)) {
-                        return -ENOMEM;
-                }
-                spin_lock_irq(&rhp->lock);
-                ret = idr_get_new_above(idr, handle, id, &newid);
-                BUG_ON(newid != id);
-                spin_unlock_irq(&rhp->lock);
-        } while (ret == -EAGAIN);
-
-        return ret;
+
+        idr_preload(GFP_KERNEL);
+        spin_lock_irq(&rhp->lock);
+
+        ret = idr_alloc(idr, handle, id, id + 1, GFP_NOWAIT);
+
+        spin_unlock_irq(&rhp->lock);
+        idr_preload_end();
+
+        BUG_ON(ret == -ENOSPC);
+        return ret < 0 ? ret : 0;
 }
 
 static inline void remove_handle(struct iwch_dev *rhp, struct idr *idr, u32 id)
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index 4c07fc069766..7eec5e13fa8c 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -260,20 +260,21 @@ static inline int _insert_handle(struct c4iw_dev *rhp, struct idr *idr,
                                  void *handle, u32 id, int lock)
 {
         int ret;
-        int newid;
 
-        do {
-                if (!idr_pre_get(idr, lock ? GFP_KERNEL : GFP_ATOMIC))
-                        return -ENOMEM;
-                if (lock)
-                        spin_lock_irq(&rhp->lock);
-                ret = idr_get_new_above(idr, handle, id, &newid);
-                BUG_ON(!ret && newid != id);
-                if (lock)
-                        spin_unlock_irq(&rhp->lock);
-        } while (ret == -EAGAIN);
-
-        return ret;
+        if (lock) {
+                idr_preload(GFP_KERNEL);
+                spin_lock_irq(&rhp->lock);
+        }
+
+        ret = idr_alloc(idr, handle, id, id + 1, GFP_ATOMIC);
+
+        if (lock) {
+                spin_unlock_irq(&rhp->lock);
+                idr_preload_end();
+        }
+
+        BUG_ON(ret == -ENOSPC);
+        return ret < 0 ? ret : 0;
 }
 
 static inline int insert_handle(struct c4iw_dev *rhp, struct idr *idr,
diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/infiniband/hw/ehca/ehca_cq.c
index 8f5290147e8a..212150c25ea0 100644
--- a/drivers/infiniband/hw/ehca/ehca_cq.c
+++ b/drivers/infiniband/hw/ehca/ehca_cq.c
@@ -128,7 +128,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe, int comp_vector,
         void *vpage;
         u32 counter;
         u64 rpage, cqx_fec, h_ret;
-        int ipz_rc, ret, i;
+        int ipz_rc, i;
         unsigned long flags;
 
         if (cqe >= 0xFFFFFFFF - 64 - additional_cqe)
@@ -163,32 +163,19 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe, int comp_vector,
         adapter_handle = shca->ipz_hca_handle;
         param.eq_handle = shca->eq.ipz_eq_handle;
 
-        do {
-                if (!idr_pre_get(&ehca_cq_idr, GFP_KERNEL)) {
-                        cq = ERR_PTR(-ENOMEM);
-                        ehca_err(device, "Can't reserve idr nr. device=%p",
-                                 device);
-                        goto create_cq_exit1;
-                }
-
-                write_lock_irqsave(&ehca_cq_idr_lock, flags);
-                ret = idr_get_new(&ehca_cq_idr, my_cq, &my_cq->token);
-                write_unlock_irqrestore(&ehca_cq_idr_lock, flags);
-        } while (ret == -EAGAIN);
+        idr_preload(GFP_KERNEL);
+        write_lock_irqsave(&ehca_cq_idr_lock, flags);
+        my_cq->token = idr_alloc(&ehca_cq_idr, my_cq, 0, 0x2000000, GFP_NOWAIT);
+        write_unlock_irqrestore(&ehca_cq_idr_lock, flags);
+        idr_preload_end();
 
-        if (ret) {
+        if (my_cq->token < 0) {
                 cq = ERR_PTR(-ENOMEM);
                 ehca_err(device, "Can't allocate new idr entry. device=%p",
                          device);
                 goto create_cq_exit1;
         }
 
-        if (my_cq->token > 0x1FFFFFF) {
-                cq = ERR_PTR(-ENOMEM);
-                ehca_err(device, "Invalid number of cq. device=%p", device);
-                goto create_cq_exit2;
-        }
-
         /*
          * CQs maximum depth is 4GB-64, but we need additional 20 as buffer
          * for receiving errors CQEs.
diff --git a/drivers/infiniband/hw/ehca/ehca_qp.c b/drivers/infiniband/hw/ehca/ehca_qp.c
index 149393915ae5..00d6861a6a18 100644
--- a/drivers/infiniband/hw/ehca/ehca_qp.c
+++ b/drivers/infiniband/hw/ehca/ehca_qp.c
@@ -636,30 +636,26 @@ static struct ehca_qp *internal_create_qp(
                 my_qp->send_cq =
                         container_of(init_attr->send_cq, struct ehca_cq, ib_cq);
 
-        do {
-                if (!idr_pre_get(&ehca_qp_idr, GFP_KERNEL)) {
-                        ret = -ENOMEM;
-                        ehca_err(pd->device, "Can't reserve idr resources.");
-                        goto create_qp_exit0;
-                }
+        idr_preload(GFP_KERNEL);
+        write_lock_irqsave(&ehca_qp_idr_lock, flags);
 
-                write_lock_irqsave(&ehca_qp_idr_lock, flags);
-                ret = idr_get_new(&ehca_qp_idr, my_qp, &my_qp->token);
-                write_unlock_irqrestore(&ehca_qp_idr_lock, flags);
-        } while (ret == -EAGAIN);
+        ret = idr_alloc(&ehca_qp_idr, my_qp, 0, 0x2000000, GFP_NOWAIT);
+        if (ret >= 0)
+                my_qp->token = ret;
 
-        if (ret) {
-                ret = -ENOMEM;
-                ehca_err(pd->device, "Can't allocate new idr entry.");
+        write_unlock_irqrestore(&ehca_qp_idr_lock, flags);
+        idr_preload_end();
+        if (ret < 0) {
+                if (ret == -ENOSPC) {
+                        ret = -EINVAL;
+                        ehca_err(pd->device, "Invalid number of qp");
+                } else {
+                        ret = -ENOMEM;
+                        ehca_err(pd->device, "Can't allocate new idr entry.");
+                }
                 goto create_qp_exit0;
         }
 
-        if (my_qp->token > 0x1FFFFFF) {
-                ret = -EINVAL;
-                ehca_err(pd->device, "Invalid number of qp");
-                goto create_qp_exit1;
-        }
-
         if (has_srq)
                 parms.srq_token = my_qp->token;
 
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 7b371f545ece..bd0caedafe99 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -194,11 +194,6 @@ static struct ipath_devdata *ipath_alloc_devdata(struct pci_dev *pdev)
         struct ipath_devdata *dd;
         int ret;
 
-        if (!idr_pre_get(&unit_table, GFP_KERNEL)) {
-                dd = ERR_PTR(-ENOMEM);
-                goto bail;
-        }
-
         dd = vzalloc(sizeof(*dd));
         if (!dd) {
                 dd = ERR_PTR(-ENOMEM);
@@ -206,9 +201,10 @@ static struct ipath_devdata *ipath_alloc_devdata(struct pci_dev *pdev)
         }
         dd->ipath_unit = -1;
 
+        idr_preload(GFP_KERNEL);
         spin_lock_irqsave(&ipath_devs_lock, flags);
 
-        ret = idr_get_new(&unit_table, dd, &dd->ipath_unit);
+        ret = idr_alloc(&unit_table, dd, 0, 0, GFP_NOWAIT);
         if (ret < 0) {
                 printk(KERN_ERR IPATH_DRV_NAME
                        ": Could not allocate unit ID: error %d\n", -ret);
@@ -216,6 +212,7 @@ static struct ipath_devdata *ipath_alloc_devdata(struct pci_dev *pdev)
                 dd = ERR_PTR(ret);
                 goto bail_unlock;
         }
+        dd->ipath_unit = ret;
 
         dd->pcidev = pdev;
         pci_set_drvdata(pdev, dd);
@@ -224,7 +221,7 @@ static struct ipath_devdata *ipath_alloc_devdata(struct pci_dev *pdev)
 
 bail_unlock:
         spin_unlock_irqrestore(&ipath_devs_lock, flags);
-
+        idr_preload_end();
 bail:
         return dd;
 }
@@ -2503,11 +2500,6 @@ static int __init infinipath_init(void)
          * the PCI subsystem.
          */
         idr_init(&unit_table);
-        if (!idr_pre_get(&unit_table, GFP_KERNEL)) {
-                printk(KERN_ERR IPATH_DRV_NAME ": idr_pre_get() failed\n");
-                ret = -ENOMEM;
-                goto bail;
-        }
 
         ret = pci_register_driver(&ipath_driver);
         if (ret < 0) {
diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c
index dbc99d41605c..e0d79b2395e4 100644
--- a/drivers/infiniband/hw/mlx4/cm.c
+++ b/drivers/infiniband/hw/mlx4/cm.c
@@ -203,7 +203,7 @@ static void sl_id_map_add(struct ib_device *ibdev, struct id_map_entry *new)
 static struct id_map_entry *
 id_map_alloc(struct ib_device *ibdev, int slave_id, u32 sl_cm_id)
 {
-        int ret, id;
+        int ret;
         static int next_id;
         struct id_map_entry *ent;
         struct mlx4_ib_sriov *sriov = &to_mdev(ibdev)->sriov;
@@ -220,25 +220,23 @@ id_map_alloc(struct ib_device *ibdev, int slave_id, u32 sl_cm_id)
         ent->dev = to_mdev(ibdev);
         INIT_DELAYED_WORK(&ent->timeout, id_map_ent_timeout);
 
-        do {
-                spin_lock(&to_mdev(ibdev)->sriov.id_map_lock);
-                ret = idr_get_new_above(&sriov->pv_id_table, ent,
-                                        next_id, &id);
-                if (!ret) {
-                        next_id = ((unsigned) id + 1) & MAX_IDR_MASK;
-                        ent->pv_cm_id = (u32)id;
-                        sl_id_map_add(ibdev, ent);
-                }
+        idr_preload(GFP_KERNEL);
+        spin_lock(&to_mdev(ibdev)->sriov.id_map_lock);
 
-                spin_unlock(&sriov->id_map_lock);
-        } while (ret == -EAGAIN && idr_pre_get(&sriov->pv_id_table, GFP_KERNEL));
-        /*the function idr_get_new_above can return -ENOSPC, so don't insert in that case.*/
-        if (!ret) {
-                spin_lock(&sriov->id_map_lock);
+        ret = idr_alloc(&sriov->pv_id_table, ent, next_id, 0, GFP_NOWAIT);
+        if (ret >= 0) {
+                next_id = max(ret + 1, 0);
+                ent->pv_cm_id = (u32)ret;
+                sl_id_map_add(ibdev, ent);
                 list_add_tail(&ent->list, &sriov->cm_list);
-                spin_unlock(&sriov->id_map_lock);
-                return ent;
         }
+
+        spin_unlock(&sriov->id_map_lock);
+        idr_preload_end();
+
+        if (ret >= 0)
+                return ent;
+
         /*error flow*/
         kfree(ent);
         mlx4_ib_warn(ibdev, "No more space in the idr (err:0x%x)\n", ret);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index c4e0131f1b57..48928c8e7774 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -51,18 +51,6 @@ static DEFINE_IDR(ocrdma_dev_id);
 
 static union ib_gid ocrdma_zero_sgid;
 
-static int ocrdma_get_instance(void)
-{
-        int instance = 0;
-
-        /* Assign an unused number */
-        if (!idr_pre_get(&ocrdma_dev_id, GFP_KERNEL))
-                return -1;
-        if (idr_get_new(&ocrdma_dev_id, NULL, &instance))
-                return -1;
-        return instance;
-}
-
 void ocrdma_get_guid(struct ocrdma_dev *dev, u8 *guid)
 {
         u8 mac_addr[6];
@@ -416,7 +404,7 @@ static struct ocrdma_dev *ocrdma_add(struct be_dev_info *dev_info)
                 goto idr_err;
 
         memcpy(&dev->nic_info, dev_info, sizeof(*dev_info));
-        dev->id = ocrdma_get_instance();
+        dev->id = idr_alloc(&ocrdma_dev_id, NULL, 0, 0, GFP_KERNEL);
         if (dev->id < 0)
                 goto idr_err;
 
diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c
index ddf066d9abb6..50e33aa0b4e3 100644
--- a/drivers/infiniband/hw/qib/qib_init.c
+++ b/drivers/infiniband/hw/qib/qib_init.c
@@ -1060,22 +1060,23 @@ struct qib_devdata *qib_alloc_devdata(struct pci_dev *pdev, size_t extra)
         struct qib_devdata *dd;
         int ret;
 
-        if (!idr_pre_get(&qib_unit_table, GFP_KERNEL)) {
-                dd = ERR_PTR(-ENOMEM);
-                goto bail;
-        }
-
         dd = (struct qib_devdata *) ib_alloc_device(sizeof(*dd) + extra);
         if (!dd) {
                 dd = ERR_PTR(-ENOMEM);
                 goto bail;
         }
 
+        idr_preload(GFP_KERNEL);
         spin_lock_irqsave(&qib_devs_lock, flags);
-        ret = idr_get_new(&qib_unit_table, dd, &dd->unit);
-        if (ret >= 0)
+
+        ret = idr_alloc(&qib_unit_table, dd, 0, 0, GFP_NOWAIT);
+        if (ret >= 0) {
+                dd->unit = ret;
                 list_add(&dd->list, &qib_dev_list);
+        }
+
         spin_unlock_irqrestore(&qib_devs_lock, flags);
+        idr_preload_end();
 
         if (ret < 0) {
                 qib_early_err(&pdev->dev,
@@ -1180,11 +1181,6 @@ static int __init qlogic_ib_init(void)
          * the PCI subsystem.
          */
         idr_init(&qib_unit_table);
-        if (!idr_pre_get(&qib_unit_table, GFP_KERNEL)) {
-                pr_err("idr_pre_get() failed\n");
-                ret = -ENOMEM;
-                goto bail_cq_wq;
-        }
 
         ret = pci_register_driver(&qib_driver);
         if (ret < 0) {
@@ -1199,7 +1195,6 @@ static int __init qlogic_ib_init(void)
 
 bail_unit:
         idr_destroy(&qib_unit_table);
-bail_cq_wq:
         destroy_workqueue(qib_cq_wq);
 bail_dev:
         qib_dev_cleanup();
diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index abe2d699b6f3..8b07f83d48ad 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -483,7 +483,6 @@ data_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 {
         struct sockaddr_mISDN *maddr = (struct sockaddr_mISDN *) addr;
         struct sock *sk = sock->sk;
-        struct hlist_node *node;
         struct sock *csk;
         int err = 0;
 
@@ -508,7 +507,7 @@ data_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 
         if (sk->sk_protocol < ISDN_P_B_START) {
                 read_lock_bh(&data_sockets.lock);
-                sk_for_each(csk, node, &data_sockets.head) {
+                sk_for_each(csk, &data_sockets.head) {
                         if (sk == csk)
                                 continue;
                         if (_pms(csk)->dev != _pms(sk)->dev)
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index deda591f70b9..9cb4b621fbc3 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -64,12 +64,11 @@ unlock:
 static void
 send_socklist(struct mISDN_sock_list *sl, struct sk_buff *skb)
 {
-        struct hlist_node       *node;
         struct sock             *sk;
         struct sk_buff          *cskb = NULL;
 
         read_lock(&sl->lock);
-        sk_for_each(sk, node, &sl->head) {
+        sk_for_each(sk, &sl->head) {
                 if (sk->sk_state != MISDN_BOUND)
                         continue;
                 if (!cskb)
diff --git a/drivers/md/dm-bio-prison.c b/drivers/md/dm-bio-prison.c
index aefb78e3cbf9..d9d3f1c7b662 100644
--- a/drivers/md/dm-bio-prison.c
+++ b/drivers/md/dm-bio-prison.c
@@ -106,9 +106,8 @@ static struct dm_bio_prison_cell *__search_bucket(struct hlist_head *bucket,
                                                   struct dm_cell_key *key)
 {
         struct dm_bio_prison_cell *cell;
-        struct hlist_node *tmp;
 
-        hlist_for_each_entry(cell, tmp, bucket, list)
+        hlist_for_each_entry(cell, bucket, list)
                 if (keys_equal(&cell->key, key))
                         return cell;
 
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 651ca79881dd..93205e32a004 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -859,9 +859,8 @@ static void __check_watermark(struct dm_bufio_client *c)
 static struct dm_buffer *__find(struct dm_bufio_client *c, sector_t block)
 {
         struct dm_buffer *b;
-        struct hlist_node *hn;
 
-        hlist_for_each_entry(b, hn, &c->cache_hash[DM_BUFIO_HASH(block)],
+        hlist_for_each_entry(b, &c->cache_hash[DM_BUFIO_HASH(block)],
                              hash_list) {
                 dm_bufio_cond_resched();
                 if (b->block == block)
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 59fc18ae52c2..10079e07edf4 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -227,12 +227,11 @@ static void stop_tracking_chunk(struct dm_snapshot *s, struct bio *bio)
 static int __chunk_is_tracked(struct dm_snapshot *s, chunk_t chunk)
 {
         struct dm_snap_tracked_chunk *c;
-        struct hlist_node *hn;
         int found = 0;
 
         spin_lock_irq(&s->tracked_chunk_lock);
 
-        hlist_for_each_entry(c, hn,
+        hlist_for_each_entry(c,
             &s->tracked_chunk_hash[DM_TRACKED_CHUNK_HASH(chunk)], node) {
                 if (c->chunk == chunk) {
                         found = 1;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 314a0e2faf79..e67a4be0080d 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -318,7 +318,6 @@ static void __exit dm_exit(void)
         /*
          * Should be empty by this point.
          */
-        idr_remove_all(&_minor_idr);
         idr_destroy(&_minor_idr);
 }
 
@@ -1756,62 +1755,38 @@ static void free_minor(int minor)
  */
 static int specific_minor(int minor)
 {
-        int r, m;
+        int r;
 
         if (minor >= (1 << MINORBITS))
                 return -EINVAL;
 
-        r = idr_pre_get(&_minor_idr, GFP_KERNEL);
-        if (!r)
-                return -ENOMEM;
-
+        idr_preload(GFP_KERNEL);
         spin_lock(&_minor_lock);
 
-        if (idr_find(&_minor_idr, minor)) {
-                r = -EBUSY;
-                goto out;
-        }
-
-        r = idr_get_new_above(&_minor_idr, MINOR_ALLOCED, minor, &m);
-        if (r)
-                goto out;
+        r = idr_alloc(&_minor_idr, MINOR_ALLOCED, minor, minor + 1, GFP_NOWAIT);
 
-        if (m != minor) {
-                idr_remove(&_minor_idr, m);
-                r = -EBUSY;
-                goto out;
-        }
-
-out:
         spin_unlock(&_minor_lock);
-        return r;
+        idr_preload_end();
+        if (r < 0)
+                return r == -ENOSPC ? -EBUSY : r;
+        return 0;
 }
 
 static int next_free_minor(int *minor)
 {
-        int r, m;
-
-        r = idr_pre_get(&_minor_idr, GFP_KERNEL);
-        if (!r)
-                return -ENOMEM;
+        int r;
 
+        idr_preload(GFP_KERNEL);
         spin_lock(&_minor_lock);
 
-        r = idr_get_new(&_minor_idr, MINOR_ALLOCED, &m);
-        if (r)
-                goto out;
-
-        if (m >= (1 << MINORBITS)) {
-                idr_remove(&_minor_idr, m);
-                r = -ENOSPC;
-                goto out;
-        }
-
-        *minor = m;
+        r = idr_alloc(&_minor_idr, MINOR_ALLOCED, 0, 1 << MINORBITS, GFP_NOWAIT);
 
-out:
         spin_unlock(&_minor_lock);
-        return r;
+        idr_preload_end();
+        if (r < 0)
+                return r;
+        *minor = r;
+        return 0;
 }
 
 static const struct block_device_operations dm_blk_dops;
diff --git a/drivers/md/persistent-data/dm-transaction-manager.c b/drivers/md/persistent-data/dm-transaction-manager.c
index 7b17a1fdeaf9..81da1a26042e 100644
--- a/drivers/md/persistent-data/dm-transaction-manager.c
+++ b/drivers/md/persistent-data/dm-transaction-manager.c
@@ -46,10 +46,9 @@ static int is_shadow(struct dm_transaction_manager *tm, dm_block_t b)
         int r = 0;
         unsigned bucket = dm_hash_block(b, DM_HASH_MASK);
         struct shadow_info *si;
-        struct hlist_node *n;
 
         spin_lock(&tm->lock);
-        hlist_for_each_entry(si, n, tm->buckets + bucket, hlist)
+        hlist_for_each_entry(si, tm->buckets + bucket, hlist)
                 if (si->where == b) {
                         r = 1;
                         break;
@@ -81,14 +80,14 @@ static void insert_shadow(struct dm_transaction_manager *tm, dm_block_t b)
 static void wipe_shadow_table(struct dm_transaction_manager *tm)
 {
         struct shadow_info *si;
-        struct hlist_node *n, *tmp;
+        struct hlist_node *tmp;
         struct hlist_head *bucket;
         int i;
 
         spin_lock(&tm->lock);
         for (i = 0; i < DM_HASH_SIZE; i++) {
                 bucket = tm->buckets + i;
-                hlist_for_each_entry_safe(si, n, tmp, bucket, hlist)
+                hlist_for_each_entry_safe(si, tmp, bucket, hlist)
                         kfree(si);
 
                 INIT_HLIST_HEAD(bucket);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 19d77a026639..697f026cb318 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -365,10 +365,9 @@ static struct stripe_head *__find_stripe(struct r5conf *conf, sector_t sector,
                                          short generation)
 {
         struct stripe_head *sh;
-        struct hlist_node *hn;
 
         pr_debug("__find_stripe, sector %llu\n", (unsigned long long)sector);
-        hlist_for_each_entry(sh, hn, stripe_hash(conf, sector), hash)
+        hlist_for_each_entry(sh, stripe_hash(conf, sector), hash)
                 if (sh->sector == sector && sh->generation == generation)
                         return sh;
         pr_debug("__stripe %llu not in cache\n", (unsigned long long)sector);
diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index 56ff19cdc2ad..ffcb10ac4341 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -512,18 +512,17 @@ int memstick_add_host(struct memstick_host *host)
 {
         int rc;
 
-        while (1) {
-                if (!idr_pre_get(&memstick_host_idr, GFP_KERNEL))
-                        return -ENOMEM;
+        idr_preload(GFP_KERNEL);
+        spin_lock(&memstick_host_lock);
 
-                spin_lock(&memstick_host_lock);
-                rc = idr_get_new(&memstick_host_idr, host, &host->id);
-                spin_unlock(&memstick_host_lock);
-                if (!rc)
-                        break;
-                else if (rc != -EAGAIN)
-                        return rc;
-        }
+        rc = idr_alloc(&memstick_host_idr, host, 0, 0, GFP_NOWAIT);
+        if (rc >= 0)
+                host->id = rc;
+
+        spin_unlock(&memstick_host_lock);
+        idr_preload_end();
+        if (rc < 0)
+                return rc;
 
         dev_set_name(&host->dev, "memstick%u", host->id);
 
diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
index 9729b92fbfdd..f12b78dbce04 100644
--- a/drivers/memstick/core/mspro_block.c
+++ b/drivers/memstick/core/mspro_block.c
@@ -1213,21 +1213,10 @@ static int mspro_block_init_disk(struct memstick_dev *card)
         msb->page_size = be16_to_cpu(sys_info->unit_size);
 
         mutex_lock(&mspro_block_disk_lock);
-        if (!idr_pre_get(&mspro_block_disk_idr, GFP_KERNEL)) {
-                mutex_unlock(&mspro_block_disk_lock);
-                return -ENOMEM;
-        }
-
-        rc = idr_get_new(&mspro_block_disk_idr, card, &disk_id);
+        disk_id = idr_alloc(&mspro_block_disk_idr, card, 0, 256, GFP_KERNEL);
         mutex_unlock(&mspro_block_disk_lock);
-
-        if (rc)
-                return rc;
-
-        if ((disk_id << MSPRO_BLOCK_PART_SHIFT) > 255) {
-                rc = -ENOSPC;
-                goto out_release_id;
-        }
+        if (disk_id < 0)
+                return disk_id;
 
         msb->disk = alloc_disk(1 << MSPRO_BLOCK_PART_SHIFT);
         if (!msb->disk) {
diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
index 29b2172ae18f..a7c5b31c0d50 100644
--- a/drivers/memstick/host/r592.c
+++ b/drivers/memstick/host/r592.c
@@ -454,7 +454,7 @@ static int r592_transfer_fifo_pio(struct r592_device *dev)
 /* Executes one TPC (data is read/written from small or large fifo) */
 static void r592_execute_tpc(struct r592_device *dev)
 {
-        bool is_write = dev->req->tpc >= MS_TPC_SET_RW_REG_ADRS;
+        bool is_write;
         int len, error;
         u32 status, reg;
 
@@ -463,6 +463,7 @@ static void r592_execute_tpc(struct r592_device *dev)
                 return;
         }
 
+        is_write = dev->req->tpc >= MS_TPC_SET_RW_REG_ADRS;
         len = dev->req->long_data ?
                 dev->req->sg.length : dev->req->data_len;
 
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index 481a98a10ecd..2f12cc13489a 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -1091,15 +1091,14 @@ static int rtsx_pci_probe(struct pci_dev *pcidev,
         }
         handle->pcr = pcr;
 
-        if (!idr_pre_get(&rtsx_pci_idr, GFP_KERNEL)) {
-                ret = -ENOMEM;
-                goto free_handle;
-        }
-
+        idr_preload(GFP_KERNEL);
         spin_lock(&rtsx_pci_lock);
-        ret = idr_get_new(&rtsx_pci_idr, pcr, &pcr->id);
+        ret = idr_alloc(&rtsx_pci_idr, pcr, 0, 0, GFP_NOWAIT);
+        if (ret >= 0)
+                pcr->id = ret;
         spin_unlock(&rtsx_pci_lock);
-        if (ret)
+        idr_preload_end();
+        if (ret < 0)
                 goto free_handle;
 
         pcr->pci = pcidev;
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index f428d86bfc10..f32550a74bdd 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -885,7 +885,7 @@ struct c2port_device *c2port_device_register(char *name,
                                         struct c2port_ops *ops, void *devdata)
 {
         struct c2port_device *c2dev;
-        int id, ret;
+        int ret;
 
         if (unlikely(!ops) || unlikely(!ops->access) || \
                 unlikely(!ops->c2d_dir) || unlikely(!ops->c2ck_set) || \
@@ -897,22 +897,18 @@ struct c2port_device *c2port_device_register(char *name,
         if (unlikely(!c2dev))
                 return ERR_PTR(-ENOMEM);
 
-        ret = idr_pre_get(&c2port_idr, GFP_KERNEL);
-        if (!ret) {
-                ret = -ENOMEM;
-                goto error_idr_get_new;
-        }
-
+        idr_preload(GFP_KERNEL);
         spin_lock_irq(&c2port_idr_lock);
-        ret = idr_get_new(&c2port_idr, c2dev, &id);
+        ret = idr_alloc(&c2port_idr, c2dev, 0, 0, GFP_NOWAIT);
         spin_unlock_irq(&c2port_idr_lock);
+        idr_preload_end();
 
         if (ret < 0)
-                goto error_idr_get_new;
-        c2dev->id = id;
+                goto error_idr_alloc;
+        c2dev->id = ret;
 
         c2dev->dev = device_create(c2port_class, NULL, 0, c2dev,
-                                        "c2port%d", id);
+                                   "c2port%d", c2dev->id);
         if (unlikely(IS_ERR(c2dev->dev))) {
                 ret = PTR_ERR(c2dev->dev);
                 goto error_device_create;
@@ -946,10 +942,10 @@ error_device_create_bin_file:
 
 error_device_create:
         spin_lock_irq(&c2port_idr_lock);
-        idr_remove(&c2port_idr, id);
+        idr_remove(&c2port_idr, c2dev->id);
         spin_unlock_irq(&c2port_idr_lock);
 
-error_idr_get_new:
+error_idr_alloc:
         kfree(c2dev);
 
         return ERR_PTR(ret);
diff --git a/drivers/misc/sgi-gru/grutlbpurge.c b/drivers/misc/sgi-gru/grutlbpurge.c
index 240a6d361665..2129274ef7ab 100644
--- a/drivers/misc/sgi-gru/grutlbpurge.c
+++ b/drivers/misc/sgi-gru/grutlbpurge.c
@@ -280,11 +280,10 @@ static struct mmu_notifier *mmu_find_ops(struct mm_struct *mm,
                         const struct mmu_notifier_ops *ops)
 {
         struct mmu_notifier *mn, *gru_mn = NULL;
-        struct hlist_node *n;
 
         if (mm->mmu_notifier_mm) {
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list,
+                hlist_for_each_entry_rcu(mn, &mm->mmu_notifier_mm->list,
                                          hlist)
                     if (mn->ops == ops) {
                         gru_mn = mn;
diff --git a/drivers/misc/tifm_core.c b/drivers/misc/tifm_core.c
index 0bd5349b0422..0ab7c922212c 100644
--- a/drivers/misc/tifm_core.c
+++ b/drivers/misc/tifm_core.c
@@ -196,13 +196,14 @@ int tifm_add_adapter(struct tifm_adapter *fm)
 {
         int rc;
 
-        if (!idr_pre_get(&tifm_adapter_idr, GFP_KERNEL))
-                return -ENOMEM;
-
+        idr_preload(GFP_KERNEL);
         spin_lock(&tifm_adapter_lock);
-        rc = idr_get_new(&tifm_adapter_idr, fm, &fm->id);
+        rc = idr_alloc(&tifm_adapter_idr, fm, 0, 0, GFP_NOWAIT);
+        if (rc >= 0)
+                fm->id = rc;
         spin_unlock(&tifm_adapter_lock);
-        if (rc)
+        idr_preload_end();
+        if (rc < 0)
                 return rc;
 
         dev_set_name(&fm->dev, "tifm%u", fm->id);
diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c
index c3e8397f62ed..a8cee33ae8d2 100644
--- a/drivers/misc/vmw_vmci/vmci_doorbell.c
+++ b/drivers/misc/vmw_vmci/vmci_doorbell.c
@@ -127,9 +127,8 @@ static struct dbell_entry *dbell_index_table_find(u32 idx)
 {
         u32 bucket = VMCI_DOORBELL_HASH(idx);
         struct dbell_entry *dbell;
-        struct hlist_node *node;
 
-        hlist_for_each_entry(dbell, node, &vmci_doorbell_it.entries[bucket],
+        hlist_for_each_entry(dbell, &vmci_doorbell_it.entries[bucket],
                              node) {
                 if (idx == dbell->idx)
                         return dbell;
@@ -359,12 +358,10 @@ static void dbell_fire_entries(u32 notify_idx)
 {
         u32 bucket = VMCI_DOORBELL_HASH(notify_idx);
         struct dbell_entry *dbell;
-        struct hlist_node *node;
 
         spin_lock_bh(&vmci_doorbell_it.lock);
 
-        hlist_for_each_entry(dbell, node,
-                             &vmci_doorbell_it.entries[bucket], node) {
+        hlist_for_each_entry(dbell, &vmci_doorbell_it.entries[bucket], node) {
                 if (dbell->idx == notify_idx &&
                     atomic_read(&dbell->active) == 1) {
                         if (dbell->run_delayed) {
diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c
index a196f84a4fd2..9a53a30de445 100644
--- a/drivers/misc/vmw_vmci/vmci_resource.c
+++ b/drivers/misc/vmw_vmci/vmci_resource.c
@@ -46,11 +46,10 @@ static struct vmci_resource *vmci_resource_lookup(struct vmci_handle handle,
                                                   enum vmci_resource_type type)
 {
         struct vmci_resource *r, *resource = NULL;
-        struct hlist_node *node;
         unsigned int idx = vmci_resource_hash(handle);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(r, node,
+        hlist_for_each_entry_rcu(r,
                                  &vmci_resource_table.entries[idx], node) {
                 u32 cid = r->handle.context;
                 u32 rid = r->handle.resource;
@@ -146,12 +145,11 @@ void vmci_resource_remove(struct vmci_resource *resource)
         struct vmci_handle handle = resource->handle;
         unsigned int idx = vmci_resource_hash(handle);
         struct vmci_resource *r;
-        struct hlist_node *node;
 
         /* Remove resource from hash table. */
         spin_lock(&vmci_resource_table.lock);
 
-        hlist_for_each_entry(r, node, &vmci_resource_table.entries[idx], node) {
+        hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) {
                 if (vmci_handle_is_equal(r->handle, resource->handle)) {
                         hlist_del_init_rcu(&r->node);
                         break;
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 821cd8224137..2a3593d9f87d 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -429,19 +429,20 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
         int err;
         struct mmc_host *host;
 
-        if (!idr_pre_get(&mmc_host_idr, GFP_KERNEL))
-                return NULL;
-
         host = kzalloc(sizeof(struct mmc_host) + extra, GFP_KERNEL);
         if (!host)
                 return NULL;
 
         /* scanning will be enabled when we're ready */
         host->rescan_disable = 1;
+        idr_preload(GFP_KERNEL);
         spin_lock(&mmc_host_lock);
-        err = idr_get_new(&mmc_host_idr, host, &host->index);
+        err = idr_alloc(&mmc_host_idr, host, 0, 0, GFP_NOWAIT);
+        if (err >= 0)
+                host->index = err;
         spin_unlock(&mmc_host_lock);
-        if (err)
+        idr_preload_end();
+        if (err < 0)
                 goto free;
 
         dev_set_name(&host->class_dev, "mmc%d", host->index);
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 60063ccb4c4b..98342213ed21 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1453,7 +1453,7 @@ static void dw_mci_read_data_pio(struct dw_mci *host)
                 if (!sg_miter_next(sg_miter))
                         goto done;
 
-                host->sg = sg_miter->__sg;
+                host->sg = sg_miter->piter.sg;
                 buf = sg_miter->addr;
                 remain = sg_miter->length;
                 offset = 0;
@@ -1508,7 +1508,7 @@ static void dw_mci_write_data_pio(struct dw_mci *host)
                 if (!sg_miter_next(sg_miter))
                         goto done;
 
-                host->sg = sg_miter->__sg;
+                host->sg = sg_miter->piter.sg;
                 buf = sg_miter->addr;
                 remain = sg_miter->length;
                 offset = 0;
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index ec794a72975d..61d5f56473e1 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -349,13 +349,8 @@ int add_mtd_device(struct mtd_info *mtd)
         BUG_ON(mtd->writesize == 0);
         mutex_lock(&mtd_table_mutex);
 
-        do {
-                if (!idr_pre_get(&mtd_idr, GFP_KERNEL))
-                        goto fail_locked;
-                error = idr_get_new(&mtd_idr, mtd, &i);
-        } while (error == -EAGAIN);
-
-        if (error)
+        i = idr_alloc(&mtd_idr, mtd, 0, 0, GFP_KERNEL);
+        if (i < 0)
                 goto fail_locked;
 
         mtd->index = i;
diff --git a/drivers/mtd/tests/mtd_nandecctest.c b/drivers/mtd/tests/mtd_nandecctest.c
index 1eee264509a8..db2f22e7966a 100644
--- a/drivers/mtd/tests/mtd_nandecctest.c
+++ b/drivers/mtd/tests/mtd_nandecctest.c
@@ -256,7 +256,7 @@ static int nand_ecc_test_run(const size_t size)
                 goto error;
         }
 
-        get_random_bytes(correct_data, size);
+        prandom_bytes(correct_data, size);
         __nand_calculate_ecc(correct_data, size, correct_ecc);
 
         for (i = 0; i < ARRAY_SIZE(nand_ecc_test); i++) {
diff --git a/drivers/mtd/tests/mtd_oobtest.c b/drivers/mtd/tests/mtd_oobtest.c
index e827fa8cd844..3e24b379ffa4 100644
--- a/drivers/mtd/tests/mtd_oobtest.c
+++ b/drivers/mtd/tests/mtd_oobtest.c
@@ -29,6 +29,7 @@
 #include <linux/mtd/mtd.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
+#include <linux/random.h>
 
 static int dev = -EINVAL;
 module_param(dev, int, S_IRUGO);
@@ -46,26 +47,7 @@ static int use_offset;
 static int use_len;
 static int use_len_max;
 static int vary_offset;
-static unsigned long next = 1;
-
-static inline unsigned int simple_rand(void)
-{
-        next = next * 1103515245 + 12345;
-        return (unsigned int)((next / 65536) % 32768);
-}
-
-static inline void simple_srand(unsigned long seed)
-{
-        next = seed;
-}
-
-static void set_random_data(unsigned char *buf, size_t len)
-{
-        size_t i;
-
-        for (i = 0; i < len; ++i)
-                buf[i] = simple_rand();
-}
+static struct rnd_state rnd_state;
 
 static int erase_eraseblock(int ebnum)
 {
@@ -129,7 +111,7 @@ static int write_eraseblock(int ebnum)
         loff_t addr = ebnum * mtd->erasesize;
 
         for (i = 0; i < pgcnt; ++i, addr += mtd->writesize) {
-                set_random_data(writebuf, use_len);
+                prandom_bytes_state(&rnd_state, writebuf, use_len);
                 ops.mode      = MTD_OPS_AUTO_OOB;
                 ops.len       = 0;
                 ops.retlen    = 0;
@@ -182,7 +164,7 @@ static int verify_eraseblock(int ebnum)
         loff_t addr = ebnum * mtd->erasesize;
 
         for (i = 0; i < pgcnt; ++i, addr += mtd->writesize) {
-                set_random_data(writebuf, use_len);
+                prandom_bytes_state(&rnd_state, writebuf, use_len);
                 ops.mode      = MTD_OPS_AUTO_OOB;
                 ops.len       = 0;
                 ops.retlen    = 0;
@@ -273,7 +255,7 @@ static int verify_eraseblock_in_one_go(int ebnum)
         loff_t addr = ebnum * mtd->erasesize;
         size_t len = mtd->ecclayout->oobavail * pgcnt;
 
-        set_random_data(writebuf, len);
+        prandom_bytes_state(&rnd_state, writebuf, len);
         ops.mode      = MTD_OPS_AUTO_OOB;
         ops.len       = 0;
         ops.retlen    = 0;
@@ -424,12 +406,12 @@ static int __init mtd_oobtest_init(void)
         if (err)
                 goto out;
 
-        simple_srand(1);
+        prandom_seed_state(&rnd_state, 1);
         err = write_whole_device();
         if (err)
                 goto out;
 
-        simple_srand(1);
+        prandom_seed_state(&rnd_state, 1);
         err = verify_all_eraseblocks();
         if (err)
                 goto out;
@@ -444,13 +426,13 @@ static int __init mtd_oobtest_init(void)
         if (err)
                 goto out;
 
-        simple_srand(3);
+        prandom_seed_state(&rnd_state, 3);
         err = write_whole_device();
         if (err)
                 goto out;
 
         /* Check all eraseblocks */
-        simple_srand(3);
+        prandom_seed_state(&rnd_state, 3);
         pr_info("verifying all eraseblocks\n");
         for (i = 0; i < ebcnt; ++i) {
                 if (bbt[i])
@@ -479,7 +461,7 @@ static int __init mtd_oobtest_init(void)
         use_len = mtd->ecclayout->oobavail;
         use_len_max = mtd->ecclayout->oobavail;
         vary_offset = 1;
-        simple_srand(5);
+        prandom_seed_state(&rnd_state, 5);
 
         err = write_whole_device();
         if (err)
@@ -490,7 +472,7 @@ static int __init mtd_oobtest_init(void)
         use_len = mtd->ecclayout->oobavail;
         use_len_max = mtd->ecclayout->oobavail;
         vary_offset = 1;
-        simple_srand(5);
+        prandom_seed_state(&rnd_state, 5);
         err = verify_all_eraseblocks();
         if (err)
                 goto out;
@@ -649,7 +631,7 @@ static int __init mtd_oobtest_init(void)
                 goto out;
 
         /* Write all eraseblocks */
-        simple_srand(11);
+        prandom_seed_state(&rnd_state, 11);
         pr_info("writing OOBs of whole device\n");
         for (i = 0; i < ebcnt - 1; ++i) {
                 int cnt = 2;
@@ -659,7 +641,7 @@ static int __init mtd_oobtest_init(void)
                         continue;
                 addr = (i + 1) * mtd->erasesize - mtd->writesize;
                 for (pg = 0; pg < cnt; ++pg) {
-                        set_random_data(writebuf, sz);
+                        prandom_bytes_state(&rnd_state, writebuf, sz);
                         ops.mode      = MTD_OPS_AUTO_OOB;
                         ops.len       = 0;
                         ops.retlen    = 0;
@@ -680,12 +662,13 @@ static int __init mtd_oobtest_init(void)
         pr_info("written %u eraseblocks\n", i);
 
         /* Check all eraseblocks */
-        simple_srand(11);
+        prandom_seed_state(&rnd_state, 11);
         pr_info("verifying all eraseblocks\n");
         for (i = 0; i < ebcnt - 1; ++i) {
                 if (bbt[i] || bbt[i + 1])
                         continue;
-                set_random_data(writebuf, mtd->ecclayout->oobavail * 2);
+                prandom_bytes_state(&rnd_state, writebuf,
+                                        mtd->ecclayout->oobavail * 2);
                 addr = (i + 1) * mtd->erasesize - mtd->writesize;
                 ops.mode      = MTD_OPS_AUTO_OOB;
                 ops.len       = 0;
diff --git a/drivers/mtd/tests/mtd_pagetest.c b/drivers/mtd/tests/mtd_pagetest.c
index f93a76f88113..0c1140b6c286 100644
--- a/drivers/mtd/tests/mtd_pagetest.c
+++ b/drivers/mtd/tests/mtd_pagetest.c
@@ -29,6 +29,7 @@
 #include <linux/mtd/mtd.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
+#include <linux/random.h>
 
 static int dev = -EINVAL;
 module_param(dev, int, S_IRUGO);
@@ -45,26 +46,7 @@ static int bufsize;
 static int ebcnt;
 static int pgcnt;
 static int errcnt;
-static unsigned long next = 1;
-
-static inline unsigned int simple_rand(void)
-{
-        next = next * 1103515245 + 12345;
-        return (unsigned int)((next / 65536) % 32768);
-}
-
-static inline void simple_srand(unsigned long seed)
-{
-        next = seed;
-}
-
-static void set_random_data(unsigned char *buf, size_t len)
-{
-        size_t i;
-
-        for (i = 0; i < len; ++i)
-                buf[i] = simple_rand();
-}
+static struct rnd_state rnd_state;
 
 static int erase_eraseblock(int ebnum)
 {
@@ -98,7 +80,7 @@ static int write_eraseblock(int ebnum)
         size_t written;
         loff_t addr = ebnum * mtd->erasesize;
 
-        set_random_data(writebuf, mtd->erasesize);
+        prandom_bytes_state(&rnd_state, writebuf, mtd->erasesize);
         cond_resched();
         err = mtd_write(mtd, addr, mtd->erasesize, &written, writebuf);
         if (err || written != mtd->erasesize)
@@ -124,7 +106,7 @@ static int verify_eraseblock(int ebnum)
         for (i = 0; i < ebcnt && bbt[ebcnt - i - 1]; ++i)
                 addrn -= mtd->erasesize;
 
-        set_random_data(writebuf, mtd->erasesize);
+        prandom_bytes_state(&rnd_state, writebuf, mtd->erasesize);
         for (j = 0; j < pgcnt - 1; ++j, addr += pgsize) {
                 /* Do a read to set the internal dataRAMs to different data */
                 err = mtd_read(mtd, addr0, bufsize, &read, twopages);
@@ -160,7 +142,8 @@ static int verify_eraseblock(int ebnum)
         }
         /* Check boundary between eraseblocks */
         if (addr <= addrn - pgsize - pgsize && !bbt[ebnum + 1]) {
-                unsigned long oldnext = next;
+                struct rnd_state old_state = rnd_state;
+
                 /* Do a read to set the internal dataRAMs to different data */
                 err = mtd_read(mtd, addr0, bufsize, &read, twopages);
                 if (mtd_is_bitflip(err))
@@ -188,13 +171,13 @@ static int verify_eraseblock(int ebnum)
                         return err;
                 }
                 memcpy(boundary, writebuf + mtd->erasesize - pgsize, pgsize);
-                set_random_data(boundary + pgsize, pgsize);
+                prandom_bytes_state(&rnd_state, boundary + pgsize, pgsize);
                 if (memcmp(twopages, boundary, bufsize)) {
                         pr_err("error: verify failed at %#llx\n",
                                (long long)addr);
                         errcnt += 1;
                 }
-                next = oldnext;
+                rnd_state = old_state;
         }
         return err;
 }
@@ -326,7 +309,7 @@ static int erasecrosstest(void)
                 return err;
 
         pr_info("writing 1st page of block %d\n", ebnum);
-        set_random_data(writebuf, pgsize);
+        prandom_bytes_state(&rnd_state, writebuf, pgsize);
         strcpy(writebuf, "There is no data like this!");
         err = mtd_write(mtd, addr0, pgsize, &written, writebuf);
         if (err || written != pgsize) {
@@ -359,7 +342,7 @@ static int erasecrosstest(void)
                 return err;
 
         pr_info("writing 1st page of block %d\n", ebnum);
-        set_random_data(writebuf, pgsize);
+        prandom_bytes_state(&rnd_state, writebuf, pgsize);
         strcpy(writebuf, "There is no data like this!");
         err = mtd_write(mtd, addr0, pgsize, &written, writebuf);
         if (err || written != pgsize) {
@@ -417,7 +400,7 @@ static int erasetest(void)
                 return err;
 
         pr_info("writing 1st page of block %d\n", ebnum);
-        set_random_data(writebuf, pgsize);
+        prandom_bytes_state(&rnd_state, writebuf, pgsize);
         err = mtd_write(mtd, addr0, pgsize, &written, writebuf);
         if (err || written != pgsize) {
                 pr_err("error: write failed at %#llx\n",
@@ -565,7 +548,7 @@ static int __init mtd_pagetest_init(void)
         pr_info("erased %u eraseblocks\n", i);
 
         /* Write all eraseblocks */
-        simple_srand(1);
+        prandom_seed_state(&rnd_state, 1);
         pr_info("writing whole device\n");
         for (i = 0; i < ebcnt; ++i) {
                 if (bbt[i])
@@ -580,7 +563,7 @@ static int __init mtd_pagetest_init(void)
         pr_info("written %u eraseblocks\n", i);
 
         /* Check all eraseblocks */
-        simple_srand(1);
+        prandom_seed_state(&rnd_state, 1);
         pr_info("verifying all eraseblocks\n");
         for (i = 0; i < ebcnt; ++i) {
                 if (bbt[i])
diff --git a/drivers/mtd/tests/mtd_speedtest.c b/drivers/mtd/tests/mtd_speedtest.c
index 596cbea8df4c..a6ce9c1fa6c5 100644
--- a/drivers/mtd/tests/mtd_speedtest.c
+++ b/drivers/mtd/tests/mtd_speedtest.c
@@ -49,13 +49,6 @@ static int pgcnt;
 static int goodebcnt;
 static struct timeval start, finish;
 
-static void set_random_data(unsigned char *buf, size_t len)
-{
-        size_t i;
-
-        for (i = 0; i < len; ++i)
-                buf[i] = random32();
-}
 
 static int erase_eraseblock(int ebnum)
 {
@@ -396,7 +389,7 @@ static int __init mtd_speedtest_init(void)
                 goto out;
         }
 
-        set_random_data(iobuf, mtd->erasesize);
+        prandom_bytes(iobuf, mtd->erasesize);
 
         err = scan_for_bad_eraseblocks();
         if (err)
diff --git a/drivers/mtd/tests/mtd_stresstest.c b/drivers/mtd/tests/mtd_stresstest.c
index 3729f679ae5d..2d7e6cffd6d4 100644
--- a/drivers/mtd/tests/mtd_stresstest.c
+++ b/drivers/mtd/tests/mtd_stresstest.c
@@ -282,8 +282,7 @@ static int __init mtd_stresstest_init(void)
         }
         for (i = 0; i < ebcnt; i++)
                 offsets[i] = mtd->erasesize;
-        for (i = 0; i < bufsize; i++)
-                writebuf[i] = random32();
+        prandom_bytes(writebuf, bufsize);
 
         err = scan_for_bad_eraseblocks();
         if (err)
diff --git a/drivers/mtd/tests/mtd_subpagetest.c b/drivers/mtd/tests/mtd_subpagetest.c
index c880c2229c59..aade56f27945 100644
--- a/drivers/mtd/tests/mtd_subpagetest.c
+++ b/drivers/mtd/tests/mtd_subpagetest.c
@@ -28,6 +28,7 @@
 #include <linux/mtd/mtd.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
+#include <linux/random.h>
 
 static int dev = -EINVAL;
 module_param(dev, int, S_IRUGO);
@@ -43,26 +44,7 @@ static int bufsize;
 static int ebcnt;
 static int pgcnt;
 static int errcnt;
-static unsigned long next = 1;
-
-static inline unsigned int simple_rand(void)
-{
-        next = next * 1103515245 + 12345;
-        return (unsigned int)((next / 65536) % 32768);
-}
-
-static inline void simple_srand(unsigned long seed)
-{
-        next = seed;
-}
-
-static void set_random_data(unsigned char *buf, size_t len)
-{
-        size_t i;
-
-        for (i = 0; i < len; ++i)
-                buf[i] = simple_rand();
-}
+static struct rnd_state rnd_state;
 
 static inline void clear_data(unsigned char *buf, size_t len)
 {
@@ -119,7 +101,7 @@ static int write_eraseblock(int ebnum)
         int err = 0;
         loff_t addr = ebnum * mtd->erasesize;
 
-        set_random_data(writebuf, subpgsize);
+        prandom_bytes_state(&rnd_state, writebuf, subpgsize);
         err = mtd_write(mtd, addr, subpgsize, &written, writebuf);
         if (unlikely(err || written != subpgsize)) {
                 pr_err("error: write failed at %#llx\n",
@@ -133,7 +115,7 @@ static int write_eraseblock(int ebnum)
 
         addr += subpgsize;
 
-        set_random_data(writebuf, subpgsize);
+        prandom_bytes_state(&rnd_state, writebuf, subpgsize);
         err = mtd_write(mtd, addr, subpgsize, &written, writebuf);
         if (unlikely(err || written != subpgsize)) {
                 pr_err("error: write failed at %#llx\n",
@@ -157,7 +139,7 @@ static int write_eraseblock2(int ebnum)
         for (k = 1; k < 33; ++k) {
                 if (addr + (subpgsize * k) > (ebnum + 1) * mtd->erasesize)
                         break;
-                set_random_data(writebuf, subpgsize * k);
+                prandom_bytes_state(&rnd_state, writebuf, subpgsize * k);
                 err = mtd_write(mtd, addr, subpgsize * k, &written, writebuf);
                 if (unlikely(err || written != subpgsize * k)) {
                         pr_err("error: write failed at %#llx\n",
@@ -193,7 +175,7 @@ static int verify_eraseblock(int ebnum)
         int err = 0;
         loff_t addr = ebnum * mtd->erasesize;
 
-        set_random_data(writebuf, subpgsize);
+        prandom_bytes_state(&rnd_state, writebuf, subpgsize);
         clear_data(readbuf, subpgsize);
         err = mtd_read(mtd, addr, subpgsize, &read, readbuf);
         if (unlikely(err || read != subpgsize)) {
@@ -220,7 +202,7 @@ static int verify_eraseblock(int ebnum)
 
         addr += subpgsize;
 
-        set_random_data(writebuf, subpgsize);
+        prandom_bytes_state(&rnd_state, writebuf, subpgsize);
         clear_data(readbuf, subpgsize);
         err = mtd_read(mtd, addr, subpgsize, &read, readbuf);
         if (unlikely(err || read != subpgsize)) {
@@ -257,7 +239,7 @@ static int verify_eraseblock2(int ebnum)
         for (k = 1; k < 33; ++k) {
                 if (addr + (subpgsize * k) > (ebnum + 1) * mtd->erasesize)
                         break;
-                set_random_data(writebuf, subpgsize * k);
+                prandom_bytes_state(&rnd_state, writebuf, subpgsize * k);
                 clear_data(readbuf, subpgsize * k);
                 err = mtd_read(mtd, addr, subpgsize * k, &read, readbuf);
                 if (unlikely(err || read != subpgsize * k)) {
@@ -430,7 +412,7 @@ static int __init mtd_subpagetest_init(void)
                 goto out;
 
         pr_info("writing whole device\n");
-        simple_srand(1);
+        prandom_seed_state(&rnd_state, 1);
         for (i = 0; i < ebcnt; ++i) {
                 if (bbt[i])
                         continue;
@@ -443,7 +425,7 @@ static int __init mtd_subpagetest_init(void)
         }
         pr_info("written %u eraseblocks\n", i);
 
-        simple_srand(1);
+        prandom_seed_state(&rnd_state, 1);
         pr_info("verifying all eraseblocks\n");
         for (i = 0; i < ebcnt; ++i) {
                 if (bbt[i])
@@ -466,7 +448,7 @@ static int __init mtd_subpagetest_init(void)
                 goto out;
 
         /* Write all eraseblocks */
-        simple_srand(3);
+        prandom_seed_state(&rnd_state, 3);
         pr_info("writing whole device\n");
         for (i = 0; i < ebcnt; ++i) {
                 if (bbt[i])
@@ -481,7 +463,7 @@ static int __init mtd_subpagetest_init(void)
         pr_info("written %u eraseblocks\n", i);
 
         /* Check all eraseblocks */
-        simple_srand(3);
+        prandom_seed_state(&rnd_state, 3);
         pr_info("verifying all eraseblocks\n");
         for (i = 0; i < ebcnt; ++i) {
                 if (bbt[i])
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index f4d2e9e3c6d5..c3f1afd86906 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -2197,13 +2197,13 @@ static int ixgbe_get_ethtool_fdir_entry(struct ixgbe_adapter *adapter,
         union ixgbe_atr_input *mask = &adapter->fdir_mask;
         struct ethtool_rx_flow_spec *fsp =
                 (struct ethtool_rx_flow_spec *)&cmd->fs;
-        struct hlist_node *node, *node2;
+        struct hlist_node *node2;
         struct ixgbe_fdir_filter *rule = NULL;
 
         /* report total rule count */
         cmd->data = (1024 << adapter->fdir_pballoc) - 2;
 
-        hlist_for_each_entry_safe(rule, node, node2,
+        hlist_for_each_entry_safe(rule, node2,
                                   &adapter->fdir_filter_list, fdir_node) {
                 if (fsp->location <= rule->sw_idx)
                         break;
@@ -2264,14 +2264,14 @@ static int ixgbe_get_ethtool_fdir_all(struct ixgbe_adapter *adapter,
                                       struct ethtool_rxnfc *cmd,
                                       u32 *rule_locs)
 {
-        struct hlist_node *node, *node2;
+        struct hlist_node *node2;
         struct ixgbe_fdir_filter *rule;
         int cnt = 0;
 
         /* report total rule count */
         cmd->data = (1024 << adapter->fdir_pballoc) - 2;
 
-        hlist_for_each_entry_safe(rule, node, node2,
+        hlist_for_each_entry_safe(rule, node2,
                                   &adapter->fdir_filter_list, fdir_node) {
                 if (cnt == cmd->rule_cnt)
                         return -EMSGSIZE;
@@ -2358,19 +2358,19 @@ static int ixgbe_update_ethtool_fdir_entry(struct ixgbe_adapter *adapter,
                                            u16 sw_idx)
 {
         struct ixgbe_hw *hw = &adapter->hw;
-        struct hlist_node *node, *node2, *parent;
-        struct ixgbe_fdir_filter *rule;
+        struct hlist_node *node2;
+        struct ixgbe_fdir_filter *rule, *parent;
         int err = -EINVAL;
 
         parent = NULL;
         rule = NULL;
 
-        hlist_for_each_entry_safe(rule, node, node2,
+        hlist_for_each_entry_safe(rule, node2,
                                   &adapter->fdir_filter_list, fdir_node) {
                 /* hash found, or no matching entry */
                 if (rule->sw_idx >= sw_idx)
                         break;
-                parent = node;
+                parent = rule;
         }
 
         /* if there is an old rule occupying our place remove it */
@@ -2399,7 +2399,7 @@ static int ixgbe_update_ethtool_fdir_entry(struct ixgbe_adapter *adapter,
 
         /* add filter to the list */
         if (parent)
-                hlist_add_after(parent, &input->fdir_node);
+                hlist_add_after(&parent->fdir_node, &input->fdir_node);
         else
                 hlist_add_head(&input->fdir_node,
                                &adapter->fdir_filter_list);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 68478d6dfa2d..db5611ae407e 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -3891,7 +3891,7 @@ static void ixgbe_configure_pb(struct ixgbe_adapter *adapter)
 static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
 {
         struct ixgbe_hw *hw = &adapter->hw;
-        struct hlist_node *node, *node2;
+        struct hlist_node *node2;
         struct ixgbe_fdir_filter *filter;
 
         spin_lock(&adapter->fdir_perfect_lock);
@@ -3899,7 +3899,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
         if (!hlist_empty(&adapter->fdir_filter_list))
                 ixgbe_fdir_set_input_mask_82599(hw, &adapter->fdir_mask);
 
-        hlist_for_each_entry_safe(filter, node, node2,
+        hlist_for_each_entry_safe(filter, node2,
                                   &adapter->fdir_filter_list, fdir_node) {
                 ixgbe_fdir_write_perfect_filter_82599(hw,
                                 &filter->filter,
@@ -4356,12 +4356,12 @@ static void ixgbe_clean_all_tx_rings(struct ixgbe_adapter *adapter)
 
 static void ixgbe_fdir_filter_exit(struct ixgbe_adapter *adapter)
 {
-        struct hlist_node *node, *node2;
+        struct hlist_node *node2;
         struct ixgbe_fdir_filter *filter;
 
         spin_lock(&adapter->fdir_perfect_lock);
 
-        hlist_for_each_entry_safe(filter, node, node2,
+        hlist_for_each_entry_safe(filter, node2,
                                   &adapter->fdir_filter_list, fdir_node) {
                 hlist_del(&filter->fdir_node);
                 kfree(filter);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 5385474bb526..bb4d8d99f36d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -225,11 +225,10 @@ static inline struct mlx4_en_filter *
 mlx4_en_filter_find(struct mlx4_en_priv *priv, __be32 src_ip, __be32 dst_ip,
                     __be16 src_port, __be16 dst_port)
 {
-        struct hlist_node *elem;
         struct mlx4_en_filter *filter;
         struct mlx4_en_filter *ret = NULL;
 
-        hlist_for_each_entry(filter, elem,
+        hlist_for_each_entry(filter,
                              filter_hash_bucket(priv, src_ip, dst_ip,
                                                 src_port, dst_port),
                              filter_chain) {
@@ -574,13 +573,13 @@ static void mlx4_en_put_qp(struct mlx4_en_priv *priv)
 
         if (dev->caps.steering_mode != MLX4_STEERING_MODE_A0) {
                 struct mlx4_mac_entry *entry;
-                struct hlist_node *n, *tmp;
+                struct hlist_node *tmp;
                 struct hlist_head *bucket;
                 unsigned int mac_hash;
 
                 mac_hash = priv->dev->dev_addr[MLX4_EN_MAC_HASH_IDX];
                 bucket = &priv->mac_hash[mac_hash];
-                hlist_for_each_entry_safe(entry, n, tmp, bucket, hlist) {
+                hlist_for_each_entry_safe(entry, tmp, bucket, hlist) {
                         if (ether_addr_equal_64bits(entry->mac,
                                                     priv->dev->dev_addr)) {
                                 en_dbg(DRV, priv, "Releasing qp: port %d, MAC %pM, qpn %d\n",
@@ -609,11 +608,11 @@ static int mlx4_en_replace_mac(struct mlx4_en_priv *priv, int qpn,
                 struct hlist_head *bucket;
                 unsigned int mac_hash;
                 struct mlx4_mac_entry *entry;
-                struct hlist_node *n, *tmp;
+                struct hlist_node *tmp;
                 u64 prev_mac_u64 = mlx4_en_mac_to_u64(prev_mac);
 
                 bucket = &priv->mac_hash[prev_mac[MLX4_EN_MAC_HASH_IDX]];
-                hlist_for_each_entry_safe(entry, n, tmp, bucket, hlist) {
+                hlist_for_each_entry_safe(entry, tmp, bucket, hlist) {
                         if (ether_addr_equal_64bits(entry->mac, prev_mac)) {
                                 mlx4_en_uc_steer_release(priv, entry->mac,
                                                          qpn, entry->reg_id);
@@ -1019,7 +1018,7 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
 {
         struct netdev_hw_addr *ha;
         struct mlx4_mac_entry *entry;
-        struct hlist_node *n, *tmp;
+        struct hlist_node *tmp;
         bool found;
         u64 mac;
         int err = 0;
@@ -1035,7 +1034,7 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
         /* find what to remove */
         for (i = 0; i < MLX4_EN_MAC_HASH_SIZE; ++i) {
                 bucket = &priv->mac_hash[i];
-                hlist_for_each_entry_safe(entry, n, tmp, bucket, hlist) {
+                hlist_for_each_entry_safe(entry, tmp, bucket, hlist) {
                         found = false;
                         netdev_for_each_uc_addr(ha, dev) {
                                 if (ether_addr_equal_64bits(entry->mac,
@@ -1078,7 +1077,7 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
         netdev_for_each_uc_addr(ha, dev) {
                 found = false;
                 bucket = &priv->mac_hash[ha->addr[MLX4_EN_MAC_HASH_IDX]];
-                hlist_for_each_entry(entry, n, bucket, hlist) {
+                hlist_for_each_entry(entry, bucket, hlist) {
                         if (ether_addr_equal_64bits(entry->mac, ha->addr)) {
                                 found = true;
                                 break;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index ce38654bbdd0..c7f856308e1a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -35,6 +35,7 @@
 #include <linux/slab.h>
 #include <linux/mlx4/qp.h>
 #include <linux/skbuff.h>
+#include <linux/rculist.h>
 #include <linux/if_ether.h>
 #include <linux/if_vlan.h>
 #include <linux/vmalloc.h>
@@ -617,7 +618,6 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud
 
                         if (is_multicast_ether_addr(ethh->h_dest)) {
                                 struct mlx4_mac_entry *entry;
-                                struct hlist_node *n;
                                 struct hlist_head *bucket;
                                 unsigned int mac_hash;
 
@@ -625,7 +625,7 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud
                                 mac_hash = ethh->h_source[MLX4_EN_MAC_HASH_IDX];
                                 bucket = &priv->mac_hash[mac_hash];
                                 rcu_read_lock();
-                                hlist_for_each_entry_rcu(entry, n, bucket, hlist) {
+                                hlist_for_each_entry_rcu(entry, bucket, hlist) {
                                         if (ether_addr_equal_64bits(entry->mac,
                                                                     ethh->h_source)) {
                                                 rcu_read_unlock();
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index 325e11e1ce0f..f89cc7a3fe6c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -576,7 +576,7 @@ void qlcnic_free_mac_list(struct qlcnic_adapter *adapter)
 void qlcnic_prune_lb_filters(struct qlcnic_adapter *adapter)
 {
         struct qlcnic_filter *tmp_fil;
-        struct hlist_node *tmp_hnode, *n;
+        struct hlist_node *n;
         struct hlist_head *head;
         int i;
         unsigned long time;
@@ -584,7 +584,7 @@ void qlcnic_prune_lb_filters(struct qlcnic_adapter *adapter)
 
         for (i = 0; i < adapter->fhash.fbucket_size; i++) {
                 head = &(adapter->fhash.fhead[i]);
-                hlist_for_each_entry_safe(tmp_fil, tmp_hnode, n, head, fnode) {
+                hlist_for_each_entry_safe(tmp_fil, n, head, fnode) {
                         cmd =  tmp_fil->vlan_id ? QLCNIC_MAC_VLAN_DEL :
                                                   QLCNIC_MAC_DEL;
                         time = tmp_fil->ftime;
@@ -604,7 +604,7 @@ void qlcnic_prune_lb_filters(struct qlcnic_adapter *adapter)
         for (i = 0; i < adapter->rx_fhash.fbucket_size; i++) {
                 head = &(adapter->rx_fhash.fhead[i]);
 
-                hlist_for_each_entry_safe(tmp_fil, tmp_hnode, n, head, fnode)
+                hlist_for_each_entry_safe(tmp_fil, n, head, fnode)
                 {
                         time = tmp_fil->ftime;
                         if (jiffies > (QLCNIC_FILTER_AGE * HZ + time)) {
@@ -621,14 +621,14 @@ void qlcnic_prune_lb_filters(struct qlcnic_adapter *adapter)
 void qlcnic_delete_lb_filters(struct qlcnic_adapter *adapter)
 {
         struct qlcnic_filter *tmp_fil;
-        struct hlist_node *tmp_hnode, *n;
+        struct hlist_node *n;
         struct hlist_head *head;
         int i;
         u8 cmd;
 
         for (i = 0; i < adapter->fhash.fbucket_size; i++) {
                 head = &(adapter->fhash.fhead[i]);
-                hlist_for_each_entry_safe(tmp_fil, tmp_hnode, n, head, fnode) {
+                hlist_for_each_entry_safe(tmp_fil, n, head, fnode) {
                         cmd =  tmp_fil->vlan_id ? QLCNIC_MAC_VLAN_DEL :
                                                   QLCNIC_MAC_DEL;
                         qlcnic_sre_macaddr_change(adapter,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 6387e0cc3ea9..0e630061bff3 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -162,7 +162,7 @@ void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, struct sk_buff *skb,
 {
         struct ethhdr *phdr = (struct ethhdr *)(skb->data);
         struct qlcnic_filter *fil, *tmp_fil;
-        struct hlist_node *tmp_hnode, *n;
+        struct hlist_node *n;
         struct hlist_head *head;
         unsigned long time;
         u64 src_addr = 0;
@@ -179,7 +179,7 @@ void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, struct sk_buff *skb,
                          (adapter->fhash.fbucket_size - 1);
                 head = &(adapter->rx_fhash.fhead[hindex]);
 
-                hlist_for_each_entry_safe(tmp_fil, tmp_hnode, n, head, fnode) {
+                hlist_for_each_entry_safe(tmp_fil, n, head, fnode) {
                         if (!memcmp(tmp_fil->faddr, &src_addr, ETH_ALEN) &&
                             tmp_fil->vlan_id == vlan_id) {
                                 time = tmp_fil->ftime;
@@ -205,7 +205,7 @@ void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, struct sk_buff *skb,
                          (adapter->fhash.fbucket_size - 1);
                 head = &(adapter->rx_fhash.fhead[hindex]);
                 spin_lock(&adapter->rx_mac_learn_lock);
-                hlist_for_each_entry_safe(tmp_fil, tmp_hnode, n, head, fnode) {
+                hlist_for_each_entry_safe(tmp_fil, n, head, fnode) {
                         if (!memcmp(tmp_fil->faddr, &src_addr, ETH_ALEN) &&
                             tmp_fil->vlan_id == vlan_id) {
                                 found = 1;
@@ -272,7 +272,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter,
                                struct sk_buff *skb)
 {
         struct qlcnic_filter *fil, *tmp_fil;
-        struct hlist_node *tmp_hnode, *n;
+        struct hlist_node *n;
         struct hlist_head *head;
         struct net_device *netdev = adapter->netdev;
         struct ethhdr *phdr = (struct ethhdr *)(skb->data);
@@ -294,7 +294,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter,
         hindex = qlcnic_mac_hash(src_addr) & (adapter->fhash.fbucket_size - 1);
         head = &(adapter->fhash.fhead[hindex]);
 
-        hlist_for_each_entry_safe(tmp_fil, tmp_hnode, n, head, fnode) {
+        hlist_for_each_entry_safe(tmp_fil, n, head, fnode) {
                 if (!memcmp(tmp_fil->faddr, &src_addr, ETH_ALEN) &&
                     tmp_fil->vlan_id == vlan_id) {
                         if (jiffies > (QLCNIC_READD_AGE * HZ + tmp_fil->ftime))
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index 289b4eefb42f..1df0ff3839e8 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -614,10 +614,9 @@ struct vnet_port *__tx_port_find(struct vnet *vp, struct sk_buff *skb)
 {
         unsigned int hash = vnet_hashfn(skb->data);
         struct hlist_head *hp = &vp->port_hash[hash];
-        struct hlist_node *n;
         struct vnet_port *port;
 
-        hlist_for_each_entry(port, n, hp, hash) {
+        hlist_for_each_entry(port, hp, hash) {
                 if (ether_addr_equal(port->raddr, skb->data))
                         return port;
         }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index defcd8a85744..417b2af1aa80 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -55,9 +55,8 @@ static struct macvlan_dev *macvlan_hash_lookup(const struct macvlan_port *port,
                                                const unsigned char *addr)
 {
         struct macvlan_dev *vlan;
-        struct hlist_node *n;
 
-        hlist_for_each_entry_rcu(vlan, n, &port->vlan_hash[addr[5]], hlist) {
+        hlist_for_each_entry_rcu(vlan, &port->vlan_hash[addr[5]], hlist) {
                 if (ether_addr_equal_64bits(vlan->dev->dev_addr, addr))
                         return vlan;
         }
@@ -149,7 +148,6 @@ static void macvlan_broadcast(struct sk_buff *skb,
 {
         const struct ethhdr *eth = eth_hdr(skb);
         const struct macvlan_dev *vlan;
-        struct hlist_node *n;
         struct sk_buff *nskb;
         unsigned int i;
         int err;
@@ -159,7 +157,7 @@ static void macvlan_broadcast(struct sk_buff *skb,
                 return;
 
         for (i = 0; i < MACVLAN_HASH_SIZE; i++) {
-                hlist_for_each_entry_rcu(vlan, n, &port->vlan_hash[i], hlist) {
+                hlist_for_each_entry_rcu(vlan, &port->vlan_hash[i], hlist) {
                         if (vlan->dev == src || !(vlan->mode & mode))
                                 continue;
 
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 97243011d319..a449439bd653 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -279,28 +279,17 @@ static int macvtap_receive(struct sk_buff *skb)
 static int macvtap_get_minor(struct macvlan_dev *vlan)
 {
         int retval = -ENOMEM;
-        int id;
 
         mutex_lock(&minor_lock);
-        if (idr_pre_get(&minor_idr, GFP_KERNEL) == 0)
-                goto exit;
-
-        retval = idr_get_new_above(&minor_idr, vlan, 1, &id);
-        if (retval < 0) {
-                if (retval == -EAGAIN)
-                        retval = -ENOMEM;
-                goto exit;
-        }
-        if (id < MACVTAP_NUM_DEVS) {
-                vlan->minor = id;
-        } else {
+        retval = idr_alloc(&minor_idr, vlan, 1, MACVTAP_NUM_DEVS, GFP_KERNEL);
+        if (retval >= 0) {
+                vlan->minor = retval;
+        } else if (retval == -ENOSPC) {
                 printk(KERN_ERR "too many macvtap devices\n");
                 retval = -EINVAL;
-                idr_remove(&minor_idr, id);
         }
-exit:
         mutex_unlock(&minor_lock);
-        return retval;
+        return retval < 0 ? retval : 0;
 }
 
 static void macvtap_free_minor(struct macvlan_dev *vlan)
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 3db9131e9229..72ff14b811c6 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2953,46 +2953,21 @@ static void __exit ppp_cleanup(void)
  * by holding all_ppp_mutex
  */
 
-static int __unit_alloc(struct idr *p, void *ptr, int n)
-{
-        int unit, err;
-
-again:
-        if (!idr_pre_get(p, GFP_KERNEL)) {
-                pr_err("PPP: No free memory for idr\n");
-                return -ENOMEM;
-        }
-
-        err = idr_get_new_above(p, ptr, n, &unit);
-        if (err < 0) {
-                if (err == -EAGAIN)
-                        goto again;
-                return err;
-        }
-
-        return unit;
-}
-
 /* associate pointer with specified number */
 static int unit_set(struct idr *p, void *ptr, int n)
 {
         int unit;
 
-        unit = __unit_alloc(p, ptr, n);
-        if (unit < 0)
-                return unit;
-        else if (unit != n) {
-                idr_remove(p, unit);
-                return -EINVAL;
-        }
-
+        unit = idr_alloc(p, ptr, n, n + 1, GFP_KERNEL);
+        if (unit == -ENOSPC)
+                unit = -EINVAL;
         return unit;
 }
 
 /* get new free unit number and associate pointer with it */
 static int unit_get(struct idr *p, void *ptr)
 {
-        return __unit_alloc(p, ptr, 0);
+        return idr_alloc(p, ptr, 0, 0, GFP_KERNEL);
 }
 
 /* put unit number back to a pool */
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index b6f45c5d84d5..2c6a22e278ea 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -197,9 +197,8 @@ static inline u32 tun_hashfn(u32 rxhash)
 static struct tun_flow_entry *tun_flow_find(struct hlist_head *head, u32 rxhash)
 {
         struct tun_flow_entry *e;
-        struct hlist_node *n;
 
-        hlist_for_each_entry_rcu(e, n, head, hash_link) {
+        hlist_for_each_entry_rcu(e, head, hash_link) {
                 if (e->rxhash == rxhash)
                         return e;
         }
@@ -241,9 +240,9 @@ static void tun_flow_flush(struct tun_struct *tun)
         spin_lock_bh(&tun->lock);
         for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
                 struct tun_flow_entry *e;
-                struct hlist_node *h, *n;
+                struct hlist_node *n;
 
-                hlist_for_each_entry_safe(e, h, n, &tun->flows[i], hash_link)
+                hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link)
                         tun_flow_delete(tun, e);
         }
         spin_unlock_bh(&tun->lock);
@@ -256,9 +255,9 @@ static void tun_flow_delete_by_queue(struct tun_struct *tun, u16 queue_index)
         spin_lock_bh(&tun->lock);
         for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
                 struct tun_flow_entry *e;
-                struct hlist_node *h, *n;
+                struct hlist_node *n;
 
-                hlist_for_each_entry_safe(e, h, n, &tun->flows[i], hash_link) {
+                hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link) {
                         if (e->queue_index == queue_index)
                                 tun_flow_delete(tun, e);
                 }
@@ -279,9 +278,9 @@ static void tun_flow_cleanup(unsigned long data)
         spin_lock_bh(&tun->lock);
         for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
                 struct tun_flow_entry *e;
-                struct hlist_node *h, *n;
+                struct hlist_node *n;
 
-                hlist_for_each_entry_safe(e, h, n, &tun->flows[i], hash_link) {
+                hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link) {
                         unsigned long this_timer;
                         count++;
                         this_timer = e->updated + delay;
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index f736823f8437..f10e58ac9c1b 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -145,9 +145,8 @@ static inline struct hlist_head *vni_head(struct net *net, u32 id)
 static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id)
 {
         struct vxlan_dev *vxlan;
-        struct hlist_node *node;
 
-        hlist_for_each_entry_rcu(vxlan, node, vni_head(net, id), hlist) {
+        hlist_for_each_entry_rcu(vxlan, vni_head(net, id), hlist) {
                 if (vxlan->vni == id)
                         return vxlan;
         }
@@ -292,9 +291,8 @@ static struct vxlan_fdb *vxlan_find_mac(struct vxlan_dev *vxlan,
 {
         struct hlist_head *head = vxlan_fdb_head(vxlan, mac);
         struct vxlan_fdb *f;
-        struct hlist_node *node;
 
-        hlist_for_each_entry_rcu(f, node, head, hlist) {
+        hlist_for_each_entry_rcu(f, head, hlist) {
                 if (compare_ether_addr(mac, f->eth_addr) == 0)
                         return f;
         }
@@ -422,10 +420,9 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
 
         for (h = 0; h < FDB_HASH_SIZE; ++h) {
                 struct vxlan_fdb *f;
-                struct hlist_node *n;
                 int err;
 
-                hlist_for_each_entry_rcu(f, n, &vxlan->fdb_head[h], hlist) {
+                hlist_for_each_entry_rcu(f, &vxlan->fdb_head[h], hlist) {
                         if (idx < cb->args[0])
                                 goto skip;
 
@@ -483,11 +480,10 @@ static bool vxlan_group_used(struct vxlan_net *vn,
                              const struct vxlan_dev *this)
 {
         const struct vxlan_dev *vxlan;
-        struct hlist_node *node;
         unsigned h;
 
         for (h = 0; h < VNI_HASH_SIZE; ++h)
-                hlist_for_each_entry(vxlan, node, &vn->vni_list[h], hlist) {
+                hlist_for_each_entry(vxlan, &vn->vni_list[h], hlist) {
                         if (vxlan == this)
                                 continue;
 
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 48273dd05b63..4941f201d6c8 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -309,7 +309,6 @@ static void zd1201_usbrx(struct urb *urb)
         if (data[urb->actual_length-1] == ZD1201_PACKET_RXDATA) {
                 int datalen = urb->actual_length-1;
                 unsigned short len, fc, seq;
-                struct hlist_node *node;
 
                 len = ntohs(*(__be16 *)&data[datalen-2]);
                 if (len>datalen)
@@ -362,7 +361,7 @@ static void zd1201_usbrx(struct urb *urb)
                                 hlist_add_head(&frag->fnode, &zd->fraglist);
                                 goto resubmit;
                         }
-                        hlist_for_each_entry(frag, node, &zd->fraglist, fnode)
+                        hlist_for_each_entry(frag, &zd->fraglist, fnode)
                                 if (frag->seq == (seq&IEEE80211_SCTL_SEQ))
                                         break;
                         if (!frag)
@@ -1831,14 +1830,14 @@ err_zd:
 static void zd1201_disconnect(struct usb_interface *interface)
 {
         struct zd1201 *zd = usb_get_intfdata(interface);
-        struct hlist_node *node, *node2;
+        struct hlist_node *node2;
         struct zd1201_frag *frag;
 
         if (!zd)
                 return;
         usb_set_intfdata(interface, NULL);
 
-        hlist_for_each_entry_safe(frag, node, node2, &zd->fraglist, fnode) {
+        hlist_for_each_entry_safe(frag, node2, &zd->fraglist, fnode) {
                 hlist_del_init(&frag->fnode);
                 kfree_skb(frag->skb);
                 kfree(frag);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 924e4665bd57..b099e0025d2b 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -842,9 +842,8 @@ static struct pci_cap_saved_state *pci_find_saved_cap(
         struct pci_dev *pci_dev, char cap)
 {
         struct pci_cap_saved_state *tmp;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry(tmp, pos, &pci_dev->saved_cap_space, next) {
+        hlist_for_each_entry(tmp, &pci_dev->saved_cap_space, next) {
                 if (tmp->cap.cap_nr == cap)
                         return tmp;
         }
@@ -1041,7 +1040,6 @@ struct pci_saved_state *pci_store_saved_state(struct pci_dev *dev)
         struct pci_saved_state *state;
         struct pci_cap_saved_state *tmp;
         struct pci_cap_saved_data *cap;
-        struct hlist_node *pos;
         size_t size;
 
         if (!dev->state_saved)
@@ -1049,7 +1047,7 @@ struct pci_saved_state *pci_store_saved_state(struct pci_dev *dev)
 
         size = sizeof(*state) + sizeof(struct pci_cap_saved_data);
 
-        hlist_for_each_entry(tmp, pos, &dev->saved_cap_space, next)
+        hlist_for_each_entry(tmp, &dev->saved_cap_space, next)
                 size += sizeof(struct pci_cap_saved_data) + tmp->cap.size;
 
         state = kzalloc(size, GFP_KERNEL);
@@ -1060,7 +1058,7 @@ struct pci_saved_state *pci_store_saved_state(struct pci_dev *dev)
                sizeof(state->config_space));
 
         cap = state->cap;
-        hlist_for_each_entry(tmp, pos, &dev->saved_cap_space, next) {
+        hlist_for_each_entry(tmp, &dev->saved_cap_space, next) {
                 size_t len = sizeof(struct pci_cap_saved_data) + tmp->cap.size;
                 memcpy(cap, &tmp->cap, len);
                 cap = (struct pci_cap_saved_data *)((u8 *)cap + len);
@@ -2038,9 +2036,9 @@ void pci_allocate_cap_save_buffers(struct pci_dev *dev)
 void pci_free_cap_save_buffers(struct pci_dev *dev)
 {
         struct pci_cap_saved_state *tmp;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
 
-        hlist_for_each_entry_safe(tmp, pos, n, &dev->saved_cap_space, next)
+        hlist_for_each_entry_safe(tmp, n, &dev->saved_cap_space, next)
                 kfree(tmp);
 }
 
diff --git a/drivers/power/bq2415x_charger.c b/drivers/power/bq2415x_charger.c
index ca91396fc48e..0727f9256138 100644
--- a/drivers/power/bq2415x_charger.c
+++ b/drivers/power/bq2415x_charger.c
@@ -1515,16 +1515,11 @@ static int bq2415x_probe(struct i2c_client *client,
         }
 
         /* Get new ID for the new device */
-        ret = idr_pre_get(&bq2415x_id, GFP_KERNEL);
-        if (ret == 0)
-                return -ENOMEM;
-
         mutex_lock(&bq2415x_id_mutex);
-        ret = idr_get_new(&bq2415x_id, client, &num);
+        num = idr_alloc(&bq2415x_id, client, 0, 0, GFP_KERNEL);
         mutex_unlock(&bq2415x_id_mutex);
-
-        if (ret < 0)
-                return ret;
+        if (num < 0)
+                return num;
 
         name = kasprintf(GFP_KERNEL, "%s-%d", id->name, num);
         if (!name) {
diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c
index 8ccf5d7d0add..26037ca7efb4 100644
--- a/drivers/power/bq27x00_battery.c
+++ b/drivers/power/bq27x00_battery.c
@@ -791,14 +791,11 @@ static int bq27x00_battery_probe(struct i2c_client *client,
         int retval = 0;
 
         /* Get new ID for the new battery device */
-        retval = idr_pre_get(&battery_id, GFP_KERNEL);
-        if (retval == 0)
-                return -ENOMEM;
         mutex_lock(&battery_mutex);
-        retval = idr_get_new(&battery_id, client, &num);
+        num = idr_alloc(&battery_id, client, 0, 0, GFP_KERNEL);
         mutex_unlock(&battery_mutex);
-        if (retval < 0)
-                return retval;
+        if (num < 0)
+                return num;
 
         name = kasprintf(GFP_KERNEL, "%s-%d", id->name, num);
         if (!name) {
diff --git a/drivers/power/ds2782_battery.c b/drivers/power/ds2782_battery.c
index e7301b3ed623..c09e7726c96c 100644
--- a/drivers/power/ds2782_battery.c
+++ b/drivers/power/ds2782_battery.c
@@ -395,17 +395,12 @@ static int ds278x_battery_probe(struct i2c_client *client,
         }
 
         /* Get an ID for this battery */
-        ret = idr_pre_get(&battery_id, GFP_KERNEL);
-        if (ret == 0) {
-                ret = -ENOMEM;
-                goto fail_id;
-        }
-
         mutex_lock(&battery_lock);
-        ret = idr_get_new(&battery_id, client, &num);
+        ret = idr_alloc(&battery_id, client, 0, 0, GFP_KERNEL);
         mutex_unlock(&battery_lock);
         if (ret < 0)
                 goto fail_id;
+        num = ret;
 
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info) {
diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c
index 2bf0c1b608dd..d3db26e46489 100644
--- a/drivers/pps/clients/pps-gpio.c
+++ b/drivers/pps/clients/pps-gpio.c
@@ -128,7 +128,8 @@ static int pps_gpio_probe(struct platform_device *pdev)
         }
 
         /* allocate space for device info */
-        data = kzalloc(sizeof(struct pps_gpio_device_data), GFP_KERNEL);
+        data = devm_kzalloc(&pdev->dev, sizeof(struct pps_gpio_device_data),
+                            GFP_KERNEL);
         if (data == NULL) {
                 err = -ENOMEM;
                 goto return_error;
@@ -150,7 +151,6 @@ static int pps_gpio_probe(struct platform_device *pdev)
                 pps_default_params |= PPS_CAPTURECLEAR | PPS_OFFSETCLEAR;
         data->pps = pps_register_source(&data->info, pps_default_params);
         if (data->pps == NULL) {
-                kfree(data);
                 pr_err("failed to register IRQ %d as PPS source\n", irq);
                 err = -EINVAL;
                 goto return_error;
@@ -164,7 +164,6 @@ static int pps_gpio_probe(struct platform_device *pdev)
                         get_irqf_trigger_flags(pdata), data->info.name, data);
         if (ret) {
                 pps_unregister_source(data->pps);
-                kfree(data);
                 pr_err("failed to acquire IRQ %d\n", irq);
                 err = -EINVAL;
                 goto return_error;
@@ -190,7 +189,6 @@ static int pps_gpio_remove(struct platform_device *pdev)
         gpio_free(pdata->gpio_pin);
         pps_unregister_source(data->pps);
         pr_info("removed IRQ %d as PPS source\n", data->irq);
-        kfree(data);
         return 0;
 }
 
diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
index f197e8ea185c..cdad4d95b20e 100644
--- a/drivers/pps/kapi.c
+++ b/drivers/pps/kapi.c
@@ -102,7 +102,7 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
                 goto pps_register_source_exit;
         }
 
-        /* These initializations must be done before calling idr_get_new()
+        /* These initializations must be done before calling idr_alloc()
          * in order to avoid reces into pps_event().
          */
         pps->params.api_version = PPS_API_VERS;
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 6437703eb10f..7173e3ad475d 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -295,29 +295,21 @@ int pps_register_cdev(struct pps_device *pps)
         dev_t devt;
 
         mutex_lock(&pps_idr_lock);
-        /* Get new ID for the new PPS source */
-        if (idr_pre_get(&pps_idr, GFP_KERNEL) == 0) {
-                mutex_unlock(&pps_idr_lock);
-                return -ENOMEM;
-        }
-
-        /* Now really allocate the PPS source.
-         * After idr_get_new() calling the new source will be freely available
-         * into the kernel.
+        /*
+         * Get new ID for the new PPS source.  After idr_alloc() calling
+         * the new source will be freely available into the kernel.
          */
-        err = idr_get_new(&pps_idr, pps, &pps->id);
-        mutex_unlock(&pps_idr_lock);
-
-        if (err < 0)
-                return err;
-
-        pps->id &= MAX_IDR_MASK;
-        if (pps->id >= PPS_MAX_SOURCES) {
-                pr_err("%s: too many PPS sources in the system\n",
-                                        pps->info.name);
-                err = -EBUSY;
-                goto free_idr;
+        err = idr_alloc(&pps_idr, pps, 0, PPS_MAX_SOURCES, GFP_KERNEL);
+        if (err < 0) {
+                if (err == -ENOSPC) {
+                        pr_err("%s: too many PPS sources in the system\n",
+                               pps->info.name);
+                        err = -EBUSY;
+                }
+                goto out_unlock;
         }
+        pps->id = err;
+        mutex_unlock(&pps_idr_lock);
 
         devt = MKDEV(MAJOR(pps_devt), pps->id);
 
@@ -351,8 +343,8 @@ del_cdev:
 free_idr:
         mutex_lock(&pps_idr_lock);
         idr_remove(&pps_idr, pps->id);
+out_unlock:
         mutex_unlock(&pps_idr_lock);
-
         return err;
 }
 
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index dd3bfaf1ad40..29387df4bfc9 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -199,11 +199,6 @@ int rproc_alloc_vring(struct rproc_vdev *rvdev, int i)
         /* actual size of vring (in bytes) */
         size = PAGE_ALIGN(vring_size(rvring->len, rvring->align));
 
-        if (!idr_pre_get(&rproc->notifyids, GFP_KERNEL)) {
-                dev_err(dev, "idr_pre_get failed\n");
-                return -ENOMEM;
-        }
-
         /*
          * Allocate non-cacheable memory for the vring. In the future
          * this call will also configure the IOMMU for us
@@ -221,12 +216,13 @@ int rproc_alloc_vring(struct rproc_vdev *rvdev, int i)
          * TODO: let the rproc know the notifyid of this vring
          * TODO: support predefined notifyids (via resource table)
          */
-        ret = idr_get_new(&rproc->notifyids, rvring, &notifyid);
+        ret = idr_alloc(&rproc->notifyids, rvring, 0, 0, GFP_KERNEL);
         if (ret) {
-                dev_err(dev, "idr_get_new failed: %d\n", ret);
+                dev_err(dev, "idr_alloc failed: %d\n", ret);
                 dma_free_coherent(dev->parent, size, va, dma);
                 return ret;
         }
+        notifyid = ret;
 
         /* Store largest notifyid */
         rproc->max_notifyid = max(rproc->max_notifyid, notifyid);
@@ -1180,7 +1176,6 @@ static void rproc_type_release(struct device *dev)
 
         rproc_delete_debug_dir(rproc);
 
-        idr_remove_all(&rproc->notifyids);
         idr_destroy(&rproc->notifyids);
 
         if (rproc->index >= 0)
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index d85446021ddb..a59684b5fc68 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -213,13 +213,10 @@ static struct rpmsg_endpoint *__rpmsg_create_ept(struct virtproc_info *vrp,
                 struct rpmsg_channel *rpdev, rpmsg_rx_cb_t cb,
                 void *priv, u32 addr)
 {
-        int err, tmpaddr, request;
+        int id_min, id_max, id;
         struct rpmsg_endpoint *ept;
         struct device *dev = rpdev ? &rpdev->dev : &vrp->vdev->dev;
 
-        if (!idr_pre_get(&vrp->endpoints, GFP_KERNEL))
-                return NULL;
-
         ept = kzalloc(sizeof(*ept), GFP_KERNEL);
         if (!ept) {
                 dev_err(dev, "failed to kzalloc a new ept\n");
@@ -234,31 +231,28 @@ static struct rpmsg_endpoint *__rpmsg_create_ept(struct virtproc_info *vrp,
         ept->priv = priv;
 
         /* do we need to allocate a local address ? */
-        request = addr == RPMSG_ADDR_ANY ? RPMSG_RESERVED_ADDRESSES : addr;
+        if (addr == RPMSG_ADDR_ANY) {
+                id_min = RPMSG_RESERVED_ADDRESSES;
+                id_max = 0;
+        } else {
+                id_min = addr;
+                id_max = addr + 1;
+        }
 
         mutex_lock(&vrp->endpoints_lock);
 
         /* bind the endpoint to an rpmsg address (and allocate one if needed) */
-        err = idr_get_new_above(&vrp->endpoints, ept, request, &tmpaddr);
-        if (err) {
-                dev_err(dev, "idr_get_new_above failed: %d\n", err);
+        id = idr_alloc(&vrp->endpoints, ept, id_min, id_max, GFP_KERNEL);
+        if (id < 0) {
+                dev_err(dev, "idr_alloc failed: %d\n", id);
                 goto free_ept;
         }
-
-        /* make sure the user's address request is fulfilled, if relevant */
-        if (addr != RPMSG_ADDR_ANY && tmpaddr != addr) {
-                dev_err(dev, "address 0x%x already in use\n", addr);
-                goto rem_idr;
-        }
-
-        ept->addr = tmpaddr;
+        ept->addr = id;
 
         mutex_unlock(&vrp->endpoints_lock);
 
         return ept;
 
-rem_idr:
-        idr_remove(&vrp->endpoints, request);
 free_ept:
         mutex_unlock(&vrp->endpoints_lock);
         kref_put(&ept->refcount, __ept_release);
@@ -1036,7 +1030,6 @@ static void rpmsg_remove(struct virtio_device *vdev)
         if (vrp->ns_ept)
                 __rpmsg_destroy_ept(vrp, vrp->ns_ept);
 
-        idr_remove_all(&vrp->endpoints);
         idr_destroy(&vrp->endpoints);
 
         vdev->config->del_vqs(vrp->vdev);
diff --git a/drivers/scsi/bfa/bfad_im.c b/drivers/scsi/bfa/bfad_im.c
index 8f92732655c7..5864f987f206 100644
--- a/drivers/scsi/bfa/bfad_im.c
+++ b/drivers/scsi/bfa/bfad_im.c
@@ -523,20 +523,13 @@ bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
         int error = 1;
 
         mutex_lock(&bfad_mutex);
-        if (!idr_pre_get(&bfad_im_port_index, GFP_KERNEL)) {
+        error = idr_alloc(&bfad_im_port_index, im_port, 0, 0, GFP_KERNEL);
+        if (error < 0) {
                 mutex_unlock(&bfad_mutex);
-                printk(KERN_WARNING "idr_pre_get failure\n");
+                printk(KERN_WARNING "idr_alloc failure\n");
                 goto out;
         }
-
-        error = idr_get_new(&bfad_im_port_index, im_port,
-                                         &im_port->idr_id);
-        if (error) {
-                mutex_unlock(&bfad_mutex);
-                printk(KERN_WARNING "idr_get_new failure\n");
-                goto out;
-        }
-
+        im_port->idr_id = error;
         mutex_unlock(&bfad_mutex);
 
         im_port->shost = bfad_scsi_host_alloc(im_port, bfad);
diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c
index a15474eef5f7..2a323742ce04 100644
--- a/drivers/scsi/ch.c
+++ b/drivers/scsi/ch.c
@@ -895,7 +895,7 @@ static int ch_probe(struct device *dev)
 {
         struct scsi_device *sd = to_scsi_device(dev);
         struct device *class_dev;
-        int minor, ret = -ENOMEM;
+        int ret;
         scsi_changer *ch;
 
         if (sd->type != TYPE_MEDIUM_CHANGER)
@@ -905,22 +905,19 @@ static int ch_probe(struct device *dev)
         if (NULL == ch)
                 return -ENOMEM;
 
-        if (!idr_pre_get(&ch_index_idr, GFP_KERNEL))
-                goto free_ch;
-
+        idr_preload(GFP_KERNEL);
         spin_lock(&ch_index_lock);
-        ret = idr_get_new(&ch_index_idr, ch, &minor);
+        ret = idr_alloc(&ch_index_idr, ch, 0, CH_MAX_DEVS + 1, GFP_NOWAIT);
         spin_unlock(&ch_index_lock);
+        idr_preload_end();
 
-        if (ret)
+        if (ret < 0) {
+                if (ret == -ENOSPC)
+                        ret = -ENODEV;
                 goto free_ch;
-
-        if (minor > CH_MAX_DEVS) {
-                ret = -ENODEV;
-                goto remove_idr;
         }
 
-        ch->minor = minor;
+        ch->minor = ret;
         sprintf(ch->name,"ch%d",ch->minor);
 
         class_dev = device_create(ch_sysfs_class, dev,
@@ -944,7 +941,7 @@ static int ch_probe(struct device *dev)
 
         return 0;
 remove_idr:
-        idr_remove(&ch_index_idr, minor);
+        idr_remove(&ch_index_idr, ch->minor);
 free_ch:
         kfree(ch);
         return ret;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 89ad55807012..7de4ef14698f 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -3165,14 +3165,10 @@ destroy_port(struct lpfc_vport *vport)
 int
 lpfc_get_instance(void)
 {
-        int instance = 0;
-
-        /* Assign an unused number */
-        if (!idr_pre_get(&lpfc_hba_index, GFP_KERNEL))
-                return -1;
-        if (idr_get_new(&lpfc_hba_index, NULL, &instance))
-                return -1;
-        return instance;
+        int ret;
+
+        ret = idr_alloc(&lpfc_hba_index, NULL, 0, 0, GFP_KERNEL);
+        return ret < 0 ? -1 : ret;
 }
 
 /**
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index be2c9a6561ff..9f0c46547459 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1391,24 +1391,23 @@ static Sg_device *sg_alloc(struct gendisk *disk, struct scsi_device *scsidp)
                 return ERR_PTR(-ENOMEM);
         }
 
-        if (!idr_pre_get(&sg_index_idr, GFP_KERNEL)) {
-                printk(KERN_WARNING "idr expansion Sg_device failure\n");
-                error = -ENOMEM;
-                goto out;
-        }
-
+        idr_preload(GFP_KERNEL);
         write_lock_irqsave(&sg_index_lock, iflags);
 
-        error = idr_get_new(&sg_index_idr, sdp, &k);
-        if (error) {
-                write_unlock_irqrestore(&sg_index_lock, iflags);
-                printk(KERN_WARNING "idr allocation Sg_device failure: %d\n",
-                       error);
-                goto out;
+        error = idr_alloc(&sg_index_idr, sdp, 0, SG_MAX_DEVS, GFP_NOWAIT);
+        if (error < 0) {
+                if (error == -ENOSPC) {
+                        sdev_printk(KERN_WARNING, scsidp,
+                                    "Unable to attach sg device type=%d, minor number exceeds %d\n",
+                                    scsidp->type, SG_MAX_DEVS - 1);
+                        error = -ENODEV;
+                } else {
+                        printk(KERN_WARNING
+                               "idr allocation Sg_device failure: %d\n", error);
+                }
+                goto out_unlock;
         }
-
-        if (unlikely(k >= SG_MAX_DEVS))
-                goto overflow;
+        k = error;
 
         SCSI_LOG_TIMEOUT(3, printk("sg_alloc: dev=%d \n", k));
         sprintf(disk->disk_name, "sg%d", k);
@@ -1420,25 +1419,17 @@ static Sg_device *sg_alloc(struct gendisk *disk, struct scsi_device *scsidp)
         sdp->sg_tablesize = queue_max_segments(q);
         sdp->index = k;
         kref_init(&sdp->d_ref);
+        error = 0;
 
+out_unlock:
         write_unlock_irqrestore(&sg_index_lock, iflags);
+        idr_preload_end();
 
-        error = 0;
- out:
         if (error) {
                 kfree(sdp);
                 return ERR_PTR(error);
         }
         return sdp;
-
- overflow:
-        idr_remove(&sg_index_idr, k);
-        write_unlock_irqrestore(&sg_index_lock, iflags);
-        sdev_printk(KERN_WARNING, scsidp,
-                    "Unable to attach sg device type=%d, minor "
-                    "number exceeds %d\n", scsidp->type, SG_MAX_DEVS - 1);
-        error = -ENODEV;
-        goto out;
 }
 
 static int
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 3e2b3717cb5c..86974471af68 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4076,7 +4076,7 @@ static int st_probe(struct device *dev)
         struct st_modedef *STm;
         struct st_partstat *STps;
         struct st_buffer *buffer;
-        int i, dev_num, error;
+        int i, error;
         char *stp;
 
         if (SDp->type != TYPE_TAPE)
@@ -4178,27 +4178,17 @@ static int st_probe(struct device *dev)
             tpnt->blksize_changed = 0;
         mutex_init(&tpnt->lock);
 
-        if (!idr_pre_get(&st_index_idr, GFP_KERNEL)) {
-                pr_warn("st: idr expansion failed\n");
-                error = -ENOMEM;
-                goto out_put_disk;
-        }
-
+        idr_preload(GFP_KERNEL);
         spin_lock(&st_index_lock);
-        error = idr_get_new(&st_index_idr, tpnt, &dev_num);
+        error = idr_alloc(&st_index_idr, tpnt, 0, ST_MAX_TAPES + 1, GFP_NOWAIT);
         spin_unlock(&st_index_lock);
-        if (error) {
+        idr_preload_end();
+        if (error < 0) {
                 pr_warn("st: idr allocation failed: %d\n", error);
                 goto out_put_disk;
         }
-
-        if (dev_num > ST_MAX_TAPES) {
-                pr_err("st: Too many tape devices (max. %d).\n", ST_MAX_TAPES);
-                goto out_put_index;
-        }
-
-        tpnt->index = dev_num;
-        sprintf(disk->disk_name, "st%d", dev_num);
+        tpnt->index = error;
+        sprintf(disk->disk_name, "st%d", tpnt->index);
 
         dev_set_drvdata(dev, tpnt);
 
@@ -4218,9 +4208,8 @@ static int st_probe(struct device *dev)
 
 out_remove_devs:
         remove_cdevs(tpnt);
-out_put_index:
         spin_lock(&st_index_lock);
-        idr_remove(&st_index_idr, dev_num);
+        idr_remove(&st_index_idr, tpnt->index);
         spin_unlock(&st_index_lock);
 out_put_disk:
         put_disk(disk);
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 538ebe213129..24456a0de6b2 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -2880,7 +2880,6 @@ static int binder_release(struct inode *nodp, struct file *filp)
 
 static void binder_deferred_release(struct binder_proc *proc)
 {
-        struct hlist_node *pos;
         struct binder_transaction *t;
         struct rb_node *n;
         int threads, nodes, incoming_refs, outgoing_refs, buffers, active_transactions, page_count;
@@ -2924,7 +2923,7 @@ static void binder_deferred_release(struct binder_proc *proc)
                         node->local_weak_refs = 0;
                         hlist_add_head(&node->dead_node, &binder_dead_nodes);
 
-                        hlist_for_each_entry(ref, pos, &node->refs, node_entry) {
+                        hlist_for_each_entry(ref, &node->refs, node_entry) {
                                 incoming_refs++;
                                 if (ref->death) {
                                         death++;
@@ -3156,12 +3155,11 @@ static void print_binder_thread(struct seq_file *m,
 static void print_binder_node(struct seq_file *m, struct binder_node *node)
 {
         struct binder_ref *ref;
-        struct hlist_node *pos;
         struct binder_work *w;
         int count;
 
         count = 0;
-        hlist_for_each_entry(ref, pos, &node->refs, node_entry)
+        hlist_for_each_entry(ref, &node->refs, node_entry)
                 count++;
 
         seq_printf(m, "  node %d: u%p c%p hs %d hw %d ls %d lw %d is %d iw %d",
@@ -3171,7 +3169,7 @@ static void print_binder_node(struct seq_file *m, struct binder_node *node)
                    node->internal_strong_refs, count);
         if (count) {
                 seq_puts(m, " proc");
-                hlist_for_each_entry(ref, pos, &node->refs, node_entry)
+                hlist_for_each_entry(ref, &node->refs, node_entry)
                         seq_printf(m, " %d", ref->proc->pid);
         }
         seq_puts(m, "\n");
@@ -3369,7 +3367,6 @@ static void print_binder_proc_stats(struct seq_file *m,
 static int binder_state_show(struct seq_file *m, void *unused)
 {
         struct binder_proc *proc;
-        struct hlist_node *pos;
         struct binder_node *node;
         int do_lock = !binder_debug_no_lock;
 
@@ -3380,10 +3377,10 @@ static int binder_state_show(struct seq_file *m, void *unused)
 
         if (!hlist_empty(&binder_dead_nodes))
                 seq_puts(m, "dead nodes:\n");
-        hlist_for_each_entry(node, pos, &binder_dead_nodes, dead_node)
+        hlist_for_each_entry(node, &binder_dead_nodes, dead_node)
                 print_binder_node(m, node);
 
-        hlist_for_each_entry(proc, pos, &binder_procs, proc_node)
+        hlist_for_each_entry(proc, &binder_procs, proc_node)
                 print_binder_proc(m, proc, 1);
         if (do_lock)
                 binder_unlock(__func__);
@@ -3393,7 +3390,6 @@ static int binder_state_show(struct seq_file *m, void *unused)
 static int binder_stats_show(struct seq_file *m, void *unused)
 {
         struct binder_proc *proc;
-        struct hlist_node *pos;
         int do_lock = !binder_debug_no_lock;
 
         if (do_lock)
@@ -3403,7 +3399,7 @@ static int binder_stats_show(struct seq_file *m, void *unused)
 
         print_binder_stats(m, "", &binder_stats);
 
-        hlist_for_each_entry(proc, pos, &binder_procs, proc_node)
+        hlist_for_each_entry(proc, &binder_procs, proc_node)
                 print_binder_proc_stats(m, proc);
         if (do_lock)
                 binder_unlock(__func__);
@@ -3413,14 +3409,13 @@ static int binder_stats_show(struct seq_file *m, void *unused)
 static int binder_transactions_show(struct seq_file *m, void *unused)
 {
         struct binder_proc *proc;
-        struct hlist_node *pos;
         int do_lock = !binder_debug_no_lock;
 
         if (do_lock)
                 binder_lock(__func__);
 
         seq_puts(m, "binder transactions:\n");
-        hlist_for_each_entry(proc, pos, &binder_procs, proc_node)
+        hlist_for_each_entry(proc, &binder_procs, proc_node)
                 print_binder_proc(m, proc, 0);
         if (do_lock)
                 binder_unlock(__func__);
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 23a98e658306..9435a3d369a7 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -144,23 +144,24 @@ struct iscsi_tiqn *iscsit_add_tiqn(unsigned char *buf)
         spin_lock_init(&tiqn->login_stats.lock);
         spin_lock_init(&tiqn->logout_stats.lock);
 
-        if (!idr_pre_get(&tiqn_idr, GFP_KERNEL)) {
-                pr_err("idr_pre_get() for tiqn_idr failed\n");
-                kfree(tiqn);
-                return ERR_PTR(-ENOMEM);
-        }
         tiqn->tiqn_state = TIQN_STATE_ACTIVE;
 
+        idr_preload(GFP_KERNEL);
         spin_lock(&tiqn_lock);
-        ret = idr_get_new(&tiqn_idr, NULL, &tiqn->tiqn_index);
+
+        ret = idr_alloc(&tiqn_idr, NULL, 0, 0, GFP_NOWAIT);
         if (ret < 0) {
-                pr_err("idr_get_new() failed for tiqn->tiqn_index\n");
+                pr_err("idr_alloc() failed for tiqn->tiqn_index\n");
                 spin_unlock(&tiqn_lock);
+                idr_preload_end();
                 kfree(tiqn);
                 return ERR_PTR(ret);
         }
+        tiqn->tiqn_index = ret;
         list_add_tail(&tiqn->tiqn_list, &g_tiqn_list);
+
         spin_unlock(&tiqn_lock);
+        idr_preload_end();
 
         pr_debug("CORE[0] - Added iSCSI Target IQN: %s\n", tiqn->tiqn);
 
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index fdb632f0ab85..2535d4d46c0e 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -247,19 +247,16 @@ static int iscsi_login_zero_tsih_s1(
         spin_lock_init(&sess->session_usage_lock);
         spin_lock_init(&sess->ttt_lock);
 
-        if (!idr_pre_get(&sess_idr, GFP_KERNEL)) {
-                pr_err("idr_pre_get() for sess_idr failed\n");
-                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
-                kfree(sess);
-                return -ENOMEM;
-        }
+        idr_preload(GFP_KERNEL);
         spin_lock_bh(&sess_idr_lock);
-        ret = idr_get_new(&sess_idr, NULL, &sess->session_index);
+        ret = idr_alloc(&sess_idr, NULL, 0, 0, GFP_NOWAIT);
+        if (ret >= 0)
+                sess->session_index = ret;
         spin_unlock_bh(&sess_idr_lock);
+        idr_preload_end();
 
         if (ret < 0) {
-                pr_err("idr_get_new() for sess_idr failed\n");
+                pr_err("idr_alloc() for sess_idr failed\n");
                 iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
                                 ISCSI_LOGIN_STATUS_NO_RESOURCES);
                 kfree(sess);
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index 6659dd36e806..113f33598b9f 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -169,7 +169,6 @@ static struct ft_sess *ft_sess_get(struct fc_lport *lport, u32 port_id)
 {
         struct ft_tport *tport;
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct ft_sess *sess;
 
         rcu_read_lock();
@@ -178,7 +177,7 @@ static struct ft_sess *ft_sess_get(struct fc_lport *lport, u32 port_id)
                 goto out;
 
         head = &tport->hash[ft_sess_hash(port_id)];
-        hlist_for_each_entry_rcu(sess, pos, head, hash) {
+        hlist_for_each_entry_rcu(sess, head, hash) {
                 if (sess->port_id == port_id) {
                         kref_get(&sess->kref);
                         rcu_read_unlock();
@@ -201,10 +200,9 @@ static struct ft_sess *ft_sess_create(struct ft_tport *tport, u32 port_id,
 {
         struct ft_sess *sess;
         struct hlist_head *head;
-        struct hlist_node *pos;
 
         head = &tport->hash[ft_sess_hash(port_id)];
-        hlist_for_each_entry_rcu(sess, pos, head, hash)
+        hlist_for_each_entry_rcu(sess, head, hash)
                 if (sess->port_id == port_id)
                         return sess;
 
@@ -253,11 +251,10 @@ static void ft_sess_unhash(struct ft_sess *sess)
 static struct ft_sess *ft_sess_delete(struct ft_tport *tport, u32 port_id)
 {
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct ft_sess *sess;
 
         head = &tport->hash[ft_sess_hash(port_id)];
-        hlist_for_each_entry_rcu(sess, pos, head, hash) {
+        hlist_for_each_entry_rcu(sess, head, hash) {
                 if (sess->port_id == port_id) {
                         ft_sess_unhash(sess);
                         return sess;
@@ -273,12 +270,11 @@ static struct ft_sess *ft_sess_delete(struct ft_tport *tport, u32 port_id)
 static void ft_sess_delete_all(struct ft_tport *tport)
 {
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct ft_sess *sess;
 
         for (head = tport->hash;
              head < &tport->hash[FT_SESS_HASH_SIZE]; head++) {
-                hlist_for_each_entry_rcu(sess, pos, head, hash) {
+                hlist_for_each_entry_rcu(sess, head, hash) {
                         ft_sess_unhash(sess);
                         transport_deregister_session_configfs(sess->se_sess);
                         ft_sess_put(sess);      /* release from table */
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 836828e29a87..c33fa5315d6b 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -73,21 +73,14 @@ static struct cpufreq_cooling_device *notify_device;
  */
 static int get_idr(struct idr *idr, int *id)
 {
-        int err;
-again:
-        if (unlikely(idr_pre_get(idr, GFP_KERNEL) == 0))
-                return -ENOMEM;
+        int ret;
 
         mutex_lock(&cooling_cpufreq_lock);
-        err = idr_get_new(idr, NULL, id);
+        ret = idr_alloc(idr, NULL, 0, 0, GFP_KERNEL);
         mutex_unlock(&cooling_cpufreq_lock);
-
-        if (unlikely(err == -EAGAIN))
-                goto again;
-        else if (unlikely(err))
-                return err;
-
-        *id = *id & MAX_IDR_MASK;
+        if (unlikely(ret < 0))
+                return ret;
+        *id = ret;
         return 0;
 }
 
diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
index 8c8ce806180f..84e95f32cdb6 100644
--- a/drivers/thermal/thermal_sys.c
+++ b/drivers/thermal/thermal_sys.c
@@ -132,23 +132,16 @@ EXPORT_SYMBOL_GPL(thermal_unregister_governor);
 
 static int get_idr(struct idr *idr, struct mutex *lock, int *id)
 {
-        int err;
-
-again:
-        if (unlikely(idr_pre_get(idr, GFP_KERNEL) == 0))
-                return -ENOMEM;
+        int ret;
 
         if (lock)
                 mutex_lock(lock);
-        err = idr_get_new(idr, NULL, id);
+        ret = idr_alloc(idr, NULL, 0, 0, GFP_KERNEL);
         if (lock)
                 mutex_unlock(lock);
-        if (unlikely(err == -EAGAIN))
-                goto again;
-        else if (unlikely(err))
-                return err;
-
-        *id = *id & MAX_IDR_MASK;
+        if (unlikely(ret < 0))
+                return ret;
+        *id = ret;
         return 0;
 }
 
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 5110f367f1f1..c8b926291e28 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -369,26 +369,15 @@ static void uio_dev_del_attributes(struct uio_device *idev)
 static int uio_get_minor(struct uio_device *idev)
 {
         int retval = -ENOMEM;
-        int id;
 
         mutex_lock(&minor_lock);
-        if (idr_pre_get(&uio_idr, GFP_KERNEL) == 0)
-                goto exit;
-
-        retval = idr_get_new(&uio_idr, idev, &id);
-        if (retval < 0) {
-                if (retval == -EAGAIN)
-                        retval = -ENOMEM;
-                goto exit;
-        }
-        if (id < UIO_MAX_DEVICES) {
-                idev->minor = id;
-        } else {
+        retval = idr_alloc(&uio_idr, idev, 0, UIO_MAX_DEVICES, GFP_KERNEL);
+        if (retval >= 0) {
+                idev->minor = retval;
+        } else if (retval == -ENOSPC) {
                 dev_err(idev->dev, "too many uio devices\n");
                 retval = -EINVAL;
-                idr_remove(&uio_idr, id);
         }
-exit:
         mutex_unlock(&minor_lock);
         return retval;
 }
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index 28e2d5b2c0c7..fcc12f3e60a3 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -139,23 +139,8 @@ EXPORT_SYMBOL_GPL(vfio_unregister_iommu_driver);
  */
 static int vfio_alloc_group_minor(struct vfio_group *group)
 {
-        int ret, minor;
-
-again:
-        if (unlikely(idr_pre_get(&vfio.group_idr, GFP_KERNEL) == 0))
-                return -ENOMEM;
-
         /* index 0 is used by /dev/vfio/vfio */
-        ret = idr_get_new_above(&vfio.group_idr, group, 1, &minor);
-        if (ret == -EAGAIN)
-                goto again;
-        if (ret || minor > MINORMASK) {
-                if (minor > MINORMASK)
-                        idr_remove(&vfio.group_idr, minor);
-                return -ENOSPC;
-        }
-
-        return minor;
+        return idr_alloc(&vfio.group_idr, group, 1, MINORMASK + 1, GFP_KERNEL);
 }
 
 static void vfio_free_group_minor(int minor)
diff --git a/drivers/video/backlight/Kconfig b/drivers/video/backlight/Kconfig
index be27b551473f..db10d0120d2b 100644
--- a/drivers/video/backlight/Kconfig
+++ b/drivers/video/backlight/Kconfig
@@ -384,6 +384,12 @@ config BACKLIGHT_LP855X
           This supports TI LP8550, LP8551, LP8552, LP8553, LP8556 and LP8557
           backlight driver.
 
+config BACKLIGHT_LP8788
+        tristate "Backlight driver for TI LP8788 MFD"
+        depends on BACKLIGHT_CLASS_DEVICE && MFD_LP8788
+        help
+          This supports TI LP8788 backlight driver.
+
 config BACKLIGHT_OT200
         tristate "Backlight driver for ot200 visualisation device"
         depends on BACKLIGHT_CLASS_DEVICE && CS5535_MFGPT && GPIO_CS5535
diff --git a/drivers/video/backlight/Makefile b/drivers/video/backlight/Makefile
index 4606c218e8e4..96c4d620c5ce 100644
--- a/drivers/video/backlight/Makefile
+++ b/drivers/video/backlight/Makefile
@@ -38,6 +38,7 @@ obj-$(CONFIG_BACKLIGHT_LM3630)		+= lm3630_bl.o
 obj-$(CONFIG_BACKLIGHT_LM3639)          += lm3639_bl.o
 obj-$(CONFIG_BACKLIGHT_LOCOMO)          += locomolcd.o
 obj-$(CONFIG_BACKLIGHT_LP855X)          += lp855x_bl.o
+obj-$(CONFIG_BACKLIGHT_LP8788)          += lp8788_bl.o
 obj-$(CONFIG_BACKLIGHT_MAX8925)         += max8925_bl.o
 obj-$(CONFIG_BACKLIGHT_OMAP1)           += omap1_bl.o
 obj-$(CONFIG_BACKLIGHT_OT200)           += ot200_bl.o
diff --git a/drivers/video/backlight/ams369fg06.c b/drivers/video/backlight/ams369fg06.c
index d29e49443f29..c02aa2c2575a 100644
--- a/drivers/video/backlight/ams369fg06.c
+++ b/drivers/video/backlight/ams369fg06.c
@@ -317,10 +317,7 @@ static int ams369fg06_power_on(struct ams369fg06 *lcd)
         pd = lcd->lcd_pd;
         bd = lcd->bd;
 
-        if (!pd->power_on) {
-                dev_err(lcd->dev, "power_on is NULL.\n");
-                return -EINVAL;
-        } else {
+        if (pd->power_on) {
                 pd->power_on(lcd->ld, 1);
                 msleep(pd->power_on_delay);
         }
@@ -370,7 +367,8 @@ static int ams369fg06_power_off(struct ams369fg06 *lcd)
 
         msleep(pd->power_off_delay);
 
-        pd->power_on(lcd->ld, 0);
+        if (pd->power_on)
+                pd->power_on(lcd->ld, 0);
 
         return 0;
 }
diff --git a/drivers/video/backlight/lp8788_bl.c b/drivers/video/backlight/lp8788_bl.c
new file mode 100644
index 000000000000..4bb8b4f140cf
--- /dev/null
+++ b/drivers/video/backlight/lp8788_bl.c
@@ -0,0 +1,333 @@
+/*
+ * TI LP8788 MFD - backlight driver
+ *
+ * Copyright 2012 Texas Instruments
+ *
+ * Author: Milo(Woogyom) Kim <milo.kim@ti.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/backlight.h>
+#include <linux/err.h>
+#include <linux/mfd/lp8788.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/pwm.h>
+#include <linux/slab.h>
+
+/* Register address */
+#define LP8788_BL_CONFIG                0x96
+#define LP8788_BL_EN                    BIT(0)
+#define LP8788_BL_PWM_INPUT_EN          BIT(5)
+#define LP8788_BL_FULLSCALE_SHIFT       2
+#define LP8788_BL_DIM_MODE_SHIFT        1
+#define LP8788_BL_PWM_POLARITY_SHIFT    6
+
+#define LP8788_BL_BRIGHTNESS            0x97
+
+#define LP8788_BL_RAMP                  0x98
+#define LP8788_BL_RAMP_RISE_SHIFT       4
+
+#define MAX_BRIGHTNESS                  127
+#define DEFAULT_BL_NAME                 "lcd-backlight"
+
+struct lp8788_bl_config {
+        enum lp8788_bl_ctrl_mode bl_mode;
+        enum lp8788_bl_dim_mode dim_mode;
+        enum lp8788_bl_full_scale_current full_scale;
+        enum lp8788_bl_ramp_step rise_time;
+        enum lp8788_bl_ramp_step fall_time;
+        enum pwm_polarity pwm_pol;
+};
+
+struct lp8788_bl {
+        struct lp8788 *lp;
+        struct backlight_device *bl_dev;
+        struct lp8788_backlight_platform_data *pdata;
+        enum lp8788_bl_ctrl_mode mode;
+        struct pwm_device *pwm;
+};
+
+struct lp8788_bl_config default_bl_config = {
+        .bl_mode    = LP8788_BL_REGISTER_ONLY,
+        .dim_mode   = LP8788_DIM_EXPONENTIAL,
+        .full_scale = LP8788_FULLSCALE_1900uA,
+        .rise_time  = LP8788_RAMP_8192us,
+        .fall_time  = LP8788_RAMP_8192us,
+        .pwm_pol    = PWM_POLARITY_NORMAL,
+};
+
+static inline bool is_brightness_ctrl_by_pwm(enum lp8788_bl_ctrl_mode mode)
+{
+        return (mode == LP8788_BL_COMB_PWM_BASED);
+}
+
+static inline bool is_brightness_ctrl_by_register(enum lp8788_bl_ctrl_mode mode)
+{
+        return (mode == LP8788_BL_REGISTER_ONLY ||
+                mode == LP8788_BL_COMB_REGISTER_BASED);
+}
+
+static int lp8788_backlight_configure(struct lp8788_bl *bl)
+{
+        struct lp8788_backlight_platform_data *pdata = bl->pdata;
+        struct lp8788_bl_config *cfg = &default_bl_config;
+        int ret;
+        u8 val;
+
+        /*
+         * Update chip configuration if platform data exists,
+         * otherwise use the default settings.
+         */
+        if (pdata) {
+                cfg->bl_mode    = pdata->bl_mode;
+                cfg->dim_mode   = pdata->dim_mode;
+                cfg->full_scale = pdata->full_scale;
+                cfg->rise_time  = pdata->rise_time;
+                cfg->fall_time  = pdata->fall_time;
+                cfg->pwm_pol    = pdata->pwm_pol;
+        }
+
+        /* Brightness ramp up/down */
+        val = (cfg->rise_time << LP8788_BL_RAMP_RISE_SHIFT) | cfg->fall_time;
+        ret = lp8788_write_byte(bl->lp, LP8788_BL_RAMP, val);
+        if (ret)
+                return ret;
+
+        /* Fullscale current setting */
+        val = (cfg->full_scale << LP8788_BL_FULLSCALE_SHIFT) |
+                (cfg->dim_mode << LP8788_BL_DIM_MODE_SHIFT);
+
+        /* Brightness control mode */
+        switch (cfg->bl_mode) {
+        case LP8788_BL_REGISTER_ONLY:
+                val |= LP8788_BL_EN;
+                break;
+        case LP8788_BL_COMB_PWM_BASED:
+        case LP8788_BL_COMB_REGISTER_BASED:
+                val |= LP8788_BL_EN | LP8788_BL_PWM_INPUT_EN |
+                        (cfg->pwm_pol << LP8788_BL_PWM_POLARITY_SHIFT);
+                break;
+        default:
+                dev_err(bl->lp->dev, "invalid mode: %d\n", cfg->bl_mode);
+                return -EINVAL;
+        }
+
+        bl->mode = cfg->bl_mode;
+
+        return lp8788_write_byte(bl->lp, LP8788_BL_CONFIG, val);
+}
+
+static void lp8788_pwm_ctrl(struct lp8788_bl *bl, int br, int max_br)
+{
+        unsigned int period;
+        unsigned int duty;
+        struct device *dev;
+        struct pwm_device *pwm;
+
+        if (!bl->pdata)
+                return;
+
+        period = bl->pdata->period_ns;
+        duty = br * period / max_br;
+        dev = bl->lp->dev;
+
+        /* request PWM device with the consumer name */
+        if (!bl->pwm) {
+                pwm = devm_pwm_get(dev, LP8788_DEV_BACKLIGHT);
+                if (IS_ERR(pwm)) {
+                        dev_err(dev, "can not get PWM device\n");
+                        return;
+                }
+
+                bl->pwm = pwm;
+        }
+
+        pwm_config(bl->pwm, duty, period);
+        if (duty)
+                pwm_enable(bl->pwm);
+        else
+                pwm_disable(bl->pwm);
+}
+
+static int lp8788_bl_update_status(struct backlight_device *bl_dev)
+{
+        struct lp8788_bl *bl = bl_get_data(bl_dev);
+        enum lp8788_bl_ctrl_mode mode = bl->mode;
+
+        if (bl_dev->props.state & BL_CORE_SUSPENDED)
+                bl_dev->props.brightness = 0;
+
+        if (is_brightness_ctrl_by_pwm(mode)) {
+                int brt = bl_dev->props.brightness;
+                int max = bl_dev->props.max_brightness;
+
+                lp8788_pwm_ctrl(bl, brt, max);
+        } else if (is_brightness_ctrl_by_register(mode)) {
+                u8 brt = bl_dev->props.brightness;
+
+                lp8788_write_byte(bl->lp, LP8788_BL_BRIGHTNESS, brt);
+        }
+
+        return 0;
+}
+
+static int lp8788_bl_get_brightness(struct backlight_device *bl_dev)
+{
+        return bl_dev->props.brightness;
+}
+
+static const struct backlight_ops lp8788_bl_ops = {
+        .options = BL_CORE_SUSPENDRESUME,
+        .update_status = lp8788_bl_update_status,
+        .get_brightness = lp8788_bl_get_brightness,
+};
+
+static int lp8788_backlight_register(struct lp8788_bl *bl)
+{
+        struct backlight_device *bl_dev;
+        struct backlight_properties props;
+        struct lp8788_backlight_platform_data *pdata = bl->pdata;
+        int init_brt;
+        char *name;
+
+        props.type = BACKLIGHT_PLATFORM;
+        props.max_brightness = MAX_BRIGHTNESS;
+
+        /* Initial brightness */
+        if (pdata)
+                init_brt = min_t(int, pdata->initial_brightness,
+                                props.max_brightness);
+        else
+                init_brt = 0;
+
+        props.brightness = init_brt;
+
+        /* Backlight device name */
+        if (!pdata || !pdata->name)
+                name = DEFAULT_BL_NAME;
+        else
+                name = pdata->name;
+
+        bl_dev = backlight_device_register(name, bl->lp->dev, bl,
+                                       &lp8788_bl_ops, &props);
+        if (IS_ERR(bl_dev))
+                return PTR_ERR(bl_dev);
+
+        bl->bl_dev = bl_dev;
+
+        return 0;
+}
+
+static void lp8788_backlight_unregister(struct lp8788_bl *bl)
+{
+        struct backlight_device *bl_dev = bl->bl_dev;
+
+        if (bl_dev)
+                backlight_device_unregister(bl_dev);
+}
+
+static ssize_t lp8788_get_bl_ctl_mode(struct device *dev,
+                                     struct device_attribute *attr, char *buf)
+{
+        struct lp8788_bl *bl = dev_get_drvdata(dev);
+        enum lp8788_bl_ctrl_mode mode = bl->mode;
+        char *strmode;
+
+        if (is_brightness_ctrl_by_pwm(mode))
+                strmode = "PWM based";
+        else if (is_brightness_ctrl_by_register(mode))
+                strmode = "Register based";
+        else
+                strmode = "Invalid mode";
+
+        return scnprintf(buf, PAGE_SIZE, "%s\n", strmode);
+}
+
+static DEVICE_ATTR(bl_ctl_mode, S_IRUGO, lp8788_get_bl_ctl_mode, NULL);
+
+static struct attribute *lp8788_attributes[] = {
+        &dev_attr_bl_ctl_mode.attr,
+        NULL,
+};
+
+static const struct attribute_group lp8788_attr_group = {
+        .attrs = lp8788_attributes,
+};
+
+static int lp8788_backlight_probe(struct platform_device *pdev)
+{
+        struct lp8788 *lp = dev_get_drvdata(pdev->dev.parent);
+        struct lp8788_bl *bl;
+        int ret;
+
+        bl = devm_kzalloc(lp->dev, sizeof(struct lp8788_bl), GFP_KERNEL);
+        if (!bl)
+                return -ENOMEM;
+
+        bl->lp = lp;
+        if (lp->pdata)
+                bl->pdata = lp->pdata->bl_pdata;
+
+        platform_set_drvdata(pdev, bl);
+
+        ret = lp8788_backlight_configure(bl);
+        if (ret) {
+                dev_err(lp->dev, "backlight config err: %d\n", ret);
+                goto err_dev;
+        }
+
+        ret = lp8788_backlight_register(bl);
+        if (ret) {
+                dev_err(lp->dev, "register backlight err: %d\n", ret);
+                goto err_dev;
+        }
+
+        ret = sysfs_create_group(&pdev->dev.kobj, &lp8788_attr_group);
+        if (ret) {
+                dev_err(lp->dev, "register sysfs err: %d\n", ret);
+                goto err_sysfs;
+        }
+
+        backlight_update_status(bl->bl_dev);
+
+        return 0;
+
+err_sysfs:
+        lp8788_backlight_unregister(bl);
+err_dev:
+        return ret;
+}
+
+static int lp8788_backlight_remove(struct platform_device *pdev)
+{
+        struct lp8788_bl *bl = platform_get_drvdata(pdev);
+        struct backlight_device *bl_dev = bl->bl_dev;
+
+        bl_dev->props.brightness = 0;
+        backlight_update_status(bl_dev);
+        sysfs_remove_group(&pdev->dev.kobj, &lp8788_attr_group);
+        lp8788_backlight_unregister(bl);
+        platform_set_drvdata(pdev, NULL);
+
+        return 0;
+}
+
+static struct platform_driver lp8788_bl_driver = {
+        .probe = lp8788_backlight_probe,
+        .remove = lp8788_backlight_remove,
+        .driver = {
+                .name = LP8788_DEV_BACKLIGHT,
+                .owner = THIS_MODULE,
+        },
+};
+module_platform_driver(lp8788_bl_driver);
+
+MODULE_DESCRIPTION("Texas Instruments LP8788 Backlight Driver");
+MODULE_AUTHOR("Milo Kim");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:lp8788-backlight");
diff --git a/drivers/w1/slaves/Kconfig b/drivers/w1/slaves/Kconfig
index 67526690acbc..762561fbabbf 100644
--- a/drivers/w1/slaves/Kconfig
+++ b/drivers/w1/slaves/Kconfig
@@ -17,11 +17,16 @@ config W1_SLAVE_SMEM
           simple 64bit memory rom(ds2401/ds2411/ds1990*) to your wire.
 
 config W1_SLAVE_DS2408
-        tristate "8-Channel Addressable Switch (IO Expander) 0x29 family support (DS2408)"
-        help
-          Say Y here if you want to use a 1-wire
+        tristate "8-Channel Addressable Switch (IO Expander) 0x29 family support (DS2408)"
+        help
+          Say Y here if you want to use a 1-wire
+          DS2408 8-Channel Addressable Switch device support
 
-                  DS2408 8-Channel Addressable Switch device support
+config W1_SLAVE_DS2413
+        tristate "Dual Channel Addressable Switch 0x3a family support (DS2413)"
+        help
+          Say Y here if you want to use a 1-wire
+          DS2413 Dual Channel Addressable Switch device support
 
 config W1_SLAVE_DS2423
         tristate "Counter 1-wire device (DS2423)"
diff --git a/drivers/w1/slaves/Makefile b/drivers/w1/slaves/Makefile
index 05188f6aab5a..06529f3157ab 100644
--- a/drivers/w1/slaves/Makefile
+++ b/drivers/w1/slaves/Makefile
@@ -4,7 +4,8 @@
 
 obj-$(CONFIG_W1_SLAVE_THERM)    += w1_therm.o
 obj-$(CONFIG_W1_SLAVE_SMEM)     += w1_smem.o
-obj-$(CONFIG_W1_SLAVE_DS2408)   += w1_ds2408.o
+obj-$(CONFIG_W1_SLAVE_DS2408)   += w1_ds2408.o
+obj-$(CONFIG_W1_SLAVE_DS2413)   += w1_ds2413.o
 obj-$(CONFIG_W1_SLAVE_DS2423)   += w1_ds2423.o
 obj-$(CONFIG_W1_SLAVE_DS2431)   += w1_ds2431.o
 obj-$(CONFIG_W1_SLAVE_DS2433)   += w1_ds2433.o
diff --git a/drivers/w1/slaves/w1_ds2413.c b/drivers/w1/slaves/w1_ds2413.c
new file mode 100644
index 000000000000..829786252c6b
--- /dev/null
+++ b/drivers/w1/slaves/w1_ds2413.c
@@ -0,0 +1,177 @@
+/*
+ * w1_ds2413.c - w1 family 3a (DS2413) driver
+ * based on w1_ds2408.c by Jean-Francois Dagenais <dagenaisj@sonatest.com>
+ *
+ * Copyright (c) 2013 Mariusz Bialonczyk <manio@skyboo.net>
+ *
+ * This source code is licensed under the GNU General Public License,
+ * Version 2. See the file COPYING for more details.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/device.h>
+#include <linux/types.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+
+#include "../w1.h"
+#include "../w1_int.h"
+#include "../w1_family.h"
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Mariusz Bialonczyk <manio@skyboo.net>");
+MODULE_DESCRIPTION("w1 family 3a driver for DS2413 2 Pin IO");
+
+#define W1_F3A_RETRIES                     3
+#define W1_F3A_FUNC_PIO_ACCESS_READ        0xF5
+#define W1_F3A_FUNC_PIO_ACCESS_WRITE       0x5A
+#define W1_F3A_SUCCESS_CONFIRM_BYTE        0xAA
+
+static ssize_t w1_f3a_read_state(
+        struct file *filp, struct kobject *kobj,
+        struct bin_attribute *bin_attr,
+        char *buf, loff_t off, size_t count)
+{
+        struct w1_slave *sl = kobj_to_w1_slave(kobj);
+        dev_dbg(&sl->dev,
+                "Reading %s kobj: %p, off: %0#10x, count: %zu, buff addr: %p",
+                bin_attr->attr.name, kobj, (unsigned int)off, count, buf);
+
+        if (off != 0)
+                return 0;
+        if (!buf)
+                return -EINVAL;
+
+        mutex_lock(&sl->master->bus_mutex);
+        dev_dbg(&sl->dev, "mutex locked");
+
+        if (w1_reset_select_slave(sl)) {
+                mutex_unlock(&sl->master->bus_mutex);
+                return -EIO;
+        }
+
+        w1_write_8(sl->master, W1_F3A_FUNC_PIO_ACCESS_READ);
+        *buf = w1_read_8(sl->master);
+
+        mutex_unlock(&sl->master->bus_mutex);
+        dev_dbg(&sl->dev, "mutex unlocked");
+
+        /* check for correct complement */
+        if ((*buf & 0x0F) != ((~*buf >> 4) & 0x0F))
+                return -EIO;
+        else
+                return 1;
+}
+
+static ssize_t w1_f3a_write_output(
+        struct file *filp, struct kobject *kobj,
+        struct bin_attribute *bin_attr,
+        char *buf, loff_t off, size_t count)
+{
+        struct w1_slave *sl = kobj_to_w1_slave(kobj);
+        u8 w1_buf[3];
+        unsigned int retries = W1_F3A_RETRIES;
+
+        if (count != 1 || off != 0)
+                return -EFAULT;
+
+        dev_dbg(&sl->dev, "locking mutex for write_output");
+        mutex_lock(&sl->master->bus_mutex);
+        dev_dbg(&sl->dev, "mutex locked");
+
+        if (w1_reset_select_slave(sl))
+                goto error;
+
+        /* according to the DS2413 datasheet the most significant 6 bits
+           should be set to "1"s, so do it now */
+        *buf = *buf | 0xFC;
+
+        while (retries--) {
+                w1_buf[0] = W1_F3A_FUNC_PIO_ACCESS_WRITE;
+                w1_buf[1] = *buf;
+                w1_buf[2] = ~(*buf);
+                w1_write_block(sl->master, w1_buf, 3);
+
+                if (w1_read_8(sl->master) == W1_F3A_SUCCESS_CONFIRM_BYTE) {
+                        mutex_unlock(&sl->master->bus_mutex);
+                        dev_dbg(&sl->dev, "mutex unlocked, retries:%d", retries);
+                        return 1;
+                }
+                if (w1_reset_resume_command(sl->master))
+                        goto error;
+        }
+
+error:
+        mutex_unlock(&sl->master->bus_mutex);
+        dev_dbg(&sl->dev, "mutex unlocked in error, retries:%d", retries);
+        return -EIO;
+}
+
+#define NB_SYSFS_BIN_FILES 2
+static struct bin_attribute w1_f3a_sysfs_bin_files[NB_SYSFS_BIN_FILES] = {
+        {
+                .attr = {
+                        .name = "state",
+                        .mode = S_IRUGO,
+                },
+                .size = 1,
+                .read = w1_f3a_read_state,
+        },
+        {
+                .attr = {
+                        .name = "output",
+                        .mode = S_IRUGO | S_IWUSR | S_IWGRP,
+                },
+                .size = 1,
+                .write = w1_f3a_write_output,
+        }
+};
+
+static int w1_f3a_add_slave(struct w1_slave *sl)
+{
+        int err = 0;
+        int i;
+
+        for (i = 0; i < NB_SYSFS_BIN_FILES && !err; ++i)
+                err = sysfs_create_bin_file(
+                        &sl->dev.kobj,
+                        &(w1_f3a_sysfs_bin_files[i]));
+        if (err)
+                while (--i >= 0)
+                        sysfs_remove_bin_file(&sl->dev.kobj,
+                                &(w1_f3a_sysfs_bin_files[i]));
+        return err;
+}
+
+static void w1_f3a_remove_slave(struct w1_slave *sl)
+{
+        int i;
+        for (i = NB_SYSFS_BIN_FILES - 1; i >= 0; --i)
+                sysfs_remove_bin_file(&sl->dev.kobj,
+                        &(w1_f3a_sysfs_bin_files[i]));
+}
+
+static struct w1_family_ops w1_f3a_fops = {
+        .add_slave      = w1_f3a_add_slave,
+        .remove_slave   = w1_f3a_remove_slave,
+};
+
+static struct w1_family w1_family_3a = {
+        .fid = W1_FAMILY_DS2413,
+        .fops = &w1_f3a_fops,
+};
+
+static int __init w1_f3a_init(void)
+{
+        return w1_register_family(&w1_family_3a);
+}
+
+static void __exit w1_f3a_exit(void)
+{
+        w1_unregister_family(&w1_family_3a);
+}
+
+module_init(w1_f3a_init);
+module_exit(w1_f3a_exit);
diff --git a/drivers/w1/w1_family.h b/drivers/w1/w1_family.h
index a1f0ce151d53..625dd08f775f 100644
--- a/drivers/w1/w1_family.h
+++ b/drivers/w1/w1_family.h
@@ -39,6 +39,7 @@
 #define W1_EEPROM_DS2431        0x2D
 #define W1_FAMILY_DS2760        0x30
 #define W1_FAMILY_DS2780        0x32
+#define W1_FAMILY_DS2413        0x3A
 #define W1_THERM_DS1825         0x3B
 #define W1_FAMILY_DS2781        0x3D
 #define W1_THERM_DS28EA00       0x42
diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
index eb82ee53ee0b..d9a43674cb94 100644
--- a/fs/affs/amigaffs.c
+++ b/fs/affs/amigaffs.c
@@ -125,9 +125,8 @@ static void
 affs_fix_dcache(struct inode *inode, u32 entry_ino)
 {
         struct dentry *dentry;
-        struct hlist_node *p;
         spin_lock(&inode->i_lock);
-        hlist_for_each_entry(dentry, p, &inode->i_dentry, d_alias) {
+        hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
                 if (entry_ino == (u32)(long)dentry->d_fsdata) {
                         dentry->d_fsdata = (void *)inode->i_ino;
                         break;
diff --git a/fs/aio.c b/fs/aio.c
index 064bfbe37566..3f941f2a3059 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -591,11 +591,10 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
 {
         struct mm_struct *mm = current->mm;
         struct kioctx *ctx, *ret = NULL;
-        struct hlist_node *n;
 
         rcu_read_lock();
 
-        hlist_for_each_entry_rcu(ctx, n, &mm->ioctx_list, list) {
+        hlist_for_each_entry_rcu(ctx, &mm->ioctx_list, list) {
                 /*
                  * RCU protects us against accessing freed memory but
                  * we have to be careful not to get a reference when the
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index d2a833999bcc..83f2606c76d0 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -816,10 +816,9 @@ static bool
 inode_has_hashed_dentries(struct inode *inode)
 {
         struct dentry *dentry;
-        struct hlist_node *p;
 
         spin_lock(&inode->i_lock);
-        hlist_for_each_entry(dentry, p, &inode->i_dentry, d_alias) {
+        hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
                 if (!d_unhashed(dentry) || IS_ROOT(dentry)) {
                         spin_unlock(&inode->i_lock);
                         return true;
diff --git a/fs/coredump.c b/fs/coredump.c
index 69baf903d3bd..c6479658d487 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -501,7 +501,7 @@ void do_coredump(siginfo_t *siginfo)
          * so we dump it as root in mode 2, and only into a controlled
          * environment (pipe handler or fully qualified path).
          */
-        if (__get_dumpable(cprm.mm_flags) == SUID_DUMPABLE_SAFE) {
+        if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) {
                 /* Setuid core dump mode */
                 flag = O_EXCL;          /* Stop rewrite attacks */
                 cred->fsuid = GLOBAL_ROOT_UID;  /* Dump root private */
diff --git a/fs/dcache.c b/fs/dcache.c
index 68220dd0c135..fbfae008ba44 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -675,11 +675,10 @@ EXPORT_SYMBOL(dget_parent);
 static struct dentry *__d_find_alias(struct inode *inode, int want_discon)
 {
         struct dentry *alias, *discon_alias;
-        struct hlist_node *p;
 
 again:
         discon_alias = NULL;
-        hlist_for_each_entry(alias, p, &inode->i_dentry, d_alias) {
+        hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
                 spin_lock(&alias->d_lock);
                 if (S_ISDIR(inode->i_mode) || !d_unhashed(alias)) {
                         if (IS_ROOT(alias) &&
@@ -730,10 +729,9 @@ EXPORT_SYMBOL(d_find_alias);
 void d_prune_aliases(struct inode *inode)
 {
         struct dentry *dentry;
-        struct hlist_node *p;
 restart:
         spin_lock(&inode->i_lock);
-        hlist_for_each_entry(dentry, p, &inode->i_dentry, d_alias) {
+        hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
                 spin_lock(&dentry->d_lock);
                 if (!dentry->d_count) {
                         __dget_dlock(dentry);
@@ -1443,14 +1441,13 @@ static struct dentry *__d_instantiate_unique(struct dentry *entry,
         int len = entry->d_name.len;
         const char *name = entry->d_name.name;
         unsigned int hash = entry->d_name.hash;
-        struct hlist_node *p;
 
         if (!inode) {
                 __d_instantiate(entry, NULL);
                 return NULL;
         }
 
-        hlist_for_each_entry(alias, p, &inode->i_dentry, d_alias) {
+        hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
                 /*
                  * Don't need alias->d_lock here, because aliases with
                  * d_parent == entry->d_parent are not subject to name or
diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
index f7501651762d..1b1146670c4b 100644
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@ -1183,7 +1183,7 @@ static void detach_lkb(struct dlm_lkb *lkb)
 static int create_lkb(struct dlm_ls *ls, struct dlm_lkb **lkb_ret)
 {
         struct dlm_lkb *lkb;
-        int rv, id;
+        int rv;
 
         lkb = dlm_allocate_lkb(ls);
         if (!lkb)
@@ -1199,19 +1199,13 @@ static int create_lkb(struct dlm_ls *ls, struct dlm_lkb **lkb_ret)
         mutex_init(&lkb->lkb_cb_mutex);
         INIT_WORK(&lkb->lkb_cb_work, dlm_callback_work);
 
- retry:
-        rv = idr_pre_get(&ls->ls_lkbidr, GFP_NOFS);
-        if (!rv)
-                return -ENOMEM;
-
+        idr_preload(GFP_NOFS);
         spin_lock(&ls->ls_lkbidr_spin);
-        rv = idr_get_new_above(&ls->ls_lkbidr, lkb, 1, &id);
-        if (!rv)
-                lkb->lkb_id = id;
+        rv = idr_alloc(&ls->ls_lkbidr, lkb, 1, 0, GFP_NOWAIT);
+        if (rv >= 0)
+                lkb->lkb_id = rv;
         spin_unlock(&ls->ls_lkbidr_spin);
-
-        if (rv == -EAGAIN)
-                goto retry;
+        idr_preload_end();
 
         if (rv < 0) {
                 log_error(ls, "create_lkb idr error %d", rv);
diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
index 2e99fb0c9737..3ca79d3253b9 100644
--- a/fs/dlm/lockspace.c
+++ b/fs/dlm/lockspace.c
@@ -796,7 +796,6 @@ static int release_lockspace(struct dlm_ls *ls, int force)
          */
 
         idr_for_each(&ls->ls_lkbidr, lkb_idr_free, ls);
-        idr_remove_all(&ls->ls_lkbidr);
         idr_destroy(&ls->ls_lkbidr);
 
         /*
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index dd87a31bcc21..4f5ad246582f 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -177,12 +177,11 @@ static inline int nodeid_hash(int nodeid)
 static struct connection *__find_con(int nodeid)
 {
         int r;
-        struct hlist_node *h;
         struct connection *con;
 
         r = nodeid_hash(nodeid);
 
-        hlist_for_each_entry(con, h, &connection_hash[r], list) {
+        hlist_for_each_entry(con, &connection_hash[r], list) {
                 if (con->nodeid == nodeid)
                         return con;
         }
@@ -232,13 +231,12 @@ static struct connection *__nodeid2con(int nodeid, gfp_t alloc)
 static void foreach_conn(void (*conn_func)(struct connection *c))
 {
         int i;
-        struct hlist_node *h, *n;
+        struct hlist_node *n;
         struct connection *con;
 
         for (i = 0; i < CONN_HASH_SIZE; i++) {
-                hlist_for_each_entry_safe(con, h, n, &connection_hash[i], list){
+                hlist_for_each_entry_safe(con, n, &connection_hash[i], list)
                         conn_func(con);
-                }
         }
 }
 
@@ -257,13 +255,12 @@ static struct connection *nodeid2con(int nodeid, gfp_t allocation)
 static struct connection *assoc2con(int assoc_id)
 {
         int i;
-        struct hlist_node *h;
         struct connection *con;
 
         mutex_lock(&connections_lock);
 
         for (i = 0 ; i < CONN_HASH_SIZE; i++) {
-                hlist_for_each_entry(con, h, &connection_hash[i], list) {
+                hlist_for_each_entry(con, &connection_hash[i], list) {
                         if (con->sctp_assoc == assoc_id) {
                                 mutex_unlock(&connections_lock);
                                 return con;
diff --git a/fs/dlm/recover.c b/fs/dlm/recover.c
index aedea28a86a1..a6bc63f6e31b 100644
--- a/fs/dlm/recover.c
+++ b/fs/dlm/recover.c
@@ -305,27 +305,26 @@ static int recover_idr_empty(struct dlm_ls *ls)
 static int recover_idr_add(struct dlm_rsb *r)
 {
         struct dlm_ls *ls = r->res_ls;
-        int rv, id;
-
-        rv = idr_pre_get(&ls->ls_recover_idr, GFP_NOFS);
-        if (!rv)
-                return -ENOMEM;
+        int rv;
 
+        idr_preload(GFP_NOFS);
         spin_lock(&ls->ls_recover_idr_lock);
         if (r->res_id) {
-                spin_unlock(&ls->ls_recover_idr_lock);
-                return -1;
-        }
-        rv = idr_get_new_above(&ls->ls_recover_idr, r, 1, &id);
-        if (rv) {
-                spin_unlock(&ls->ls_recover_idr_lock);
-                return rv;
+                rv = -1;
+                goto out_unlock;
         }
-        r->res_id = id;
+        rv = idr_alloc(&ls->ls_recover_idr, r, 1, 0, GFP_NOWAIT);
+        if (rv < 0)
+                goto out_unlock;
+
+        r->res_id = rv;
         ls->ls_recover_list_count++;
         dlm_hold_rsb(r);
+        rv = 0;
+out_unlock:
         spin_unlock(&ls->ls_recover_idr_lock);
-        return 0;
+        idr_preload_end();
+        return rv;
 }
 
 static void recover_idr_del(struct dlm_rsb *r)
@@ -351,24 +350,21 @@ static struct dlm_rsb *recover_idr_find(struct dlm_ls *ls, uint64_t id)
         return r;
 }
 
-static int recover_idr_clear_rsb(int id, void *p, void *data)
+static void recover_idr_clear(struct dlm_ls *ls)
 {
-        struct dlm_ls *ls = data;
-        struct dlm_rsb *r = p;
+        struct dlm_rsb *r;
+        int id;
 
-        r->res_id = 0;
-        r->res_recover_locks_count = 0;
-        ls->ls_recover_list_count--;
+        spin_lock(&ls->ls_recover_idr_lock);
 
-        dlm_put_rsb(r);
-        return 0;
-}
+        idr_for_each_entry(&ls->ls_recover_idr, r, id) {
+                idr_remove(&ls->ls_recover_idr, id);
+                r->res_id = 0;
+                r->res_recover_locks_count = 0;
+                ls->ls_recover_list_count--;
 
-static void recover_idr_clear(struct dlm_ls *ls)
-{
-        spin_lock(&ls->ls_recover_idr_lock);
-        idr_for_each(&ls->ls_recover_idr, recover_idr_clear_rsb, ls);
-        idr_remove_all(&ls->ls_recover_idr);
+                dlm_put_rsb(r);
+        }
 
         if (ls->ls_recover_list_count != 0) {
                 log_error(ls, "warning: recover_list_count %d",
diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
index 5fa2471796c2..8d7a577ae497 100644
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -115,10 +115,9 @@ void ecryptfs_msg_ctx_alloc_to_free(struct ecryptfs_msg_ctx *msg_ctx)
  */
 int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon)
 {
-        struct hlist_node *elem;
         int rc;
 
-        hlist_for_each_entry(*daemon, elem,
+        hlist_for_each_entry(*daemon,
                             &ecryptfs_daemon_hash[ecryptfs_current_euid_hash()],
                             euid_chain) {
                 if (uid_eq((*daemon)->file->f_cred->euid, current_euid())) {
@@ -445,7 +444,6 @@ void ecryptfs_release_messaging(void)
                 mutex_unlock(&ecryptfs_msg_ctx_lists_mux);
         }
         if (ecryptfs_daemon_hash) {
-                struct hlist_node *elem;
                 struct ecryptfs_daemon *daemon;
                 int i;
 
@@ -453,7 +451,7 @@ void ecryptfs_release_messaging(void)
                 for (i = 0; i < (1 << ecryptfs_hash_bits); i++) {
                         int rc;
 
-                        hlist_for_each_entry(daemon, elem,
+                        hlist_for_each_entry(daemon,
                                              &ecryptfs_daemon_hash[i],
                                              euid_chain) {
                                 rc = ecryptfs_exorcise_daemon(daemon);
diff --git a/fs/exec.c b/fs/exec.c
index 864c50df660a..a96a4885bbbf 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1111,7 +1111,7 @@ void setup_new_exec(struct linux_binprm * bprm)
         current->sas_ss_sp = current->sas_ss_size = 0;
 
         if (uid_eq(current_euid(), current_uid()) && gid_eq(current_egid(), current_gid()))
-                set_dumpable(current->mm, SUID_DUMPABLE_ENABLED);
+                set_dumpable(current->mm, SUID_DUMP_USER);
         else
                 set_dumpable(current->mm, suid_dumpable);
 
@@ -1639,17 +1639,17 @@ EXPORT_SYMBOL(set_binfmt);
 void set_dumpable(struct mm_struct *mm, int value)
 {
         switch (value) {
-        case SUID_DUMPABLE_DISABLED:
+        case SUID_DUMP_DISABLE:
                 clear_bit(MMF_DUMPABLE, &mm->flags);
                 smp_wmb();
                 clear_bit(MMF_DUMP_SECURELY, &mm->flags);
                 break;
-        case SUID_DUMPABLE_ENABLED:
+        case SUID_DUMP_USER:
                 set_bit(MMF_DUMPABLE, &mm->flags);
                 smp_wmb();
                 clear_bit(MMF_DUMP_SECURELY, &mm->flags);
                 break;
-        case SUID_DUMPABLE_SAFE:
+        case SUID_DUMP_ROOT:
                 set_bit(MMF_DUMP_SECURELY, &mm->flags);
                 smp_wmb();
                 set_bit(MMF_DUMPABLE, &mm->flags);
@@ -1662,7 +1662,7 @@ int __get_dumpable(unsigned long mm_flags)
         int ret;
 
         ret = mm_flags & MMF_DUMPABLE_MASK;
-        return (ret > SUID_DUMPABLE_ENABLED) ? SUID_DUMPABLE_SAFE : ret;
+        return (ret > SUID_DUMP_USER) ? SUID_DUMP_ROOT : ret;
 }
 
 int get_dumpable(struct mm_struct *mm)
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index 5df4bb4aab14..262fc9940982 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -44,14 +44,13 @@ find_acceptable_alias(struct dentry *result,
 {
         struct dentry *dentry, *toput = NULL;
         struct inode *inode;
-        struct hlist_node *p;
 
         if (acceptable(context, result))
                 return result;
 
         inode = result->d_inode;
         spin_lock(&inode->i_lock);
-        hlist_for_each_entry(dentry, p, &inode->i_dentry, d_alias) {
+        hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
                 dget(dentry);
                 spin_unlock(&inode->i_lock);
                 if (toput)
diff --git a/fs/fat/fat.h b/fs/fat/fat.h
index 12701a567752..e9cc3f0d58e2 100644
--- a/fs/fat/fat.h
+++ b/fs/fat/fat.h
@@ -95,6 +95,8 @@ struct msdos_sb_info {
 
         spinlock_t dir_hash_lock;
         struct hlist_head dir_hashtable[FAT_HASH_SIZE];
+
+        unsigned int dirty;           /* fs state before mount */
 };
 
 #define FAT_CACHE_VALID 0       /* special case for valid cache */
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index f8f491677a4a..acf6e479b443 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -341,12 +341,11 @@ struct inode *fat_iget(struct super_block *sb, loff_t i_pos)
 {
         struct msdos_sb_info *sbi = MSDOS_SB(sb);
         struct hlist_head *head = sbi->inode_hashtable + fat_hash(i_pos);
-        struct hlist_node *_p;
         struct msdos_inode_info *i;
         struct inode *inode = NULL;
 
         spin_lock(&sbi->inode_hash_lock);
-        hlist_for_each_entry(i, _p, head, i_fat_hash) {
+        hlist_for_each_entry(i, head, i_fat_hash) {
                 BUG_ON(i->vfs_inode.i_sb != sb);
                 if (i->i_pos != i_pos)
                         continue;
@@ -488,10 +487,59 @@ static void fat_evict_inode(struct inode *inode)
         fat_detach(inode);
 }
 
+static void fat_set_state(struct super_block *sb,
+                        unsigned int set, unsigned int force)
+{
+        struct buffer_head *bh;
+        struct fat_boot_sector *b;
+        struct msdos_sb_info *sbi = sb->s_fs_info;
+
+        /* do not change any thing if mounted read only */
+        if ((sb->s_flags & MS_RDONLY) && !force)
+                return;
+
+        /* do not change state if fs was dirty */
+        if (sbi->dirty) {
+                /* warn only on set (mount). */
+                if (set)
+                        fat_msg(sb, KERN_WARNING, "Volume was not properly "
+                                "unmounted. Some data may be corrupt. "
+                                "Please run fsck.");
+                return;
+        }
+
+        bh = sb_bread(sb, 0);
+        if (bh == NULL) {
+                fat_msg(sb, KERN_ERR, "unable to read boot sector "
+                        "to mark fs as dirty");
+                return;
+        }
+
+        b = (struct fat_boot_sector *) bh->b_data;
+
+        if (sbi->fat_bits == 32) {
+                if (set)
+                        b->fat32.state |= FAT_STATE_DIRTY;
+                else
+                        b->fat32.state &= ~FAT_STATE_DIRTY;
+        } else /* fat 16 and 12 */ {
+                if (set)
+                        b->fat16.state |= FAT_STATE_DIRTY;
+                else
+                        b->fat16.state &= ~FAT_STATE_DIRTY;
+        }
+
+        mark_buffer_dirty(bh);
+        sync_dirty_buffer(bh);
+        brelse(bh);
+}
+
 static void fat_put_super(struct super_block *sb)
 {
         struct msdos_sb_info *sbi = MSDOS_SB(sb);
 
+        fat_set_state(sb, 0, 0);
+
         iput(sbi->fsinfo_inode);
         iput(sbi->fat_inode);
 
@@ -566,8 +614,18 @@ static void __exit fat_destroy_inodecache(void)
 
 static int fat_remount(struct super_block *sb, int *flags, char *data)
 {
+        int new_rdonly;
         struct msdos_sb_info *sbi = MSDOS_SB(sb);
         *flags |= MS_NODIRATIME | (sbi->options.isvfat ? 0 : MS_NOATIME);
+
+        /* make sure we update state on remount. */
+        new_rdonly = *flags & MS_RDONLY;
+        if (new_rdonly != (sb->s_flags & MS_RDONLY)) {
+                if (new_rdonly)
+                        fat_set_state(sb, 0, 0);
+                else
+                        fat_set_state(sb, 1, 1);
+        }
         return 0;
 }
 
@@ -1298,17 +1356,17 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
         sbi->prev_free = FAT_START_ENT;
         sb->s_maxbytes = 0xffffffff;
 
-        if (!sbi->fat_length && b->fat32_length) {
+        if (!sbi->fat_length && b->fat32.length) {
                 struct fat_boot_fsinfo *fsinfo;
                 struct buffer_head *fsinfo_bh;
 
                 /* Must be FAT32 */
                 sbi->fat_bits = 32;
-                sbi->fat_length = le32_to_cpu(b->fat32_length);
-                sbi->root_cluster = le32_to_cpu(b->root_cluster);
+                sbi->fat_length = le32_to_cpu(b->fat32.length);
+                sbi->root_cluster = le32_to_cpu(b->fat32.root_cluster);
 
                 /* MC - if info_sector is 0, don't multiply by 0 */
-                sbi->fsinfo_sector = le16_to_cpu(b->info_sector);
+                sbi->fsinfo_sector = le16_to_cpu(b->fat32.info_sector);
                 if (sbi->fsinfo_sector == 0)
                         sbi->fsinfo_sector = 1;
 
@@ -1362,6 +1420,12 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
         if (sbi->fat_bits != 32)
                 sbi->fat_bits = (total_clusters > MAX_FAT12) ? 16 : 12;
 
+        /* some OSes set FAT_STATE_DIRTY and clean it on unmount. */
+        if (sbi->fat_bits == 32)
+                sbi->dirty = b->fat32.state & FAT_STATE_DIRTY;
+        else /* fat 16 or 12 */
+                sbi->dirty = b->fat16.state & FAT_STATE_DIRTY;
+
         /* check that FAT table does not overflow */
         fat_clusters = sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits;
         total_clusters = min(total_clusters, fat_clusters - FAT_START_ENT);
@@ -1456,6 +1520,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
                                         "the device does not support discard");
         }
 
+        fat_set_state(sb, 1, 0);
         return 0;
 
 out_invalid:
diff --git a/fs/fat/nfs.c b/fs/fat/nfs.c
index ef4b5faba87b..499c10438ca2 100644
--- a/fs/fat/nfs.c
+++ b/fs/fat/nfs.c
@@ -21,13 +21,12 @@ static struct inode *fat_dget(struct super_block *sb, int i_logstart)
 {
         struct msdos_sb_info *sbi = MSDOS_SB(sb);
         struct hlist_head *head;
-        struct hlist_node *_p;
         struct msdos_inode_info *i;
         struct inode *inode = NULL;
 
         head = sbi->dir_hashtable + fat_dir_hash(i_logstart);
         spin_lock(&sbi->dir_hash_lock);
-        hlist_for_each_entry(i, _p, head, i_dir_hash) {
+        hlist_for_each_entry(i, head, i_dir_hash) {
                 BUG_ON(i->vfs_inode.i_sb != sb);
                 if (i->i_logstart != i_logstart)
                         continue;
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 8dcb114758e3..e2cba1f60c21 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -237,13 +237,12 @@ static int fscache_alloc_object(struct fscache_cache *cache,
                                 struct fscache_cookie *cookie)
 {
         struct fscache_object *object;
-        struct hlist_node *_n;
         int ret;
 
         _enter("%p,%p{%s}", cache, cookie, cookie->def->name);
 
         spin_lock(&cookie->lock);
-        hlist_for_each_entry(object, _n, &cookie->backing_objects,
+        hlist_for_each_entry(object, &cookie->backing_objects,
                              cookie_link) {
                 if (object->cache == cache)
                         goto object_already_extant;
@@ -311,7 +310,6 @@ static int fscache_attach_object(struct fscache_cookie *cookie,
 {
         struct fscache_object *p;
         struct fscache_cache *cache = object->cache;
-        struct hlist_node *_n;
         int ret;
 
         _enter("{%s},{OBJ%x}", cookie->def->name, object->debug_id);
@@ -321,7 +319,7 @@ static int fscache_attach_object(struct fscache_cookie *cookie,
         /* there may be multiple initial creations of this object, but we only
          * want one */
         ret = -EEXIST;
-        hlist_for_each_entry(p, _n, &cookie->backing_objects, cookie_link) {
+        hlist_for_each_entry(p, &cookie->backing_objects, cookie_link) {
                 if (p->cache == object->cache) {
                         if (p->state >= FSCACHE_OBJECT_DYING)
                                 ret = -ENOBUFS;
@@ -331,7 +329,7 @@ static int fscache_attach_object(struct fscache_cookie *cookie,
 
         /* pin the parent object */
         spin_lock_nested(&cookie->parent->lock, 1);
-        hlist_for_each_entry(p, _n, &cookie->parent->backing_objects,
+        hlist_for_each_entry(p, &cookie->parent->backing_objects,
                              cookie_link) {
                 if (p->cache == object->cache) {
                         if (p->state >= FSCACHE_OBJECT_DYING) {
@@ -435,7 +433,6 @@ EXPORT_SYMBOL(__fscache_wait_on_invalidate);
 void __fscache_update_cookie(struct fscache_cookie *cookie)
 {
         struct fscache_object *object;
-        struct hlist_node *_p;
 
         fscache_stat(&fscache_n_updates);
 
@@ -452,7 +449,7 @@ void __fscache_update_cookie(struct fscache_cookie *cookie)
         spin_lock(&cookie->lock);
 
         /* update the index entry on disk in each cache backing this cookie */
-        hlist_for_each_entry(object, _p,
+        hlist_for_each_entry(object,
                              &cookie->backing_objects, cookie_link) {
                 fscache_raise_event(object, FSCACHE_OBJECT_EV_UPDATE);
         }
diff --git a/fs/hfsplus/Makefile b/fs/hfsplus/Makefile
index 3cc0df730156..09d278bb7b91 100644
--- a/fs/hfsplus/Makefile
+++ b/fs/hfsplus/Makefile
@@ -5,5 +5,5 @@
 obj-$(CONFIG_HFSPLUS_FS) += hfsplus.o
 
 hfsplus-objs := super.o options.o inode.o ioctl.o extents.o catalog.o dir.o btree.o \
-                bnode.o brec.o bfind.o tables.o unicode.o wrapper.o bitmap.o part_tbl.o
-
+                bnode.o brec.o bfind.o tables.o unicode.o wrapper.o bitmap.o part_tbl.o \
+                attributes.o xattr.o xattr_user.o xattr_security.o xattr_trusted.o
diff --git a/fs/hfsplus/attributes.c b/fs/hfsplus/attributes.c
new file mode 100644
index 000000000000..8d691f124714
--- /dev/null
+++ b/fs/hfsplus/attributes.c
@@ -0,0 +1,399 @@
+/*
+ * linux/fs/hfsplus/attributes.c
+ *
+ * Vyacheslav Dubeyko <slava@dubeyko.com>
+ *
+ * Handling of records in attributes tree
+ */
+
+#include "hfsplus_fs.h"
+#include "hfsplus_raw.h"
+
+static struct kmem_cache *hfsplus_attr_tree_cachep;
+
+int hfsplus_create_attr_tree_cache(void)
+{
+        if (hfsplus_attr_tree_cachep)
+                return -EEXIST;
+
+        hfsplus_attr_tree_cachep =
+                kmem_cache_create("hfsplus_attr_cache",
+                        sizeof(hfsplus_attr_entry), 0,
+                        SLAB_HWCACHE_ALIGN, NULL);
+        if (!hfsplus_attr_tree_cachep)
+                return -ENOMEM;
+
+        return 0;
+}
+
+void hfsplus_destroy_attr_tree_cache(void)
+{
+        kmem_cache_destroy(hfsplus_attr_tree_cachep);
+}
+
+int hfsplus_attr_bin_cmp_key(const hfsplus_btree_key *k1,
+                                const hfsplus_btree_key *k2)
+{
+        __be32 k1_cnid, k2_cnid;
+
+        k1_cnid = k1->attr.cnid;
+        k2_cnid = k2->attr.cnid;
+        if (k1_cnid != k2_cnid)
+                return be32_to_cpu(k1_cnid) < be32_to_cpu(k2_cnid) ? -1 : 1;
+
+        return hfsplus_strcmp(
+                        (const struct hfsplus_unistr *)&k1->attr.key_name,
+                        (const struct hfsplus_unistr *)&k2->attr.key_name);
+}
+
+int hfsplus_attr_build_key(struct super_block *sb, hfsplus_btree_key *key,
+                        u32 cnid, const char *name)
+{
+        int len;
+
+        memset(key, 0, sizeof(struct hfsplus_attr_key));
+        key->attr.cnid = cpu_to_be32(cnid);
+        if (name) {
+                len = strlen(name);
+                if (len > HFSPLUS_ATTR_MAX_STRLEN) {
+                        printk(KERN_ERR "hfs: invalid xattr name's length\n");
+                        return -EINVAL;
+                }
+                hfsplus_asc2uni(sb,
+                                (struct hfsplus_unistr *)&key->attr.key_name,
+                                HFSPLUS_ATTR_MAX_STRLEN, name, len);
+                len = be16_to_cpu(key->attr.key_name.length);
+        } else {
+                key->attr.key_name.length = 0;
+                len = 0;
+        }
+
+        /* The length of the key, as stored in key_len field, does not include
+         * the size of the key_len field itself.
+         * So, offsetof(hfsplus_attr_key, key_name) is a trick because
+         * it takes into consideration key_len field (__be16) of
+         * hfsplus_attr_key structure instead of length field (__be16) of
+         * hfsplus_attr_unistr structure.
+         */
+        key->key_len =
+                cpu_to_be16(offsetof(struct hfsplus_attr_key, key_name) +
+                                2 * len);
+
+        return 0;
+}
+
+void hfsplus_attr_build_key_uni(hfsplus_btree_key *key,
+                                        u32 cnid,
+                                        struct hfsplus_attr_unistr *name)
+{
+        int ustrlen;
+
+        memset(key, 0, sizeof(struct hfsplus_attr_key));
+        ustrlen = be16_to_cpu(name->length);
+        key->attr.cnid = cpu_to_be32(cnid);
+        key->attr.key_name.length = cpu_to_be16(ustrlen);
+        ustrlen *= 2;
+        memcpy(key->attr.key_name.unicode, name->unicode, ustrlen);
+
+        /* The length of the key, as stored in key_len field, does not include
+         * the size of the key_len field itself.
+         * So, offsetof(hfsplus_attr_key, key_name) is a trick because
+         * it takes into consideration key_len field (__be16) of
+         * hfsplus_attr_key structure instead of length field (__be16) of
+         * hfsplus_attr_unistr structure.
+         */
+        key->key_len =
+                cpu_to_be16(offsetof(struct hfsplus_attr_key, key_name) +
+                                ustrlen);
+}
+
+hfsplus_attr_entry *hfsplus_alloc_attr_entry(void)
+{
+        return kmem_cache_alloc(hfsplus_attr_tree_cachep, GFP_KERNEL);
+}
+
+void hfsplus_destroy_attr_entry(hfsplus_attr_entry *entry)
+{
+        if (entry)
+                kmem_cache_free(hfsplus_attr_tree_cachep, entry);
+}
+
+#define HFSPLUS_INVALID_ATTR_RECORD -1
+
+static int hfsplus_attr_build_record(hfsplus_attr_entry *entry, int record_type,
+                                u32 cnid, const void *value, size_t size)
+{
+        if (record_type == HFSPLUS_ATTR_FORK_DATA) {
+                /*
+                 * Mac OS X supports only inline data attributes.
+                 * Do nothing
+                 */
+                memset(entry, 0, sizeof(*entry));
+                return sizeof(struct hfsplus_attr_fork_data);
+        } else if (record_type == HFSPLUS_ATTR_EXTENTS) {
+                /*
+                 * Mac OS X supports only inline data attributes.
+                 * Do nothing.
+                 */
+                memset(entry, 0, sizeof(*entry));
+                return sizeof(struct hfsplus_attr_extents);
+        } else if (record_type == HFSPLUS_ATTR_INLINE_DATA) {
+                u16 len;
+
+                memset(entry, 0, sizeof(struct hfsplus_attr_inline_data));
+                entry->inline_data.record_type = cpu_to_be32(record_type);
+                if (size <= HFSPLUS_MAX_INLINE_DATA_SIZE)
+                        len = size;
+                else
+                        return HFSPLUS_INVALID_ATTR_RECORD;
+                entry->inline_data.length = cpu_to_be16(len);
+                memcpy(entry->inline_data.raw_bytes, value, len);
+                /*
+                 * Align len on two-byte boundary.
+                 * It needs to add pad byte if we have odd len.
+                 */
+                len = round_up(len, 2);
+                return offsetof(struct hfsplus_attr_inline_data, raw_bytes) +
+                                        len;
+        } else /* invalid input */
+                memset(entry, 0, sizeof(*entry));
+
+        return HFSPLUS_INVALID_ATTR_RECORD;
+}
+
+int hfsplus_find_attr(struct super_block *sb, u32 cnid,
+                        const char *name, struct hfs_find_data *fd)
+{
+        int err = 0;
+
+        dprint(DBG_ATTR_MOD, "find_attr: %s,%d\n", name ? name : NULL, cnid);
+
+        if (!HFSPLUS_SB(sb)->attr_tree) {
+                printk(KERN_ERR "hfs: attributes file doesn't exist\n");
+                return -EINVAL;
+        }
+
+        if (name) {
+                err = hfsplus_attr_build_key(sb, fd->search_key, cnid, name);
+                if (err)
+                        goto failed_find_attr;
+                err = hfs_brec_find(fd, hfs_find_rec_by_key);
+                if (err)
+                        goto failed_find_attr;
+        } else {
+                err = hfsplus_attr_build_key(sb, fd->search_key, cnid, NULL);
+                if (err)
+                        goto failed_find_attr;
+                err = hfs_brec_find(fd, hfs_find_1st_rec_by_cnid);
+                if (err)
+                        goto failed_find_attr;
+        }
+
+failed_find_attr:
+        return err;
+}
+
+int hfsplus_attr_exists(struct inode *inode, const char *name)
+{
+        int err = 0;
+        struct super_block *sb = inode->i_sb;
+        struct hfs_find_data fd;
+
+        if (!HFSPLUS_SB(sb)->attr_tree)
+                return 0;
+
+        err = hfs_find_init(HFSPLUS_SB(sb)->attr_tree, &fd);
+        if (err)
+                return 0;
+
+        err = hfsplus_find_attr(sb, inode->i_ino, name, &fd);
+        if (err)
+                goto attr_not_found;
+
+        hfs_find_exit(&fd);
+        return 1;
+
+attr_not_found:
+        hfs_find_exit(&fd);
+        return 0;
+}
+
+int hfsplus_create_attr(struct inode *inode,
+                                const char *name,
+                                const void *value, size_t size)
+{
+        struct super_block *sb = inode->i_sb;
+        struct hfs_find_data fd;
+        hfsplus_attr_entry *entry_ptr;
+        int entry_size;
+        int err;
+
+        dprint(DBG_ATTR_MOD, "create_attr: %s,%ld\n",
+                name ? name : NULL, inode->i_ino);
+
+        if (!HFSPLUS_SB(sb)->attr_tree) {
+                printk(KERN_ERR "hfs: attributes file doesn't exist\n");
+                return -EINVAL;
+        }
+
+        entry_ptr = hfsplus_alloc_attr_entry();
+        if (!entry_ptr)
+                return -ENOMEM;
+
+        err = hfs_find_init(HFSPLUS_SB(sb)->attr_tree, &fd);
+        if (err)
+                goto failed_init_create_attr;
+
+        if (name) {
+                err = hfsplus_attr_build_key(sb, fd.search_key,
+                                                inode->i_ino, name);
+                if (err)
+                        goto failed_create_attr;
+        } else {
+                err = -EINVAL;
+                goto failed_create_attr;
+        }
+
+        /* Mac OS X supports only inline data attributes. */
+        entry_size = hfsplus_attr_build_record(entry_ptr,
+                                        HFSPLUS_ATTR_INLINE_DATA,
+                                        inode->i_ino,
+                                        value, size);
+        if (entry_size == HFSPLUS_INVALID_ATTR_RECORD) {
+                err = -EINVAL;
+                goto failed_create_attr;
+        }
+
+        err = hfs_brec_find(&fd, hfs_find_rec_by_key);
+        if (err != -ENOENT) {
+                if (!err)
+                        err = -EEXIST;
+                goto failed_create_attr;
+        }
+
+        err = hfs_brec_insert(&fd, entry_ptr, entry_size);
+        if (err)
+                goto failed_create_attr;
+
+        hfsplus_mark_inode_dirty(inode, HFSPLUS_I_ATTR_DIRTY);
+
+failed_create_attr:
+        hfs_find_exit(&fd);
+
+failed_init_create_attr:
+        hfsplus_destroy_attr_entry(entry_ptr);
+        return err;
+}
+
+static int __hfsplus_delete_attr(struct inode *inode, u32 cnid,
+                                        struct hfs_find_data *fd)
+{
+        int err = 0;
+        __be32 found_cnid, record_type;
+
+        hfs_bnode_read(fd->bnode, &found_cnid,
+                        fd->keyoffset +
+                        offsetof(struct hfsplus_attr_key, cnid),
+                        sizeof(__be32));
+        if (cnid != be32_to_cpu(found_cnid))
+                return -ENOENT;
+
+        hfs_bnode_read(fd->bnode, &record_type,
+                        fd->entryoffset, sizeof(record_type));
+
+        switch (be32_to_cpu(record_type)) {
+        case HFSPLUS_ATTR_INLINE_DATA:
+                /* All is OK. Do nothing. */
+                break;
+        case HFSPLUS_ATTR_FORK_DATA:
+        case HFSPLUS_ATTR_EXTENTS:
+                printk(KERN_ERR "hfs: only inline data xattr are supported\n");
+                return -EOPNOTSUPP;
+        default:
+                printk(KERN_ERR "hfs: invalid extended attribute record\n");
+                return -ENOENT;
+        }
+
+        err = hfs_brec_remove(fd);
+        if (err)
+                return err;
+
+        hfsplus_mark_inode_dirty(inode, HFSPLUS_I_ATTR_DIRTY);
+        return err;
+}
+
+int hfsplus_delete_attr(struct inode *inode, const char *name)
+{
+        int err = 0;
+        struct super_block *sb = inode->i_sb;
+        struct hfs_find_data fd;
+
+        dprint(DBG_ATTR_MOD, "delete_attr: %s,%ld\n",
+                name ? name : NULL, inode->i_ino);
+
+        if (!HFSPLUS_SB(sb)->attr_tree) {
+                printk(KERN_ERR "hfs: attributes file doesn't exist\n");
+                return -EINVAL;
+        }
+
+        err = hfs_find_init(HFSPLUS_SB(sb)->attr_tree, &fd);
+        if (err)
+                return err;
+
+        if (name) {
+                err = hfsplus_attr_build_key(sb, fd.search_key,
+                                                inode->i_ino, name);
+                if (err)
+                        goto out;
+        } else {
+                printk(KERN_ERR "hfs: invalid extended attribute name\n");
+                err = -EINVAL;
+                goto out;
+        }
+
+        err = hfs_brec_find(&fd, hfs_find_rec_by_key);
+        if (err)
+                goto out;
+
+        err = __hfsplus_delete_attr(inode, inode->i_ino, &fd);
+        if (err)
+                goto out;
+
+out:
+        hfs_find_exit(&fd);
+        return err;
+}
+
+int hfsplus_delete_all_attrs(struct inode *dir, u32 cnid)
+{
+        int err = 0;
+        struct hfs_find_data fd;
+
+        dprint(DBG_ATTR_MOD, "delete_all_attrs: %d\n", cnid);
+
+        if (!HFSPLUS_SB(dir->i_sb)->attr_tree) {
+                printk(KERN_ERR "hfs: attributes file doesn't exist\n");
+                return -EINVAL;
+        }
+
+        err = hfs_find_init(HFSPLUS_SB(dir->i_sb)->attr_tree, &fd);
+        if (err)
+                return err;
+
+        for (;;) {
+                err = hfsplus_find_attr(dir->i_sb, cnid, NULL, &fd);
+                if (err) {
+                        if (err != -ENOENT)
+                                printk(KERN_ERR "hfs: xattr search failed.\n");
+                        goto end_delete_all;
+                }
+
+                err = __hfsplus_delete_attr(dir, cnid, &fd);
+                if (err)
+                        goto end_delete_all;
+        }
+
+end_delete_all:
+        hfs_find_exit(&fd);
+        return err;
+}
diff --git a/fs/hfsplus/bfind.c b/fs/hfsplus/bfind.c
index 5d799c13205f..d73c98d1ee99 100644
--- a/fs/hfsplus/bfind.c
+++ b/fs/hfsplus/bfind.c
@@ -24,7 +24,19 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd)
         fd->key = ptr + tree->max_key_len + 2;
         dprint(DBG_BNODE_REFS, "find_init: %d (%p)\n",
                 tree->cnid, __builtin_return_address(0));
-        mutex_lock(&tree->tree_lock);
+        switch (tree->cnid) {
+        case HFSPLUS_CAT_CNID:
+                mutex_lock_nested(&tree->tree_lock, CATALOG_BTREE_MUTEX);
+                break;
+        case HFSPLUS_EXT_CNID:
+                mutex_lock_nested(&tree->tree_lock, EXTENTS_BTREE_MUTEX);
+                break;
+        case HFSPLUS_ATTR_CNID:
+                mutex_lock_nested(&tree->tree_lock, ATTR_BTREE_MUTEX);
+                break;
+        default:
+                BUG();
+        }
         return 0;
 }
 
@@ -38,15 +50,73 @@ void hfs_find_exit(struct hfs_find_data *fd)
         fd->tree = NULL;
 }
 
-/* Find the record in bnode that best matches key (not greater than...)*/
-int __hfs_brec_find(struct hfs_bnode *bnode, struct hfs_find_data *fd)
+int hfs_find_1st_rec_by_cnid(struct hfs_bnode *bnode,
+                                struct hfs_find_data *fd,
+                                int *begin,
+                                int *end,
+                                int *cur_rec)
+{
+        __be32 cur_cnid, search_cnid;
+
+        if (bnode->tree->cnid == HFSPLUS_EXT_CNID) {
+                cur_cnid = fd->key->ext.cnid;
+                search_cnid = fd->search_key->ext.cnid;
+        } else if (bnode->tree->cnid == HFSPLUS_CAT_CNID) {
+                cur_cnid = fd->key->cat.parent;
+                search_cnid = fd->search_key->cat.parent;
+        } else if (bnode->tree->cnid == HFSPLUS_ATTR_CNID) {
+                cur_cnid = fd->key->attr.cnid;
+                search_cnid = fd->search_key->attr.cnid;
+        } else
+                BUG();
+
+        if (cur_cnid == search_cnid) {
+                (*end) = (*cur_rec);
+                if ((*begin) == (*end))
+                        return 1;
+        } else {
+                if (be32_to_cpu(cur_cnid) < be32_to_cpu(search_cnid))
+                        (*begin) = (*cur_rec) + 1;
+                else
+                        (*end) = (*cur_rec) - 1;
+        }
+
+        return 0;
+}
+
+int hfs_find_rec_by_key(struct hfs_bnode *bnode,
+                                struct hfs_find_data *fd,
+                                int *begin,
+                                int *end,
+                                int *cur_rec)
 {
         int cmpval;
+
+        cmpval = bnode->tree->keycmp(fd->key, fd->search_key);
+        if (!cmpval) {
+                (*end) = (*cur_rec);
+                return 1;
+        }
+        if (cmpval < 0)
+                (*begin) = (*cur_rec) + 1;
+        else
+                *(end) = (*cur_rec) - 1;
+
+        return 0;
+}
+
+/* Find the record in bnode that best matches key (not greater than...)*/
+int __hfs_brec_find(struct hfs_bnode *bnode, struct hfs_find_data *fd,
+                                        search_strategy_t rec_found)
+{
         u16 off, len, keylen;
         int rec;
         int b, e;
         int res;
 
+        if (!rec_found)
+                BUG();
+
         b = 0;
         e = bnode->num_recs - 1;
         res = -ENOENT;
@@ -59,17 +129,12 @@ int __hfs_brec_find(struct hfs_bnode *bnode, struct hfs_find_data *fd)
                         goto fail;
                 }
                 hfs_bnode_read(bnode, fd->key, off, keylen);
-                cmpval = bnode->tree->keycmp(fd->key, fd->search_key);
-                if (!cmpval) {
-                        e = rec;
+                if (rec_found(bnode, fd, &b, &e, &rec)) {
                         res = 0;
                         goto done;
                 }
-                if (cmpval < 0)
-                        b = rec + 1;
-                else
-                        e = rec - 1;
         } while (b <= e);
+
         if (rec != e && e >= 0) {
                 len = hfs_brec_lenoff(bnode, e, &off);
                 keylen = hfs_brec_keylen(bnode, e);
@@ -79,19 +144,21 @@ int __hfs_brec_find(struct hfs_bnode *bnode, struct hfs_find_data *fd)
                 }
                 hfs_bnode_read(bnode, fd->key, off, keylen);
         }
+
 done:
         fd->record = e;
         fd->keyoffset = off;
         fd->keylength = keylen;
         fd->entryoffset = off + keylen;
         fd->entrylength = len - keylen;
+
 fail:
         return res;
 }
 
 /* Traverse a B*Tree from the root to a leaf finding best fit to key */
 /* Return allocated copy of node found, set recnum to best record */
-int hfs_brec_find(struct hfs_find_data *fd)
+int hfs_brec_find(struct hfs_find_data *fd, search_strategy_t do_key_compare)
 {
         struct hfs_btree *tree;
         struct hfs_bnode *bnode;
@@ -122,7 +189,7 @@ int hfs_brec_find(struct hfs_find_data *fd)
                         goto invalid;
                 bnode->parent = parent;
 
-                res = __hfs_brec_find(bnode, fd);
+                res = __hfs_brec_find(bnode, fd, do_key_compare);
                 if (!height)
                         break;
                 if (fd->record < 0)
@@ -149,7 +216,7 @@ int hfs_brec_read(struct hfs_find_data *fd, void *rec, int rec_len)
 {
         int res;
 
-        res = hfs_brec_find(fd);
+        res = hfs_brec_find(fd, hfs_find_rec_by_key);
         if (res)
                 return res;
         if (fd->entrylength > rec_len)
diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
index 1c42cc5b899f..f31ac6f404f1 100644
--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -62,7 +62,8 @@ void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off)
 
         tree = node->tree;
         if (node->type == HFS_NODE_LEAF ||
-            tree->attributes & HFS_TREE_VARIDXKEYS)
+            tree->attributes & HFS_TREE_VARIDXKEYS ||
+            node->tree->cnid == HFSPLUS_ATTR_CNID)
                 key_len = hfs_bnode_read_u16(node, off) + 2;
         else
                 key_len = tree->max_key_len + 2;
@@ -314,7 +315,8 @@ void hfs_bnode_dump(struct hfs_bnode *node)
                 if (i && node->type == HFS_NODE_INDEX) {
                         int tmp;
 
-                        if (node->tree->attributes & HFS_TREE_VARIDXKEYS)
+                        if (node->tree->attributes & HFS_TREE_VARIDXKEYS ||
+                                        node->tree->cnid == HFSPLUS_ATTR_CNID)
                                 tmp = hfs_bnode_read_u16(node, key_off) + 2;
                         else
                                 tmp = node->tree->max_key_len + 2;
@@ -646,6 +648,8 @@ void hfs_bnode_put(struct hfs_bnode *node)
                 if (test_bit(HFS_BNODE_DELETED, &node->flags)) {
                         hfs_bnode_unhash(node);
                         spin_unlock(&tree->hash_lock);
+                        hfs_bnode_clear(node, 0,
+                                PAGE_CACHE_SIZE * tree->pages_per_bnode);
                         hfs_bmap_free(node);
                         hfs_bnode_free(node);
                         return;
diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
index 2a734cfccc92..298d4e45604b 100644
--- a/fs/hfsplus/brec.c
+++ b/fs/hfsplus/brec.c
@@ -36,7 +36,8 @@ u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec)
                 return 0;
 
         if ((node->type == HFS_NODE_INDEX) &&
-           !(node->tree->attributes & HFS_TREE_VARIDXKEYS)) {
+           !(node->tree->attributes & HFS_TREE_VARIDXKEYS) &&
+           (node->tree->cnid != HFSPLUS_ATTR_CNID)) {
                 retval = node->tree->max_key_len + 2;
         } else {
                 recoff = hfs_bnode_read_u16(node,
@@ -151,12 +152,13 @@ skip:
 
                 /* get index key */
                 hfs_bnode_read_key(new_node, fd->search_key, 14);
-                __hfs_brec_find(fd->bnode, fd);
+                __hfs_brec_find(fd->bnode, fd, hfs_find_rec_by_key);
 
                 hfs_bnode_put(new_node);
                 new_node = NULL;
 
-                if (tree->attributes & HFS_TREE_VARIDXKEYS)
+                if ((tree->attributes & HFS_TREE_VARIDXKEYS) ||
+                                (tree->cnid == HFSPLUS_ATTR_CNID))
                         key_len = be16_to_cpu(fd->search_key->key_len) + 2;
                 else {
                         fd->search_key->key_len =
@@ -201,7 +203,7 @@ again:
                 hfs_bnode_put(node);
                 node = fd->bnode = parent;
 
-                __hfs_brec_find(node, fd);
+                __hfs_brec_find(node, fd, hfs_find_rec_by_key);
                 goto again;
         }
         hfs_bnode_write_u16(node,
@@ -367,12 +369,13 @@ again:
         parent = hfs_bnode_find(tree, node->parent);
         if (IS_ERR(parent))
                 return PTR_ERR(parent);
-        __hfs_brec_find(parent, fd);
+        __hfs_brec_find(parent, fd, hfs_find_rec_by_key);
         hfs_bnode_dump(parent);
         rec = fd->record;
 
         /* size difference between old and new key */
-        if (tree->attributes & HFS_TREE_VARIDXKEYS)
+        if ((tree->attributes & HFS_TREE_VARIDXKEYS) ||
+                                (tree->cnid == HFSPLUS_ATTR_CNID))
                 newkeylen = hfs_bnode_read_u16(node, 14) + 2;
         else
                 fd->keylength = newkeylen = tree->max_key_len + 2;
@@ -427,7 +430,7 @@ skip:
                 hfs_bnode_read_key(new_node, fd->search_key, 14);
                 cnid = cpu_to_be32(new_node->this);
 
-                __hfs_brec_find(fd->bnode, fd);
+                __hfs_brec_find(fd->bnode, fd, hfs_find_rec_by_key);
                 hfs_brec_insert(fd, &cnid, sizeof(cnid));
                 hfs_bnode_put(fd->bnode);
                 hfs_bnode_put(new_node);
@@ -495,13 +498,15 @@ static int hfs_btree_inc_height(struct hfs_btree *tree)
                 /* insert old root idx into new root */
                 node->parent = tree->root;
                 if (node->type == HFS_NODE_LEAF ||
-                    tree->attributes & HFS_TREE_VARIDXKEYS)
+                                tree->attributes & HFS_TREE_VARIDXKEYS ||
+                                tree->cnid == HFSPLUS_ATTR_CNID)
                         key_size = hfs_bnode_read_u16(node, 14) + 2;
                 else
                         key_size = tree->max_key_len + 2;
                 hfs_bnode_copy(new_node, 14, node, 14, key_size);
 
-                if (!(tree->attributes & HFS_TREE_VARIDXKEYS)) {
+                if (!(tree->attributes & HFS_TREE_VARIDXKEYS) &&
+                                (tree->cnid != HFSPLUS_ATTR_CNID)) {
                         key_size = tree->max_key_len + 2;
                         hfs_bnode_write_u16(new_node, 14, tree->max_key_len);
                 }
diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
index 685d07d0ed18..efb689c21a95 100644
--- a/fs/hfsplus/btree.c
+++ b/fs/hfsplus/btree.c
@@ -98,6 +98,14 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
                         set_bit(HFSPLUS_SB_CASEFOLD, &HFSPLUS_SB(sb)->flags);
                 }
                 break;
+        case HFSPLUS_ATTR_CNID:
+                if (tree->max_key_len != HFSPLUS_ATTR_KEYLEN - sizeof(u16)) {
+                        printk(KERN_ERR "hfs: invalid attributes max_key_len %d\n",
+                                tree->max_key_len);
+                        goto fail_page;
+                }
+                tree->keycmp = hfsplus_attr_bin_cmp_key;
+                break;
         default:
                 printk(KERN_ERR "hfs: unknown B*Tree requested\n");
                 goto fail_page;
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index 798d9c4c5e71..840d71edd193 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -45,7 +45,8 @@ void hfsplus_cat_build_key(struct super_block *sb, hfsplus_btree_key *key,
 
         key->cat.parent = cpu_to_be32(parent);
         if (str) {
-                hfsplus_asc2uni(sb, &key->cat.name, str->name, str->len);
+                hfsplus_asc2uni(sb, &key->cat.name, HFSPLUS_MAX_STRLEN,
+                                        str->name, str->len);
                 len = be16_to_cpu(key->cat.name.length);
         } else {
                 key->cat.name.length = 0;
@@ -167,7 +168,8 @@ static int hfsplus_fill_cat_thread(struct super_block *sb,
         entry->type = cpu_to_be16(type);
         entry->thread.reserved = 0;
         entry->thread.parentID = cpu_to_be32(parentid);
-        hfsplus_asc2uni(sb, &entry->thread.nodeName, str->name, str->len);
+        hfsplus_asc2uni(sb, &entry->thread.nodeName, HFSPLUS_MAX_STRLEN,
+                                str->name, str->len);
         return 10 + be16_to_cpu(entry->thread.nodeName.length) * 2;
 }
 
@@ -198,7 +200,7 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
         hfsplus_cat_build_key_uni(fd->search_key,
                 be32_to_cpu(tmp.thread.parentID),
                 &tmp.thread.nodeName);
-        return hfs_brec_find(fd);
+        return hfs_brec_find(fd, hfs_find_rec_by_key);
 }
 
 int hfsplus_create_cat(u32 cnid, struct inode *dir,
@@ -221,7 +223,7 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
                 S_ISDIR(inode->i_mode) ?
                         HFSPLUS_FOLDER_THREAD : HFSPLUS_FILE_THREAD,
                 dir->i_ino, str);
-        err = hfs_brec_find(&fd);
+        err = hfs_brec_find(&fd, hfs_find_rec_by_key);
         if (err != -ENOENT) {
                 if (!err)
                         err = -EEXIST;
@@ -233,7 +235,7 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
 
         hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);
         entry_size = hfsplus_cat_build_record(&entry, cnid, inode);
-        err = hfs_brec_find(&fd);
+        err = hfs_brec_find(&fd, hfs_find_rec_by_key);
         if (err != -ENOENT) {
                 /* panic? */
                 if (!err)
@@ -253,7 +255,7 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
 
 err1:
         hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL);
-        if (!hfs_brec_find(&fd))
+        if (!hfs_brec_find(&fd, hfs_find_rec_by_key))
                 hfs_brec_remove(&fd);
 err2:
         hfs_find_exit(&fd);
@@ -279,7 +281,7 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
                 int len;
 
                 hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL);
-                err = hfs_brec_find(&fd);
+                err = hfs_brec_find(&fd, hfs_find_rec_by_key);
                 if (err)
                         goto out;
 
@@ -296,7 +298,7 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
         } else
                 hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);
 
-        err = hfs_brec_find(&fd);
+        err = hfs_brec_find(&fd, hfs_find_rec_by_key);
         if (err)
                 goto out;
 
@@ -326,7 +328,7 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
                 goto out;
 
         hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL);
-        err = hfs_brec_find(&fd);
+        err = hfs_brec_find(&fd, hfs_find_rec_by_key);
         if (err)
                 goto out;
 
@@ -337,6 +339,12 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
         dir->i_size--;
         dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
         hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
+
+        if (type == HFSPLUS_FILE || type == HFSPLUS_FOLDER) {
+                if (HFSPLUS_SB(sb)->attr_tree)
+                        hfsplus_delete_all_attrs(dir, cnid);
+        }
+
 out:
         hfs_find_exit(&fd);
 
@@ -363,7 +371,7 @@ int hfsplus_rename_cat(u32 cnid,
 
         /* find the old dir entry and read the data */
         hfsplus_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name);
-        err = hfs_brec_find(&src_fd);
+        err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);
         if (err)
                 goto out;
         if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
@@ -376,7 +384,7 @@ int hfsplus_rename_cat(u32 cnid,
 
         /* create new dir entry with the data from the old entry */
         hfsplus_cat_build_key(sb, dst_fd.search_key, dst_dir->i_ino, dst_name);
-        err = hfs_brec_find(&dst_fd);
+        err = hfs_brec_find(&dst_fd, hfs_find_rec_by_key);
         if (err != -ENOENT) {
                 if (!err)
                         err = -EEXIST;
@@ -391,7 +399,7 @@ int hfsplus_rename_cat(u32 cnid,
 
         /* finally remove the old entry */
         hfsplus_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name);
-        err = hfs_brec_find(&src_fd);
+        err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);
         if (err)
                 goto out;
         err = hfs_brec_remove(&src_fd);
@@ -402,7 +410,7 @@ int hfsplus_rename_cat(u32 cnid,
 
         /* remove old thread entry */
         hfsplus_cat_build_key(sb, src_fd.search_key, cnid, NULL);
-        err = hfs_brec_find(&src_fd);
+        err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);
         if (err)
                 goto out;
         type = hfs_bnode_read_u16(src_fd.bnode, src_fd.entryoffset);
@@ -414,7 +422,7 @@ int hfsplus_rename_cat(u32 cnid,
         hfsplus_cat_build_key(sb, dst_fd.search_key, cnid, NULL);
         entry_size = hfsplus_fill_cat_thread(sb, &entry, type,
                 dst_dir->i_ino, dst_name);
-        err = hfs_brec_find(&dst_fd);
+        err = hfs_brec_find(&dst_fd, hfs_find_rec_by_key);
         if (err != -ENOENT) {
                 if (!err)
                         err = -EEXIST;
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index 074e04589248..031c24e50521 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -15,6 +15,7 @@
 
 #include "hfsplus_fs.h"
 #include "hfsplus_raw.h"
+#include "xattr.h"
 
 static inline void hfsplus_instantiate(struct dentry *dentry,
                                        struct inode *inode, u32 cnid)
@@ -138,7 +139,7 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
         if (err)
                 return err;
         hfsplus_cat_build_key(sb, fd.search_key, inode->i_ino, NULL);
-        err = hfs_brec_find(&fd);
+        err = hfs_brec_find(&fd, hfs_find_rec_by_key);
         if (err)
                 goto out;
 
@@ -421,6 +422,15 @@ static int hfsplus_symlink(struct inode *dir, struct dentry *dentry,
         if (res)
                 goto out_err;
 
+        res = hfsplus_init_inode_security(inode, dir, &dentry->d_name);
+        if (res == -EOPNOTSUPP)
+                res = 0; /* Operation is not supported. */
+        else if (res) {
+                /* Try to delete anyway without error analysis. */
+                hfsplus_delete_cat(inode->i_ino, dir, &dentry->d_name);
+                goto out_err;
+        }
+
         hfsplus_instantiate(dentry, inode, inode->i_ino);
         mark_inode_dirty(inode);
         goto out;
@@ -450,15 +460,26 @@ static int hfsplus_mknod(struct inode *dir, struct dentry *dentry,
                 init_special_inode(inode, mode, rdev);
 
         res = hfsplus_create_cat(inode->i_ino, dir, &dentry->d_name, inode);
-        if (res) {
-                clear_nlink(inode);
-                hfsplus_delete_inode(inode);
-                iput(inode);
-                goto out;
+        if (res)
+                goto failed_mknod;
+
+        res = hfsplus_init_inode_security(inode, dir, &dentry->d_name);
+        if (res == -EOPNOTSUPP)
+                res = 0; /* Operation is not supported. */
+        else if (res) {
+                /* Try to delete anyway without error analysis. */
+                hfsplus_delete_cat(inode->i_ino, dir, &dentry->d_name);
+                goto failed_mknod;
         }
 
         hfsplus_instantiate(dentry, inode, inode->i_ino);
         mark_inode_dirty(inode);
+        goto out;
+
+failed_mknod:
+        clear_nlink(inode);
+        hfsplus_delete_inode(inode);
+        iput(inode);
 out:
         mutex_unlock(&sbi->vh_mutex);
         return res;
@@ -499,15 +520,19 @@ static int hfsplus_rename(struct inode *old_dir, struct dentry *old_dentry,
 }
 
 const struct inode_operations hfsplus_dir_inode_operations = {
-        .lookup         = hfsplus_lookup,
-        .create         = hfsplus_create,
-        .link           = hfsplus_link,
-        .unlink         = hfsplus_unlink,
-        .mkdir          = hfsplus_mkdir,
-        .rmdir          = hfsplus_rmdir,
-        .symlink        = hfsplus_symlink,
-        .mknod          = hfsplus_mknod,
-        .rename         = hfsplus_rename,
+        .lookup                 = hfsplus_lookup,
+        .create                 = hfsplus_create,
+        .link                   = hfsplus_link,
+        .unlink                 = hfsplus_unlink,
+        .mkdir                  = hfsplus_mkdir,
+        .rmdir                  = hfsplus_rmdir,
+        .symlink                = hfsplus_symlink,
+        .mknod                  = hfsplus_mknod,
+        .rename                 = hfsplus_rename,
+        .setxattr               = generic_setxattr,
+        .getxattr               = generic_getxattr,
+        .listxattr              = hfsplus_listxattr,
+        .removexattr            = hfsplus_removexattr,
 };
 
 const struct file_operations hfsplus_dir_operations = {
diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
index eba76eab6d62..a94f0f779d5e 100644
--- a/fs/hfsplus/extents.c
+++ b/fs/hfsplus/extents.c
@@ -95,7 +95,7 @@ static void __hfsplus_ext_write_extent(struct inode *inode,
                               HFSPLUS_IS_RSRC(inode) ?
                                 HFSPLUS_TYPE_RSRC : HFSPLUS_TYPE_DATA);
 
-        res = hfs_brec_find(fd);
+        res = hfs_brec_find(fd, hfs_find_rec_by_key);
         if (hip->extent_state & HFSPLUS_EXT_NEW) {
                 if (res != -ENOENT)
                         return;
@@ -154,7 +154,7 @@ static inline int __hfsplus_ext_read_extent(struct hfs_find_data *fd,
 
         hfsplus_ext_build_key(fd->search_key, cnid, block, type);
         fd->key->ext.cnid = 0;
-        res = hfs_brec_find(fd);
+        res = hfs_brec_find(fd, hfs_find_rec_by_key);
         if (res && res != -ENOENT)
                 return res;
         if (fd->key->ext.cnid != fd->search_key->ext.cnid ||
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index a6da86b1b4c1..05b11f36024c 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -23,6 +23,7 @@
 #define DBG_SUPER       0x00000010
 #define DBG_EXTENT      0x00000020
 #define DBG_BITMAP      0x00000040
+#define DBG_ATTR_MOD    0x00000080
 
 #if 0
 #define DBG_MASK        (DBG_EXTENT|DBG_INODE|DBG_BNODE_MOD)
@@ -46,6 +47,13 @@ typedef int (*btree_keycmp)(const hfsplus_btree_key *,
 
 #define NODE_HASH_SIZE  256
 
+/* B-tree mutex nested subclasses */
+enum hfsplus_btree_mutex_classes {
+        CATALOG_BTREE_MUTEX,
+        EXTENTS_BTREE_MUTEX,
+        ATTR_BTREE_MUTEX,
+};
+
 /* An HFS+ BTree held in memory */
 struct hfs_btree {
         struct super_block *sb;
@@ -223,6 +231,7 @@ struct hfsplus_inode_info {
 #define HFSPLUS_I_CAT_DIRTY     1       /* has changes in the catalog tree */
 #define HFSPLUS_I_EXT_DIRTY     2       /* has changes in the extent tree */
 #define HFSPLUS_I_ALLOC_DIRTY   3       /* has changes in the allocation file */
+#define HFSPLUS_I_ATTR_DIRTY    4       /* has changes in the attributes tree */
 
 #define HFSPLUS_IS_RSRC(inode) \
         test_bit(HFSPLUS_I_RSRC, &HFSPLUS_I(inode)->flags)
@@ -302,7 +311,7 @@ static inline unsigned short hfsplus_min_io_size(struct super_block *sb)
 #define hfs_brec_remove hfsplus_brec_remove
 #define hfs_find_init hfsplus_find_init
 #define hfs_find_exit hfsplus_find_exit
-#define __hfs_brec_find __hplusfs_brec_find
+#define __hfs_brec_find __hfsplus_brec_find
 #define hfs_brec_find hfsplus_brec_find
 #define hfs_brec_read hfsplus_brec_read
 #define hfs_brec_goto hfsplus_brec_goto
@@ -324,10 +333,33 @@ static inline unsigned short hfsplus_min_io_size(struct super_block *sb)
  */
 #define HFSPLUS_IOC_BLESS _IO('h', 0x80)
 
+typedef int (*search_strategy_t)(struct hfs_bnode *,
+                                struct hfs_find_data *,
+                                int *, int *, int *);
+
 /*
  * Functions in any *.c used in other files
  */
 
+/* attributes.c */
+int hfsplus_create_attr_tree_cache(void);
+void hfsplus_destroy_attr_tree_cache(void);
+hfsplus_attr_entry *hfsplus_alloc_attr_entry(void);
+void hfsplus_destroy_attr_entry(hfsplus_attr_entry *entry_p);
+int hfsplus_attr_bin_cmp_key(const hfsplus_btree_key *,
+                const hfsplus_btree_key *);
+int hfsplus_attr_build_key(struct super_block *, hfsplus_btree_key *,
+                        u32, const char *);
+void hfsplus_attr_build_key_uni(hfsplus_btree_key *key,
+                                        u32 cnid,
+                                        struct hfsplus_attr_unistr *name);
+int hfsplus_find_attr(struct super_block *, u32,
+                        const char *, struct hfs_find_data *);
+int hfsplus_attr_exists(struct inode *inode, const char *name);
+int hfsplus_create_attr(struct inode *, const char *, const void *, size_t);
+int hfsplus_delete_attr(struct inode *, const char *);
+int hfsplus_delete_all_attrs(struct inode *dir, u32 cnid);
+
 /* bitmap.c */
 int hfsplus_block_allocate(struct super_block *, u32, u32, u32 *);
 int hfsplus_block_free(struct super_block *, u32, u32);
@@ -369,8 +401,15 @@ int hfs_brec_remove(struct hfs_find_data *);
 /* bfind.c */
 int hfs_find_init(struct hfs_btree *, struct hfs_find_data *);
 void hfs_find_exit(struct hfs_find_data *);
-int __hfs_brec_find(struct hfs_bnode *, struct hfs_find_data *);
-int hfs_brec_find(struct hfs_find_data *);
+int hfs_find_1st_rec_by_cnid(struct hfs_bnode *,
+                                struct hfs_find_data *,
+                                int *, int *, int *);
+int hfs_find_rec_by_key(struct hfs_bnode *,
+                                struct hfs_find_data *,
+                                int *, int *, int *);
+int __hfs_brec_find(struct hfs_bnode *, struct hfs_find_data *,
+                                search_strategy_t);
+int hfs_brec_find(struct hfs_find_data *, search_strategy_t);
 int hfs_brec_read(struct hfs_find_data *, void *, int);
 int hfs_brec_goto(struct hfs_find_data *, int);
 
@@ -417,11 +456,6 @@ int hfsplus_file_fsync(struct file *file, loff_t start, loff_t end,
 
 /* ioctl.c */
 long hfsplus_ioctl(struct file *filp, unsigned int cmd, unsigned long arg);
-int hfsplus_setxattr(struct dentry *dentry, const char *name,
-                     const void *value, size_t size, int flags);
-ssize_t hfsplus_getxattr(struct dentry *dentry, const char *name,
-                         void *value, size_t size);
-ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size);
 
 /* options.c */
 int hfsplus_parse_options(char *, struct hfsplus_sb_info *);
@@ -446,7 +480,7 @@ int hfsplus_strcmp(const struct hfsplus_unistr *,
 int hfsplus_uni2asc(struct super_block *,
                 const struct hfsplus_unistr *, char *, int *);
 int hfsplus_asc2uni(struct super_block *,
-                struct hfsplus_unistr *, const char *, int);
+                struct hfsplus_unistr *, int, const char *, int);
 int hfsplus_hash_dentry(const struct dentry *dentry,
                 const struct inode *inode, struct qstr *str);
 int hfsplus_compare_dentry(const struct dentry *parent,
diff --git a/fs/hfsplus/hfsplus_raw.h b/fs/hfsplus/hfsplus_raw.h
index 921967e5abb1..452ede01b036 100644
--- a/fs/hfsplus/hfsplus_raw.h
+++ b/fs/hfsplus/hfsplus_raw.h
@@ -52,13 +52,23 @@
 typedef __be32 hfsplus_cnid;
 typedef __be16 hfsplus_unichr;
 
+#define HFSPLUS_MAX_STRLEN 255
+#define HFSPLUS_ATTR_MAX_STRLEN 127
+
 /* A "string" as used in filenames, etc. */
 struct hfsplus_unistr {
         __be16 length;
-        hfsplus_unichr unicode[255];
+        hfsplus_unichr unicode[HFSPLUS_MAX_STRLEN];
 } __packed;
 
-#define HFSPLUS_MAX_STRLEN 255
+/*
+ * A "string" is used in attributes file
+ * for name of extended attribute
+ */
+struct hfsplus_attr_unistr {
+        __be16 length;
+        hfsplus_unichr unicode[HFSPLUS_ATTR_MAX_STRLEN];
+} __packed;
 
 /* POSIX permissions */
 struct hfsplus_perm {
@@ -291,6 +301,8 @@ struct hfsplus_cat_file {
 /* File attribute bits */
 #define HFSPLUS_FILE_LOCKED             0x0001
 #define HFSPLUS_FILE_THREAD_EXISTS      0x0002
+#define HFSPLUS_XATTR_EXISTS            0x0004
+#define HFSPLUS_ACL_EXISTS              0x0008
 
 /* HFS+ catalog thread (part of a cat_entry) */
 struct hfsplus_cat_thread {
@@ -327,11 +339,63 @@ struct hfsplus_ext_key {
 
 #define HFSPLUS_EXT_KEYLEN      sizeof(struct hfsplus_ext_key)
 
+#define HFSPLUS_XATTR_FINDER_INFO_NAME "com.apple.FinderInfo"
+#define HFSPLUS_XATTR_ACL_NAME "com.apple.system.Security"
+
+#define HFSPLUS_ATTR_INLINE_DATA 0x10
+#define HFSPLUS_ATTR_FORK_DATA   0x20
+#define HFSPLUS_ATTR_EXTENTS     0x30
+
+/* HFS+ attributes tree key */
+struct hfsplus_attr_key {
+        __be16 key_len;
+        __be16 pad;
+        hfsplus_cnid cnid;
+        __be32 start_block;
+        struct hfsplus_attr_unistr key_name;
+} __packed;
+
+#define HFSPLUS_ATTR_KEYLEN     sizeof(struct hfsplus_attr_key)
+
+/* HFS+ fork data attribute */
+struct hfsplus_attr_fork_data {
+        __be32 record_type;
+        __be32 reserved;
+        struct hfsplus_fork_raw the_fork;
+} __packed;
+
+/* HFS+ extension attribute */
+struct hfsplus_attr_extents {
+        __be32 record_type;
+        __be32 reserved;
+        struct hfsplus_extent extents;
+} __packed;
+
+#define HFSPLUS_MAX_INLINE_DATA_SIZE 3802
+
+/* HFS+ attribute inline data */
+struct hfsplus_attr_inline_data {
+        __be32 record_type;
+        __be32 reserved1;
+        u8 reserved2[6];
+        __be16 length;
+        u8 raw_bytes[HFSPLUS_MAX_INLINE_DATA_SIZE];
+} __packed;
+
+/* A data record in the attributes tree */
+typedef union {
+        __be32 record_type;
+        struct hfsplus_attr_fork_data fork_data;
+        struct hfsplus_attr_extents extents;
+        struct hfsplus_attr_inline_data inline_data;
+} __packed hfsplus_attr_entry;
+
 /* HFS+ generic BTree key */
 typedef union {
         __be16 key_len;
         struct hfsplus_cat_key cat;
         struct hfsplus_ext_key ext;
+        struct hfsplus_attr_key attr;
 } __packed hfsplus_btree_key;
 
 #endif
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index dcd05be5344b..160ccc9cdb4b 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -17,6 +17,7 @@
 
 #include "hfsplus_fs.h"
 #include "hfsplus_raw.h"
+#include "xattr.h"
 
 static int hfsplus_readpage(struct file *file, struct page *page)
 {
@@ -348,6 +349,18 @@ int hfsplus_file_fsync(struct file *file, loff_t start, loff_t end,
                         error = error2;
         }
 
+        if (test_and_clear_bit(HFSPLUS_I_ATTR_DIRTY, &hip->flags)) {
+                if (sbi->attr_tree) {
+                        error2 =
+                                filemap_write_and_wait(
+                                            sbi->attr_tree->inode->i_mapping);
+                        if (!error)
+                                error = error2;
+                } else {
+                        printk(KERN_ERR "hfs: sync non-existent attributes tree\n");
+                }
+        }
+
         if (test_and_clear_bit(HFSPLUS_I_ALLOC_DIRTY, &hip->flags)) {
                 error2 = filemap_write_and_wait(sbi->alloc_file->i_mapping);
                 if (!error)
@@ -365,9 +378,10 @@ int hfsplus_file_fsync(struct file *file, loff_t start, loff_t end,
 static const struct inode_operations hfsplus_file_inode_operations = {
         .lookup         = hfsplus_file_lookup,
         .setattr        = hfsplus_setattr,
-        .setxattr       = hfsplus_setxattr,
-        .getxattr       = hfsplus_getxattr,
+        .setxattr       = generic_setxattr,
+        .getxattr       = generic_getxattr,
         .listxattr      = hfsplus_listxattr,
+        .removexattr    = hfsplus_removexattr,
 };
 
 static const struct file_operations hfsplus_file_operations = {
diff --git a/fs/hfsplus/ioctl.c b/fs/hfsplus/ioctl.c
index e3c4c4209428..d3ff5cc317d7 100644
--- a/fs/hfsplus/ioctl.c
+++ b/fs/hfsplus/ioctl.c
@@ -16,7 +16,6 @@
 #include <linux/fs.h>
 #include <linux/mount.h>
 #include <linux/sched.h>
-#include <linux/xattr.h>
 #include <asm/uaccess.h>
 #include "hfsplus_fs.h"
 
@@ -151,110 +150,3 @@ long hfsplus_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 return -ENOTTY;
         }
 }
-
-int hfsplus_setxattr(struct dentry *dentry, const char *name,
-                     const void *value, size_t size, int flags)
-{
-        struct inode *inode = dentry->d_inode;
-        struct hfs_find_data fd;
-        hfsplus_cat_entry entry;
-        struct hfsplus_cat_file *file;
-        int res;
-
-        if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
-                return -EOPNOTSUPP;
-
-        res = hfs_find_init(HFSPLUS_SB(inode->i_sb)->cat_tree, &fd);
-        if (res)
-                return res;
-        res = hfsplus_find_cat(inode->i_sb, inode->i_ino, &fd);
-        if (res)
-                goto out;
-        hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
-                        sizeof(struct hfsplus_cat_file));
-        file = &entry.file;
-
-        if (!strcmp(name, "hfs.type")) {
-                if (size == 4)
-                        memcpy(&file->user_info.fdType, value, 4);
-                else
-                        res = -ERANGE;
-        } else if (!strcmp(name, "hfs.creator")) {
-                if (size == 4)
-                        memcpy(&file->user_info.fdCreator, value, 4);
-                else
-                        res = -ERANGE;
-        } else
-                res = -EOPNOTSUPP;
-        if (!res) {
-                hfs_bnode_write(fd.bnode, &entry, fd.entryoffset,
-                                sizeof(struct hfsplus_cat_file));
-                hfsplus_mark_inode_dirty(inode, HFSPLUS_I_CAT_DIRTY);
-        }
-out:
-        hfs_find_exit(&fd);
-        return res;
-}
-
-ssize_t hfsplus_getxattr(struct dentry *dentry, const char *name,
-                         void *value, size_t size)
-{
-        struct inode *inode = dentry->d_inode;
-        struct hfs_find_data fd;
-        hfsplus_cat_entry entry;
-        struct hfsplus_cat_file *file;
-        ssize_t res = 0;
-
-        if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
-                return -EOPNOTSUPP;
-
-        if (size) {
-                res = hfs_find_init(HFSPLUS_SB(inode->i_sb)->cat_tree, &fd);
-                if (res)
-                        return res;
-                res = hfsplus_find_cat(inode->i_sb, inode->i_ino, &fd);
-                if (res)
-                        goto out;
-                hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
-                                sizeof(struct hfsplus_cat_file));
-        }
-        file = &entry.file;
-
-        if (!strcmp(name, "hfs.type")) {
-                if (size >= 4) {
-                        memcpy(value, &file->user_info.fdType, 4);
-                        res = 4;
-                } else
-                        res = size ? -ERANGE : 4;
-        } else if (!strcmp(name, "hfs.creator")) {
-                if (size >= 4) {
-                        memcpy(value, &file->user_info.fdCreator, 4);
-                        res = 4;
-                } else
-                        res = size ? -ERANGE : 4;
-        } else
-                res = -EOPNOTSUPP;
-out:
-        if (size)
-                hfs_find_exit(&fd);
-        return res;
-}
-
-#define HFSPLUS_ATTRLIST_SIZE (sizeof("hfs.creator")+sizeof("hfs.type"))
-
-ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size)
-{
-        struct inode *inode = dentry->d_inode;
-
-        if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
-                return -EOPNOTSUPP;
-
-        if (!buffer || !size)
-                return HFSPLUS_ATTRLIST_SIZE;
-        if (size < HFSPLUS_ATTRLIST_SIZE)
-                return -ERANGE;
-        strcpy(buffer, "hfs.type");
-        strcpy(buffer + sizeof("hfs.type"), "hfs.creator");
-
-        return HFSPLUS_ATTRLIST_SIZE;
-}
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 796198d26553..974c26f96fae 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -20,6 +20,7 @@ static struct inode *hfsplus_alloc_inode(struct super_block *sb);
 static void hfsplus_destroy_inode(struct inode *inode);
 
 #include "hfsplus_fs.h"
+#include "xattr.h"
 
 static int hfsplus_system_read_inode(struct inode *inode)
 {
@@ -118,6 +119,7 @@ static int hfsplus_system_write_inode(struct inode *inode)
         case HFSPLUS_ATTR_CNID:
                 fork = &vhdr->attr_file;
                 tree = sbi->attr_tree;
+                break;
         default:
                 return -EIO;
         }
@@ -191,6 +193,12 @@ static int hfsplus_sync_fs(struct super_block *sb, int wait)
         error2 = filemap_write_and_wait(sbi->ext_tree->inode->i_mapping);
         if (!error)
                 error = error2;
+        if (sbi->attr_tree) {
+                error2 =
+                    filemap_write_and_wait(sbi->attr_tree->inode->i_mapping);
+                if (!error)
+                        error = error2;
+        }
         error2 = filemap_write_and_wait(sbi->alloc_file->i_mapping);
         if (!error)
                 error = error2;
@@ -281,6 +289,7 @@ static void hfsplus_put_super(struct super_block *sb)
                 hfsplus_sync_fs(sb, 1);
         }
 
+        hfs_btree_close(sbi->attr_tree);
         hfs_btree_close(sbi->cat_tree);
         hfs_btree_close(sbi->ext_tree);
         iput(sbi->alloc_file);
@@ -477,12 +486,20 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
                 printk(KERN_ERR "hfs: failed to load catalog file\n");
                 goto out_close_ext_tree;
         }
+        if (vhdr->attr_file.total_blocks != 0) {
+                sbi->attr_tree = hfs_btree_open(sb, HFSPLUS_ATTR_CNID);
+                if (!sbi->attr_tree) {
+                        printk(KERN_ERR "hfs: failed to load attributes file\n");
+                        goto out_close_cat_tree;
+                }
+        }
+        sb->s_xattr = hfsplus_xattr_handlers;
 
         inode = hfsplus_iget(sb, HFSPLUS_ALLOC_CNID);
         if (IS_ERR(inode)) {
                 printk(KERN_ERR "hfs: failed to load allocation file\n");
                 err = PTR_ERR(inode);
-                goto out_close_cat_tree;
+                goto out_close_attr_tree;
         }
         sbi->alloc_file = inode;
 
@@ -542,10 +559,27 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
                         }
                         err = hfsplus_create_cat(sbi->hidden_dir->i_ino, root,
                                                  &str, sbi->hidden_dir);
-                        mutex_unlock(&sbi->vh_mutex);
-                        if (err)
+                        if (err) {
+                                mutex_unlock(&sbi->vh_mutex);
+                                goto out_put_hidden_dir;
+                        }
+
+                        err = hfsplus_init_inode_security(sbi->hidden_dir,
+                                                                root, &str);
+                        if (err == -EOPNOTSUPP)
+                                err = 0; /* Operation is not supported. */
+                        else if (err) {
+                                /*
+                                 * Try to delete anyway without
+                                 * error analysis.
+                                 */
+                                hfsplus_delete_cat(sbi->hidden_dir->i_ino,
+                                                        root, &str);
+                                mutex_unlock(&sbi->vh_mutex);
                                 goto out_put_hidden_dir;
+                        }
 
+                        mutex_unlock(&sbi->vh_mutex);
                         hfsplus_mark_inode_dirty(sbi->hidden_dir,
                                                  HFSPLUS_I_CAT_DIRTY);
                 }
@@ -562,6 +596,8 @@ out_put_root:
         sb->s_root = NULL;
 out_put_alloc_file:
         iput(sbi->alloc_file);
+out_close_attr_tree:
+        hfs_btree_close(sbi->attr_tree);
 out_close_cat_tree:
         hfs_btree_close(sbi->cat_tree);
 out_close_ext_tree:
@@ -635,9 +671,20 @@ static int __init init_hfsplus_fs(void)
                 hfsplus_init_once);
         if (!hfsplus_inode_cachep)
                 return -ENOMEM;
+        err = hfsplus_create_attr_tree_cache();
+        if (err)
+                goto destroy_inode_cache;
         err = register_filesystem(&hfsplus_fs_type);
         if (err)
-                kmem_cache_destroy(hfsplus_inode_cachep);
+                goto destroy_attr_tree_cache;
+        return 0;
+
+destroy_attr_tree_cache:
+        hfsplus_destroy_attr_tree_cache();
+
+destroy_inode_cache:
+        kmem_cache_destroy(hfsplus_inode_cachep);
+
         return err;
 }
 
@@ -650,6 +697,7 @@ static void __exit exit_hfsplus_fs(void)
          * destroy cache.
          */
         rcu_barrier();
+        hfsplus_destroy_attr_tree_cache();
         kmem_cache_destroy(hfsplus_inode_cachep);
 }
 
diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c
index a32998f29f0b..2c2e47dcfdd8 100644
--- a/fs/hfsplus/unicode.c
+++ b/fs/hfsplus/unicode.c
@@ -295,7 +295,8 @@ static inline u16 *decompose_unichar(wchar_t uc, int *size)
         return hfsplus_decompose_table + (off / 4);
 }
 
-int hfsplus_asc2uni(struct super_block *sb, struct hfsplus_unistr *ustr,
+int hfsplus_asc2uni(struct super_block *sb,
+                    struct hfsplus_unistr *ustr, int max_unistr_len,
                     const char *astr, int len)
 {
         int size, dsize, decompose;
@@ -303,7 +304,7 @@ int hfsplus_asc2uni(struct super_block *sb, struct hfsplus_unistr *ustr,
         wchar_t c;
 
         decompose = !test_bit(HFSPLUS_SB_NODECOMPOSE, &HFSPLUS_SB(sb)->flags);
-        while (outlen < HFSPLUS_MAX_STRLEN && len > 0) {
+        while (outlen < max_unistr_len && len > 0) {
                 size = asc2unichar(sb, astr, len, &c);
 
                 if (decompose)
@@ -311,7 +312,7 @@ int hfsplus_asc2uni(struct super_block *sb, struct hfsplus_unistr *ustr,
                 else
                         dstr = NULL;
                 if (dstr) {
-                        if (outlen + dsize > HFSPLUS_MAX_STRLEN)
+                        if (outlen + dsize > max_unistr_len)
                                 break;
                         do {
                                 ustr->unicode[outlen++] = cpu_to_be16(*dstr++);
diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c
new file mode 100644
index 000000000000..e8a4b0815c61
--- /dev/null
+++ b/fs/hfsplus/xattr.c
@@ -0,0 +1,709 @@
+/*
+ * linux/fs/hfsplus/xattr.c
+ *
+ * Vyacheslav Dubeyko <slava@dubeyko.com>
+ *
+ * Logic of processing extended attributes
+ */
+
+#include "hfsplus_fs.h"
+#include "xattr.h"
+
+const struct xattr_handler *hfsplus_xattr_handlers[] = {
+        &hfsplus_xattr_osx_handler,
+        &hfsplus_xattr_user_handler,
+        &hfsplus_xattr_trusted_handler,
+        &hfsplus_xattr_security_handler,
+        NULL
+};
+
+static int strcmp_xattr_finder_info(const char *name)
+{
+        if (name) {
+                return strncmp(name, HFSPLUS_XATTR_FINDER_INFO_NAME,
+                                sizeof(HFSPLUS_XATTR_FINDER_INFO_NAME));
+        }
+        return -1;
+}
+
+static int strcmp_xattr_acl(const char *name)
+{
+        if (name) {
+                return strncmp(name, HFSPLUS_XATTR_ACL_NAME,
+                                sizeof(HFSPLUS_XATTR_ACL_NAME));
+        }
+        return -1;
+}
+
+static inline int is_known_namespace(const char *name)
+{
+        if (strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) &&
+            strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
+            strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) &&
+            strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
+                return false;
+
+        return true;
+}
+
+static int can_set_xattr(struct inode *inode, const char *name,
+                                const void *value, size_t value_len)
+{
+        if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+                return -EOPNOTSUPP; /* TODO: implement ACL support */
+
+        if (!strncmp(name, XATTR_MAC_OSX_PREFIX, XATTR_MAC_OSX_PREFIX_LEN)) {
+                /*
+                 * This makes sure that we aren't trying to set an
+                 * attribute in a different namespace by prefixing it
+                 * with "osx."
+                 */
+                if (is_known_namespace(name + XATTR_MAC_OSX_PREFIX_LEN))
+                        return -EOPNOTSUPP;
+
+                return 0;
+        }
+
+        /*
+         * Don't allow setting an attribute in an unknown namespace.
+         */
+        if (strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) &&
+            strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) &&
+            strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
+                return -EOPNOTSUPP;
+
+        return 0;
+}
+
+int __hfsplus_setxattr(struct inode *inode, const char *name,
+                        const void *value, size_t size, int flags)
+{
+        int err = 0;
+        struct hfs_find_data cat_fd;
+        hfsplus_cat_entry entry;
+        u16 cat_entry_flags, cat_entry_type;
+        u16 folder_finderinfo_len = sizeof(struct DInfo) +
+                                        sizeof(struct DXInfo);
+        u16 file_finderinfo_len = sizeof(struct FInfo) +
+                                        sizeof(struct FXInfo);
+
+        if ((!S_ISREG(inode->i_mode) &&
+                        !S_ISDIR(inode->i_mode)) ||
+                                HFSPLUS_IS_RSRC(inode))
+                return -EOPNOTSUPP;
+
+        err = can_set_xattr(inode, name, value, size);
+        if (err)
+                return err;
+
+        if (strncmp(name, XATTR_MAC_OSX_PREFIX,
+                                XATTR_MAC_OSX_PREFIX_LEN) == 0)
+                name += XATTR_MAC_OSX_PREFIX_LEN;
+
+        if (value == NULL) {
+                value = "";
+                size = 0;
+        }
+
+        err = hfs_find_init(HFSPLUS_SB(inode->i_sb)->cat_tree, &cat_fd);
+        if (err) {
+                printk(KERN_ERR "hfs: can't init xattr find struct\n");
+                return err;
+        }
+
+        err = hfsplus_find_cat(inode->i_sb, inode->i_ino, &cat_fd);
+        if (err) {
+                printk(KERN_ERR "hfs: catalog searching failed\n");
+                goto end_setxattr;
+        }
+
+        if (!strcmp_xattr_finder_info(name)) {
+                if (flags & XATTR_CREATE) {
+                        printk(KERN_ERR "hfs: xattr exists yet\n");
+                        err = -EOPNOTSUPP;
+                        goto end_setxattr;
+                }
+                hfs_bnode_read(cat_fd.bnode, &entry, cat_fd.entryoffset,
+                                        sizeof(hfsplus_cat_entry));
+                if (be16_to_cpu(entry.type) == HFSPLUS_FOLDER) {
+                        if (size == folder_finderinfo_len) {
+                                memcpy(&entry.folder.user_info, value,
+                                                folder_finderinfo_len);
+                                hfs_bnode_write(cat_fd.bnode, &entry,
+                                        cat_fd.entryoffset,
+                                        sizeof(struct hfsplus_cat_folder));
+                                hfsplus_mark_inode_dirty(inode,
+                                                HFSPLUS_I_CAT_DIRTY);
+                        } else {
+                                err = -ERANGE;
+                                goto end_setxattr;
+                        }
+                } else if (be16_to_cpu(entry.type) == HFSPLUS_FILE) {
+                        if (size == file_finderinfo_len) {
+                                memcpy(&entry.file.user_info, value,
+                                                file_finderinfo_len);
+                                hfs_bnode_write(cat_fd.bnode, &entry,
+                                        cat_fd.entryoffset,
+                                        sizeof(struct hfsplus_cat_file));
+                                hfsplus_mark_inode_dirty(inode,
+                                                HFSPLUS_I_CAT_DIRTY);
+                        } else {
+                                err = -ERANGE;
+                                goto end_setxattr;
+                        }
+                } else {
+                        err = -EOPNOTSUPP;
+                        goto end_setxattr;
+                }
+                goto end_setxattr;
+        }
+
+        if (!HFSPLUS_SB(inode->i_sb)->attr_tree) {
+                err = -EOPNOTSUPP;
+                goto end_setxattr;
+        }
+
+        if (hfsplus_attr_exists(inode, name)) {
+                if (flags & XATTR_CREATE) {
+                        printk(KERN_ERR "hfs: xattr exists yet\n");
+                        err = -EOPNOTSUPP;
+                        goto end_setxattr;
+                }
+                err = hfsplus_delete_attr(inode, name);
+                if (err)
+                        goto end_setxattr;
+                err = hfsplus_create_attr(inode, name, value, size);
+                if (err)
+                        goto end_setxattr;
+        } else {
+                if (flags & XATTR_REPLACE) {
+                        printk(KERN_ERR "hfs: cannot replace xattr\n");
+                        err = -EOPNOTSUPP;
+                        goto end_setxattr;
+                }
+                err = hfsplus_create_attr(inode, name, value, size);
+                if (err)
+                        goto end_setxattr;
+        }
+
+        cat_entry_type = hfs_bnode_read_u16(cat_fd.bnode, cat_fd.entryoffset);
+        if (cat_entry_type == HFSPLUS_FOLDER) {
+                cat_entry_flags = hfs_bnode_read_u16(cat_fd.bnode,
+                                    cat_fd.entryoffset +
+                                    offsetof(struct hfsplus_cat_folder, flags));
+                cat_entry_flags |= HFSPLUS_XATTR_EXISTS;
+                if (!strcmp_xattr_acl(name))
+                        cat_entry_flags |= HFSPLUS_ACL_EXISTS;
+                hfs_bnode_write_u16(cat_fd.bnode, cat_fd.entryoffset +
+                                offsetof(struct hfsplus_cat_folder, flags),
+                                cat_entry_flags);
+                hfsplus_mark_inode_dirty(inode, HFSPLUS_I_CAT_DIRTY);
+        } else if (cat_entry_type == HFSPLUS_FILE) {
+                cat_entry_flags = hfs_bnode_read_u16(cat_fd.bnode,
+                                    cat_fd.entryoffset +
+                                    offsetof(struct hfsplus_cat_file, flags));
+                cat_entry_flags |= HFSPLUS_XATTR_EXISTS;
+                if (!strcmp_xattr_acl(name))
+                        cat_entry_flags |= HFSPLUS_ACL_EXISTS;
+                hfs_bnode_write_u16(cat_fd.bnode, cat_fd.entryoffset +
+                                    offsetof(struct hfsplus_cat_file, flags),
+                                    cat_entry_flags);
+                hfsplus_mark_inode_dirty(inode, HFSPLUS_I_CAT_DIRTY);
+        } else {
+                printk(KERN_ERR "hfs: invalid catalog entry type\n");
+                err = -EIO;
+                goto end_setxattr;
+        }
+
+end_setxattr:
+        hfs_find_exit(&cat_fd);
+        return err;
+}
+
+static inline int is_osx_xattr(const char *xattr_name)
+{
+        return !is_known_namespace(xattr_name);
+}
+
+static int name_len(const char *xattr_name, int xattr_name_len)
+{
+        int len = xattr_name_len + 1;
+
+        if (is_osx_xattr(xattr_name))
+                len += XATTR_MAC_OSX_PREFIX_LEN;
+
+        return len;
+}
+
+static int copy_name(char *buffer, const char *xattr_name, int name_len)
+{
+        int len = name_len;
+        int offset = 0;
+
+        if (is_osx_xattr(xattr_name)) {
+                strncpy(buffer, XATTR_MAC_OSX_PREFIX, XATTR_MAC_OSX_PREFIX_LEN);
+                offset += XATTR_MAC_OSX_PREFIX_LEN;
+                len += XATTR_MAC_OSX_PREFIX_LEN;
+        }
+
+        strncpy(buffer + offset, xattr_name, name_len);
+        memset(buffer + offset + name_len, 0, 1);
+        len += 1;
+
+        return len;
+}
+
+static ssize_t hfsplus_getxattr_finder_info(struct dentry *dentry,
+                                                void *value, size_t size)
+{
+        ssize_t res = 0;
+        struct inode *inode = dentry->d_inode;
+        struct hfs_find_data fd;
+        u16 entry_type;
+        u16 folder_rec_len = sizeof(struct DInfo) + sizeof(struct DXInfo);
+        u16 file_rec_len = sizeof(struct FInfo) + sizeof(struct FXInfo);
+        u16 record_len = max(folder_rec_len, file_rec_len);
+        u8 folder_finder_info[sizeof(struct DInfo) + sizeof(struct DXInfo)];
+        u8 file_finder_info[sizeof(struct FInfo) + sizeof(struct FXInfo)];
+
+        if (size >= record_len) {
+                res = hfs_find_init(HFSPLUS_SB(inode->i_sb)->cat_tree, &fd);
+                if (res) {
+                        printk(KERN_ERR "hfs: can't init xattr find struct\n");
+                        return res;
+                }
+                res = hfsplus_find_cat(inode->i_sb, inode->i_ino, &fd);
+                if (res)
+                        goto end_getxattr_finder_info;
+                entry_type = hfs_bnode_read_u16(fd.bnode, fd.entryoffset);
+
+                if (entry_type == HFSPLUS_FOLDER) {
+                        hfs_bnode_read(fd.bnode, folder_finder_info,
+                                fd.entryoffset +
+                                offsetof(struct hfsplus_cat_folder, user_info),
+                                folder_rec_len);
+                        memcpy(value, folder_finder_info, folder_rec_len);
+                        res = folder_rec_len;
+                } else if (entry_type == HFSPLUS_FILE) {
+                        hfs_bnode_read(fd.bnode, file_finder_info,
+                                fd.entryoffset +
+                                offsetof(struct hfsplus_cat_file, user_info),
+                                file_rec_len);
+                        memcpy(value, file_finder_info, file_rec_len);
+                        res = file_rec_len;
+                } else {
+                        res = -EOPNOTSUPP;
+                        goto end_getxattr_finder_info;
+                }
+        } else
+                res = size ? -ERANGE : record_len;
+
+end_getxattr_finder_info:
+        if (size >= record_len)
+                hfs_find_exit(&fd);
+        return res;
+}
+
+ssize_t hfsplus_getxattr(struct dentry *dentry, const char *name,
+                         void *value, size_t size)
+{
+        struct inode *inode = dentry->d_inode;
+        struct hfs_find_data fd;
+        hfsplus_attr_entry *entry;
+        __be32 xattr_record_type;
+        u32 record_type;
+        u16 record_length = 0;
+        ssize_t res = 0;
+
+        if ((!S_ISREG(inode->i_mode) &&
+                        !S_ISDIR(inode->i_mode)) ||
+                                HFSPLUS_IS_RSRC(inode))
+                return -EOPNOTSUPP;
+
+        if (strncmp(name, XATTR_MAC_OSX_PREFIX,
+                                XATTR_MAC_OSX_PREFIX_LEN) == 0) {
+                /* skip "osx." prefix */
+                name += XATTR_MAC_OSX_PREFIX_LEN;
+                /*
+                 * Don't allow retrieving properly prefixed attributes
+                 * by prepending them with "osx."
+                 */
+                if (is_known_namespace(name))
+                        return -EOPNOTSUPP;
+        }
+
+        if (!strcmp_xattr_finder_info(name))
+                return hfsplus_getxattr_finder_info(dentry, value, size);
+
+        if (!HFSPLUS_SB(inode->i_sb)->attr_tree)
+                return -EOPNOTSUPP;
+
+        entry = hfsplus_alloc_attr_entry();
+        if (!entry) {
+                printk(KERN_ERR "hfs: can't allocate xattr entry\n");
+                return -ENOMEM;
+        }
+
+        res = hfs_find_init(HFSPLUS_SB(inode->i_sb)->attr_tree, &fd);
+        if (res) {
+                printk(KERN_ERR "hfs: can't init xattr find struct\n");
+                goto failed_getxattr_init;
+        }
+
+        res = hfsplus_find_attr(inode->i_sb, inode->i_ino, name, &fd);
+        if (res) {
+                if (res == -ENOENT)
+                        res = -ENODATA;
+                else
+                        printk(KERN_ERR "hfs: xattr searching failed\n");
+                goto out;
+        }
+
+        hfs_bnode_read(fd.bnode, &xattr_record_type,
+                        fd.entryoffset, sizeof(xattr_record_type));
+        record_type = be32_to_cpu(xattr_record_type);
+        if (record_type == HFSPLUS_ATTR_INLINE_DATA) {
+                record_length = hfs_bnode_read_u16(fd.bnode,
+                                fd.entryoffset +
+                                offsetof(struct hfsplus_attr_inline_data,
+                                length));
+                if (record_length > HFSPLUS_MAX_INLINE_DATA_SIZE) {
+                        printk(KERN_ERR "hfs: invalid xattr record size\n");
+                        res = -EIO;
+                        goto out;
+                }
+        } else if (record_type == HFSPLUS_ATTR_FORK_DATA ||
+                        record_type == HFSPLUS_ATTR_EXTENTS) {
+                printk(KERN_ERR "hfs: only inline data xattr are supported\n");
+                res = -EOPNOTSUPP;
+                goto out;
+        } else {
+                printk(KERN_ERR "hfs: invalid xattr record\n");
+                res = -EIO;
+                goto out;
+        }
+
+        if (size) {
+                hfs_bnode_read(fd.bnode, entry, fd.entryoffset,
+                                offsetof(struct hfsplus_attr_inline_data,
+                                        raw_bytes) + record_length);
+        }
+
+        if (size >= record_length) {
+                memcpy(value, entry->inline_data.raw_bytes, record_length);
+                res = record_length;
+        } else
+                res = size ? -ERANGE : record_length;
+
+out:
+        hfs_find_exit(&fd);
+
+failed_getxattr_init:
+        hfsplus_destroy_attr_entry(entry);
+        return res;
+}
+
+static inline int can_list(const char *xattr_name)
+{
+        if (!xattr_name)
+                return 0;
+
+        return strncmp(xattr_name, XATTR_TRUSTED_PREFIX,
+                        XATTR_TRUSTED_PREFIX_LEN) ||
+                                capable(CAP_SYS_ADMIN);
+}
+
+static ssize_t hfsplus_listxattr_finder_info(struct dentry *dentry,
+                                                char *buffer, size_t size)
+{
+        ssize_t res = 0;
+        struct inode *inode = dentry->d_inode;
+        struct hfs_find_data fd;
+        u16 entry_type;
+        u8 folder_finder_info[sizeof(struct DInfo) + sizeof(struct DXInfo)];
+        u8 file_finder_info[sizeof(struct FInfo) + sizeof(struct FXInfo)];
+        unsigned long len, found_bit;
+        int xattr_name_len, symbols_count;
+
+        res = hfs_find_init(HFSPLUS_SB(inode->i_sb)->cat_tree, &fd);
+        if (res) {
+                printk(KERN_ERR "hfs: can't init xattr find struct\n");
+                return res;
+        }
+
+        res = hfsplus_find_cat(inode->i_sb, inode->i_ino, &fd);
+        if (res)
+                goto end_listxattr_finder_info;
+
+        entry_type = hfs_bnode_read_u16(fd.bnode, fd.entryoffset);
+        if (entry_type == HFSPLUS_FOLDER) {
+                len = sizeof(struct DInfo) + sizeof(struct DXInfo);
+                hfs_bnode_read(fd.bnode, folder_finder_info,
+                                fd.entryoffset +
+                                offsetof(struct hfsplus_cat_folder, user_info),
+                                len);
+                found_bit = find_first_bit((void *)folder_finder_info, len*8);
+        } else if (entry_type == HFSPLUS_FILE) {
+                len = sizeof(struct FInfo) + sizeof(struct FXInfo);
+                hfs_bnode_read(fd.bnode, file_finder_info,
+                                fd.entryoffset +
+                                offsetof(struct hfsplus_cat_file, user_info),
+                                len);
+                found_bit = find_first_bit((void *)file_finder_info, len*8);
+        } else {
+                res = -EOPNOTSUPP;
+                goto end_listxattr_finder_info;
+        }
+
+        if (found_bit >= (len*8))
+                res = 0;
+        else {
+                symbols_count = sizeof(HFSPLUS_XATTR_FINDER_INFO_NAME) - 1;
+                xattr_name_len =
+                        name_len(HFSPLUS_XATTR_FINDER_INFO_NAME, symbols_count);
+                if (!buffer || !size) {
+                        if (can_list(HFSPLUS_XATTR_FINDER_INFO_NAME))
+                                res = xattr_name_len;
+                } else if (can_list(HFSPLUS_XATTR_FINDER_INFO_NAME)) {
+                        if (size < xattr_name_len)
+                                res = -ERANGE;
+                        else {
+                                res = copy_name(buffer,
+                                                HFSPLUS_XATTR_FINDER_INFO_NAME,
+                                                symbols_count);
+                        }
+                }
+        }
+
+end_listxattr_finder_info:
+        hfs_find_exit(&fd);
+
+        return res;
+}
+
+ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size)
+{
+        ssize_t err;
+        ssize_t res = 0;
+        struct inode *inode = dentry->d_inode;
+        struct hfs_find_data fd;
+        u16 key_len = 0;
+        struct hfsplus_attr_key attr_key;
+        char strbuf[HFSPLUS_ATTR_MAX_STRLEN +
+                        XATTR_MAC_OSX_PREFIX_LEN + 1] = {0};
+        int xattr_name_len;
+
+        if ((!S_ISREG(inode->i_mode) &&
+                        !S_ISDIR(inode->i_mode)) ||
+                                HFSPLUS_IS_RSRC(inode))
+                return -EOPNOTSUPP;
+
+        res = hfsplus_listxattr_finder_info(dentry, buffer, size);
+        if (res < 0)
+                return res;
+        else if (!HFSPLUS_SB(inode->i_sb)->attr_tree)
+                return (res == 0) ? -EOPNOTSUPP : res;
+
+        err = hfs_find_init(HFSPLUS_SB(inode->i_sb)->attr_tree, &fd);
+        if (err) {
+                printk(KERN_ERR "hfs: can't init xattr find struct\n");
+                return err;
+        }
+
+        err = hfsplus_find_attr(inode->i_sb, inode->i_ino, NULL, &fd);
+        if (err) {
+                if (err == -ENOENT) {
+                        if (res == 0)
+                                res = -ENODATA;
+                        goto end_listxattr;
+                } else {
+                        res = err;
+                        goto end_listxattr;
+                }
+        }
+
+        for (;;) {
+                key_len = hfs_bnode_read_u16(fd.bnode, fd.keyoffset);
+                if (key_len == 0 || key_len > fd.tree->max_key_len) {
+                        printk(KERN_ERR "hfs: invalid xattr key length: %d\n",
+                                                        key_len);
+                        res = -EIO;
+                        goto end_listxattr;
+                }
+
+                hfs_bnode_read(fd.bnode, &attr_key,
+                                fd.keyoffset, key_len + sizeof(key_len));
+
+                if (be32_to_cpu(attr_key.cnid) != inode->i_ino)
+                        goto end_listxattr;
+
+                xattr_name_len = HFSPLUS_ATTR_MAX_STRLEN;
+                if (hfsplus_uni2asc(inode->i_sb,
+                        (const struct hfsplus_unistr *)&fd.key->attr.key_name,
+                                        strbuf, &xattr_name_len)) {
+                        printk(KERN_ERR "hfs: unicode conversion failed\n");
+                        res = -EIO;
+                        goto end_listxattr;
+                }
+
+                if (!buffer || !size) {
+                        if (can_list(strbuf))
+                                res += name_len(strbuf, xattr_name_len);
+                } else if (can_list(strbuf)) {
+                        if (size < (res + name_len(strbuf, xattr_name_len))) {
+                                res = -ERANGE;
+                                goto end_listxattr;
+                        } else
+                                res += copy_name(buffer + res,
+                                                strbuf, xattr_name_len);
+                }
+
+                if (hfs_brec_goto(&fd, 1))
+                        goto end_listxattr;
+        }
+
+end_listxattr:
+        hfs_find_exit(&fd);
+        return res;
+}
+
+int hfsplus_removexattr(struct dentry *dentry, const char *name)
+{
+        int err = 0;
+        struct inode *inode = dentry->d_inode;
+        struct hfs_find_data cat_fd;
+        u16 flags;
+        u16 cat_entry_type;
+        int is_xattr_acl_deleted = 0;
+        int is_all_xattrs_deleted = 0;
+
+        if ((!S_ISREG(inode->i_mode) &&
+                        !S_ISDIR(inode->i_mode)) ||
+                                HFSPLUS_IS_RSRC(inode))
+                return -EOPNOTSUPP;
+
+        if (!HFSPLUS_SB(inode->i_sb)->attr_tree)
+                return -EOPNOTSUPP;
+
+        err = can_set_xattr(inode, name, NULL, 0);
+        if (err)
+                return err;
+
+        if (strncmp(name, XATTR_MAC_OSX_PREFIX,
+                                XATTR_MAC_OSX_PREFIX_LEN) == 0)
+                name += XATTR_MAC_OSX_PREFIX_LEN;
+
+        if (!strcmp_xattr_finder_info(name))
+                return -EOPNOTSUPP;
+
+        err = hfs_find_init(HFSPLUS_SB(inode->i_sb)->cat_tree, &cat_fd);
+        if (err) {
+                printk(KERN_ERR "hfs: can't init xattr find struct\n");
+                return err;
+        }
+
+        err = hfsplus_find_cat(inode->i_sb, inode->i_ino, &cat_fd);
+        if (err) {
+                printk(KERN_ERR "hfs: catalog searching failed\n");
+                goto end_removexattr;
+        }
+
+        err = hfsplus_delete_attr(inode, name);
+        if (err)
+                goto end_removexattr;
+
+        is_xattr_acl_deleted = !strcmp_xattr_acl(name);
+        is_all_xattrs_deleted = !hfsplus_attr_exists(inode, NULL);
+
+        if (!is_xattr_acl_deleted && !is_all_xattrs_deleted)
+                goto end_removexattr;
+
+        cat_entry_type = hfs_bnode_read_u16(cat_fd.bnode, cat_fd.entryoffset);
+
+        if (cat_entry_type == HFSPLUS_FOLDER) {
+                flags = hfs_bnode_read_u16(cat_fd.bnode, cat_fd.entryoffset +
+                                offsetof(struct hfsplus_cat_folder, flags));
+                if (is_xattr_acl_deleted)
+                        flags &= ~HFSPLUS_ACL_EXISTS;
+                if (is_all_xattrs_deleted)
+                        flags &= ~HFSPLUS_XATTR_EXISTS;
+                hfs_bnode_write_u16(cat_fd.bnode, cat_fd.entryoffset +
+                                offsetof(struct hfsplus_cat_folder, flags),
+                                flags);
+                hfsplus_mark_inode_dirty(inode, HFSPLUS_I_CAT_DIRTY);
+        } else if (cat_entry_type == HFSPLUS_FILE) {
+                flags = hfs_bnode_read_u16(cat_fd.bnode, cat_fd.entryoffset +
+                                offsetof(struct hfsplus_cat_file, flags));
+                if (is_xattr_acl_deleted)
+                        flags &= ~HFSPLUS_ACL_EXISTS;
+                if (is_all_xattrs_deleted)
+                        flags &= ~HFSPLUS_XATTR_EXISTS;
+                hfs_bnode_write_u16(cat_fd.bnode, cat_fd.entryoffset +
+                                offsetof(struct hfsplus_cat_file, flags),
+                                flags);
+                hfsplus_mark_inode_dirty(inode, HFSPLUS_I_CAT_DIRTY);
+        } else {
+                printk(KERN_ERR "hfs: invalid catalog entry type\n");
+                err = -EIO;
+                goto end_removexattr;
+        }
+
+end_removexattr:
+        hfs_find_exit(&cat_fd);
+        return err;
+}
+
+static int hfsplus_osx_getxattr(struct dentry *dentry, const char *name,
+                                        void *buffer, size_t size, int type)
+{
+        char xattr_name[HFSPLUS_ATTR_MAX_STRLEN +
+                                XATTR_MAC_OSX_PREFIX_LEN + 1] = {0};
+        size_t len = strlen(name);
+
+        if (!strcmp(name, ""))
+                return -EINVAL;
+
+        if (len > HFSPLUS_ATTR_MAX_STRLEN)
+                return -EOPNOTSUPP;
+
+        strcpy(xattr_name, XATTR_MAC_OSX_PREFIX);
+        strcpy(xattr_name + XATTR_MAC_OSX_PREFIX_LEN, name);
+
+        return hfsplus_getxattr(dentry, xattr_name, buffer, size);
+}
+
+static int hfsplus_osx_setxattr(struct dentry *dentry, const char *name,
+                const void *buffer, size_t size, int flags, int type)
+{
+        char xattr_name[HFSPLUS_ATTR_MAX_STRLEN +
+                                XATTR_MAC_OSX_PREFIX_LEN + 1] = {0};
+        size_t len = strlen(name);
+
+        if (!strcmp(name, ""))
+                return -EINVAL;
+
+        if (len > HFSPLUS_ATTR_MAX_STRLEN)
+                return -EOPNOTSUPP;
+
+        strcpy(xattr_name, XATTR_MAC_OSX_PREFIX);
+        strcpy(xattr_name + XATTR_MAC_OSX_PREFIX_LEN, name);
+
+        return hfsplus_setxattr(dentry, xattr_name, buffer, size, flags);
+}
+
+static size_t hfsplus_osx_listxattr(struct dentry *dentry, char *list,
+                size_t list_size, const char *name, size_t name_len, int type)
+{
+        /*
+         * This method is not used.
+         * It is used hfsplus_listxattr() instead of generic_listxattr().
+         */
+        return -EOPNOTSUPP;
+}
+
+const struct xattr_handler hfsplus_xattr_osx_handler = {
+        .prefix = XATTR_MAC_OSX_PREFIX,
+        .list   = hfsplus_osx_listxattr,
+        .get    = hfsplus_osx_getxattr,
+        .set    = hfsplus_osx_setxattr,
+};
diff --git a/fs/hfsplus/xattr.h b/fs/hfsplus/xattr.h
new file mode 100644
index 000000000000..847b695b984d
--- /dev/null
+++ b/fs/hfsplus/xattr.h
@@ -0,0 +1,60 @@
+/*
+ * linux/fs/hfsplus/xattr.h
+ *
+ * Vyacheslav Dubeyko <slava@dubeyko.com>
+ *
+ * Logic of processing extended attributes
+ */
+
+#ifndef _LINUX_HFSPLUS_XATTR_H
+#define _LINUX_HFSPLUS_XATTR_H
+
+#include <linux/xattr.h>
+
+extern const struct xattr_handler hfsplus_xattr_osx_handler;
+extern const struct xattr_handler hfsplus_xattr_user_handler;
+extern const struct xattr_handler hfsplus_xattr_trusted_handler;
+/*extern const struct xattr_handler hfsplus_xattr_acl_access_handler;*/
+/*extern const struct xattr_handler hfsplus_xattr_acl_default_handler;*/
+extern const struct xattr_handler hfsplus_xattr_security_handler;
+
+extern const struct xattr_handler *hfsplus_xattr_handlers[];
+
+int __hfsplus_setxattr(struct inode *inode, const char *name,
+                        const void *value, size_t size, int flags);
+
+static inline int hfsplus_setxattr(struct dentry *dentry, const char *name,
+                        const void *value, size_t size, int flags)
+{
+        return __hfsplus_setxattr(dentry->d_inode, name, value, size, flags);
+}
+
+ssize_t hfsplus_getxattr(struct dentry *dentry, const char *name,
+                        void *value, size_t size);
+
+ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size);
+
+int hfsplus_removexattr(struct dentry *dentry, const char *name);
+
+int hfsplus_init_security(struct inode *inode, struct inode *dir,
+                                const struct qstr *qstr);
+
+static inline int hfsplus_init_acl(struct inode *inode, struct inode *dir)
+{
+        /*TODO: implement*/
+        return 0;
+}
+
+static inline int hfsplus_init_inode_security(struct inode *inode,
+                                                struct inode *dir,
+                                                const struct qstr *qstr)
+{
+        int err;
+
+        err = hfsplus_init_acl(inode, dir);
+        if (!err)
+                err = hfsplus_init_security(inode, dir, qstr);
+        return err;
+}
+
+#endif
diff --git a/fs/hfsplus/xattr_security.c b/fs/hfsplus/xattr_security.c
new file mode 100644
index 000000000000..83b842f113c5
--- /dev/null
+++ b/fs/hfsplus/xattr_security.c
@@ -0,0 +1,104 @@
+/*
+ * linux/fs/hfsplus/xattr_trusted.c
+ *
+ * Vyacheslav Dubeyko <slava@dubeyko.com>
+ *
+ * Handler for storing security labels as extended attributes.
+ */
+
+#include <linux/security.h>
+#include "hfsplus_fs.h"
+#include "xattr.h"
+
+static int hfsplus_security_getxattr(struct dentry *dentry, const char *name,
+                                        void *buffer, size_t size, int type)
+{
+        char xattr_name[HFSPLUS_ATTR_MAX_STRLEN + 1] = {0};
+        size_t len = strlen(name);
+
+        if (!strcmp(name, ""))
+                return -EINVAL;
+
+        if (len + XATTR_SECURITY_PREFIX_LEN > HFSPLUS_ATTR_MAX_STRLEN)
+                return -EOPNOTSUPP;
+
+        strcpy(xattr_name, XATTR_SECURITY_PREFIX);
+        strcpy(xattr_name + XATTR_SECURITY_PREFIX_LEN, name);
+
+        return hfsplus_getxattr(dentry, xattr_name, buffer, size);
+}
+
+static int hfsplus_security_setxattr(struct dentry *dentry, const char *name,
+                const void *buffer, size_t size, int flags, int type)
+{
+        char xattr_name[HFSPLUS_ATTR_MAX_STRLEN + 1] = {0};
+        size_t len = strlen(name);
+
+        if (!strcmp(name, ""))
+                return -EINVAL;
+
+        if (len + XATTR_SECURITY_PREFIX_LEN > HFSPLUS_ATTR_MAX_STRLEN)
+                return -EOPNOTSUPP;
+
+        strcpy(xattr_name, XATTR_SECURITY_PREFIX);
+        strcpy(xattr_name + XATTR_SECURITY_PREFIX_LEN, name);
+
+        return hfsplus_setxattr(dentry, xattr_name, buffer, size, flags);
+}
+
+static size_t hfsplus_security_listxattr(struct dentry *dentry, char *list,
+                size_t list_size, const char *name, size_t name_len, int type)
+{
+        /*
+         * This method is not used.
+         * It is used hfsplus_listxattr() instead of generic_listxattr().
+         */
+        return -EOPNOTSUPP;
+}
+
+static int hfsplus_initxattrs(struct inode *inode,
+                                const struct xattr *xattr_array,
+                                void *fs_info)
+{
+        const struct xattr *xattr;
+        char xattr_name[HFSPLUS_ATTR_MAX_STRLEN + 1] = {0};
+        size_t xattr_name_len;
+        int err = 0;
+
+        for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+                xattr_name_len = strlen(xattr->name);
+
+                if (xattr_name_len == 0)
+                        continue;
+
+                if (xattr_name_len + XATTR_SECURITY_PREFIX_LEN >
+                                HFSPLUS_ATTR_MAX_STRLEN)
+                        return -EOPNOTSUPP;
+
+                strcpy(xattr_name, XATTR_SECURITY_PREFIX);
+                strcpy(xattr_name +
+                        XATTR_SECURITY_PREFIX_LEN, xattr->name);
+                memset(xattr_name +
+                        XATTR_SECURITY_PREFIX_LEN + xattr_name_len, 0, 1);
+
+                err = __hfsplus_setxattr(inode, xattr_name,
+                                        xattr->value, xattr->value_len, 0);
+                if (err)
+                        break;
+        }
+        return err;
+}
+
+int hfsplus_init_security(struct inode *inode, struct inode *dir,
+                                const struct qstr *qstr)
+{
+        return security_inode_init_security(inode, dir, qstr,
+                                        &hfsplus_initxattrs, NULL);
+}
+
+const struct xattr_handler hfsplus_xattr_security_handler = {
+        .prefix = XATTR_SECURITY_PREFIX,
+        .list   = hfsplus_security_listxattr,
+        .get    = hfsplus_security_getxattr,
+        .set    = hfsplus_security_setxattr,
+};
diff --git a/fs/hfsplus/xattr_trusted.c b/fs/hfsplus/xattr_trusted.c
new file mode 100644
index 000000000000..426cee277542
--- /dev/null
+++ b/fs/hfsplus/xattr_trusted.c
@@ -0,0 +1,63 @@
+/*
+ * linux/fs/hfsplus/xattr_trusted.c
+ *
+ * Vyacheslav Dubeyko <slava@dubeyko.com>
+ *
+ * Handler for trusted extended attributes.
+ */
+
+#include "hfsplus_fs.h"
+#include "xattr.h"
+
+static int hfsplus_trusted_getxattr(struct dentry *dentry, const char *name,
+                                        void *buffer, size_t size, int type)
+{
+        char xattr_name[HFSPLUS_ATTR_MAX_STRLEN + 1] = {0};
+        size_t len = strlen(name);
+
+        if (!strcmp(name, ""))
+                return -EINVAL;
+
+        if (len + XATTR_TRUSTED_PREFIX_LEN > HFSPLUS_ATTR_MAX_STRLEN)
+                return -EOPNOTSUPP;
+
+        strcpy(xattr_name, XATTR_TRUSTED_PREFIX);
+        strcpy(xattr_name + XATTR_TRUSTED_PREFIX_LEN, name);
+
+        return hfsplus_getxattr(dentry, xattr_name, buffer, size);
+}
+
+static int hfsplus_trusted_setxattr(struct dentry *dentry, const char *name,
+                const void *buffer, size_t size, int flags, int type)
+{
+        char xattr_name[HFSPLUS_ATTR_MAX_STRLEN + 1] = {0};
+        size_t len = strlen(name);
+
+        if (!strcmp(name, ""))
+                return -EINVAL;
+
+        if (len + XATTR_TRUSTED_PREFIX_LEN > HFSPLUS_ATTR_MAX_STRLEN)
+                return -EOPNOTSUPP;
+
+        strcpy(xattr_name, XATTR_TRUSTED_PREFIX);
+        strcpy(xattr_name + XATTR_TRUSTED_PREFIX_LEN, name);
+
+        return hfsplus_setxattr(dentry, xattr_name, buffer, size, flags);
+}
+
+static size_t hfsplus_trusted_listxattr(struct dentry *dentry, char *list,
+                size_t list_size, const char *name, size_t name_len, int type)
+{
+        /*
+         * This method is not used.
+         * It is used hfsplus_listxattr() instead of generic_listxattr().
+         */
+        return -EOPNOTSUPP;
+}
+
+const struct xattr_handler hfsplus_xattr_trusted_handler = {
+        .prefix = XATTR_TRUSTED_PREFIX,
+        .list   = hfsplus_trusted_listxattr,
+        .get    = hfsplus_trusted_getxattr,
+        .set    = hfsplus_trusted_setxattr,
+};
diff --git a/fs/hfsplus/xattr_user.c b/fs/hfsplus/xattr_user.c
new file mode 100644
index 000000000000..e34016561ae0
--- /dev/null
+++ b/fs/hfsplus/xattr_user.c
@@ -0,0 +1,63 @@
+/*
+ * linux/fs/hfsplus/xattr_user.c
+ *
+ * Vyacheslav Dubeyko <slava@dubeyko.com>
+ *
+ * Handler for user extended attributes.
+ */
+
+#include "hfsplus_fs.h"
+#include "xattr.h"
+
+static int hfsplus_user_getxattr(struct dentry *dentry, const char *name,
+                                        void *buffer, size_t size, int type)
+{
+        char xattr_name[HFSPLUS_ATTR_MAX_STRLEN + 1] = {0};
+        size_t len = strlen(name);
+
+        if (!strcmp(name, ""))
+                return -EINVAL;
+
+        if (len + XATTR_USER_PREFIX_LEN > HFSPLUS_ATTR_MAX_STRLEN)
+                return -EOPNOTSUPP;
+
+        strcpy(xattr_name, XATTR_USER_PREFIX);
+        strcpy(xattr_name + XATTR_USER_PREFIX_LEN, name);
+
+        return hfsplus_getxattr(dentry, xattr_name, buffer, size);
+}
+
+static int hfsplus_user_setxattr(struct dentry *dentry, const char *name,
+                const void *buffer, size_t size, int flags, int type)
+{
+        char xattr_name[HFSPLUS_ATTR_MAX_STRLEN + 1] = {0};
+        size_t len = strlen(name);
+
+        if (!strcmp(name, ""))
+                return -EINVAL;
+
+        if (len + XATTR_USER_PREFIX_LEN > HFSPLUS_ATTR_MAX_STRLEN)
+                return -EOPNOTSUPP;
+
+        strcpy(xattr_name, XATTR_USER_PREFIX);
+        strcpy(xattr_name + XATTR_USER_PREFIX_LEN, name);
+
+        return hfsplus_setxattr(dentry, xattr_name, buffer, size, flags);
+}
+
+static size_t hfsplus_user_listxattr(struct dentry *dentry, char *list,
+                size_t list_size, const char *name, size_t name_len, int type)
+{
+        /*
+         * This method is not used.
+         * It is used hfsplus_listxattr() instead of generic_listxattr().
+         */
+        return -EOPNOTSUPP;
+}
+
+const struct xattr_handler hfsplus_xattr_user_handler = {
+        .prefix = XATTR_USER_PREFIX,
+        .list   = hfsplus_user_listxattr,
+        .get    = hfsplus_user_getxattr,
+        .set    = hfsplus_user_setxattr,
+};
diff --git a/fs/inode.c b/fs/inode.c
index 67880e604399..f5f7c06c36fb 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -798,11 +798,10 @@ static struct inode *find_inode(struct super_block *sb,
                                 int (*test)(struct inode *, void *),
                                 void *data)
 {
-        struct hlist_node *node;
         struct inode *inode = NULL;
 
 repeat:
-        hlist_for_each_entry(inode, node, head, i_hash) {
+        hlist_for_each_entry(inode, head, i_hash) {
                 spin_lock(&inode->i_lock);
                 if (inode->i_sb != sb) {
                         spin_unlock(&inode->i_lock);
@@ -830,11 +829,10 @@ repeat:
 static struct inode *find_inode_fast(struct super_block *sb,
                                 struct hlist_head *head, unsigned long ino)
 {
-        struct hlist_node *node;
         struct inode *inode = NULL;
 
 repeat:
-        hlist_for_each_entry(inode, node, head, i_hash) {
+        hlist_for_each_entry(inode, head, i_hash) {
                 spin_lock(&inode->i_lock);
                 if (inode->i_ino != ino) {
                         spin_unlock(&inode->i_lock);
@@ -1132,11 +1130,10 @@ EXPORT_SYMBOL(iget_locked);
 static int test_inode_iunique(struct super_block *sb, unsigned long ino)
 {
         struct hlist_head *b = inode_hashtable + hash(sb, ino);
-        struct hlist_node *node;
         struct inode *inode;
 
         spin_lock(&inode_hash_lock);
-        hlist_for_each_entry(inode, node, b, i_hash) {
+        hlist_for_each_entry(inode, b, i_hash) {
                 if (inode->i_ino == ino && inode->i_sb == sb) {
                         spin_unlock(&inode_hash_lock);
                         return 0;
@@ -1291,10 +1288,9 @@ int insert_inode_locked(struct inode *inode)
         struct hlist_head *head = inode_hashtable + hash(sb, ino);
 
         while (1) {
-                struct hlist_node *node;
                 struct inode *old = NULL;
                 spin_lock(&inode_hash_lock);
-                hlist_for_each_entry(old, node, head, i_hash) {
+                hlist_for_each_entry(old, head, i_hash) {
                         if (old->i_ino != ino)
                                 continue;
                         if (old->i_sb != sb)
@@ -1306,7 +1302,7 @@ int insert_inode_locked(struct inode *inode)
                         }
                         break;
                 }
-                if (likely(!node)) {
+                if (likely(!old)) {
                         spin_lock(&inode->i_lock);
                         inode->i_state |= I_NEW;
                         hlist_add_head(&inode->i_hash, head);
@@ -1334,11 +1330,10 @@ int insert_inode_locked4(struct inode *inode, unsigned long hashval,
         struct hlist_head *head = inode_hashtable + hash(sb, hashval);
 
         while (1) {
-                struct hlist_node *node;
                 struct inode *old = NULL;
 
                 spin_lock(&inode_hash_lock);
-                hlist_for_each_entry(old, node, head, i_hash) {
+                hlist_for_each_entry(old, head, i_hash) {
                         if (old->i_sb != sb)
                                 continue;
                         if (!test(old, data))
@@ -1350,7 +1345,7 @@ int insert_inode_locked4(struct inode *inode, unsigned long hashval,
                         }
                         break;
                 }
-                if (likely(!node)) {
+                if (likely(!old)) {
                         spin_lock(&inode->i_lock);
                         inode->i_state |= I_NEW;
                         hlist_add_head(&inode->i_hash, head);
diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index 0e17090c310f..abdd75d44dd4 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -32,15 +32,15 @@
 static struct hlist_head        nlm_server_hosts[NLM_HOST_NRHASH];
 static struct hlist_head        nlm_client_hosts[NLM_HOST_NRHASH];
 
-#define for_each_host(host, pos, chain, table) \
+#define for_each_host(host, chain, table) \
         for ((chain) = (table); \
              (chain) < (table) + NLM_HOST_NRHASH; ++(chain)) \
-                hlist_for_each_entry((host), (pos), (chain), h_hash)
+                hlist_for_each_entry((host), (chain), h_hash)
 
-#define for_each_host_safe(host, pos, next, chain, table) \
+#define for_each_host_safe(host, next, chain, table) \
         for ((chain) = (table); \
              (chain) < (table) + NLM_HOST_NRHASH; ++(chain)) \
-                hlist_for_each_entry_safe((host), (pos), (next), \
+                hlist_for_each_entry_safe((host), (next), \
                                                 (chain), h_hash)
 
 static unsigned long            nrhosts;
@@ -225,7 +225,6 @@ struct nlm_host *nlmclnt_lookup_host(const struct sockaddr *sap,
                 .net            = net,
         };
         struct hlist_head *chain;
-        struct hlist_node *pos;
         struct nlm_host *host;
         struct nsm_handle *nsm = NULL;
         struct lockd_net *ln = net_generic(net, lockd_net_id);
@@ -237,7 +236,7 @@ struct nlm_host *nlmclnt_lookup_host(const struct sockaddr *sap,
         mutex_lock(&nlm_host_mutex);
 
         chain = &nlm_client_hosts[nlm_hash_address(sap)];
-        hlist_for_each_entry(host, pos, chain, h_hash) {
+        hlist_for_each_entry(host, chain, h_hash) {
                 if (host->net != net)
                         continue;
                 if (!rpc_cmp_addr(nlm_addr(host), sap))
@@ -322,7 +321,6 @@ struct nlm_host *nlmsvc_lookup_host(const struct svc_rqst *rqstp,
                                     const size_t hostname_len)
 {
         struct hlist_head *chain;
-        struct hlist_node *pos;
         struct nlm_host *host = NULL;
         struct nsm_handle *nsm = NULL;
         struct sockaddr *src_sap = svc_daddr(rqstp);
@@ -350,7 +348,7 @@ struct nlm_host *nlmsvc_lookup_host(const struct svc_rqst *rqstp,
                 nlm_gc_hosts(net);
 
         chain = &nlm_server_hosts[nlm_hash_address(ni.sap)];
-        hlist_for_each_entry(host, pos, chain, h_hash) {
+        hlist_for_each_entry(host, chain, h_hash) {
                 if (host->net != net)
                         continue;
                 if (!rpc_cmp_addr(nlm_addr(host), ni.sap))
@@ -515,10 +513,9 @@ static struct nlm_host *next_host_state(struct hlist_head *cache,
 {
         struct nlm_host *host;
         struct hlist_head *chain;
-        struct hlist_node *pos;
 
         mutex_lock(&nlm_host_mutex);
-        for_each_host(host, pos, chain, cache) {
+        for_each_host(host, chain, cache) {
                 if (host->h_nsmhandle == nsm
                     && host->h_nsmstate != info->state) {
                         host->h_nsmstate = info->state;
@@ -570,7 +567,6 @@ void nlm_host_rebooted(const struct nlm_reboot *info)
 static void nlm_complain_hosts(struct net *net)
 {
         struct hlist_head *chain;
-        struct hlist_node *pos;
         struct nlm_host *host;
 
         if (net) {
@@ -587,7 +583,7 @@ static void nlm_complain_hosts(struct net *net)
                 dprintk("lockd: %lu hosts left:\n", nrhosts);
         }
 
-        for_each_host(host, pos, chain, nlm_server_hosts) {
+        for_each_host(host, chain, nlm_server_hosts) {
                 if (net && host->net != net)
                         continue;
                 dprintk("       %s (cnt %d use %d exp %ld net %p)\n",
@@ -600,14 +596,13 @@ void
 nlm_shutdown_hosts_net(struct net *net)
 {
         struct hlist_head *chain;
-        struct hlist_node *pos;
         struct nlm_host *host;
 
         mutex_lock(&nlm_host_mutex);
 
         /* First, make all hosts eligible for gc */
         dprintk("lockd: nuking all hosts in net %p...\n", net);
-        for_each_host(host, pos, chain, nlm_server_hosts) {
+        for_each_host(host, chain, nlm_server_hosts) {
                 if (net && host->net != net)
                         continue;
                 host->h_expires = jiffies - 1;
@@ -644,11 +639,11 @@ static void
 nlm_gc_hosts(struct net *net)
 {
         struct hlist_head *chain;
-        struct hlist_node *pos, *next;
+        struct hlist_node *next;
         struct nlm_host *host;
 
         dprintk("lockd: host garbage collection for net %p\n", net);
-        for_each_host(host, pos, chain, nlm_server_hosts) {
+        for_each_host(host, chain, nlm_server_hosts) {
                 if (net && host->net != net)
                         continue;
                 host->h_inuse = 0;
@@ -657,7 +652,7 @@ nlm_gc_hosts(struct net *net)
         /* Mark all hosts that hold locks, blocks or shares */
         nlmsvc_mark_resources(net);
 
-        for_each_host_safe(host, pos, next, chain, nlm_server_hosts) {
+        for_each_host_safe(host, next, chain, nlm_server_hosts) {
                 if (net && host->net != net)
                         continue;
                 if (atomic_read(&host->h_count) || host->h_inuse
diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c
index b3a24b07d981..d17bb62b06d6 100644
--- a/fs/lockd/svcsubs.c
+++ b/fs/lockd/svcsubs.c
@@ -84,7 +84,6 @@ __be32
 nlm_lookup_file(struct svc_rqst *rqstp, struct nlm_file **result,
                                         struct nfs_fh *f)
 {
-        struct hlist_node *pos;
         struct nlm_file *file;
         unsigned int    hash;
         __be32          nfserr;
@@ -96,7 +95,7 @@ nlm_lookup_file(struct svc_rqst *rqstp, struct nlm_file **result,
         /* Lock file table */
         mutex_lock(&nlm_file_mutex);
 
-        hlist_for_each_entry(file, pos, &nlm_files[hash], f_list)
+        hlist_for_each_entry(file, &nlm_files[hash], f_list)
                 if (!nfs_compare_fh(&file->f_handle, f))
                         goto found;
 
@@ -248,13 +247,13 @@ static int
 nlm_traverse_files(void *data, nlm_host_match_fn_t match,
                 int (*is_failover_file)(void *data, struct nlm_file *file))
 {
-        struct hlist_node *pos, *next;
+        struct hlist_node *next;
         struct nlm_file *file;
         int i, ret = 0;
 
         mutex_lock(&nlm_file_mutex);
         for (i = 0; i < FILE_NRHASH; i++) {
-                hlist_for_each_entry_safe(file, pos, next, &nlm_files[i], f_list) {
+                hlist_for_each_entry_safe(file, next, &nlm_files[i], f_list) {
                         if (is_failover_file && !is_failover_file(data, file))
                                 continue;
                         file->f_count++;
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 9f3c66438d0e..84d8eae203a7 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -197,7 +197,6 @@ error_0:
 EXPORT_SYMBOL_GPL(nfs_alloc_client);
 
 #if IS_ENABLED(CONFIG_NFS_V4)
-/* idr_remove_all is not needed as all id's are removed by nfs_put_client */
 void nfs_cleanup_cb_ident_idr(struct net *net)
 {
         struct nfs_net *nn = net_generic(net, nfs_net_id);
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 2e9779b58b7a..47d100872390 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -29,15 +29,14 @@ static int nfs_get_cb_ident_idr(struct nfs_client *clp, int minorversion)
 
         if (clp->rpc_ops->version != 4 || minorversion != 0)
                 return ret;
-retry:
-        if (!idr_pre_get(&nn->cb_ident_idr, GFP_KERNEL))
-                return -ENOMEM;
+        idr_preload(GFP_KERNEL);
         spin_lock(&nn->nfs_client_lock);
-        ret = idr_get_new(&nn->cb_ident_idr, clp, &clp->cl_cb_ident);
+        ret = idr_alloc(&nn->cb_ident_idr, clp, 0, 0, GFP_NOWAIT);
+        if (ret >= 0)
+                clp->cl_cb_ident = ret;
         spin_unlock(&nn->nfs_client_lock);
-        if (ret == -EAGAIN)
-                goto retry;
-        return ret;
+        idr_preload_end();
+        return ret < 0 ? ret : 0;
 }
 
 #ifdef CONFIG_NFS_V4_1
diff --git a/fs/nfs/pnfs_dev.c b/fs/nfs/pnfs_dev.c
index d35b62e83ea6..6da209bd9408 100644
--- a/fs/nfs/pnfs_dev.c
+++ b/fs/nfs/pnfs_dev.c
@@ -77,9 +77,8 @@ _lookup_deviceid(const struct pnfs_layoutdriver_type *ld,
                  long hash)
 {
         struct nfs4_deviceid_node *d;
-        struct hlist_node *n;
 
-        hlist_for_each_entry_rcu(d, n, &nfs4_deviceid_cache[hash], node)
+        hlist_for_each_entry_rcu(d, &nfs4_deviceid_cache[hash], node)
                 if (d->ld == ld && d->nfs_client == clp &&
                     !memcmp(&d->deviceid, id, sizeof(*id))) {
                         if (atomic_read(&d->ref))
@@ -248,12 +247,11 @@ static void
 _deviceid_purge_client(const struct nfs_client *clp, long hash)
 {
         struct nfs4_deviceid_node *d;
-        struct hlist_node *n;
         HLIST_HEAD(tmp);
 
         spin_lock(&nfs4_deviceid_lock);
         rcu_read_lock();
-        hlist_for_each_entry_rcu(d, n, &nfs4_deviceid_cache[hash], node)
+        hlist_for_each_entry_rcu(d, &nfs4_deviceid_cache[hash], node)
                 if (d->nfs_client == clp && atomic_read(&d->ref)) {
                         hlist_del_init_rcu(&d->node);
                         hlist_add_head(&d->tmpnode, &tmp);
@@ -291,12 +289,11 @@ void
 nfs4_deviceid_mark_client_invalid(struct nfs_client *clp)
 {
         struct nfs4_deviceid_node *d;
-        struct hlist_node *n;
         int i;
 
         rcu_read_lock();
         for (i = 0; i < NFS4_DEVICE_ID_HASH_SIZE; i ++){
-                hlist_for_each_entry_rcu(d, n, &nfs4_deviceid_cache[i], node)
+                hlist_for_each_entry_rcu(d, &nfs4_deviceid_cache[i], node)
                         if (d->nfs_client == clp)
                                 set_bit(NFS_DEVICEID_INVALID, &d->flags);
         }
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 2cbac34a55da..da3dbd0f8979 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -120,7 +120,6 @@ hash_refile(struct svc_cacherep *rp)
 int
 nfsd_cache_lookup(struct svc_rqst *rqstp)
 {
-        struct hlist_node       *hn;
         struct hlist_head       *rh;
         struct svc_cacherep     *rp;
         __be32                  xid = rqstp->rq_xid;
@@ -141,7 +140,7 @@ nfsd_cache_lookup(struct svc_rqst *rqstp)
         rtn = RC_DOIT;
 
         rh = &cache_hash[request_hash(xid)];
-        hlist_for_each_entry(rp, hn, rh, c_hash) {
+        hlist_for_each_entry(rp, rh, c_hash) {
                 if (rp->c_state != RC_UNUSED &&
                     xid == rp->c_xid && proc == rp->c_proc &&
                     proto == rp->c_prot && vers == rp->c_vers &&
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index 6baadb5a8430..4bb21d67d9b1 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -52,7 +52,6 @@ void __fsnotify_vfsmount_delete(struct vfsmount *mnt)
 void __fsnotify_update_child_dentry_flags(struct inode *inode)
 {
         struct dentry *alias;
-        struct hlist_node *p;
         int watched;
 
         if (!S_ISDIR(inode->i_mode))
@@ -64,7 +63,7 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode)
         spin_lock(&inode->i_lock);
         /* run all of the dentries associated with this inode.  Since this is a
          * directory, there damn well better only be one item on this list */
-        hlist_for_each_entry(alias, p, &inode->i_dentry, d_alias) {
+        hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
                 struct dentry *child;
 
                 /* run all of the children of the original inode and fix their
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index f31e90fc050d..74825be65b7b 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -36,12 +36,11 @@
 static void fsnotify_recalc_inode_mask_locked(struct inode *inode)
 {
         struct fsnotify_mark *mark;
-        struct hlist_node *pos;
         __u32 new_mask = 0;
 
         assert_spin_locked(&inode->i_lock);
 
-        hlist_for_each_entry(mark, pos, &inode->i_fsnotify_marks, i.i_list)
+        hlist_for_each_entry(mark, &inode->i_fsnotify_marks, i.i_list)
                 new_mask |= mark->mask;
         inode->i_fsnotify_mask = new_mask;
 }
@@ -87,11 +86,11 @@ void fsnotify_destroy_inode_mark(struct fsnotify_mark *mark)
 void fsnotify_clear_marks_by_inode(struct inode *inode)
 {
         struct fsnotify_mark *mark, *lmark;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
         LIST_HEAD(free_list);
 
         spin_lock(&inode->i_lock);
-        hlist_for_each_entry_safe(mark, pos, n, &inode->i_fsnotify_marks, i.i_list) {
+        hlist_for_each_entry_safe(mark, n, &inode->i_fsnotify_marks, i.i_list) {
                 list_add(&mark->i.free_i_list, &free_list);
                 hlist_del_init_rcu(&mark->i.i_list);
                 fsnotify_get_mark(mark);
@@ -129,11 +128,10 @@ static struct fsnotify_mark *fsnotify_find_inode_mark_locked(
                 struct inode *inode)
 {
         struct fsnotify_mark *mark;
-        struct hlist_node *pos;
 
         assert_spin_locked(&inode->i_lock);
 
-        hlist_for_each_entry(mark, pos, &inode->i_fsnotify_marks, i.i_list) {
+        hlist_for_each_entry(mark, &inode->i_fsnotify_marks, i.i_list) {
                 if (mark->group == group) {
                         fsnotify_get_mark(mark);
                         return mark;
@@ -194,8 +192,7 @@ int fsnotify_add_inode_mark(struct fsnotify_mark *mark,
                             struct fsnotify_group *group, struct inode *inode,
                             int allow_dups)
 {
-        struct fsnotify_mark *lmark;
-        struct hlist_node *node, *last = NULL;
+        struct fsnotify_mark *lmark, *last = NULL;
         int ret = 0;
 
         mark->flags |= FSNOTIFY_MARK_FLAG_INODE;
@@ -214,8 +211,8 @@ int fsnotify_add_inode_mark(struct fsnotify_mark *mark,
         }
 
         /* should mark be in the middle of the current list? */
-        hlist_for_each_entry(lmark, node, &inode->i_fsnotify_marks, i.i_list) {
-                last = node;
+        hlist_for_each_entry(lmark, &inode->i_fsnotify_marks, i.i_list) {
+                last = lmark;
 
                 if ((lmark->group == group) && !allow_dups) {
                         ret = -EEXIST;
@@ -235,7 +232,7 @@ int fsnotify_add_inode_mark(struct fsnotify_mark *mark,
 
         BUG_ON(last == NULL);
         /* mark should be the last entry.  last is the current last entry */
-        hlist_add_after_rcu(last, &mark->i.i_list);
+        hlist_add_after_rcu(&last->i.i_list, &mark->i.i_list);
 out:
         fsnotify_recalc_inode_mask_locked(inode);
         spin_unlock(&inode->i_lock);
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index 871569c7d609..4216308b81b4 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -197,7 +197,6 @@ static void inotify_free_group_priv(struct fsnotify_group *group)
 {
         /* ideally the idr is empty and we won't hit the BUG in the callback */
         idr_for_each(&group->inotify_data.idr, idr_callback, group);
-        idr_remove_all(&group->inotify_data.idr);
         idr_destroy(&group->inotify_data.idr);
         atomic_dec(&group->inotify_data.user->inotify_devs);
         free_uid(group->inotify_data.user);
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 07f7a92fe88e..e0f7c1241a6a 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -364,22 +364,20 @@ static int inotify_add_to_idr(struct idr *idr, spinlock_t *idr_lock,
 {
         int ret;
 
-        do {
-                if (unlikely(!idr_pre_get(idr, GFP_KERNEL)))
-                        return -ENOMEM;
+        idr_preload(GFP_KERNEL);
+        spin_lock(idr_lock);
 
-                spin_lock(idr_lock);
-                ret = idr_get_new_above(idr, i_mark, *last_wd + 1,
-                                        &i_mark->wd);
+        ret = idr_alloc(idr, i_mark, *last_wd + 1, 0, GFP_NOWAIT);
+        if (ret >= 0) {
                 /* we added the mark to the idr, take a reference */
-                if (!ret) {
-                        *last_wd = i_mark->wd;
-                        fsnotify_get_mark(&i_mark->fsn_mark);
-                }
-                spin_unlock(idr_lock);
-        } while (ret == -EAGAIN);
+                i_mark->wd = ret;
+                *last_wd = i_mark->wd;
+                fsnotify_get_mark(&i_mark->fsn_mark);
+        }
 
-        return ret;
+        spin_unlock(idr_lock);
+        idr_preload_end();
+        return ret < 0 ? ret : 0;
 }
 
 static struct inotify_inode_mark *inotify_idr_find_locked(struct fsnotify_group *group,
diff --git a/fs/notify/vfsmount_mark.c b/fs/notify/vfsmount_mark.c
index 4df58b8ea64a..68ca5a8704b5 100644
--- a/fs/notify/vfsmount_mark.c
+++ b/fs/notify/vfsmount_mark.c
@@ -33,12 +33,12 @@
 void fsnotify_clear_marks_by_mount(struct vfsmount *mnt)
 {
         struct fsnotify_mark *mark, *lmark;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
         struct mount *m = real_mount(mnt);
         LIST_HEAD(free_list);
 
         spin_lock(&mnt->mnt_root->d_lock);
-        hlist_for_each_entry_safe(mark, pos, n, &m->mnt_fsnotify_marks, m.m_list) {
+        hlist_for_each_entry_safe(mark, n, &m->mnt_fsnotify_marks, m.m_list) {
                 list_add(&mark->m.free_m_list, &free_list);
                 hlist_del_init_rcu(&mark->m.m_list);
                 fsnotify_get_mark(mark);
@@ -71,12 +71,11 @@ static void fsnotify_recalc_vfsmount_mask_locked(struct vfsmount *mnt)
 {
         struct mount *m = real_mount(mnt);
         struct fsnotify_mark *mark;
-        struct hlist_node *pos;
         __u32 new_mask = 0;
 
         assert_spin_locked(&mnt->mnt_root->d_lock);
 
-        hlist_for_each_entry(mark, pos, &m->mnt_fsnotify_marks, m.m_list)
+        hlist_for_each_entry(mark, &m->mnt_fsnotify_marks, m.m_list)
                 new_mask |= mark->mask;
         m->mnt_fsnotify_mask = new_mask;
 }
@@ -114,11 +113,10 @@ static struct fsnotify_mark *fsnotify_find_vfsmount_mark_locked(struct fsnotify_
 {
         struct mount *m = real_mount(mnt);
         struct fsnotify_mark *mark;
-        struct hlist_node *pos;
 
         assert_spin_locked(&mnt->mnt_root->d_lock);
 
-        hlist_for_each_entry(mark, pos, &m->mnt_fsnotify_marks, m.m_list) {
+        hlist_for_each_entry(mark, &m->mnt_fsnotify_marks, m.m_list) {
                 if (mark->group == group) {
                         fsnotify_get_mark(mark);
                         return mark;
@@ -153,8 +151,7 @@ int fsnotify_add_vfsmount_mark(struct fsnotify_mark *mark,
                                int allow_dups)
 {
         struct mount *m = real_mount(mnt);
-        struct fsnotify_mark *lmark;
-        struct hlist_node *node, *last = NULL;
+        struct fsnotify_mark *lmark, *last = NULL;
         int ret = 0;
 
         mark->flags |= FSNOTIFY_MARK_FLAG_VFSMOUNT;
@@ -173,8 +170,8 @@ int fsnotify_add_vfsmount_mark(struct fsnotify_mark *mark,
         }
 
         /* should mark be in the middle of the current list? */
-        hlist_for_each_entry(lmark, node, &m->mnt_fsnotify_marks, m.m_list) {
-                last = node;
+        hlist_for_each_entry(lmark, &m->mnt_fsnotify_marks, m.m_list) {
+                last = lmark;
 
                 if ((lmark->group == group) && !allow_dups) {
                         ret = -EEXIST;
@@ -194,7 +191,7 @@ int fsnotify_add_vfsmount_mark(struct fsnotify_mark *mark,
 
         BUG_ON(last == NULL);
         /* mark should be the last entry.  last is the current last entry */
-        hlist_add_after_rcu(last, &mark->m.m_list);
+        hlist_add_after_rcu(&last->m.m_list, &mark->m.m_list);
 out:
         fsnotify_recalc_vfsmount_mask_locked(mnt);
         spin_unlock(&mnt->mnt_root->d_lock);
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 0d2bf566e39a..aa88bd8bcedc 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -304,28 +304,22 @@ static u8 o2net_num_from_nn(struct o2net_node *nn)
 
 static int o2net_prep_nsw(struct o2net_node *nn, struct o2net_status_wait *nsw)
 {
-        int ret = 0;
-
-        do {
-                if (!idr_pre_get(&nn->nn_status_idr, GFP_ATOMIC)) {
-                        ret = -EAGAIN;
-                        break;
-                }
-                spin_lock(&nn->nn_lock);
-                ret = idr_get_new(&nn->nn_status_idr, nsw, &nsw->ns_id);
-                if (ret == 0)
-                        list_add_tail(&nsw->ns_node_item,
-                                      &nn->nn_status_list);
-                spin_unlock(&nn->nn_lock);
-        } while (ret == -EAGAIN);
+        int ret;
 
-        if (ret == 0)  {
-                init_waitqueue_head(&nsw->ns_wq);
-                nsw->ns_sys_status = O2NET_ERR_NONE;
-                nsw->ns_status = 0;
+        spin_lock(&nn->nn_lock);
+        ret = idr_alloc(&nn->nn_status_idr, nsw, 0, 0, GFP_ATOMIC);
+        if (ret >= 0) {
+                nsw->ns_id = ret;
+                list_add_tail(&nsw->ns_node_item, &nn->nn_status_list);
         }
+        spin_unlock(&nn->nn_lock);
+        if (ret < 0)
+                return ret;
 
-        return ret;
+        init_waitqueue_head(&nsw->ns_wq);
+        nsw->ns_sys_status = O2NET_ERR_NONE;
+        nsw->ns_status = 0;
+        return 0;
 }
 
 static void o2net_complete_nsw_locked(struct o2net_node *nn,
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index 8db4b58b2e4b..ef999729e274 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -169,11 +169,10 @@ struct dentry *ocfs2_find_local_alias(struct inode *inode,
                                       u64 parent_blkno,
                                       int skip_unhashed)
 {
-        struct hlist_node *p;
         struct dentry *dentry;
 
         spin_lock(&inode->i_lock);
-        hlist_for_each_entry(dentry, p, &inode->i_dentry, d_alias) {
+        hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
                 spin_lock(&dentry->d_lock);
                 if (ocfs2_match_dentry(dentry, parent_blkno, skip_unhashed)) {
                         trace_ocfs2_find_local_alias(dentry->d_name.len,
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 01ebfd0bdad7..eeac97bb3bfa 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -2083,7 +2083,6 @@ static void dlm_finish_local_lockres_recovery(struct dlm_ctxt *dlm,
                                               u8 dead_node, u8 new_master)
 {
         int i;
-        struct hlist_node *hash_iter;
         struct hlist_head *bucket;
         struct dlm_lock_resource *res, *next;
 
@@ -2114,7 +2113,7 @@ static void dlm_finish_local_lockres_recovery(struct dlm_ctxt *dlm,
          * if necessary */
         for (i = 0; i < DLM_HASH_BUCKETS; i++) {
                 bucket = dlm_lockres_hash(dlm, i);
-                hlist_for_each_entry(res, hash_iter, bucket, hash_node) {
+                hlist_for_each_entry(res, bucket, hash_node) {
                         if (!(res->state & DLM_LOCK_RES_RECOVERING))
                                 continue;
 
@@ -2273,7 +2272,6 @@ static void dlm_free_dead_locks(struct dlm_ctxt *dlm,
 
 static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
 {
-        struct hlist_node *iter;
         struct dlm_lock_resource *res;
         int i;
         struct hlist_head *bucket;
@@ -2299,7 +2297,7 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
          */
         for (i = 0; i < DLM_HASH_BUCKETS; i++) {
                 bucket = dlm_lockres_hash(dlm, i);
-                hlist_for_each_entry(res, iter, bucket, hash_node) {
+                hlist_for_each_entry(res, bucket, hash_node) {
                         /* always prune any $RECOVERY entries for dead nodes,
                          * otherwise hangs can occur during later recovery */
                         if (dlm_is_recovery_lock(res->lockname.name,
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index f169da4624fd..b7e74b580c0f 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -642,7 +642,7 @@ ocfs2_block_group_alloc_discontig(handle_t *handle,
          * cluster groups will be staying in cache for the duration of
          * this operation.
          */
-        ac->ac_allow_chain_relink = 0;
+        ac->ac_disable_chain_relink = 1;
 
         /* Claim the first region */
         status = ocfs2_block_group_claim_bits(osb, handle, ac, min_bits,
@@ -1823,7 +1823,7 @@ static int ocfs2_search_chain(struct ocfs2_alloc_context *ac,
          * Do this *after* figuring out how many bits we're taking out
          * of our target group.
          */
-        if (ac->ac_allow_chain_relink &&
+        if (!ac->ac_disable_chain_relink &&
             (prev_group_bh) &&
             (ocfs2_block_group_reasonably_empty(bg, res->sr_bits))) {
                 status = ocfs2_relink_block_group(handle, alloc_inode,
@@ -1928,7 +1928,6 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_alloc_context *ac,
 
         victim = ocfs2_find_victim_chain(cl);
         ac->ac_chain = victim;
-        ac->ac_allow_chain_relink = 1;
 
         status = ocfs2_search_chain(ac, handle, bits_wanted, min_bits,
                                     res, &bits_left);
@@ -1947,7 +1946,7 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_alloc_context *ac,
          * searching each chain in order. Don't allow chain relinking
          * because we only calculate enough journal credits for one
          * relink per alloc. */
-        ac->ac_allow_chain_relink = 0;
+        ac->ac_disable_chain_relink = 1;
         for (i = 0; i < le16_to_cpu(cl->cl_next_free_rec); i ++) {
                 if (i == victim)
                         continue;
diff --git a/fs/ocfs2/suballoc.h b/fs/ocfs2/suballoc.h
index b8afabfeede4..a36d0aa50911 100644
--- a/fs/ocfs2/suballoc.h
+++ b/fs/ocfs2/suballoc.h
@@ -49,7 +49,7 @@ struct ocfs2_alloc_context {
 
         /* these are used by the chain search */
         u16    ac_chain;
-        int    ac_allow_chain_relink;
+        int    ac_disable_chain_relink;
         group_search_t *ac_group_search;
 
         u64    ac_last_group;
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 0ba9ea1e7961..2e3ea308c144 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -7189,7 +7189,7 @@ int ocfs2_init_security_and_acl(struct inode *dir,
         struct buffer_head *dir_bh = NULL;
 
         ret = ocfs2_init_security_get(inode, dir, qstr, NULL);
-        if (!ret) {
+        if (ret) {
                 mlog_errno(ret);
                 goto leave;
         }
diff --git a/fs/proc/base.c b/fs/proc/base.c
index f3b133d79914..69078c7cef1f 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -73,6 +73,7 @@
 #include <linux/security.h>
 #include <linux/ptrace.h>
 #include <linux/tracehook.h>
+#include <linux/printk.h>
 #include <linux/cgroup.h>
 #include <linux/cpuset.h>
 #include <linux/audit.h>
@@ -952,7 +953,7 @@ static ssize_t oom_adj_write(struct file *file, const char __user *buf,
          * /proc/pid/oom_adj is provided for legacy purposes, ask users to use
          * /proc/pid/oom_score_adj instead.
          */
-        printk_once(KERN_WARNING "%s (%d): /proc/%d/oom_adj is deprecated, please use /proc/%d/oom_score_adj instead.\n",
+        pr_warn_once("%s (%d): /proc/%d/oom_adj is deprecated, please use /proc/%d/oom_score_adj instead.\n",
                   current->comm, task_pid_nr(current), task_pid_nr(task),
                   task_pid_nr(task));
 
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 2983dc52ca25..4b3b3ffb52f1 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -15,6 +15,7 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/printk.h>
 #include <linux/mount.h>
 #include <linux/init.h>
 #include <linux/idr.h>
@@ -132,11 +133,8 @@ __proc_file_read(struct file *file, char __user *buf, size_t nbytes,
                 }
 
                 if (start == NULL) {
-                        if (n > PAGE_SIZE) {
-                                printk(KERN_ERR
-                                       "proc_file_read: Apparent buffer overflow!\n");
+                        if (n > PAGE_SIZE)      /* Apparent buffer overflow */
                                 n = PAGE_SIZE;
-                        }
                         n -= *ppos;
                         if (n <= 0)
                                 break;
@@ -144,26 +142,19 @@ __proc_file_read(struct file *file, char __user *buf, size_t nbytes,
                                 n = count;
                         start = page + *ppos;
                 } else if (start < page) {
-                        if (n > PAGE_SIZE) {
-                                printk(KERN_ERR
-                                       "proc_file_read: Apparent buffer overflow!\n");
+                        if (n > PAGE_SIZE)      /* Apparent buffer overflow */
                                 n = PAGE_SIZE;
-                        }
                         if (n > count) {
                                 /*
                                  * Don't reduce n because doing so might
                                  * cut off part of a data block.
                                  */
-                                printk(KERN_WARNING
-                                       "proc_file_read: Read count exceeded\n");
+                                pr_warn("proc_file_read: count exceeded\n");
                         }
                 } else /* start >= page */ {
                         unsigned long startoff = (unsigned long)(start - page);
-                        if (n > (PAGE_SIZE - startoff)) {
-                                printk(KERN_ERR
-                                       "proc_file_read: Apparent buffer overflow!\n");
+                        if (n > (PAGE_SIZE - startoff)) /* buffer overflow? */
                                 n = PAGE_SIZE - startoff;
-                        }
                         if (n > count)
                                 n = count;
                 }
@@ -569,7 +560,7 @@ static int proc_register(struct proc_dir_entry * dir, struct proc_dir_entry * dp
 
         for (tmp = dir->subdir; tmp; tmp = tmp->next)
                 if (strcmp(tmp->name, dp->name) == 0) {
-                        WARN(1, KERN_WARNING "proc_dir_entry '%s/%s' already registered\n",
+                        WARN(1, "proc_dir_entry '%s/%s' already registered\n",
                                 dir->name, dp->name);
                         break;
                 }
@@ -830,9 +821,9 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
         if (S_ISDIR(de->mode))
                 parent->nlink--;
         de->nlink = 0;
-        WARN(de->subdir, KERN_WARNING "%s: removing non-empty directory "
-                        "'%s/%s', leaking at least '%s'\n", __func__,
-                        de->parent->name, de->name, de->subdir->name);
+        WARN(de->subdir, "%s: removing non-empty directory "
+                         "'%s/%s', leaking at least '%s'\n", __func__,
+                         de->parent->name, de->name, de->subdir->name);
         pde_put(de);
 }
 EXPORT_SYMBOL(remove_proc_entry);
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 70322e1a4f0f..a86aebc9ba7c 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -13,6 +13,7 @@
 #include <linux/stat.h>
 #include <linux/completion.h>
 #include <linux/poll.h>
+#include <linux/printk.h>
 #include <linux/file.h>
 #include <linux/limits.h>
 #include <linux/init.h>
@@ -495,13 +496,13 @@ int proc_fill_super(struct super_block *s)
         pde_get(&proc_root);
         root_inode = proc_get_inode(s, &proc_root);
         if (!root_inode) {
-                printk(KERN_ERR "proc_fill_super: get root inode failed\n");
+                pr_err("proc_fill_super: get root inode failed\n");
                 return -ENOMEM;
         }
 
         s->s_root = d_make_root(root_inode);
         if (!s->s_root) {
-                printk(KERN_ERR "proc_fill_super: allocate dentry failed\n");
+                pr_err("proc_fill_super: allocate dentry failed\n");
                 return -ENOMEM;
         }
 
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 252544c05207..85ff3a4598b3 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -11,6 +11,7 @@
 
 #include <linux/sched.h>
 #include <linux/proc_fs.h>
+#include <linux/binfmts.h>
 struct  ctl_table_header;
 struct  mempolicy;
 
@@ -108,7 +109,7 @@ static inline int task_dumpable(struct task_struct *task)
         if (mm)
                 dumpable = get_dumpable(mm);
         task_unlock(task);
-        if (dumpable == SUID_DUMPABLE_ENABLED)
+        if (dumpable == SUID_DUMP_USER)
                 return 1;
         return 0;
 }
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index e96d4f18ca3a..eda6f017f272 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -17,6 +17,7 @@
 #include <linux/elfcore.h>
 #include <linux/vmalloc.h>
 #include <linux/highmem.h>
+#include <linux/printk.h>
 #include <linux/bootmem.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -619,7 +620,7 @@ static int __init proc_kcore_init(void)
         proc_root_kcore = proc_create("kcore", S_IRUSR, NULL,
                                       &proc_kcore_operations);
         if (!proc_root_kcore) {
-                printk(KERN_ERR "couldn't create /proc/kcore\n");
+                pr_err("couldn't create /proc/kcore\n");
                 return 0; /* Always returns 0. */
         }
         /* Store text area if it's special */
diff --git a/fs/proc/proc_devtree.c b/fs/proc/proc_devtree.c
index de20ec480fa0..30b590f5bd35 100644
--- a/fs/proc/proc_devtree.c
+++ b/fs/proc/proc_devtree.c
@@ -8,6 +8,7 @@
 #include <linux/time.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/printk.h>
 #include <linux/stat.h>
 #include <linux/string.h>
 #include <linux/of.h>
@@ -110,8 +111,8 @@ void proc_device_tree_update_prop(struct proc_dir_entry *pde,
                 if (ent->data == oldprop)
                         break;
         if (ent == NULL) {
-                printk(KERN_WARNING "device-tree: property \"%s\" "
-                       " does not exist\n", oldprop->name);
+                pr_warn("device-tree: property \"%s\" does not exist\n",
+                        oldprop->name);
         } else {
                 ent->data = newprop;
                 ent->size = newprop->length;
@@ -153,8 +154,8 @@ static const char *fixup_name(struct device_node *np, struct proc_dir_entry *de,
 realloc:
         fixed_name = kmalloc(fixup_len, GFP_KERNEL);
         if (fixed_name == NULL) {
-                printk(KERN_ERR "device-tree: Out of memory trying to fixup "
-                                "name \"%s\"\n", name);
+                pr_err("device-tree: Out of memory trying to fixup "
+                       "name \"%s\"\n", name);
                 return name;
         }
 
@@ -175,8 +176,8 @@ retry:
                 goto retry;
         }
 
-        printk(KERN_WARNING "device-tree: Duplicate name in %s, "
-                        "renamed to \"%s\"\n", np->full_name, fixed_name);
+        pr_warn("device-tree: Duplicate name in %s, renamed to \"%s\"\n",
+                np->full_name, fixed_name);
 
         return fixed_name;
 }
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 612df79cc6a1..ac05f33a0dde 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -5,6 +5,7 @@
 #include <linux/sysctl.h>
 #include <linux/poll.h>
 #include <linux/proc_fs.h>
+#include <linux/printk.h>
 #include <linux/security.h>
 #include <linux/sched.h>
 #include <linux/namei.h>
@@ -57,7 +58,7 @@ static void sysctl_print_dir(struct ctl_dir *dir)
 {
         if (dir->header.parent)
                 sysctl_print_dir(dir->header.parent);
-        printk(KERN_CONT "%s/", dir->header.ctl_table[0].procname);
+        pr_cont("%s/", dir->header.ctl_table[0].procname);
 }
 
 static int namecmp(const char *name1, int len1, const char *name2, int len2)
@@ -134,9 +135,9 @@ static int insert_entry(struct ctl_table_header *head, struct ctl_table *entry)
                 else if (cmp > 0)
                         p = &(*p)->rb_right;
                 else {
-                        printk(KERN_ERR "sysctl duplicate entry: ");
+                        pr_err("sysctl duplicate entry: ");
                         sysctl_print_dir(head->parent);
-                        printk(KERN_CONT "/%s\n", entry->procname);
+                        pr_cont("/%s\n", entry->procname);
                         return -EEXIST;
                 }
         }
@@ -927,9 +928,9 @@ found:
         subdir->header.nreg++;
 failed:
         if (unlikely(IS_ERR(subdir))) {
-                printk(KERN_ERR "sysctl could not get directory: ");
+                pr_err("sysctl could not get directory: ");
                 sysctl_print_dir(dir);
-                printk(KERN_CONT "/%*.*s %ld\n",
+                pr_cont("/%*.*s %ld\n",
                         namelen, namelen, name, PTR_ERR(subdir));
         }
         drop_sysctl_table(&dir->header);
@@ -995,8 +996,8 @@ static int sysctl_err(const char *path, struct ctl_table *table, char *fmt, ...)
         vaf.fmt = fmt;
         vaf.va = &args;
 
-        printk(KERN_ERR "sysctl table check failed: %s/%s %pV\n",
-                path, table->procname, &vaf);
+        pr_err("sysctl table check failed: %s/%s %pV\n",
+               path, table->procname, &vaf);
 
         va_end(args);
         return -EINVAL;
@@ -1510,9 +1511,9 @@ static void put_links(struct ctl_table_header *header)
                         drop_sysctl_table(link_head);
                 }
                 else {
-                        printk(KERN_ERR "sysctl link missing during unregister: ");
+                        pr_err("sysctl link missing during unregister: ");
                         sysctl_print_dir(parent);
-                        printk(KERN_CONT "/%s\n", name);
+                        pr_cont("/%s\n", name);
                 }
         }
 }
diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
index 0d5071d29985..b870f740ab5a 100644
--- a/fs/proc/vmcore.c
+++ b/fs/proc/vmcore.c
@@ -15,6 +15,7 @@
 #include <linux/export.h>
 #include <linux/slab.h>
 #include <linux/highmem.h>
+#include <linux/printk.h>
 #include <linux/bootmem.h>
 #include <linux/init.h>
 #include <linux/crash_dump.h>
@@ -175,15 +176,15 @@ static ssize_t read_vmcore(struct file *file, char __user *buffer,
         start = map_offset_to_paddr(*fpos, &vmcore_list, &curr_m);
         if (!curr_m)
                 return -EINVAL;
-        if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
-                tsz = buflen;
-
-        /* Calculate left bytes in current memory segment. */
-        nr_bytes = (curr_m->size - (start - curr_m->paddr));
-        if (tsz > nr_bytes)
-                tsz = nr_bytes;
 
         while (buflen) {
+                tsz = min_t(size_t, buflen, PAGE_SIZE - (start & ~PAGE_MASK));
+
+                /* Calculate left bytes in current memory segment. */
+                nr_bytes = (curr_m->size - (start - curr_m->paddr));
+                if (tsz > nr_bytes)
+                        tsz = nr_bytes;
+
                 tmp = read_from_oldmem(buffer, tsz, &start, 1);
                 if (tmp < 0)
                         return tmp;
@@ -198,12 +199,6 @@ static ssize_t read_vmcore(struct file *file, char __user *buffer,
                                                 struct vmcore, list);
                         start = curr_m->paddr;
                 }
-                if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
-                        tsz = buflen;
-                /* Calculate left bytes in current memory segment. */
-                nr_bytes = (curr_m->size - (start - curr_m->paddr));
-                if (tsz > nr_bytes)
-                        tsz = nr_bytes;
         }
         return acc;
 }
@@ -553,8 +548,7 @@ static int __init parse_crash_elf64_headers(void)
                 ehdr.e_ehsize != sizeof(Elf64_Ehdr) ||
                 ehdr.e_phentsize != sizeof(Elf64_Phdr) ||
                 ehdr.e_phnum == 0) {
-                printk(KERN_WARNING "Warning: Core image elf header is not"
-                                        "sane\n");
+                pr_warn("Warning: Core image elf header is not sane\n");
                 return -EINVAL;
         }
 
@@ -609,8 +603,7 @@ static int __init parse_crash_elf32_headers(void)
                 ehdr.e_ehsize != sizeof(Elf32_Ehdr) ||
                 ehdr.e_phentsize != sizeof(Elf32_Phdr) ||
                 ehdr.e_phnum == 0) {
-                printk(KERN_WARNING "Warning: Core image elf header is not"
-                                        "sane\n");
+                pr_warn("Warning: Core image elf header is not sane\n");
                 return -EINVAL;
         }
 
@@ -653,8 +646,7 @@ static int __init parse_crash_elf_headers(void)
         if (rc < 0)
                 return rc;
         if (memcmp(e_ident, ELFMAG, SELFMAG) != 0) {
-                printk(KERN_WARNING "Warning: Core image elf header"
-                                        " not found\n");
+                pr_warn("Warning: Core image elf header not found\n");
                 return -EINVAL;
         }
 
@@ -673,8 +665,7 @@ static int __init parse_crash_elf_headers(void)
                 /* Determine vmcore size. */
                 vmcore_size = get_vmcore_size_elf32(elfcorebuf);
         } else {
-                printk(KERN_WARNING "Warning: Core image elf header is not"
-                                        " sane\n");
+                pr_warn("Warning: Core image elf header is not sane\n");
                 return -EINVAL;
         }
         return 0;
@@ -690,7 +681,7 @@ static int __init vmcore_init(void)
                 return rc;
         rc = parse_crash_elf_headers();
         if (rc) {
-                printk(KERN_WARNING "Kdump: vmcore not initialized\n");
+                pr_warn("Kdump: vmcore not initialized\n");
                 return rc;
         }
 
diff --git a/fs/seq_file.c b/fs/seq_file.c
index f2bc3dfd0b88..15c6304bab71 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -308,27 +308,27 @@ loff_t seq_lseek(struct file *file, loff_t offset, int whence)
         mutex_lock(&m->lock);
         m->version = file->f_version;
         switch (whence) {
-                case 1:
-                        offset += file->f_pos;
-                case 0:
-                        if (offset < 0)
-                                break;
-                        retval = offset;
-                        if (offset != m->read_pos) {
-                                while ((retval=traverse(m, offset)) == -EAGAIN)
-                                        ;
-                                if (retval) {
-                                        /* with extreme prejudice... */
-                                        file->f_pos = 0;
-                                        m->read_pos = 0;
-                                        m->version = 0;
-                                        m->index = 0;
-                                        m->count = 0;
-                                } else {
-                                        m->read_pos = offset;
-                                        retval = file->f_pos = offset;
-                                }
+        case SEEK_CUR:
+                offset += file->f_pos;
+        case SEEK_SET:
+                if (offset < 0)
+                        break;
+                retval = offset;
+                if (offset != m->read_pos) {
+                        while ((retval = traverse(m, offset)) == -EAGAIN)
+                                ;
+                        if (retval) {
+                                /* with extreme prejudice... */
+                                file->f_pos = 0;
+                                m->read_pos = 0;
+                                m->version = 0;
+                                m->index = 0;
+                                m->count = 0;
+                        } else {
+                                m->read_pos = offset;
+                                retval = file->f_pos = offset;
                         }
+                }
         }
         file->f_version = m->version;
         mutex_unlock(&m->lock);
diff --git a/fs/super.c b/fs/super.c
index 12f123712161..7465d4364208 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -447,14 +447,13 @@ struct super_block *sget(struct file_system_type *type,
                         void *data)
 {
         struct super_block *s = NULL;
-        struct hlist_node *node;
         struct super_block *old;
         int err;
 
 retry:
         spin_lock(&sb_lock);
         if (test) {
-                hlist_for_each_entry(old, node, &type->fs_supers, s_instances) {
+                hlist_for_each_entry(old, &type->fs_supers, s_instances) {
                         if (!test(old, data))
                                 continue;
                         if (!grab_super(old))
@@ -554,10 +553,9 @@ void iterate_supers_type(struct file_system_type *type,
         void (*f)(struct super_block *, void *), void *arg)
 {
         struct super_block *sb, *p = NULL;
-        struct hlist_node *node;
 
         spin_lock(&sb_lock);
-        hlist_for_each_entry(sb, node, &type->fs_supers, s_instances) {
+        hlist_for_each_entry(sb, &type->fs_supers, s_instances) {
                 sb->s_count++;
                 spin_unlock(&sb_lock);
 
@@ -842,7 +840,7 @@ int get_anon_bdev(dev_t *p)
         else if (error)
                 return -EAGAIN;
 
-        if ((dev & MAX_IDR_MASK) == (1 << MINORBITS)) {
+        if (dev == (1 << MINORBITS)) {
                 spin_lock(&unnamed_dev_lock);
                 ida_remove(&unnamed_dev_ida, dev);
                 if (unnamed_dev_start > dev)
diff --git a/fs/sysfs/bin.c b/fs/sysfs/bin.c
index 2ce9a5db6ab5..15c68f9489ae 100644
--- a/fs/sysfs/bin.c
+++ b/fs/sysfs/bin.c
@@ -461,14 +461,13 @@ const struct file_operations bin_fops = {
 void unmap_bin_file(struct sysfs_dirent *attr_sd)
 {
         struct bin_buffer *bb;
-        struct hlist_node *tmp;
 
         if (sysfs_type(attr_sd) != SYSFS_KOBJ_BIN_ATTR)
                 return;
 
         mutex_lock(&sysfs_bin_lock);
 
-        hlist_for_each_entry(bb, tmp, &attr_sd->s_bin_attr.buffers, list) {
+        hlist_for_each_entry(bb, &attr_sd->s_bin_attr.buffers, list) {
                 struct inode *inode = file_inode(bb->file);
 
                 unmap_mapping_range(inode->i_mapping, 0, 0, 1);
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 96fcbb85ff83..d1dba7ce75ae 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1442,9 +1442,8 @@ xlog_recover_find_tid(
         xlog_tid_t              tid)
 {
         xlog_recover_t          *trans;
-        struct hlist_node       *n;
 
-        hlist_for_each_entry(trans, n, head, r_list) {
+        hlist_for_each_entry(trans, head, r_list) {
                 if (trans->r_log_tid == tid)
                         return trans;
         }
diff --git a/include/linux/debug_locks.h b/include/linux/debug_locks.h
index 3bd46f766751..a975de1ff59f 100644
--- a/include/linux/debug_locks.h
+++ b/include/linux/debug_locks.h
@@ -51,7 +51,7 @@ struct task_struct;
 extern void debug_show_all_locks(void);
 extern void debug_show_held_locks(struct task_struct *task);
 extern void debug_check_no_locks_freed(const void *from, unsigned long len);
-extern void debug_check_no_locks_held(struct task_struct *task);
+extern void debug_check_no_locks_held(void);
 #else
 static inline void debug_show_all_locks(void)
 {
@@ -67,7 +67,7 @@ debug_check_no_locks_freed(const void *from, unsigned long len)
 }
 
 static inline void
-debug_check_no_locks_held(struct task_struct *task)
+debug_check_no_locks_held(void)
 {
 }
 #endif
diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
index 3c3ef19a625a..cf5d2af61b81 100644
--- a/include/linux/eventfd.h
+++ b/include/linux/eventfd.h
@@ -13,7 +13,7 @@
 #include <linux/wait.h>
 
 /*
- * CAREFUL: Check include/asm-generic/fcntl.h when defining
+ * CAREFUL: Check include/uapi/asm-generic/fcntl.h when defining
  * new flags, since they might collide with O_* ones. We want
  * to re-use O_* flags that couldn't possibly have a meaning
  * from eventfd, in order to leave a free define-space for
diff --git a/include/linux/freezer.h b/include/linux/freezer.h
index e70df40d84f6..043a5cf8b5ba 100644
--- a/include/linux/freezer.h
+++ b/include/linux/freezer.h
@@ -3,6 +3,7 @@
 #ifndef FREEZER_H_INCLUDED
 #define FREEZER_H_INCLUDED
 
+#include <linux/debug_locks.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/atomic.h>
@@ -48,6 +49,8 @@ extern void thaw_kernel_threads(void);
 
 static inline bool try_to_freeze(void)
 {
+        if (!(current->flags & PF_NOFREEZE))
+                debug_check_no_locks_held();
         might_sleep();
         if (likely(!freezing(current)))
                 return false;
diff --git a/include/linux/hashtable.h b/include/linux/hashtable.h
index 227c62424f3c..a9df51f5d54c 100644
--- a/include/linux/hashtable.h
+++ b/include/linux/hashtable.h
@@ -115,51 +115,50 @@ static inline void hash_del_rcu(struct hlist_node *node)
  * hash_for_each - iterate over a hashtable
  * @name: hashtable to iterate
  * @bkt: integer to use as bucket loop cursor
- * @node: the &struct list_head to use as a loop cursor for each entry
  * @obj: the type * to use as a loop cursor for each entry
  * @member: the name of the hlist_node within the struct
  */
-#define hash_for_each(name, bkt, node, obj, member)                             \
-        for ((bkt) = 0, node = NULL; node == NULL && (bkt) < HASH_SIZE(name); (bkt)++)\
-                hlist_for_each_entry(obj, node, &name[bkt], member)
+#define hash_for_each(name, bkt, obj, member)                           \
+        for ((bkt) = 0, obj = NULL; obj == NULL && (bkt) < HASH_SIZE(name);\
+                        (bkt)++)\
+                hlist_for_each_entry(obj, &name[bkt], member)
 
 /**
  * hash_for_each_rcu - iterate over a rcu enabled hashtable
  * @name: hashtable to iterate
  * @bkt: integer to use as bucket loop cursor
- * @node: the &struct list_head to use as a loop cursor for each entry
  * @obj: the type * to use as a loop cursor for each entry
  * @member: the name of the hlist_node within the struct
  */
-#define hash_for_each_rcu(name, bkt, node, obj, member)                         \
-        for ((bkt) = 0, node = NULL; node == NULL && (bkt) < HASH_SIZE(name); (bkt)++)\
-                hlist_for_each_entry_rcu(obj, node, &name[bkt], member)
+#define hash_for_each_rcu(name, bkt, obj, member)                       \
+        for ((bkt) = 0, obj = NULL; obj == NULL && (bkt) < HASH_SIZE(name);\
+                        (bkt)++)\
+                hlist_for_each_entry_rcu(obj, &name[bkt], member)
 
 /**
  * hash_for_each_safe - iterate over a hashtable safe against removal of
  * hash entry
  * @name: hashtable to iterate
  * @bkt: integer to use as bucket loop cursor
- * @node: the &struct list_head to use as a loop cursor for each entry
  * @tmp: a &struct used for temporary storage
  * @obj: the type * to use as a loop cursor for each entry
  * @member: the name of the hlist_node within the struct
  */
-#define hash_for_each_safe(name, bkt, node, tmp, obj, member)                   \
-        for ((bkt) = 0, node = NULL; node == NULL && (bkt) < HASH_SIZE(name); (bkt)++)\
-                hlist_for_each_entry_safe(obj, node, tmp, &name[bkt], member)
+#define hash_for_each_safe(name, bkt, tmp, obj, member)                 \
+        for ((bkt) = 0, obj = NULL; obj == NULL && (bkt) < HASH_SIZE(name);\
+                        (bkt)++)\
+                hlist_for_each_entry_safe(obj, tmp, &name[bkt], member)
 
 /**
  * hash_for_each_possible - iterate over all possible objects hashing to the
  * same bucket
  * @name: hashtable to iterate
  * @obj: the type * to use as a loop cursor for each entry
- * @node: the &struct list_head to use as a loop cursor for each entry
  * @member: the name of the hlist_node within the struct
  * @key: the key of the objects to iterate over
  */
-#define hash_for_each_possible(name, obj, node, member, key)                    \
-        hlist_for_each_entry(obj, node, &name[hash_min(key, HASH_BITS(name))], member)
+#define hash_for_each_possible(name, obj, member, key)                  \
+        hlist_for_each_entry(obj, &name[hash_min(key, HASH_BITS(name))], member)
 
 /**
  * hash_for_each_possible_rcu - iterate over all possible objects hashing to the
@@ -167,25 +166,24 @@ static inline void hash_del_rcu(struct hlist_node *node)
  * in a rcu enabled hashtable
  * @name: hashtable to iterate
  * @obj: the type * to use as a loop cursor for each entry
- * @node: the &struct list_head to use as a loop cursor for each entry
  * @member: the name of the hlist_node within the struct
  * @key: the key of the objects to iterate over
  */
-#define hash_for_each_possible_rcu(name, obj, node, member, key)                \
-        hlist_for_each_entry_rcu(obj, node, &name[hash_min(key, HASH_BITS(name))], member)
+#define hash_for_each_possible_rcu(name, obj, member, key)              \
+        hlist_for_each_entry_rcu(obj, &name[hash_min(key, HASH_BITS(name))],\
+                member)
 
 /**
  * hash_for_each_possible_safe - iterate over all possible objects hashing to the
  * same bucket safe against removals
  * @name: hashtable to iterate
  * @obj: the type * to use as a loop cursor for each entry
- * @node: the &struct list_head to use as a loop cursor for each entry
  * @tmp: a &struct used for temporary storage
  * @member: the name of the hlist_node within the struct
  * @key: the key of the objects to iterate over
  */
-#define hash_for_each_possible_safe(name, obj, node, tmp, member, key)          \
-        hlist_for_each_entry_safe(obj, node, tmp,                               \
+#define hash_for_each_possible_safe(name, obj, tmp, member, key)        \
+        hlist_for_each_entry_safe(obj, tmp,\
                 &name[hash_min(key, HASH_BITS(name))], member)
 
 
diff --git a/include/linux/idr.h b/include/linux/idr.h
index e5eb125effe6..a6f38b5c34e4 100644
--- a/include/linux/idr.h
+++ b/include/linux/idr.h
@@ -17,69 +17,40 @@
 #include <linux/init.h>
 #include <linux/rcupdate.h>
 
-#if BITS_PER_LONG == 32
-# define IDR_BITS 5
-# define IDR_FULL 0xfffffffful
-/* We can only use two of the bits in the top level because there is
-   only one possible bit in the top level (5 bits * 7 levels = 35
-   bits, but you only use 31 bits in the id). */
-# define TOP_LEVEL_FULL (IDR_FULL >> 30)
-#elif BITS_PER_LONG == 64
-# define IDR_BITS 6
-# define IDR_FULL 0xfffffffffffffffful
-/* We can only use two of the bits in the top level because there is
-   only one possible bit in the top level (6 bits * 6 levels = 36
-   bits, but you only use 31 bits in the id). */
-# define TOP_LEVEL_FULL (IDR_FULL >> 62)
-#else
-# error "BITS_PER_LONG is not 32 or 64"
-#endif
-
+/*
+ * We want shallower trees and thus more bits covered at each layer.  8
+ * bits gives us large enough first layer for most use cases and maximum
+ * tree depth of 4.  Each idr_layer is slightly larger than 2k on 64bit and
+ * 1k on 32bit.
+ */
+#define IDR_BITS 8
 #define IDR_SIZE (1 << IDR_BITS)
 #define IDR_MASK ((1 << IDR_BITS)-1)
 
-#define MAX_IDR_SHIFT (sizeof(int)*8 - 1)
-#define MAX_IDR_BIT (1U << MAX_IDR_SHIFT)
-#define MAX_IDR_MASK (MAX_IDR_BIT - 1)
-
-/* Leave the possibility of an incomplete final layer */
-#define MAX_IDR_LEVEL ((MAX_IDR_SHIFT + IDR_BITS - 1) / IDR_BITS)
-
-/* Number of id_layer structs to leave in free list */
-#define MAX_IDR_FREE (MAX_IDR_LEVEL * 2)
-
 struct idr_layer {
-        unsigned long            bitmap; /* A zero bit means "space here" */
+        int                     prefix; /* the ID prefix of this idr_layer */
+        DECLARE_BITMAP(bitmap, IDR_SIZE); /* A zero bit means "space here" */
         struct idr_layer __rcu  *ary[1<<IDR_BITS];
-        int                      count;  /* When zero, we can release it */
-        int                      layer;  /* distance from leaf */
-        struct rcu_head          rcu_head;
+        int                     count;  /* When zero, we can release it */
+        int                     layer;  /* distance from leaf */
+        struct rcu_head         rcu_head;
 };
 
 struct idr {
-        struct idr_layer __rcu *top;
-        struct idr_layer *id_free;
-        int               layers; /* only valid without concurrent changes */
-        int               id_free_cnt;
-        spinlock_t        lock;
+        struct idr_layer __rcu  *hint;  /* the last layer allocated from */
+        struct idr_layer __rcu  *top;
+        struct idr_layer        *id_free;
+        int                     layers; /* only valid w/o concurrent changes */
+        int                     id_free_cnt;
+        spinlock_t              lock;
 };
 
-#define IDR_INIT(name)                                          \
-{                                                               \
-        .top            = NULL,                                 \
-        .id_free        = NULL,                                 \
-        .layers         = 0,                                    \
-        .id_free_cnt    = 0,                                    \
-        .lock           = __SPIN_LOCK_UNLOCKED(name.lock),      \
+#define IDR_INIT(name)                                                  \
+{                                                                       \
+        .lock                   = __SPIN_LOCK_UNLOCKED(name.lock),      \
 }
 #define DEFINE_IDR(name)        struct idr name = IDR_INIT(name)
 
-/* Actions to be taken after a call to _idr_sub_alloc */
-#define IDR_NEED_TO_GROW -2
-#define IDR_NOMORE_SPACE -3
-
-#define _idr_rc_to_errno(rc) ((rc) == -1 ? -EAGAIN : -ENOSPC)
-
 /**
  * DOC: idr sync
  * idr synchronization (stolen from radix-tree.h)
@@ -101,19 +72,90 @@ struct idr {
  * This is what we export.
  */
 
-void *idr_find(struct idr *idp, int id);
+void *idr_find_slowpath(struct idr *idp, int id);
 int idr_pre_get(struct idr *idp, gfp_t gfp_mask);
-int idr_get_new(struct idr *idp, void *ptr, int *id);
 int idr_get_new_above(struct idr *idp, void *ptr, int starting_id, int *id);
+void idr_preload(gfp_t gfp_mask);
+int idr_alloc(struct idr *idp, void *ptr, int start, int end, gfp_t gfp_mask);
 int idr_for_each(struct idr *idp,
                  int (*fn)(int id, void *p, void *data), void *data);
 void *idr_get_next(struct idr *idp, int *nextid);
 void *idr_replace(struct idr *idp, void *ptr, int id);
 void idr_remove(struct idr *idp, int id);
-void idr_remove_all(struct idr *idp);
+void idr_free(struct idr *idp, int id);
 void idr_destroy(struct idr *idp);
 void idr_init(struct idr *idp);
 
+/**
+ * idr_preload_end - end preload section started with idr_preload()
+ *
+ * Each idr_preload() should be matched with an invocation of this
+ * function.  See idr_preload() for details.
+ */
+static inline void idr_preload_end(void)
+{
+        preempt_enable();
+}
+
+/**
+ * idr_find - return pointer for given id
+ * @idp: idr handle
+ * @id: lookup key
+ *
+ * Return the pointer given the id it has been registered with.  A %NULL
+ * return indicates that @id is not valid or you passed %NULL in
+ * idr_get_new().
+ *
+ * This function can be called under rcu_read_lock(), given that the leaf
+ * pointers lifetimes are correctly managed.
+ */
+static inline void *idr_find(struct idr *idr, int id)
+{
+        struct idr_layer *hint = rcu_dereference_raw(idr->hint);
+
+        if (hint && (id & ~IDR_MASK) == hint->prefix)
+                return rcu_dereference_raw(hint->ary[id & IDR_MASK]);
+
+        return idr_find_slowpath(idr, id);
+}
+
+/**
+ * idr_get_new - allocate new idr entry
+ * @idp: idr handle
+ * @ptr: pointer you want associated with the id
+ * @id: pointer to the allocated handle
+ *
+ * Simple wrapper around idr_get_new_above() w/ @starting_id of zero.
+ */
+static inline int idr_get_new(struct idr *idp, void *ptr, int *id)
+{
+        return idr_get_new_above(idp, ptr, 0, id);
+}
+
+/**
+ * idr_for_each_entry - iterate over an idr's elements of a given type
+ * @idp:     idr handle
+ * @entry:   the type * to use as cursor
+ * @id:      id entry's key
+ */
+#define idr_for_each_entry(idp, entry, id)                              \
+        for (id = 0, entry = (typeof(entry))idr_get_next((idp), &(id)); \
+             entry != NULL;                                             \
+             ++id, entry = (typeof(entry))idr_get_next((idp), &(id)))
+
+void __idr_remove_all(struct idr *idp); /* don't use */
+
+/**
+ * idr_remove_all - remove all ids from the given idr tree
+ * @idp: idr handle
+ *
+ * If you're trying to destroy @idp, calling idr_destroy() is enough.
+ * This is going away.  Don't use.
+ */
+static inline void __deprecated idr_remove_all(struct idr *idp)
+{
+        __idr_remove_all(idp);
+}
 
 /*
  * IDA - IDR based id allocator, use when translation from id to
@@ -141,7 +183,6 @@ struct ida {
 
 int ida_pre_get(struct ida *ida, gfp_t gfp_mask);
 int ida_get_new_above(struct ida *ida, int starting_id, int *p_id);
-int ida_get_new(struct ida *ida, int *p_id);
 void ida_remove(struct ida *ida, int id);
 void ida_destroy(struct ida *ida);
 void ida_init(struct ida *ida);
@@ -150,17 +191,18 @@ int ida_simple_get(struct ida *ida, unsigned int start, unsigned int end,
                    gfp_t gfp_mask);
 void ida_simple_remove(struct ida *ida, unsigned int id);
 
-void __init idr_init_cache(void);
-
 /**
- * idr_for_each_entry - iterate over an idr's elements of a given type
- * @idp:     idr handle
- * @entry:   the type * to use as cursor
- * @id:      id entry's key
+ * ida_get_new - allocate new ID
+ * @ida:        idr handle
+ * @p_id:       pointer to the allocated handle
+ *
+ * Simple wrapper around ida_get_new_above() w/ @starting_id of zero.
  */
-#define idr_for_each_entry(idp, entry, id)                              \
-        for (id = 0, entry = (typeof(entry))idr_get_next((idp), &(id)); \
-             entry != NULL;                                             \
-             ++id, entry = (typeof(entry))idr_get_next((idp), &(id)))
+static inline int ida_get_new(struct ida *ida, int *p_id)
+{
+        return ida_get_new_above(ida, 0, p_id);
+}
+
+void __init idr_init_cache(void);
 
 #endif /* __IDR_H__ */
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index 4648d8021244..cfd21e3d5506 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -216,11 +216,10 @@ static inline struct hlist_head *team_port_index_hash(struct team *team,
 static inline struct team_port *team_get_port_by_index(struct team *team,
                                                        int port_index)
 {
-        struct hlist_node *p;
         struct team_port *port;
         struct hlist_head *head = team_port_index_hash(team, port_index);
 
-        hlist_for_each_entry(port, p, head, hlist)
+        hlist_for_each_entry(port, head, hlist)
                 if (port->index == port_index)
                         return port;
         return NULL;
@@ -228,11 +227,10 @@ static inline struct team_port *team_get_port_by_index(struct team *team,
 static inline struct team_port *team_get_port_by_index_rcu(struct team *team,
                                                            int port_index)
 {
-        struct hlist_node *p;
         struct team_port *port;
         struct hlist_head *head = team_port_index_hash(team, port_index);
 
-        hlist_for_each_entry_rcu(port, p, head, hlist)
+        hlist_for_each_entry_rcu(port, head, hlist)
                 if (port->index == port_index)
                         return port;
         return NULL;
diff --git a/include/linux/ipmi.h b/include/linux/ipmi.h
index 1487e7906bbd..1f9f56e28851 100644
--- a/include/linux/ipmi.h
+++ b/include/linux/ipmi.h
@@ -35,10 +35,6 @@
 
 #include <uapi/linux/ipmi.h>
 
-
-/*
- * The in-kernel interface.
- */
 #include <linux/list.h>
 #include <linux/proc_fs.h>
 
diff --git a/include/linux/list.h b/include/linux/list.h
index cc6d2aa6b415..d991cc147c98 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -666,54 +666,49 @@ static inline void hlist_move_list(struct hlist_head *old,
         for (pos = (head)->first; pos && ({ n = pos->next; 1; }); \
              pos = n)
 
+#define hlist_entry_safe(ptr, type, member) \
+        (ptr) ? hlist_entry(ptr, type, member) : NULL
+
 /**
  * hlist_for_each_entry - iterate over list of given type
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
+ * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
  * @member:     the name of the hlist_node within the struct.
  */
-#define hlist_for_each_entry(tpos, pos, head, member)                    \
-        for (pos = (head)->first;                                        \
-             pos &&                                                      \
-                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
-             pos = pos->next)
+#define hlist_for_each_entry(pos, head, member)                         \
+        for (pos = hlist_entry_safe((head)->first, typeof(*(pos)), member);\
+             pos;                                                       \
+             pos = hlist_entry_safe((pos)->member.next, typeof(*(pos)), member))
 
 /**
  * hlist_for_each_entry_continue - iterate over a hlist continuing after current point
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
+ * @pos:        the type * to use as a loop cursor.
  * @member:     the name of the hlist_node within the struct.
  */
-#define hlist_for_each_entry_continue(tpos, pos, member)                 \
-        for (pos = (pos)->next;                                          \
-             pos &&                                                      \
-                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
-             pos = pos->next)
+#define hlist_for_each_entry_continue(pos, member)                      \
+        for (pos = hlist_entry_safe((pos)->member.next, typeof(*(pos)), member);\
+             pos;                                                       \
+             pos = hlist_entry_safe((pos)->member.next, typeof(*(pos)), member))
 
 /**
  * hlist_for_each_entry_from - iterate over a hlist continuing from current point
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
+ * @pos:        the type * to use as a loop cursor.
  * @member:     the name of the hlist_node within the struct.
  */
-#define hlist_for_each_entry_from(tpos, pos, member)                     \
-        for (; pos &&                                                    \
-                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
-             pos = pos->next)
+#define hlist_for_each_entry_from(pos, member)                          \
+        for (; pos;                                                     \
+             pos = hlist_entry_safe((pos)->member.next, typeof(*(pos)), member))
 
 /**
  * hlist_for_each_entry_safe - iterate over list of given type safe against removal of list entry
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
+ * @pos:        the type * to use as a loop cursor.
  * @n:          another &struct hlist_node to use as temporary storage
  * @head:       the head for your list.
  * @member:     the name of the hlist_node within the struct.
  */
-#define hlist_for_each_entry_safe(tpos, pos, n, head, member)            \
-        for (pos = (head)->first;                                        \
-             pos && ({ n = pos->next; 1; }) &&                           \
-                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
-             pos = n)
+#define hlist_for_each_entry_safe(pos, n, head, member)                 \
+        for (pos = hlist_entry_safe((head)->first, typeof(*pos), member);\
+             pos && ({ n = pos->member.next; 1; });                     \
+             pos = hlist_entry_safe(n, typeof(*pos), member))
 
 #endif
diff --git a/include/linux/mfd/lp8788.h b/include/linux/mfd/lp8788.h
index 2a32b16f79cb..786bf6679a28 100644
--- a/include/linux/mfd/lp8788.h
+++ b/include/linux/mfd/lp8788.h
@@ -16,6 +16,7 @@
 
 #include <linux/gpio.h>
 #include <linux/irqdomain.h>
+#include <linux/pwm.h>
 #include <linux/regmap.h>
 
 #define LP8788_DEV_BUCK         "lp8788-buck"
@@ -124,11 +125,6 @@ enum lp8788_bl_ramp_step {
         LP8788_RAMP_65538us,
 };
 
-enum lp8788_bl_pwm_polarity {
-        LP8788_PWM_ACTIVE_HIGH,
-        LP8788_PWM_ACTIVE_LOW,
-};
-
 enum lp8788_isink_scale {
         LP8788_ISINK_SCALE_100mA,
         LP8788_ISINK_SCALE_120mA,
@@ -229,16 +225,6 @@ struct lp8788_charger_platform_data {
 };
 
 /*
- * struct lp8788_bl_pwm_data
- * @pwm_set_intensity     : set duty of pwm
- * @pwm_get_intensity     : get current duty of pwm
- */
-struct lp8788_bl_pwm_data {
-        void (*pwm_set_intensity) (int brightness, int max_brightness);
-        int (*pwm_get_intensity) (int max_brightness);
-};
-
-/*
  * struct lp8788_backlight_platform_data
  * @name                  : backlight driver name. (default: "lcd-backlight")
  * @initial_brightness    : initial value of backlight brightness
@@ -248,8 +234,8 @@ struct lp8788_bl_pwm_data {
  * @rise_time             : brightness ramp up step time
  * @fall_time             : brightness ramp down step time
  * @pwm_pol               : pwm polarity setting when bl_mode is pwm based
- * @pwm_data              : platform specific pwm generation functions
- *                          only valid when bl_mode is pwm based
+ * @period_ns             : platform specific pwm period value. unit is nano.
+                            Only valid when bl_mode is LP8788_BL_COMB_PWM_BASED
  */
 struct lp8788_backlight_platform_data {
         char *name;
@@ -259,8 +245,8 @@ struct lp8788_backlight_platform_data {
         enum lp8788_bl_full_scale_current full_scale;
         enum lp8788_bl_ramp_step rise_time;
         enum lp8788_bl_ramp_step fall_time;
-        enum lp8788_bl_pwm_polarity pwm_pol;
-        struct lp8788_bl_pwm_data pwm_data;
+        enum pwm_polarity pwm_pol;
+        unsigned int period_ns;
 };
 
 /*
diff --git a/include/linux/pid.h b/include/linux/pid.h
index 2381c973d897..a089a3c447fc 100644
--- a/include/linux/pid.h
+++ b/include/linux/pid.h
@@ -176,9 +176,8 @@ pid_t pid_vnr(struct pid *pid);
 
 #define do_each_pid_task(pid, type, task)                               \
         do {                                                            \
-                struct hlist_node *pos___;                              \
                 if ((pid) != NULL)                                      \
-                        hlist_for_each_entry_rcu((task), pos___,        \
+                        hlist_for_each_entry_rcu((task),                \
                                 &(pid)->tasks[type], pids[type].node) {
 
                         /*
diff --git a/include/linux/rculist.h b/include/linux/rculist.h
index c92dd28eaa6c..8089e35d47ac 100644
--- a/include/linux/rculist.h
+++ b/include/linux/rculist.h
@@ -445,8 +445,7 @@ static inline void hlist_add_after_rcu(struct hlist_node *prev,
 
 /**
  * hlist_for_each_entry_rcu - iterate over rcu list of given type
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
+ * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
  * @member:     the name of the hlist_node within the struct.
  *
@@ -454,16 +453,16 @@ static inline void hlist_add_after_rcu(struct hlist_node *prev,
  * the _rcu list-mutation primitives such as hlist_add_head_rcu()
  * as long as the traversal is guarded by rcu_read_lock().
  */
-#define hlist_for_each_entry_rcu(tpos, pos, head, member)               \
-        for (pos = rcu_dereference_raw(hlist_first_rcu(head));          \
-                pos &&                                                   \
-                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1; }); \
-                pos = rcu_dereference_raw(hlist_next_rcu(pos)))
+#define hlist_for_each_entry_rcu(pos, head, member)                     \
+        for (pos = hlist_entry_safe (rcu_dereference_raw(hlist_first_rcu(head)),\
+                        typeof(*(pos)), member);                        \
+                pos;                                                    \
+                pos = hlist_entry_safe(rcu_dereference_raw(hlist_next_rcu(\
+                        &(pos)->member)), typeof(*(pos)), member))
 
 /**
  * hlist_for_each_entry_rcu_bh - iterate over rcu list of given type
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
+ * @pos:        the type * to use as a loop cursor.
  * @head:       the head for your list.
  * @member:     the name of the hlist_node within the struct.
  *
@@ -471,35 +470,36 @@ static inline void hlist_add_after_rcu(struct hlist_node *prev,
  * the _rcu list-mutation primitives such as hlist_add_head_rcu()
  * as long as the traversal is guarded by rcu_read_lock().
  */
-#define hlist_for_each_entry_rcu_bh(tpos, pos, head, member)             \
-        for (pos = rcu_dereference_bh((head)->first);                    \
-                pos &&                                                   \
-                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1; }); \
-                pos = rcu_dereference_bh(pos->next))
+#define hlist_for_each_entry_rcu_bh(pos, head, member)                  \
+        for (pos = hlist_entry_safe(rcu_dereference_bh(hlist_first_rcu(head)),\
+                        typeof(*(pos)), member);                        \
+                pos;                                                    \
+                pos = hlist_entry_safe(rcu_dereference_bh(hlist_next_rcu(\
+                        &(pos)->member)), typeof(*(pos)), member))
 
 /**
  * hlist_for_each_entry_continue_rcu - iterate over a hlist continuing after current point
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
+ * @pos:        the type * to use as a loop cursor.
  * @member:     the name of the hlist_node within the struct.
  */
-#define hlist_for_each_entry_continue_rcu(tpos, pos, member)            \
-        for (pos = rcu_dereference((pos)->next);                        \
-             pos &&                                                     \
-             ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1; });  \
-             pos = rcu_dereference(pos->next))
+#define hlist_for_each_entry_continue_rcu(pos, member)                  \
+        for (pos = hlist_entry_safe(rcu_dereference((pos)->member.next),\
+                        typeof(*(pos)), member);                        \
+             pos;                                                       \
+             pos = hlist_entry_safe(rcu_dereference((pos)->member.next),\
+                        typeof(*(pos)), member))
 
 /**
  * hlist_for_each_entry_continue_rcu_bh - iterate over a hlist continuing after current point
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
+ * @pos:        the type * to use as a loop cursor.
  * @member:     the name of the hlist_node within the struct.
  */
-#define hlist_for_each_entry_continue_rcu_bh(tpos, pos, member)         \
-        for (pos = rcu_dereference_bh((pos)->next);                     \
-             pos &&                                                     \
-             ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1; });  \
-             pos = rcu_dereference_bh(pos->next))
+#define hlist_for_each_entry_continue_rcu_bh(pos, member)               \
+        for (pos = hlist_entry_safe(rcu_dereference_bh((pos)->member.next),\
+                        typeof(*(pos)), member);                        \
+             pos;                                                       \
+             pos = hlist_entry_safe(rcu_dereference_bh((pos)->member.next),\
+                        typeof(*(pos)), member))
 
 
 #endif  /* __KERNEL__ */
diff --git a/include/linux/scatterlist.h b/include/linux/scatterlist.h
index 4bd6c06eb28e..2d8bdaef9611 100644
--- a/include/linux/scatterlist.h
+++ b/include/linux/scatterlist.h
@@ -231,6 +231,41 @@ size_t sg_copy_to_buffer(struct scatterlist *sgl, unsigned int nents,
  */
 #define SG_MAX_SINGLE_ALLOC             (PAGE_SIZE / sizeof(struct scatterlist))
 
+/*
+ * sg page iterator
+ *
+ * Iterates over sg entries page-by-page.  On each successful iteration,
+ * @piter->page points to the current page, @piter->sg to the sg holding this
+ * page and @piter->sg_pgoffset to the page's page offset within the sg. The
+ * iteration will stop either when a maximum number of sg entries was reached
+ * or a terminating sg (sg_last(sg) == true) was reached.
+ */
+struct sg_page_iter {
+        struct page             *page;          /* current page */
+        struct scatterlist      *sg;            /* sg holding the page */
+        unsigned int            sg_pgoffset;    /* page offset within the sg */
+
+        /* these are internal states, keep away */
+        unsigned int            __nents;        /* remaining sg entries */
+        int                     __pg_advance;   /* nr pages to advance at the
+                                                 * next step */
+};
+
+bool __sg_page_iter_next(struct sg_page_iter *piter);
+void __sg_page_iter_start(struct sg_page_iter *piter,
+                          struct scatterlist *sglist, unsigned int nents,
+                          unsigned long pgoffset);
+
+/**
+ * for_each_sg_page - iterate over the pages of the given sg list
+ * @sglist:     sglist to iterate over
+ * @piter:      page iterator to hold current page, sg, sg_pgoffset
+ * @nents:      maximum number of sg entries to iterate over
+ * @pgoffset:   starting page offset
+ */
+#define for_each_sg_page(sglist, piter, nents, pgoffset)                   \
+        for (__sg_page_iter_start((piter), (sglist), (nents), (pgoffset)); \
+             __sg_page_iter_next(piter);)
 
 /*
  * Mapping sg iterator
@@ -258,11 +293,11 @@ struct sg_mapping_iter {
         void                    *addr;          /* pointer to the mapped area */
         size_t                  length;         /* length of the mapped area */
         size_t                  consumed;       /* number of consumed bytes */
+        struct sg_page_iter     piter;          /* page iterator */
 
         /* these are internal states, keep away */
-        struct scatterlist      *__sg;          /* current entry */
-        unsigned int            __nents;        /* nr of remaining entries */
-        unsigned int            __offset;       /* offset within sg */
+        unsigned int            __offset;       /* offset within page */
+        unsigned int            __remaining;    /* remaining bytes on page */
         unsigned int            __flags;
 };
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6853bf947fde..d35d2b6ddbfb 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -346,11 +346,6 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {}
 extern void set_dumpable(struct mm_struct *mm, int value);
 extern int get_dumpable(struct mm_struct *mm);
 
-/* get/set_dumpable() values */
-#define SUID_DUMPABLE_DISABLED  0
-#define SUID_DUMPABLE_ENABLED   1
-#define SUID_DUMPABLE_SAFE      2
-
 /* mm flags */
 /* dumpable bits */
 #define MMF_DUMPABLE      0  /* core dump is permitted */
diff --git a/include/net/ax25.h b/include/net/ax25.h
index 53539acbd81a..89ed9ac5701f 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -161,8 +161,8 @@ typedef struct ax25_uid_assoc {
         ax25_address            call;
 } ax25_uid_assoc;
 
-#define ax25_uid_for_each(__ax25, node, list) \
-        hlist_for_each_entry(__ax25, node, list, uid_node)
+#define ax25_uid_for_each(__ax25, list) \
+        hlist_for_each_entry(__ax25, list, uid_node)
 
 #define ax25_uid_hold(ax25) \
         atomic_inc(&((ax25)->refcount))
@@ -247,8 +247,8 @@ typedef struct ax25_cb {
 
 #define ax25_sk(__sk) ((ax25_cb *)(__sk)->sk_protinfo)
 
-#define ax25_for_each(__ax25, node, list) \
-        hlist_for_each_entry(__ax25, node, list, ax25_node)
+#define ax25_for_each(__ax25, list) \
+        hlist_for_each_entry(__ax25, list, ax25_node)
 
 #define ax25_cb_hold(__ax25) \
         atomic_inc(&((__ax25)->refcount))
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index 7b2ae9d37076..ef83d9e844b5 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -94,8 +94,8 @@ static inline struct net *ib_net(struct inet_bind_bucket *ib)
         return read_pnet(&ib->ib_net);
 }
 
-#define inet_bind_bucket_for_each(tb, pos, head) \
-        hlist_for_each_entry(tb, pos, head, node)
+#define inet_bind_bucket_for_each(tb, head) \
+        hlist_for_each_entry(tb, head, node)
 
 struct inet_bind_hashbucket {
         spinlock_t              lock;
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 7d658d577368..f908dfc06505 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -178,11 +178,11 @@ static inline int inet_twsk_del_dead_node(struct inet_timewait_sock *tw)
 #define inet_twsk_for_each(tw, node, head) \
         hlist_nulls_for_each_entry(tw, node, head, tw_node)
 
-#define inet_twsk_for_each_inmate(tw, node, jail) \
-        hlist_for_each_entry(tw, node, jail, tw_death_node)
+#define inet_twsk_for_each_inmate(tw, jail) \
+        hlist_for_each_entry(tw, jail, tw_death_node)
 
-#define inet_twsk_for_each_inmate_safe(tw, node, safe, jail) \
-        hlist_for_each_entry_safe(tw, node, safe, jail, tw_death_node)
+#define inet_twsk_for_each_inmate_safe(tw, safe, jail) \
+        hlist_for_each_entry_safe(tw, safe, jail, tw_death_node)
 
 static inline struct inet_timewait_sock *inet_twsk(const struct sock *sk)
 {
diff --git a/include/net/netrom.h b/include/net/netrom.h
index f0793c1cb5f8..121dcf854db5 100644
--- a/include/net/netrom.h
+++ b/include/net/netrom.h
@@ -154,17 +154,17 @@ static __inline__ void nr_node_unlock(struct nr_node *nr_node)
         nr_node_put(nr_node);
 }
 
-#define nr_neigh_for_each(__nr_neigh, node, list) \
-        hlist_for_each_entry(__nr_neigh, node, list, neigh_node)
+#define nr_neigh_for_each(__nr_neigh, list) \
+        hlist_for_each_entry(__nr_neigh, list, neigh_node)
 
-#define nr_neigh_for_each_safe(__nr_neigh, node, node2, list) \
-        hlist_for_each_entry_safe(__nr_neigh, node, node2, list, neigh_node)
+#define nr_neigh_for_each_safe(__nr_neigh, node2, list) \
+        hlist_for_each_entry_safe(__nr_neigh, node2, list, neigh_node)
 
-#define nr_node_for_each(__nr_node, node, list) \
-        hlist_for_each_entry(__nr_node, node, list, node_node)
+#define nr_node_for_each(__nr_node, list) \
+        hlist_for_each_entry(__nr_node, list, node_node)
 
-#define nr_node_for_each_safe(__nr_node, node, node2, list) \
-        hlist_for_each_entry_safe(__nr_node, node, node2, list, node_node)
+#define nr_node_for_each_safe(__nr_node, node2, list) \
+        hlist_for_each_entry_safe(__nr_node, node2, list, node_node)
 
 
 /*********************************************************************/
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 2761c905504e..f10818fc8804 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -339,11 +339,10 @@ static inline struct Qdisc_class_common *
 qdisc_class_find(const struct Qdisc_class_hash *hash, u32 id)
 {
         struct Qdisc_class_common *cl;
-        struct hlist_node *n;
         unsigned int h;
 
         h = qdisc_class_hash(id, hash->hashmask);
-        hlist_for_each_entry(cl, n, &hash->hash[h], hnode) {
+        hlist_for_each_entry(cl, &hash->hash[h], hnode) {
                 if (cl->classid == id)
                         return cl;
         }
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 7fdf298a47ef..df85a0c0f2d5 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -675,8 +675,8 @@ static inline int sctp_vtag_hashfn(__u16 lport, __u16 rport, __u32 vtag)
         return h & (sctp_assoc_hashsize - 1);
 }
 
-#define sctp_for_each_hentry(epb, node, head) \
-        hlist_for_each_entry(epb, node, head, node)
+#define sctp_for_each_hentry(epb, head) \
+        hlist_for_each_entry(epb, head, node)
 
 /* Is a socket of this style? */
 #define sctp_style(sk, style) __sctp_style((sk), (SCTP_SOCKET_##style))
diff --git a/include/net/sock.h b/include/net/sock.h
index a66caa223d18..14f6e9d19dc7 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -606,24 +606,23 @@ static inline void sk_add_bind_node(struct sock *sk,
         hlist_add_head(&sk->sk_bind_node, list);
 }
 
-#define sk_for_each(__sk, node, list) \
-        hlist_for_each_entry(__sk, node, list, sk_node)
-#define sk_for_each_rcu(__sk, node, list) \
-        hlist_for_each_entry_rcu(__sk, node, list, sk_node)
+#define sk_for_each(__sk, list) \
+        hlist_for_each_entry(__sk, list, sk_node)
+#define sk_for_each_rcu(__sk, list) \
+        hlist_for_each_entry_rcu(__sk, list, sk_node)
 #define sk_nulls_for_each(__sk, node, list) \
         hlist_nulls_for_each_entry(__sk, node, list, sk_nulls_node)
 #define sk_nulls_for_each_rcu(__sk, node, list) \
         hlist_nulls_for_each_entry_rcu(__sk, node, list, sk_nulls_node)
-#define sk_for_each_from(__sk, node) \
-        if (__sk && ({ node = &(__sk)->sk_node; 1; })) \
-                hlist_for_each_entry_from(__sk, node, sk_node)
+#define sk_for_each_from(__sk) \
+        hlist_for_each_entry_from(__sk, sk_node)
 #define sk_nulls_for_each_from(__sk, node) \
         if (__sk && ({ node = &(__sk)->sk_nulls_node; 1; })) \
                 hlist_nulls_for_each_entry_from(__sk, node, sk_nulls_node)
-#define sk_for_each_safe(__sk, node, tmp, list) \
-        hlist_for_each_entry_safe(__sk, node, tmp, list, sk_node)
-#define sk_for_each_bound(__sk, node, list) \
-        hlist_for_each_entry(__sk, node, list, sk_bind_node)
+#define sk_for_each_safe(__sk, tmp, list) \
+        hlist_for_each_entry_safe(__sk, tmp, list, sk_node)
+#define sk_for_each_bound(__sk, list) \
+        hlist_for_each_entry(__sk, list, sk_bind_node)
 
 static inline struct user_namespace *sk_user_ns(struct sock *sk)
 {
diff --git a/include/uapi/linux/ipmi.h b/include/uapi/linux/ipmi.h
index 33fbc99b3812..7b26a62e5707 100644
--- a/include/uapi/linux/ipmi.h
+++ b/include/uapi/linux/ipmi.h
@@ -59,15 +59,7 @@
  * if it becomes full and it is queried once a second to see if
  * anything is in it.  Incoming commands to the driver will get
  * delivered as commands.
- *
- * This driver provides two main interfaces: one for in-kernel
- * applications and another for userland applications.  The
- * capabilities are basically the same for both interface, although
- * the interfaces are somewhat different.  The stuff in the
- * #ifdef __KERNEL__ below is the in-kernel interface.  The userland
- * interface is defined later in the file.  */
-
-
+ */
 
 /*
  * This is an overlay for all the address types, so it's easy to
diff --git a/include/uapi/linux/msdos_fs.h b/include/uapi/linux/msdos_fs.h
index 996719f82e28..f055e58b3147 100644
--- a/include/uapi/linux/msdos_fs.h
+++ b/include/uapi/linux/msdos_fs.h
@@ -87,6 +87,8 @@
 #define IS_FSINFO(x)    (le32_to_cpu((x)->signature1) == FAT_FSINFO_SIG1 \
                          && le32_to_cpu((x)->signature2) == FAT_FSINFO_SIG2)
 
+#define FAT_STATE_DIRTY 0x01
+
 struct __fat_dirent {
         long            d_ino;
         __kernel_off_t  d_off;
@@ -120,14 +122,34 @@ struct fat_boot_sector {
         __le32  hidden;         /* hidden sectors (unused) */
         __le32  total_sect;     /* number of sectors (if sectors == 0) */
 
-        /* The following fields are only used by FAT32 */
-        __le32  fat32_length;   /* sectors/FAT */
-        __le16  flags;          /* bit 8: fat mirroring, low 4: active fat */
-        __u8    version[2];     /* major, minor filesystem version */
-        __le32  root_cluster;   /* first cluster in root directory */
-        __le16  info_sector;    /* filesystem info sector */
-        __le16  backup_boot;    /* backup boot sector */
-        __le16  reserved2[6];   /* Unused */
+        union {
+                struct {
+                        /*  Extended BPB Fields for FAT16 */
+                        __u8    drive_number;   /* Physical drive number */
+                        __u8    state;          /* undocumented, but used
+                                                   for mount state. */
+                        /* other fiealds are not added here */
+                } fat16;
+
+                struct {
+                        /* only used by FAT32 */
+                        __le32  length;         /* sectors/FAT */
+                        __le16  flags;          /* bit 8: fat mirroring,
+                                                   low 4: active fat */
+                        __u8    version[2];     /* major, minor filesystem
+                                                   version */
+                        __le32  root_cluster;   /* first cluster in
+                                                   root directory */
+                        __le16  info_sector;    /* filesystem info sector */
+                        __le16  backup_boot;    /* backup boot sector */
+                        __le16  reserved2[6];   /* Unused */
+                        /* Extended BPB Fields for FAT32 */
+                        __u8    drive_number;   /* Physical drive number */
+                        __u8    state;          /* undocumented, but used
+                                                   for mount state. */
+                        /* other fiealds are not added here */
+                } fat32;
+        };
 };
 
 struct fat_boot_fsinfo {
diff --git a/include/uapi/linux/nbd.h b/include/uapi/linux/nbd.h
index dfb514472cbc..4f52549b23ff 100644
--- a/include/uapi/linux/nbd.h
+++ b/include/uapi/linux/nbd.h
@@ -33,13 +33,14 @@ enum {
         NBD_CMD_READ = 0,
         NBD_CMD_WRITE = 1,
         NBD_CMD_DISC = 2,
-        /* there is a gap here to match userspace */
+        NBD_CMD_FLUSH = 3,
         NBD_CMD_TRIM = 4
 };
 
 /* values for flags field */
 #define NBD_FLAG_HAS_FLAGS    (1 << 0) /* nbd-server supports flags */
 #define NBD_FLAG_READ_ONLY    (1 << 1) /* device is read-only */
+#define NBD_FLAG_SEND_FLUSH   (1 << 2) /* can flush writeback cache */
 /* there is a gap here to match userspace */
 #define NBD_FLAG_SEND_TRIM    (1 << 5) /* send trim/discard */
 
diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
index 26607bd965fa..e4629b93bdd6 100644
--- a/include/uapi/linux/xattr.h
+++ b/include/uapi/linux/xattr.h
@@ -15,19 +15,22 @@
 
 /* Namespaces */
 #define XATTR_OS2_PREFIX "os2."
-#define XATTR_OS2_PREFIX_LEN (sizeof (XATTR_OS2_PREFIX) - 1)
+#define XATTR_OS2_PREFIX_LEN (sizeof(XATTR_OS2_PREFIX) - 1)
+
+#define XATTR_MAC_OSX_PREFIX "osx."
+#define XATTR_MAC_OSX_PREFIX_LEN (sizeof(XATTR_MAC_OSX_PREFIX) - 1)
 
 #define XATTR_SECURITY_PREFIX   "security."
-#define XATTR_SECURITY_PREFIX_LEN (sizeof (XATTR_SECURITY_PREFIX) - 1)
+#define XATTR_SECURITY_PREFIX_LEN (sizeof(XATTR_SECURITY_PREFIX) - 1)
 
 #define XATTR_SYSTEM_PREFIX "system."
-#define XATTR_SYSTEM_PREFIX_LEN (sizeof (XATTR_SYSTEM_PREFIX) - 1)
+#define XATTR_SYSTEM_PREFIX_LEN (sizeof(XATTR_SYSTEM_PREFIX) - 1)
 
 #define XATTR_TRUSTED_PREFIX "trusted."
-#define XATTR_TRUSTED_PREFIX_LEN (sizeof (XATTR_TRUSTED_PREFIX) - 1)
+#define XATTR_TRUSTED_PREFIX_LEN (sizeof(XATTR_TRUSTED_PREFIX) - 1)
 
 #define XATTR_USER_PREFIX "user."
-#define XATTR_USER_PREFIX_LEN (sizeof (XATTR_USER_PREFIX) - 1)
+#define XATTR_USER_PREFIX_LEN (sizeof(XATTR_USER_PREFIX) - 1)
 
 /* Security namespace */
 #define XATTR_EVM_SUFFIX "evm"
diff --git a/ipc/util.c b/ipc/util.c
index 74e1d9c7a98a..464a8abd779f 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -252,7 +252,7 @@ int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size)
 {
         kuid_t euid;
         kgid_t egid;
-        int id, err;
+        int id;
         int next_id = ids->next_id;
 
         if (size > IPCMNI)
@@ -261,17 +261,21 @@ int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size)
         if (ids->in_use >= size)
                 return -ENOSPC;
 
+        idr_preload(GFP_KERNEL);
+
         spin_lock_init(&new->lock);
         new->deleted = 0;
         rcu_read_lock();
         spin_lock(&new->lock);
 
-        err = idr_get_new_above(&ids->ipcs_idr, new,
-                                (next_id < 0) ? 0 : ipcid_to_idx(next_id), &id);
-        if (err) {
+        id = idr_alloc(&ids->ipcs_idr, new,
+                       (next_id < 0) ? 0 : ipcid_to_idx(next_id), 0,
+                       GFP_NOWAIT);
+        idr_preload_end();
+        if (id < 0) {
                 spin_unlock(&new->lock);
                 rcu_read_unlock();
-                return err;
+                return id;
         }
 
         ids->in_use++;
@@ -307,19 +311,10 @@ static int ipcget_new(struct ipc_namespace *ns, struct ipc_ids *ids,
                 struct ipc_ops *ops, struct ipc_params *params)
 {
         int err;
-retry:
-        err = idr_pre_get(&ids->ipcs_idr, GFP_KERNEL);
-
-        if (!err)
-                return -ENOMEM;
 
         down_write(&ids->rw_mutex);
         err = ops->getnew(ns, params);
         up_write(&ids->rw_mutex);
-
-        if (err == -EAGAIN)
-                goto retry;
-
         return err;
 }
 
@@ -376,8 +371,6 @@ static int ipcget_public(struct ipc_namespace *ns, struct ipc_ids *ids,
         struct kern_ipc_perm *ipcp;
         int flg = params->flg;
         int err;
-retry:
-        err = idr_pre_get(&ids->ipcs_idr, GFP_KERNEL);
 
         /*
          * Take the lock as a writer since we are potentially going to add
@@ -389,8 +382,6 @@ retry:
                 /* key not used */
                 if (!(flg & IPC_CREAT))
                         err = -ENOENT;
-                else if (!err)
-                        err = -ENOMEM;
                 else
                         err = ops->getnew(ns, params);
         } else {
@@ -413,9 +404,6 @@ retry:
         }
         up_write(&ids->rw_mutex);
 
-        if (err == -EAGAIN)
-                goto retry;
-
         return err;
 }
 
diff --git a/kernel/Makefile b/kernel/Makefile
index 05949c0510c5..bbde5f1a4486 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -7,7 +7,7 @@ obj-y     = fork.o exec_domain.o panic.o printk.o \
             sysctl.o sysctl_binary.o capability.o ptrace.o timer.o user.o \
             signal.o sys.o kmod.o workqueue.o pid.o task_work.o \
             rcupdate.o extable.o params.o posix-timers.o \
-            kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
+            kthread.o wait.o sys_ni.o posix-cpu-timers.o mutex.o \
             hrtimer.o rwsem.o nsproxy.o srcu.o semaphore.o \
             notifier.o ksysfs.o cred.o \
             async.o range.o groups.o lglock.o smpboot.o
@@ -25,9 +25,7 @@ endif
 obj-y += sched/
 obj-y += power/
 
-ifeq ($(CONFIG_CHECKPOINT_RESTORE),y)
-obj-$(CONFIG_X86) += kcmp.o
-endif
+obj-$(CONFIG_CHECKPOINT_RESTORE) += kcmp.o
 obj-$(CONFIG_FREEZER) += freezer.o
 obj-$(CONFIG_PROFILING) += profile.o
 obj-$(CONFIG_STACKTRACE) += stacktrace.o
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index fb2fb11fbb25..a32f9432666c 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -554,7 +554,6 @@ static struct css_set *find_existing_css_set(
 {
         int i;
         struct cgroupfs_root *root = cgrp->root;
-        struct hlist_node *node;
         struct css_set *cg;
         unsigned long key;
 
@@ -577,7 +576,7 @@ static struct css_set *find_existing_css_set(
         }
 
         key = css_set_hash(template);
-        hash_for_each_possible(css_set_table, cg, node, hlist, key) {
+        hash_for_each_possible(css_set_table, cg, hlist, key) {
                 if (!compare_css_sets(cg, oldcg, cgrp, template))
                         continue;
 
@@ -1611,7 +1610,6 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                 struct cgroupfs_root *existing_root;
                 const struct cred *cred;
                 int i;
-                struct hlist_node *node;
                 struct css_set *cg;
 
                 BUG_ON(sb->s_root != NULL);
@@ -1666,7 +1664,7 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                 /* Link the top cgroup in this hierarchy into all
                  * the css_set objects */
                 write_lock(&css_set_lock);
-                hash_for_each(css_set_table, i, node, cg, hlist)
+                hash_for_each(css_set_table, i, cg, hlist)
                         link_css_set(&tmp_cg_links, cg, root_cgrp);
                 write_unlock(&css_set_lock);
 
@@ -4493,7 +4491,7 @@ int __init_or_module cgroup_load_subsys(struct cgroup_subsys *ss)
 {
         struct cgroup_subsys_state *css;
         int i, ret;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         struct css_set *cg;
         unsigned long key;
 
@@ -4561,7 +4559,7 @@ int __init_or_module cgroup_load_subsys(struct cgroup_subsys *ss)
          * this is all done under the css_set_lock.
          */
         write_lock(&css_set_lock);
-        hash_for_each_safe(css_set_table, i, node, tmp, cg, hlist) {
+        hash_for_each_safe(css_set_table, i, tmp, cg, hlist) {
                 /* skip entries that we already rehashed */
                 if (cg->subsys[ss->subsys_id])
                         continue;
@@ -4571,7 +4569,7 @@ int __init_or_module cgroup_load_subsys(struct cgroup_subsys *ss)
                 cg->subsys[ss->subsys_id] = css;
                 /* recompute hash and restore entry */
                 key = css_set_hash(cg->subsys);
-                hash_add(css_set_table, node, key);
+                hash_add(css_set_table, &cg->hlist, key);
         }
         write_unlock(&css_set_lock);
 
@@ -4618,10 +4616,8 @@ void cgroup_unload_subsys(struct cgroup_subsys *ss)
         offline_css(ss, dummytop);
         ss->active = 0;
 
-        if (ss->use_id) {
-                idr_remove_all(&ss->idr);
+        if (ss->use_id)
                 idr_destroy(&ss->idr);
-        }
 
         /* deassign the subsys_id */
         subsys[ss->subsys_id] = NULL;
@@ -5322,7 +5318,7 @@ EXPORT_SYMBOL_GPL(free_css_id);
 static struct css_id *get_new_cssid(struct cgroup_subsys *ss, int depth)
 {
         struct css_id *newid;
-        int myid, error, size;
+        int ret, size;
 
         BUG_ON(!ss->use_id);
 
@@ -5330,35 +5326,24 @@ static struct css_id *get_new_cssid(struct cgroup_subsys *ss, int depth)
         newid = kzalloc(size, GFP_KERNEL);
         if (!newid)
                 return ERR_PTR(-ENOMEM);
-        /* get id */
-        if (unlikely(!idr_pre_get(&ss->idr, GFP_KERNEL))) {
-                error = -ENOMEM;
-                goto err_out;
-        }
+
+        idr_preload(GFP_KERNEL);
         spin_lock(&ss->id_lock);
         /* Don't use 0. allocates an ID of 1-65535 */
-        error = idr_get_new_above(&ss->idr, newid, 1, &myid);
+        ret = idr_alloc(&ss->idr, newid, 1, CSS_ID_MAX + 1, GFP_NOWAIT);
         spin_unlock(&ss->id_lock);
+        idr_preload_end();
 
         /* Returns error when there are no free spaces for new ID.*/
-        if (error) {
-                error = -ENOSPC;
+        if (ret < 0)
                 goto err_out;
-        }
-        if (myid > CSS_ID_MAX)
-                goto remove_idr;
 
-        newid->id = myid;
+        newid->id = ret;
         newid->depth = depth;
         return newid;
-remove_idr:
-        error = -ENOSPC;
-        spin_lock(&ss->id_lock);
-        idr_remove(&ss->idr, myid);
-        spin_unlock(&ss->id_lock);
 err_out:
         kfree(newid);
-        return ERR_PTR(error);
+        return ERR_PTR(ret);
 
 }
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index ccc457e36354..b0cd86501c30 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5126,7 +5126,6 @@ static void do_perf_sw_event(enum perf_type_id type, u32 event_id,
 {
         struct swevent_htable *swhash = &__get_cpu_var(swevent_htable);
         struct perf_event *event;
-        struct hlist_node *node;
         struct hlist_head *head;
 
         rcu_read_lock();
@@ -5134,7 +5133,7 @@ static void do_perf_sw_event(enum perf_type_id type, u32 event_id,
         if (!head)
                 goto end;
 
-        hlist_for_each_entry_rcu(event, node, head, hlist_entry) {
+        hlist_for_each_entry_rcu(event, head, hlist_entry) {
                 if (perf_swevent_match(event, type, event_id, data, regs))
                         perf_swevent_event(event, nr, data, regs);
         }
@@ -5419,7 +5418,6 @@ void perf_tp_event(u64 addr, u64 count, void *record, int entry_size,
 {
         struct perf_sample_data data;
         struct perf_event *event;
-        struct hlist_node *node;
 
         struct perf_raw_record raw = {
                 .size = entry_size,
@@ -5429,7 +5427,7 @@ void perf_tp_event(u64 addr, u64 count, void *record, int entry_size,
         perf_sample_data_init(&data, addr, 0);
         data.raw = &raw;
 
-        hlist_for_each_entry_rcu(event, node, head, hlist_entry) {
+        hlist_for_each_entry_rcu(event, head, hlist_entry) {
                 if (perf_tp_event_match(event, &data, regs))
                         perf_swevent_event(event, count, &data, regs);
         }
@@ -5965,13 +5963,9 @@ int perf_pmu_register(struct pmu *pmu, char *name, int type)
         pmu->name = name;
 
         if (type < 0) {
-                int err = idr_pre_get(&pmu_idr, GFP_KERNEL);
-                if (!err)
-                        goto free_pdc;
-
-                err = idr_get_new_above(&pmu_idr, pmu, PERF_TYPE_MAX, &type);
-                if (err) {
-                        ret = err;
+                type = idr_alloc(&pmu_idr, pmu, PERF_TYPE_MAX, 0, GFP_KERNEL);
+                if (type < 0) {
+                        ret = type;
                         goto free_pdc;
                 }
         }
diff --git a/kernel/exit.c b/kernel/exit.c
index 7dd20408707c..51e485ca9935 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -20,6 +20,7 @@
 #include <linux/tsacct_kern.h>
 #include <linux/file.h>
 #include <linux/fdtable.h>
+#include <linux/freezer.h>
 #include <linux/binfmts.h>
 #include <linux/nsproxy.h>
 #include <linux/pid_namespace.h>
@@ -31,7 +32,6 @@
 #include <linux/mempolicy.h>
 #include <linux/taskstats_kern.h>
 #include <linux/delayacct.h>
-#include <linux/freezer.h>
 #include <linux/cgroup.h>
 #include <linux/syscalls.h>
 #include <linux/signal.h>
@@ -485,7 +485,7 @@ static void exit_mm(struct task_struct * tsk)
                         set_task_state(tsk, TASK_UNINTERRUPTIBLE);
                         if (!self.task) /* see coredump_finish() */
                                 break;
-                        schedule();
+                        freezable_schedule();
                 }
                 __set_task_state(tsk, TASK_RUNNING);
                 down_read(&mm->mmap_sem);
@@ -835,7 +835,7 @@ void do_exit(long code)
         /*
          * Make sure we are holding no locks:
          */
-        debug_check_no_locks_held(tsk);
+        debug_check_no_locks_held();
         /*
          * We can do this unlocked here. The futex code uses this flag
          * just to verify whether the pi state cleanup has been done
diff --git a/kernel/fork.c b/kernel/fork.c
index 8f62b2a0f120..8d932b1c9056 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1861,10 +1861,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
                         exit_sem(current);
                 }
 
-                if (new_nsproxy) {
+                if (new_nsproxy)
                         switch_task_namespaces(current, new_nsproxy);
-                        new_nsproxy = NULL;
-                }
 
                 task_lock(current);
 
@@ -1894,9 +1892,6 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
                 }
         }
 
-        if (new_nsproxy)
-                put_nsproxy(new_nsproxy);
-
 bad_unshare_cleanup_cred:
         if (new_cred)
                 put_cred(new_cred);
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 2436ffcec91f..bddd3d7a74b6 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -229,6 +229,8 @@ out:
 
 }
 
+static void kimage_free_page_list(struct list_head *list);
+
 static int kimage_normal_alloc(struct kimage **rimage, unsigned long entry,
                                 unsigned long nr_segments,
                                 struct kexec_segment __user *segments)
@@ -242,8 +244,6 @@ static int kimage_normal_alloc(struct kimage **rimage, unsigned long entry,
         if (result)
                 goto out;
 
-        *rimage = image;
-
         /*
          * Find a location for the control code buffer, and add it
          * the vector of segments so that it's pages will also be
@@ -254,22 +254,22 @@ static int kimage_normal_alloc(struct kimage **rimage, unsigned long entry,
                                            get_order(KEXEC_CONTROL_PAGE_SIZE));
         if (!image->control_code_page) {
                 printk(KERN_ERR "Could not allocate control_code_buffer\n");
-                goto out;
+                goto out_free;
         }
 
         image->swap_page = kimage_alloc_control_pages(image, 0);
         if (!image->swap_page) {
                 printk(KERN_ERR "Could not allocate swap buffer\n");
-                goto out;
+                goto out_free;
         }
 
-        result = 0;
- out:
-        if (result == 0)
-                *rimage = image;
-        else
-                kfree(image);
+        *rimage = image;
+        return 0;
 
+out_free:
+        kimage_free_page_list(&image->control_pages);
+        kfree(image);
+out:
         return result;
 }
 
@@ -316,7 +316,7 @@ static int kimage_crash_alloc(struct kimage **rimage, unsigned long entry,
                 mend = mstart + image->segment[i].memsz - 1;
                 /* Ensure we are within the crash kernel limits */
                 if ((mstart < crashk_res.start) || (mend > crashk_res.end))
-                        goto out;
+                        goto out_free;
         }
 
         /*
@@ -329,16 +329,15 @@ static int kimage_crash_alloc(struct kimage **rimage, unsigned long entry,
                                            get_order(KEXEC_CONTROL_PAGE_SIZE));
         if (!image->control_code_page) {
                 printk(KERN_ERR "Could not allocate control_code_buffer\n");
-                goto out;
+                goto out_free;
         }
 
-        result = 0;
-out:
-        if (result == 0)
-                *rimage = image;
-        else
-                kfree(image);
+        *rimage = image;
+        return 0;
 
+out_free:
+        kfree(image);
+out:
         return result;
 }
 
@@ -503,8 +502,6 @@ static struct page *kimage_alloc_crash_control_pages(struct kimage *image,
 
                 if (hole_end > KEXEC_CRASH_CONTROL_MEMORY_LIMIT)
                         break;
-                if (hole_end > crashk_res.end)
-                        break;
                 /* See if I overlap any of the segments */
                 for (i = 0; i < image->nr_segments; i++) {
                         unsigned long mstart, mend;
@@ -1514,6 +1511,8 @@ static int __init crash_save_vmcoreinfo_init(void)
         VMCOREINFO_OFFSET(page, _count);
         VMCOREINFO_OFFSET(page, mapping);
         VMCOREINFO_OFFSET(page, lru);
+        VMCOREINFO_OFFSET(page, _mapcount);
+        VMCOREINFO_OFFSET(page, private);
         VMCOREINFO_OFFSET(pglist_data, node_zones);
         VMCOREINFO_OFFSET(pglist_data, nr_zones);
 #ifdef CONFIG_FLAT_NODE_MEM_MAP
@@ -1536,6 +1535,11 @@ static int __init crash_save_vmcoreinfo_init(void)
         VMCOREINFO_NUMBER(PG_lru);
         VMCOREINFO_NUMBER(PG_private);
         VMCOREINFO_NUMBER(PG_swapcache);
+        VMCOREINFO_NUMBER(PG_slab);
+#ifdef CONFIG_MEMORY_FAILURE
+        VMCOREINFO_NUMBER(PG_hwpoison);
+#endif
+        VMCOREINFO_NUMBER(PAGE_BUDDY_MAPCOUNT_VALUE);
 
         arch_crash_save_vmcoreinfo();
         update_vmcoreinfo_note();
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 550294d58a02..e35be53f6613 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -334,11 +334,10 @@ static inline void reset_kprobe_instance(void)
 struct kprobe __kprobes *get_kprobe(void *addr)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct kprobe *p;
 
         head = &kprobe_table[hash_ptr(addr, KPROBE_HASH_BITS)];
-        hlist_for_each_entry_rcu(p, node, head, hlist) {
+        hlist_for_each_entry_rcu(p, head, hlist) {
                 if (p->addr == addr)
                         return p;
         }
@@ -799,7 +798,6 @@ out:
 static void __kprobes optimize_all_kprobes(void)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct kprobe *p;
         unsigned int i;
 
@@ -810,7 +808,7 @@ static void __kprobes optimize_all_kprobes(void)
         kprobes_allow_optimization = true;
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
-                hlist_for_each_entry_rcu(p, node, head, hlist)
+                hlist_for_each_entry_rcu(p, head, hlist)
                         if (!kprobe_disabled(p))
                                 optimize_kprobe(p);
         }
@@ -821,7 +819,6 @@ static void __kprobes optimize_all_kprobes(void)
 static void __kprobes unoptimize_all_kprobes(void)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct kprobe *p;
         unsigned int i;
 
@@ -832,7 +829,7 @@ static void __kprobes unoptimize_all_kprobes(void)
         kprobes_allow_optimization = false;
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
-                hlist_for_each_entry_rcu(p, node, head, hlist) {
+                hlist_for_each_entry_rcu(p, head, hlist) {
                         if (!kprobe_disabled(p))
                                 unoptimize_kprobe(p, false);
                 }
@@ -1148,7 +1145,7 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
 {
         struct kretprobe_instance *ri;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long hash, flags = 0;
 
         if (unlikely(!kprobes_initialized))
@@ -1159,12 +1156,12 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
         hash = hash_ptr(tk, KPROBE_HASH_BITS);
         head = &kretprobe_inst_table[hash];
         kretprobe_table_lock(hash, &flags);
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task == tk)
                         recycle_rp_inst(ri, &empty_rp);
         }
         kretprobe_table_unlock(hash, &flags);
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
@@ -1173,9 +1170,9 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
 static inline void free_rp_inst(struct kretprobe *rp)
 {
         struct kretprobe_instance *ri;
-        struct hlist_node *pos, *next;
+        struct hlist_node *next;
 
-        hlist_for_each_entry_safe(ri, pos, next, &rp->free_instances, hlist) {
+        hlist_for_each_entry_safe(ri, next, &rp->free_instances, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
@@ -1185,14 +1182,14 @@ static void __kprobes cleanup_rp_inst(struct kretprobe *rp)
 {
         unsigned long flags, hash;
         struct kretprobe_instance *ri;
-        struct hlist_node *pos, *next;
+        struct hlist_node *next;
         struct hlist_head *head;
 
         /* No race here */
         for (hash = 0; hash < KPROBE_TABLE_SIZE; hash++) {
                 kretprobe_table_lock(hash, &flags);
                 head = &kretprobe_inst_table[hash];
-                hlist_for_each_entry_safe(ri, pos, next, head, hlist) {
+                hlist_for_each_entry_safe(ri, next, head, hlist) {
                         if (ri->rp == rp)
                                 ri->rp = NULL;
                 }
@@ -2028,7 +2025,6 @@ static int __kprobes kprobes_module_callback(struct notifier_block *nb,
 {
         struct module *mod = data;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct kprobe *p;
         unsigned int i;
         int checkcore = (val == MODULE_STATE_GOING);
@@ -2045,7 +2041,7 @@ static int __kprobes kprobes_module_callback(struct notifier_block *nb,
         mutex_lock(&kprobe_mutex);
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
-                hlist_for_each_entry_rcu(p, node, head, hlist)
+                hlist_for_each_entry_rcu(p, head, hlist)
                         if (within_module_init((unsigned long)p->addr, mod) ||
                             (checkcore &&
                              within_module_core((unsigned long)p->addr, mod))) {
@@ -2192,7 +2188,6 @@ static void __kprobes kprobe_seq_stop(struct seq_file *f, void *v)
 static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct kprobe *p, *kp;
         const char *sym = NULL;
         unsigned int i = *(loff_t *) v;
@@ -2201,7 +2196,7 @@ static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
 
         head = &kprobe_table[i];
         preempt_disable();
-        hlist_for_each_entry_rcu(p, node, head, hlist) {
+        hlist_for_each_entry_rcu(p, head, hlist) {
                 sym = kallsyms_lookup((unsigned long)p->addr, NULL,
                                         &offset, &modname, namebuf);
                 if (kprobe_aggrprobe(p)) {
@@ -2236,7 +2231,6 @@ static const struct file_operations debugfs_kprobes_operations = {
 static void __kprobes arm_all_kprobes(void)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct kprobe *p;
         unsigned int i;
 
@@ -2249,7 +2243,7 @@ static void __kprobes arm_all_kprobes(void)
         /* Arming kprobes doesn't optimize kprobe itself */
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
-                hlist_for_each_entry_rcu(p, node, head, hlist)
+                hlist_for_each_entry_rcu(p, head, hlist)
                         if (!kprobe_disabled(p))
                                 arm_kprobe(p);
         }
@@ -2265,7 +2259,6 @@ already_enabled:
 static void __kprobes disarm_all_kprobes(void)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct kprobe *p;
         unsigned int i;
 
@@ -2282,7 +2275,7 @@ static void __kprobes disarm_all_kprobes(void)
 
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
-                hlist_for_each_entry_rcu(p, node, head, hlist) {
+                hlist_for_each_entry_rcu(p, head, hlist) {
                         if (!arch_trampoline_kprobe(p) && !kprobe_disabled(p))
                                 disarm_kprobe(p, false);
                 }
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 8a0efac4f99d..259db207b5d9 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -4088,7 +4088,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len)
 }
 EXPORT_SYMBOL_GPL(debug_check_no_locks_freed);
 
-static void print_held_locks_bug(struct task_struct *curr)
+static void print_held_locks_bug(void)
 {
         if (!debug_locks_off())
                 return;
@@ -4097,22 +4097,21 @@ static void print_held_locks_bug(struct task_struct *curr)
 
         printk("\n");
         printk("=====================================\n");
-        printk("[ BUG: lock held at task exit time! ]\n");
+        printk("[ BUG: %s/%d still has locks held! ]\n",
+               current->comm, task_pid_nr(current));
         print_kernel_ident();
         printk("-------------------------------------\n");
-        printk("%s/%d is exiting with locks still held!\n",
-                curr->comm, task_pid_nr(curr));
-        lockdep_print_held_locks(curr);
-
+        lockdep_print_held_locks(current);
         printk("\nstack backtrace:\n");
         dump_stack();
 }
 
-void debug_check_no_locks_held(struct task_struct *task)
+void debug_check_no_locks_held(void)
 {
-        if (unlikely(task->lockdep_depth > 0))
-                print_held_locks_bug(task);
+        if (unlikely(current->lockdep_depth > 0))
+                print_held_locks_bug();
 }
+EXPORT_SYMBOL_GPL(debug_check_no_locks_held);
 
 void debug_show_all_locks(void)
 {
diff --git a/kernel/pid.c b/kernel/pid.c
index f2c6a6825098..047dc6264638 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -350,10 +350,9 @@ void disable_pid_allocation(struct pid_namespace *ns)
 
 struct pid *find_pid_ns(int nr, struct pid_namespace *ns)
 {
-        struct hlist_node *elem;
         struct upid *pnr;
 
-        hlist_for_each_entry_rcu(pnr, elem,
+        hlist_for_each_entry_rcu(pnr,
                         &pid_hash[pid_hashfn(nr, ns)], pid_chain)
                 if (pnr->nr == nr && pnr->ns == ns)
                         return container_of(pnr, struct pid,
diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 7edfe4b901e7..6edbb2c55c22 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -552,24 +552,22 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
                 return -EAGAIN;
 
         spin_lock_init(&new_timer->it_lock);
- retry:
-        if (unlikely(!idr_pre_get(&posix_timers_id, GFP_KERNEL))) {
-                error = -EAGAIN;
-                goto out;
-        }
+
+        idr_preload(GFP_KERNEL);
         spin_lock_irq(&idr_lock);
-        error = idr_get_new(&posix_timers_id, new_timer, &new_timer_id);
+        error = idr_alloc(&posix_timers_id, new_timer, 0, 0, GFP_NOWAIT);
         spin_unlock_irq(&idr_lock);
-        if (error) {
-                if (error == -EAGAIN)
-                        goto retry;
+        idr_preload_end();
+        if (error < 0) {
                 /*
                  * Weird looking, but we return EAGAIN if the IDR is
                  * full (proper POSIX return value for this)
                  */
-                error = -EAGAIN;
+                if (error == -ENOSPC)
+                        error = -EAGAIN;
                 goto out;
         }
+        new_timer_id = error;
 
         it_id_set = IT_ID_SET;
         new_timer->it_id = (timer_t) new_timer_id;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 2b5243176aba..12af4270c9c1 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1752,9 +1752,8 @@ EXPORT_SYMBOL_GPL(preempt_notifier_unregister);
 static void fire_sched_in_preempt_notifiers(struct task_struct *curr)
 {
         struct preempt_notifier *notifier;
-        struct hlist_node *node;
 
-        hlist_for_each_entry(notifier, node, &curr->preempt_notifiers, link)
+        hlist_for_each_entry(notifier, &curr->preempt_notifiers, link)
                 notifier->ops->sched_in(notifier, raw_smp_processor_id());
 }
 
@@ -1763,9 +1762,8 @@ fire_sched_out_preempt_notifiers(struct task_struct *curr,
                                  struct task_struct *next)
 {
         struct preempt_notifier *notifier;
-        struct hlist_node *node;
 
-        hlist_for_each_entry(notifier, node, &curr->preempt_notifiers, link)
+        hlist_for_each_entry(notifier, &curr->preempt_notifiers, link)
                 notifier->ops->sched_out(notifier, next);
 }
 
diff --git a/kernel/signal.c b/kernel/signal.c
index 2a7ae2963185..2676aac4103d 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1157,11 +1157,11 @@ static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
 static void print_fatal_signal(int signr)
 {
         struct pt_regs *regs = signal_pt_regs();
-        printk("%s/%d: potentially unexpected fatal signal %d.\n",
+        printk(KERN_INFO "%s/%d: potentially unexpected fatal signal %d.\n",
                 current->comm, task_pid_nr(current), signr);
 
 #if defined(__i386__) && !defined(__arch_um__)
-        printk("code at %08lx: ", regs->ip);
+        printk(KERN_INFO "code at %08lx: ", regs->ip);
         {
                 int i;
                 for (i = 0; i < 16; i++) {
@@ -1169,11 +1169,11 @@ static void print_fatal_signal(int signr)
 
                         if (get_user(insn, (unsigned char *)(regs->ip + i)))
                                 break;
-                        printk("%02x ", insn);
+                        printk(KERN_CONT "%02x ", insn);
                 }
         }
+        printk(KERN_CONT "\n");
 #endif
-        printk("\n");
         preempt_disable();
         show_regs(regs);
         preempt_enable();
@@ -2996,7 +2996,8 @@ static int do_rt_sigqueueinfo(pid_t pid, int sig, siginfo_t *info)
         /* Not even root can pretend to send signals from the kernel.
          * Nor can they impersonate a kill()/tgkill(), which adds source info.
          */
-        if (info->si_code >= 0 || info->si_code == SI_TKILL) {
+        if ((info->si_code >= 0 || info->si_code == SI_TKILL) &&
+            (task_pid_vnr(current) != pid)) {
                 /* We used to allow any < 0 si_code */
                 WARN_ON_ONCE(info->si_code < 0);
                 return -EPERM;
@@ -3045,7 +3046,8 @@ static int do_rt_tgsigqueueinfo(pid_t tgid, pid_t pid, int sig, siginfo_t *info)
         /* Not even root can pretend to send signals from the kernel.
          * Nor can they impersonate a kill()/tgkill(), which adds source info.
          */
-        if (info->si_code >= 0 || info->si_code == SI_TKILL) {
+        if (((info->si_code >= 0 || info->si_code == SI_TKILL)) &&
+            (task_pid_vnr(current) != pid)) {
                 /* We used to allow any < 0 si_code */
                 WARN_ON_ONCE(info->si_code < 0);
                 return -EPERM;
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index d4abac261779..b9bde5727829 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -131,7 +131,7 @@ static int smpboot_thread_fn(void *data)
                         continue;
                 }
 
-                BUG_ON(td->cpu != smp_processor_id());
+                //BUG_ON(td->cpu != smp_processor_id());
 
                 /* Check for state change setup */
                 switch (td->status) {
diff --git a/kernel/sys.c b/kernel/sys.c
index e10566bee399..81f56445fba9 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -2185,11 +2185,6 @@ SYSCALL_DEFINE3(getcpu, unsigned __user *, cpup, unsigned __user *, nodep,
 
 char poweroff_cmd[POWEROFF_CMD_PATH_LEN] = "/sbin/poweroff";
 
-static void argv_cleanup(struct subprocess_info *info)
-{
-        argv_free(info->argv);
-}
-
 static int __orderly_poweroff(void)
 {
         int argc;
@@ -2209,9 +2204,8 @@ static int __orderly_poweroff(void)
         }
 
         ret = call_usermodehelper_fns(argv[0], argv, envp, UMH_WAIT_EXEC,
-                                      NULL, argv_cleanup, NULL);
-        if (ret == -ENOMEM)
-                argv_free(argv);
+                                      NULL, NULL, NULL);
+        argv_free(argv);
 
         return ret;
 }
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index d8df00e69c14..d1b4ee67d2df 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2095,7 +2095,7 @@ int proc_dointvec_minmax(struct ctl_table *table, int write,
 static void validate_coredump_safety(void)
 {
 #ifdef CONFIG_COREDUMP
-        if (suid_dumpable == SUID_DUMPABLE_SAFE &&
+        if (suid_dumpable == SUID_DUMP_ROOT &&
             core_pattern[0] != '/' && core_pattern[0] != '|') {
                 printk(KERN_WARNING "Unsafe core_pattern used with "\
                         "suid_dumpable=2. Pipe handler or fully qualified "\
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index b25115e8c7f3..ebf72358e86a 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -1171,9 +1171,10 @@ static ssize_t bin_dn_node_address(struct file *file,
 
                 /* Convert the decnet address to binary */
                 result = -EIO;
-                nodep = strchr(buf, '.') + 1;
+                nodep = strchr(buf, '.');
                 if (!nodep)
                         goto out;
+                ++nodep;
 
                 area = simple_strtoul(buf, NULL, 10);
                 node = simple_strtoul(nodep, NULL, 10);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 98ca94a41819..ab25b88aae56 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -762,7 +762,6 @@ ftrace_find_profiled_func(struct ftrace_profile_stat *stat, unsigned long ip)
 {
         struct ftrace_profile *rec;
         struct hlist_head *hhd;
-        struct hlist_node *n;
         unsigned long key;
 
         key = hash_long(ip, ftrace_profile_bits);
@@ -771,7 +770,7 @@ ftrace_find_profiled_func(struct ftrace_profile_stat *stat, unsigned long ip)
         if (hlist_empty(hhd))
                 return NULL;
 
-        hlist_for_each_entry_rcu(rec, n, hhd, node) {
+        hlist_for_each_entry_rcu(rec, hhd, node) {
                 if (rec->ip == ip)
                         return rec;
         }
@@ -1133,7 +1132,6 @@ ftrace_lookup_ip(struct ftrace_hash *hash, unsigned long ip)
         unsigned long key;
         struct ftrace_func_entry *entry;
         struct hlist_head *hhd;
-        struct hlist_node *n;
 
         if (ftrace_hash_empty(hash))
                 return NULL;
@@ -1145,7 +1143,7 @@ ftrace_lookup_ip(struct ftrace_hash *hash, unsigned long ip)
 
         hhd = &hash->buckets[key];
 
-        hlist_for_each_entry_rcu(entry, n, hhd, hlist) {
+        hlist_for_each_entry_rcu(entry, hhd, hlist) {
                 if (entry->ip == ip)
                         return entry;
         }
@@ -1202,7 +1200,7 @@ remove_hash_entry(struct ftrace_hash *hash,
 static void ftrace_hash_clear(struct ftrace_hash *hash)
 {
         struct hlist_head *hhd;
-        struct hlist_node *tp, *tn;
+        struct hlist_node *tn;
         struct ftrace_func_entry *entry;
         int size = 1 << hash->size_bits;
         int i;
@@ -1212,7 +1210,7 @@ static void ftrace_hash_clear(struct ftrace_hash *hash)
 
         for (i = 0; i < size; i++) {
                 hhd = &hash->buckets[i];
-                hlist_for_each_entry_safe(entry, tp, tn, hhd, hlist)
+                hlist_for_each_entry_safe(entry, tn, hhd, hlist)
                         free_hash_entry(hash, entry);
         }
         FTRACE_WARN_ON(hash->count);
@@ -1275,7 +1273,6 @@ alloc_and_copy_ftrace_hash(int size_bits, struct ftrace_hash *hash)
 {
         struct ftrace_func_entry *entry;
         struct ftrace_hash *new_hash;
-        struct hlist_node *tp;
         int size;
         int ret;
         int i;
@@ -1290,7 +1287,7 @@ alloc_and_copy_ftrace_hash(int size_bits, struct ftrace_hash *hash)
 
         size = 1 << hash->size_bits;
         for (i = 0; i < size; i++) {
-                hlist_for_each_entry(entry, tp, &hash->buckets[i], hlist) {
+                hlist_for_each_entry(entry, &hash->buckets[i], hlist) {
                         ret = add_hash_entry(new_hash, entry->ip);
                         if (ret < 0)
                                 goto free_hash;
@@ -1316,7 +1313,7 @@ ftrace_hash_move(struct ftrace_ops *ops, int enable,
                  struct ftrace_hash **dst, struct ftrace_hash *src)
 {
         struct ftrace_func_entry *entry;
-        struct hlist_node *tp, *tn;
+        struct hlist_node *tn;
         struct hlist_head *hhd;
         struct ftrace_hash *old_hash;
         struct ftrace_hash *new_hash;
@@ -1362,7 +1359,7 @@ ftrace_hash_move(struct ftrace_ops *ops, int enable,
         size = 1 << src->size_bits;
         for (i = 0; i < size; i++) {
                 hhd = &src->buckets[i];
-                hlist_for_each_entry_safe(entry, tp, tn, hhd, hlist) {
+                hlist_for_each_entry_safe(entry, tn, hhd, hlist) {
                         if (bits > 0)
                                 key = hash_long(entry->ip, bits);
                         else
@@ -2901,7 +2898,6 @@ static void function_trace_probe_call(unsigned long ip, unsigned long parent_ip,
 {
         struct ftrace_func_probe *entry;
         struct hlist_head *hhd;
-        struct hlist_node *n;
         unsigned long key;
 
         key = hash_long(ip, FTRACE_HASH_BITS);
@@ -2917,7 +2913,7 @@ static void function_trace_probe_call(unsigned long ip, unsigned long parent_ip,
          * on the hash. rcu_read_lock is too dangerous here.
          */
         preempt_disable_notrace();
-        hlist_for_each_entry_rcu(entry, n, hhd, node) {
+        hlist_for_each_entry_rcu(entry, hhd, node) {
                 if (entry->ip == ip)
                         entry->ops->func(ip, parent_ip, &entry->data);
         }
@@ -3068,7 +3064,7 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
                                   void *data, int flags)
 {
         struct ftrace_func_probe *entry;
-        struct hlist_node *n, *tmp;
+        struct hlist_node *tmp;
         char str[KSYM_SYMBOL_LEN];
         int type = MATCH_FULL;
         int i, len = 0;
@@ -3091,7 +3087,7 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
         for (i = 0; i < FTRACE_FUNC_HASHSIZE; i++) {
                 struct hlist_head *hhd = &ftrace_func_hash[i];
 
-                hlist_for_each_entry_safe(entry, n, tmp, hhd, node) {
+                hlist_for_each_entry_safe(entry, tmp, hhd, node) {
 
                         /* break up if statements for readability */
                         if ((flags & PROBE_TEST_FUNC) && entry->ops != ops)
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index 194d79602dc7..697e88d13907 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -739,12 +739,11 @@ static int task_state_char(unsigned long state)
 struct trace_event *ftrace_find_event(int type)
 {
         struct trace_event *event;
-        struct hlist_node *n;
         unsigned key;
 
         key = type & (EVENT_HASHSIZE - 1);
 
-        hlist_for_each_entry(event, n, &event_hash[key], node) {
+        hlist_for_each_entry(event, &event_hash[key], node) {
                 if (event->type == type)
                         return event;
         }
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index d96ba22dabfa..0c05a4592047 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -192,12 +192,11 @@ tracepoint_entry_remove_probe(struct tracepoint_entry *entry,
 static struct tracepoint_entry *get_tracepoint(const char *name)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct tracepoint_entry *e;
         u32 hash = jhash(name, strlen(name), 0);
 
         head = &tracepoint_table[hash & (TRACEPOINT_TABLE_SIZE - 1)];
-        hlist_for_each_entry(e, node, head, hlist) {
+        hlist_for_each_entry(e, head, hlist) {
                 if (!strcmp(name, e->name))
                         return e;
         }
@@ -211,13 +210,12 @@ static struct tracepoint_entry *get_tracepoint(const char *name)
 static struct tracepoint_entry *add_tracepoint(const char *name)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct tracepoint_entry *e;
         size_t name_len = strlen(name) + 1;
         u32 hash = jhash(name, name_len-1, 0);
 
         head = &tracepoint_table[hash & (TRACEPOINT_TABLE_SIZE - 1)];
-        hlist_for_each_entry(e, node, head, hlist) {
+        hlist_for_each_entry(e, head, hlist) {
                 if (!strcmp(name, e->name)) {
                         printk(KERN_NOTICE
                                 "tracepoint %s busy\n", name);
diff --git a/kernel/user-return-notifier.c b/kernel/user-return-notifier.c
index 1744bb80f1fb..394f70b17162 100644
--- a/kernel/user-return-notifier.c
+++ b/kernel/user-return-notifier.c
@@ -34,11 +34,11 @@ EXPORT_SYMBOL_GPL(user_return_notifier_unregister);
 void fire_user_return_notifiers(void)
 {
         struct user_return_notifier *urn;
-        struct hlist_node *tmp1, *tmp2;
+        struct hlist_node *tmp2;
         struct hlist_head *head;
 
         head = &get_cpu_var(return_notifier_list);
-        hlist_for_each_entry_safe(urn, tmp1, tmp2, head, link)
+        hlist_for_each_entry_safe(urn, tmp2, head, link)
                 urn->on_user_return(urn);
         put_cpu_var(return_notifier_list);
 }
diff --git a/kernel/user.c b/kernel/user.c
index 57ebfd42023c..e81978e8c03b 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -105,9 +105,8 @@ static void uid_hash_remove(struct user_struct *up)
 static struct user_struct *uid_hash_find(kuid_t uid, struct hlist_head *hashent)
 {
         struct user_struct *user;
-        struct hlist_node *h;
 
-        hlist_for_each_entry(user, h, hashent, uidhash_node) {
+        hlist_for_each_entry(user, hashent, uidhash_node) {
                 if (uid_eq(user->uid, uid)) {
                         atomic_inc(&user->__count);
                         return user;
diff --git a/kernel/utsname.c b/kernel/utsname.c
index 08b197e8c485..a47fc5de3113 100644
--- a/kernel/utsname.c
+++ b/kernel/utsname.c
@@ -30,7 +30,7 @@ static struct uts_namespace *create_uts_ns(void)
 /*
  * Clone a new ns copying an original utsname, setting refcount to 1
  * @old_ns: namespace to clone
- * Return NULL on error (failure to kmalloc), new ns otherwise
+ * Return ERR_PTR(-ENOMEM) on error (failure to kmalloc), new ns otherwise
  */
 static struct uts_namespace *clone_uts_ns(struct user_namespace *user_ns,
                                           struct uts_namespace *old_ns)
diff --git a/kernel/utsname_sysctl.c b/kernel/utsname_sysctl.c
index 63da38c2d820..4f69f9a5e221 100644
--- a/kernel/utsname_sysctl.c
+++ b/kernel/utsname_sysctl.c
@@ -15,6 +15,8 @@
 #include <linux/sysctl.h>
 #include <linux/wait.h>
 
+#ifdef CONFIG_PROC_SYSCTL
+
 static void *get_uts(ctl_table *table, int write)
 {
         char *which = table->data;
@@ -38,7 +40,6 @@ static void put_uts(ctl_table *table, int write, void *which)
                 up_write(&uts_sem);
 }
 
-#ifdef CONFIG_PROC_SYSCTL
 /*
  *      Special case of dostring for the UTS structure. This has locks
  *      to observe. Should this be in kernel/sys.c ????
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index f4feacad3812..81f2457811eb 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -251,8 +251,8 @@ EXPORT_SYMBOL_GPL(system_freezable_wq);
         for ((pool) = &std_worker_pools(cpu)[0];                        \
              (pool) < &std_worker_pools(cpu)[NR_STD_WORKER_POOLS]; (pool)++)
 
-#define for_each_busy_worker(worker, i, pos, pool)                      \
-        hash_for_each(pool->busy_hash, i, pos, worker, hentry)
+#define for_each_busy_worker(worker, i, pool)                           \
+        hash_for_each(pool->busy_hash, i, worker, hentry)
 
 static inline int __next_wq_cpu(int cpu, const struct cpumask *mask,
                                 unsigned int sw)
@@ -909,9 +909,8 @@ static struct worker *find_worker_executing_work(struct worker_pool *pool,
                                                  struct work_struct *work)
 {
         struct worker *worker;
-        struct hlist_node *tmp;
 
-        hash_for_each_possible(pool->busy_hash, worker, tmp, hentry,
+        hash_for_each_possible(pool->busy_hash, worker, hentry,
                                (unsigned long)work)
                 if (worker->current_work == work &&
                     worker->current_func == work->func)
@@ -1626,7 +1625,6 @@ static void busy_worker_rebind_fn(struct work_struct *work)
 static void rebind_workers(struct worker_pool *pool)
 {
         struct worker *worker, *n;
-        struct hlist_node *pos;
         int i;
 
         lockdep_assert_held(&pool->assoc_mutex);
@@ -1648,7 +1646,7 @@ static void rebind_workers(struct worker_pool *pool)
         }
 
         /* rebind busy workers */
-        for_each_busy_worker(worker, i, pos, pool) {
+        for_each_busy_worker(worker, i, pool) {
                 struct work_struct *rebind_work = &worker->rebind_work;
                 struct workqueue_struct *wq;
 
@@ -3423,7 +3421,6 @@ static void wq_unbind_fn(struct work_struct *work)
         int cpu = smp_processor_id();
         struct worker_pool *pool;
         struct worker *worker;
-        struct hlist_node *pos;
         int i;
 
         for_each_std_worker_pool(pool, cpu) {
@@ -3442,7 +3439,7 @@ static void wq_unbind_fn(struct work_struct *work)
                 list_for_each_entry(worker, &pool->idle_list, entry)
                         worker->flags |= WORKER_UNBOUND;
 
-                for_each_busy_worker(worker, i, pos, pool)
+                for_each_busy_worker(worker, i, pool)
                         worker->flags |= WORKER_UNBOUND;
 
                 pool->flags |= POOL_DISASSOCIATED;
diff --git a/lib/Makefile b/lib/Makefile
index 02ed6c04cd7d..d7946ff75b2e 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -23,7 +23,7 @@ lib-y	+= kobject.o klist.o
 obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
          bust_spinlocks.o hexdump.o kasprintf.o bitmap.o scatterlist.o \
          string_helpers.o gcd.o lcm.o list_sort.o uuid.o flex_array.o \
-         bsearch.o find_last_bit.o find_next_bit.o llist.o memweight.o
+         bsearch.o find_last_bit.o find_next_bit.o llist.o memweight.o kfifo.o
 obj-y += kstrtox.o
 obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o
 
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index d11808ca4bc4..37061ede8b81 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -109,11 +109,10 @@ static void fill_pool(void)
  */
 static struct debug_obj *lookup_object(void *addr, struct debug_bucket *b)
 {
-        struct hlist_node *node;
         struct debug_obj *obj;
         int cnt = 0;
 
-        hlist_for_each_entry(obj, node, &b->list, node) {
+        hlist_for_each_entry(obj, &b->list, node) {
                 cnt++;
                 if (obj->object == addr)
                         return obj;
@@ -213,7 +212,7 @@ static void free_object(struct debug_obj *obj)
 static void debug_objects_oom(void)
 {
         struct debug_bucket *db = obj_hash;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         HLIST_HEAD(freelist);
         struct debug_obj *obj;
         unsigned long flags;
@@ -227,7 +226,7 @@ static void debug_objects_oom(void)
                 raw_spin_unlock_irqrestore(&db->lock, flags);
 
                 /* Now free them */
-                hlist_for_each_entry_safe(obj, node, tmp, &freelist, node) {
+                hlist_for_each_entry_safe(obj, tmp, &freelist, node) {
                         hlist_del(&obj->node);
                         free_object(obj);
                 }
@@ -658,7 +657,7 @@ debug_object_active_state(void *addr, struct debug_obj_descr *descr,
 static void __debug_check_no_obj_freed(const void *address, unsigned long size)
 {
         unsigned long flags, oaddr, saddr, eaddr, paddr, chunks;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         HLIST_HEAD(freelist);
         struct debug_obj_descr *descr;
         enum debug_obj_state state;
@@ -678,7 +677,7 @@ static void __debug_check_no_obj_freed(const void *address, unsigned long size)
 repeat:
                 cnt = 0;
                 raw_spin_lock_irqsave(&db->lock, flags);
-                hlist_for_each_entry_safe(obj, node, tmp, &db->list, node) {
+                hlist_for_each_entry_safe(obj, tmp, &db->list, node) {
                         cnt++;
                         oaddr = (unsigned long) obj->object;
                         if (oaddr < saddr || oaddr >= eaddr)
@@ -702,7 +701,7 @@ repeat:
                 raw_spin_unlock_irqrestore(&db->lock, flags);
 
                 /* Now free them */
-                hlist_for_each_entry_safe(obj, node, tmp, &freelist, node) {
+                hlist_for_each_entry_safe(obj, tmp, &freelist, node) {
                         hlist_del(&obj->node);
                         free_object(obj);
                 }
@@ -1013,7 +1012,7 @@ void __init debug_objects_early_init(void)
 static int __init debug_objects_replace_static_objects(void)
 {
         struct debug_bucket *db = obj_hash;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         struct debug_obj *obj, *new;
         HLIST_HEAD(objects);
         int i, cnt = 0;
@@ -1033,7 +1032,7 @@ static int __init debug_objects_replace_static_objects(void)
         local_irq_disable();
 
         /* Remove the statically allocated objects from the pool */
-        hlist_for_each_entry_safe(obj, node, tmp, &obj_pool, node)
+        hlist_for_each_entry_safe(obj, tmp, &obj_pool, node)
                 hlist_del(&obj->node);
         /* Move the allocated objects to the pool */
         hlist_move_list(&objects, &obj_pool);
@@ -1042,7 +1041,7 @@ static int __init debug_objects_replace_static_objects(void)
         for (i = 0; i < ODEBUG_HASH_SIZE; i++, db++) {
                 hlist_move_list(&db->list, &objects);
 
-                hlist_for_each_entry(obj, node, &objects, node) {
+                hlist_for_each_entry(obj, &objects, node) {
                         new = hlist_entry(obj_pool.first, typeof(*obj), node);
                         hlist_del(&new->node);
                         /* copy object data */
@@ -1057,7 +1056,7 @@ static int __init debug_objects_replace_static_objects(void)
                obj_pool_used);
         return 0;
 free:
-        hlist_for_each_entry_safe(obj, node, tmp, &objects, node) {
+        hlist_for_each_entry_safe(obj, tmp, &objects, node) {
                 hlist_del(&obj->node);
                 kmem_cache_free(obj_cache, obj);
         }
diff --git a/lib/devres.c b/lib/devres.c
index 88ad75952a76..823533138fa0 100644
--- a/lib/devres.c
+++ b/lib/devres.c
@@ -227,6 +227,7 @@ void devm_ioport_unmap(struct device *dev, void __iomem *addr)
                                devm_ioport_map_match, (void *)addr));
 }
 EXPORT_SYMBOL(devm_ioport_unmap);
+#endif /* CONFIG_HAS_IOPORT */
 
 #ifdef CONFIG_PCI
 /*
@@ -432,4 +433,3 @@ void pcim_iounmap_regions(struct pci_dev *pdev, int mask)
 }
 EXPORT_SYMBOL(pcim_iounmap_regions);
 #endif /* CONFIG_PCI */
-#endif /* CONFIG_HAS_IOPORT */
diff --git a/lib/idr.c b/lib/idr.c
index 648239079dd2..73f4d53c02f3 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -35,10 +35,41 @@
 #include <linux/string.h>
 #include <linux/idr.h>
 #include <linux/spinlock.h>
+#include <linux/percpu.h>
+#include <linux/hardirq.h>
+
+#define MAX_IDR_SHIFT           (sizeof(int) * 8 - 1)
+#define MAX_IDR_BIT             (1U << MAX_IDR_SHIFT)
+
+/* Leave the possibility of an incomplete final layer */
+#define MAX_IDR_LEVEL ((MAX_IDR_SHIFT + IDR_BITS - 1) / IDR_BITS)
+
+/* Number of id_layer structs to leave in free list */
+#define MAX_IDR_FREE (MAX_IDR_LEVEL * 2)
 
 static struct kmem_cache *idr_layer_cache;
+static DEFINE_PER_CPU(struct idr_layer *, idr_preload_head);
+static DEFINE_PER_CPU(int, idr_preload_cnt);
 static DEFINE_SPINLOCK(simple_ida_lock);
 
+/* the maximum ID which can be allocated given idr->layers */
+static int idr_max(int layers)
+{
+        int bits = min_t(int, layers * IDR_BITS, MAX_IDR_SHIFT);
+
+        return (1 << bits) - 1;
+}
+
+/*
+ * Prefix mask for an idr_layer at @layer.  For layer 0, the prefix mask is
+ * all bits except for the lower IDR_BITS.  For layer 1, 2 * IDR_BITS, and
+ * so on.
+ */
+static int idr_layer_prefix_mask(int layer)
+{
+        return ~idr_max(layer + 1);
+}
+
 static struct idr_layer *get_from_free_list(struct idr *idp)
 {
         struct idr_layer *p;
@@ -54,6 +85,50 @@ static struct idr_layer *get_from_free_list(struct idr *idp)
         return(p);
 }
 
+/**
+ * idr_layer_alloc - allocate a new idr_layer
+ * @gfp_mask: allocation mask
+ * @layer_idr: optional idr to allocate from
+ *
+ * If @layer_idr is %NULL, directly allocate one using @gfp_mask or fetch
+ * one from the per-cpu preload buffer.  If @layer_idr is not %NULL, fetch
+ * an idr_layer from @idr->id_free.
+ *
+ * @layer_idr is to maintain backward compatibility with the old alloc
+ * interface - idr_pre_get() and idr_get_new*() - and will be removed
+ * together with per-pool preload buffer.
+ */
+static struct idr_layer *idr_layer_alloc(gfp_t gfp_mask, struct idr *layer_idr)
+{
+        struct idr_layer *new;
+
+        /* this is the old path, bypass to get_from_free_list() */
+        if (layer_idr)
+                return get_from_free_list(layer_idr);
+
+        /* try to allocate directly from kmem_cache */
+        new = kmem_cache_zalloc(idr_layer_cache, gfp_mask);
+        if (new)
+                return new;
+
+        /*
+         * Try to fetch one from the per-cpu preload buffer if in process
+         * context.  See idr_preload() for details.
+         */
+        if (in_interrupt())
+                return NULL;
+
+        preempt_disable();
+        new = __this_cpu_read(idr_preload_head);
+        if (new) {
+                __this_cpu_write(idr_preload_head, new->ary[0]);
+                __this_cpu_dec(idr_preload_cnt);
+                new->ary[0] = NULL;
+        }
+        preempt_enable();
+        return new;
+}
+
 static void idr_layer_rcu_free(struct rcu_head *head)
 {
         struct idr_layer *layer;
@@ -62,8 +137,10 @@ static void idr_layer_rcu_free(struct rcu_head *head)
         kmem_cache_free(idr_layer_cache, layer);
 }
 
-static inline void free_layer(struct idr_layer *p)
+static inline void free_layer(struct idr *idr, struct idr_layer *p)
 {
+        if (idr->hint && idr->hint == p)
+                RCU_INIT_POINTER(idr->hint, NULL);
         call_rcu(&p->rcu_head, idr_layer_rcu_free);
 }
 
@@ -92,18 +169,18 @@ static void idr_mark_full(struct idr_layer **pa, int id)
         struct idr_layer *p = pa[0];
         int l = 0;
 
-        __set_bit(id & IDR_MASK, &p->bitmap);
+        __set_bit(id & IDR_MASK, p->bitmap);
         /*
          * If this layer is full mark the bit in the layer above to
          * show that this part of the radix tree is full.  This may
          * complete the layer above and require walking up the radix
          * tree.
          */
-        while (p->bitmap == IDR_FULL) {
+        while (bitmap_full(p->bitmap, IDR_SIZE)) {
                 if (!(p = pa[++l]))
                         break;
                 id = id >> IDR_BITS;
-                __set_bit((id & IDR_MASK), &p->bitmap);
+                __set_bit((id & IDR_MASK), p->bitmap);
         }
 }
 
@@ -133,12 +210,29 @@ int idr_pre_get(struct idr *idp, gfp_t gfp_mask)
 }
 EXPORT_SYMBOL(idr_pre_get);
 
-static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
+/**
+ * sub_alloc - try to allocate an id without growing the tree depth
+ * @idp: idr handle
+ * @starting_id: id to start search at
+ * @id: pointer to the allocated handle
+ * @pa: idr_layer[MAX_IDR_LEVEL] used as backtrack buffer
+ * @gfp_mask: allocation mask for idr_layer_alloc()
+ * @layer_idr: optional idr passed to idr_layer_alloc()
+ *
+ * Allocate an id in range [@starting_id, INT_MAX] from @idp without
+ * growing its depth.  Returns
+ *
+ *  the allocated id >= 0 if successful,
+ *  -EAGAIN if the tree needs to grow for allocation to succeed,
+ *  -ENOSPC if the id space is exhausted,
+ *  -ENOMEM if more idr_layers need to be allocated.
+ */
+static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa,
+                     gfp_t gfp_mask, struct idr *layer_idr)
 {
         int n, m, sh;
         struct idr_layer *p, *new;
         int l, id, oid;
-        unsigned long bm;
 
         id = *starting_id;
  restart:
@@ -150,8 +244,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
                  * We run around this while until we reach the leaf node...
                  */
                 n = (id >> (IDR_BITS*l)) & IDR_MASK;
-                bm = ~p->bitmap;
-                m = find_next_bit(&bm, IDR_SIZE, n);
+                m = find_next_zero_bit(p->bitmap, IDR_SIZE, n);
                 if (m == IDR_SIZE) {
                         /* no space available go back to previous layer. */
                         l++;
@@ -161,7 +254,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
                         /* if already at the top layer, we need to grow */
                         if (id >= 1 << (idp->layers * IDR_BITS)) {
                                 *starting_id = id;
-                                return IDR_NEED_TO_GROW;
+                                return -EAGAIN;
                         }
                         p = pa[l];
                         BUG_ON(!p);
@@ -180,17 +273,18 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
                         id = ((id >> sh) ^ n ^ m) << sh;
                 }
                 if ((id >= MAX_IDR_BIT) || (id < 0))
-                        return IDR_NOMORE_SPACE;
+                        return -ENOSPC;
                 if (l == 0)
                         break;
                 /*
                  * Create the layer below if it is missing.
                  */
                 if (!p->ary[m]) {
-                        new = get_from_free_list(idp);
+                        new = idr_layer_alloc(gfp_mask, layer_idr);
                         if (!new)
-                                return -1;
+                                return -ENOMEM;
                         new->layer = l-1;
+                        new->prefix = id & idr_layer_prefix_mask(new->layer);
                         rcu_assign_pointer(p->ary[m], new);
                         p->count++;
                 }
@@ -203,7 +297,8 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
 }
 
 static int idr_get_empty_slot(struct idr *idp, int starting_id,
-                              struct idr_layer **pa)
+                              struct idr_layer **pa, gfp_t gfp_mask,
+                              struct idr *layer_idr)
 {
         struct idr_layer *p, *new;
         int layers, v, id;
@@ -214,8 +309,8 @@ build_up:
         p = idp->top;
         layers = idp->layers;
         if (unlikely(!p)) {
-                if (!(p = get_from_free_list(idp)))
-                        return -1;
+                if (!(p = idr_layer_alloc(gfp_mask, layer_idr)))
+                        return -ENOMEM;
                 p->layer = 0;
                 layers = 1;
         }
@@ -223,7 +318,7 @@ build_up:
          * Add a new layer to the top of the tree if the requested
          * id is larger than the currently allocated space.
          */
-        while ((layers < (MAX_IDR_LEVEL - 1)) && (id >= (1 << (layers*IDR_BITS)))) {
+        while (id > idr_max(layers)) {
                 layers++;
                 if (!p->count) {
                         /* special case: if the tree is currently empty,
@@ -231,9 +326,10 @@ build_up:
                          * upwards.
                          */
                         p->layer++;
+                        WARN_ON_ONCE(p->prefix);
                         continue;
                 }
-                if (!(new = get_from_free_list(idp))) {
+                if (!(new = idr_layer_alloc(gfp_mask, layer_idr))) {
                         /*
                          * The allocation failed.  If we built part of
                          * the structure tear it down.
@@ -242,45 +338,42 @@ build_up:
                         for (new = p; p && p != idp->top; new = p) {
                                 p = p->ary[0];
                                 new->ary[0] = NULL;
-                                new->bitmap = new->count = 0;
+                                new->count = 0;
+                                bitmap_clear(new->bitmap, 0, IDR_SIZE);
                                 __move_to_free_list(idp, new);
                         }
                         spin_unlock_irqrestore(&idp->lock, flags);
-                        return -1;
+                        return -ENOMEM;
                 }
                 new->ary[0] = p;
                 new->count = 1;
                 new->layer = layers-1;
-                if (p->bitmap == IDR_FULL)
-                        __set_bit(0, &new->bitmap);
+                new->prefix = id & idr_layer_prefix_mask(new->layer);
+                if (bitmap_full(p->bitmap, IDR_SIZE))
+                        __set_bit(0, new->bitmap);
                 p = new;
         }
         rcu_assign_pointer(idp->top, p);
         idp->layers = layers;
-        v = sub_alloc(idp, &id, pa);
-        if (v == IDR_NEED_TO_GROW)
+        v = sub_alloc(idp, &id, pa, gfp_mask, layer_idr);
+        if (v == -EAGAIN)
                 goto build_up;
         return(v);
 }
 
-static int idr_get_new_above_int(struct idr *idp, void *ptr, int starting_id)
+/*
+ * @id and @pa are from a successful allocation from idr_get_empty_slot().
+ * Install the user pointer @ptr and mark the slot full.
+ */
+static void idr_fill_slot(struct idr *idr, void *ptr, int id,
+                          struct idr_layer **pa)
 {
-        struct idr_layer *pa[MAX_IDR_LEVEL];
-        int id;
-
-        id = idr_get_empty_slot(idp, starting_id, pa);
-        if (id >= 0) {
-                /*
-                 * Successfully found an empty slot.  Install the user
-                 * pointer and mark the slot full.
-                 */
-                rcu_assign_pointer(pa[0]->ary[id & IDR_MASK],
-                                (struct idr_layer *)ptr);
-                pa[0]->count++;
-                idr_mark_full(pa, id);
-        }
+        /* update hint used for lookup, cleared from free_layer() */
+        rcu_assign_pointer(idr->hint, pa[0]);
 
-        return id;
+        rcu_assign_pointer(pa[0]->ary[id & IDR_MASK], (struct idr_layer *)ptr);
+        pa[0]->count++;
+        idr_mark_full(pa, id);
 }
 
 /**
@@ -303,49 +396,124 @@ static int idr_get_new_above_int(struct idr *idp, void *ptr, int starting_id)
  */
 int idr_get_new_above(struct idr *idp, void *ptr, int starting_id, int *id)
 {
+        struct idr_layer *pa[MAX_IDR_LEVEL + 1];
         int rv;
 
-        rv = idr_get_new_above_int(idp, ptr, starting_id);
-        /*
-         * This is a cheap hack until the IDR code can be fixed to
-         * return proper error values.
-         */
+        rv = idr_get_empty_slot(idp, starting_id, pa, 0, idp);
         if (rv < 0)
-                return _idr_rc_to_errno(rv);
+                return rv == -ENOMEM ? -EAGAIN : rv;
+
+        idr_fill_slot(idp, ptr, rv, pa);
         *id = rv;
         return 0;
 }
 EXPORT_SYMBOL(idr_get_new_above);
 
 /**
- * idr_get_new - allocate new idr entry
- * @idp: idr handle
- * @ptr: pointer you want associated with the id
- * @id: pointer to the allocated handle
+ * idr_preload - preload for idr_alloc()
+ * @gfp_mask: allocation mask to use for preloading
  *
- * If allocation from IDR's private freelist fails, idr_get_new_above() will
- * return %-EAGAIN.  The caller should retry the idr_pre_get() call to refill
- * IDR's preallocation and then retry the idr_get_new_above() call.
+ * Preload per-cpu layer buffer for idr_alloc().  Can only be used from
+ * process context and each idr_preload() invocation should be matched with
+ * idr_preload_end().  Note that preemption is disabled while preloaded.
  *
- * If the idr is full idr_get_new_above() will return %-ENOSPC.
+ * The first idr_alloc() in the preloaded section can be treated as if it
+ * were invoked with @gfp_mask used for preloading.  This allows using more
+ * permissive allocation masks for idrs protected by spinlocks.
+ *
+ * For example, if idr_alloc() below fails, the failure can be treated as
+ * if idr_alloc() were called with GFP_KERNEL rather than GFP_NOWAIT.
+ *
+ *      idr_preload(GFP_KERNEL);
+ *      spin_lock(lock);
+ *
+ *      id = idr_alloc(idr, ptr, start, end, GFP_NOWAIT);
  *
- * @id returns a value in the range %0 ... %0x7fffffff
+ *      spin_unlock(lock);
+ *      idr_preload_end();
+ *      if (id < 0)
+ *              error;
  */
-int idr_get_new(struct idr *idp, void *ptr, int *id)
+void idr_preload(gfp_t gfp_mask)
 {
-        int rv;
+        /*
+         * Consuming preload buffer from non-process context breaks preload
+         * allocation guarantee.  Disallow usage from those contexts.
+         */
+        WARN_ON_ONCE(in_interrupt());
+        might_sleep_if(gfp_mask & __GFP_WAIT);
+
+        preempt_disable();
 
-        rv = idr_get_new_above_int(idp, ptr, 0);
         /*
-         * This is a cheap hack until the IDR code can be fixed to
-         * return proper error values.
+         * idr_alloc() is likely to succeed w/o full idr_layer buffer and
+         * return value from idr_alloc() needs to be checked for failure
+         * anyway.  Silently give up if allocation fails.  The caller can
+         * treat failures from idr_alloc() as if idr_alloc() were called
+         * with @gfp_mask which should be enough.
          */
-        if (rv < 0)
-                return _idr_rc_to_errno(rv);
-        *id = rv;
-        return 0;
+        while (__this_cpu_read(idr_preload_cnt) < MAX_IDR_FREE) {
+                struct idr_layer *new;
+
+                preempt_enable();
+                new = kmem_cache_zalloc(idr_layer_cache, gfp_mask);
+                preempt_disable();
+                if (!new)
+                        break;
+
+                /* link the new one to per-cpu preload list */
+                new->ary[0] = __this_cpu_read(idr_preload_head);
+                __this_cpu_write(idr_preload_head, new);
+                __this_cpu_inc(idr_preload_cnt);
+        }
 }
-EXPORT_SYMBOL(idr_get_new);
+EXPORT_SYMBOL(idr_preload);
+
+/**
+ * idr_alloc - allocate new idr entry
+ * @idr: the (initialized) idr
+ * @ptr: pointer to be associated with the new id
+ * @start: the minimum id (inclusive)
+ * @end: the maximum id (exclusive, <= 0 for max)
+ * @gfp_mask: memory allocation flags
+ *
+ * Allocate an id in [start, end) and associate it with @ptr.  If no ID is
+ * available in the specified range, returns -ENOSPC.  On memory allocation
+ * failure, returns -ENOMEM.
+ *
+ * Note that @end is treated as max when <= 0.  This is to always allow
+ * using @start + N as @end as long as N is inside integer range.
+ *
+ * The user is responsible for exclusively synchronizing all operations
+ * which may modify @idr.  However, read-only accesses such as idr_find()
+ * or iteration can be performed under RCU read lock provided the user
+ * destroys @ptr in RCU-safe way after removal from idr.
+ */
+int idr_alloc(struct idr *idr, void *ptr, int start, int end, gfp_t gfp_mask)
+{
+        int max = end > 0 ? end - 1 : INT_MAX;  /* inclusive upper limit */
+        struct idr_layer *pa[MAX_IDR_LEVEL + 1];
+        int id;
+
+        might_sleep_if(gfp_mask & __GFP_WAIT);
+
+        /* sanity checks */
+        if (WARN_ON_ONCE(start < 0))
+                return -EINVAL;
+        if (unlikely(max < start))
+                return -ENOSPC;
+
+        /* allocate id */
+        id = idr_get_empty_slot(idr, start, pa, gfp_mask, NULL);
+        if (unlikely(id < 0))
+                return id;
+        if (unlikely(id > max))
+                return -ENOSPC;
+
+        idr_fill_slot(idr, ptr, id, pa);
+        return id;
+}
+EXPORT_SYMBOL_GPL(idr_alloc);
 
 static void idr_remove_warning(int id)
 {
@@ -357,7 +525,7 @@ static void idr_remove_warning(int id)
 static void sub_remove(struct idr *idp, int shift, int id)
 {
         struct idr_layer *p = idp->top;
-        struct idr_layer **pa[MAX_IDR_LEVEL];
+        struct idr_layer **pa[MAX_IDR_LEVEL + 1];
         struct idr_layer ***paa = &pa[0];
         struct idr_layer *to_free;
         int n;
@@ -367,26 +535,26 @@ static void sub_remove(struct idr *idp, int shift, int id)
 
         while ((shift > 0) && p) {
                 n = (id >> shift) & IDR_MASK;
-                __clear_bit(n, &p->bitmap);
+                __clear_bit(n, p->bitmap);
                 *++paa = &p->ary[n];
                 p = p->ary[n];
                 shift -= IDR_BITS;
         }
         n = id & IDR_MASK;
-        if (likely(p != NULL && test_bit(n, &p->bitmap))){
-                __clear_bit(n, &p->bitmap);
+        if (likely(p != NULL && test_bit(n, p->bitmap))) {
+                __clear_bit(n, p->bitmap);
                 rcu_assign_pointer(p->ary[n], NULL);
                 to_free = NULL;
                 while(*paa && ! --((**paa)->count)){
                         if (to_free)
-                                free_layer(to_free);
+                                free_layer(idp, to_free);
                         to_free = **paa;
                         **paa-- = NULL;
                 }
                 if (!*paa)
                         idp->layers = 0;
                 if (to_free)
-                        free_layer(to_free);
+                        free_layer(idp, to_free);
         } else
                 idr_remove_warning(id);
 }
@@ -401,8 +569,9 @@ void idr_remove(struct idr *idp, int id)
         struct idr_layer *p;
         struct idr_layer *to_free;
 
-        /* Mask off upper bits we don't use for the search. */
-        id &= MAX_IDR_MASK;
+        /* see comment in idr_find_slowpath() */
+        if (WARN_ON_ONCE(id < 0))
+                return;
 
         sub_remove(idp, (idp->layers - 1) * IDR_BITS, id);
         if (idp->top && idp->top->count == 1 && (idp->layers > 1) &&
@@ -417,8 +586,9 @@ void idr_remove(struct idr *idp, int id)
                 p = idp->top->ary[0];
                 rcu_assign_pointer(idp->top, p);
                 --idp->layers;
-                to_free->bitmap = to_free->count = 0;
-                free_layer(to_free);
+                to_free->count = 0;
+                bitmap_clear(to_free->bitmap, 0, IDR_SIZE);
+                free_layer(idp, to_free);
         }
         while (idp->id_free_cnt >= MAX_IDR_FREE) {
                 p = get_from_free_list(idp);
@@ -433,34 +603,21 @@ void idr_remove(struct idr *idp, int id)
 }
 EXPORT_SYMBOL(idr_remove);
 
-/**
- * idr_remove_all - remove all ids from the given idr tree
- * @idp: idr handle
- *
- * idr_destroy() only frees up unused, cached idp_layers, but this
- * function will remove all id mappings and leave all idp_layers
- * unused.
- *
- * A typical clean-up sequence for objects stored in an idr tree will
- * use idr_for_each() to free all objects, if necessay, then
- * idr_remove_all() to remove all ids, and idr_destroy() to free
- * up the cached idr_layers.
- */
-void idr_remove_all(struct idr *idp)
+void __idr_remove_all(struct idr *idp)
 {
         int n, id, max;
         int bt_mask;
         struct idr_layer *p;
-        struct idr_layer *pa[MAX_IDR_LEVEL];
+        struct idr_layer *pa[MAX_IDR_LEVEL + 1];
         struct idr_layer **paa = &pa[0];
 
         n = idp->layers * IDR_BITS;
         p = idp->top;
         rcu_assign_pointer(idp->top, NULL);
-        max = 1 << n;
+        max = idr_max(idp->layers);
 
         id = 0;
-        while (id < max) {
+        while (id >= 0 && id <= max) {
                 while (n > IDR_BITS && p) {
                         n -= IDR_BITS;
                         *paa++ = p;
@@ -472,21 +629,32 @@ void idr_remove_all(struct idr *idp)
                 /* Get the highest bit that the above add changed from 0->1. */
                 while (n < fls(id ^ bt_mask)) {
                         if (p)
-                                free_layer(p);
+                                free_layer(idp, p);
                         n += IDR_BITS;
                         p = *--paa;
                 }
         }
         idp->layers = 0;
 }
-EXPORT_SYMBOL(idr_remove_all);
+EXPORT_SYMBOL(__idr_remove_all);
 
 /**
  * idr_destroy - release all cached layers within an idr tree
  * @idp: idr handle
+ *
+ * Free all id mappings and all idp_layers.  After this function, @idp is
+ * completely unused and can be freed / recycled.  The caller is
+ * responsible for ensuring that no one else accesses @idp during or after
+ * idr_destroy().
+ *
+ * A typical clean-up sequence for objects stored in an idr tree will use
+ * idr_for_each() to free all objects, if necessay, then idr_destroy() to
+ * free up the id mappings and cached idr_layers.
  */
 void idr_destroy(struct idr *idp)
 {
+        __idr_remove_all(idp);
+
         while (idp->id_free_cnt) {
                 struct idr_layer *p = get_from_free_list(idp);
                 kmem_cache_free(idr_layer_cache, p);
@@ -494,32 +662,28 @@ void idr_destroy(struct idr *idp)
 }
 EXPORT_SYMBOL(idr_destroy);
 
-/**
- * idr_find - return pointer for given id
- * @idp: idr handle
- * @id: lookup key
- *
- * Return the pointer given the id it has been registered with.  A %NULL
- * return indicates that @id is not valid or you passed %NULL in
- * idr_get_new().
- *
- * This function can be called under rcu_read_lock(), given that the leaf
- * pointers lifetimes are correctly managed.
- */
-void *idr_find(struct idr *idp, int id)
+void *idr_find_slowpath(struct idr *idp, int id)
 {
         int n;
         struct idr_layer *p;
 
+        /*
+         * If @id is negative, idr_find() used to ignore the sign bit and
+         * performed lookup with the rest of bits, which is weird and can
+         * lead to very obscure bugs.  We're now returning NULL for all
+         * negative IDs but just in case somebody was depending on the sign
+         * bit being ignored, let's trigger WARN_ON_ONCE() so that they can
+         * be detected and fixed.  WARN_ON_ONCE() can later be removed.
+         */
+        if (WARN_ON_ONCE(id < 0))
+                return NULL;
+
         p = rcu_dereference_raw(idp->top);
         if (!p)
                 return NULL;
         n = (p->layer+1) * IDR_BITS;
 
-        /* Mask off upper bits we don't use for the search. */
-        id &= MAX_IDR_MASK;
-
-        if (id >= (1 << n))
+        if (id > idr_max(p->layer + 1))
                 return NULL;
         BUG_ON(n == 0);
 
@@ -530,7 +694,7 @@ void *idr_find(struct idr *idp, int id)
         }
         return((void *)p);
 }
-EXPORT_SYMBOL(idr_find);
+EXPORT_SYMBOL(idr_find_slowpath);
 
 /**
  * idr_for_each - iterate through all stored pointers
@@ -555,15 +719,15 @@ int idr_for_each(struct idr *idp,
 {
         int n, id, max, error = 0;
         struct idr_layer *p;
-        struct idr_layer *pa[MAX_IDR_LEVEL];
+        struct idr_layer *pa[MAX_IDR_LEVEL + 1];
         struct idr_layer **paa = &pa[0];
 
         n = idp->layers * IDR_BITS;
         p = rcu_dereference_raw(idp->top);
-        max = 1 << n;
+        max = idr_max(idp->layers);
 
         id = 0;
-        while (id < max) {
+        while (id >= 0 && id <= max) {
                 while (n > 0 && p) {
                         n -= IDR_BITS;
                         *paa++ = p;
@@ -601,7 +765,7 @@ EXPORT_SYMBOL(idr_for_each);
  */
 void *idr_get_next(struct idr *idp, int *nextidp)
 {
-        struct idr_layer *p, *pa[MAX_IDR_LEVEL];
+        struct idr_layer *p, *pa[MAX_IDR_LEVEL + 1];
         struct idr_layer **paa = &pa[0];
         int id = *nextidp;
         int n, max;
@@ -611,9 +775,9 @@ void *idr_get_next(struct idr *idp, int *nextidp)
         if (!p)
                 return NULL;
         n = (p->layer + 1) * IDR_BITS;
-        max = 1 << n;
+        max = idr_max(p->layer + 1);
 
-        while (id < max) {
+        while (id >= 0 && id <= max) {
                 while (n > 0 && p) {
                         n -= IDR_BITS;
                         *paa++ = p;
@@ -625,7 +789,14 @@ void *idr_get_next(struct idr *idp, int *nextidp)
                         return p;
                 }
 
-                id += 1 << n;
+                /*
+                 * Proceed to the next layer at the current level.  Unlike
+                 * idr_for_each(), @id isn't guaranteed to be aligned to
+                 * layer boundary at this point and adding 1 << n may
+                 * incorrectly skip IDs.  Make sure we jump to the
+                 * beginning of the next layer using round_up().
+                 */
+                id = round_up(id + 1, 1 << n);
                 while (n < fls(id)) {
                         n += IDR_BITS;
                         p = *--paa;
@@ -653,14 +824,16 @@ void *idr_replace(struct idr *idp, void *ptr, int id)
         int n;
         struct idr_layer *p, *old_p;
 
+        /* see comment in idr_find_slowpath() */
+        if (WARN_ON_ONCE(id < 0))
+                return ERR_PTR(-EINVAL);
+
         p = idp->top;
         if (!p)
                 return ERR_PTR(-EINVAL);
 
         n = (p->layer+1) * IDR_BITS;
 
-        id &= MAX_IDR_MASK;
-
         if (id >= (1 << n))
                 return ERR_PTR(-EINVAL);
 
@@ -671,7 +844,7 @@ void *idr_replace(struct idr *idp, void *ptr, int id)
         }
 
         n = id & IDR_MASK;
-        if (unlikely(p == NULL || !test_bit(n, &p->bitmap)))
+        if (unlikely(p == NULL || !test_bit(n, p->bitmap)))
                 return ERR_PTR(-ENOENT);
 
         old_p = p->ary[n];
@@ -780,7 +953,7 @@ EXPORT_SYMBOL(ida_pre_get);
  */
 int ida_get_new_above(struct ida *ida, int starting_id, int *p_id)
 {
-        struct idr_layer *pa[MAX_IDR_LEVEL];
+        struct idr_layer *pa[MAX_IDR_LEVEL + 1];
         struct ida_bitmap *bitmap;
         unsigned long flags;
         int idr_id = starting_id / IDA_BITMAP_BITS;
@@ -789,9 +962,9 @@ int ida_get_new_above(struct ida *ida, int starting_id, int *p_id)
 
  restart:
         /* get vacant slot */
-        t = idr_get_empty_slot(&ida->idr, idr_id, pa);
+        t = idr_get_empty_slot(&ida->idr, idr_id, pa, 0, &ida->idr);
         if (t < 0)
-                return _idr_rc_to_errno(t);
+                return t == -ENOMEM ? -EAGAIN : t;
 
         if (t * IDA_BITMAP_BITS >= MAX_IDR_BIT)
                 return -ENOSPC;
@@ -852,25 +1025,6 @@ int ida_get_new_above(struct ida *ida, int starting_id, int *p_id)
 EXPORT_SYMBOL(ida_get_new_above);
 
 /**
- * ida_get_new - allocate new ID
- * @ida:        idr handle
- * @p_id:       pointer to the allocated handle
- *
- * Allocate new ID.  It should be called with any required locks.
- *
- * If memory is required, it will return %-EAGAIN, you should unlock
- * and go back to the idr_pre_get() call.  If the idr is full, it will
- * return %-ENOSPC.
- *
- * @p_id returns a value in the range %0 ... %0x7fffffff.
- */
-int ida_get_new(struct ida *ida, int *p_id)
-{
-        return ida_get_new_above(ida, 0, p_id);
-}
-EXPORT_SYMBOL(ida_get_new);
-
-/**
  * ida_remove - remove the given ID
  * @ida:        ida handle
  * @id:         ID to free
@@ -887,7 +1041,7 @@ void ida_remove(struct ida *ida, int id)
         /* clear full bits while looking up the leaf idr_layer */
         while ((shift > 0) && p) {
                 n = (idr_id >> shift) & IDR_MASK;
-                __clear_bit(n, &p->bitmap);
+                __clear_bit(n, p->bitmap);
                 p = p->ary[n];
                 shift -= IDR_BITS;
         }
@@ -896,7 +1050,7 @@ void ida_remove(struct ida *ida, int id)
                 goto err;
 
         n = idr_id & IDR_MASK;
-        __clear_bit(n, &p->bitmap);
+        __clear_bit(n, p->bitmap);
 
         bitmap = (void *)p->ary[n];
         if (!test_bit(offset, bitmap->bitmap))
@@ -905,7 +1059,7 @@ void ida_remove(struct ida *ida, int id)
         /* update bitmap and remove it if empty */
         __clear_bit(offset, bitmap->bitmap);
         if (--bitmap->nr_busy == 0) {
-                __set_bit(n, &p->bitmap);       /* to please idr_remove() */
+                __set_bit(n, p->bitmap);        /* to please idr_remove() */
                 idr_remove(&ida->idr, idr_id);
                 free_bitmap(ida, bitmap);
         }
diff --git a/kernel/kfifo.c b/lib/kfifo.c
index 59dcf5b81d24..7b7f83027b7b 100644
--- a/kernel/kfifo.c
+++ b/lib/kfifo.c
@@ -42,8 +42,7 @@ int __kfifo_alloc(struct __kfifo *fifo, unsigned int size,
          * round down to the next power of 2, since our 'let the indices
          * wrap' technique works only in this case.
          */
-        if (!is_power_of_2(size))
-                size = rounddown_pow_of_two(size);
+        size = roundup_pow_of_two(size);
 
         fifo->in = 0;
         fifo->out = 0;
@@ -83,8 +82,7 @@ int __kfifo_init(struct __kfifo *fifo, void *buffer,
 {
         size /= esize;
 
-        if (!is_power_of_2(size))
-                size = rounddown_pow_of_two(size);
+        size = roundup_pow_of_two(size);
 
         fifo->in = 0;
         fifo->out = 0;
diff --git a/lib/lru_cache.c b/lib/lru_cache.c
index d71d89498943..8335d39d2ccd 100644
--- a/lib/lru_cache.c
+++ b/lib/lru_cache.c
@@ -262,12 +262,11 @@ static struct hlist_head *lc_hash_slot(struct lru_cache *lc, unsigned int enr)
 static struct lc_element *__lc_find(struct lru_cache *lc, unsigned int enr,
                 bool include_changing)
 {
-        struct hlist_node *n;
         struct lc_element *e;
 
         BUG_ON(!lc);
         BUG_ON(!lc->nr_elements);
-        hlist_for_each_entry(e, n, lc_hash_slot(lc, enr), colision) {
+        hlist_for_each_entry(e, lc_hash_slot(lc, enr), colision) {
                 /* "about to be changed" elements, pending transaction commit,
                  * are hashed by their "new number". "Normal" elements have
                  * lc_number == lc_new_number. */
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index 7874b01e816e..b83c144d731f 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -394,6 +394,44 @@ int sg_alloc_table_from_pages(struct sg_table *sgt,
 }
 EXPORT_SYMBOL(sg_alloc_table_from_pages);
 
+void __sg_page_iter_start(struct sg_page_iter *piter,
+                          struct scatterlist *sglist, unsigned int nents,
+                          unsigned long pgoffset)
+{
+        piter->__pg_advance = 0;
+        piter->__nents = nents;
+
+        piter->page = NULL;
+        piter->sg = sglist;
+        piter->sg_pgoffset = pgoffset;
+}
+EXPORT_SYMBOL(__sg_page_iter_start);
+
+static int sg_page_count(struct scatterlist *sg)
+{
+        return PAGE_ALIGN(sg->offset + sg->length) >> PAGE_SHIFT;
+}
+
+bool __sg_page_iter_next(struct sg_page_iter *piter)
+{
+        if (!piter->__nents || !piter->sg)
+                return false;
+
+        piter->sg_pgoffset += piter->__pg_advance;
+        piter->__pg_advance = 1;
+
+        while (piter->sg_pgoffset >= sg_page_count(piter->sg)) {
+                piter->sg_pgoffset -= sg_page_count(piter->sg);
+                piter->sg = sg_next(piter->sg);
+                if (!--piter->__nents || !piter->sg)
+                        return false;
+        }
+        piter->page = nth_page(sg_page(piter->sg), piter->sg_pgoffset);
+
+        return true;
+}
+EXPORT_SYMBOL(__sg_page_iter_next);
+
 /**
  * sg_miter_start - start mapping iteration over a sg list
  * @miter: sg mapping iter to be started
@@ -411,9 +449,7 @@ void sg_miter_start(struct sg_mapping_iter *miter, struct scatterlist *sgl,
 {
         memset(miter, 0, sizeof(struct sg_mapping_iter));
 
-        miter->__sg = sgl;
-        miter->__nents = nents;
-        miter->__offset = 0;
+        __sg_page_iter_start(&miter->piter, sgl, nents, 0);
         WARN_ON(!(flags & (SG_MITER_TO_SG | SG_MITER_FROM_SG)));
         miter->__flags = flags;
 }
@@ -438,36 +474,35 @@ EXPORT_SYMBOL(sg_miter_start);
  */
 bool sg_miter_next(struct sg_mapping_iter *miter)
 {
-        unsigned int off, len;
-
-        /* check for end and drop resources from the last iteration */
-        if (!miter->__nents)
-                return false;
-
         sg_miter_stop(miter);
 
-        /* get to the next sg if necessary.  __offset is adjusted by stop */
-        while (miter->__offset == miter->__sg->length) {
-                if (--miter->__nents) {
-                        miter->__sg = sg_next(miter->__sg);
-                        miter->__offset = 0;
-                } else
+        /*
+         * Get to the next page if necessary.
+         * __remaining, __offset is adjusted by sg_miter_stop
+         */
+        if (!miter->__remaining) {
+                struct scatterlist *sg;
+                unsigned long pgoffset;
+
+                if (!__sg_page_iter_next(&miter->piter))
                         return false;
-        }
 
-        /* map the next page */
-        off = miter->__sg->offset + miter->__offset;
-        len = miter->__sg->length - miter->__offset;
+                sg = miter->piter.sg;
+                pgoffset = miter->piter.sg_pgoffset;
 
-        miter->page = nth_page(sg_page(miter->__sg), off >> PAGE_SHIFT);
-        off &= ~PAGE_MASK;
-        miter->length = min_t(unsigned int, len, PAGE_SIZE - off);
-        miter->consumed = miter->length;
+                miter->__offset = pgoffset ? 0 : sg->offset;
+                miter->__remaining = sg->offset + sg->length -
+                                (pgoffset << PAGE_SHIFT) - miter->__offset;
+                miter->__remaining = min_t(unsigned long, miter->__remaining,
+                                           PAGE_SIZE - miter->__offset);
+        }
+        miter->page = miter->piter.page;
+        miter->consumed = miter->length = miter->__remaining;
 
         if (miter->__flags & SG_MITER_ATOMIC)
-                miter->addr = kmap_atomic(miter->page) + off;
+                miter->addr = kmap_atomic(miter->page) + miter->__offset;
         else
-                miter->addr = kmap(miter->page) + off;
+                miter->addr = kmap(miter->page) + miter->__offset;
 
         return true;
 }
@@ -494,6 +529,7 @@ void sg_miter_stop(struct sg_mapping_iter *miter)
         /* drop resources from the last iteration */
         if (miter->addr) {
                 miter->__offset += miter->consumed;
+                miter->__remaining -= miter->consumed;
 
                 if (miter->__flags & SG_MITER_TO_SG)
                         flush_kernel_dcache_page(miter->page);
diff --git a/mm/Kconfig b/mm/Kconfig
index 2c7aea7106f9..ae55c1e04d10 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -287,7 +287,7 @@ config NR_QUICK
 
 config VIRT_TO_BUS
         def_bool y
-        depends on !ARCH_NO_VIRT_TO_BUS
+        depends on HAVE_VIRT_TO_BUS
 
 config MMU_NOTIFIER
         bool
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index bfa142e67b1c..e2f7f5aaaafb 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1906,9 +1906,8 @@ static inline void free_mm_slot(struct mm_slot *mm_slot)
 static struct mm_slot *get_mm_slot(struct mm_struct *mm)
 {
         struct mm_slot *mm_slot;
-        struct hlist_node *node;
 
-        hash_for_each_possible(mm_slots_hash, mm_slot, node, hash, (unsigned long)mm)
+        hash_for_each_possible(mm_slots_hash, mm_slot, hash, (unsigned long)mm)
                 if (mm == mm_slot->mm)
                         return mm_slot;
 
diff --git a/mm/internal.h b/mm/internal.h
index 1c0c4cc0fcf7..8562de0a5197 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -195,7 +195,7 @@ static inline int mlocked_vma_newpage(struct vm_area_struct *vma,
  * must be called with vma's mmap_sem held for read or write, and page locked.
  */
 extern void mlock_vma_page(struct page *page);
-extern void munlock_vma_page(struct page *page);
+extern unsigned int munlock_vma_page(struct page *page);
 
 /*
  * Clear the page's PageMlocked().  This can be useful in a situation where
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 83dd5fbf5e60..c8d7f3110fd0 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -436,7 +436,7 @@ static int get_object(struct kmemleak_object *object)
  */
 static void free_object_rcu(struct rcu_head *rcu)
 {
-        struct hlist_node *elem, *tmp;
+        struct hlist_node *tmp;
         struct kmemleak_scan_area *area;
         struct kmemleak_object *object =
                 container_of(rcu, struct kmemleak_object, rcu);
@@ -445,8 +445,8 @@ static void free_object_rcu(struct rcu_head *rcu)
          * Once use_count is 0 (guaranteed by put_object), there is no other
          * code accessing this object, hence no need for locking.
          */
-        hlist_for_each_entry_safe(area, elem, tmp, &object->area_list, node) {
-                hlist_del(elem);
+        hlist_for_each_entry_safe(area, tmp, &object->area_list, node) {
+                hlist_del(&area->node);
                 kmem_cache_free(scan_area_cache, area);
         }
         kmem_cache_free(object_cache, object);
@@ -1177,7 +1177,6 @@ static void scan_block(void *_start, void *_end,
 static void scan_object(struct kmemleak_object *object)
 {
         struct kmemleak_scan_area *area;
-        struct hlist_node *elem;
         unsigned long flags;
 
         /*
@@ -1205,7 +1204,7 @@ static void scan_object(struct kmemleak_object *object)
                         spin_lock_irqsave(&object->lock, flags);
                 }
         } else
-                hlist_for_each_entry(area, elem, &object->area_list, node)
+                hlist_for_each_entry(area, &object->area_list, node)
                         scan_block((void *)area->start,
                                    (void *)(area->start + area->size),
                                    object, 0);
diff --git a/mm/ksm.c b/mm/ksm.c
index ab2ba9ad3c59..85bfd4c16346 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -320,10 +320,9 @@ static inline void free_mm_slot(struct mm_slot *mm_slot)
 
 static struct mm_slot *get_mm_slot(struct mm_struct *mm)
 {
-        struct hlist_node *node;
         struct mm_slot *slot;
 
-        hash_for_each_possible(mm_slots_hash, slot, node, link, (unsigned long)mm)
+        hash_for_each_possible(mm_slots_hash, slot, link, (unsigned long)mm)
                 if (slot->mm == mm)
                         return slot;
 
@@ -496,9 +495,8 @@ static inline int get_kpfn_nid(unsigned long kpfn)
 static void remove_node_from_stable_tree(struct stable_node *stable_node)
 {
         struct rmap_item *rmap_item;
-        struct hlist_node *hlist;
 
-        hlist_for_each_entry(rmap_item, hlist, &stable_node->hlist, hlist) {
+        hlist_for_each_entry(rmap_item, &stable_node->hlist, hlist) {
                 if (rmap_item->hlist.next)
                         ksm_pages_sharing--;
                 else
@@ -1898,7 +1896,6 @@ int page_referenced_ksm(struct page *page, struct mem_cgroup *memcg,
 {
         struct stable_node *stable_node;
         struct rmap_item *rmap_item;
-        struct hlist_node *hlist;
         unsigned int mapcount = page_mapcount(page);
         int referenced = 0;
         int search_new_forks = 0;
@@ -1910,7 +1907,7 @@ int page_referenced_ksm(struct page *page, struct mem_cgroup *memcg,
         if (!stable_node)
                 return 0;
 again:
-        hlist_for_each_entry(rmap_item, hlist, &stable_node->hlist, hlist) {
+        hlist_for_each_entry(rmap_item, &stable_node->hlist, hlist) {
                 struct anon_vma *anon_vma = rmap_item->anon_vma;
                 struct anon_vma_chain *vmac;
                 struct vm_area_struct *vma;
@@ -1952,7 +1949,6 @@ out:
 int try_to_unmap_ksm(struct page *page, enum ttu_flags flags)
 {
         struct stable_node *stable_node;
-        struct hlist_node *hlist;
         struct rmap_item *rmap_item;
         int ret = SWAP_AGAIN;
         int search_new_forks = 0;
@@ -1964,7 +1960,7 @@ int try_to_unmap_ksm(struct page *page, enum ttu_flags flags)
         if (!stable_node)
                 return SWAP_FAIL;
 again:
-        hlist_for_each_entry(rmap_item, hlist, &stable_node->hlist, hlist) {
+        hlist_for_each_entry(rmap_item, &stable_node->hlist, hlist) {
                 struct anon_vma *anon_vma = rmap_item->anon_vma;
                 struct anon_vma_chain *vmac;
                 struct vm_area_struct *vma;
@@ -2005,7 +2001,6 @@ int rmap_walk_ksm(struct page *page, int (*rmap_one)(struct page *,
                   struct vm_area_struct *, unsigned long, void *), void *arg)
 {
         struct stable_node *stable_node;
-        struct hlist_node *hlist;
         struct rmap_item *rmap_item;
         int ret = SWAP_AGAIN;
         int search_new_forks = 0;
@@ -2017,7 +2012,7 @@ int rmap_walk_ksm(struct page *page, int (*rmap_one)(struct page *,
         if (!stable_node)
                 return ret;
 again:
-        hlist_for_each_entry(rmap_item, hlist, &stable_node->hlist, hlist) {
+        hlist_for_each_entry(rmap_item, &stable_node->hlist, hlist) {
                 struct anon_vma *anon_vma = rmap_item->anon_vma;
                 struct anon_vma_chain *vmac;
                 struct vm_area_struct *vma;
diff --git a/mm/mlock.c b/mm/mlock.c
index e6638f565d42..1c5e33fce639 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -102,13 +102,16 @@ void mlock_vma_page(struct page *page)
  * can't isolate the page, we leave it for putback_lru_page() and vmscan
  * [page_referenced()/try_to_unmap()] to deal with.
  */
-void munlock_vma_page(struct page *page)
+unsigned int munlock_vma_page(struct page *page)
 {
+        unsigned int page_mask = 0;
+
         BUG_ON(!PageLocked(page));
 
         if (TestClearPageMlocked(page)) {
-                mod_zone_page_state(page_zone(page), NR_MLOCK,
-                                    -hpage_nr_pages(page));
+                unsigned int nr_pages = hpage_nr_pages(page);
+                mod_zone_page_state(page_zone(page), NR_MLOCK, -nr_pages);
+                page_mask = nr_pages - 1;
                 if (!isolate_lru_page(page)) {
                         int ret = SWAP_AGAIN;
 
@@ -141,6 +144,8 @@ void munlock_vma_page(struct page *page)
                                 count_vm_event(UNEVICTABLE_PGMUNLOCKED);
                 }
         }
+
+        return page_mask;
 }
 
 /**
@@ -159,7 +164,6 @@ long __mlock_vma_pages_range(struct vm_area_struct *vma,
                 unsigned long start, unsigned long end, int *nonblocking)
 {
         struct mm_struct *mm = vma->vm_mm;
-        unsigned long addr = start;
         unsigned long nr_pages = (end - start) / PAGE_SIZE;
         int gup_flags;
 
@@ -189,7 +193,7 @@ long __mlock_vma_pages_range(struct vm_area_struct *vma,
          * We made sure addr is within a VMA, so the following will
          * not result in a stack expansion that recurses back here.
          */
-        return __get_user_pages(current, mm, addr, nr_pages, gup_flags,
+        return __get_user_pages(current, mm, start, nr_pages, gup_flags,
                                 NULL, NULL, nonblocking);
 }
 
@@ -226,13 +230,12 @@ static int __mlock_posix_error_return(long retval)
 void munlock_vma_pages_range(struct vm_area_struct *vma,
                              unsigned long start, unsigned long end)
 {
-        unsigned long addr;
-
-        lru_add_drain();
         vma->vm_flags &= ~VM_LOCKED;
 
-        for (addr = start; addr < end; addr += PAGE_SIZE) {
+        while (start < end) {
                 struct page *page;
+                unsigned int page_mask, page_increm;
+
                 /*
                  * Although FOLL_DUMP is intended for get_dump_page(),
                  * it just so happens that its special treatment of the
@@ -240,13 +243,22 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
                  * suits munlock very well (and if somehow an abnormal page
                  * has sneaked into the range, we won't oops here: great).
                  */
-                page = follow_page(vma, addr, FOLL_GET | FOLL_DUMP);
+                page = follow_page_mask(vma, start, FOLL_GET | FOLL_DUMP,
+                                        &page_mask);
                 if (page && !IS_ERR(page)) {
                         lock_page(page);
-                        munlock_vma_page(page);
+                        lru_add_drain();
+                        /*
+                         * Any THP page found by follow_page_mask() may have
+                         * gotten split before reaching munlock_vma_page(),
+                         * so we need to recompute the page_mask here.
+                         */
+                        page_mask = munlock_vma_page(page);
                         unlock_page(page);
                         put_page(page);
                 }
+                page_increm = 1 + (~(start >> PAGE_SHIFT) & page_mask);
+                start += page_increm * PAGE_SIZE;
                 cond_resched();
         }
 }
diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
index 2175fb0d501c..be04122fb277 100644
--- a/mm/mmu_notifier.c
+++ b/mm/mmu_notifier.c
@@ -95,11 +95,10 @@ int __mmu_notifier_clear_flush_young(struct mm_struct *mm,
                                         unsigned long address)
 {
         struct mmu_notifier *mn;
-        struct hlist_node *n;
         int young = 0, id;
 
         id = srcu_read_lock(&srcu);
-        hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) {
+        hlist_for_each_entry_rcu(mn, &mm->mmu_notifier_mm->list, hlist) {
                 if (mn->ops->clear_flush_young)
                         young |= mn->ops->clear_flush_young(mn, mm, address);
         }
@@ -112,11 +111,10 @@ int __mmu_notifier_test_young(struct mm_struct *mm,
                               unsigned long address)
 {
         struct mmu_notifier *mn;
-        struct hlist_node *n;
         int young = 0, id;
 
         id = srcu_read_lock(&srcu);
-        hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) {
+        hlist_for_each_entry_rcu(mn, &mm->mmu_notifier_mm->list, hlist) {
                 if (mn->ops->test_young) {
                         young = mn->ops->test_young(mn, mm, address);
                         if (young)
@@ -132,11 +130,10 @@ void __mmu_notifier_change_pte(struct mm_struct *mm, unsigned long address,
                                pte_t pte)
 {
         struct mmu_notifier *mn;
-        struct hlist_node *n;
         int id;
 
         id = srcu_read_lock(&srcu);
-        hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) {
+        hlist_for_each_entry_rcu(mn, &mm->mmu_notifier_mm->list, hlist) {
                 if (mn->ops->change_pte)
                         mn->ops->change_pte(mn, mm, address, pte);
         }
@@ -147,11 +144,10 @@ void __mmu_notifier_invalidate_page(struct mm_struct *mm,
                                           unsigned long address)
 {
         struct mmu_notifier *mn;
-        struct hlist_node *n;
         int id;
 
         id = srcu_read_lock(&srcu);
-        hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) {
+        hlist_for_each_entry_rcu(mn, &mm->mmu_notifier_mm->list, hlist) {
                 if (mn->ops->invalidate_page)
                         mn->ops->invalidate_page(mn, mm, address);
         }
@@ -162,11 +158,10 @@ void __mmu_notifier_invalidate_range_start(struct mm_struct *mm,
                                   unsigned long start, unsigned long end)
 {
         struct mmu_notifier *mn;
-        struct hlist_node *n;
         int id;
 
         id = srcu_read_lock(&srcu);
-        hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) {
+        hlist_for_each_entry_rcu(mn, &mm->mmu_notifier_mm->list, hlist) {
                 if (mn->ops->invalidate_range_start)
                         mn->ops->invalidate_range_start(mn, mm, start, end);
         }
@@ -178,11 +173,10 @@ void __mmu_notifier_invalidate_range_end(struct mm_struct *mm,
                                   unsigned long start, unsigned long end)
 {
         struct mmu_notifier *mn;
-        struct hlist_node *n;
         int id;
 
         id = srcu_read_lock(&srcu);
-        hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist) {
+        hlist_for_each_entry_rcu(mn, &mm->mmu_notifier_mm->list, hlist) {
                 if (mn->ops->invalidate_range_end)
                         mn->ops->invalidate_range_end(mn, mm, start, end);
         }
diff --git a/net/9p/error.c b/net/9p/error.c
index 2ab2de76010f..126fd0dceea2 100644
--- a/net/9p/error.c
+++ b/net/9p/error.c
@@ -221,15 +221,13 @@ EXPORT_SYMBOL(p9_error_init);
 int p9_errstr2errno(char *errstr, int len)
 {
         int errno;
-        struct hlist_node *p;
         struct errormap *c;
         int bucket;
 
         errno = 0;
-        p = NULL;
         c = NULL;
         bucket = jhash(errstr, len, 0) % ERRHASHSZ;
-        hlist_for_each_entry(c, p, &hash_errmap[bucket], list) {
+        hlist_for_each_entry(c, &hash_errmap[bucket], list) {
                 if (c->namelen == len && !memcmp(c->name, errstr, len)) {
                         errno = c->val;
                         break;
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index de2e950a0a7a..74dea377fe5b 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -655,7 +655,7 @@ static struct p9_trans_module p9_virtio_trans = {
         .create = p9_virtio_create,
         .close = p9_virtio_close,
         .request = p9_virtio_request,
-        .zc_request = p9_virtio_zc_request,
+        //.zc_request = p9_virtio_zc_request,
         .cancel = p9_virtio_cancel,
         /*
          * We leave one entry for input and one entry for response
diff --git a/net/9p/util.c b/net/9p/util.c
index 6ceeeb384de7..59f278e64f58 100644
--- a/net/9p/util.c
+++ b/net/9p/util.c
@@ -87,23 +87,18 @@ EXPORT_SYMBOL(p9_idpool_destroy);
 
 int p9_idpool_get(struct p9_idpool *p)
 {
-        int i = 0;
-        int error;
+        int i;
         unsigned long flags;
 
-retry:
-        if (idr_pre_get(&p->pool, GFP_NOFS) == 0)
-                return -1;
-
+        idr_preload(GFP_NOFS);
         spin_lock_irqsave(&p->lock, flags);
 
         /* no need to store exactly p, we just need something non-null */
-        error = idr_get_new(&p->pool, p, &i);
-        spin_unlock_irqrestore(&p->lock, flags);
+        i = idr_alloc(&p->pool, p, 0, 0, GFP_NOWAIT);
 
-        if (error == -EAGAIN)
-                goto retry;
-        else if (error)
+        spin_unlock_irqrestore(&p->lock, flags);
+        idr_preload_end();
+        if (i < 0)
                 return -1;
 
         p9_debug(P9_DEBUG_MUX, " id %d pool %p\n", i, p);
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 33475291c9c1..4a141e3cf076 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -93,10 +93,9 @@ static struct sock *atalk_search_socket(struct sockaddr_at *to,
                                         struct atalk_iface *atif)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         read_lock_bh(&atalk_sockets_lock);
-        sk_for_each(s, node, &atalk_sockets) {
+        sk_for_each(s, &atalk_sockets) {
                 struct atalk_sock *at = at_sk(s);
 
                 if (to->sat_port != at->src_port)
@@ -141,11 +140,10 @@ static struct sock *atalk_find_or_insert_socket(struct sock *sk,
                                                 struct sockaddr_at *sat)
 {
         struct sock *s;
-        struct hlist_node *node;
         struct atalk_sock *at;
 
         write_lock_bh(&atalk_sockets_lock);
-        sk_for_each(s, node, &atalk_sockets) {
+        sk_for_each(s, &atalk_sockets) {
                 at = at_sk(s);
 
                 if (at->src_net == sat->sat_addr.s_net &&
@@ -1084,9 +1082,8 @@ static int atalk_pick_and_bind_port(struct sock *sk, struct sockaddr_at *sat)
              sat->sat_port < ATPORT_LAST;
              sat->sat_port++) {
                 struct sock *s;
-                struct hlist_node *node;
 
-                sk_for_each(s, node, &atalk_sockets) {
+                sk_for_each(s, &atalk_sockets) {
                         struct atalk_sock *at = at_sk(s);
 
                         if (at->src_net == sat->sat_addr.s_net &&
diff --git a/net/atm/common.c b/net/atm/common.c
index 806fc0a40051..7b491006eaf4 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -270,11 +270,11 @@ void atm_dev_release_vccs(struct atm_dev *dev)
         write_lock_irq(&vcc_sklist_lock);
         for (i = 0; i < VCC_HTABLE_SIZE; i++) {
                 struct hlist_head *head = &vcc_hash[i];
-                struct hlist_node *node, *tmp;
+                struct hlist_node *tmp;
                 struct sock *s;
                 struct atm_vcc *vcc;
 
-                sk_for_each_safe(s, node, tmp, head) {
+                sk_for_each_safe(s, tmp, head) {
                         vcc = atm_sk(s);
                         if (vcc->dev == dev) {
                                 vcc_release_async(vcc, -EPIPE);
@@ -317,11 +317,10 @@ static int adjust_tp(struct atm_trafprm *tp, unsigned char aal)
 static int check_ci(const struct atm_vcc *vcc, short vpi, int vci)
 {
         struct hlist_head *head = &vcc_hash[vci & (VCC_HTABLE_SIZE - 1)];
-        struct hlist_node *node;
         struct sock *s;
         struct atm_vcc *walk;
 
-        sk_for_each(s, node, head) {
+        sk_for_each(s, head) {
                 walk = atm_sk(s);
                 if (walk->dev != vcc->dev)
                         continue;
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 2e3d942e77f1..f23916be18fb 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -842,7 +842,9 @@ static void *lec_tbl_walk(struct lec_state *state, struct hlist_head *tbl,
                 --*l;
         }
 
-        hlist_for_each_entry_from(tmp, e, next) {
+        tmp = container_of(e, struct lec_arp_table, next);
+
+        hlist_for_each_entry_from(tmp, next) {
                 if (--*l < 0)
                         break;
         }
@@ -1307,7 +1309,6 @@ lec_arp_add(struct lec_priv *priv, struct lec_arp_table *entry)
 static int
 lec_arp_remove(struct lec_priv *priv, struct lec_arp_table *to_remove)
 {
-        struct hlist_node *node;
         struct lec_arp_table *entry;
         int i, remove_vcc = 1;
 
@@ -1326,7 +1327,7 @@ lec_arp_remove(struct lec_priv *priv, struct lec_arp_table *to_remove)
                  * ESI_FLUSH_PENDING, ESI_FORWARD_DIRECT
                  */
                 for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                        hlist_for_each_entry(entry, node,
+                        hlist_for_each_entry(entry,
                                              &priv->lec_arp_tables[i], next) {
                                 if (memcmp(to_remove->atm_addr,
                                            entry->atm_addr, ATM_ESA_LEN) == 0) {
@@ -1364,14 +1365,13 @@ static const char *get_status_string(unsigned char st)
 
 static void dump_arp_table(struct lec_priv *priv)
 {
-        struct hlist_node *node;
         struct lec_arp_table *rulla;
         char buf[256];
         int i, j, offset;
 
         pr_info("Dump %p:\n", priv);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(rulla, node,
+                hlist_for_each_entry(rulla,
                                      &priv->lec_arp_tables[i], next) {
                         offset = 0;
                         offset += sprintf(buf, "%d: %p\n", i, rulla);
@@ -1403,7 +1403,7 @@ static void dump_arp_table(struct lec_priv *priv)
 
         if (!hlist_empty(&priv->lec_no_forward))
                 pr_info("No forward\n");
-        hlist_for_each_entry(rulla, node, &priv->lec_no_forward, next) {
+        hlist_for_each_entry(rulla, &priv->lec_no_forward, next) {
                 offset = 0;
                 offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
                 offset += sprintf(buf + offset, " Atm:");
@@ -1428,7 +1428,7 @@ static void dump_arp_table(struct lec_priv *priv)
 
         if (!hlist_empty(&priv->lec_arp_empty_ones))
                 pr_info("Empty ones\n");
-        hlist_for_each_entry(rulla, node, &priv->lec_arp_empty_ones, next) {
+        hlist_for_each_entry(rulla, &priv->lec_arp_empty_ones, next) {
                 offset = 0;
                 offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
                 offset += sprintf(buf + offset, " Atm:");
@@ -1453,7 +1453,7 @@ static void dump_arp_table(struct lec_priv *priv)
 
         if (!hlist_empty(&priv->mcast_fwds))
                 pr_info("Multicast Forward VCCs\n");
-        hlist_for_each_entry(rulla, node, &priv->mcast_fwds, next) {
+        hlist_for_each_entry(rulla, &priv->mcast_fwds, next) {
                 offset = 0;
                 offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
                 offset += sprintf(buf + offset, " Atm:");
@@ -1487,7 +1487,7 @@ static void dump_arp_table(struct lec_priv *priv)
 static void lec_arp_destroy(struct lec_priv *priv)
 {
         unsigned long flags;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry;
         int i;
 
@@ -1499,7 +1499,7 @@ static void lec_arp_destroy(struct lec_priv *priv)
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next,
+                hlist_for_each_entry_safe(entry, next,
                                           &priv->lec_arp_tables[i], next) {
                         lec_arp_remove(priv, entry);
                         lec_arp_put(entry);
@@ -1507,7 +1507,7 @@ static void lec_arp_destroy(struct lec_priv *priv)
                 INIT_HLIST_HEAD(&priv->lec_arp_tables[i]);
         }
 
-        hlist_for_each_entry_safe(entry, node, next,
+        hlist_for_each_entry_safe(entry, next,
                                   &priv->lec_arp_empty_ones, next) {
                 del_timer_sync(&entry->timer);
                 lec_arp_clear_vccs(entry);
@@ -1516,7 +1516,7 @@ static void lec_arp_destroy(struct lec_priv *priv)
         }
         INIT_HLIST_HEAD(&priv->lec_arp_empty_ones);
 
-        hlist_for_each_entry_safe(entry, node, next,
+        hlist_for_each_entry_safe(entry, next,
                                   &priv->lec_no_forward, next) {
                 del_timer_sync(&entry->timer);
                 lec_arp_clear_vccs(entry);
@@ -1525,7 +1525,7 @@ static void lec_arp_destroy(struct lec_priv *priv)
         }
         INIT_HLIST_HEAD(&priv->lec_no_forward);
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->mcast_fwds, next) {
+        hlist_for_each_entry_safe(entry, next, &priv->mcast_fwds, next) {
                 /* No timer, LANEv2 7.1.20 and 2.3.5.3 */
                 lec_arp_clear_vccs(entry);
                 hlist_del(&entry->next);
@@ -1542,14 +1542,13 @@ static void lec_arp_destroy(struct lec_priv *priv)
 static struct lec_arp_table *lec_arp_find(struct lec_priv *priv,
                                           const unsigned char *mac_addr)
 {
-        struct hlist_node *node;
         struct hlist_head *head;
         struct lec_arp_table *entry;
 
         pr_debug("%pM\n", mac_addr);
 
         head = &priv->lec_arp_tables[HASH(mac_addr[ETH_ALEN - 1])];
-        hlist_for_each_entry(entry, node, head, next) {
+        hlist_for_each_entry(entry, head, next) {
                 if (ether_addr_equal(mac_addr, entry->mac_addr))
                         return entry;
         }
@@ -1686,7 +1685,7 @@ static void lec_arp_check_expire(struct work_struct *work)
         unsigned long flags;
         struct lec_priv *priv =
                 container_of(work, struct lec_priv, lec_arp_work.work);
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry;
         unsigned long now;
         int i;
@@ -1696,7 +1695,7 @@ static void lec_arp_check_expire(struct work_struct *work)
 restart:
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next,
+                hlist_for_each_entry_safe(entry, next,
                                           &priv->lec_arp_tables[i], next) {
                         if (__lec_arp_check_expire(entry, now, priv)) {
                                 struct sk_buff *skb;
@@ -1823,14 +1822,14 @@ lec_addr_delete(struct lec_priv *priv, const unsigned char *atm_addr,
                 unsigned long permanent)
 {
         unsigned long flags;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry;
         int i;
 
         pr_debug("\n");
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next,
+                hlist_for_each_entry_safe(entry, next,
                                           &priv->lec_arp_tables[i], next) {
                         if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN) &&
                             (permanent ||
@@ -1855,7 +1854,7 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
                unsigned int targetless_le_arp)
 {
         unsigned long flags;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry, *tmp;
         int i;
 
@@ -1870,7 +1869,7 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
                                  * we have no entry in the cache. 7.1.30
                                  */
         if (!hlist_empty(&priv->lec_arp_empty_ones)) {
-                hlist_for_each_entry_safe(entry, node, next,
+                hlist_for_each_entry_safe(entry, next,
                                           &priv->lec_arp_empty_ones, next) {
                         if (memcmp(entry->atm_addr, atm_addr, ATM_ESA_LEN) == 0) {
                                 hlist_del(&entry->next);
@@ -1915,7 +1914,7 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
         memcpy(entry->atm_addr, atm_addr, ATM_ESA_LEN);
         del_timer(&entry->timer);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(tmp, node,
+                hlist_for_each_entry(tmp,
                                      &priv->lec_arp_tables[i], next) {
                         if (entry != tmp &&
                             !memcmp(tmp->atm_addr, atm_addr, ATM_ESA_LEN)) {
@@ -1956,7 +1955,6 @@ lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
               void (*old_push) (struct atm_vcc *vcc, struct sk_buff *skb))
 {
         unsigned long flags;
-        struct hlist_node *node;
         struct lec_arp_table *entry;
         int i, found_entry = 0;
 
@@ -2026,7 +2024,7 @@ lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
                  ioc_data->atm_addr[16], ioc_data->atm_addr[17],
                  ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(entry, node,
+                hlist_for_each_entry(entry,
                                      &priv->lec_arp_tables[i], next) {
                         if (memcmp
                             (ioc_data->atm_addr, entry->atm_addr,
@@ -2103,7 +2101,6 @@ out:
 static void lec_flush_complete(struct lec_priv *priv, unsigned long tran_id)
 {
         unsigned long flags;
-        struct hlist_node *node;
         struct lec_arp_table *entry;
         int i;
 
@@ -2111,7 +2108,7 @@ static void lec_flush_complete(struct lec_priv *priv, unsigned long tran_id)
 restart:
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(entry, node,
+                hlist_for_each_entry(entry,
                                      &priv->lec_arp_tables[i], next) {
                         if (entry->flush_tran_id == tran_id &&
                             entry->status == ESI_FLUSH_PENDING) {
@@ -2140,13 +2137,12 @@ lec_set_flush_tran_id(struct lec_priv *priv,
                       const unsigned char *atm_addr, unsigned long tran_id)
 {
         unsigned long flags;
-        struct hlist_node *node;
         struct lec_arp_table *entry;
         int i;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++)
-                hlist_for_each_entry(entry, node,
+                hlist_for_each_entry(entry,
                                      &priv->lec_arp_tables[i], next) {
                         if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN)) {
                                 entry->flush_tran_id = tran_id;
@@ -2198,7 +2194,7 @@ out:
 static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
 {
         unsigned long flags;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry;
         int i;
 
@@ -2208,7 +2204,7 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
 
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next,
+                hlist_for_each_entry_safe(entry, next,
                                           &priv->lec_arp_tables[i], next) {
                         if (vcc == entry->vcc) {
                                 lec_arp_remove(priv, entry);
@@ -2219,7 +2215,7 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
                 }
         }
 
-        hlist_for_each_entry_safe(entry, node, next,
+        hlist_for_each_entry_safe(entry, next,
                                   &priv->lec_arp_empty_ones, next) {
                 if (entry->vcc == vcc) {
                         lec_arp_clear_vccs(entry);
@@ -2229,7 +2225,7 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
                 }
         }
 
-        hlist_for_each_entry_safe(entry, node, next,
+        hlist_for_each_entry_safe(entry, next,
                                   &priv->lec_no_forward, next) {
                 if (entry->recv_vcc == vcc) {
                         lec_arp_clear_vccs(entry);
@@ -2239,7 +2235,7 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
                 }
         }
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->mcast_fwds, next) {
+        hlist_for_each_entry_safe(entry, next, &priv->mcast_fwds, next) {
                 if (entry->recv_vcc == vcc) {
                         lec_arp_clear_vccs(entry);
                         /* No timer, LANEv2 7.1.20 and 2.3.5.3 */
@@ -2257,13 +2253,13 @@ lec_arp_check_empties(struct lec_priv *priv,
                       struct atm_vcc *vcc, struct sk_buff *skb)
 {
         unsigned long flags;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         struct lec_arp_table *entry, *tmp;
         struct lecdatahdr_8023 *hdr = (struct lecdatahdr_8023 *)skb->data;
         unsigned char *src = hdr->h_source;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        hlist_for_each_entry_safe(entry, node, next,
+        hlist_for_each_entry_safe(entry, next,
                                   &priv->lec_arp_empty_ones, next) {
                 if (vcc == entry->vcc) {
                         del_timer(&entry->timer);
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index 86767ca908a3..4176887e72eb 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -217,7 +217,6 @@ static void purge_vcc(struct atm_vcc *vcc)
 
 static void sigd_close(struct atm_vcc *vcc)
 {
-        struct hlist_node *node;
         struct sock *s;
         int i;
 
@@ -231,7 +230,7 @@ static void sigd_close(struct atm_vcc *vcc)
         for (i = 0; i < VCC_HTABLE_SIZE; ++i) {
                 struct hlist_head *head = &vcc_hash[i];
 
-                sk_for_each(s, node, head) {
+                sk_for_each(s, head) {
                         vcc = atm_sk(s);
 
                         purge_vcc(vcc);
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 69a06c47b648..7b11f8bc5071 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -81,14 +81,13 @@ static void ax25_kill_by_device(struct net_device *dev)
 {
         ax25_dev *ax25_dev;
         ax25_cb *s;
-        struct hlist_node *node;
 
         if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
                 return;
 
         spin_lock_bh(&ax25_list_lock);
 again:
-        ax25_for_each(s, node, &ax25_list) {
+        ax25_for_each(s, &ax25_list) {
                 if (s->ax25_dev == ax25_dev) {
                         s->ax25_dev = NULL;
                         spin_unlock_bh(&ax25_list_lock);
@@ -158,10 +157,9 @@ struct sock *ax25_find_listener(ax25_address *addr, int digi,
         struct net_device *dev, int type)
 {
         ax25_cb *s;
-        struct hlist_node *node;
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(s, node, &ax25_list) {
+        ax25_for_each(s, &ax25_list) {
                 if ((s->iamdigi && !digi) || (!s->iamdigi && digi))
                         continue;
                 if (s->sk && !ax25cmp(&s->source_addr, addr) &&
@@ -187,10 +185,9 @@ struct sock *ax25_get_socket(ax25_address *my_addr, ax25_address *dest_addr,
 {
         struct sock *sk = NULL;
         ax25_cb *s;
-        struct hlist_node *node;
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(s, node, &ax25_list) {
+        ax25_for_each(s, &ax25_list) {
                 if (s->sk && !ax25cmp(&s->source_addr, my_addr) &&
                     !ax25cmp(&s->dest_addr, dest_addr) &&
                     s->sk->sk_type == type) {
@@ -213,10 +210,9 @@ ax25_cb *ax25_find_cb(ax25_address *src_addr, ax25_address *dest_addr,
         ax25_digi *digi, struct net_device *dev)
 {
         ax25_cb *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&ax25_list_lock);
-        ax25_for_each(s, node, &ax25_list) {
+        ax25_for_each(s, &ax25_list) {
                 if (s->sk && s->sk->sk_type != SOCK_SEQPACKET)
                         continue;
                 if (s->ax25_dev == NULL)
@@ -248,10 +244,9 @@ void ax25_send_to_raw(ax25_address *addr, struct sk_buff *skb, int proto)
 {
         ax25_cb *s;
         struct sk_buff *copy;
-        struct hlist_node *node;
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(s, node, &ax25_list) {
+        ax25_for_each(s, &ax25_list) {
                 if (s->sk != NULL && ax25cmp(&s->source_addr, addr) == 0 &&
                     s->sk->sk_type == SOCK_RAW &&
                     s->sk->sk_protocol == proto &&
diff --git a/net/ax25/ax25_ds_subr.c b/net/ax25/ax25_ds_subr.c
index 5ea7fd3e2af9..e05bd57b5afd 100644
--- a/net/ax25/ax25_ds_subr.c
+++ b/net/ax25/ax25_ds_subr.c
@@ -39,7 +39,6 @@ void ax25_ds_nr_error_recovery(ax25_cb *ax25)
 void ax25_ds_enquiry_response(ax25_cb *ax25)
 {
         ax25_cb *ax25o;
-        struct hlist_node *node;
 
         /* Please note that neither DK4EG's nor DG2FEF's
          * DAMA spec mention the following behaviour as seen
@@ -80,7 +79,7 @@ void ax25_ds_enquiry_response(ax25_cb *ax25)
         ax25_ds_set_timer(ax25->ax25_dev);
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(ax25o, node, &ax25_list) {
+        ax25_for_each(ax25o, &ax25_list) {
                 if (ax25o == ax25)
                         continue;
 
@@ -159,10 +158,9 @@ static int ax25_check_dama_slave(ax25_dev *ax25_dev)
 {
         ax25_cb *ax25;
         int res = 0;
-        struct hlist_node *node;
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(ax25, node, &ax25_list)
+        ax25_for_each(ax25, &ax25_list)
                 if (ax25->ax25_dev == ax25_dev && (ax25->condition & AX25_COND_DAMA_MODE) && ax25->state > AX25_STATE_1) {
                         res = 1;
                         break;
diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
index 993c439b4f71..951cd57bb07d 100644
--- a/net/ax25/ax25_ds_timer.c
+++ b/net/ax25/ax25_ds_timer.c
@@ -70,7 +70,6 @@ static void ax25_ds_timeout(unsigned long arg)
 {
         ax25_dev *ax25_dev = (struct ax25_dev *) arg;
         ax25_cb *ax25;
-        struct hlist_node *node;
 
         if (ax25_dev == NULL || !ax25_dev->dama.slave)
                 return;                 /* Yikes! */
@@ -81,7 +80,7 @@ static void ax25_ds_timeout(unsigned long arg)
         }
 
         spin_lock(&ax25_list_lock);
-        ax25_for_each(ax25, node, &ax25_list) {
+        ax25_for_each(ax25, &ax25_list) {
                 if (ax25->ax25_dev != ax25_dev || !(ax25->condition & AX25_COND_DAMA_MODE))
                         continue;
 
diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c
index 7d5f24b82cc8..7f16e8a931b2 100644
--- a/net/ax25/ax25_iface.c
+++ b/net/ax25/ax25_iface.c
@@ -193,10 +193,9 @@ int ax25_listen_mine(ax25_address *callsign, struct net_device *dev)
 void ax25_link_failed(ax25_cb *ax25, int reason)
 {
         struct ax25_linkfail *lf;
-        struct hlist_node *node;
 
         spin_lock_bh(&linkfail_lock);
-        hlist_for_each_entry(lf, node, &ax25_linkfail_list, lf_node)
+        hlist_for_each_entry(lf, &ax25_linkfail_list, lf_node)
                 lf->func(ax25, reason);
         spin_unlock_bh(&linkfail_lock);
 }
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index 957999e43ff7..71c4badbc807 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -54,10 +54,9 @@ EXPORT_SYMBOL(ax25_uid_policy);
 ax25_uid_assoc *ax25_findbyuid(kuid_t uid)
 {
         ax25_uid_assoc *ax25_uid, *res = NULL;
-        struct hlist_node *node;
 
         read_lock(&ax25_uid_lock);
-        ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+        ax25_uid_for_each(ax25_uid, &ax25_uid_list) {
                 if (uid_eq(ax25_uid->uid, uid)) {
                         ax25_uid_hold(ax25_uid);
                         res = ax25_uid;
@@ -74,7 +73,6 @@ EXPORT_SYMBOL(ax25_findbyuid);
 int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 {
         ax25_uid_assoc *ax25_uid;
-        struct hlist_node *node;
         ax25_uid_assoc *user;
         unsigned long res;
 
@@ -82,7 +80,7 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
         case SIOCAX25GETUID:
                 res = -ENOENT;
                 read_lock(&ax25_uid_lock);
-                ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+                ax25_uid_for_each(ax25_uid, &ax25_uid_list) {
                         if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0) {
                                 res = from_kuid_munged(current_user_ns(), ax25_uid->uid);
                                 break;
@@ -126,7 +124,7 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 
                 ax25_uid = NULL;
                 write_lock(&ax25_uid_lock);
-                ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+                ax25_uid_for_each(ax25_uid, &ax25_uid_list) {
                         if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0)
                                 break;
                 }
@@ -212,11 +210,10 @@ const struct file_operations ax25_uid_fops = {
 void __exit ax25_uid_free(void)
 {
         ax25_uid_assoc *ax25_uid;
-        struct hlist_node *node;
 
         write_lock(&ax25_uid_lock);
 again:
-        ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+        ax25_uid_for_each(ax25_uid, &ax25_uid_list) {
                 hlist_del_init(&ax25_uid->uid_node);
                 ax25_uid_put(ax25_uid);
                 goto again;
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 72fe1bbf7721..a0b253ecadaf 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -487,7 +487,6 @@ static void batadv_iv_ogm_queue_add(struct batadv_priv *bat_priv,
          */
         struct batadv_forw_packet *forw_packet_aggr = NULL;
         struct batadv_forw_packet *forw_packet_pos = NULL;
-        struct hlist_node *tmp_node;
         struct batadv_ogm_packet *batadv_ogm_packet;
         bool direct_link;
         unsigned long max_aggregation_jiffies;
@@ -500,7 +499,7 @@ static void batadv_iv_ogm_queue_add(struct batadv_priv *bat_priv,
         spin_lock_bh(&bat_priv->forw_bat_list_lock);
         /* own packets are not to be aggregated */
         if ((atomic_read(&bat_priv->aggregated_ogms)) && (!own_packet)) {
-                hlist_for_each_entry(forw_packet_pos, tmp_node,
+                hlist_for_each_entry(forw_packet_pos,
                                      &bat_priv->forw_bat_list, list) {
                         if (batadv_iv_ogm_can_aggregate(batadv_ogm_packet,
                                                         bat_priv, packet_len,
@@ -655,7 +654,6 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         struct batadv_neigh_node *neigh_node = NULL, *tmp_neigh_node = NULL;
         struct batadv_neigh_node *router = NULL;
         struct batadv_orig_node *orig_node_tmp;
-        struct hlist_node *node;
         int if_num;
         uint8_t sum_orig, sum_neigh;
         uint8_t *neigh_addr;
@@ -665,7 +663,7 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
                    "update_originator(): Searching and updating originator entry of received packet\n");
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(tmp_neigh_node, node,
+        hlist_for_each_entry_rcu(tmp_neigh_node,
                                  &orig_node->neigh_list, list) {
                 neigh_addr = tmp_neigh_node->addr;
                 if (batadv_compare_eth(neigh_addr, ethhdr->h_source) &&
@@ -801,7 +799,6 @@ static int batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
 {
         struct batadv_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct batadv_neigh_node *neigh_node = NULL, *tmp_neigh_node;
-        struct hlist_node *node;
         uint8_t total_count;
         uint8_t orig_eq_count, neigh_rq_count, neigh_rq_inv, tq_own;
         unsigned int neigh_rq_inv_cube, neigh_rq_max_cube;
@@ -810,7 +807,7 @@ static int batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
 
         /* find corresponding one hop neighbor */
         rcu_read_lock();
-        hlist_for_each_entry_rcu(tmp_neigh_node, node,
+        hlist_for_each_entry_rcu(tmp_neigh_node,
                                  &orig_neigh_node->neigh_list, list) {
                 if (!batadv_compare_eth(tmp_neigh_node->addr,
                                         orig_neigh_node->orig))
@@ -920,7 +917,6 @@ batadv_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
         struct batadv_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct batadv_orig_node *orig_node;
         struct batadv_neigh_node *tmp_neigh_node;
-        struct hlist_node *node;
         int is_duplicate = 0;
         int32_t seq_diff;
         int need_update = 0;
@@ -943,7 +939,7 @@ batadv_iv_ogm_update_seqnos(const struct ethhdr *ethhdr,
                 goto out;
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(tmp_neigh_node, node,
+        hlist_for_each_entry_rcu(tmp_neigh_node,
                                  &orig_node->neigh_list, list) {
                 is_duplicate |= batadv_test_bit(tmp_neigh_node->real_bits,
                                                 orig_node->last_real_seqno,
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 30f46526cbbd..6a4f728680ae 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -144,7 +144,6 @@ static struct batadv_bla_claim
 {
         struct batadv_hashtable *hash = bat_priv->bla.claim_hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_bla_claim *claim;
         struct batadv_bla_claim *claim_tmp = NULL;
         int index;
@@ -156,7 +155,7 @@ static struct batadv_bla_claim
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(claim, head, hash_entry) {
                 if (!batadv_compare_claim(&claim->hash_entry, data))
                         continue;
 
@@ -185,7 +184,6 @@ batadv_backbone_hash_find(struct batadv_priv *bat_priv,
 {
         struct batadv_hashtable *hash = bat_priv->bla.backbone_hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_bla_backbone_gw search_entry, *backbone_gw;
         struct batadv_bla_backbone_gw *backbone_gw_tmp = NULL;
         int index;
@@ -200,7 +198,7 @@ batadv_backbone_hash_find(struct batadv_priv *bat_priv,
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                 if (!batadv_compare_backbone_gw(&backbone_gw->hash_entry,
                                                 &search_entry))
                         continue;
@@ -221,7 +219,7 @@ static void
 batadv_bla_del_backbone_claims(struct batadv_bla_backbone_gw *backbone_gw)
 {
         struct batadv_hashtable *hash;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         struct batadv_bla_claim *claim;
         int i;
@@ -236,13 +234,13 @@ batadv_bla_del_backbone_claims(struct batadv_bla_backbone_gw *backbone_gw)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(claim, node, node_tmp,
+                hlist_for_each_entry_safe(claim, node_tmp,
                                           head, hash_entry) {
                         if (claim->backbone_gw != backbone_gw)
                                 continue;
 
                         batadv_claim_free_ref(claim);
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&claim->hash_entry);
                 }
                 spin_unlock_bh(list_lock);
         }
@@ -460,7 +458,6 @@ static void batadv_bla_answer_request(struct batadv_priv *bat_priv,
                                       struct batadv_hard_iface *primary_if,
                                       short vid)
 {
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_hashtable *hash;
         struct batadv_bla_claim *claim;
@@ -481,7 +478,7 @@ static void batadv_bla_answer_request(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(claim, head, hash_entry) {
                         /* only own claims are interesting */
                         if (claim->backbone_gw != backbone_gw)
                                 continue;
@@ -958,7 +955,7 @@ static int batadv_bla_process_claim(struct batadv_priv *bat_priv,
 static void batadv_bla_purge_backbone_gw(struct batadv_priv *bat_priv, int now)
 {
         struct batadv_bla_backbone_gw *backbone_gw;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         struct batadv_hashtable *hash;
         spinlock_t *list_lock;  /* protects write access to the hash lists */
@@ -973,7 +970,7 @@ static void batadv_bla_purge_backbone_gw(struct batadv_priv *bat_priv, int now)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(backbone_gw, node, node_tmp,
+                hlist_for_each_entry_safe(backbone_gw, node_tmp,
                                           head, hash_entry) {
                         if (now)
                                 goto purge_now;
@@ -992,7 +989,7 @@ purge_now:
 
                         batadv_bla_del_backbone_claims(backbone_gw);
 
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&backbone_gw->hash_entry);
                         batadv_backbone_gw_free_ref(backbone_gw);
                 }
                 spin_unlock_bh(list_lock);
@@ -1013,7 +1010,6 @@ static void batadv_bla_purge_claims(struct batadv_priv *bat_priv,
                                     int now)
 {
         struct batadv_bla_claim *claim;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_hashtable *hash;
         int i;
@@ -1026,7 +1022,7 @@ static void batadv_bla_purge_claims(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(claim, head, hash_entry) {
                         if (now)
                                 goto purge_now;
                         if (!batadv_compare_eth(claim->backbone_gw->orig,
@@ -1062,7 +1058,6 @@ void batadv_bla_update_orig_address(struct batadv_priv *bat_priv,
                                     struct batadv_hard_iface *oldif)
 {
         struct batadv_bla_backbone_gw *backbone_gw;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_hashtable *hash;
         __be16 group;
@@ -1086,7 +1081,7 @@ void batadv_bla_update_orig_address(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                         /* own orig still holds the old value. */
                         if (!batadv_compare_eth(backbone_gw->orig,
                                                 oldif->net_dev->dev_addr))
@@ -1112,7 +1107,6 @@ static void batadv_bla_periodic_work(struct work_struct *work)
         struct delayed_work *delayed_work;
         struct batadv_priv *bat_priv;
         struct batadv_priv_bla *priv_bla;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_bla_backbone_gw *backbone_gw;
         struct batadv_hashtable *hash;
@@ -1140,7 +1134,7 @@ static void batadv_bla_periodic_work(struct work_struct *work)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                         if (!batadv_compare_eth(backbone_gw->orig,
                                                 primary_if->net_dev->dev_addr))
                                 continue;
@@ -1322,7 +1316,6 @@ int batadv_bla_is_backbone_gw_orig(struct batadv_priv *bat_priv, uint8_t *orig)
 {
         struct batadv_hashtable *hash = bat_priv->bla.backbone_hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_bla_backbone_gw *backbone_gw;
         int i;
 
@@ -1336,7 +1329,7 @@ int batadv_bla_is_backbone_gw_orig(struct batadv_priv *bat_priv, uint8_t *orig)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                         if (batadv_compare_eth(backbone_gw->orig, orig)) {
                                 rcu_read_unlock();
                                 return 1;
@@ -1607,7 +1600,6 @@ int batadv_bla_claim_table_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_hashtable *hash = bat_priv->bla.claim_hash;
         struct batadv_bla_claim *claim;
         struct batadv_hard_iface *primary_if;
-        struct hlist_node *node;
         struct hlist_head *head;
         uint32_t i;
         bool is_own;
@@ -1628,7 +1620,7 @@ int batadv_bla_claim_table_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(claim, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(claim, head, hash_entry) {
                         is_own = batadv_compare_eth(claim->backbone_gw->orig,
                                                     primary_addr);
                         seq_printf(seq, " * %pM on % 5d by %pM [%c] (%#.4x)\n",
@@ -1652,7 +1644,6 @@ int batadv_bla_backbone_table_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_hashtable *hash = bat_priv->bla.backbone_hash;
         struct batadv_bla_backbone_gw *backbone_gw;
         struct batadv_hard_iface *primary_if;
-        struct hlist_node *node;
         struct hlist_head *head;
         int secs, msecs;
         uint32_t i;
@@ -1674,7 +1665,7 @@ int batadv_bla_backbone_table_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(backbone_gw, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                         msecs = jiffies_to_msecs(jiffies -
                                                  backbone_gw->lasttime);
                         secs = msecs / 1000;
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 761a59002e34..d54188a112ea 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -83,7 +83,7 @@ static void __batadv_dat_purge(struct batadv_priv *bat_priv,
 {
         spinlock_t *list_lock; /* protects write access to the hash lists */
         struct batadv_dat_entry *dat_entry;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         uint32_t i;
 
@@ -95,7 +95,7 @@ static void __batadv_dat_purge(struct batadv_priv *bat_priv,
                 list_lock = &bat_priv->dat.hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(dat_entry, node, node_tmp, head,
+                hlist_for_each_entry_safe(dat_entry, node_tmp, head,
                                           hash_entry) {
                         /* if an helper function has been passed as parameter,
                          * ask it if the entry has to be purged or not
@@ -103,7 +103,7 @@ static void __batadv_dat_purge(struct batadv_priv *bat_priv,
                         if (to_purge && !to_purge(dat_entry))
                                 continue;
 
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&dat_entry->hash_entry);
                         batadv_dat_entry_free_ref(dat_entry);
                 }
                 spin_unlock_bh(list_lock);
@@ -235,7 +235,6 @@ static struct batadv_dat_entry *
 batadv_dat_entry_hash_find(struct batadv_priv *bat_priv, __be32 ip)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_dat_entry *dat_entry, *dat_entry_tmp = NULL;
         struct batadv_hashtable *hash = bat_priv->dat.hash;
         uint32_t index;
@@ -247,7 +246,7 @@ batadv_dat_entry_hash_find(struct batadv_priv *bat_priv, __be32 ip)
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(dat_entry, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(dat_entry, head, hash_entry) {
                 if (dat_entry->ip != ip)
                         continue;
 
@@ -465,7 +464,6 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,
         batadv_dat_addr_t max = 0, tmp_max = 0;
         struct batadv_orig_node *orig_node, *max_orig_node = NULL;
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         int i;
 
@@ -481,7 +479,7 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         /* the dht space is a ring and addresses are unsigned */
                         tmp_max = BATADV_DAT_ADDR_MAX - orig_node->dat_addr +
                                   ip_key;
@@ -686,7 +684,6 @@ int batadv_dat_cache_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_hashtable *hash = bat_priv->dat.hash;
         struct batadv_dat_entry *dat_entry;
         struct batadv_hard_iface *primary_if;
-        struct hlist_node *node;
         struct hlist_head *head;
         unsigned long last_seen_jiffies;
         int last_seen_msecs, last_seen_secs, last_seen_mins;
@@ -704,7 +701,7 @@ int batadv_dat_cache_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(dat_entry, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(dat_entry, head, hash_entry) {
                         last_seen_jiffies = jiffies - dat_entry->last_update;
                         last_seen_msecs = jiffies_to_msecs(last_seen_jiffies);
                         last_seen_mins = last_seen_msecs / 60000;
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index 074107f2cfaa..34f99a46ec1d 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -114,7 +114,6 @@ static struct batadv_gw_node *
 batadv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
 {
         struct batadv_neigh_node *router;
-        struct hlist_node *node;
         struct batadv_gw_node *gw_node, *curr_gw = NULL;
         uint32_t max_gw_factor = 0, tmp_gw_factor = 0;
         uint32_t gw_divisor;
@@ -127,7 +126,7 @@ batadv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
         gw_divisor *= 64;
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw.list, list) {
+        hlist_for_each_entry_rcu(gw_node, &bat_priv->gw.list, list) {
                 if (gw_node->deleted)
                         continue;
 
@@ -344,7 +343,6 @@ void batadv_gw_node_update(struct batadv_priv *bat_priv,
                            struct batadv_orig_node *orig_node,
                            uint8_t new_gwflags)
 {
-        struct hlist_node *node;
         struct batadv_gw_node *gw_node, *curr_gw;
 
         /* Note: We don't need a NULL check here, since curr_gw never gets
@@ -355,7 +353,7 @@ void batadv_gw_node_update(struct batadv_priv *bat_priv,
         curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw.list, list) {
+        hlist_for_each_entry_rcu(gw_node, &bat_priv->gw.list, list) {
                 if (gw_node->orig_node != orig_node)
                         continue;
 
@@ -403,7 +401,7 @@ void batadv_gw_node_delete(struct batadv_priv *bat_priv,
 void batadv_gw_node_purge(struct batadv_priv *bat_priv)
 {
         struct batadv_gw_node *gw_node, *curr_gw;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         unsigned long timeout = msecs_to_jiffies(2 * BATADV_PURGE_TIMEOUT);
         int do_deselect = 0;
 
@@ -411,7 +409,7 @@ void batadv_gw_node_purge(struct batadv_priv *bat_priv)
 
         spin_lock_bh(&bat_priv->gw.list_lock);
 
-        hlist_for_each_entry_safe(gw_node, node, node_tmp,
+        hlist_for_each_entry_safe(gw_node, node_tmp,
                                   &bat_priv->gw.list, list) {
                 if (((!gw_node->deleted) ||
                      (time_before(jiffies, gw_node->deleted + timeout))) &&
@@ -476,7 +474,6 @@ int batadv_gw_client_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_priv *bat_priv = netdev_priv(net_dev);
         struct batadv_hard_iface *primary_if;
         struct batadv_gw_node *gw_node;
-        struct hlist_node *node;
         int gw_count = 0;
 
         primary_if = batadv_seq_print_text_primary_if_get(seq);
@@ -490,7 +487,7 @@ int batadv_gw_client_seq_print_text(struct seq_file *seq, void *offset)
                    primary_if->net_dev->dev_addr, net_dev->name);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw.list, list) {
+        hlist_for_each_entry_rcu(gw_node, &bat_priv->gw.list, list) {
                 if (gw_node->deleted)
                         continue;
 
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 21fe6987733b..0488d70c8c35 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -345,9 +345,8 @@ void batadv_recv_handler_unregister(uint8_t packet_type)
 static struct batadv_algo_ops *batadv_algo_get(char *name)
 {
         struct batadv_algo_ops *bat_algo_ops = NULL, *bat_algo_ops_tmp;
-        struct hlist_node *node;
 
-        hlist_for_each_entry(bat_algo_ops_tmp, node, &batadv_algo_list, list) {
+        hlist_for_each_entry(bat_algo_ops_tmp, &batadv_algo_list, list) {
                 if (strcmp(bat_algo_ops_tmp->name, name) != 0)
                         continue;
 
@@ -411,11 +410,10 @@ out:
 int batadv_algo_seq_print_text(struct seq_file *seq, void *offset)
 {
         struct batadv_algo_ops *bat_algo_ops;
-        struct hlist_node *node;
 
         seq_printf(seq, "Available routing algorithms:\n");
 
-        hlist_for_each_entry(bat_algo_ops, node, &batadv_algo_list, list) {
+        hlist_for_each_entry(bat_algo_ops, &batadv_algo_list, list) {
                 seq_printf(seq, "%s\n", bat_algo_ops->name);
         }
 
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 457ea445217c..96fb80b724dc 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -118,7 +118,7 @@ out:
 
 static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
 {
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct batadv_neigh_node *neigh_node, *tmp_neigh_node;
         struct batadv_orig_node *orig_node;
 
@@ -134,7 +134,7 @@ static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
         }
 
         /* for all neighbors towards this originator ... */
-        hlist_for_each_entry_safe(neigh_node, node, node_tmp,
+        hlist_for_each_entry_safe(neigh_node, node_tmp,
                                   &orig_node->neigh_list, list) {
                 hlist_del_rcu(&neigh_node->list);
                 batadv_neigh_node_free_ref(neigh_node);
@@ -161,7 +161,7 @@ void batadv_orig_node_free_ref(struct batadv_orig_node *orig_node)
 void batadv_originator_free(struct batadv_priv *bat_priv)
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         spinlock_t *list_lock; /* spinlock to protect write access */
         struct batadv_orig_node *orig_node;
@@ -179,9 +179,9 @@ void batadv_originator_free(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(orig_node, node, node_tmp,
+                hlist_for_each_entry_safe(orig_node, node_tmp,
                                           head, hash_entry) {
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&orig_node->hash_entry);
                         batadv_orig_node_free_ref(orig_node);
                 }
                 spin_unlock_bh(list_lock);
@@ -274,7 +274,7 @@ batadv_purge_orig_neighbors(struct batadv_priv *bat_priv,
                             struct batadv_orig_node *orig_node,
                             struct batadv_neigh_node **best_neigh_node)
 {
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct batadv_neigh_node *neigh_node;
         bool neigh_purged = false;
         unsigned long last_seen;
@@ -285,7 +285,7 @@ batadv_purge_orig_neighbors(struct batadv_priv *bat_priv,
         spin_lock_bh(&orig_node->neigh_list_lock);
 
         /* for all neighbors towards this originator ... */
-        hlist_for_each_entry_safe(neigh_node, node, node_tmp,
+        hlist_for_each_entry_safe(neigh_node, node_tmp,
                                   &orig_node->neigh_list, list) {
                 last_seen = neigh_node->last_seen;
                 if_incoming = neigh_node->if_incoming;
@@ -348,7 +348,7 @@ static bool batadv_purge_orig_node(struct batadv_priv *bat_priv,
 static void _batadv_purge_orig(struct batadv_priv *bat_priv)
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         spinlock_t *list_lock; /* spinlock to protect write access */
         struct batadv_orig_node *orig_node;
@@ -363,13 +363,13 @@ static void _batadv_purge_orig(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(orig_node, node, node_tmp,
+                hlist_for_each_entry_safe(orig_node, node_tmp,
                                           head, hash_entry) {
                         if (batadv_purge_orig_node(bat_priv, orig_node)) {
                                 if (orig_node->gw_flags)
                                         batadv_gw_node_delete(bat_priv,
                                                               orig_node);
-                                hlist_del_rcu(node);
+                                hlist_del_rcu(&orig_node->hash_entry);
                                 batadv_orig_node_free_ref(orig_node);
                                 continue;
                         }
@@ -408,7 +408,6 @@ int batadv_orig_seq_print_text(struct seq_file *seq, void *offset)
         struct net_device *net_dev = (struct net_device *)seq->private;
         struct batadv_priv *bat_priv = netdev_priv(net_dev);
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node, *node_tmp;
         struct hlist_head *head;
         struct batadv_hard_iface *primary_if;
         struct batadv_orig_node *orig_node;
@@ -434,7 +433,7 @@ int batadv_orig_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         neigh_node = batadv_orig_node_get_router(orig_node);
                         if (!neigh_node)
                                 continue;
@@ -453,7 +452,7 @@ int batadv_orig_seq_print_text(struct seq_file *seq, void *offset)
                                    neigh_node->addr,
                                    neigh_node->if_incoming->net_dev->name);
 
-                        hlist_for_each_entry_rcu(neigh_node_tmp, node_tmp,
+                        hlist_for_each_entry_rcu(neigh_node_tmp,
                                                  &orig_node->neigh_list, list) {
                                 seq_printf(seq, " %pM (%3i)",
                                            neigh_node_tmp->addr,
@@ -511,7 +510,6 @@ int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface,
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_orig_node *orig_node;
         uint32_t i;
@@ -524,7 +522,7 @@ int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         spin_lock_bh(&orig_node->ogm_cnt_lock);
                         ret = batadv_orig_node_add_if(orig_node, max_if_num);
                         spin_unlock_bh(&orig_node->ogm_cnt_lock);
@@ -595,7 +593,6 @@ int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface,
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_hard_iface *hard_iface_tmp;
         struct batadv_orig_node *orig_node;
@@ -609,7 +606,7 @@ int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         spin_lock_bh(&orig_node->ogm_cnt_lock);
                         ret = batadv_orig_node_del_if(orig_node, max_if_num,
                                                       hard_iface->if_num);
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 286bf743e76a..7df48fa7669d 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -68,7 +68,6 @@ batadv_orig_hash_find(struct batadv_priv *bat_priv, const void *data)
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_orig_node *orig_node, *orig_node_tmp = NULL;
         int index;
 
@@ -79,7 +78,7 @@ batadv_orig_hash_find(struct batadv_priv *bat_priv, const void *data)
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                 if (!batadv_compare_eth(orig_node, data))
                         continue;
 
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 60ba03fc8390..5ee21cebbbb0 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -37,7 +37,6 @@ void batadv_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_orig_node *orig_node;
         unsigned long *word;
@@ -49,7 +48,7 @@ void batadv_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         spin_lock_bh(&orig_node->ogm_cnt_lock);
                         word_index = hard_iface->if_num * BATADV_NUM_WORDS;
                         word = &(orig_node->bcast_own[word_index]);
@@ -146,7 +145,6 @@ out:
 void batadv_bonding_candidate_add(struct batadv_orig_node *orig_node,
                                   struct batadv_neigh_node *neigh_node)
 {
-        struct hlist_node *node;
         struct batadv_neigh_node *tmp_neigh_node, *router = NULL;
         uint8_t interference_candidate = 0;
 
@@ -169,7 +167,7 @@ void batadv_bonding_candidate_add(struct batadv_orig_node *orig_node,
          * interface. If we do, we won't select this candidate because of
          * possible interference.
          */
-        hlist_for_each_entry_rcu(tmp_neigh_node, node,
+        hlist_for_each_entry_rcu(tmp_neigh_node,
                                  &orig_node->neigh_list, list) {
                 if (tmp_neigh_node == neigh_node)
                         continue;
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 80ca65fc89a1..a67cffde37ae 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -316,7 +316,7 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
                                  const struct batadv_hard_iface *hard_iface)
 {
         struct batadv_forw_packet *forw_packet;
-        struct hlist_node *tmp_node, *safe_tmp_node;
+        struct hlist_node *safe_tmp_node;
         bool pending;
 
         if (hard_iface)
@@ -329,7 +329,7 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
 
         /* free bcast list */
         spin_lock_bh(&bat_priv->forw_bcast_list_lock);
-        hlist_for_each_entry_safe(forw_packet, tmp_node, safe_tmp_node,
+        hlist_for_each_entry_safe(forw_packet, safe_tmp_node,
                                   &bat_priv->forw_bcast_list, list) {
                 /* if purge_outstanding_packets() was called with an argument
                  * we delete only packets belonging to the given interface
@@ -355,7 +355,7 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
 
         /* free batman packet list */
         spin_lock_bh(&bat_priv->forw_bat_list_lock);
-        hlist_for_each_entry_safe(forw_packet, tmp_node, safe_tmp_node,
+        hlist_for_each_entry_safe(forw_packet, safe_tmp_node,
                                   &bat_priv->forw_bat_list, list) {
                 /* if purge_outstanding_packets() was called with an argument
                  * we delete only packets belonging to the given interface
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index d44672f4a349..98a66a021a60 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -56,7 +56,6 @@ static struct batadv_tt_common_entry *
 batadv_tt_hash_find(struct batadv_hashtable *hash, const void *data)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_common_entry *tt_common_entry_tmp = NULL;
         uint32_t index;
@@ -68,7 +67,7 @@ batadv_tt_hash_find(struct batadv_hashtable *hash, const void *data)
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(tt_common_entry, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(tt_common_entry, head, hash_entry) {
                 if (!batadv_compare_eth(tt_common_entry, data))
                         continue;
 
@@ -257,7 +256,6 @@ void batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
         struct batadv_tt_local_entry *tt_local;
         struct batadv_tt_global_entry *tt_global;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_orig_list_entry *orig_entry;
         int hash_added;
         bool roamed_back = false;
@@ -339,7 +337,7 @@ check_roaming:
                 /* These node are probably going to update their tt table */
                 head = &tt_global->orig_list;
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+                hlist_for_each_entry_rcu(orig_entry, head, list) {
                         batadv_send_roam_adv(bat_priv, tt_global->common.addr,
                                              orig_entry->orig_node);
                 }
@@ -470,7 +468,6 @@ int batadv_tt_local_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_local_entry *tt_local;
         struct batadv_hard_iface *primary_if;
-        struct hlist_node *node;
         struct hlist_head *head;
         uint32_t i;
         int last_seen_secs;
@@ -494,7 +491,7 @@ int batadv_tt_local_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common_entry, node,
+                hlist_for_each_entry_rcu(tt_common_entry,
                                          head, hash_entry) {
                         tt_local = container_of(tt_common_entry,
                                                 struct batadv_tt_local_entry,
@@ -605,9 +602,9 @@ static void batadv_tt_local_purge_list(struct batadv_priv *bat_priv,
 {
         struct batadv_tt_local_entry *tt_local_entry;
         struct batadv_tt_common_entry *tt_common_entry;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
 
-        hlist_for_each_entry_safe(tt_common_entry, node, node_tmp, head,
+        hlist_for_each_entry_safe(tt_common_entry, node_tmp, head,
                                   hash_entry) {
                 tt_local_entry = container_of(tt_common_entry,
                                               struct batadv_tt_local_entry,
@@ -651,7 +648,7 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
         spinlock_t *list_lock; /* protects write access to the hash lists */
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_local_entry *tt_local;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         uint32_t i;
 
@@ -665,9 +662,9 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(tt_common_entry, node, node_tmp,
+                hlist_for_each_entry_safe(tt_common_entry, node_tmp,
                                           head, hash_entry) {
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&tt_common_entry->hash_entry);
                         tt_local = container_of(tt_common_entry,
                                                 struct batadv_tt_local_entry,
                                                 common);
@@ -724,11 +721,10 @@ batadv_tt_global_orig_entry_find(const struct batadv_tt_global_entry *entry,
 {
         struct batadv_tt_orig_list_entry *tmp_orig_entry, *orig_entry = NULL;
         const struct hlist_head *head;
-        struct hlist_node *node;
 
         rcu_read_lock();
         head = &entry->orig_list;
-        hlist_for_each_entry_rcu(tmp_orig_entry, node, head, list) {
+        hlist_for_each_entry_rcu(tmp_orig_entry, head, list) {
                 if (tmp_orig_entry->orig_node != orig_node)
                         continue;
                 if (!atomic_inc_not_zero(&tmp_orig_entry->refcount))
@@ -940,12 +936,11 @@ batadv_transtable_best_orig(struct batadv_tt_global_entry *tt_global_entry)
 {
         struct batadv_neigh_node *router = NULL;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_orig_list_entry *orig_entry, *best_entry = NULL;
         int best_tq = 0;
 
         head = &tt_global_entry->orig_list;
-        hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+        hlist_for_each_entry_rcu(orig_entry, head, list) {
                 router = batadv_orig_node_get_router(orig_entry->orig_node);
                 if (!router)
                         continue;
@@ -973,7 +968,6 @@ batadv_tt_global_print_entry(struct batadv_tt_global_entry *tt_global_entry,
                              struct seq_file *seq)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_orig_list_entry *orig_entry, *best_entry;
         struct batadv_tt_common_entry *tt_common_entry;
         uint16_t flags;
@@ -997,7 +991,7 @@ batadv_tt_global_print_entry(struct batadv_tt_global_entry *tt_global_entry,
 
         head = &tt_global_entry->orig_list;
 
-        hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+        hlist_for_each_entry_rcu(orig_entry, head, list) {
                 if (best_entry == orig_entry)
                         continue;
 
@@ -1020,7 +1014,6 @@ int batadv_tt_global_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_global_entry *tt_global;
         struct batadv_hard_iface *primary_if;
-        struct hlist_node *node;
         struct hlist_head *head;
         uint32_t i;
 
@@ -1039,7 +1032,7 @@ int batadv_tt_global_seq_print_text(struct seq_file *seq, void *offset)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common_entry, node,
+                hlist_for_each_entry_rcu(tt_common_entry,
                                          head, hash_entry) {
                         tt_global = container_of(tt_common_entry,
                                                  struct batadv_tt_global_entry,
@@ -1059,13 +1052,13 @@ static void
 batadv_tt_global_del_orig_list(struct batadv_tt_global_entry *tt_global_entry)
 {
         struct hlist_head *head;
-        struct hlist_node *node, *safe;
+        struct hlist_node *safe;
         struct batadv_tt_orig_list_entry *orig_entry;
 
         spin_lock_bh(&tt_global_entry->list_lock);
         head = &tt_global_entry->orig_list;
-        hlist_for_each_entry_safe(orig_entry, node, safe, head, list) {
-                hlist_del_rcu(node);
+        hlist_for_each_entry_safe(orig_entry, safe, head, list) {
+                hlist_del_rcu(&orig_entry->list);
                 batadv_tt_orig_list_entry_free_ref(orig_entry);
         }
         spin_unlock_bh(&tt_global_entry->list_lock);
@@ -1078,18 +1071,18 @@ batadv_tt_global_del_orig_entry(struct batadv_priv *bat_priv,
                                 const char *message)
 {
         struct hlist_head *head;
-        struct hlist_node *node, *safe;
+        struct hlist_node *safe;
         struct batadv_tt_orig_list_entry *orig_entry;
 
         spin_lock_bh(&tt_global_entry->list_lock);
         head = &tt_global_entry->orig_list;
-        hlist_for_each_entry_safe(orig_entry, node, safe, head, list) {
+        hlist_for_each_entry_safe(orig_entry, safe, head, list) {
                 if (orig_entry->orig_node == orig_node) {
                         batadv_dbg(BATADV_DBG_TT, bat_priv,
                                    "Deleting %pM from global tt entry %pM: %s\n",
                                    orig_node->orig,
                                    tt_global_entry->common.addr, message);
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&orig_entry->list);
                         batadv_tt_orig_list_entry_free_ref(orig_entry);
                 }
         }
@@ -1108,7 +1101,6 @@ batadv_tt_global_del_roaming(struct batadv_priv *bat_priv,
 {
         bool last_entry = true;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_orig_list_entry *orig_entry;
 
         /* no local entry exists, case 1:
@@ -1117,7 +1109,7 @@ batadv_tt_global_del_roaming(struct batadv_priv *bat_priv,
 
         rcu_read_lock();
         head = &tt_global_entry->orig_list;
-        hlist_for_each_entry_rcu(orig_entry, node, head, list) {
+        hlist_for_each_entry_rcu(orig_entry, head, list) {
                 if (orig_entry->orig_node != orig_node) {
                         last_entry = false;
                         break;
@@ -1202,7 +1194,7 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
         struct batadv_tt_common_entry *tt_common_entry;
         uint32_t i;
         struct batadv_hashtable *hash = bat_priv->tt.global_hash;
-        struct hlist_node *node, *safe;
+        struct hlist_node *safe;
         struct hlist_head *head;
         spinlock_t *list_lock; /* protects write access to the hash lists */
 
@@ -1214,7 +1206,7 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(tt_common_entry, node, safe,
+                hlist_for_each_entry_safe(tt_common_entry, safe,
                                           head, hash_entry) {
                         tt_global = container_of(tt_common_entry,
                                                  struct batadv_tt_global_entry,
@@ -1227,7 +1219,7 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
                                 batadv_dbg(BATADV_DBG_TT, bat_priv,
                                            "Deleting global tt entry %pM: %s\n",
                                            tt_global->common.addr, message);
-                                hlist_del_rcu(node);
+                                hlist_del_rcu(&tt_common_entry->hash_entry);
                                 batadv_tt_global_entry_free_ref(tt_global);
                         }
                 }
@@ -1262,7 +1254,7 @@ static void batadv_tt_global_purge(struct batadv_priv *bat_priv)
 {
         struct batadv_hashtable *hash = bat_priv->tt.global_hash;
         struct hlist_head *head;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         spinlock_t *list_lock; /* protects write access to the hash lists */
         uint32_t i;
         char *msg = NULL;
@@ -1274,7 +1266,7 @@ static void batadv_tt_global_purge(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(tt_common, node, node_tmp, head,
+                hlist_for_each_entry_safe(tt_common, node_tmp, head,
                                           hash_entry) {
                         tt_global = container_of(tt_common,
                                                  struct batadv_tt_global_entry,
@@ -1287,7 +1279,7 @@ static void batadv_tt_global_purge(struct batadv_priv *bat_priv)
                                    "Deleting global tt entry (%pM): %s\n",
                                    tt_global->common.addr, msg);
 
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&tt_common->hash_entry);
 
                         batadv_tt_global_entry_free_ref(tt_global);
                 }
@@ -1301,7 +1293,7 @@ static void batadv_tt_global_table_free(struct batadv_priv *bat_priv)
         spinlock_t *list_lock; /* protects write access to the hash lists */
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_global_entry *tt_global;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         uint32_t i;
 
@@ -1315,9 +1307,9 @@ static void batadv_tt_global_table_free(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(tt_common_entry, node, node_tmp,
+                hlist_for_each_entry_safe(tt_common_entry, node_tmp,
                                           head, hash_entry) {
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&tt_common_entry->hash_entry);
                         tt_global = container_of(tt_common_entry,
                                                  struct batadv_tt_global_entry,
                                                  common);
@@ -1397,7 +1389,6 @@ static uint16_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
         struct batadv_hashtable *hash = bat_priv->tt.global_hash;
         struct batadv_tt_common_entry *tt_common;
         struct batadv_tt_global_entry *tt_global;
-        struct hlist_node *node;
         struct hlist_head *head;
         uint32_t i;
         int j;
@@ -1406,7 +1397,7 @@ static uint16_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(tt_common, head, hash_entry) {
                         tt_global = container_of(tt_common,
                                                  struct batadv_tt_global_entry,
                                                  common);
@@ -1449,7 +1440,6 @@ static uint16_t batadv_tt_local_crc(struct batadv_priv *bat_priv)
         uint16_t total = 0, total_one;
         struct batadv_hashtable *hash = bat_priv->tt.local_hash;
         struct batadv_tt_common_entry *tt_common;
-        struct hlist_node *node;
         struct hlist_head *head;
         uint32_t i;
         int j;
@@ -1458,7 +1448,7 @@ static uint16_t batadv_tt_local_crc(struct batadv_priv *bat_priv)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(tt_common, head, hash_entry) {
                         /* not yet committed clients have not to be taken into
                          * account while computing the CRC
                          */
@@ -1597,7 +1587,6 @@ batadv_tt_response_fill_table(uint16_t tt_len, uint8_t ttvn,
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_query_packet *tt_response;
         struct batadv_tt_change *tt_change;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct sk_buff *skb = NULL;
         uint16_t tt_tot, tt_count;
@@ -1627,7 +1616,7 @@ batadv_tt_response_fill_table(uint16_t tt_len, uint8_t ttvn,
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
 
-                hlist_for_each_entry_rcu(tt_common_entry, node,
+                hlist_for_each_entry_rcu(tt_common_entry,
                                          head, hash_entry) {
                         if (tt_count == tt_tot)
                                 break;
@@ -2307,7 +2296,6 @@ static uint16_t batadv_tt_set_flags(struct batadv_hashtable *hash,
         uint32_t i;
         uint16_t changed_num = 0;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_tt_common_entry *tt_common_entry;
 
         if (!hash)
@@ -2317,7 +2305,7 @@ static uint16_t batadv_tt_set_flags(struct batadv_hashtable *hash,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common_entry, node,
+                hlist_for_each_entry_rcu(tt_common_entry,
                                          head, hash_entry) {
                         if (enable) {
                                 if ((tt_common_entry->flags & flags) == flags)
@@ -2342,7 +2330,7 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
         struct batadv_hashtable *hash = bat_priv->tt.local_hash;
         struct batadv_tt_common_entry *tt_common;
         struct batadv_tt_local_entry *tt_local;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         spinlock_t *list_lock; /* protects write access to the hash lists */
         uint32_t i;
@@ -2355,7 +2343,7 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
                 list_lock = &hash->list_locks[i];
 
                 spin_lock_bh(list_lock);
-                hlist_for_each_entry_safe(tt_common, node, node_tmp, head,
+                hlist_for_each_entry_safe(tt_common, node_tmp, head,
                                           hash_entry) {
                         if (!(tt_common->flags & BATADV_TT_CLIENT_PENDING))
                                 continue;
@@ -2365,7 +2353,7 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
                                    tt_common->addr);
 
                         atomic_dec(&bat_priv->tt.local_entry_num);
-                        hlist_del_rcu(node);
+                        hlist_del_rcu(&tt_common->hash_entry);
                         tt_local = container_of(tt_common,
                                                 struct batadv_tt_local_entry,
                                                 common);
diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c
index 22d2785177d1..c053244b97bd 100644
--- a/net/batman-adv/vis.c
+++ b/net/batman-adv/vis.c
@@ -97,7 +97,6 @@ batadv_vis_hash_find(struct batadv_priv *bat_priv, const void *data)
 {
         struct batadv_hashtable *hash = bat_priv->vis.hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct batadv_vis_info *vis_info, *vis_info_tmp = NULL;
         uint32_t index;
 
@@ -108,8 +107,8 @@ batadv_vis_hash_find(struct batadv_priv *bat_priv, const void *data)
         head = &hash->table[index];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(vis_info, node, head, hash_entry) {
-                if (!batadv_vis_info_cmp(node, data))
+        hlist_for_each_entry_rcu(vis_info, head, hash_entry) {
+                if (!batadv_vis_info_cmp(&vis_info->hash_entry, data))
                         continue;
 
                 vis_info_tmp = vis_info;
@@ -128,9 +127,8 @@ static void batadv_vis_data_insert_interface(const uint8_t *interface,
                                              bool primary)
 {
         struct batadv_vis_if_list_entry *entry;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry(entry, pos, if_list, list) {
+        hlist_for_each_entry(entry, if_list, list) {
                 if (batadv_compare_eth(entry->addr, interface))
                         return;
         }
@@ -148,9 +146,8 @@ static void batadv_vis_data_read_prim_sec(struct seq_file *seq,
                                           const struct hlist_head *if_list)
 {
         struct batadv_vis_if_list_entry *entry;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry(entry, pos, if_list, list) {
+        hlist_for_each_entry(entry, if_list, list) {
                 if (entry->primary)
                         seq_printf(seq, "PRIMARY, ");
                 else
@@ -198,9 +195,8 @@ static void batadv_vis_data_read_entries(struct seq_file *seq,
 {
         int i;
         struct batadv_vis_if_list_entry *entry;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry(entry, pos, list, list) {
+        hlist_for_each_entry(entry, list, list) {
                 seq_printf(seq, "%pM,", entry->addr);
 
                 for (i = 0; i < packet->entries; i++)
@@ -218,17 +214,16 @@ static void batadv_vis_data_read_entries(struct seq_file *seq,
 static void batadv_vis_seq_print_text_bucket(struct seq_file *seq,
                                              const struct hlist_head *head)
 {
-        struct hlist_node *node;
         struct batadv_vis_info *info;
         struct batadv_vis_packet *packet;
         uint8_t *entries_pos;
         struct batadv_vis_info_entry *entries;
         struct batadv_vis_if_list_entry *entry;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
 
         HLIST_HEAD(vis_if_list);
 
-        hlist_for_each_entry_rcu(info, node, head, hash_entry) {
+        hlist_for_each_entry_rcu(info, head, hash_entry) {
                 packet = (struct batadv_vis_packet *)info->skb_packet->data;
                 entries_pos = (uint8_t *)packet + sizeof(*packet);
                 entries = (struct batadv_vis_info_entry *)entries_pos;
@@ -240,7 +235,7 @@ static void batadv_vis_seq_print_text_bucket(struct seq_file *seq,
                 batadv_vis_data_read_entries(seq, &vis_if_list, packet,
                                              entries);
 
-                hlist_for_each_entry_safe(entry, pos, n, &vis_if_list, list) {
+                hlist_for_each_entry_safe(entry, n, &vis_if_list, list) {
                         hlist_del(&entry->list);
                         kfree(entry);
                 }
@@ -519,7 +514,6 @@ static int batadv_find_best_vis_server(struct batadv_priv *bat_priv,
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
         struct batadv_neigh_node *router;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_orig_node *orig_node;
         struct batadv_vis_packet *packet;
@@ -532,7 +526,7 @@ static int batadv_find_best_vis_server(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         router = batadv_orig_node_get_router(orig_node);
                         if (!router)
                                 continue;
@@ -571,7 +565,6 @@ static bool batadv_vis_packet_full(const struct batadv_vis_info *info)
 static int batadv_generate_vis_packet(struct batadv_priv *bat_priv)
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_orig_node *orig_node;
         struct batadv_neigh_node *router;
@@ -605,7 +598,7 @@ static int batadv_generate_vis_packet(struct batadv_priv *bat_priv)
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         router = batadv_orig_node_get_router(orig_node);
                         if (!router)
                                 continue;
@@ -644,7 +637,7 @@ next:
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(tt_common_entry, node, head,
+                hlist_for_each_entry_rcu(tt_common_entry, head,
                                          hash_entry) {
                         packet_pos = skb_put(info->skb_packet, sizeof(*entry));
                         entry = (struct batadv_vis_info_entry *)packet_pos;
@@ -673,14 +666,14 @@ static void batadv_purge_vis_packets(struct batadv_priv *bat_priv)
 {
         uint32_t i;
         struct batadv_hashtable *hash = bat_priv->vis.hash;
-        struct hlist_node *node, *node_tmp;
+        struct hlist_node *node_tmp;
         struct hlist_head *head;
         struct batadv_vis_info *info;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
 
-                hlist_for_each_entry_safe(info, node, node_tmp,
+                hlist_for_each_entry_safe(info, node_tmp,
                                           head, hash_entry) {
                         /* never purge own data. */
                         if (info == bat_priv->vis.my_info)
@@ -688,7 +681,7 @@ static void batadv_purge_vis_packets(struct batadv_priv *bat_priv)
 
                         if (batadv_has_timed_out(info->first_seen,
                                                  BATADV_VIS_TIMEOUT)) {
-                                hlist_del(node);
+                                hlist_del(&info->hash_entry);
                                 batadv_send_list_del(info);
                                 kref_put(&info->refcount, batadv_free_info);
                         }
@@ -700,7 +693,6 @@ static void batadv_broadcast_vis_packet(struct batadv_priv *bat_priv,
                                         struct batadv_vis_info *info)
 {
         struct batadv_hashtable *hash = bat_priv->orig_hash;
-        struct hlist_node *node;
         struct hlist_head *head;
         struct batadv_orig_node *orig_node;
         struct batadv_vis_packet *packet;
@@ -715,7 +707,7 @@ static void batadv_broadcast_vis_packet(struct batadv_priv *bat_priv,
                 head = &hash->table[i];
 
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
+                hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
                         /* if it's a vis server and reachable, send it. */
                         if (!(orig_node->flags & BATADV_VIS_SERVER))
                                 continue;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 07f073935811..6a93614f2c49 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -70,14 +70,13 @@ static struct bt_sock_list hci_sk_list = {
 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct sk_buff *skb_copy = NULL;
 
         BT_DBG("hdev %p len %d", hdev, skb->len);
 
         read_lock(&hci_sk_list.lock);
 
-        sk_for_each(sk, node, &hci_sk_list.head) {
+        sk_for_each(sk, &hci_sk_list.head) {
                 struct hci_filter *flt;
                 struct sk_buff *nskb;
 
@@ -142,13 +141,12 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 void hci_send_to_control(struct sk_buff *skb, struct sock *skip_sk)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         BT_DBG("len %d", skb->len);
 
         read_lock(&hci_sk_list.lock);
 
-        sk_for_each(sk, node, &hci_sk_list.head) {
+        sk_for_each(sk, &hci_sk_list.head) {
                 struct sk_buff *nskb;
 
                 /* Skip the original socket */
@@ -176,7 +174,6 @@ void hci_send_to_control(struct sk_buff *skb, struct sock *skip_sk)
 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct sk_buff *skb_copy = NULL;
         __le16 opcode;
 
@@ -210,7 +207,7 @@ void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
 
         read_lock(&hci_sk_list.lock);
 
-        sk_for_each(sk, node, &hci_sk_list.head) {
+        sk_for_each(sk, &hci_sk_list.head) {
                 struct sk_buff *nskb;
 
                 if (sk->sk_state != BT_BOUND)
@@ -251,13 +248,12 @@ void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
 static void send_monitor_event(struct sk_buff *skb)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         BT_DBG("len %d", skb->len);
 
         read_lock(&hci_sk_list.lock);
 
-        sk_for_each(sk, node, &hci_sk_list.head) {
+        sk_for_each(sk, &hci_sk_list.head) {
                 struct sk_buff *nskb;
 
                 if (sk->sk_state != BT_BOUND)
@@ -393,11 +389,10 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event)
 
         if (event == HCI_DEV_UNREG) {
                 struct sock *sk;
-                struct hlist_node *node;
 
                 /* Detach sockets from device */
                 read_lock(&hci_sk_list.lock);
-                sk_for_each(sk, node, &hci_sk_list.head) {
+                sk_for_each(sk, &hci_sk_list.head) {
                         bh_lock_sock_nested(sk);
                         if (hci_pi(sk)->hdev == hdev) {
                                 hci_pi(sk)->hdev = NULL;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index ce3f6658f4b2..c23bae86263b 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -107,15 +107,14 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 {
         struct sock *sk = NULL;
-        struct hlist_node *node;
 
-        sk_for_each(sk, node, &rfcomm_sk_list.head) {
+        sk_for_each(sk, &rfcomm_sk_list.head) {
                 if (rfcomm_pi(sk)->channel == channel &&
                                 !bacmp(&bt_sk(sk)->src, src))
                         break;
         }
 
-        return node ? sk : NULL;
+        return sk ? sk : NULL;
 }
 
 /* Find socket with channel and source bdaddr.
@@ -124,11 +123,10 @@ static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 {
         struct sock *sk = NULL, *sk1 = NULL;
-        struct hlist_node *node;
 
         read_lock(&rfcomm_sk_list.lock);
 
-        sk_for_each(sk, node, &rfcomm_sk_list.head) {
+        sk_for_each(sk, &rfcomm_sk_list.head) {
                 if (state && sk->sk_state != state)
                         continue;
 
@@ -145,7 +143,7 @@ static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *
 
         read_unlock(&rfcomm_sk_list.lock);
 
-        return node ? sk : sk1;
+        return sk ? sk : sk1;
 }
 
 static void rfcomm_sock_destruct(struct sock *sk)
@@ -970,11 +968,10 @@ done:
 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         read_lock(&rfcomm_sk_list.lock);
 
-        sk_for_each(sk, node, &rfcomm_sk_list.head) {
+        sk_for_each(sk, &rfcomm_sk_list.head) {
                 seq_printf(f, "%pMR %pMR %d %d\n",
                            &bt_sk(sk)->src, &bt_sk(sk)->dst,
                            sk->sk_state, rfcomm_pi(sk)->channel);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index b5178d62064e..79d87d8d4f51 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -259,10 +259,9 @@ drop:
 /* -------- Socket interface ---------- */
 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
 {
-        struct hlist_node *node;
         struct sock *sk;
 
-        sk_for_each(sk, node, &sco_sk_list.head) {
+        sk_for_each(sk, &sco_sk_list.head) {
                 if (sk->sk_state != BT_LISTEN)
                         continue;
 
@@ -279,11 +278,10 @@ static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
 static struct sock *sco_get_sock_listen(bdaddr_t *src)
 {
         struct sock *sk = NULL, *sk1 = NULL;
-        struct hlist_node *node;
 
         read_lock(&sco_sk_list.lock);
 
-        sk_for_each(sk, node, &sco_sk_list.head) {
+        sk_for_each(sk, &sco_sk_list.head) {
                 if (sk->sk_state != BT_LISTEN)
                         continue;
 
@@ -298,7 +296,7 @@ static struct sock *sco_get_sock_listen(bdaddr_t *src)
 
         read_unlock(&sco_sk_list.lock);
 
-        return node ? sk : sk1;
+        return sk ? sk : sk1;
 }
 
 static void sco_sock_destruct(struct sock *sk)
@@ -951,14 +949,13 @@ static void sco_conn_ready(struct sco_conn *conn)
 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
 {
         struct sock *sk;
-        struct hlist_node *node;
         int lm = 0;
 
         BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
 
         /* Find listening sockets */
         read_lock(&sco_sk_list.lock);
-        sk_for_each(sk, node, &sco_sk_list.head) {
+        sk_for_each(sk, &sco_sk_list.head) {
                 if (sk->sk_state != BT_LISTEN)
                         continue;
 
@@ -1018,11 +1015,10 @@ drop:
 static int sco_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         read_lock(&sco_sk_list.lock);
 
-        sk_for_each(sk, node, &sco_sk_list.head) {
+        sk_for_each(sk, &sco_sk_list.head) {
                 seq_printf(f, "%pMR %pMR %d\n", &bt_sk(sk)->src,
                            &bt_sk(sk)->dst, sk->sk_state);
         }
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 8117900af4de..b0812c91c0f0 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -181,9 +181,9 @@ void br_fdb_cleanup(unsigned long _data)
         spin_lock(&br->hash_lock);
         for (i = 0; i < BR_HASH_SIZE; i++) {
                 struct net_bridge_fdb_entry *f;
-                struct hlist_node *h, *n;
+                struct hlist_node *n;
 
-                hlist_for_each_entry_safe(f, h, n, &br->hash[i], hlist) {
+                hlist_for_each_entry_safe(f, n, &br->hash[i], hlist) {
                         unsigned long this_timer;
                         if (f->is_static)
                                 continue;
@@ -207,8 +207,8 @@ void br_fdb_flush(struct net_bridge *br)
         spin_lock_bh(&br->hash_lock);
         for (i = 0; i < BR_HASH_SIZE; i++) {
                 struct net_bridge_fdb_entry *f;
-                struct hlist_node *h, *n;
-                hlist_for_each_entry_safe(f, h, n, &br->hash[i], hlist) {
+                struct hlist_node *n;
+                hlist_for_each_entry_safe(f, n, &br->hash[i], hlist) {
                         if (!f->is_static)
                                 fdb_delete(br, f);
                 }
@@ -266,10 +266,9 @@ struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
                                           const unsigned char *addr,
                                           __u16 vid)
 {
-        struct hlist_node *h;
         struct net_bridge_fdb_entry *fdb;
 
-        hlist_for_each_entry_rcu(fdb, h,
+        hlist_for_each_entry_rcu(fdb,
                                 &br->hash[br_mac_hash(addr, vid)], hlist) {
                 if (ether_addr_equal(fdb->addr.addr, addr) &&
                     fdb->vlan_id == vid) {
@@ -315,14 +314,13 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf,
 {
         struct __fdb_entry *fe = buf;
         int i, num = 0;
-        struct hlist_node *h;
         struct net_bridge_fdb_entry *f;
 
         memset(buf, 0, maxnum*sizeof(struct __fdb_entry));
 
         rcu_read_lock();
         for (i = 0; i < BR_HASH_SIZE; i++) {
-                hlist_for_each_entry_rcu(f, h, &br->hash[i], hlist) {
+                hlist_for_each_entry_rcu(f, &br->hash[i], hlist) {
                         if (num >= maxnum)
                                 goto out;
 
@@ -363,10 +361,9 @@ static struct net_bridge_fdb_entry *fdb_find(struct hlist_head *head,
                                              const unsigned char *addr,
                                              __u16 vid)
 {
-        struct hlist_node *h;
         struct net_bridge_fdb_entry *fdb;
 
-        hlist_for_each_entry(fdb, h, head, hlist) {
+        hlist_for_each_entry(fdb, head, hlist) {
                 if (ether_addr_equal(fdb->addr.addr, addr) &&
                     fdb->vlan_id == vid)
                         return fdb;
@@ -378,10 +375,9 @@ static struct net_bridge_fdb_entry *fdb_find_rcu(struct hlist_head *head,
                                                  const unsigned char *addr,
                                                  __u16 vid)
 {
-        struct hlist_node *h;
         struct net_bridge_fdb_entry *fdb;
 
-        hlist_for_each_entry_rcu(fdb, h, head, hlist) {
+        hlist_for_each_entry_rcu(fdb, head, hlist) {
                 if (ether_addr_equal(fdb->addr.addr, addr) &&
                     fdb->vlan_id == vid)
                         return fdb;
@@ -593,10 +589,9 @@ int br_fdb_dump(struct sk_buff *skb,
                 goto out;
 
         for (i = 0; i < BR_HASH_SIZE; i++) {
-                struct hlist_node *h;
                 struct net_bridge_fdb_entry *f;
 
-                hlist_for_each_entry_rcu(f, h, &br->hash[i], hlist) {
+                hlist_for_each_entry_rcu(f, &br->hash[i], hlist) {
                         if (idx < cb->args[0])
                                 goto skip;
 
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 38991e03646d..9f97b850fc65 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -18,7 +18,6 @@ static int br_rports_fill_info(struct sk_buff *skb, struct netlink_callback *cb,
 {
         struct net_bridge *br = netdev_priv(dev);
         struct net_bridge_port *p;
-        struct hlist_node *n;
         struct nlattr *nest;
 
         if (!br->multicast_router || hlist_empty(&br->router_list))
@@ -28,7 +27,7 @@ static int br_rports_fill_info(struct sk_buff *skb, struct netlink_callback *cb,
         if (nest == NULL)
                 return -EMSGSIZE;
 
-        hlist_for_each_entry_rcu(p, n, &br->router_list, rlist) {
+        hlist_for_each_entry_rcu(p, &br->router_list, rlist) {
                 if (p && nla_put_u32(skb, MDBA_ROUTER_PORT, p->dev->ifindex))
                         goto fail;
         }
@@ -61,12 +60,11 @@ static int br_mdb_fill_info(struct sk_buff *skb, struct netlink_callback *cb,
                 return -EMSGSIZE;
 
         for (i = 0; i < mdb->max; i++) {
-                struct hlist_node *h;
                 struct net_bridge_mdb_entry *mp;
                 struct net_bridge_port_group *p, **pp;
                 struct net_bridge_port *port;
 
-                hlist_for_each_entry_rcu(mp, h, &mdb->mhash[i], hlist[mdb->ver]) {
+                hlist_for_each_entry_rcu(mp, &mdb->mhash[i], hlist[mdb->ver]) {
                         if (idx < s_idx)
                                 goto skip;
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 7d886b0a8b7b..10e6fce1bb62 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -86,9 +86,8 @@ static struct net_bridge_mdb_entry *__br_mdb_ip_get(
         struct net_bridge_mdb_htable *mdb, struct br_ip *dst, int hash)
 {
         struct net_bridge_mdb_entry *mp;
-        struct hlist_node *p;
 
-        hlist_for_each_entry_rcu(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
+        hlist_for_each_entry_rcu(mp, &mdb->mhash[hash], hlist[mdb->ver]) {
                 if (br_ip_equal(&mp->addr, dst))
                         return mp;
         }
@@ -178,13 +177,12 @@ static int br_mdb_copy(struct net_bridge_mdb_htable *new,
                        int elasticity)
 {
         struct net_bridge_mdb_entry *mp;
-        struct hlist_node *p;
         int maxlen;
         int len;
         int i;
 
         for (i = 0; i < old->max; i++)
-                hlist_for_each_entry(mp, p, &old->mhash[i], hlist[old->ver])
+                hlist_for_each_entry(mp, &old->mhash[i], hlist[old->ver])
                         hlist_add_head(&mp->hlist[new->ver],
                                        &new->mhash[br_ip_hash(new, &mp->addr)]);
 
@@ -194,7 +192,7 @@ static int br_mdb_copy(struct net_bridge_mdb_htable *new,
         maxlen = 0;
         for (i = 0; i < new->max; i++) {
                 len = 0;
-                hlist_for_each_entry(mp, p, &new->mhash[i], hlist[new->ver])
+                hlist_for_each_entry(mp, &new->mhash[i], hlist[new->ver])
                         len++;
                 if (len > maxlen)
                         maxlen = len;
@@ -510,14 +508,13 @@ static struct net_bridge_mdb_entry *br_multicast_get_group(
 {
         struct net_bridge_mdb_htable *mdb;
         struct net_bridge_mdb_entry *mp;
-        struct hlist_node *p;
         unsigned int count = 0;
         unsigned int max;
         int elasticity;
         int err;
 
         mdb = rcu_dereference_protected(br->mdb, 1);
-        hlist_for_each_entry(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
+        hlist_for_each_entry(mp, &mdb->mhash[hash], hlist[mdb->ver]) {
                 count++;
                 if (unlikely(br_ip_equal(group, &mp->addr)))
                         return mp;
@@ -882,10 +879,10 @@ void br_multicast_disable_port(struct net_bridge_port *port)
 {
         struct net_bridge *br = port->br;
         struct net_bridge_port_group *pg;
-        struct hlist_node *p, *n;
+        struct hlist_node *n;
 
         spin_lock(&br->multicast_lock);
-        hlist_for_each_entry_safe(pg, p, n, &port->mglist, mglist)
+        hlist_for_each_entry_safe(pg, n, &port->mglist, mglist)
                 br_multicast_del_pg(br, pg);
 
         if (!hlist_unhashed(&port->rlist))
@@ -1025,12 +1022,12 @@ static void br_multicast_add_router(struct net_bridge *br,
                                     struct net_bridge_port *port)
 {
         struct net_bridge_port *p;
-        struct hlist_node *n, *slot = NULL;
+        struct hlist_node *slot = NULL;
 
-        hlist_for_each_entry(p, n, &br->router_list, rlist) {
+        hlist_for_each_entry(p, &br->router_list, rlist) {
                 if ((unsigned long) port >= (unsigned long) p)
                         break;
-                slot = n;
+                slot = &p->rlist;
         }
 
         if (slot)
@@ -1653,7 +1650,7 @@ void br_multicast_stop(struct net_bridge *br)
 {
         struct net_bridge_mdb_htable *mdb;
         struct net_bridge_mdb_entry *mp;
-        struct hlist_node *p, *n;
+        struct hlist_node *n;
         u32 ver;
         int i;
 
@@ -1670,7 +1667,7 @@ void br_multicast_stop(struct net_bridge *br)
 
         ver = mdb->ver;
         for (i = 0; i < mdb->max; i++) {
-                hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
+                hlist_for_each_entry_safe(mp, n, &mdb->mhash[i],
                                           hlist[ver]) {
                         del_timer(&mp->timer);
                         call_rcu_bh(&mp->rcu, br_multicast_free_group);
diff --git a/net/can/af_can.c b/net/can/af_can.c
index ddac1ee2ed20..c48e5220bbac 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -516,7 +516,6 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
 {
         struct receiver *r = NULL;
         struct hlist_head *rl;
-        struct hlist_node *next;
         struct dev_rcv_lists *d;
 
         if (dev && dev->type != ARPHRD_CAN)
@@ -540,7 +539,7 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
          * been registered before.
          */
 
-        hlist_for_each_entry_rcu(r, next, rl, list) {
+        hlist_for_each_entry_rcu(r, rl, list) {
                 if (r->can_id == can_id && r->mask == mask &&
                     r->func == func && r->data == data)
                         break;
@@ -552,7 +551,7 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
          * will be NULL, while r will point to the last item of the list.
          */
 
-        if (!next) {
+        if (!r) {
                 printk(KERN_ERR "BUG: receive list entry not found for "
                        "dev %s, id %03X, mask %03X\n",
                        DNAME(dev), can_id, mask);
@@ -590,7 +589,6 @@ static inline void deliver(struct sk_buff *skb, struct receiver *r)
 static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
 {
         struct receiver *r;
-        struct hlist_node *n;
         int matches = 0;
         struct can_frame *cf = (struct can_frame *)skb->data;
         canid_t can_id = cf->can_id;
@@ -600,7 +598,7 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
 
         if (can_id & CAN_ERR_FLAG) {
                 /* check for error message frame entries only */
-                hlist_for_each_entry_rcu(r, n, &d->rx[RX_ERR], list) {
+                hlist_for_each_entry_rcu(r, &d->rx[RX_ERR], list) {
                         if (can_id & r->mask) {
                                 deliver(skb, r);
                                 matches++;
@@ -610,13 +608,13 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
         }
 
         /* check for unfiltered entries */
-        hlist_for_each_entry_rcu(r, n, &d->rx[RX_ALL], list) {
+        hlist_for_each_entry_rcu(r, &d->rx[RX_ALL], list) {
                 deliver(skb, r);
                 matches++;
         }
 
         /* check for can_id/mask entries */
-        hlist_for_each_entry_rcu(r, n, &d->rx[RX_FIL], list) {
+        hlist_for_each_entry_rcu(r, &d->rx[RX_FIL], list) {
                 if ((can_id & r->mask) == r->can_id) {
                         deliver(skb, r);
                         matches++;
@@ -624,7 +622,7 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
         }
 
         /* check for inverted can_id/mask entries */
-        hlist_for_each_entry_rcu(r, n, &d->rx[RX_INV], list) {
+        hlist_for_each_entry_rcu(r, &d->rx[RX_INV], list) {
                 if ((can_id & r->mask) != r->can_id) {
                         deliver(skb, r);
                         matches++;
@@ -636,7 +634,7 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
                 return matches;
 
         if (can_id & CAN_EFF_FLAG) {
-                hlist_for_each_entry_rcu(r, n, &d->rx[RX_EFF], list) {
+                hlist_for_each_entry_rcu(r, &d->rx[RX_EFF], list) {
                         if (r->can_id == can_id) {
                                 deliver(skb, r);
                                 matches++;
@@ -644,7 +642,7 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
                 }
         } else {
                 can_id &= CAN_SFF_MASK;
-                hlist_for_each_entry_rcu(r, n, &d->rx_sff[can_id], list) {
+                hlist_for_each_entry_rcu(r, &d->rx_sff[can_id], list) {
                         deliver(skb, r);
                         matches++;
                 }
diff --git a/net/can/gw.c b/net/can/gw.c
index c185fcd5e828..2d117dc5ebea 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -457,11 +457,11 @@ static int cgw_notifier(struct notifier_block *nb,
         if (msg == NETDEV_UNREGISTER) {
 
                 struct cgw_job *gwj = NULL;
-                struct hlist_node *n, *nx;
+                struct hlist_node *nx;
 
                 ASSERT_RTNL();
 
-                hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
+                hlist_for_each_entry_safe(gwj, nx, &cgw_list, list) {
 
                         if (gwj->src.dev == dev || gwj->dst.dev == dev) {
                                 hlist_del(&gwj->list);
@@ -575,12 +575,11 @@ cancel:
 static int cgw_dump_jobs(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct cgw_job *gwj = NULL;
-        struct hlist_node *n;
         int idx = 0;
         int s_idx = cb->args[0];
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(gwj, n, &cgw_list, list) {
+        hlist_for_each_entry_rcu(gwj, &cgw_list, list) {
                 if (idx < s_idx)
                         goto cont;
 
@@ -858,11 +857,11 @@ out:
 static void cgw_remove_all_jobs(void)
 {
         struct cgw_job *gwj = NULL;
-        struct hlist_node *n, *nx;
+        struct hlist_node *nx;
 
         ASSERT_RTNL();
 
-        hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
+        hlist_for_each_entry_safe(gwj, nx, &cgw_list, list) {
                 hlist_del(&gwj->list);
                 cgw_unregister_filter(gwj);
                 kfree(gwj);
@@ -872,7 +871,7 @@ static void cgw_remove_all_jobs(void)
 static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
 {
         struct cgw_job *gwj = NULL;
-        struct hlist_node *n, *nx;
+        struct hlist_node *nx;
         struct rtcanmsg *r;
         struct cf_mod mod;
         struct can_can_gw ccgw;
@@ -907,7 +906,7 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
         ASSERT_RTNL();
 
         /* remove only the first matching entry */
-        hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
+        hlist_for_each_entry_safe(gwj, nx, &cgw_list, list) {
 
                 if (gwj->flags != r->flags)
                         continue;
diff --git a/net/can/proc.c b/net/can/proc.c
index 497335892146..1ab8c888f102 100644
--- a/net/can/proc.c
+++ b/net/can/proc.c
@@ -195,9 +195,8 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
                               struct net_device *dev)
 {
         struct receiver *r;
-        struct hlist_node *n;
 
-        hlist_for_each_entry_rcu(r, n, rx_list, list) {
+        hlist_for_each_entry_rcu(r, rx_list, list) {
                 char *fmt = (r->can_id & CAN_EFF_FLAG)?
                         "   %-5s  %08x  %08x  %pK  %pK  %8ld  %s\n" :
                         "   %-5s     %03x    %08x  %pK  %pK  %8ld  %s\n";
diff --git a/net/core/dev.c b/net/core/dev.c
index 18d8b5acc343..a06a7a58dd11 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -658,11 +658,10 @@ __setup("netdev=", netdev_boot_setup);
 
 struct net_device *__dev_get_by_name(struct net *net, const char *name)
 {
-        struct hlist_node *p;
         struct net_device *dev;
         struct hlist_head *head = dev_name_hash(net, name);
 
-        hlist_for_each_entry(dev, p, head, name_hlist)
+        hlist_for_each_entry(dev, head, name_hlist)
                 if (!strncmp(dev->name, name, IFNAMSIZ))
                         return dev;
 
@@ -684,11 +683,10 @@ EXPORT_SYMBOL(__dev_get_by_name);
 
 struct net_device *dev_get_by_name_rcu(struct net *net, const char *name)
 {
-        struct hlist_node *p;
         struct net_device *dev;
         struct hlist_head *head = dev_name_hash(net, name);
 
-        hlist_for_each_entry_rcu(dev, p, head, name_hlist)
+        hlist_for_each_entry_rcu(dev, head, name_hlist)
                 if (!strncmp(dev->name, name, IFNAMSIZ))
                         return dev;
 
@@ -735,11 +733,10 @@ EXPORT_SYMBOL(dev_get_by_name);
 
 struct net_device *__dev_get_by_index(struct net *net, int ifindex)
 {
-        struct hlist_node *p;
         struct net_device *dev;
         struct hlist_head *head = dev_index_hash(net, ifindex);
 
-        hlist_for_each_entry(dev, p, head, index_hlist)
+        hlist_for_each_entry(dev, head, index_hlist)
                 if (dev->ifindex == ifindex)
                         return dev;
 
@@ -760,11 +757,10 @@ EXPORT_SYMBOL(__dev_get_by_index);
 
 struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex)
 {
-        struct hlist_node *p;
         struct net_device *dev;
         struct hlist_head *head = dev_index_hash(net, ifindex);
 
-        hlist_for_each_entry_rcu(dev, p, head, index_hlist)
+        hlist_for_each_entry_rcu(dev, head, index_hlist)
                 if (dev->ifindex == ifindex)
                         return dev;
 
diff --git a/net/core/flow.c b/net/core/flow.c
index 43f7495df27a..c56ea6f7f6c7 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -132,14 +132,14 @@ static void __flow_cache_shrink(struct flow_cache *fc,
                                 int shrink_to)
 {
         struct flow_cache_entry *fle;
-        struct hlist_node *entry, *tmp;
+        struct hlist_node *tmp;
         LIST_HEAD(gc_list);
         int i, deleted = 0;
 
         for (i = 0; i < flow_cache_hash_size(fc); i++) {
                 int saved = 0;
 
-                hlist_for_each_entry_safe(fle, entry, tmp,
+                hlist_for_each_entry_safe(fle, tmp,
                                           &fcp->hash_table[i], u.hlist) {
                         if (saved < shrink_to &&
                             flow_entry_valid(fle)) {
@@ -211,7 +211,6 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
         struct flow_cache *fc = &flow_cache_global;
         struct flow_cache_percpu *fcp;
         struct flow_cache_entry *fle, *tfle;
-        struct hlist_node *entry;
         struct flow_cache_object *flo;
         size_t keysize;
         unsigned int hash;
@@ -235,7 +234,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
                 flow_new_hash_rnd(fc, fcp);
 
         hash = flow_hash_code(fc, fcp, key, keysize);
-        hlist_for_each_entry(tfle, entry, &fcp->hash_table[hash], u.hlist) {
+        hlist_for_each_entry(tfle, &fcp->hash_table[hash], u.hlist) {
                 if (tfle->net == net &&
                     tfle->family == family &&
                     tfle->dir == dir &&
@@ -301,13 +300,13 @@ static void flow_cache_flush_tasklet(unsigned long data)
         struct flow_cache *fc = info->cache;
         struct flow_cache_percpu *fcp;
         struct flow_cache_entry *fle;
-        struct hlist_node *entry, *tmp;
+        struct hlist_node *tmp;
         LIST_HEAD(gc_list);
         int i, deleted = 0;
 
         fcp = this_cpu_ptr(fc->percpu);
         for (i = 0; i < flow_cache_hash_size(fc); i++) {
-                hlist_for_each_entry_safe(fle, entry, tmp,
+                hlist_for_each_entry_safe(fle, tmp,
                                           &fcp->hash_table[i], u.hlist) {
                         if (flow_entry_valid(fle))
                                 continue;
diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c
index 0f6bb6f8d391..3174f1998ee6 100644
--- a/net/core/net-procfs.c
+++ b/net/core/net-procfs.c
@@ -16,12 +16,11 @@ static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff
 {
         struct net *net = seq_file_net(seq);
         struct net_device *dev;
-        struct hlist_node *p;
         struct hlist_head *h;
         unsigned int count = 0, offset = get_offset(*pos);
 
         h = &net->dev_name_head[get_bucket(*pos)];
-        hlist_for_each_entry_rcu(dev, p, h, name_hlist) {
+        hlist_for_each_entry_rcu(dev, h, name_hlist) {
                 if (++count == offset)
                         return dev;
         }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d8aa20f6a46e..b376410ff259 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1060,7 +1060,6 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         int idx = 0, s_idx;
         struct net_device *dev;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct nlattr *tb[IFLA_MAX+1];
         u32 ext_filter_mask = 0;
 
@@ -1080,7 +1079,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
-                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                hlist_for_each_entry_rcu(dev, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index c4a2def5b7bd..c21f200eed93 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -175,12 +175,11 @@ static struct hlist_head *dn_find_list(struct sock *sk)
 static int check_port(__le16 port)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         if (port == 0)
                 return -1;
 
-        sk_for_each(sk, node, &dn_sk_hash[le16_to_cpu(port) & DN_SK_HASH_MASK]) {
+        sk_for_each(sk, &dn_sk_hash[le16_to_cpu(port) & DN_SK_HASH_MASK]) {
                 struct dn_scp *scp = DN_SK(sk);
                 if (scp->addrloc == port)
                         return -1;
@@ -374,11 +373,10 @@ int dn_username2sockaddr(unsigned char *data, int len, struct sockaddr_dn *sdn,
 struct sock *dn_sklist_find_listener(struct sockaddr_dn *addr)
 {
         struct hlist_head *list = listen_hash(addr);
-        struct hlist_node *node;
         struct sock *sk;
 
         read_lock(&dn_hash_lock);
-        sk_for_each(sk, node, list) {
+        sk_for_each(sk, list) {
                 struct dn_scp *scp = DN_SK(sk);
                 if (sk->sk_state != TCP_LISTEN)
                         continue;
@@ -414,11 +412,10 @@ struct sock *dn_find_by_skb(struct sk_buff *skb)
 {
         struct dn_skb_cb *cb = DN_SKB_CB(skb);
         struct sock *sk;
-        struct hlist_node *node;
         struct dn_scp *scp;
 
         read_lock(&dn_hash_lock);
-        sk_for_each(sk, node, &dn_sk_hash[le16_to_cpu(cb->dst_port) & DN_SK_HASH_MASK]) {
+        sk_for_each(sk, &dn_sk_hash[le16_to_cpu(cb->dst_port) & DN_SK_HASH_MASK]) {
                 scp = DN_SK(sk);
                 if (cb->src != dn_saddr2dn(&scp->peer))
                         continue;
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index f968c1b58f47..6c2445bcaba1 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -483,7 +483,6 @@ int dn_fib_dump(struct sk_buff *skb, struct netlink_callback *cb)
         unsigned int h, s_h;
         unsigned int e = 0, s_e;
         struct dn_fib_table *tb;
-        struct hlist_node *node;
         int dumped = 0;
 
         if (!net_eq(net, &init_net))
@@ -498,7 +497,7 @@ int dn_fib_dump(struct sk_buff *skb, struct netlink_callback *cb)
 
         for (h = s_h; h < DN_FIB_TABLE_HASHSZ; h++, s_h = 0) {
                 e = 0;
-                hlist_for_each_entry(tb, node, &dn_fib_table_hash[h], hlist) {
+                hlist_for_each_entry(tb, &dn_fib_table_hash[h], hlist) {
                         if (e < s_e)
                                 goto next;
                         if (dumped)
@@ -828,7 +827,6 @@ out:
 struct dn_fib_table *dn_fib_get_table(u32 n, int create)
 {
         struct dn_fib_table *t;
-        struct hlist_node *node;
         unsigned int h;
 
         if (n < RT_TABLE_MIN)
@@ -839,7 +837,7 @@ struct dn_fib_table *dn_fib_get_table(u32 n, int create)
 
         h = n & (DN_FIB_TABLE_HASHSZ - 1);
         rcu_read_lock();
-        hlist_for_each_entry_rcu(t, node, &dn_fib_table_hash[h], hlist) {
+        hlist_for_each_entry_rcu(t, &dn_fib_table_hash[h], hlist) {
                 if (t->n == n) {
                         rcu_read_unlock();
                         return t;
@@ -885,11 +883,10 @@ void dn_fib_flush(void)
 {
         int flushed = 0;
         struct dn_fib_table *tb;
-        struct hlist_node *node;
         unsigned int h;
 
         for (h = 0; h < DN_FIB_TABLE_HASHSZ; h++) {
-                hlist_for_each_entry(tb, node, &dn_fib_table_hash[h], hlist)
+                hlist_for_each_entry(tb, &dn_fib_table_hash[h], hlist)
                         flushed += tb->flush(tb);
         }
 
@@ -908,12 +905,12 @@ void __init dn_fib_table_init(void)
 void __exit dn_fib_table_cleanup(void)
 {
         struct dn_fib_table *t;
-        struct hlist_node *node, *next;
+        struct hlist_node *next;
         unsigned int h;
 
         write_lock(&dn_fib_tables_lock);
         for (h = 0; h < DN_FIB_TABLE_HASHSZ; h++) {
-                hlist_for_each_entry_safe(t, node, next, &dn_fib_table_hash[h],
+                hlist_for_each_entry_safe(t, next, &dn_fib_table_hash[h],
                                           hlist) {
                         hlist_del(&t->hlist);
                         kfree(t);
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 16705611589a..e0da175f8e5b 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -350,7 +350,6 @@ static inline int ieee802154_match_sock(u8 *hw_addr, u16 pan_id,
 int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
 {
         struct sock *sk, *prev = NULL;
-        struct hlist_node *node;
         int ret = NET_RX_SUCCESS;
         u16 pan_id, short_addr;
 
@@ -361,7 +360,7 @@ int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
         short_addr = ieee802154_mlme_ops(dev)->get_short_addr(dev);
 
         read_lock(&dgram_lock);
-        sk_for_each(sk, node, &dgram_head) {
+        sk_for_each(sk, &dgram_head) {
                 if (ieee802154_match_sock(dev->dev_addr, pan_id, short_addr,
                                         dgram_sk(sk))) {
                         if (prev) {
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index 50e823927d49..41f538b8e59c 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -221,10 +221,9 @@ static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
 void ieee802154_raw_deliver(struct net_device *dev, struct sk_buff *skb)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
         read_lock(&raw_lock);
-        sk_for_each(sk, node, &raw_head) {
+        sk_for_each(sk, &raw_head) {
                 bh_lock_sock(sk);
                 if (!sk->sk_bound_dev_if ||
                     sk->sk_bound_dev_if == dev->ifindex) {
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 5281314886c1..f678507bc829 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -139,10 +139,9 @@ struct net_device *__ip_dev_find(struct net *net, __be32 addr, bool devref)
         u32 hash = inet_addr_hash(net, addr);
         struct net_device *result = NULL;
         struct in_ifaddr *ifa;
-        struct hlist_node *node;
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(ifa, node, &inet_addr_lst[hash], hash) {
+        hlist_for_each_entry_rcu(ifa, &inet_addr_lst[hash], hash) {
                 if (ifa->ifa_local == addr) {
                         struct net_device *dev = ifa->ifa_dev->dev;
 
@@ -588,7 +587,6 @@ static void check_lifetime(struct work_struct *work)
 {
         unsigned long now, next, next_sec, next_sched;
         struct in_ifaddr *ifa;
-        struct hlist_node *node;
         int i;
 
         now = jiffies;
@@ -596,8 +594,7 @@ static void check_lifetime(struct work_struct *work)
 
         rcu_read_lock();
         for (i = 0; i < IN4_ADDR_HSIZE; i++) {
-                hlist_for_each_entry_rcu(ifa, node,
-                                         &inet_addr_lst[i], hash) {
+                hlist_for_each_entry_rcu(ifa, &inet_addr_lst[i], hash) {
                         unsigned long age;
 
                         if (ifa->ifa_flags & IFA_F_PERMANENT)
@@ -1493,7 +1490,6 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
         struct in_device *in_dev;
         struct in_ifaddr *ifa;
         struct hlist_head *head;
-        struct hlist_node *node;
 
         s_h = cb->args[0];
         s_idx = idx = cb->args[1];
@@ -1503,7 +1499,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                 idx = 0;
                 head = &net->dev_index_head[h];
                 rcu_read_lock();
-                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                hlist_for_each_entry_rcu(dev, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         if (h > s_h || idx > s_idx)
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 99f00d39d10b..eb4bb12b3eb4 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -112,7 +112,6 @@ struct fib_table *fib_new_table(struct net *net, u32 id)
 struct fib_table *fib_get_table(struct net *net, u32 id)
 {
         struct fib_table *tb;
-        struct hlist_node *node;
         struct hlist_head *head;
         unsigned int h;
 
@@ -122,7 +121,7 @@ struct fib_table *fib_get_table(struct net *net, u32 id)
 
         rcu_read_lock();
         head = &net->ipv4.fib_table_hash[h];
-        hlist_for_each_entry_rcu(tb, node, head, tb_hlist) {
+        hlist_for_each_entry_rcu(tb, head, tb_hlist) {
                 if (tb->tb_id == id) {
                         rcu_read_unlock();
                         return tb;
@@ -137,13 +136,12 @@ static void fib_flush(struct net *net)
 {
         int flushed = 0;
         struct fib_table *tb;
-        struct hlist_node *node;
         struct hlist_head *head;
         unsigned int h;
 
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
                 head = &net->ipv4.fib_table_hash[h];
-                hlist_for_each_entry(tb, node, head, tb_hlist)
+                hlist_for_each_entry(tb, head, tb_hlist)
                         flushed += fib_table_flush(tb);
         }
 
@@ -656,7 +654,6 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         unsigned int h, s_h;
         unsigned int e = 0, s_e;
         struct fib_table *tb;
-        struct hlist_node *node;
         struct hlist_head *head;
         int dumped = 0;
 
@@ -670,7 +667,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
                 e = 0;
                 head = &net->ipv4.fib_table_hash[h];
-                hlist_for_each_entry(tb, node, head, tb_hlist) {
+                hlist_for_each_entry(tb, head, tb_hlist) {
                         if (e < s_e)
                                 goto next;
                         if (dumped)
@@ -1117,11 +1114,11 @@ static void ip_fib_net_exit(struct net *net)
         for (i = 0; i < FIB_TABLE_HASHSZ; i++) {
                 struct fib_table *tb;
                 struct hlist_head *head;
-                struct hlist_node *node, *tmp;
+                struct hlist_node *tmp;
 
                 head = &net->ipv4.fib_table_hash[i];
-                hlist_for_each_entry_safe(tb, node, tmp, head, tb_hlist) {
-                        hlist_del(node);
+                hlist_for_each_entry_safe(tb, tmp, head, tb_hlist) {
+                        hlist_del(&tb->tb_hlist);
                         fib_table_flush(tb);
                         fib_free_table(tb);
                 }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 4797a800faf8..8f6cb7a87cd6 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -298,14 +298,13 @@ static inline unsigned int fib_info_hashfn(const struct fib_info *fi)
 static struct fib_info *fib_find_info(const struct fib_info *nfi)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct fib_info *fi;
         unsigned int hash;
 
         hash = fib_info_hashfn(nfi);
         head = &fib_info_hash[hash];
 
-        hlist_for_each_entry(fi, node, head, fib_hash) {
+        hlist_for_each_entry(fi, head, fib_hash) {
                 if (!net_eq(fi->fib_net, nfi->fib_net))
                         continue;
                 if (fi->fib_nhs != nfi->fib_nhs)
@@ -331,7 +330,6 @@ static struct fib_info *fib_find_info(const struct fib_info *nfi)
 int ip_fib_check_default(__be32 gw, struct net_device *dev)
 {
         struct hlist_head *head;
-        struct hlist_node *node;
         struct fib_nh *nh;
         unsigned int hash;
 
@@ -339,7 +337,7 @@ int ip_fib_check_default(__be32 gw, struct net_device *dev)
 
         hash = fib_devindex_hashfn(dev->ifindex);
         head = &fib_info_devhash[hash];
-        hlist_for_each_entry(nh, node, head, nh_hash) {
+        hlist_for_each_entry(nh, head, nh_hash) {
                 if (nh->nh_dev == dev &&
                     nh->nh_gw == gw &&
                     !(nh->nh_flags & RTNH_F_DEAD)) {
@@ -721,10 +719,10 @@ static void fib_info_hash_move(struct hlist_head *new_info_hash,
 
         for (i = 0; i < old_size; i++) {
                 struct hlist_head *head = &fib_info_hash[i];
-                struct hlist_node *node, *n;
+                struct hlist_node *n;
                 struct fib_info *fi;
 
-                hlist_for_each_entry_safe(fi, node, n, head, fib_hash) {
+                hlist_for_each_entry_safe(fi, n, head, fib_hash) {
                         struct hlist_head *dest;
                         unsigned int new_hash;
 
@@ -739,10 +737,10 @@ static void fib_info_hash_move(struct hlist_head *new_info_hash,
 
         for (i = 0; i < old_size; i++) {
                 struct hlist_head *lhead = &fib_info_laddrhash[i];
-                struct hlist_node *node, *n;
+                struct hlist_node *n;
                 struct fib_info *fi;
 
-                hlist_for_each_entry_safe(fi, node, n, lhead, fib_lhash) {
+                hlist_for_each_entry_safe(fi, n, lhead, fib_lhash) {
                         struct hlist_head *ldest;
                         unsigned int new_hash;
 
@@ -1096,13 +1094,12 @@ int fib_sync_down_addr(struct net *net, __be32 local)
         int ret = 0;
         unsigned int hash = fib_laddr_hashfn(local);
         struct hlist_head *head = &fib_info_laddrhash[hash];
-        struct hlist_node *node;
         struct fib_info *fi;
 
         if (fib_info_laddrhash == NULL || local == 0)
                 return 0;
 
-        hlist_for_each_entry(fi, node, head, fib_lhash) {
+        hlist_for_each_entry(fi, head, fib_lhash) {
                 if (!net_eq(fi->fib_net, net))
                         continue;
                 if (fi->fib_prefsrc == local) {
@@ -1120,13 +1117,12 @@ int fib_sync_down_dev(struct net_device *dev, int force)
         struct fib_info *prev_fi = NULL;
         unsigned int hash = fib_devindex_hashfn(dev->ifindex);
         struct hlist_head *head = &fib_info_devhash[hash];
-        struct hlist_node *node;
         struct fib_nh *nh;
 
         if (force)
                 scope = -1;
 
-        hlist_for_each_entry(nh, node, head, nh_hash) {
+        hlist_for_each_entry(nh, head, nh_hash) {
                 struct fib_info *fi = nh->nh_parent;
                 int dead;
 
@@ -1232,7 +1228,6 @@ int fib_sync_up(struct net_device *dev)
         struct fib_info *prev_fi;
         unsigned int hash;
         struct hlist_head *head;
-        struct hlist_node *node;
         struct fib_nh *nh;
         int ret;
 
@@ -1244,7 +1239,7 @@ int fib_sync_up(struct net_device *dev)
         head = &fib_info_devhash[hash];
         ret = 0;
 
-        hlist_for_each_entry(nh, node, head, nh_hash) {
+        hlist_for_each_entry(nh, head, nh_hash) {
                 struct fib_info *fi = nh->nh_parent;
                 int alive;
 
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 61e03da3e1f5..ff06b7543d9f 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -920,10 +920,9 @@ nomem:
 static struct leaf_info *find_leaf_info(struct leaf *l, int plen)
 {
         struct hlist_head *head = &l->list;
-        struct hlist_node *node;
         struct leaf_info *li;
 
-        hlist_for_each_entry_rcu(li, node, head, hlist)
+        hlist_for_each_entry_rcu(li, head, hlist)
                 if (li->plen == plen)
                         return li;
 
@@ -943,12 +942,11 @@ static inline struct list_head *get_fa_head(struct leaf *l, int plen)
 static void insert_leaf_info(struct hlist_head *head, struct leaf_info *new)
 {
         struct leaf_info *li = NULL, *last = NULL;
-        struct hlist_node *node;
 
         if (hlist_empty(head)) {
                 hlist_add_head_rcu(&new->hlist, head);
         } else {
-                hlist_for_each_entry(li, node, head, hlist) {
+                hlist_for_each_entry(li, head, hlist) {
                         if (new->plen > li->plen)
                                 break;
 
@@ -1354,9 +1352,8 @@ static int check_leaf(struct fib_table *tb, struct trie *t, struct leaf *l,
 {
         struct leaf_info *li;
         struct hlist_head *hhead = &l->list;
-        struct hlist_node *node;
 
-        hlist_for_each_entry_rcu(li, node, hhead, hlist) {
+        hlist_for_each_entry_rcu(li, hhead, hlist) {
                 struct fib_alias *fa;
 
                 if (l->key != (key & li->mask_plen))
@@ -1740,10 +1737,10 @@ static int trie_flush_leaf(struct leaf *l)
 {
         int found = 0;
         struct hlist_head *lih = &l->list;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         struct leaf_info *li = NULL;
 
-        hlist_for_each_entry_safe(li, node, tmp, lih, hlist) {
+        hlist_for_each_entry_safe(li, tmp, lih, hlist) {
                 found += trie_flush_list(&li->falh);
 
                 if (list_empty(&li->falh)) {
@@ -1895,14 +1892,13 @@ static int fn_trie_dump_leaf(struct leaf *l, struct fib_table *tb,
                         struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct leaf_info *li;
-        struct hlist_node *node;
         int i, s_i;
 
         s_i = cb->args[4];
         i = 0;
 
         /* rcu_read_lock is hold by caller */
-        hlist_for_each_entry_rcu(li, node, &l->list, hlist) {
+        hlist_for_each_entry_rcu(li, &l->list, hlist) {
                 if (i < s_i) {
                         i++;
                         continue;
@@ -2092,14 +2088,13 @@ static void trie_collect_stats(struct trie *t, struct trie_stat *s)
                 if (IS_LEAF(n)) {
                         struct leaf *l = (struct leaf *)n;
                         struct leaf_info *li;
-                        struct hlist_node *tmp;
 
                         s->leaves++;
                         s->totdepth += iter.depth;
                         if (iter.depth > s->maxdepth)
                                 s->maxdepth = iter.depth;
 
-                        hlist_for_each_entry_rcu(li, tmp, &l->list, hlist)
+                        hlist_for_each_entry_rcu(li, &l->list, hlist)
                                 ++s->prefixes;
                 } else {
                         const struct tnode *tn = (const struct tnode *) n;
@@ -2200,10 +2195,9 @@ static int fib_triestat_seq_show(struct seq_file *seq, void *v)
 
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
                 struct hlist_head *head = &net->ipv4.fib_table_hash[h];
-                struct hlist_node *node;
                 struct fib_table *tb;
 
-                hlist_for_each_entry_rcu(tb, node, head, tb_hlist) {
+                hlist_for_each_entry_rcu(tb, head, tb_hlist) {
                         struct trie *t = (struct trie *) tb->tb_data;
                         struct trie_stat stat;
 
@@ -2245,10 +2239,9 @@ static struct rt_trie_node *fib_trie_get_idx(struct seq_file *seq, loff_t pos)
 
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
                 struct hlist_head *head = &net->ipv4.fib_table_hash[h];
-                struct hlist_node *node;
                 struct fib_table *tb;
 
-                hlist_for_each_entry_rcu(tb, node, head, tb_hlist) {
+                hlist_for_each_entry_rcu(tb, head, tb_hlist) {
                         struct rt_trie_node *n;
 
                         for (n = fib_trie_get_first(iter,
@@ -2298,7 +2291,7 @@ static void *fib_trie_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         /* new hash chain */
         while (++h < FIB_TABLE_HASHSZ) {
                 struct hlist_head *head = &net->ipv4.fib_table_hash[h];
-                hlist_for_each_entry_rcu(tb, tb_node, head, tb_hlist) {
+                hlist_for_each_entry_rcu(tb, head, tb_hlist) {
                         n = fib_trie_get_first(iter, (struct trie *) tb->tb_data);
                         if (n)
                                 goto found;
@@ -2381,13 +2374,12 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
         } else {
                 struct leaf *l = (struct leaf *) n;
                 struct leaf_info *li;
-                struct hlist_node *node;
                 __be32 val = htonl(l->key);
 
                 seq_indent(seq, iter->depth);
                 seq_printf(seq, "  |-- %pI4\n", &val);
 
-                hlist_for_each_entry_rcu(li, node, &l->list, hlist) {
+                hlist_for_each_entry_rcu(li, &l->list, hlist) {
                         struct fib_alias *fa;
 
                         list_for_each_entry_rcu(fa, &li->falh, fa_list) {
@@ -2532,7 +2524,6 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
 {
         struct leaf *l = v;
         struct leaf_info *li;
-        struct hlist_node *node;
 
         if (v == SEQ_START_TOKEN) {
                 seq_printf(seq, "%-127s\n", "Iface\tDestination\tGateway "
@@ -2541,7 +2532,7 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
                 return 0;
         }
 
-        hlist_for_each_entry_rcu(li, node, &l->list, hlist) {
+        hlist_for_each_entry_rcu(li, &l->list, hlist) {
                 struct fib_alias *fa;
                 __be32 mask, prefix;
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 11cb4979a465..7d1874be1df3 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -57,7 +57,6 @@ int inet_csk_bind_conflict(const struct sock *sk,
                            const struct inet_bind_bucket *tb, bool relax)
 {
         struct sock *sk2;
-        struct hlist_node *node;
         int reuse = sk->sk_reuse;
         int reuseport = sk->sk_reuseport;
         kuid_t uid = sock_i_uid((struct sock *)sk);
@@ -69,7 +68,7 @@ int inet_csk_bind_conflict(const struct sock *sk,
          * one this bucket belongs to.
          */
 
-        sk_for_each_bound(sk2, node, &tb->owners) {
+        sk_for_each_bound(sk2, &tb->owners) {
                 if (sk != sk2 &&
                     !inet_v6_ipv6only(sk2) &&
                     (!sk->sk_bound_dev_if ||
@@ -95,7 +94,7 @@ int inet_csk_bind_conflict(const struct sock *sk,
                         }
                 }
         }
-        return node != NULL;
+        return sk2 != NULL;
 }
 EXPORT_SYMBOL_GPL(inet_csk_bind_conflict);
 
@@ -106,7 +105,6 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
         struct inet_bind_hashbucket *head;
-        struct hlist_node *node;
         struct inet_bind_bucket *tb;
         int ret, attempts = 5;
         struct net *net = sock_net(sk);
@@ -129,7 +127,7 @@ again:
                         head = &hashinfo->bhash[inet_bhashfn(net, rover,
                                         hashinfo->bhash_size)];
                         spin_lock(&head->lock);
-                        inet_bind_bucket_for_each(tb, node, &head->chain)
+                        inet_bind_bucket_for_each(tb, &head->chain)
                                 if (net_eq(ib_net(tb), net) && tb->port == rover) {
                                         if (((tb->fastreuse > 0 &&
                                               sk->sk_reuse &&
@@ -183,7 +181,7 @@ have_snum:
                 head = &hashinfo->bhash[inet_bhashfn(net, snum,
                                 hashinfo->bhash_size)];
                 spin_lock(&head->lock);
-                inet_bind_bucket_for_each(tb, node, &head->chain)
+                inet_bind_bucket_for_each(tb, &head->chain)
                         if (net_eq(ib_net(tb), net) && tb->port == snum)
                                 goto tb_found;
         }
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 2e453bde6992..245ae078a07f 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -33,9 +33,9 @@ static void inet_frag_secret_rebuild(unsigned long dummy)
         get_random_bytes(&f->rnd, sizeof(u32));
         for (i = 0; i < INETFRAGS_HASHSZ; i++) {
                 struct inet_frag_queue *q;
-                struct hlist_node *p, *n;
+                struct hlist_node *n;
 
-                hlist_for_each_entry_safe(q, p, n, &f->hash[i], list) {
+                hlist_for_each_entry_safe(q, n, &f->hash[i], list) {
                         unsigned int hval = f->hashfn(q);
 
                         if (hval != i) {
@@ -203,7 +203,6 @@ static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,
 {
         struct inet_frag_queue *qp;
 #ifdef CONFIG_SMP
-        struct hlist_node *n;
 #endif
         unsigned int hash;
 
@@ -219,7 +218,7 @@ static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,
          * such entry could be created on other cpu, while we
          * promoted read lock to write lock.
          */
-        hlist_for_each_entry(qp, n, &f->hash[hash], list) {
+        hlist_for_each_entry(qp, &f->hash[hash], list) {
                 if (qp->net == nf && f->match(qp, arg)) {
                         atomic_inc(&qp->refcnt);
                         write_unlock(&f->lock);
@@ -278,9 +277,8 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
         __releases(&f->lock)
 {
         struct inet_frag_queue *q;
-        struct hlist_node *n;
 
-        hlist_for_each_entry(q, n, &f->hash[hash], list) {
+        hlist_for_each_entry(q, &f->hash[hash], list) {
                 if (q->net == nf && f->match(q, key)) {
                         atomic_inc(&q->refcnt);
                         read_unlock(&f->lock);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 0ce0595d9861..6af375afeeef 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -120,13 +120,12 @@ int __inet_inherit_port(struct sock *sk, struct sock *child)
                  * that the listener socket's icsk_bind_hash is the same
                  * as that of the child socket. We have to look up or
                  * create a new bind bucket for the child here. */
-                struct hlist_node *node;
-                inet_bind_bucket_for_each(tb, node, &head->chain) {
+                inet_bind_bucket_for_each(tb, &head->chain) {
                         if (net_eq(ib_net(tb), sock_net(sk)) &&
                             tb->port == port)
                                 break;
                 }
-                if (!node) {
+                if (!tb) {
                         tb = inet_bind_bucket_create(table->bind_bucket_cachep,
                                                      sock_net(sk), head, port);
                         if (!tb) {
@@ -493,7 +492,6 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                 int i, remaining, low, high, port;
                 static u32 hint;
                 u32 offset = hint + port_offset;
-                struct hlist_node *node;
                 struct inet_timewait_sock *tw = NULL;
 
                 inet_get_local_port_range(&low, &high);
@@ -512,7 +510,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                          * because the established check is already
                          * unique enough.
                          */
-                        inet_bind_bucket_for_each(tb, node, &head->chain) {
+                        inet_bind_bucket_for_each(tb, &head->chain) {
                                 if (net_eq(ib_net(tb), net) &&
                                     tb->port == port) {
                                         if (tb->fastreuse >= 0 ||
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 2784db3155fb..1f27c9f4afd0 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -216,7 +216,6 @@ static int inet_twdr_do_twkill_work(struct inet_timewait_death_row *twdr,
                                     const int slot)
 {
         struct inet_timewait_sock *tw;
-        struct hlist_node *node;
         unsigned int killed;
         int ret;
 
@@ -229,7 +228,7 @@ static int inet_twdr_do_twkill_work(struct inet_timewait_death_row *twdr,
         killed = 0;
         ret = 0;
 rescan:
-        inet_twsk_for_each_inmate(tw, node, &twdr->cells[slot]) {
+        inet_twsk_for_each_inmate(tw, &twdr->cells[slot]) {
                 __inet_twsk_del_dead_node(tw);
                 spin_unlock(&twdr->death_lock);
                 __inet_twsk_kill(tw, twdr->hashinfo);
@@ -438,10 +437,10 @@ void inet_twdr_twcal_tick(unsigned long data)
 
         for (n = 0; n < INET_TWDR_RECYCLE_SLOTS; n++) {
                 if (time_before_eq(j, now)) {
-                        struct hlist_node *node, *safe;
+                        struct hlist_node *safe;
                         struct inet_timewait_sock *tw;
 
-                        inet_twsk_for_each_inmate_safe(tw, node, safe,
+                        inet_twsk_for_each_inmate_safe(tw, safe,
                                                        &twdr->twcal_row[slot]) {
                                 __inet_twsk_del_dead_node(tw);
                                 __inet_twsk_kill(tw, twdr->hashinfo);
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 53ddebc292b6..dd44e0ab600c 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -111,9 +111,7 @@ EXPORT_SYMBOL_GPL(raw_unhash_sk);
 static struct sock *__raw_v4_lookup(struct net *net, struct sock *sk,
                 unsigned short num, __be32 raddr, __be32 laddr, int dif)
 {
-        struct hlist_node *node;
-
-        sk_for_each_from(sk, node) {
+        sk_for_each_from(sk) {
                 struct inet_sock *inet = inet_sk(sk);
 
                 if (net_eq(sock_net(sk), net) && inet->inet_num == num  &&
@@ -914,9 +912,7 @@ static struct sock *raw_get_first(struct seq_file *seq)
 
         for (state->bucket = 0; state->bucket < RAW_HTABLE_SIZE;
                         ++state->bucket) {
-                struct hlist_node *node;
-
-                sk_for_each(sk, node, &state->h->ht[state->bucket])
+                sk_for_each(sk, &state->h->ht[state->bucket])
                         if (sock_net(sk) == seq_file_net(seq))
                                 goto found;
         }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 145d3bf8df86..4a8ec457310f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -954,7 +954,6 @@ struct tcp_md5sig_key *tcp_md5_do_lookup(struct sock *sk,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_md5sig_key *key;
-        struct hlist_node *pos;
         unsigned int size = sizeof(struct in_addr);
         struct tcp_md5sig_info *md5sig;
 
@@ -968,7 +967,7 @@ struct tcp_md5sig_key *tcp_md5_do_lookup(struct sock *sk,
         if (family == AF_INET6)
                 size = sizeof(struct in6_addr);
 #endif
-        hlist_for_each_entry_rcu(key, pos, &md5sig->head, node) {
+        hlist_for_each_entry_rcu(key, &md5sig->head, node) {
                 if (key->family != family)
                         continue;
                 if (!memcmp(&key->addr, addr, size))
@@ -1069,14 +1068,14 @@ static void tcp_clear_md5_list(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_md5sig_key *key;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
         struct tcp_md5sig_info *md5sig;
 
         md5sig = rcu_dereference_protected(tp->md5sig_info, 1);
 
         if (!hlist_empty(&md5sig->head))
                 tcp_free_md5sig_pool();
-        hlist_for_each_entry_safe(key, pos, n, &md5sig->head, node) {
+        hlist_for_each_entry_safe(key, n, &md5sig->head, node) {
                 hlist_del_rcu(&key->node);
                 atomic_sub(sizeof(*key), &sk->sk_omem_alloc);
                 kfree_rcu(key, rcu);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 4dc0d44a5d31..f2c7e615f902 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1419,11 +1419,10 @@ int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
                   struct net_device *dev, int strict)
 {
         struct inet6_ifaddr *ifp;
-        struct hlist_node *node;
         unsigned int hash = inet6_addr_hash(addr);
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu(ifp, node, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr) &&
@@ -1445,9 +1444,8 @@ static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
 {
         unsigned int hash = inet6_addr_hash(addr);
         struct inet6_ifaddr *ifp;
-        struct hlist_node *node;
 
-        hlist_for_each_entry(ifp, node, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr)) {
@@ -1487,10 +1485,9 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add
 {
         struct inet6_ifaddr *ifp, *result = NULL;
         unsigned int hash = inet6_addr_hash(addr);
-        struct hlist_node *node;
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu_bh(ifp, node, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr)) {
@@ -2907,11 +2904,10 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         /* Step 2: clear hash table */
         for (i = 0; i < IN6_ADDR_HSIZE; i++) {
                 struct hlist_head *h = &inet6_addr_lst[i];
-                struct hlist_node *n;
 
                 spin_lock_bh(&addrconf_hash_lock);
         restart:
-                hlist_for_each_entry_rcu(ifa, n, h, addr_lst) {
+                hlist_for_each_entry_rcu(ifa, h, addr_lst) {
                         if (ifa->idev == idev) {
                                 hlist_del_init_rcu(&ifa->addr_lst);
                                 addrconf_del_timer(ifa);
@@ -3218,8 +3214,7 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
         }
 
         for (; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
-                struct hlist_node *n;
-                hlist_for_each_entry_rcu_bh(ifa, n, &inet6_addr_lst[state->bucket],
+                hlist_for_each_entry_rcu_bh(ifa, &inet6_addr_lst[state->bucket],
                                          addr_lst) {
                         if (!net_eq(dev_net(ifa->idev->dev), net))
                                 continue;
@@ -3244,9 +3239,8 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
 {
         struct if6_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
-        struct hlist_node *n = &ifa->addr_lst;
 
-        hlist_for_each_entry_continue_rcu_bh(ifa, n, addr_lst) {
+        hlist_for_each_entry_continue_rcu_bh(ifa, addr_lst) {
                 if (!net_eq(dev_net(ifa->idev->dev), net))
                         continue;
                 state->offset++;
@@ -3255,7 +3249,7 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
 
         while (++state->bucket < IN6_ADDR_HSIZE) {
                 state->offset = 0;
-                hlist_for_each_entry_rcu_bh(ifa, n,
+                hlist_for_each_entry_rcu_bh(ifa,
                                      &inet6_addr_lst[state->bucket], addr_lst) {
                         if (!net_eq(dev_net(ifa->idev->dev), net))
                                 continue;
@@ -3357,11 +3351,10 @@ int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
 {
         int ret = 0;
         struct inet6_ifaddr *ifp = NULL;
-        struct hlist_node *n;
         unsigned int hash = inet6_addr_hash(addr);
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu_bh(ifp, n, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr) &&
@@ -3383,7 +3376,6 @@ static void addrconf_verify(unsigned long foo)
 {
         unsigned long now, next, next_sec, next_sched;
         struct inet6_ifaddr *ifp;
-        struct hlist_node *node;
         int i;
 
         rcu_read_lock_bh();
@@ -3395,7 +3387,7 @@ static void addrconf_verify(unsigned long foo)
 
         for (i = 0; i < IN6_ADDR_HSIZE; i++) {
 restart:
-                hlist_for_each_entry_rcu_bh(ifp, node,
+                hlist_for_each_entry_rcu_bh(ifp,
                                          &inet6_addr_lst[i], addr_lst) {
                         unsigned long age;
 
@@ -3866,7 +3858,6 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
         struct net_device *dev;
         struct inet6_dev *idev;
         struct hlist_head *head;
-        struct hlist_node *node;
 
         s_h = cb->args[0];
         s_idx = idx = cb->args[1];
@@ -3876,7 +3867,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
-                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                hlist_for_each_entry_rcu(dev, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         if (h > s_h || idx > s_idx)
@@ -4222,7 +4213,6 @@ static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         struct net_device *dev;
         struct inet6_dev *idev;
         struct hlist_head *head;
-        struct hlist_node *node;
 
         s_h = cb->args[0];
         s_idx = cb->args[1];
@@ -4231,7 +4221,7 @@ static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
-                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                hlist_for_each_entry_rcu(dev, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         idev = __in6_dev_get(dev);
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index ff76eecfd622..aad64352cb60 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -173,9 +173,8 @@ static struct ip6addrlbl_entry *__ipv6_addr_label(struct net *net,
                                                   const struct in6_addr *addr,
                                                   int type, int ifindex)
 {
-        struct hlist_node *pos;
         struct ip6addrlbl_entry *p;
-        hlist_for_each_entry_rcu(p, pos, &ip6addrlbl_table.head, list) {
+        hlist_for_each_entry_rcu(p, &ip6addrlbl_table.head, list) {
                 if (__ip6addrlbl_match(net, p, addr, type, ifindex))
                         return p;
         }
@@ -261,9 +260,9 @@ static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace)
         if (hlist_empty(&ip6addrlbl_table.head)) {
                 hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head);
         } else {
-                struct hlist_node *pos, *n;
+                struct hlist_node *n;
                 struct ip6addrlbl_entry *p = NULL;
-                hlist_for_each_entry_safe(p, pos, n,
+                hlist_for_each_entry_safe(p, n,
                                           &ip6addrlbl_table.head, list) {
                         if (p->prefixlen == newp->prefixlen &&
                             net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) &&
@@ -319,13 +318,13 @@ static int __ip6addrlbl_del(struct net *net,
                             int ifindex)
 {
         struct ip6addrlbl_entry *p = NULL;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
         int ret = -ESRCH;
 
         ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d)\n",
                   __func__, prefix, prefixlen, ifindex);
 
-        hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) {
+        hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) {
                 if (p->prefixlen == prefixlen &&
                     net_eq(ip6addrlbl_net(p), net) &&
                     p->ifindex == ifindex &&
@@ -380,11 +379,11 @@ static int __net_init ip6addrlbl_net_init(struct net *net)
 static void __net_exit ip6addrlbl_net_exit(struct net *net)
 {
         struct ip6addrlbl_entry *p = NULL;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
 
         /* Remove all labels belonging to the exiting net */
         spin_lock(&ip6addrlbl_table.lock);
-        hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) {
+        hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) {
                 if (net_eq(ip6addrlbl_net(p), net)) {
                         hlist_del_rcu(&p->list);
                         ip6addrlbl_put(p);
@@ -505,12 +504,11 @@ static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
         struct ip6addrlbl_entry *p;
-        struct hlist_node *pos;
         int idx = 0, s_idx = cb->args[0];
         int err;
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(p, pos, &ip6addrlbl_table.head, list) {
+        hlist_for_each_entry_rcu(p, &ip6addrlbl_table.head, list) {
                 if (idx >= s_idx &&
                     net_eq(ip6addrlbl_net(p), net)) {
                         if ((err = ip6addrlbl_fill(skb, p,
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index b386a2ce4c6f..9bfab19ff3c0 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -31,7 +31,6 @@ int inet6_csk_bind_conflict(const struct sock *sk,
                             const struct inet_bind_bucket *tb, bool relax)
 {
         const struct sock *sk2;
-        const struct hlist_node *node;
         int reuse = sk->sk_reuse;
         int reuseport = sk->sk_reuseport;
         kuid_t uid = sock_i_uid((struct sock *)sk);
@@ -41,7 +40,7 @@ int inet6_csk_bind_conflict(const struct sock *sk,
          * See comment in inet_csk_bind_conflict about sock lookup
          * vs net namespaces issues.
          */
-        sk_for_each_bound(sk2, node, &tb->owners) {
+        sk_for_each_bound(sk2, &tb->owners) {
                 if (sk != sk2 &&
                     (!sk->sk_bound_dev_if ||
                      !sk2->sk_bound_dev_if ||
@@ -58,7 +57,7 @@ int inet6_csk_bind_conflict(const struct sock *sk,
                 }
         }
 
-        return node != NULL;
+        return sk2 != NULL;
 }
 
 EXPORT_SYMBOL_GPL(inet6_csk_bind_conflict);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 710cafd2e1a9..192dd1a0e188 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -224,7 +224,6 @@ struct fib6_table *fib6_get_table(struct net *net, u32 id)
 {
         struct fib6_table *tb;
         struct hlist_head *head;
-        struct hlist_node *node;
         unsigned int h;
 
         if (id == 0)
@@ -232,7 +231,7 @@ struct fib6_table *fib6_get_table(struct net *net, u32 id)
         h = id & (FIB6_TABLE_HASHSZ - 1);
         rcu_read_lock();
         head = &net->ipv6.fib_table_hash[h];
-        hlist_for_each_entry_rcu(tb, node, head, tb6_hlist) {
+        hlist_for_each_entry_rcu(tb, head, tb6_hlist) {
                 if (tb->tb6_id == id) {
                         rcu_read_unlock();
                         return tb;
@@ -363,7 +362,6 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         struct rt6_rtnl_dump_arg arg;
         struct fib6_walker_t *w;
         struct fib6_table *tb;
-        struct hlist_node *node;
         struct hlist_head *head;
         int res = 0;
 
@@ -398,7 +396,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         for (h = s_h; h < FIB6_TABLE_HASHSZ; h++, s_e = 0) {
                 e = 0;
                 head = &net->ipv6.fib_table_hash[h];
-                hlist_for_each_entry_rcu(tb, node, head, tb6_hlist) {
+                hlist_for_each_entry_rcu(tb, head, tb6_hlist) {
                         if (e < s_e)
                                 goto next;
                         res = fib6_dump_table(tb, skb, cb);
@@ -1520,14 +1518,13 @@ void fib6_clean_all_ro(struct net *net, int (*func)(struct rt6_info *, void *arg
                     int prune, void *arg)
 {
         struct fib6_table *table;
-        struct hlist_node *node;
         struct hlist_head *head;
         unsigned int h;
 
         rcu_read_lock();
         for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
                 head = &net->ipv6.fib_table_hash[h];
-                hlist_for_each_entry_rcu(table, node, head, tb6_hlist) {
+                hlist_for_each_entry_rcu(table, head, tb6_hlist) {
                         read_lock_bh(&table->tb6_lock);
                         fib6_clean_tree(net, &table->tb6_root,
                                         func, prune, arg);
@@ -1540,14 +1537,13 @@ void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *arg),
                     int prune, void *arg)
 {
         struct fib6_table *table;
-        struct hlist_node *node;
         struct hlist_head *head;
         unsigned int h;
 
         rcu_read_lock();
         for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
                 head = &net->ipv6.fib_table_hash[h];
-                hlist_for_each_entry_rcu(table, node, head, tb6_hlist) {
+                hlist_for_each_entry_rcu(table, head, tb6_hlist) {
                         write_lock_bh(&table->tb6_lock);
                         fib6_clean_tree(net, &table->tb6_root,
                                         func, prune, arg);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index c65907db8c44..330b5e7b7df6 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -71,10 +71,9 @@ static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
                 unsigned short num, const struct in6_addr *loc_addr,
                 const struct in6_addr *rmt_addr, int dif)
 {
-        struct hlist_node *node;
         bool is_multicast = ipv6_addr_is_multicast(loc_addr);
 
-        sk_for_each_from(sk, node)
+        sk_for_each_from(sk)
                 if (inet_sk(sk)->inet_num == num) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
 
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 6cc48012b730..de2bcfaaf759 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -89,9 +89,8 @@ static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(struct net *net, const
 {
         struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
         struct xfrm6_tunnel_spi *x6spi;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry_rcu(x6spi, pos,
+        hlist_for_each_entry_rcu(x6spi,
                              &xfrm6_tn->spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                              list_byaddr) {
                 if (xfrm6_addr_equal(&x6spi->addr, saddr))
@@ -120,9 +119,8 @@ static int __xfrm6_tunnel_spi_check(struct net *net, u32 spi)
         struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
         struct xfrm6_tunnel_spi *x6spi;
         int index = xfrm6_tunnel_spi_hash_byspi(spi);
-        struct hlist_node *pos;
 
-        hlist_for_each_entry(x6spi, pos,
+        hlist_for_each_entry(x6spi,
                              &xfrm6_tn->spi_byspi[index],
                              list_byspi) {
                 if (x6spi->spi == spi)
@@ -203,11 +201,11 @@ static void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr)
 {
         struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
         struct xfrm6_tunnel_spi *x6spi;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
 
         spin_lock_bh(&xfrm6_tunnel_spi_lock);
 
-        hlist_for_each_entry_safe(x6spi, pos, n,
+        hlist_for_each_entry_safe(x6spi, n,
                                   &xfrm6_tn->spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                                   list_byaddr)
         {
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index dfd6faaf0ea7..f547a47d381c 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -228,9 +228,8 @@ static struct sock *__ipxitf_find_socket(struct ipx_interface *intrfc,
                                          __be16 port)
 {
         struct sock *s;
-        struct hlist_node *node;
 
-        sk_for_each(s, node, &intrfc->if_sklist)
+        sk_for_each(s, &intrfc->if_sklist)
                 if (ipx_sk(s)->port == port)
                         goto found;
         s = NULL;
@@ -259,12 +258,11 @@ static struct sock *ipxitf_find_internal_socket(struct ipx_interface *intrfc,
                                                 __be16 port)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         ipxitf_hold(intrfc);
         spin_lock_bh(&intrfc->if_sklist_lock);
 
-        sk_for_each(s, node, &intrfc->if_sklist) {
+        sk_for_each(s, &intrfc->if_sklist) {
                 struct ipx_sock *ipxs = ipx_sk(s);
 
                 if (ipxs->port == port &&
@@ -282,14 +280,14 @@ found:
 static void __ipxitf_down(struct ipx_interface *intrfc)
 {
         struct sock *s;
-        struct hlist_node *node, *t;
+        struct hlist_node *t;
 
         /* Delete all routes associated with this interface */
         ipxrtr_del_routes(intrfc);
 
         spin_lock_bh(&intrfc->if_sklist_lock);
         /* error sockets */
-        sk_for_each_safe(s, node, t, &intrfc->if_sklist) {
+        sk_for_each_safe(s, t, &intrfc->if_sklist) {
                 struct ipx_sock *ipxs = ipx_sk(s);
 
                 s->sk_err = ENOLINK;
@@ -385,12 +383,11 @@ static int ipxitf_demux_socket(struct ipx_interface *intrfc,
         int is_broadcast = !memcmp(ipx->ipx_dest.node, ipx_broadcast_node,
                                    IPX_NODE_LEN);
         struct sock *s;
-        struct hlist_node *node;
         int rc;
 
         spin_lock_bh(&intrfc->if_sklist_lock);
 
-        sk_for_each(s, node, &intrfc->if_sklist) {
+        sk_for_each(s, &intrfc->if_sklist) {
                 struct ipx_sock *ipxs = ipx_sk(s);
 
                 if (ipxs->port == ipx->ipx_dest.sock &&
@@ -446,12 +443,11 @@ static struct sock *ncp_connection_hack(struct ipx_interface *intrfc,
                 connection = (((int) *(ncphdr + 9)) << 8) | (int) *(ncphdr + 8);
 
         if (connection) {
-                struct hlist_node *node;
                 /* Now we have to look for a special NCP connection handling
                  * socket. Only these sockets have ipx_ncp_conn != 0, set by
                  * SIOCIPXNCPCONN. */
                 spin_lock_bh(&intrfc->if_sklist_lock);
-                sk_for_each(sk, node, &intrfc->if_sklist)
+                sk_for_each(sk, &intrfc->if_sklist)
                         if (ipx_sk(sk)->ipx_ncp_conn == connection) {
                                 sock_hold(sk);
                                 goto found;
diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c
index 02ff7f2f60d4..65e8833a2510 100644
--- a/net/ipx/ipx_proc.c
+++ b/net/ipx/ipx_proc.c
@@ -103,19 +103,18 @@ out:
 static __inline__ struct sock *ipx_get_socket_idx(loff_t pos)
 {
         struct sock *s = NULL;
-        struct hlist_node *node;
         struct ipx_interface *i;
 
         list_for_each_entry(i, &ipx_interfaces, node) {
                 spin_lock_bh(&i->if_sklist_lock);
-                sk_for_each(s, node, &i->if_sklist) {
+                sk_for_each(s, &i->if_sklist) {
                         if (!pos)
                                 break;
                         --pos;
                 }
                 spin_unlock_bh(&i->if_sklist_lock);
                 if (!pos) {
-                        if (node)
+                        if (s)
                                 goto found;
                         break;
                 }
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index cd6f7a991d80..a7d11ffe4284 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -156,14 +156,13 @@ static int afiucv_pm_freeze(struct device *dev)
 {
         struct iucv_sock *iucv;
         struct sock *sk;
-        struct hlist_node *node;
         int err = 0;
 
 #ifdef CONFIG_PM_DEBUG
         printk(KERN_WARNING "afiucv_pm_freeze\n");
 #endif
         read_lock(&iucv_sk_list.lock);
-        sk_for_each(sk, node, &iucv_sk_list.head) {
+        sk_for_each(sk, &iucv_sk_list.head) {
                 iucv = iucv_sk(sk);
                 switch (sk->sk_state) {
                 case IUCV_DISCONN:
@@ -194,13 +193,12 @@ static int afiucv_pm_freeze(struct device *dev)
 static int afiucv_pm_restore_thaw(struct device *dev)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
 #ifdef CONFIG_PM_DEBUG
         printk(KERN_WARNING "afiucv_pm_restore_thaw\n");
 #endif
         read_lock(&iucv_sk_list.lock);
-        sk_for_each(sk, node, &iucv_sk_list.head) {
+        sk_for_each(sk, &iucv_sk_list.head) {
                 switch (sk->sk_state) {
                 case IUCV_CONNECTED:
                         sk->sk_err = EPIPE;
@@ -390,9 +388,8 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
 static struct sock *__iucv_get_sock_by_name(char *nm)
 {
         struct sock *sk;
-        struct hlist_node *node;
 
-        sk_for_each(sk, node, &iucv_sk_list.head)
+        sk_for_each(sk, &iucv_sk_list.head)
                 if (!memcmp(&iucv_sk(sk)->src_name, nm, 8))
                         return sk;
 
@@ -1678,7 +1675,6 @@ static int iucv_callback_connreq(struct iucv_path *path,
         unsigned char user_data[16];
         unsigned char nuser_data[16];
         unsigned char src_name[8];
-        struct hlist_node *node;
         struct sock *sk, *nsk;
         struct iucv_sock *iucv, *niucv;
         int err;
@@ -1689,7 +1685,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
         read_lock(&iucv_sk_list.lock);
         iucv = NULL;
         sk = NULL;
-        sk_for_each(sk, node, &iucv_sk_list.head)
+        sk_for_each(sk, &iucv_sk_list.head)
                 if (sk->sk_state == IUCV_LISTEN &&
                     !memcmp(&iucv_sk(sk)->src_name, src_name, 8)) {
                         /*
@@ -2115,7 +2111,6 @@ static int afiucv_hs_callback_rx(struct sock *sk, struct sk_buff *skb)
 static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
         struct packet_type *pt, struct net_device *orig_dev)
 {
-        struct hlist_node *node;
         struct sock *sk;
         struct iucv_sock *iucv;
         struct af_iucv_trans_hdr *trans_hdr;
@@ -2132,7 +2127,7 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
         iucv = NULL;
         sk = NULL;
         read_lock(&iucv_sk_list.lock);
-        sk_for_each(sk, node, &iucv_sk_list.head) {
+        sk_for_each(sk, &iucv_sk_list.head) {
                 if (trans_hdr->flags == AF_IUCV_FLAG_SYN) {
                         if ((!memcmp(&iucv_sk(sk)->src_name,
                                      trans_hdr->destAppName, 8)) &&
@@ -2225,10 +2220,9 @@ static void afiucv_hs_callback_txnotify(struct sk_buff *skb,
         struct sk_buff *list_skb;
         struct sk_buff *nskb;
         unsigned long flags;
-        struct hlist_node *node;
 
         read_lock_irqsave(&iucv_sk_list.lock, flags);
-        sk_for_each(sk, node, &iucv_sk_list.head)
+        sk_for_each(sk, &iucv_sk_list.head)
                 if (sk == isk) {
                         iucv = iucv_sk(sk);
                         break;
@@ -2299,14 +2293,13 @@ static int afiucv_netdev_event(struct notifier_block *this,
                                unsigned long event, void *ptr)
 {
         struct net_device *event_dev = (struct net_device *)ptr;
-        struct hlist_node *node;
         struct sock *sk;
         struct iucv_sock *iucv;
 
         switch (event) {
         case NETDEV_REBOOT:
         case NETDEV_GOING_DOWN:
-                sk_for_each(sk, node, &iucv_sk_list.head) {
+                sk_for_each(sk, &iucv_sk_list.head) {
                         iucv = iucv_sk(sk);
                         if ((iucv->hs_dev == event_dev) &&
                             (sk->sk_state == IUCV_CONNECTED)) {
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9ef79851f297..556fdafdd1ea 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -225,7 +225,6 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
 {
         struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
         struct sock *sk;
-        struct hlist_node *node;
         struct sk_buff *skb2 = NULL;
         int err = -ESRCH;
 
@@ -236,7 +235,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                 return -ENOMEM;
 
         rcu_read_lock();
-        sk_for_each_rcu(sk, node, &net_pfkey->table) {
+        sk_for_each_rcu(sk, &net_pfkey->table) {
                 struct pfkey_sock *pfk = pfkey_sk(sk);
                 int err2;
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index dcfd64e83ab7..d36875f3427e 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -221,10 +221,9 @@ static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
         struct hlist_head *session_list =
                 l2tp_session_id_hash_2(pn, session_id);
         struct l2tp_session *session;
-        struct hlist_node *walk;
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu(session, walk, session_list, global_hlist) {
+        hlist_for_each_entry_rcu(session, session_list, global_hlist) {
                 if (session->session_id == session_id) {
                         rcu_read_unlock_bh();
                         return session;
@@ -253,7 +252,6 @@ struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunn
 {
         struct hlist_head *session_list;
         struct l2tp_session *session;
-        struct hlist_node *walk;
 
         /* In L2TPv3, session_ids are unique over all tunnels and we
          * sometimes need to look them up before we know the
@@ -264,7 +262,7 @@ struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunn
 
         session_list = l2tp_session_id_hash(tunnel, session_id);
         read_lock_bh(&tunnel->hlist_lock);
-        hlist_for_each_entry(session, walk, session_list, hlist) {
+        hlist_for_each_entry(session, session_list, hlist) {
                 if (session->session_id == session_id) {
                         read_unlock_bh(&tunnel->hlist_lock);
                         return session;
@@ -279,13 +277,12 @@ EXPORT_SYMBOL_GPL(l2tp_session_find);
 struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
 {
         int hash;
-        struct hlist_node *walk;
         struct l2tp_session *session;
         int count = 0;
 
         read_lock_bh(&tunnel->hlist_lock);
         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
-                hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) {
+                hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
                         if (++count > nth) {
                                 read_unlock_bh(&tunnel->hlist_lock);
                                 return session;
@@ -306,12 +303,11 @@ struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
 {
         struct l2tp_net *pn = l2tp_pernet(net);
         int hash;
-        struct hlist_node *walk;
         struct l2tp_session *session;
 
         rcu_read_lock_bh();
         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
-                hlist_for_each_entry_rcu(session, walk, &pn->l2tp_session_hlist[hash], global_hlist) {
+                hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
                         if (!strcmp(session->ifname, ifname)) {
                                 rcu_read_unlock_bh();
                                 return session;
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index f7ac8f42fee2..7f41b7051269 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -49,10 +49,9 @@ static inline struct l2tp_ip_sock *l2tp_ip_sk(const struct sock *sk)
 
 static struct sock *__l2tp_ip_bind_lookup(struct net *net, __be32 laddr, int dif, u32 tunnel_id)
 {
-        struct hlist_node *node;
         struct sock *sk;
 
-        sk_for_each_bound(sk, node, &l2tp_ip_bind_table) {
+        sk_for_each_bound(sk, &l2tp_ip_bind_table) {
                 struct inet_sock *inet = inet_sk(sk);
                 struct l2tp_ip_sock *l2tp = l2tp_ip_sk(sk);
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 8ee4a86ae996..41f2f8126ebc 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -60,10 +60,9 @@ static struct sock *__l2tp_ip6_bind_lookup(struct net *net,
                                            struct in6_addr *laddr,
                                            int dif, u32 tunnel_id)
 {
-        struct hlist_node *node;
         struct sock *sk;
 
-        sk_for_each_bound(sk, node, &l2tp_ip6_bind_table) {
+        sk_for_each_bound(sk, &l2tp_ip6_bind_table) {
                 struct in6_addr *addr = inet6_rcv_saddr(sk);
                 struct l2tp_ip6_sock *l2tp = l2tp_ip6_sk(sk);
 
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 7c5073badc73..78be45cda5c1 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -393,12 +393,11 @@ static void llc_sap_mcast(struct llc_sap *sap,
 {
         int i = 0, count = 256 / sizeof(struct sock *);
         struct sock *sk, *stack[count];
-        struct hlist_node *node;
         struct llc_sock *llc;
         struct hlist_head *dev_hb = llc_sk_dev_hash(sap, skb->dev->ifindex);
 
         spin_lock_bh(&sap->sk_lock);
-        hlist_for_each_entry(llc, node, dev_hb, dev_hash_node) {
+        hlist_for_each_entry(llc, dev_hb, dev_hash_node) {
 
                 sk = &llc->sk;
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index d0dd11153a6c..1a8591b77a13 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -647,8 +647,6 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         spin_lock_init(&local->ack_status_lock);
         idr_init(&local->ack_status_frames);
-        /* preallocate at least one entry */
-        idr_pre_get(&local->ack_status_frames, GFP_KERNEL);
 
         sta_info_init(local);
 
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 6b3c4e119c63..dc7c8df40c2c 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -72,9 +72,9 @@ static inline struct mesh_table *resize_dereference_mpp_paths(void)
  * it's used twice. So it is illegal to do
  *      for_each_mesh_entry(rcu_dereference(...), ...)
  */
-#define for_each_mesh_entry(tbl, p, node, i) \
+#define for_each_mesh_entry(tbl, node, i) \
         for (i = 0; i <= tbl->hash_mask; i++) \
-                hlist_for_each_entry_rcu(node, p, &tbl->hash_buckets[i], list)
+                hlist_for_each_entry_rcu(node, &tbl->hash_buckets[i], list)
 
 
 static struct mesh_table *mesh_table_alloc(int size_order)
@@ -139,7 +139,7 @@ static void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
         }
         if (free_leafs) {
                 spin_lock_bh(&tbl->gates_lock);
-                hlist_for_each_entry_safe(gate, p, q,
+                hlist_for_each_entry_safe(gate, q,
                                          tbl->known_gates, list) {
                         hlist_del(&gate->list);
                         kfree(gate);
@@ -333,12 +333,11 @@ static struct mesh_path *mpath_lookup(struct mesh_table *tbl, const u8 *dst,
                                       struct ieee80211_sub_if_data *sdata)
 {
         struct mesh_path *mpath;
-        struct hlist_node *n;
         struct hlist_head *bucket;
         struct mpath_node *node;
 
         bucket = &tbl->hash_buckets[mesh_table_hash(dst, sdata, tbl)];
-        hlist_for_each_entry_rcu(node, n, bucket, list) {
+        hlist_for_each_entry_rcu(node, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
                     ether_addr_equal(dst, mpath->dst)) {
@@ -389,11 +388,10 @@ mesh_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx)
 {
         struct mesh_table *tbl = rcu_dereference(mesh_paths);
         struct mpath_node *node;
-        struct hlist_node *p;
         int i;
         int j = 0;
 
-        for_each_mesh_entry(tbl, p, node, i) {
+        for_each_mesh_entry(tbl, node, i) {
                 if (sdata && node->mpath->sdata != sdata)
                         continue;
                 if (j++ == idx) {
@@ -417,13 +415,12 @@ int mesh_path_add_gate(struct mesh_path *mpath)
 {
         struct mesh_table *tbl;
         struct mpath_node *gate, *new_gate;
-        struct hlist_node *n;
         int err;
 
         rcu_read_lock();
         tbl = rcu_dereference(mesh_paths);
 
-        hlist_for_each_entry_rcu(gate, n, tbl->known_gates, list)
+        hlist_for_each_entry_rcu(gate, tbl->known_gates, list)
                 if (gate->mpath == mpath) {
                         err = -EEXIST;
                         goto err_rcu;
@@ -460,9 +457,9 @@ err_rcu:
 static void mesh_gate_del(struct mesh_table *tbl, struct mesh_path *mpath)
 {
         struct mpath_node *gate;
-        struct hlist_node *p, *q;
+        struct hlist_node *q;
 
-        hlist_for_each_entry_safe(gate, p, q, tbl->known_gates, list) {
+        hlist_for_each_entry_safe(gate, q, tbl->known_gates, list) {
                 if (gate->mpath != mpath)
                         continue;
                 spin_lock_bh(&tbl->gates_lock);
@@ -504,7 +501,6 @@ int mesh_path_add(struct ieee80211_sub_if_data *sdata, const u8 *dst)
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
-        struct hlist_node *n;
         int grow = 0;
         int err = 0;
         u32 hash_idx;
@@ -550,7 +546,7 @@ int mesh_path_add(struct ieee80211_sub_if_data *sdata, const u8 *dst)
         spin_lock(&tbl->hashwlock[hash_idx]);
 
         err = -EEXIST;
-        hlist_for_each_entry(node, n, bucket, list) {
+        hlist_for_each_entry(node, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
                     ether_addr_equal(dst, mpath->dst))
@@ -640,7 +636,6 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
-        struct hlist_node *n;
         int grow = 0;
         int err = 0;
         u32 hash_idx;
@@ -680,7 +675,7 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
         spin_lock(&tbl->hashwlock[hash_idx]);
 
         err = -EEXIST;
-        hlist_for_each_entry(node, n, bucket, list) {
+        hlist_for_each_entry(node, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
                     ether_addr_equal(dst, mpath->dst))
@@ -725,14 +720,13 @@ void mesh_plink_broken(struct sta_info *sta)
         static const u8 bcast[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
         struct mesh_path *mpath;
         struct mpath_node *node;
-        struct hlist_node *p;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         int i;
         __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_DEST_UNREACHABLE);
 
         rcu_read_lock();
         tbl = rcu_dereference(mesh_paths);
-        for_each_mesh_entry(tbl, p, node, i) {
+        for_each_mesh_entry(tbl, node, i) {
                 mpath = node->mpath;
                 if (rcu_dereference(mpath->next_hop) == sta &&
                     mpath->flags & MESH_PATH_ACTIVE &&
@@ -792,13 +786,12 @@ void mesh_path_flush_by_nexthop(struct sta_info *sta)
         struct mesh_table *tbl;
         struct mesh_path *mpath;
         struct mpath_node *node;
-        struct hlist_node *p;
         int i;
 
         rcu_read_lock();
         read_lock_bh(&pathtbl_resize_lock);
         tbl = resize_dereference_mesh_paths();
-        for_each_mesh_entry(tbl, p, node, i) {
+        for_each_mesh_entry(tbl, node, i) {
                 mpath = node->mpath;
                 if (rcu_dereference(mpath->next_hop) == sta) {
                         spin_lock(&tbl->hashwlock[i]);
@@ -815,11 +808,10 @@ static void table_flush_by_iface(struct mesh_table *tbl,
 {
         struct mesh_path *mpath;
         struct mpath_node *node;
-        struct hlist_node *p;
         int i;
 
         WARN_ON(!rcu_read_lock_held());
-        for_each_mesh_entry(tbl, p, node, i) {
+        for_each_mesh_entry(tbl, node, i) {
                 mpath = node->mpath;
                 if (mpath->sdata != sdata)
                         continue;
@@ -865,7 +857,6 @@ int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
         struct mesh_path *mpath;
         struct mpath_node *node;
         struct hlist_head *bucket;
-        struct hlist_node *n;
         int hash_idx;
         int err = 0;
 
@@ -875,7 +866,7 @@ int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
         bucket = &tbl->hash_buckets[hash_idx];
 
         spin_lock(&tbl->hashwlock[hash_idx]);
-        hlist_for_each_entry(node, n, bucket, list) {
+        hlist_for_each_entry(node, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
                     ether_addr_equal(addr, mpath->dst)) {
@@ -920,7 +911,6 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
 int mesh_path_send_to_gates(struct mesh_path *mpath)
 {
         struct ieee80211_sub_if_data *sdata = mpath->sdata;
-        struct hlist_node *n;
         struct mesh_table *tbl;
         struct mesh_path *from_mpath = mpath;
         struct mpath_node *gate = NULL;
@@ -935,7 +925,7 @@ int mesh_path_send_to_gates(struct mesh_path *mpath)
         if (!known_gates)
                 return -EHOSTUNREACH;
 
-        hlist_for_each_entry_rcu(gate, n, known_gates, list) {
+        hlist_for_each_entry_rcu(gate, known_gates, list) {
                 if (gate->mpath->sdata != sdata)
                         continue;
 
@@ -951,7 +941,7 @@ int mesh_path_send_to_gates(struct mesh_path *mpath)
                 }
         }
 
-        hlist_for_each_entry_rcu(gate, n, known_gates, list)
+        hlist_for_each_entry_rcu(gate, known_gates, list)
                 if (gate->mpath->sdata == sdata) {
                         mpath_dbg(sdata, "Sending to %pM\n", gate->mpath->dst);
                         mesh_path_tx_pending(gate->mpath);
@@ -1096,12 +1086,11 @@ void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
         struct mesh_table *tbl;
         struct mesh_path *mpath;
         struct mpath_node *node;
-        struct hlist_node *p;
         int i;
 
         rcu_read_lock();
         tbl = rcu_dereference(mesh_paths);
-        for_each_mesh_entry(tbl, p, node, i) {
+        for_each_mesh_entry(tbl, node, i) {
                 if (node->mpath->sdata != sdata)
                         continue;
                 mpath = node->mpath;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5b9602b62405..de8548bf0a7f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2017,24 +2017,14 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 skb = skb_clone(skb, GFP_ATOMIC);
                 if (skb) {
                         unsigned long flags;
-                        int id, r;
+                        int id;
 
                         spin_lock_irqsave(&local->ack_status_lock, flags);
-                        r = idr_get_new_above(&local->ack_status_frames,
-                                              orig_skb, 1, &id);
-                        if (r == -EAGAIN) {
-                                idr_pre_get(&local->ack_status_frames,
-                                            GFP_ATOMIC);
-                                r = idr_get_new_above(&local->ack_status_frames,
-                                                      orig_skb, 1, &id);
-                        }
-                        if (WARN_ON(!id) || id > 0xffff) {
-                                idr_remove(&local->ack_status_frames, id);
-                                r = -ERANGE;
-                        }
+                        id = idr_alloc(&local->ack_status_frames, orig_skb,
+                                       1, 0x10000, GFP_ATOMIC);
                         spin_unlock_irqrestore(&local->ack_status_lock, flags);
 
-                        if (!r) {
+                        if (id >= 0) {
                                 info_id = id;
                                 info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
                         } else if (skb_shared(skb)) {
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 9f00db7e03f2..704e514e02ab 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -259,13 +259,12 @@ __ip_vs_conn_in_get(const struct ip_vs_conn_param *p)
 {
         unsigned int hash;
         struct ip_vs_conn *cp;
-        struct hlist_node *n;
 
         hash = ip_vs_conn_hashkey_param(p, false);
 
         ct_read_lock(hash);
 
-        hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {
+        hlist_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                 if (cp->af == p->af &&
                     p->cport == cp->cport && p->vport == cp->vport &&
                     ip_vs_addr_equal(p->af, p->caddr, &cp->caddr) &&
@@ -344,13 +343,12 @@ struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p)
 {
         unsigned int hash;
         struct ip_vs_conn *cp;
-        struct hlist_node *n;
 
         hash = ip_vs_conn_hashkey_param(p, false);
 
         ct_read_lock(hash);
 
-        hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {
+        hlist_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                 if (!ip_vs_conn_net_eq(cp, p->net))
                         continue;
                 if (p->pe_data && p->pe->ct_match) {
@@ -394,7 +392,6 @@ struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p)
 {
         unsigned int hash;
         struct ip_vs_conn *cp, *ret=NULL;
-        struct hlist_node *n;
 
         /*
          *      Check for "full" addressed entries
@@ -403,7 +400,7 @@ struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p)
 
         ct_read_lock(hash);
 
-        hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {
+        hlist_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                 if (cp->af == p->af &&
                     p->vport == cp->cport && p->cport == cp->dport &&
                     ip_vs_addr_equal(p->af, p->vaddr, &cp->caddr) &&
@@ -953,11 +950,10 @@ static void *ip_vs_conn_array(struct seq_file *seq, loff_t pos)
         int idx;
         struct ip_vs_conn *cp;
         struct ip_vs_iter_state *iter = seq->private;
-        struct hlist_node *n;
 
         for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {
                 ct_read_lock_bh(idx);
-                hlist_for_each_entry(cp, n, &ip_vs_conn_tab[idx], c_list) {
+                hlist_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
                         if (pos-- == 0) {
                                 iter->l = &ip_vs_conn_tab[idx];
                                 return cp;
@@ -981,7 +977,6 @@ static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct ip_vs_conn *cp = v;
         struct ip_vs_iter_state *iter = seq->private;
-        struct hlist_node *e;
         struct hlist_head *l = iter->l;
         int idx;
 
@@ -990,15 +985,15 @@ static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                 return ip_vs_conn_array(seq, 0);
 
         /* more on same hash chain? */
-        if ((e = cp->c_list.next))
-                return hlist_entry(e, struct ip_vs_conn, c_list);
+        if (cp->c_list.next)
+                return hlist_entry(cp->c_list.next, struct ip_vs_conn, c_list);
 
         idx = l - ip_vs_conn_tab;
         ct_read_unlock_bh(idx);
 
         while (++idx < ip_vs_conn_tab_size) {
                 ct_read_lock_bh(idx);
-                hlist_for_each_entry(cp, e, &ip_vs_conn_tab[idx], c_list) {
+                hlist_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
                         iter->l = &ip_vs_conn_tab[idx];
                         return cp;
                 }
@@ -1200,14 +1195,13 @@ void ip_vs_random_dropentry(struct net *net)
          */
         for (idx = 0; idx < (ip_vs_conn_tab_size>>5); idx++) {
                 unsigned int hash = net_random() & ip_vs_conn_tab_mask;
-                struct hlist_node *n;
 
                 /*
                  *  Lock is actually needed in this loop.
                  */
                 ct_write_lock_bh(hash);
 
-                hlist_for_each_entry(cp, n, &ip_vs_conn_tab[hash], c_list) {
+                hlist_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                         if (cp->flags & IP_VS_CONN_F_TEMPLATE)
                                 /* connection template */
                                 continue;
@@ -1255,14 +1249,12 @@ static void ip_vs_conn_flush(struct net *net)
 
 flush_again:
         for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {
-                struct hlist_node *n;
-
                 /*
                  *  Lock is actually needed in this loop.
                  */
                 ct_write_lock_bh(idx);
 
-                hlist_for_each_entry(cp, n, &ip_vs_conn_tab[idx], c_list) {
+                hlist_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
                         if (!ip_vs_conn_net_eq(cp, net))
                                 continue;
                         IP_VS_DBG(4, "del connection\n");
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 3921e5bc1235..8c10e3db3d9b 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -90,14 +90,13 @@ __nf_ct_expect_find(struct net *net, u16 zone,
                     const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_expect *i;
-        struct hlist_node *n;
         unsigned int h;
 
         if (!net->ct.expect_count)
                 return NULL;
 
         h = nf_ct_expect_dst_hash(tuple);
-        hlist_for_each_entry_rcu(i, n, &net->ct.expect_hash[h], hnode) {
+        hlist_for_each_entry_rcu(i, &net->ct.expect_hash[h], hnode) {
                 if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
                     nf_ct_zone(i->master) == zone)
                         return i;
@@ -130,14 +129,13 @@ nf_ct_find_expectation(struct net *net, u16 zone,
                        const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_expect *i, *exp = NULL;
-        struct hlist_node *n;
         unsigned int h;
 
         if (!net->ct.expect_count)
                 return NULL;
 
         h = nf_ct_expect_dst_hash(tuple);
-        hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) {
+        hlist_for_each_entry(i, &net->ct.expect_hash[h], hnode) {
                 if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&
                     nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
                     nf_ct_zone(i->master) == zone) {
@@ -172,13 +170,13 @@ void nf_ct_remove_expectations(struct nf_conn *ct)
 {
         struct nf_conn_help *help = nfct_help(ct);
         struct nf_conntrack_expect *exp;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
 
         /* Optimization: most connection never expect any others. */
         if (!help)
                 return;
 
-        hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
+        hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
                 if (del_timer(&exp->timeout)) {
                         nf_ct_unlink_expect(exp);
                         nf_ct_expect_put(exp);
@@ -348,9 +346,8 @@ static void evict_oldest_expect(struct nf_conn *master,
 {
         struct nf_conn_help *master_help = nfct_help(master);
         struct nf_conntrack_expect *exp, *last = NULL;
-        struct hlist_node *n;
 
-        hlist_for_each_entry(exp, n, &master_help->expectations, lnode) {
+        hlist_for_each_entry(exp, &master_help->expectations, lnode) {
                 if (exp->class == new->class)
                         last = exp;
         }
@@ -369,7 +366,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
         struct nf_conn_help *master_help = nfct_help(master);
         struct nf_conntrack_helper *helper;
         struct net *net = nf_ct_exp_net(expect);
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         unsigned int h;
         int ret = 1;
 
@@ -378,7 +375,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
                 goto out;
         }
         h = nf_ct_expect_dst_hash(&expect->tuple);
-        hlist_for_each_entry_safe(i, n, next, &net->ct.expect_hash[h], hnode) {
+        hlist_for_each_entry_safe(i, next, &net->ct.expect_hash[h], hnode) {
                 if (expect_matches(i, expect)) {
                         if (del_timer(&i->timeout)) {
                                 nf_ct_unlink_expect(i);
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 013cdf69fe29..a9740bd6fe54 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -116,14 +116,13 @@ __nf_ct_helper_find(const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_helper *helper;
         struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) };
-        struct hlist_node *n;
         unsigned int h;
 
         if (!nf_ct_helper_count)
                 return NULL;
 
         h = helper_hash(tuple);
-        hlist_for_each_entry_rcu(helper, n, &nf_ct_helper_hash[h], hnode) {
+        hlist_for_each_entry_rcu(helper, &nf_ct_helper_hash[h], hnode) {
                 if (nf_ct_tuple_src_mask_cmp(tuple, &helper->tuple, &mask))
                         return helper;
         }
@@ -134,11 +133,10 @@ struct nf_conntrack_helper *
 __nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum)
 {
         struct nf_conntrack_helper *h;
-        struct hlist_node *n;
         unsigned int i;
 
         for (i = 0; i < nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_rcu(h, n, &nf_ct_helper_hash[i], hnode) {
+                hlist_for_each_entry_rcu(h, &nf_ct_helper_hash[i], hnode) {
                         if (!strcmp(h->name, name) &&
                             h->tuple.src.l3num == l3num &&
                             h->tuple.dst.protonum == protonum)
@@ -357,7 +355,6 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
 {
         int ret = 0;
         struct nf_conntrack_helper *cur;
-        struct hlist_node *n;
         unsigned int h = helper_hash(&me->tuple);
 
         BUG_ON(me->expect_policy == NULL);
@@ -365,7 +362,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
         BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1);
 
         mutex_lock(&nf_ct_helper_mutex);
-        hlist_for_each_entry(cur, n, &nf_ct_helper_hash[h], hnode) {
+        hlist_for_each_entry(cur, &nf_ct_helper_hash[h], hnode) {
                 if (strncmp(cur->name, me->name, NF_CT_HELPER_NAME_LEN) == 0 &&
                     cur->tuple.src.l3num == me->tuple.src.l3num &&
                     cur->tuple.dst.protonum == me->tuple.dst.protonum) {
@@ -386,13 +383,13 @@ static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
 {
         struct nf_conntrack_tuple_hash *h;
         struct nf_conntrack_expect *exp;
-        const struct hlist_node *n, *next;
+        const struct hlist_node *next;
         const struct hlist_nulls_node *nn;
         unsigned int i;
 
         /* Get rid of expectations */
         for (i = 0; i < nf_ct_expect_hsize; i++) {
-                hlist_for_each_entry_safe(exp, n, next,
+                hlist_for_each_entry_safe(exp, next,
                                           &net->ct.expect_hash[i], hnode) {
                         struct nf_conn_help *help = nfct_help(exp->master);
                         if ((rcu_dereference_protected(
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 5d60e04f9679..9904b15f600e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2370,14 +2370,13 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct net *net = sock_net(skb->sk);
         struct nf_conntrack_expect *exp, *last;
         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
-        struct hlist_node *n;
         u_int8_t l3proto = nfmsg->nfgen_family;
 
         rcu_read_lock();
         last = (struct nf_conntrack_expect *)cb->args[1];
         for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
 restart:
-                hlist_for_each_entry(exp, n, &net->ct.expect_hash[cb->args[0]],
+                hlist_for_each_entry(exp, &net->ct.expect_hash[cb->args[0]],
                                      hnode) {
                         if (l3proto && exp->tuple.src.l3num != l3proto)
                                 continue;
@@ -2510,7 +2509,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
         struct nf_conntrack_expect *exp;
         struct nf_conntrack_tuple tuple;
         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         u_int8_t u3 = nfmsg->nfgen_family;
         unsigned int i;
         u16 zone;
@@ -2557,7 +2556,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                 /* delete all expectations for this helper */
                 spin_lock_bh(&nf_conntrack_lock);
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
-                        hlist_for_each_entry_safe(exp, n, next,
+                        hlist_for_each_entry_safe(exp, next,
                                                   &net->ct.expect_hash[i],
                                                   hnode) {
                                 m_help = nfct_help(exp->master);
@@ -2575,7 +2574,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                 /* This basically means we have to flush everything*/
                 spin_lock_bh(&nf_conntrack_lock);
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
-                        hlist_for_each_entry_safe(exp, n, next,
+                        hlist_for_each_entry_safe(exp, next,
                                                   &net->ct.expect_hash[i],
                                                   hnode) {
                                 if (del_timer(&exp->timeout)) {
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 069229d919b6..0e7d423324c3 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -855,11 +855,11 @@ static int refresh_signalling_expectation(struct nf_conn *ct,
 {
         struct nf_conn_help *help = nfct_help(ct);
         struct nf_conntrack_expect *exp;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         int found = 0;
 
         spin_lock_bh(&nf_conntrack_lock);
-        hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
+        hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
                 if (exp->class != SIP_EXPECT_SIGNALLING ||
                     !nf_inet_addr_cmp(&exp->tuple.dst.u3, addr) ||
                     exp->tuple.dst.protonum != proto ||
@@ -881,10 +881,10 @@ static void flush_expectations(struct nf_conn *ct, bool media)
 {
         struct nf_conn_help *help = nfct_help(ct);
         struct nf_conntrack_expect *exp;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
 
         spin_lock_bh(&nf_conntrack_lock);
-        hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
+        hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
                 if ((exp->class != SIP_EXPECT_SIGNALLING) ^ media)
                         continue;
                 if (!del_timer(&exp->timeout))
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 5f2f9109f461..8d5769c6d16e 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -191,9 +191,8 @@ find_appropriate_src(struct net *net, u16 zone,
         unsigned int h = hash_by_src(net, zone, tuple);
         const struct nf_conn_nat *nat;
         const struct nf_conn *ct;
-        const struct hlist_node *n;
 
-        hlist_for_each_entry_rcu(nat, n, &net->ct.nat_bysource[h], bysource) {
+        hlist_for_each_entry_rcu(nat, &net->ct.nat_bysource[h], bysource) {
                 ct = nat->ct;
                 if (same_src(ct, tuple) && nf_ct_zone(ct) == zone) {
                         /* Copy source part from reply tuple. */
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 945950a8b1f1..a191b6db657e 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -282,7 +282,6 @@ nfnl_cthelper_new(struct sock *nfnl, struct sk_buff *skb,
         const char *helper_name;
         struct nf_conntrack_helper *cur, *helper = NULL;
         struct nf_conntrack_tuple tuple;
-        struct hlist_node *n;
         int ret = 0, i;
 
         if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])
@@ -296,7 +295,7 @@ nfnl_cthelper_new(struct sock *nfnl, struct sk_buff *skb,
 
         rcu_read_lock();
         for (i = 0; i < nf_ct_helper_hsize && !helper; i++) {
-                hlist_for_each_entry_rcu(cur, n, &nf_ct_helper_hash[i], hnode) {
+                hlist_for_each_entry_rcu(cur, &nf_ct_helper_hash[i], hnode) {
 
                         /* skip non-userspace conntrack helpers. */
                         if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
@@ -452,13 +451,12 @@ static int
 nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct nf_conntrack_helper *cur, *last;
-        struct hlist_node *n;
 
         rcu_read_lock();
         last = (struct nf_conntrack_helper *)cb->args[1];
         for (; cb->args[0] < nf_ct_helper_hsize; cb->args[0]++) {
 restart:
-                hlist_for_each_entry_rcu(cur, n,
+                hlist_for_each_entry_rcu(cur,
                                 &nf_ct_helper_hash[cb->args[0]], hnode) {
 
                         /* skip non-userspace conntrack helpers. */
@@ -495,7 +493,6 @@ nfnl_cthelper_get(struct sock *nfnl, struct sk_buff *skb,
 {
         int ret = -ENOENT, i;
         struct nf_conntrack_helper *cur;
-        struct hlist_node *n;
         struct sk_buff *skb2;
         char *helper_name = NULL;
         struct nf_conntrack_tuple tuple;
@@ -520,7 +517,7 @@ nfnl_cthelper_get(struct sock *nfnl, struct sk_buff *skb,
         }
 
         for (i = 0; i < nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_rcu(cur, n, &nf_ct_helper_hash[i], hnode) {
+                hlist_for_each_entry_rcu(cur, &nf_ct_helper_hash[i], hnode) {
 
                         /* skip non-userspace conntrack helpers. */
                         if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
@@ -568,7 +565,7 @@ nfnl_cthelper_del(struct sock *nfnl, struct sk_buff *skb,
 {
         char *helper_name = NULL;
         struct nf_conntrack_helper *cur;
-        struct hlist_node *n, *tmp;
+        struct hlist_node *tmp;
         struct nf_conntrack_tuple tuple;
         bool tuple_set = false, found = false;
         int i, j = 0, ret;
@@ -585,7 +582,7 @@ nfnl_cthelper_del(struct sock *nfnl, struct sk_buff *skb,
         }
 
         for (i = 0; i < nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_safe(cur, n, tmp, &nf_ct_helper_hash[i],
+                hlist_for_each_entry_safe(cur, tmp, &nf_ct_helper_hash[i],
                                                                 hnode) {
                         /* skip non-userspace conntrack helpers. */
                         if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
@@ -654,13 +651,13 @@ err_out:
 static void __exit nfnl_cthelper_exit(void)
 {
         struct nf_conntrack_helper *cur;
-        struct hlist_node *n, *tmp;
+        struct hlist_node *tmp;
         int i;
 
         nfnetlink_subsys_unregister(&nfnl_cthelper_subsys);
 
         for (i=0; i<nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_safe(cur, n, tmp, &nf_ct_helper_hash[i],
+                hlist_for_each_entry_safe(cur, tmp, &nf_ct_helper_hash[i],
                                                                         hnode) {
                         /* skip non-userspace conntrack helpers. */
                         if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 92fd8eca0d31..f248db572972 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -87,11 +87,10 @@ static struct nfulnl_instance *
 __instance_lookup(u_int16_t group_num)
 {
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct nfulnl_instance *inst;
 
         head = &instance_table[instance_hashfn(group_num)];
-        hlist_for_each_entry_rcu(inst, pos, head, hlist) {
+        hlist_for_each_entry_rcu(inst, head, hlist) {
                 if (inst->group_num == group_num)
                         return inst;
         }
@@ -717,11 +716,11 @@ nfulnl_rcv_nl_event(struct notifier_block *this,
                 /* destroy all instances for this portid */
                 spin_lock_bh(&instances_lock);
                 for  (i = 0; i < INSTANCE_BUCKETS; i++) {
-                        struct hlist_node *tmp, *t2;
+                        struct hlist_node *t2;
                         struct nfulnl_instance *inst;
                         struct hlist_head *head = &instance_table[i];
 
-                        hlist_for_each_entry_safe(inst, tmp, t2, head, hlist) {
+                        hlist_for_each_entry_safe(inst, t2, head, hlist) {
                                 if ((net_eq(n->net, &init_net)) &&
                                     (n->portid == inst->peer_portid))
                                         __instance_destroy(inst);
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 3158d87b56a8..858fd52c1040 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -80,11 +80,10 @@ static struct nfqnl_instance *
 instance_lookup(u_int16_t queue_num)
 {
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct nfqnl_instance *inst;
 
         head = &instance_table[instance_hashfn(queue_num)];
-        hlist_for_each_entry_rcu(inst, pos, head, hlist) {
+        hlist_for_each_entry_rcu(inst, head, hlist) {
                 if (inst->queue_num == queue_num)
                         return inst;
         }
@@ -583,11 +582,10 @@ nfqnl_dev_drop(int ifindex)
         rcu_read_lock();
 
         for (i = 0; i < INSTANCE_BUCKETS; i++) {
-                struct hlist_node *tmp;
                 struct nfqnl_instance *inst;
                 struct hlist_head *head = &instance_table[i];
 
-                hlist_for_each_entry_rcu(inst, tmp, head, hlist)
+                hlist_for_each_entry_rcu(inst, head, hlist)
                         nfqnl_flush(inst, dev_cmp, ifindex);
         }
 
@@ -627,11 +625,11 @@ nfqnl_rcv_nl_event(struct notifier_block *this,
                 /* destroy all instances for this portid */
                 spin_lock(&instances_lock);
                 for (i = 0; i < INSTANCE_BUCKETS; i++) {
-                        struct hlist_node *tmp, *t2;
+                        struct hlist_node *t2;
                         struct nfqnl_instance *inst;
                         struct hlist_head *head = &instance_table[i];
 
-                        hlist_for_each_entry_safe(inst, tmp, t2, head, hlist) {
+                        hlist_for_each_entry_safe(inst, t2, head, hlist) {
                                 if ((n->net == &init_net) &&
                                     (n->portid == inst->peer_portid))
                                         __instance_destroy(inst);
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index f264032b8c56..370adf622cef 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -43,12 +43,11 @@ static void xt_rateest_hash_insert(struct xt_rateest *est)
 struct xt_rateest *xt_rateest_lookup(const char *name)
 {
         struct xt_rateest *est;
-        struct hlist_node *n;
         unsigned int h;
 
         h = xt_rateest_hash(name);
         mutex_lock(&xt_rateest_mutex);
-        hlist_for_each_entry(est, n, &rateest_hash[h], list) {
+        hlist_for_each_entry(est, &rateest_hash[h], list) {
                 if (strcmp(est->name, name) == 0) {
                         est->refcnt++;
                         mutex_unlock(&xt_rateest_mutex);
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 70b5591a2586..c40b2695633b 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -101,7 +101,7 @@ static int count_them(struct net *net,
 {
         const struct nf_conntrack_tuple_hash *found;
         struct xt_connlimit_conn *conn;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
         struct nf_conn *found_ct;
         struct hlist_head *hash;
         bool addit = true;
@@ -115,7 +115,7 @@ static int count_them(struct net *net,
         rcu_read_lock();
 
         /* check the saved connections */
-        hlist_for_each_entry_safe(conn, pos, n, hash, node) {
+        hlist_for_each_entry_safe(conn, n, hash, node) {
                 found    = nf_conntrack_find_get(net, NF_CT_DEFAULT_ZONE,
                                                  &conn->tuple);
                 found_ct = NULL;
@@ -258,14 +258,14 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
 {
         const struct xt_connlimit_info *info = par->matchinfo;
         struct xt_connlimit_conn *conn;
-        struct hlist_node *pos, *n;
+        struct hlist_node *n;
         struct hlist_head *hash = info->data->iphash;
         unsigned int i;
 
         nf_ct_l3proto_module_put(par->family);
 
         for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {
-                hlist_for_each_entry_safe(conn, pos, n, &hash[i], node) {
+                hlist_for_each_entry_safe(conn, n, &hash[i], node) {
                         hlist_del(&conn->node);
                         kfree(conn);
                 }
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 98218c896d2e..f330e8beaf69 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -141,11 +141,10 @@ dsthash_find(const struct xt_hashlimit_htable *ht,
              const struct dsthash_dst *dst)
 {
         struct dsthash_ent *ent;
-        struct hlist_node *pos;
         u_int32_t hash = hash_dst(ht, dst);
 
         if (!hlist_empty(&ht->hash[hash])) {
-                hlist_for_each_entry_rcu(ent, pos, &ht->hash[hash], node)
+                hlist_for_each_entry_rcu(ent, &ht->hash[hash], node)
                         if (dst_cmp(ent, dst)) {
                                 spin_lock(&ent->lock);
                                 return ent;
@@ -297,8 +296,8 @@ static void htable_selective_cleanup(struct xt_hashlimit_htable *ht,
         spin_lock_bh(&ht->lock);
         for (i = 0; i < ht->cfg.size; i++) {
                 struct dsthash_ent *dh;
-                struct hlist_node *pos, *n;
-                hlist_for_each_entry_safe(dh, pos, n, &ht->hash[i], node) {
+                struct hlist_node *n;
+                hlist_for_each_entry_safe(dh, n, &ht->hash[i], node) {
                         if ((*select)(ht, dh))
                                 dsthash_free(ht, dh);
                 }
@@ -343,9 +342,8 @@ static struct xt_hashlimit_htable *htable_find_get(struct net *net,
 {
         struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
         struct xt_hashlimit_htable *hinfo;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry(hinfo, pos, &hashlimit_net->htables, node) {
+        hlist_for_each_entry(hinfo, &hashlimit_net->htables, node) {
                 if (!strcmp(name, hinfo->pde->name) &&
                     hinfo->family == family) {
                         hinfo->use++;
@@ -821,10 +819,9 @@ static int dl_seq_show(struct seq_file *s, void *v)
         struct xt_hashlimit_htable *htable = s->private;
         unsigned int *bucket = (unsigned int *)v;
         struct dsthash_ent *ent;
-        struct hlist_node *pos;
 
         if (!hlist_empty(&htable->hash[*bucket])) {
-                hlist_for_each_entry(ent, pos, &htable->hash[*bucket], node)
+                hlist_for_each_entry(ent, &htable->hash[*bucket], node)
                         if (dl_seq_real_show(ent, htable->family, s))
                                 return -1;
         }
@@ -877,7 +874,6 @@ static int __net_init hashlimit_proc_net_init(struct net *net)
 static void __net_exit hashlimit_proc_net_exit(struct net *net)
 {
         struct xt_hashlimit_htable *hinfo;
-        struct hlist_node *pos;
         struct proc_dir_entry *pde;
         struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
 
@@ -890,7 +886,7 @@ static void __net_exit hashlimit_proc_net_exit(struct net *net)
         if (pde == NULL)
                 pde = hashlimit_net->ip6t_hashlimit;
 
-        hlist_for_each_entry(hinfo, pos, &hashlimit_net->htables, node)
+        hlist_for_each_entry(hinfo, &hashlimit_net->htables, node)
                 remove_proc_entry(hinfo->pde->name, pde);
 
         hashlimit_net->ipt_hashlimit = NULL;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 8097b4f3ead4..1e3fd5bfcd86 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -248,11 +248,10 @@ static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
         struct nl_portid_hash *hash = &nl_table[protocol].hash;
         struct hlist_head *head;
         struct sock *sk;
-        struct hlist_node *node;
 
         read_lock(&nl_table_lock);
         head = nl_portid_hashfn(hash, portid);
-        sk_for_each(sk, node, head) {
+        sk_for_each(sk, head) {
                 if (net_eq(sock_net(sk), net) && (nlk_sk(sk)->portid == portid)) {
                         sock_hold(sk);
                         goto found;
@@ -312,9 +311,9 @@ static int nl_portid_hash_rehash(struct nl_portid_hash *hash, int grow)
 
         for (i = 0; i <= omask; i++) {
                 struct sock *sk;
-                struct hlist_node *node, *tmp;
+                struct hlist_node *tmp;
 
-                sk_for_each_safe(sk, node, tmp, &otable[i])
+                sk_for_each_safe(sk, tmp, &otable[i])
                         __sk_add_node(sk, nl_portid_hashfn(hash, nlk_sk(sk)->portid));
         }
 
@@ -344,7 +343,6 @@ static void
 netlink_update_listeners(struct sock *sk)
 {
         struct netlink_table *tbl = &nl_table[sk->sk_protocol];
-        struct hlist_node *node;
         unsigned long mask;
         unsigned int i;
         struct listeners *listeners;
@@ -355,7 +353,7 @@ netlink_update_listeners(struct sock *sk)
 
         for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
                 mask = 0;
-                sk_for_each_bound(sk, node, &tbl->mc_list) {
+                sk_for_each_bound(sk, &tbl->mc_list) {
                         if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
                                 mask |= nlk_sk(sk)->groups[i];
                 }
@@ -371,18 +369,17 @@ static int netlink_insert(struct sock *sk, struct net *net, u32 portid)
         struct hlist_head *head;
         int err = -EADDRINUSE;
         struct sock *osk;
-        struct hlist_node *node;
         int len;
 
         netlink_table_grab();
         head = nl_portid_hashfn(hash, portid);
         len = 0;
-        sk_for_each(osk, node, head) {
+        sk_for_each(osk, head) {
                 if (net_eq(sock_net(osk), net) && (nlk_sk(osk)->portid == portid))
                         break;
                 len++;
         }
-        if (node)
+        if (osk)
                 goto err;
 
         err = -EBUSY;
@@ -575,7 +572,6 @@ static int netlink_autobind(struct socket *sock)
         struct nl_portid_hash *hash = &nl_table[sk->sk_protocol].hash;
         struct hlist_head *head;
         struct sock *osk;
-        struct hlist_node *node;
         s32 portid = task_tgid_vnr(current);
         int err;
         static s32 rover = -4097;
@@ -584,7 +580,7 @@ retry:
         cond_resched();
         netlink_table_grab();
         head = nl_portid_hashfn(hash, portid);
-        sk_for_each(osk, node, head) {
+        sk_for_each(osk, head) {
                 if (!net_eq(sock_net(osk), net))
                         continue;
                 if (nlk_sk(osk)->portid == portid) {
@@ -1101,7 +1097,6 @@ int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid
 {
         struct net *net = sock_net(ssk);
         struct netlink_broadcast_data info;
-        struct hlist_node *node;
         struct sock *sk;
 
         skb = netlink_trim(skb, allocation);
@@ -1124,7 +1119,7 @@ int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid
 
         netlink_lock_table();
 
-        sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
+        sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
                 do_one_broadcast(sk, &info);
 
         consume_skb(skb);
@@ -1200,7 +1195,6 @@ out:
 int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
 {
         struct netlink_set_err_data info;
-        struct hlist_node *node;
         struct sock *sk;
         int ret = 0;
 
@@ -1212,7 +1206,7 @@ int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
 
         read_lock(&nl_table_lock);
 
-        sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
+        sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
                 ret += do_one_set_err(sk, &info);
 
         read_unlock(&nl_table_lock);
@@ -1676,10 +1670,9 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
 void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
 
-        sk_for_each_bound(sk, node, &tbl->mc_list)
+        sk_for_each_bound(sk, &tbl->mc_list)
                 netlink_update_socket_mc(nlk_sk(sk), group, 0);
 }
 
@@ -1974,14 +1967,13 @@ static struct sock *netlink_seq_socket_idx(struct seq_file *seq, loff_t pos)
         struct nl_seq_iter *iter = seq->private;
         int i, j;
         struct sock *s;
-        struct hlist_node *node;
         loff_t off = 0;
 
         for (i = 0; i < MAX_LINKS; i++) {
                 struct nl_portid_hash *hash = &nl_table[i].hash;
 
                 for (j = 0; j <= hash->mask; j++) {
-                        sk_for_each(s, node, &hash->table[j]) {
+                        sk_for_each(s, &hash->table[j]) {
                                 if (sock_net(s) != seq_file_net(seq))
                                         continue;
                                 if (off == pos) {
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 297b07a029de..d1fa1d9ffd2e 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -104,10 +104,9 @@ static void nr_remove_socket(struct sock *sk)
 static void nr_kill_by_device(struct net_device *dev)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_list_lock);
-        sk_for_each(s, node, &nr_list)
+        sk_for_each(s, &nr_list)
                 if (nr_sk(s)->device == dev)
                         nr_disconnect(s, ENETUNREACH);
         spin_unlock_bh(&nr_list_lock);
@@ -149,10 +148,9 @@ static void nr_insert_socket(struct sock *sk)
 static struct sock *nr_find_listener(ax25_address *addr)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_list_lock);
-        sk_for_each(s, node, &nr_list)
+        sk_for_each(s, &nr_list)
                 if (!ax25cmp(&nr_sk(s)->source_addr, addr) &&
                     s->sk_state == TCP_LISTEN) {
                         bh_lock_sock(s);
@@ -170,10 +168,9 @@ found:
 static struct sock *nr_find_socket(unsigned char index, unsigned char id)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_list_lock);
-        sk_for_each(s, node, &nr_list) {
+        sk_for_each(s, &nr_list) {
                 struct nr_sock *nr = nr_sk(s);
 
                 if (nr->my_index == index && nr->my_id == id) {
@@ -194,10 +191,9 @@ static struct sock *nr_find_peer(unsigned char index, unsigned char id,
         ax25_address *dest)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_list_lock);
-        sk_for_each(s, node, &nr_list) {
+        sk_for_each(s, &nr_list) {
                 struct nr_sock *nr = nr_sk(s);
 
                 if (nr->your_index == index && nr->your_id == id &&
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 70ffff76a967..b976d5eff2de 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -49,10 +49,9 @@ static struct nr_node *nr_node_get(ax25_address *callsign)
 {
         struct nr_node *found = NULL;
         struct nr_node *nr_node;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_node_list_lock);
-        nr_node_for_each(nr_node, node, &nr_node_list)
+        nr_node_for_each(nr_node, &nr_node_list)
                 if (ax25cmp(callsign, &nr_node->callsign) == 0) {
                         nr_node_hold(nr_node);
                         found = nr_node;
@@ -67,10 +66,9 @@ static struct nr_neigh *nr_neigh_get_dev(ax25_address *callsign,
 {
         struct nr_neigh *found = NULL;
         struct nr_neigh *nr_neigh;
-        struct hlist_node *node;
 
         spin_lock_bh(&nr_neigh_list_lock);
-        nr_neigh_for_each(nr_neigh, node, &nr_neigh_list)
+        nr_neigh_for_each(nr_neigh, &nr_neigh_list)
                 if (ax25cmp(callsign, &nr_neigh->callsign) == 0 &&
                     nr_neigh->dev == dev) {
                         nr_neigh_hold(nr_neigh);
@@ -114,10 +112,9 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,
          */
         if (nr_neigh != NULL && nr_neigh->failed != 0 && quality == 0) {
                 struct nr_node *nr_nodet;
-                struct hlist_node *node;
 
                 spin_lock_bh(&nr_node_list_lock);
-                nr_node_for_each(nr_nodet, node, &nr_node_list) {
+                nr_node_for_each(nr_nodet, &nr_node_list) {
                         nr_node_lock(nr_nodet);
                         for (i = 0; i < nr_nodet->count; i++)
                                 if (nr_nodet->routes[i].neighbour == nr_neigh)
@@ -485,11 +482,11 @@ static int nr_dec_obs(void)
 {
         struct nr_neigh *nr_neigh;
         struct nr_node  *s;
-        struct hlist_node *node, *nodet;
+        struct hlist_node *nodet;
         int i;
 
         spin_lock_bh(&nr_node_list_lock);
-        nr_node_for_each_safe(s, node, nodet, &nr_node_list) {
+        nr_node_for_each_safe(s, nodet, &nr_node_list) {
                 nr_node_lock(s);
                 for (i = 0; i < s->count; i++) {
                         switch (s->routes[i].obs_count) {
@@ -540,15 +537,15 @@ static int nr_dec_obs(void)
 void nr_rt_device_down(struct net_device *dev)
 {
         struct nr_neigh *s;
-        struct hlist_node *node, *nodet, *node2, *node2t;
+        struct hlist_node *nodet, *node2t;
         struct nr_node  *t;
         int i;
 
         spin_lock_bh(&nr_neigh_list_lock);
-        nr_neigh_for_each_safe(s, node, nodet, &nr_neigh_list) {
+        nr_neigh_for_each_safe(s, nodet, &nr_neigh_list) {
                 if (s->dev == dev) {
                         spin_lock_bh(&nr_node_list_lock);
-                        nr_node_for_each_safe(t, node2, node2t, &nr_node_list) {
+                        nr_node_for_each_safe(t, node2t, &nr_node_list) {
                                 nr_node_lock(t);
                                 for (i = 0; i < t->count; i++) {
                                         if (t->routes[i].neighbour == s) {
@@ -737,11 +734,10 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
 void nr_link_failed(ax25_cb *ax25, int reason)
 {
         struct nr_neigh *s, *nr_neigh = NULL;
-        struct hlist_node *node;
         struct nr_node  *nr_node = NULL;
 
         spin_lock_bh(&nr_neigh_list_lock);
-        nr_neigh_for_each(s, node, &nr_neigh_list) {
+        nr_neigh_for_each(s, &nr_neigh_list) {
                 if (s->ax25 == ax25) {
                         nr_neigh_hold(s);
                         nr_neigh = s;
@@ -761,7 +757,7 @@ void nr_link_failed(ax25_cb *ax25, int reason)
                 return;
         }
         spin_lock_bh(&nr_node_list_lock);
-        nr_node_for_each(nr_node, node, &nr_node_list) {
+        nr_node_for_each(nr_node, &nr_node_list) {
                 nr_node_lock(nr_node);
                 if (nr_node->which < nr_node->count &&
                     nr_node->routes[nr_node->which].neighbour == nr_neigh)
@@ -1013,16 +1009,16 @@ void __exit nr_rt_free(void)
 {
         struct nr_neigh *s = NULL;
         struct nr_node  *t = NULL;
-        struct hlist_node *node, *nodet;
+        struct hlist_node *nodet;
 
         spin_lock_bh(&nr_neigh_list_lock);
         spin_lock_bh(&nr_node_list_lock);
-        nr_node_for_each_safe(t, node, nodet, &nr_node_list) {
+        nr_node_for_each_safe(t, nodet, &nr_node_list) {
                 nr_node_lock(t);
                 nr_remove_node_locked(t);
                 nr_node_unlock(t);
         }
-        nr_neigh_for_each_safe(s, node, nodet, &nr_neigh_list) {
+        nr_neigh_for_each_safe(s, nodet, &nr_neigh_list) {
                 while(s->count) {
                         s->count--;
                         nr_neigh_put(s);
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 746f5a2f9804..7f8266dd14cb 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -71,14 +71,14 @@ static void nfc_llcp_socket_purge(struct nfc_llcp_sock *sock)
 static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
 {
         struct sock *sk;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         struct nfc_llcp_sock *llcp_sock;
 
         skb_queue_purge(&local->tx_queue);
 
         write_lock(&local->sockets.lock);
 
-        sk_for_each_safe(sk, node, tmp, &local->sockets.head) {
+        sk_for_each_safe(sk, tmp, &local->sockets.head) {
                 llcp_sock = nfc_llcp_sock(sk);
 
                 bh_lock_sock(sk);
@@ -171,7 +171,6 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
                                                u8 ssap, u8 dsap)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct nfc_llcp_sock *llcp_sock, *tmp_sock;
 
         pr_debug("ssap dsap %d %d\n", ssap, dsap);
@@ -183,7 +182,7 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
 
         llcp_sock = NULL;
 
-        sk_for_each(sk, node, &local->sockets.head) {
+        sk_for_each(sk, &local->sockets.head) {
                 tmp_sock = nfc_llcp_sock(sk);
 
                 if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) {
@@ -272,7 +271,6 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
                                             u8 *sn, size_t sn_len)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct nfc_llcp_sock *llcp_sock, *tmp_sock;
 
         pr_debug("sn %zd %p\n", sn_len, sn);
@@ -284,7 +282,7 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
 
         llcp_sock = NULL;
 
-        sk_for_each(sk, node, &local->sockets.head) {
+        sk_for_each(sk, &local->sockets.head) {
                 tmp_sock = nfc_llcp_sock(sk);
 
                 pr_debug("llcp sock %p\n", tmp_sock);
@@ -601,14 +599,13 @@ static void nfc_llcp_set_nrns(struct nfc_llcp_sock *sock, struct sk_buff *pdu)
 void nfc_llcp_send_to_raw_sock(struct nfc_llcp_local *local,
                                struct sk_buff *skb, u8 direction)
 {
-        struct hlist_node *node;
         struct sk_buff *skb_copy = NULL, *nskb;
         struct sock *sk;
         u8 *data;
 
         read_lock(&local->raw_sockets.lock);
 
-        sk_for_each(sk, node, &local->raw_sockets.head) {
+        sk_for_each(sk, &local->raw_sockets.head) {
                 if (sk->sk_state != LLCP_BOUND)
                         continue;
 
@@ -697,11 +694,10 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local
 {
         struct sock *sk;
         struct nfc_llcp_sock *llcp_sock;
-        struct hlist_node *node;
 
         read_lock(&local->connecting_sockets.lock);
 
-        sk_for_each(sk, node, &local->connecting_sockets.head) {
+        sk_for_each(sk, &local->connecting_sockets.head) {
                 llcp_sock = nfc_llcp_sock(sk);
 
                 if (llcp_sock->ssap == ssap) {
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 9dc537df46c4..e87a26506dba 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -158,11 +158,10 @@ static struct hlist_head *vport_hash_bucket(const struct datapath *dp,
 struct vport *ovs_lookup_vport(const struct datapath *dp, u16 port_no)
 {
         struct vport *vport;
-        struct hlist_node *n;
         struct hlist_head *head;
 
         head = vport_hash_bucket(dp, port_no);
-        hlist_for_each_entry_rcu(vport, n, head, dp_hash_node) {
+        hlist_for_each_entry_rcu(vport, head, dp_hash_node) {
                 if (vport->port_no == port_no)
                         return vport;
         }
@@ -1386,9 +1385,9 @@ static void __dp_destroy(struct datapath *dp)
 
         for (i = 0; i < DP_VPORT_HASH_BUCKETS; i++) {
                 struct vport *vport;
-                struct hlist_node *node, *n;
+                struct hlist_node *n;
 
-                hlist_for_each_entry_safe(vport, node, n, &dp->ports[i], dp_hash_node)
+                hlist_for_each_entry_safe(vport, n, &dp->ports[i], dp_hash_node)
                         if (vport->port_no != OVSP_LOCAL)
                                 ovs_dp_detach_port(vport);
         }
@@ -1825,10 +1824,9 @@ static int ovs_vport_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
         rcu_read_lock();
         for (i = bucket; i < DP_VPORT_HASH_BUCKETS; i++) {
                 struct vport *vport;
-                struct hlist_node *n;
 
                 j = 0;
-                hlist_for_each_entry_rcu(vport, n, &dp->ports[i], dp_hash_node) {
+                hlist_for_each_entry_rcu(vport, &dp->ports[i], dp_hash_node) {
                         if (j >= skip &&
                             ovs_vport_cmd_fill_info(vport, skb,
                                                     NETLINK_CB(cb->skb).portid,
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index c3294cebc4f2..20605ecf100b 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -299,10 +299,10 @@ void ovs_flow_tbl_destroy(struct flow_table *table)
         for (i = 0; i < table->n_buckets; i++) {
                 struct sw_flow *flow;
                 struct hlist_head *head = flex_array_get(table->buckets, i);
-                struct hlist_node *node, *n;
+                struct hlist_node *n;
                 int ver = table->node_ver;
 
-                hlist_for_each_entry_safe(flow, node, n, head, hash_node[ver]) {
+                hlist_for_each_entry_safe(flow, n, head, hash_node[ver]) {
                         hlist_del_rcu(&flow->hash_node[ver]);
                         ovs_flow_free(flow);
                 }
@@ -332,7 +332,6 @@ struct sw_flow *ovs_flow_tbl_next(struct flow_table *table, u32 *bucket, u32 *la
 {
         struct sw_flow *flow;
         struct hlist_head *head;
-        struct hlist_node *n;
         int ver;
         int i;
 
@@ -340,7 +339,7 @@ struct sw_flow *ovs_flow_tbl_next(struct flow_table *table, u32 *bucket, u32 *la
         while (*bucket < table->n_buckets) {
                 i = 0;
                 head = flex_array_get(table->buckets, *bucket);
-                hlist_for_each_entry_rcu(flow, n, head, hash_node[ver]) {
+                hlist_for_each_entry_rcu(flow, head, hash_node[ver]) {
                         if (i < *last) {
                                 i++;
                                 continue;
@@ -367,11 +366,10 @@ static void flow_table_copy_flows(struct flow_table *old, struct flow_table *new
         for (i = 0; i < old->n_buckets; i++) {
                 struct sw_flow *flow;
                 struct hlist_head *head;
-                struct hlist_node *n;
 
                 head = flex_array_get(old->buckets, i);
 
-                hlist_for_each_entry(flow, n, head, hash_node[old_ver])
+                hlist_for_each_entry(flow, head, hash_node[old_ver])
                         ovs_flow_tbl_insert(new, flow);
         }
         old->keep_flows = true;
@@ -766,14 +764,13 @@ struct sw_flow *ovs_flow_tbl_lookup(struct flow_table *table,
                                 struct sw_flow_key *key, int key_len)
 {
         struct sw_flow *flow;
-        struct hlist_node *n;
         struct hlist_head *head;
         u32 hash;
 
         hash = ovs_flow_hash(key, key_len);
 
         head = find_bucket(table, hash);
-        hlist_for_each_entry_rcu(flow, n, head, hash_node[table->node_ver]) {
+        hlist_for_each_entry_rcu(flow, head, hash_node[table->node_ver]) {
 
                 if (flow->hash == hash &&
                     !memcmp(&flow->key, key, key_len)) {
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 70af0bedbac4..ba717cc038b3 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -86,9 +86,8 @@ struct vport *ovs_vport_locate(struct net *net, const char *name)
 {
         struct hlist_head *bucket = hash_bucket(net, name);
         struct vport *vport;
-        struct hlist_node *node;
 
-        hlist_for_each_entry_rcu(vport, node, bucket, hash_node)
+        hlist_for_each_entry_rcu(vport, bucket, hash_node)
                 if (!strcmp(name, vport->ops->get_name(vport)) &&
                     net_eq(ovs_dp_get_net(vport->dp), net))
                         return vport;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c7bfeff10767..1d6793dbfbae 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3263,12 +3263,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
 {
         struct sock *sk;
-        struct hlist_node *node;
         struct net_device *dev = data;
         struct net *net = dev_net(dev);
 
         rcu_read_lock();
-        sk_for_each_rcu(sk, node, &net->packet.sklist) {
+        sk_for_each_rcu(sk, &net->packet.sklist) {
                 struct packet_sock *po = pkt_sk(sk);
 
                 switch (msg) {
diff --git a/net/packet/diag.c b/net/packet/diag.c
index 8db6e21c46bd..d3fcd1ebef7e 100644
--- a/net/packet/diag.c
+++ b/net/packet/diag.c
@@ -172,13 +172,12 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
         struct packet_diag_req *req;
         struct net *net;
         struct sock *sk;
-        struct hlist_node *node;
 
         net = sock_net(skb->sk);
         req = nlmsg_data(cb->nlh);
 
         mutex_lock(&net->packet.sklist_lock);
-        sk_for_each(sk, node, &net->packet.sklist) {
+        sk_for_each(sk, &net->packet.sklist) {
                 if (!net_eq(sock_net(sk), net))
                         continue;
                 if (num < s_num)
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 576f22c9c76e..e77411735de8 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -640,11 +640,10 @@ static struct sock *pep_find_pipe(const struct hlist_head *hlist,
                                         const struct sockaddr_pn *dst,
                                         u8 pipe_handle)
 {
-        struct hlist_node *node;
         struct sock *sknode;
         u16 dobj = pn_sockaddr_get_object(dst);
 
-        sk_for_each(sknode, node, hlist) {
+        sk_for_each(sknode, hlist) {
                 struct pep_sock *pnnode = pep_sk(sknode);
 
                 /* Ports match, but addresses might not: */
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index b7e982782255..1afd1381cdc7 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -76,7 +76,6 @@ static struct hlist_head *pn_hash_list(u16 obj)
  */
 struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
 {
-        struct hlist_node *node;
         struct sock *sknode;
         struct sock *rval = NULL;
         u16 obj = pn_sockaddr_get_object(spn);
@@ -84,7 +83,7 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
         struct hlist_head *hlist = pn_hash_list(obj);
 
         rcu_read_lock();
-        sk_for_each_rcu(sknode, node, hlist) {
+        sk_for_each_rcu(sknode, hlist) {
                 struct pn_sock *pn = pn_sk(sknode);
                 BUG_ON(!pn->sobject); /* unbound socket */
 
@@ -120,10 +119,9 @@ void pn_deliver_sock_broadcast(struct net *net, struct sk_buff *skb)
 
         rcu_read_lock();
         for (h = 0; h < PN_HASHSIZE; h++) {
-                struct hlist_node *node;
                 struct sock *sknode;
 
-                sk_for_each(sknode, node, hlist) {
+                sk_for_each(sknode, hlist) {
                         struct sk_buff *clone;
 
                         if (!net_eq(sock_net(sknode), net))
@@ -543,12 +541,11 @@ static struct sock *pn_sock_get_idx(struct seq_file *seq, loff_t pos)
 {
         struct net *net = seq_file_net(seq);
         struct hlist_head *hlist = pnsocks.hlist;
-        struct hlist_node *node;
         struct sock *sknode;
         unsigned int h;
 
         for (h = 0; h < PN_HASHSIZE; h++) {
-                sk_for_each_rcu(sknode, node, hlist) {
+                sk_for_each_rcu(sknode, hlist) {
                         if (!net_eq(net, sock_net(sknode)))
                                 continue;
                         if (!pos)
diff --git a/net/rds/bind.c b/net/rds/bind.c
index 637bde56c9db..b5ad65a0067e 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -52,13 +52,12 @@ static struct rds_sock *rds_bind_lookup(__be32 addr, __be16 port,
                                         struct rds_sock *insert)
 {
         struct rds_sock *rs;
-        struct hlist_node *node;
         struct hlist_head *head = hash_to_bucket(addr, port);
         u64 cmp;
         u64 needle = ((u64)be32_to_cpu(addr) << 32) | be16_to_cpu(port);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(rs, node, head, rs_bound_node) {
+        hlist_for_each_entry_rcu(rs, head, rs_bound_node) {
                 cmp = ((u64)be32_to_cpu(rs->rs_bound_addr) << 32) |
                       be16_to_cpu(rs->rs_bound_port);
 
diff --git a/net/rds/connection.c b/net/rds/connection.c
index 9e07c756d1f9..642ad42c416b 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -69,9 +69,8 @@ static struct rds_connection *rds_conn_lookup(struct hlist_head *head,
                                               struct rds_transport *trans)
 {
         struct rds_connection *conn, *ret = NULL;
-        struct hlist_node *pos;
 
-        hlist_for_each_entry_rcu(conn, pos, head, c_hash_node) {
+        hlist_for_each_entry_rcu(conn, head, c_hash_node) {
                 if (conn->c_faddr == faddr && conn->c_laddr == laddr &&
                                 conn->c_trans == trans) {
                         ret = conn;
@@ -376,7 +375,6 @@ static void rds_conn_message_info(struct socket *sock, unsigned int len,
                                   int want_send)
 {
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct list_head *list;
         struct rds_connection *conn;
         struct rds_message *rm;
@@ -390,7 +388,7 @@ static void rds_conn_message_info(struct socket *sock, unsigned int len,
 
         for (i = 0, head = rds_conn_hash; i < ARRAY_SIZE(rds_conn_hash);
              i++, head++) {
-                hlist_for_each_entry_rcu(conn, pos, head, c_hash_node) {
+                hlist_for_each_entry_rcu(conn, head, c_hash_node) {
                         if (want_send)
                                 list = &conn->c_send_queue;
                         else
@@ -439,7 +437,6 @@ void rds_for_each_conn_info(struct socket *sock, unsigned int len,
 {
         uint64_t buffer[(item_len + 7) / 8];
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct rds_connection *conn;
         size_t i;
 
@@ -450,7 +447,7 @@ void rds_for_each_conn_info(struct socket *sock, unsigned int len,
 
         for (i = 0, head = rds_conn_hash; i < ARRAY_SIZE(rds_conn_hash);
              i++, head++) {
-                hlist_for_each_entry_rcu(conn, pos, head, c_hash_node) {
+                hlist_for_each_entry_rcu(conn, head, c_hash_node) {
 
                         /* XXX no c_lock usage.. */
                         if (!visitor(conn, buffer))
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index b768fe9d5e7a..cf68e6e4054a 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -165,10 +165,9 @@ static void rose_remove_socket(struct sock *sk)
 void rose_kill_by_neigh(struct rose_neigh *neigh)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&rose_list_lock);
-        sk_for_each(s, node, &rose_list) {
+        sk_for_each(s, &rose_list) {
                 struct rose_sock *rose = rose_sk(s);
 
                 if (rose->neighbour == neigh) {
@@ -186,10 +185,9 @@ void rose_kill_by_neigh(struct rose_neigh *neigh)
 static void rose_kill_by_device(struct net_device *dev)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&rose_list_lock);
-        sk_for_each(s, node, &rose_list) {
+        sk_for_each(s, &rose_list) {
                 struct rose_sock *rose = rose_sk(s);
 
                 if (rose->device == dev) {
@@ -246,10 +244,9 @@ static void rose_insert_socket(struct sock *sk)
 static struct sock *rose_find_listener(rose_address *addr, ax25_address *call)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&rose_list_lock);
-        sk_for_each(s, node, &rose_list) {
+        sk_for_each(s, &rose_list) {
                 struct rose_sock *rose = rose_sk(s);
 
                 if (!rosecmp(&rose->source_addr, addr) &&
@@ -258,7 +255,7 @@ static struct sock *rose_find_listener(rose_address *addr, ax25_address *call)
                         goto found;
         }
 
-        sk_for_each(s, node, &rose_list) {
+        sk_for_each(s, &rose_list) {
                 struct rose_sock *rose = rose_sk(s);
 
                 if (!rosecmp(&rose->source_addr, addr) &&
@@ -278,10 +275,9 @@ found:
 struct sock *rose_find_socket(unsigned int lci, struct rose_neigh *neigh)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock_bh(&rose_list_lock);
-        sk_for_each(s, node, &rose_list) {
+        sk_for_each(s, &rose_list) {
                 struct rose_sock *rose = rose_sk(s);
 
                 if (rose->lci == lci && rose->neighbour == neigh)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index a181b484812a..c297e2a8e2a1 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -545,7 +545,7 @@ static void qdisc_class_hash_free(struct hlist_head *h, unsigned int n)
 void qdisc_class_hash_grow(struct Qdisc *sch, struct Qdisc_class_hash *clhash)
 {
         struct Qdisc_class_common *cl;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         struct hlist_head *nhash, *ohash;
         unsigned int nsize, nmask, osize;
         unsigned int i, h;
@@ -564,7 +564,7 @@ void qdisc_class_hash_grow(struct Qdisc *sch, struct Qdisc_class_hash *clhash)
 
         sch_tree_lock(sch);
         for (i = 0; i < osize; i++) {
-                hlist_for_each_entry_safe(cl, n, next, &ohash[i], hnode) {
+                hlist_for_each_entry_safe(cl, next, &ohash[i], hnode) {
                         h = qdisc_class_hash(cl->classid, nmask);
                         hlist_add_head(&cl->hnode, &nhash[h]);
                 }
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 0e19948470b8..13aa47aa2ffb 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1041,14 +1041,13 @@ static void cbq_adjust_levels(struct cbq_class *this)
 static void cbq_normalize_quanta(struct cbq_sched_data *q, int prio)
 {
         struct cbq_class *cl;
-        struct hlist_node *n;
         unsigned int h;
 
         if (q->quanta[prio] == 0)
                 return;
 
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[h], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
                         /* BUGGGG... Beware! This expression suffer of
                          * arithmetic overflows!
                          */
@@ -1087,10 +1086,9 @@ static void cbq_sync_defmap(struct cbq_class *cl)
                         continue;
 
                 for (h = 0; h < q->clhash.hashsize; h++) {
-                        struct hlist_node *n;
                         struct cbq_class *c;
 
-                        hlist_for_each_entry(c, n, &q->clhash.hash[h],
+                        hlist_for_each_entry(c, &q->clhash.hash[h],
                                              common.hnode) {
                                 if (c->split == split && c->level < level &&
                                     c->defmap & (1<<i)) {
@@ -1210,7 +1208,6 @@ cbq_reset(struct Qdisc *sch)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
         struct cbq_class *cl;
-        struct hlist_node *n;
         int prio;
         unsigned int h;
 
@@ -1228,7 +1225,7 @@ cbq_reset(struct Qdisc *sch)
                 q->active[prio] = NULL;
 
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[h], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
                         qdisc_reset(cl->q);
 
                         cl->next_alive = NULL;
@@ -1697,7 +1694,7 @@ static void cbq_destroy_class(struct Qdisc *sch, struct cbq_class *cl)
 static void cbq_destroy(struct Qdisc *sch)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         struct cbq_class *cl;
         unsigned int h;
 
@@ -1710,11 +1707,11 @@ static void cbq_destroy(struct Qdisc *sch)
          * be bound to classes which have been destroyed already. --TGR '04
          */
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[h], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode)
                         tcf_destroy_chain(&cl->filter_list);
         }
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[h],
+                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[h],
                                           common.hnode)
                         cbq_destroy_class(sch, cl);
         }
@@ -2013,14 +2010,13 @@ static void cbq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
         struct cbq_class *cl;
-        struct hlist_node *n;
         unsigned int h;
 
         if (arg->stop)
                 return;
 
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[h], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
                         if (arg->count < arg->skip) {
                                 arg->count++;
                                 continue;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 71e50c80315f..759b308d1a8d 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -293,14 +293,13 @@ static void drr_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 {
         struct drr_sched *q = qdisc_priv(sch);
         struct drr_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         if (arg->stop)
                 return;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (arg->count < arg->skip) {
                                 arg->count++;
                                 continue;
@@ -451,11 +450,10 @@ static void drr_reset_qdisc(struct Qdisc *sch)
 {
         struct drr_sched *q = qdisc_priv(sch);
         struct drr_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (cl->qdisc->q.qlen)
                                 list_del(&cl->alist);
                         qdisc_reset(cl->qdisc);
@@ -468,13 +466,13 @@ static void drr_destroy_qdisc(struct Qdisc *sch)
 {
         struct drr_sched *q = qdisc_priv(sch);
         struct drr_class *cl;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         unsigned int i;
 
         tcf_destroy_chain(&q->filter_list);
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[i],
+                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
                                           common.hnode)
                         drr_destroy_class(sch, cl);
         }
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 6c2ec4510540..9facea03faeb 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1389,7 +1389,6 @@ static void
 hfsc_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 {
         struct hfsc_sched *q = qdisc_priv(sch);
-        struct hlist_node *n;
         struct hfsc_class *cl;
         unsigned int i;
 
@@ -1397,7 +1396,7 @@ hfsc_walk(struct Qdisc *sch, struct qdisc_walker *arg)
                 return;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i],
+                hlist_for_each_entry(cl, &q->clhash.hash[i],
                                      cl_common.hnode) {
                         if (arg->count < arg->skip) {
                                 arg->count++;
@@ -1523,11 +1522,10 @@ hfsc_reset_qdisc(struct Qdisc *sch)
 {
         struct hfsc_sched *q = qdisc_priv(sch);
         struct hfsc_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], cl_common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
                         hfsc_reset_class(cl);
         }
         q->eligible = RB_ROOT;
@@ -1540,16 +1538,16 @@ static void
 hfsc_destroy_qdisc(struct Qdisc *sch)
 {
         struct hfsc_sched *q = qdisc_priv(sch);
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         struct hfsc_class *cl;
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], cl_common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
                         tcf_destroy_chain(&cl->filter_list);
         }
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[i],
+                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
                                           cl_common.hnode)
                         hfsc_destroy_class(sch, cl);
         }
@@ -1564,12 +1562,11 @@ hfsc_dump_qdisc(struct Qdisc *sch, struct sk_buff *skb)
         unsigned char *b = skb_tail_pointer(skb);
         struct tc_hfsc_qopt qopt;
         struct hfsc_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         sch->qstats.backlog = 0;
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], cl_common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
                         sch->qstats.backlog += cl->qdisc->qstats.backlog;
         }
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 03c2692ca01e..571f1d211f4d 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -949,11 +949,10 @@ static void htb_reset(struct Qdisc *sch)
 {
         struct htb_sched *q = qdisc_priv(sch);
         struct htb_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (cl->level)
                                 memset(&cl->un.inner, 0, sizeof(cl->un.inner));
                         else {
@@ -1218,7 +1217,7 @@ static void htb_destroy_class(struct Qdisc *sch, struct htb_class *cl)
 static void htb_destroy(struct Qdisc *sch)
 {
         struct htb_sched *q = qdisc_priv(sch);
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         struct htb_class *cl;
         unsigned int i;
 
@@ -1232,11 +1231,11 @@ static void htb_destroy(struct Qdisc *sch)
         tcf_destroy_chain(&q->filter_list);
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode)
                         tcf_destroy_chain(&cl->filter_list);
         }
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[i],
+                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
                                           common.hnode)
                         htb_destroy_class(sch, cl);
         }
@@ -1516,14 +1515,13 @@ static void htb_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 {
         struct htb_sched *q = qdisc_priv(sch);
         struct htb_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         if (arg->stop)
                 return;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (arg->count < arg->skip) {
                                 arg->count++;
                                 continue;
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 6ed37652a4c3..e9a77f621c3d 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -276,9 +276,8 @@ static struct qfq_aggregate *qfq_find_agg(struct qfq_sched *q,
                                           u32 lmax, u32 weight)
 {
         struct qfq_aggregate *agg;
-        struct hlist_node *n;
 
-        hlist_for_each_entry(agg, n, &q->nonfull_aggs, nonfull_next)
+        hlist_for_each_entry(agg, &q->nonfull_aggs, nonfull_next)
                 if (agg->lmax == lmax && agg->class_weight == weight)
                         return agg;
 
@@ -670,14 +669,13 @@ static void qfq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
 {
         struct qfq_sched *q = qdisc_priv(sch);
         struct qfq_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         if (arg->stop)
                 return;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (arg->count < arg->skip) {
                                 arg->count++;
                                 continue;
@@ -1376,11 +1374,10 @@ static unsigned int qfq_drop_from_slot(struct qfq_sched *q,
                                        struct hlist_head *slot)
 {
         struct qfq_aggregate *agg;
-        struct hlist_node *n;
         struct qfq_class *cl;
         unsigned int len;
 
-        hlist_for_each_entry(agg, n, slot, next) {
+        hlist_for_each_entry(agg, slot, next) {
                 list_for_each_entry(cl, &agg->active, alist) {
 
                         if (!cl->qdisc->ops->drop)
@@ -1459,11 +1456,10 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
 {
         struct qfq_sched *q = qdisc_priv(sch);
         struct qfq_class *cl;
-        struct hlist_node *n;
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         if (cl->qdisc->q.qlen > 0)
                                 qfq_deactivate_class(q, cl);
 
@@ -1477,13 +1473,13 @@ static void qfq_destroy_qdisc(struct Qdisc *sch)
 {
         struct qfq_sched *q = qdisc_priv(sch);
         struct qfq_class *cl;
-        struct hlist_node *n, *next;
+        struct hlist_node *next;
         unsigned int i;
 
         tcf_destroy_chain(&q->filter_list);
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[i],
+                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
                                           common.hnode) {
                         qfq_destroy_class(sch, cl);
                 }
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 2f95f5a5145d..43cd0dd9149d 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1591,32 +1591,31 @@ int sctp_assoc_lookup_laddr(struct sctp_association *asoc,
 /* Set an association id for a given association */
 int sctp_assoc_set_id(struct sctp_association *asoc, gfp_t gfp)
 {
-        int assoc_id;
-        int error = 0;
+        bool preload = gfp & __GFP_WAIT;
+        int ret;
 
         /* If the id is already assigned, keep it. */
         if (asoc->assoc_id)
-                return error;
-retry:
-        if (unlikely(!idr_pre_get(&sctp_assocs_id, gfp)))
-                return -ENOMEM;
+                return 0;
 
+        if (preload)
+                idr_preload(gfp);
         spin_lock_bh(&sctp_assocs_id_lock);
-        error = idr_get_new_above(&sctp_assocs_id, (void *)asoc,
-                                    idr_low, &assoc_id);
-        if (!error) {
-                idr_low = assoc_id + 1;
+        /* 0 is not a valid id, idr_low is always >= 1 */
+        ret = idr_alloc(&sctp_assocs_id, asoc, idr_low, 0, GFP_NOWAIT);
+        if (ret >= 0) {
+                idr_low = ret + 1;
                 if (idr_low == INT_MAX)
                         idr_low = 1;
         }
         spin_unlock_bh(&sctp_assocs_id_lock);
-        if (error == -EAGAIN)
-                goto retry;
-        else if (error)
-                return error;
+        if (preload)
+                idr_preload_end();
+        if (ret < 0)
+                return ret;
 
-        asoc->assoc_id = (sctp_assoc_t) assoc_id;
-        return error;
+        asoc->assoc_id = (sctp_assoc_t)ret;
+        return 0;
 }
 
 /* Free the ASCONF queue */
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 73aad3d16a45..2b3ef03c6098 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -332,7 +332,6 @@ static struct sctp_association *__sctp_endpoint_lookup_assoc(
         struct sctp_transport *t = NULL;
         struct sctp_hashbucket *head;
         struct sctp_ep_common *epb;
-        struct hlist_node *node;
         int hash;
         int rport;
 
@@ -350,7 +349,7 @@ static struct sctp_association *__sctp_endpoint_lookup_assoc(
                                  rport);
         head = &sctp_assoc_hashtable[hash];
         read_lock(&head->lock);
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 tmp = sctp_assoc(epb);
                 if (tmp->ep != ep || rport != tmp->peer.port)
                         continue;
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 965bbbbe48d4..4b2c83146aa7 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -784,13 +784,12 @@ static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(struct net *net,
         struct sctp_hashbucket *head;
         struct sctp_ep_common *epb;
         struct sctp_endpoint *ep;
-        struct hlist_node *node;
         int hash;
 
         hash = sctp_ep_hashfn(net, ntohs(laddr->v4.sin_port));
         head = &sctp_ep_hashtable[hash];
         read_lock(&head->lock);
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 ep = sctp_ep(epb);
                 if (sctp_endpoint_is_match(ep, net, laddr))
                         goto hit;
@@ -876,7 +875,6 @@ static struct sctp_association *__sctp_lookup_association(
         struct sctp_ep_common *epb;
         struct sctp_association *asoc;
         struct sctp_transport *transport;
-        struct hlist_node *node;
         int hash;
 
         /* Optimize here for direct hit, only listening connections can
@@ -886,7 +884,7 @@ static struct sctp_association *__sctp_lookup_association(
                                  ntohs(peer->v4.sin_port));
         head = &sctp_assoc_hashtable[hash];
         read_lock(&head->lock);
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 asoc = sctp_assoc(epb);
                 transport = sctp_assoc_is_match(asoc, net, local, peer);
                 if (transport)
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 8c19e97262ca..ab3bba8cb0a8 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -213,7 +213,6 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
         struct sctp_ep_common *epb;
         struct sctp_endpoint *ep;
         struct sock *sk;
-        struct hlist_node *node;
         int    hash = *(loff_t *)v;
 
         if (hash >= sctp_ep_hashsize)
@@ -222,7 +221,7 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
         head = &sctp_ep_hashtable[hash];
         sctp_local_bh_disable();
         read_lock(&head->lock);
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 ep = sctp_ep(epb);
                 sk = epb->sk;
                 if (!net_eq(sock_net(sk), seq_file_net(seq)))
@@ -321,7 +320,6 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
         struct sctp_ep_common *epb;
         struct sctp_association *assoc;
         struct sock *sk;
-        struct hlist_node *node;
         int    hash = *(loff_t *)v;
 
         if (hash >= sctp_assoc_hashsize)
@@ -330,7 +328,7 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
         head = &sctp_assoc_hashtable[hash];
         sctp_local_bh_disable();
         read_lock(&head->lock);
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 assoc = sctp_assoc(epb);
                 sk = epb->sk;
                 if (!net_eq(sock_net(sk), seq_file_net(seq)))
@@ -436,7 +434,6 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
         struct sctp_hashbucket *head;
         struct sctp_ep_common *epb;
         struct sctp_association *assoc;
-        struct hlist_node *node;
         struct sctp_transport *tsp;
         int    hash = *(loff_t *)v;
 
@@ -447,7 +444,7 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
         sctp_local_bh_disable();
         read_lock(&head->lock);
         rcu_read_lock();
-        sctp_for_each_hentry(epb, node, &head->chain) {
+        sctp_for_each_hentry(epb, &head->chain) {
                 if (!net_eq(sock_net(epb->sk), seq_file_net(seq)))
                         continue;
                 assoc = sctp_assoc(epb);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index cedd9bf67b8c..c99458df3f3f 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5882,8 +5882,7 @@ static struct sctp_bind_bucket *sctp_bucket_create(
 static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
 {
         struct sctp_bind_hashbucket *head; /* hash list */
-        struct sctp_bind_bucket *pp; /* hash list port iterator */
-        struct hlist_node *node;
+        struct sctp_bind_bucket *pp;
         unsigned short snum;
         int ret;
 
@@ -5910,7 +5909,7 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
                         index = sctp_phashfn(sock_net(sk), rover);
                         head = &sctp_port_hashtable[index];
                         sctp_spin_lock(&head->lock);
-                        sctp_for_each_hentry(pp, node, &head->chain)
+                        sctp_for_each_hentry(pp, &head->chain)
                                 if ((pp->port == rover) &&
                                     net_eq(sock_net(sk), pp->net))
                                         goto next;
@@ -5938,7 +5937,7 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
                  */
                 head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
                 sctp_spin_lock(&head->lock);
-                sctp_for_each_hentry(pp, node, &head->chain) {
+                sctp_for_each_hentry(pp, &head->chain) {
                         if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))
                                 goto pp_found;
                 }
@@ -5970,7 +5969,7 @@ pp_found:
                  * that this port/socket (sk) combination are already
                  * in an endpoint.
                  */
-                sk_for_each_bound(sk2, node, &pp->owner) {
+                sk_for_each_bound(sk2, &pp->owner) {
                         struct sctp_endpoint *ep2;
                         ep2 = sctp_sk(sk2)->ep;
 
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 392adc41e2e5..f5294047df77 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -407,7 +407,6 @@ rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
 {
         LIST_HEAD(free);
         struct rpc_cred_cache *cache = auth->au_credcache;
-        struct hlist_node *pos;
         struct rpc_cred *cred = NULL,
                         *entry, *new;
         unsigned int nr;
@@ -415,7 +414,7 @@ rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
         nr = hash_long(from_kuid(&init_user_ns, acred->uid), cache->hashbits);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(entry, pos, &cache->hashtable[nr], cr_hash) {
+        hlist_for_each_entry_rcu(entry, &cache->hashtable[nr], cr_hash) {
                 if (!entry->cr_ops->crmatch(acred, entry, flags))
                         continue;
                 spin_lock(&cache->lock);
@@ -439,7 +438,7 @@ rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
         }
 
         spin_lock(&cache->lock);
-        hlist_for_each_entry(entry, pos, &cache->hashtable[nr], cr_hash) {
+        hlist_for_each_entry(entry, &cache->hashtable[nr], cr_hash) {
                 if (!entry->cr_ops->crmatch(acred, entry, flags))
                         continue;
                 cred = get_rpccred(entry);
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index f3897d10f649..39a4112faf54 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -670,13 +670,13 @@ static void cache_revisit_request(struct cache_head *item)
 {
         struct cache_deferred_req *dreq;
         struct list_head pending;
-        struct hlist_node *lp, *tmp;
+        struct hlist_node *tmp;
         int hash = DFR_HASH(item);
 
         INIT_LIST_HEAD(&pending);
         spin_lock(&cache_defer_lock);
 
-        hlist_for_each_entry_safe(dreq, lp, tmp, &cache_defer_hash[hash], hash)
+        hlist_for_each_entry_safe(dreq, tmp, &cache_defer_hash[hash], hash)
                 if (dreq->item == item) {
                         __unhash_deferred_req(dreq);
                         list_add(&dreq->recent, &pending);
diff --git a/net/sunrpc/svcauth.c b/net/sunrpc/svcauth.c
index 7963569fc04f..2af7b0cba43a 100644
--- a/net/sunrpc/svcauth.c
+++ b/net/sunrpc/svcauth.c
@@ -138,13 +138,12 @@ auth_domain_lookup(char *name, struct auth_domain *new)
 {
         struct auth_domain *hp;
         struct hlist_head *head;
-        struct hlist_node *np;
 
         head = &auth_domain_table[hash_str(name, DN_HASHBITS)];
 
         spin_lock(&auth_domain_lock);
 
-        hlist_for_each_entry(hp, np, head, hash) {
+        hlist_for_each_entry(hp, head, hash) {
                 if (strcmp(hp->name, name)==0) {
                         kref_get(&hp->ref);
                         spin_unlock(&auth_domain_lock);
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 46754779fd3d..24b167914311 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -473,11 +473,10 @@ static void tipc_nameseq_subscribe(struct name_seq *nseq,
 static struct name_seq *nametbl_find_seq(u32 type)
 {
         struct hlist_head *seq_head;
-        struct hlist_node *seq_node;
         struct name_seq *ns;
 
         seq_head = &table.types[hash(type)];
-        hlist_for_each_entry(ns, seq_node, seq_head, ns_list) {
+        hlist_for_each_entry(ns, seq_head, ns_list) {
                 if (ns->type == type)
                         return ns;
         }
@@ -853,7 +852,6 @@ static int nametbl_list(char *buf, int len, u32 depth_info,
                          u32 type, u32 lowbound, u32 upbound)
 {
         struct hlist_head *seq_head;
-        struct hlist_node *seq_node;
         struct name_seq *seq;
         int all_types;
         int ret = 0;
@@ -873,7 +871,7 @@ static int nametbl_list(char *buf, int len, u32 depth_info,
                 upbound = ~0;
                 for (i = 0; i < TIPC_NAMETBL_SIZE; i++) {
                         seq_head = &table.types[i];
-                        hlist_for_each_entry(seq, seq_node, seq_head, ns_list) {
+                        hlist_for_each_entry(seq, seq_head, ns_list) {
                                 ret += nameseq_list(seq, buf + ret, len - ret,
                                                    depth, seq->type,
                                                    lowbound, upbound, i);
@@ -889,7 +887,7 @@ static int nametbl_list(char *buf, int len, u32 depth_info,
                 ret += nametbl_header(buf + ret, len - ret, depth);
                 i = hash(type);
                 seq_head = &table.types[i];
-                hlist_for_each_entry(seq, seq_node, seq_head, ns_list) {
+                hlist_for_each_entry(seq, seq_head, ns_list) {
                         if (seq->type == type) {
                                 ret += nameseq_list(seq, buf + ret, len - ret,
                                                    depth, type,
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 48f39dd3eae8..6e6c434872e8 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -69,12 +69,11 @@ static unsigned int tipc_hashfn(u32 addr)
 struct tipc_node *tipc_node_find(u32 addr)
 {
         struct tipc_node *node;
-        struct hlist_node *pos;
 
         if (unlikely(!in_own_cluster_exact(addr)))
                 return NULL;
 
-        hlist_for_each_entry(node, pos, &node_htable[tipc_hashfn(addr)], hash) {
+        hlist_for_each_entry(node, &node_htable[tipc_hashfn(addr)], hash) {
                 if (node->addr == addr)
                         return node;
         }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 87d284289012..51be64f163ec 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -263,9 +263,8 @@ static struct sock *__unix_find_socket_byname(struct net *net,
                                               int len, int type, unsigned int hash)
 {
         struct sock *s;
-        struct hlist_node *node;
 
-        sk_for_each(s, node, &unix_socket_table[hash ^ type]) {
+        sk_for_each(s, &unix_socket_table[hash ^ type]) {
                 struct unix_sock *u = unix_sk(s);
 
                 if (!net_eq(sock_net(s), net))
@@ -298,10 +297,9 @@ static inline struct sock *unix_find_socket_byname(struct net *net,
 static struct sock *unix_find_socket_byinode(struct inode *i)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         spin_lock(&unix_table_lock);
-        sk_for_each(s, node,
+        sk_for_each(s,
                     &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {
                 struct dentry *dentry = unix_sk(s)->path.dentry;
 
diff --git a/net/unix/diag.c b/net/unix/diag.c
index 5ac19dc1d5e4..d591091603bf 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -192,10 +192,9 @@ static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
              slot < ARRAY_SIZE(unix_socket_table);
              s_num = 0, slot++) {
                 struct sock *sk;
-                struct hlist_node *node;
 
                 num = 0;
-                sk_for_each(sk, node, &unix_socket_table[slot]) {
+                sk_for_each(sk, &unix_socket_table[slot]) {
                         if (!net_eq(sock_net(sk), net))
                                 continue;
                         if (num < s_num)
@@ -226,9 +225,7 @@ static struct sock *unix_lookup_by_ino(int ino)
 
         spin_lock(&unix_table_lock);
         for (i = 0; i < ARRAY_SIZE(unix_socket_table); i++) {
-                struct hlist_node *node;
-
-                sk_for_each(sk, node, &unix_socket_table[i])
+                sk_for_each(sk, &unix_socket_table[i])
                         if (ino == sock_i_ino(sk)) {
                                 sock_hold(sk);
                                 spin_unlock(&unix_table_lock);
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index a306bc66000e..37ca9694aabe 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -208,11 +208,10 @@ static void x25_remove_socket(struct sock *sk)
 static void x25_kill_by_device(struct net_device *dev)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         write_lock_bh(&x25_list_lock);
 
-        sk_for_each(s, node, &x25_list)
+        sk_for_each(s, &x25_list)
                 if (x25_sk(s)->neighbour && x25_sk(s)->neighbour->dev == dev)
                         x25_disconnect(s, ENETUNREACH, 0, 0);
 
@@ -280,12 +279,11 @@ static struct sock *x25_find_listener(struct x25_address *addr,
 {
         struct sock *s;
         struct sock *next_best;
-        struct hlist_node *node;
 
         read_lock_bh(&x25_list_lock);
         next_best = NULL;
 
-        sk_for_each(s, node, &x25_list)
+        sk_for_each(s, &x25_list)
                 if ((!strcmp(addr->x25_addr,
                         x25_sk(s)->source_addr.x25_addr) ||
                                 !strcmp(addr->x25_addr,
@@ -323,9 +321,8 @@ found:
 static struct sock *__x25_find_socket(unsigned int lci, struct x25_neigh *nb)
 {
         struct sock *s;
-        struct hlist_node *node;
 
-        sk_for_each(s, node, &x25_list)
+        sk_for_each(s, &x25_list)
                 if (x25_sk(s)->lci == lci && x25_sk(s)->neighbour == nb) {
                         sock_hold(s);
                         goto found;
@@ -1782,11 +1779,10 @@ static struct notifier_block x25_dev_notifier = {
 void x25_kill_by_neigh(struct x25_neigh *nb)
 {
         struct sock *s;
-        struct hlist_node *node;
 
         write_lock_bh(&x25_list_lock);
 
-        sk_for_each(s, node, &x25_list)
+        sk_for_each(s, &x25_list)
                 if (x25_sk(s)->neighbour == nb)
                         x25_disconnect(s, ENETUNREACH, 0, 0);
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 5b47180986f8..167c67d46c6a 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -379,27 +379,27 @@ static void xfrm_dst_hash_transfer(struct hlist_head *list,
                                    struct hlist_head *ndsttable,
                                    unsigned int nhashmask)
 {
-        struct hlist_node *entry, *tmp, *entry0 = NULL;
+        struct hlist_node *tmp, *entry0 = NULL;
         struct xfrm_policy *pol;
         unsigned int h0 = 0;
 
 redo:
-        hlist_for_each_entry_safe(pol, entry, tmp, list, bydst) {
+        hlist_for_each_entry_safe(pol, tmp, list, bydst) {
                 unsigned int h;
 
                 h = __addr_hash(&pol->selector.daddr, &pol->selector.saddr,
                                 pol->family, nhashmask);
                 if (!entry0) {
-                        hlist_del(entry);
+                        hlist_del(&pol->bydst);
                         hlist_add_head(&pol->bydst, ndsttable+h);
                         h0 = h;
                 } else {
                         if (h != h0)
                                 continue;
-                        hlist_del(entry);
+                        hlist_del(&pol->bydst);
                         hlist_add_after(entry0, &pol->bydst);
                 }
-                entry0 = entry;
+                entry0 = &pol->bydst;
         }
         if (!hlist_empty(list)) {
                 entry0 = NULL;
@@ -411,10 +411,10 @@ static void xfrm_idx_hash_transfer(struct hlist_head *list,
                                    struct hlist_head *nidxtable,
                                    unsigned int nhashmask)
 {
-        struct hlist_node *entry, *tmp;
+        struct hlist_node *tmp;
         struct xfrm_policy *pol;
 
-        hlist_for_each_entry_safe(pol, entry, tmp, list, byidx) {
+        hlist_for_each_entry_safe(pol, tmp, list, byidx) {
                 unsigned int h;
 
                 h = __idx_hash(pol->index, nhashmask);
@@ -544,7 +544,6 @@ static u32 xfrm_gen_index(struct net *net, int dir)
         static u32 idx_generator;
 
         for (;;) {
-                struct hlist_node *entry;
                 struct hlist_head *list;
                 struct xfrm_policy *p;
                 u32 idx;
@@ -556,7 +555,7 @@ static u32 xfrm_gen_index(struct net *net, int dir)
                         idx = 8;
                 list = net->xfrm.policy_byidx + idx_hash(net, idx);
                 found = 0;
-                hlist_for_each_entry(p, entry, list, byidx) {
+                hlist_for_each_entry(p, list, byidx) {
                         if (p->index == idx) {
                                 found = 1;
                                 break;
@@ -628,13 +627,13 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         struct xfrm_policy *pol;
         struct xfrm_policy *delpol;
         struct hlist_head *chain;
-        struct hlist_node *entry, *newpos;
+        struct hlist_node *newpos;
 
         write_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_bysel(net, &policy->selector, policy->family, dir);
         delpol = NULL;
         newpos = NULL;
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 if (pol->type == policy->type &&
                     !selector_cmp(&pol->selector, &policy->selector) &&
                     xfrm_policy_mark_match(policy, pol) &&
@@ -691,13 +690,12 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type,
 {
         struct xfrm_policy *pol, *ret;
         struct hlist_head *chain;
-        struct hlist_node *entry;
 
         *err = 0;
         write_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_bysel(net, sel, sel->family, dir);
         ret = NULL;
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 if (pol->type == type &&
                     (mark & pol->mark.m) == pol->mark.v &&
                     !selector_cmp(sel, &pol->selector) &&
@@ -729,7 +727,6 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
 {
         struct xfrm_policy *pol, *ret;
         struct hlist_head *chain;
-        struct hlist_node *entry;
 
         *err = -ENOENT;
         if (xfrm_policy_id2dir(id) != dir)
@@ -739,7 +736,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
         write_lock_bh(&xfrm_policy_lock);
         chain = net->xfrm.policy_byidx + idx_hash(net, id);
         ret = NULL;
-        hlist_for_each_entry(pol, entry, chain, byidx) {
+        hlist_for_each_entry(pol, chain, byidx) {
                 if (pol->type == type && pol->index == id &&
                     (mark & pol->mark.m) == pol->mark.v) {
                         xfrm_pol_hold(pol);
@@ -772,10 +769,9 @@ xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audi
 
         for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
                 struct xfrm_policy *pol;
-                struct hlist_node *entry;
                 int i;
 
-                hlist_for_each_entry(pol, entry,
+                hlist_for_each_entry(pol,
                                      &net->xfrm.policy_inexact[dir], bydst) {
                         if (pol->type != type)
                                 continue;
@@ -789,7 +785,7 @@ xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audi
                         }
                 }
                 for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) {
-                        hlist_for_each_entry(pol, entry,
+                        hlist_for_each_entry(pol,
                                              net->xfrm.policy_bydst[dir].table + i,
                                              bydst) {
                                 if (pol->type != type)
@@ -828,11 +824,10 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
 
         for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
                 struct xfrm_policy *pol;
-                struct hlist_node *entry;
                 int i;
 
         again1:
-                hlist_for_each_entry(pol, entry,
+                hlist_for_each_entry(pol,
                                      &net->xfrm.policy_inexact[dir], bydst) {
                         if (pol->type != type)
                                 continue;
@@ -852,7 +847,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
 
                 for (i = net->xfrm.policy_bydst[dir].hmask; i >= 0; i--) {
         again2:
-                        hlist_for_each_entry(pol, entry,
+                        hlist_for_each_entry(pol,
                                              net->xfrm.policy_bydst[dir].table + i,
                                              bydst) {
                                 if (pol->type != type)
@@ -980,7 +975,6 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
         int err;
         struct xfrm_policy *pol, *ret;
         const xfrm_address_t *daddr, *saddr;
-        struct hlist_node *entry;
         struct hlist_head *chain;
         u32 priority = ~0U;
 
@@ -992,7 +986,7 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
         read_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_direct(net, daddr, saddr, family, dir);
         ret = NULL;
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 err = xfrm_policy_match(pol, fl, type, family, dir);
                 if (err) {
                         if (err == -ESRCH)
@@ -1008,7 +1002,7 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
                 }
         }
         chain = &net->xfrm.policy_inexact[dir];
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 err = xfrm_policy_match(pol, fl, type, family, dir);
                 if (err) {
                         if (err == -ESRCH)
@@ -3041,13 +3035,12 @@ static struct xfrm_policy * xfrm_migrate_policy_find(const struct xfrm_selector
                                                      u8 dir, u8 type)
 {
         struct xfrm_policy *pol, *ret = NULL;
-        struct hlist_node *entry;
         struct hlist_head *chain;
         u32 priority = ~0U;
 
         read_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_direct(&init_net, &sel->daddr, &sel->saddr, sel->family, dir);
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 if (xfrm_migrate_selector_match(sel, &pol->selector) &&
                     pol->type == type) {
                         ret = pol;
@@ -3056,7 +3049,7 @@ static struct xfrm_policy * xfrm_migrate_policy_find(const struct xfrm_selector
                 }
         }
         chain = &init_net.xfrm.policy_inexact[dir];
-        hlist_for_each_entry(pol, entry, chain, bydst) {
+        hlist_for_each_entry(pol, chain, bydst) {
                 if (xfrm_migrate_selector_match(sel, &pol->selector) &&
                     pol->type == type &&
                     pol->priority < priority) {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index ae01bdbcb294..2c341bdaf47c 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -72,10 +72,10 @@ static void xfrm_hash_transfer(struct hlist_head *list,
                                struct hlist_head *nspitable,
                                unsigned int nhashmask)
 {
-        struct hlist_node *entry, *tmp;
+        struct hlist_node *tmp;
         struct xfrm_state *x;
 
-        hlist_for_each_entry_safe(x, entry, tmp, list, bydst) {
+        hlist_for_each_entry_safe(x, tmp, list, bydst) {
                 unsigned int h;
 
                 h = __xfrm_dst_hash(&x->id.daddr, &x->props.saddr,
@@ -368,14 +368,14 @@ static void xfrm_state_gc_task(struct work_struct *work)
 {
         struct net *net = container_of(work, struct net, xfrm.state_gc_work);
         struct xfrm_state *x;
-        struct hlist_node *entry, *tmp;
+        struct hlist_node *tmp;
         struct hlist_head gc_list;
 
         spin_lock_bh(&xfrm_state_gc_lock);
         hlist_move_list(&net->xfrm.state_gc_list, &gc_list);
         spin_unlock_bh(&xfrm_state_gc_lock);
 
-        hlist_for_each_entry_safe(x, entry, tmp, &gc_list, gclist)
+        hlist_for_each_entry_safe(x, tmp, &gc_list, gclist)
                 xfrm_state_gc_destroy(x);
 
         wake_up(&net->xfrm.km_waitq);
@@ -577,10 +577,9 @@ xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audi
         int i, err = 0;
 
         for (i = 0; i <= net->xfrm.state_hmask; i++) {
-                struct hlist_node *entry;
                 struct xfrm_state *x;
 
-                hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
+                hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
                         if (xfrm_id_proto_match(x->id.proto, proto) &&
                            (err = security_xfrm_state_delete(x)) != 0) {
                                 xfrm_audit_state_delete(x, 0,
@@ -613,10 +612,9 @@ int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info)
 
         err = -ESRCH;
         for (i = 0; i <= net->xfrm.state_hmask; i++) {
-                struct hlist_node *entry;
                 struct xfrm_state *x;
 restart:
-                hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
+                hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
                         if (!xfrm_state_kern(x) &&
                             xfrm_id_proto_match(x->id.proto, proto)) {
                                 xfrm_state_hold(x);
@@ -685,9 +683,8 @@ static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark,
 {
         unsigned int h = xfrm_spi_hash(net, daddr, spi, proto, family);
         struct xfrm_state *x;
-        struct hlist_node *entry;
 
-        hlist_for_each_entry(x, entry, net->xfrm.state_byspi+h, byspi) {
+        hlist_for_each_entry(x, net->xfrm.state_byspi+h, byspi) {
                 if (x->props.family != family ||
                     x->id.spi       != spi ||
                     x->id.proto     != proto ||
@@ -710,9 +707,8 @@ static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark,
 {
         unsigned int h = xfrm_src_hash(net, daddr, saddr, family);
         struct xfrm_state *x;
-        struct hlist_node *entry;
 
-        hlist_for_each_entry(x, entry, net->xfrm.state_bysrc+h, bysrc) {
+        hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) {
                 if (x->props.family != family ||
                     x->id.proto     != proto ||
                     !xfrm_addr_equal(&x->id.daddr, daddr, family) ||
@@ -798,7 +794,6 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
         static xfrm_address_t saddr_wildcard = { };
         struct net *net = xp_net(pol);
         unsigned int h, h_wildcard;
-        struct hlist_node *entry;
         struct xfrm_state *x, *x0, *to_put;
         int acquire_in_progress = 0;
         int error = 0;
@@ -810,7 +805,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
 
         spin_lock_bh(&xfrm_state_lock);
         h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
-        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
+        hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.family == encap_family &&
                     x->props.reqid == tmpl->reqid &&
                     (mark & x->mark.m) == x->mark.v &&
@@ -826,7 +821,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
                 goto found;
 
         h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family);
-        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) {
+        hlist_for_each_entry(x, net->xfrm.state_bydst+h_wildcard, bydst) {
                 if (x->props.family == encap_family &&
                     x->props.reqid == tmpl->reqid &&
                     (mark & x->mark.m) == x->mark.v &&
@@ -906,11 +901,10 @@ xfrm_stateonly_find(struct net *net, u32 mark,
 {
         unsigned int h;
         struct xfrm_state *rx = NULL, *x = NULL;
-        struct hlist_node *entry;
 
         spin_lock(&xfrm_state_lock);
         h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
-        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
+        hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.family == family &&
                     x->props.reqid == reqid &&
                     (mark & x->mark.m) == x->mark.v &&
@@ -972,12 +966,11 @@ static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
         unsigned short family = xnew->props.family;
         u32 reqid = xnew->props.reqid;
         struct xfrm_state *x;
-        struct hlist_node *entry;
         unsigned int h;
         u32 mark = xnew->mark.v & xnew->mark.m;
 
         h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
-        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
+        hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.family     == family &&
                     x->props.reqid      == reqid &&
                     (mark & x->mark.m) == x->mark.v &&
@@ -1004,11 +997,10 @@ static struct xfrm_state *__find_acq_core(struct net *net, struct xfrm_mark *m,
                                           const xfrm_address_t *saddr, int create)
 {
         unsigned int h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
-        struct hlist_node *entry;
         struct xfrm_state *x;
         u32 mark = m->v & m->m;
 
-        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
+        hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
                 if (x->props.reqid  != reqid ||
                     x->props.mode   != mode ||
                     x->props.family != family ||
@@ -1215,12 +1207,11 @@ struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
 {
         unsigned int h;
         struct xfrm_state *x;
-        struct hlist_node *entry;
 
         if (m->reqid) {
                 h = xfrm_dst_hash(&init_net, &m->old_daddr, &m->old_saddr,
                                   m->reqid, m->old_family);
-                hlist_for_each_entry(x, entry, init_net.xfrm.state_bydst+h, bydst) {
+                hlist_for_each_entry(x, init_net.xfrm.state_bydst+h, bydst) {
                         if (x->props.mode != m->mode ||
                             x->id.proto != m->proto)
                                 continue;
@@ -1237,7 +1228,7 @@ struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
         } else {
                 h = xfrm_src_hash(&init_net, &m->old_daddr, &m->old_saddr,
                                   m->old_family);
-                hlist_for_each_entry(x, entry, init_net.xfrm.state_bysrc+h, bysrc) {
+                hlist_for_each_entry(x, init_net.xfrm.state_bysrc+h, bysrc) {
                         if (x->props.mode != m->mode ||
                             x->id.proto != m->proto)
                                 continue;
@@ -1466,10 +1457,9 @@ static struct xfrm_state *__xfrm_find_acq_byseq(struct net *net, u32 mark, u32 s
         int i;
 
         for (i = 0; i <= net->xfrm.state_hmask; i++) {
-                struct hlist_node *entry;
                 struct xfrm_state *x;
 
-                hlist_for_each_entry(x, entry, net->xfrm.state_bydst+i, bydst) {
+                hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
                         if (x->km.seq == seq &&
                             (mark & x->mark.m) == x->mark.v &&
                             x->km.state == XFRM_STATE_ACQ) {
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 747bcd768da0..b28cc384a5bc 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2930,7 +2930,7 @@ sub process {
                         my $var = $1;
                         if ($var !~ /$Constant/ &&
                             $var =~ /[A-Z]\w*[a-z]|[a-z]\w*[A-Z]/ &&
-                            $var !~ /^Page[A-Z]/ &&
+                            $var !~ /"^(?:Clear|Set|TestClear|TestSet|)Page[A-Z]/ &&
                             !defined $camelcase{$var}) {
                                 $camelcase{$var} = 1;
                                 WARN("CAMELCASE",
diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl
index 18d4ab55606b..ce4cc837b748 100755
--- a/scripts/get_maintainer.pl
+++ b/scripts/get_maintainer.pl
@@ -611,6 +611,10 @@ sub get_maintainers {
                                     $hash{$tvi} = $value_pd;
                                 }
                             }
+                        } elsif ($type eq 'K') {
+                            if ($file =~ m/$value/x) {
+                                $hash{$tvi} = 0;
+                            }
                         }
                     }
                 }
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index f565536a2bef..4305b2f2ec5e 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -1750,7 +1750,7 @@ sub dump_struct($$) {
         # strip kmemcheck_bitfield_{begin,end}.*;
         $members =~ s/kmemcheck_bitfield_.*?;//gos;
         # strip attributes
-        $members =~ s/__aligned\s*\(\d+\)//gos;
+        $members =~ s/__aligned\s*\(.+\)//gos;
 
         create_parameterlist($members, ';', $file);
         check_sections($file, $declaration_name, "struct", $sectcheck, $struct_actual, $nested);
diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
index 55a6271bce7a..ff63fe00c195 100644
--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c
@@ -45,12 +45,11 @@ static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value)
 {
         struct ima_queue_entry *qe, *ret = NULL;
         unsigned int key;
-        struct hlist_node *pos;
         int rc;
 
         key = ima_hash_key(digest_value);
         rcu_read_lock();
-        hlist_for_each_entry_rcu(qe, pos, &ima_htable.queue[key], hnext) {
+        hlist_for_each_entry_rcu(qe, &ima_htable.queue[key], hnext) {
                 rc = memcmp(qe->entry->digest, digest_value, IMA_DIGEST_SIZE);
                 if (rc == 0) {
                         ret = qe;
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 4d3fab47e643..dad36a6ab45f 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -188,11 +188,9 @@ int avc_get_hash_stats(char *page)
         for (i = 0; i < AVC_CACHE_SLOTS; i++) {
                 head = &avc_cache.slots[i];
                 if (!hlist_empty(head)) {
-                        struct hlist_node *next;
-
                         slots_used++;
                         chain_len = 0;
-                        hlist_for_each_entry_rcu(node, next, head, list)
+                        hlist_for_each_entry_rcu(node, head, list)
                                 chain_len++;
                         if (chain_len > max_chain_len)
                                 max_chain_len = chain_len;
@@ -241,7 +239,6 @@ static inline int avc_reclaim_node(void)
         int hvalue, try, ecx;
         unsigned long flags;
         struct hlist_head *head;
-        struct hlist_node *next;
         spinlock_t *lock;
 
         for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) {
@@ -253,7 +250,7 @@ static inline int avc_reclaim_node(void)
                         continue;
 
                 rcu_read_lock();
-                hlist_for_each_entry(node, next, head, list) {
+                hlist_for_each_entry(node, head, list) {
                         avc_node_delete(node);
                         avc_cache_stats_incr(reclaims);
                         ecx++;
@@ -301,11 +298,10 @@ static inline struct avc_node *avc_search_node(u32 ssid, u32 tsid, u16 tclass)
         struct avc_node *node, *ret = NULL;
         int hvalue;
         struct hlist_head *head;
-        struct hlist_node *next;
 
         hvalue = avc_hash(ssid, tsid, tclass);
         head = &avc_cache.slots[hvalue];
-        hlist_for_each_entry_rcu(node, next, head, list) {
+        hlist_for_each_entry_rcu(node, head, list) {
                 if (ssid == node->ae.ssid &&
                     tclass == node->ae.tclass &&
                     tsid == node->ae.tsid) {
@@ -394,7 +390,6 @@ static struct avc_node *avc_insert(u32 ssid, u32 tsid, u16 tclass, struct av_dec
         node = avc_alloc_node();
         if (node) {
                 struct hlist_head *head;
-                struct hlist_node *next;
                 spinlock_t *lock;
 
                 hvalue = avc_hash(ssid, tsid, tclass);
@@ -404,7 +399,7 @@ static struct avc_node *avc_insert(u32 ssid, u32 tsid, u16 tclass, struct av_dec
                 lock = &avc_cache.slots_lock[hvalue];
 
                 spin_lock_irqsave(lock, flag);
-                hlist_for_each_entry(pos, next, head, list) {
+                hlist_for_each_entry(pos, head, list) {
                         if (pos->ae.ssid == ssid &&
                             pos->ae.tsid == tsid &&
                             pos->ae.tclass == tclass) {
@@ -541,7 +536,6 @@ static int avc_update_node(u32 event, u32 perms, u32 ssid, u32 tsid, u16 tclass,
         unsigned long flag;
         struct avc_node *pos, *node, *orig = NULL;
         struct hlist_head *head;
-        struct hlist_node *next;
         spinlock_t *lock;
 
         node = avc_alloc_node();
@@ -558,7 +552,7 @@ static int avc_update_node(u32 event, u32 perms, u32 ssid, u32 tsid, u16 tclass,
 
         spin_lock_irqsave(lock, flag);
 
-        hlist_for_each_entry(pos, next, head, list) {
+        hlist_for_each_entry(pos, head, list) {
                 if (ssid == pos->ae.ssid &&
                     tsid == pos->ae.tsid &&
                     tclass == pos->ae.tclass &&
@@ -614,7 +608,6 @@ out:
 static void avc_flush(void)
 {
         struct hlist_head *head;
-        struct hlist_node *next;
         struct avc_node *node;
         spinlock_t *lock;
         unsigned long flag;
@@ -630,7 +623,7 @@ static void avc_flush(void)
                  * prevent RCU grace periods from ending.
                  */
                 rcu_read_lock();
-                hlist_for_each_entry(node, next, head, list)
+                hlist_for_each_entry(node, head, list)
                         avc_node_delete(node);
                 rcu_read_unlock();
                 spin_unlock_irqrestore(lock, flag);
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index bc4ad7977438..c8be0fbc5145 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -314,7 +314,6 @@ static int perf_evlist__id_add_fd(struct perf_evlist *evlist,
 struct perf_evsel *perf_evlist__id2evsel(struct perf_evlist *evlist, u64 id)
 {
         struct hlist_head *head;
-        struct hlist_node *pos;
         struct perf_sample_id *sid;
         int hash;
 
@@ -324,7 +323,7 @@ struct perf_evsel *perf_evlist__id2evsel(struct perf_evlist *evlist, u64 id)
         hash = hash_64(id, PERF_EVLIST__HLIST_BITS);
         head = &evlist->heads[hash];
 
-        hlist_for_each_entry(sid, pos, head, node)
+        hlist_for_each_entry(sid, head, node)
                 if (sid->id == id)
                         return sid->evsel;
 
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 85baf11e2acd..3cc0ad7ae863 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -1,4 +1,10 @@
-TARGETS = breakpoints kcmp mqueue vm cpu-hotplug memory-hotplug
+TARGETS = breakpoints
+TARGETS += kcmp
+TARGETS += mqueue
+TARGETS += vm
+TARGETS += cpu-hotplug
+TARGETS += memory-hotplug
+TARGETS += efivarfs
 
 all:
         for TARGET in $(TARGETS); do \
diff --git a/tools/testing/selftests/README.txt b/tools/testing/selftests/README.txt
new file mode 100644
index 000000000000..5e2faf9c55d3
--- /dev/null
+++ b/tools/testing/selftests/README.txt
@@ -0,0 +1,42 @@
+Linux Kernel Selftests
+
+The kernel contains a set of "self tests" under the tools/testing/selftests/
+directory. These are intended to be small unit tests to exercise individual
+code paths in the kernel.
+
+Running the selftests
+=====================
+
+To build the tests:
+
+  $ make -C tools/testing/selftests
+
+
+To run the tests:
+
+  $ make -C tools/testing/selftests run_tests
+
+- note that some tests will require root privileges.
+
+
+To run only tests targetted for a single subsystem:
+
+  $  make -C tools/testing/selftests TARGETS=cpu-hotplug run_tests
+
+See the top-level tools/testing/selftests/Makefile for the list of all possible
+targets.
+
+
+Contributing new tests
+======================
+
+In general, the rules for for selftests are
+
+ * Do as much as you can if you're not root;
+
+ * Don't take too long;
+
+ * Don't break the build on any architecture, and
+
+ * Don't cause the top-level "make run_tests" to fail if your feature is
+   unconfigured.
diff --git a/tools/testing/selftests/efivarfs/Makefile b/tools/testing/selftests/efivarfs/Makefile
new file mode 100644
index 000000000000..29e8c6bc81b0
--- /dev/null
+++ b/tools/testing/selftests/efivarfs/Makefile
@@ -0,0 +1,12 @@
+CC = $(CROSS_COMPILE)gcc
+CFLAGS = -Wall
+
+test_objs = open-unlink create-read
+
+all: $(test_objs)
+
+run_tests: all
+        @/bin/bash ./efivarfs.sh || echo "efivarfs selftests: [FAIL]"
+
+clean:
+        rm -f $(test_objs)
diff --git a/tools/testing/selftests/efivarfs/create-read.c b/tools/testing/selftests/efivarfs/create-read.c
new file mode 100644
index 000000000000..7feef1880968
--- /dev/null
+++ b/tools/testing/selftests/efivarfs/create-read.c
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <string.h>
+
+int main(int argc, char **argv)
+{
+        const char *path;
+        char buf[4];
+        int fd, rc;
+
+        if (argc < 2) {
+                fprintf(stderr, "usage: %s <path>\n", argv[0]);
+                return EXIT_FAILURE;
+        }
+
+        path = argv[1];
+
+        /* create a test variable */
+        fd = open(path, O_RDWR | O_CREAT, 0600);
+        if (fd < 0) {
+                perror("open(O_WRONLY)");
+                return EXIT_FAILURE;
+        }
+
+        rc = read(fd, buf, sizeof(buf));
+        if (rc != 0) {
+                fprintf(stderr, "Reading a new var should return EOF\n");
+                return EXIT_FAILURE;
+        }
+
+        return EXIT_SUCCESS;
+}
diff --git a/tools/testing/selftests/efivarfs/efivarfs.sh b/tools/testing/selftests/efivarfs/efivarfs.sh
new file mode 100644
index 000000000000..880cdd5dc63f
--- /dev/null
+++ b/tools/testing/selftests/efivarfs/efivarfs.sh
@@ -0,0 +1,139 @@
+#!/bin/bash
+
+efivarfs_mount=/sys/firmware/efi/efivars
+test_guid=210be57c-9849-4fc7-a635-e6382d1aec27
+
+check_prereqs()
+{
+        local msg="skip all tests:"
+
+        if [ $UID != 0 ]; then
+                echo $msg must be run as root >&2
+                exit 0
+        fi
+
+        if ! grep -q "^\S\+ $efivarfs_mount efivarfs" /proc/mounts; then
+                echo $msg efivarfs is not mounted on $efivarfs_mount >&2
+                exit 0
+        fi
+}
+
+run_test()
+{
+        local test="$1"
+
+        echo "--------------------"
+        echo "running $test"
+        echo "--------------------"
+
+        if [ "$(type -t $test)" = 'function' ]; then
+                ( $test )
+        else
+                ( ./$test )
+        fi
+
+        if [ $? -ne 0 ]; then
+                echo "  [FAIL]"
+                rc=1
+        else
+                echo "  [PASS]"
+        fi
+}
+
+test_create()
+{
+        local attrs='\x07\x00\x00\x00'
+        local file=$efivarfs_mount/$FUNCNAME-$test_guid
+
+        printf "$attrs\x00" > $file
+
+        if [ ! -e $file ]; then
+                echo "$file couldn't be created" >&2
+                exit 1
+        fi
+
+        if [ $(stat -c %s $file) -ne 5 ]; then
+                echo "$file has invalid size" >&2
+                exit 1
+        fi
+}
+
+test_create_empty()
+{
+        local file=$efivarfs_mount/$FUNCNAME-$test_guid
+
+        : > $file
+
+        if [ ! -e $file ]; then
+                echo "$file can not be created without writing" >&2
+                exit 1
+        fi
+}
+
+test_create_read()
+{
+        local file=$efivarfs_mount/$FUNCNAME-$test_guid
+        ./create-read $file
+}
+
+test_delete()
+{
+        local attrs='\x07\x00\x00\x00'
+        local file=$efivarfs_mount/$FUNCNAME-$test_guid
+
+        printf "$attrs\x00" > $file
+
+        if [ ! -e $file ]; then
+                echo "$file couldn't be created" >&2
+                exit 1
+        fi
+
+        rm $file
+
+        if [ -e $file ]; then
+                echo "$file couldn't be deleted" >&2
+                exit 1
+        fi
+
+}
+
+# test that we can remove a variable by issuing a write with only
+# attributes specified
+test_zero_size_delete()
+{
+        local attrs='\x07\x00\x00\x00'
+        local file=$efivarfs_mount/$FUNCNAME-$test_guid
+
+        printf "$attrs\x00" > $file
+
+        if [ ! -e $file ]; then
+                echo "$file does not exist" >&2
+                exit 1
+        fi
+
+        printf "$attrs" > $file
+
+        if [ -e $file ]; then
+                echo "$file should have been deleted" >&2
+                exit 1
+        fi
+}
+
+test_open_unlink()
+{
+        local file=$efivarfs_mount/$FUNCNAME-$test_guid
+        ./open-unlink $file
+}
+
+check_prereqs
+
+rc=0
+
+run_test test_create
+run_test test_create_empty
+run_test test_create_read
+run_test test_delete
+run_test test_zero_size_delete
+run_test test_open_unlink
+
+exit $rc
diff --git a/tools/testing/selftests/efivarfs/open-unlink.c b/tools/testing/selftests/efivarfs/open-unlink.c
new file mode 100644
index 000000000000..8c0764407b3c
--- /dev/null
+++ b/tools/testing/selftests/efivarfs/open-unlink.c
@@ -0,0 +1,63 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+int main(int argc, char **argv)
+{
+        const char *path;
+        char buf[5];
+        int fd, rc;
+
+        if (argc < 2) {
+                fprintf(stderr, "usage: %s <path>\n", argv[0]);
+                return EXIT_FAILURE;
+        }
+
+        path = argv[1];
+
+        /* attributes: EFI_VARIABLE_NON_VOLATILE |
+         *              EFI_VARIABLE_BOOTSERVICE_ACCESS |
+         *              EFI_VARIABLE_RUNTIME_ACCESS
+         */
+        *(uint32_t *)buf = 0x7;
+        buf[4] = 0;
+
+        /* create a test variable */
+        fd = open(path, O_WRONLY | O_CREAT);
+        if (fd < 0) {
+                perror("open(O_WRONLY)");
+                return EXIT_FAILURE;
+        }
+
+        rc = write(fd, buf, sizeof(buf));
+        if (rc != sizeof(buf)) {
+                perror("write");
+                return EXIT_FAILURE;
+        }
+
+        close(fd);
+
+        fd = open(path, O_RDONLY);
+        if (fd < 0) {
+                perror("open");
+                return EXIT_FAILURE;
+        }
+
+        if (unlink(path) < 0) {
+                perror("unlink");
+                return EXIT_FAILURE;
+        }
+
+        rc = read(fd, buf, sizeof(buf));
+        if (rc > 0) {
+                fprintf(stderr, "reading from an unlinked variable "
+                                "shouldn't be possible\n");
+                return EXIT_FAILURE;
+        }
+
+        return EXIT_SUCCESS;
+}
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index b6eea5cc7b34..adb17f266b28 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -268,14 +268,13 @@ static void irqfd_update(struct kvm *kvm, struct _irqfd *irqfd,
                          struct kvm_irq_routing_table *irq_rt)
 {
         struct kvm_kernel_irq_routing_entry *e;
-        struct hlist_node *n;
 
         if (irqfd->gsi >= irq_rt->nr_rt_entries) {
                 rcu_assign_pointer(irqfd->irq_entry, NULL);
                 return;
         }
 
-        hlist_for_each_entry(e, n, &irq_rt->map[irqfd->gsi], link) {
+        hlist_for_each_entry(e, &irq_rt->map[irqfd->gsi], link) {
                 /* Only fast-path MSI. */
                 if (e->type == KVM_IRQ_ROUTING_MSI)
                         rcu_assign_pointer(irqfd->irq_entry, e);
diff --git a/virt/kvm/irq_comm.c b/virt/kvm/irq_comm.c
index ff6d40e2c06d..e9073cf4d040 100644
--- a/virt/kvm/irq_comm.c
+++ b/virt/kvm/irq_comm.c
@@ -173,7 +173,6 @@ int kvm_set_irq(struct kvm *kvm, int irq_source_id, u32 irq, int level)
         struct kvm_kernel_irq_routing_entry *e, irq_set[KVM_NR_IRQCHIPS];
         int ret = -1, i = 0;
         struct kvm_irq_routing_table *irq_rt;
-        struct hlist_node *n;
 
         trace_kvm_set_irq(irq, level, irq_source_id);
 
@@ -184,7 +183,7 @@ int kvm_set_irq(struct kvm *kvm, int irq_source_id, u32 irq, int level)
         rcu_read_lock();
         irq_rt = rcu_dereference(kvm->irq_routing);
         if (irq < irq_rt->nr_rt_entries)
-                hlist_for_each_entry(e, n, &irq_rt->map[irq], link)
+                hlist_for_each_entry(e, &irq_rt->map[irq], link)
                         irq_set[i++] = *e;
         rcu_read_unlock();
 
@@ -212,7 +211,6 @@ int kvm_set_irq_inatomic(struct kvm *kvm, int irq_source_id, u32 irq, int level)
         struct kvm_kernel_irq_routing_entry *e;
         int ret = -EINVAL;
         struct kvm_irq_routing_table *irq_rt;
-        struct hlist_node *n;
 
         trace_kvm_set_irq(irq, level, irq_source_id);
 
@@ -227,7 +225,7 @@ int kvm_set_irq_inatomic(struct kvm *kvm, int irq_source_id, u32 irq, int level)
         rcu_read_lock();
         irq_rt = rcu_dereference(kvm->irq_routing);
         if (irq < irq_rt->nr_rt_entries)
-                hlist_for_each_entry(e, n, &irq_rt->map[irq], link) {
+                hlist_for_each_entry(e, &irq_rt->map[irq], link) {
                         if (likely(e->type == KVM_IRQ_ROUTING_MSI))
                                 ret = kvm_set_msi_inatomic(e, kvm);
                         else
@@ -241,13 +239,12 @@ int kvm_set_irq_inatomic(struct kvm *kvm, int irq_source_id, u32 irq, int level)
 bool kvm_irq_has_notifier(struct kvm *kvm, unsigned irqchip, unsigned pin)
 {
         struct kvm_irq_ack_notifier *kian;
-        struct hlist_node *n;
         int gsi;
 
         rcu_read_lock();
         gsi = rcu_dereference(kvm->irq_routing)->chip[irqchip][pin];
         if (gsi != -1)
-                hlist_for_each_entry_rcu(kian, n, &kvm->irq_ack_notifier_list,
+                hlist_for_each_entry_rcu(kian, &kvm->irq_ack_notifier_list,
                                          link)
                         if (kian->gsi == gsi) {
                                 rcu_read_unlock();
@@ -263,7 +260,6 @@ EXPORT_SYMBOL_GPL(kvm_irq_has_notifier);
 void kvm_notify_acked_irq(struct kvm *kvm, unsigned irqchip, unsigned pin)
 {
         struct kvm_irq_ack_notifier *kian;
-        struct hlist_node *n;
         int gsi;
 
         trace_kvm_ack_irq(irqchip, pin);
@@ -271,7 +267,7 @@ void kvm_notify_acked_irq(struct kvm *kvm, unsigned irqchip, unsigned pin)
         rcu_read_lock();
         gsi = rcu_dereference(kvm->irq_routing)->chip[irqchip][pin];
         if (gsi != -1)
-                hlist_for_each_entry_rcu(kian, n, &kvm->irq_ack_notifier_list,
+                hlist_for_each_entry_rcu(kian, &kvm->irq_ack_notifier_list,
                                          link)
                         if (kian->gsi == gsi)
                                 kian->irq_acked(kian);
@@ -369,13 +365,12 @@ void kvm_fire_mask_notifiers(struct kvm *kvm, unsigned irqchip, unsigned pin,
                              bool mask)
 {
         struct kvm_irq_mask_notifier *kimn;
-        struct hlist_node *n;
         int gsi;
 
         rcu_read_lock();
         gsi = rcu_dereference(kvm->irq_routing)->chip[irqchip][pin];
         if (gsi != -1)
-                hlist_for_each_entry_rcu(kimn, n, &kvm->mask_notifier_list, link)
+                hlist_for_each_entry_rcu(kimn, &kvm->mask_notifier_list, link)
                         if (kimn->irq == gsi)
                                 kimn->func(kimn, mask);
         rcu_read_unlock();
@@ -396,13 +391,12 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
         int delta;
         unsigned max_pin;
         struct kvm_kernel_irq_routing_entry *ei;
-        struct hlist_node *n;
 
         /*
          * Do not allow GSI to be mapped to the same irqchip more than once.
          * Allow only one to one mapping between GSI and MSI.
          */
-        hlist_for_each_entry(ei, n, &rt->map[ue->gsi], link)
+        hlist_for_each_entry(ei, &rt->map[ue->gsi], link)
                 if (ei->type == KVM_IRQ_ROUTING_MSI ||
                     ue->type == KVM_IRQ_ROUTING_MSI ||
                     ue->u.irqchip.irqchip == ei->irqchip.irqchip)