12 files changed, 45 insertions, 59 deletions

diff --git a/arch/arm/kernel/kprobes.c b/arch/arm/kernel/kprobes.c
index 4dd41fc9e235..170e9f34003f 100644
--- a/arch/arm/kernel/kprobes.c
+++ b/arch/arm/kernel/kprobes.c
@@ -395,7 +395,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
 
@@ -415,7 +415,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -442,7 +442,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
         kretprobe_assert(ri, orig_ret_address, trampoline_address);
         kretprobe_hash_unlock(current, &flags);
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c
index 7026b29e277a..f8280a766a78 100644
--- a/arch/ia64/kernel/kprobes.c
+++ b/arch/ia64/kernel/kprobes.c
@@ -423,7 +423,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address =
                 ((struct fnptr *)kretprobe_trampoline)->ip;
@@ -444,7 +444,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -461,7 +461,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 
         regs->cr_iip = orig_ret_address;
 
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -487,7 +487,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
         kretprobe_hash_unlock(current, &flags);
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/mips/kernel/kprobes.c b/arch/mips/kernel/kprobes.c
index 158467da9bc1..ce3f0807ad1e 100644
--- a/arch/mips/kernel/kprobes.c
+++ b/arch/mips/kernel/kprobes.c
@@ -598,7 +598,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)kretprobe_trampoline;
 
@@ -618,7 +618,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -645,7 +645,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
         kretprobe_hash_unlock(current, &flags);
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index e88c64331819..11f5b03a0b06 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -310,7 +310,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
 
@@ -330,7 +330,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -357,7 +357,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
         kretprobe_hash_unlock(current, &flags);
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/powerpc/kvm/book3s_mmu_hpte.c b/arch/powerpc/kvm/book3s_mmu_hpte.c
index 2c86b0d63714..da8b13c4b776 100644
--- a/arch/powerpc/kvm/book3s_mmu_hpte.c
+++ b/arch/powerpc/kvm/book3s_mmu_hpte.c
@@ -124,7 +124,6 @@ static void kvmppc_mmu_pte_flush_all(struct kvm_vcpu *vcpu)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
         struct hpte_cache *pte;
-        struct hlist_node *node;
         int i;
 
         rcu_read_lock();
@@ -132,7 +131,7 @@ static void kvmppc_mmu_pte_flush_all(struct kvm_vcpu *vcpu)
         for (i = 0; i < HPTEG_HASH_NUM_VPTE_LONG; i++) {
                 struct hlist_head *list = &vcpu3s->hpte_hash_vpte_long[i];
 
-                hlist_for_each_entry_rcu(pte, node, list, list_vpte_long)
+                hlist_for_each_entry_rcu(pte, list, list_vpte_long)
                         invalidate_pte(vcpu, pte);
         }
 
@@ -143,7 +142,6 @@ static void kvmppc_mmu_pte_flush_page(struct kvm_vcpu *vcpu, ulong guest_ea)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
         struct hlist_head *list;
-        struct hlist_node *node;
         struct hpte_cache *pte;
 
         /* Find the list of entries in the map */
@@ -152,7 +150,7 @@ static void kvmppc_mmu_pte_flush_page(struct kvm_vcpu *vcpu, ulong guest_ea)
         rcu_read_lock();
 
         /* Check the list for matching entries and invalidate */
-        hlist_for_each_entry_rcu(pte, node, list, list_pte)
+        hlist_for_each_entry_rcu(pte, list, list_pte)
                 if ((pte->pte.eaddr & ~0xfffUL) == guest_ea)
                         invalidate_pte(vcpu, pte);
 
@@ -163,7 +161,6 @@ static void kvmppc_mmu_pte_flush_long(struct kvm_vcpu *vcpu, ulong guest_ea)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
         struct hlist_head *list;
-        struct hlist_node *node;
         struct hpte_cache *pte;
 
         /* Find the list of entries in the map */
@@ -173,7 +170,7 @@ static void kvmppc_mmu_pte_flush_long(struct kvm_vcpu *vcpu, ulong guest_ea)
         rcu_read_lock();
 
         /* Check the list for matching entries and invalidate */
-        hlist_for_each_entry_rcu(pte, node, list, list_pte_long)
+        hlist_for_each_entry_rcu(pte, list, list_pte_long)
                 if ((pte->pte.eaddr & 0x0ffff000UL) == guest_ea)
                         invalidate_pte(vcpu, pte);
 
@@ -207,7 +204,6 @@ static void kvmppc_mmu_pte_vflush_short(struct kvm_vcpu *vcpu, u64 guest_vp)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
         struct hlist_head *list;
-        struct hlist_node *node;
         struct hpte_cache *pte;
         u64 vp_mask = 0xfffffffffULL;
 
@@ -216,7 +212,7 @@ static void kvmppc_mmu_pte_vflush_short(struct kvm_vcpu *vcpu, u64 guest_vp)
         rcu_read_lock();
 
         /* Check the list for matching entries and invalidate */
-        hlist_for_each_entry_rcu(pte, node, list, list_vpte)
+        hlist_for_each_entry_rcu(pte, list, list_vpte)
                 if ((pte->pte.vpage & vp_mask) == guest_vp)
                         invalidate_pte(vcpu, pte);
 
@@ -228,7 +224,6 @@ static void kvmppc_mmu_pte_vflush_long(struct kvm_vcpu *vcpu, u64 guest_vp)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
         struct hlist_head *list;
-        struct hlist_node *node;
         struct hpte_cache *pte;
         u64 vp_mask = 0xffffff000ULL;
 
@@ -238,7 +233,7 @@ static void kvmppc_mmu_pte_vflush_long(struct kvm_vcpu *vcpu, u64 guest_vp)
         rcu_read_lock();
 
         /* Check the list for matching entries and invalidate */
-        hlist_for_each_entry_rcu(pte, node, list, list_vpte_long)
+        hlist_for_each_entry_rcu(pte, list, list_vpte_long)
                 if ((pte->pte.vpage & vp_mask) == guest_vp)
                         invalidate_pte(vcpu, pte);
 
@@ -266,7 +261,6 @@ void kvmppc_mmu_pte_vflush(struct kvm_vcpu *vcpu, u64 guest_vp, u64 vp_mask)
 void kvmppc_mmu_pte_pflush(struct kvm_vcpu *vcpu, ulong pa_start, ulong pa_end)
 {
         struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu);
-        struct hlist_node *node;
         struct hpte_cache *pte;
         int i;
 
@@ -277,7 +271,7 @@ void kvmppc_mmu_pte_pflush(struct kvm_vcpu *vcpu, ulong pa_start, ulong pa_end)
         for (i = 0; i < HPTEG_HASH_NUM_VPTE_LONG; i++) {
                 struct hlist_head *list = &vcpu3s->hpte_hash_vpte_long[i];
 
-                hlist_for_each_entry_rcu(pte, node, list, list_vpte_long)
+                hlist_for_each_entry_rcu(pte, list, list_vpte_long)
                         if ((pte->pte.raddr >= pa_start) &&
                             (pte->pte.raddr < pa_end))
                                 invalidate_pte(vcpu, pte);
diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index d1c7214e157c..3388b2b2a07d 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -354,7 +354,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
 {
         struct kretprobe_instance *ri;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address;
         unsigned long trampoline_address;
         kprobe_opcode_t *correct_ret_addr;
@@ -379,7 +379,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
         orig_ret_address = 0;
         correct_ret_addr = NULL;
         trampoline_address = (unsigned long) &kretprobe_trampoline;
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -398,7 +398,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
         kretprobe_assert(ri, orig_ret_address, trampoline_address);
 
         correct_ret_addr = ri->ret_addr;
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -427,7 +427,7 @@ static int __kprobes trampoline_probe_handler(struct kprobe *p,
         kretprobe_hash_unlock(current, &flags);
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/s390/pci/pci_msi.c b/arch/s390/pci/pci_msi.c
index 90fd3482b9e2..0297931335e1 100644
--- a/arch/s390/pci/pci_msi.c
+++ b/arch/s390/pci/pci_msi.c
@@ -25,10 +25,9 @@ static DEFINE_SPINLOCK(msi_map_lock);
 
 struct msi_desc *__irq_get_msi_desc(unsigned int irq)
 {
-        struct hlist_node *entry;
         struct msi_map *map;
 
-        hlist_for_each_entry_rcu(map, entry,
+        hlist_for_each_entry_rcu(map,
                         &msi_hash[msi_hashfn(irq)], msi_chain)
                 if (map->irq == irq)
                         return map->msi;
diff --git a/arch/sh/kernel/kprobes.c b/arch/sh/kernel/kprobes.c
index 1208b09e95c3..42b46e61a2d5 100644
--- a/arch/sh/kernel/kprobes.c
+++ b/arch/sh/kernel/kprobes.c
@@ -310,7 +310,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
 
@@ -330,7 +330,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -360,7 +360,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/sparc/kernel/kprobes.c b/arch/sparc/kernel/kprobes.c
index a39d1ba5a119..e72212148d2a 100644
--- a/arch/sparc/kernel/kprobes.c
+++ b/arch/sparc/kernel/kprobes.c
@@ -511,7 +511,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
 
@@ -531,7 +531,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
          *       real return address, and all the rest will point to
          *       kretprobe_trampoline
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -559,7 +559,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
         kretprobe_hash_unlock(current, &flags);
         preempt_enable_no_resched();
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
index 9fcc6b4e93b3..54df554b82d9 100644
--- a/arch/sparc/kernel/ldc.c
+++ b/arch/sparc/kernel/ldc.c
@@ -953,9 +953,8 @@ static HLIST_HEAD(ldc_channel_list);
 static int __ldc_channel_exists(unsigned long id)
 {
         struct ldc_channel *lp;
-        struct hlist_node *n;
 
-        hlist_for_each_entry(lp, n, &ldc_channel_list, list) {
+        hlist_for_each_entry(lp, &ldc_channel_list, list) {
                 if (lp->id == id)
                         return 1;
         }
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index e124554598ee..3f06e6149981 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -652,7 +652,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
         struct hlist_head *head, empty_rp;
-        struct hlist_node *node, *tmp;
+        struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
         kprobe_opcode_t *correct_ret_addr = NULL;
@@ -682,7 +682,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
          *       will be the real return address, and all the rest will
          *       point to kretprobe_trampoline.
          */
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -701,7 +701,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
         kretprobe_assert(ri, orig_ret_address, trampoline_address);
 
         correct_ret_addr = ri->ret_addr;
-        hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
                 if (ri->task != current)
                         /* another task is sharing our hash bucket */
                         continue;
@@ -728,7 +728,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
 
         kretprobe_hash_unlock(current, &flags);
 
-        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+        hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
                 hlist_del(&ri->hlist);
                 kfree(ri);
         }
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 4ed3edbe06bd..956ca358108a 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -1644,13 +1644,13 @@ static int kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
 static void kvm_mmu_commit_zap_page(struct kvm *kvm,
                                     struct list_head *invalid_list);
 
-#define for_each_gfn_sp(kvm, sp, gfn, pos)                              \
-  hlist_for_each_entry(sp, pos,                                         \
+#define for_each_gfn_sp(kvm, sp, gfn)                                   \
+  hlist_for_each_entry(sp,                                              \
    &(kvm)->arch.mmu_page_hash[kvm_page_table_hashfn(gfn)], hash_link)   \
         if ((sp)->gfn != (gfn)) {} else
 
-#define for_each_gfn_indirect_valid_sp(kvm, sp, gfn, pos)               \
-  hlist_for_each_entry(sp, pos,                                         \
+#define for_each_gfn_indirect_valid_sp(kvm, sp, gfn)                    \
+  hlist_for_each_entry(sp,                                              \
    &(kvm)->arch.mmu_page_hash[kvm_page_table_hashfn(gfn)], hash_link)   \
                 if ((sp)->gfn != (gfn) || (sp)->role.direct ||          \
                         (sp)->role.invalid) {} else
@@ -1706,11 +1706,10 @@ static int kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
 static void kvm_sync_pages(struct kvm_vcpu *vcpu,  gfn_t gfn)
 {
         struct kvm_mmu_page *s;
-        struct hlist_node *node;
         LIST_HEAD(invalid_list);
         bool flush = false;
 
-        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn, node) {
+        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn) {
                 if (!s->unsync)
                         continue;
 
@@ -1848,7 +1847,6 @@ static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
         union kvm_mmu_page_role role;
         unsigned quadrant;
         struct kvm_mmu_page *sp;
-        struct hlist_node *node;
         bool need_sync = false;
 
         role = vcpu->arch.mmu.base_role;
@@ -1863,7 +1861,7 @@ static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
                 quadrant &= (1 << ((PT32_PT_BITS - PT64_PT_BITS) * level)) - 1;
                 role.quadrant = quadrant;
         }
-        for_each_gfn_sp(vcpu->kvm, sp, gfn, node) {
+        for_each_gfn_sp(vcpu->kvm, sp, gfn) {
                 if (!need_sync && sp->unsync)
                         need_sync = true;
 
@@ -2151,14 +2149,13 @@ void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int goal_nr_mmu_pages)
 int kvm_mmu_unprotect_page(struct kvm *kvm, gfn_t gfn)
 {
         struct kvm_mmu_page *sp;
-        struct hlist_node *node;
         LIST_HEAD(invalid_list);
         int r;
 
         pgprintk("%s: looking for gfn %llx\n", __func__, gfn);
         r = 0;
         spin_lock(&kvm->mmu_lock);
-        for_each_gfn_indirect_valid_sp(kvm, sp, gfn, node) {
+        for_each_gfn_indirect_valid_sp(kvm, sp, gfn) {
                 pgprintk("%s: gfn %llx role %x\n", __func__, gfn,
                          sp->role.word);
                 r = 1;
@@ -2288,9 +2285,8 @@ static void __kvm_unsync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
 static void kvm_unsync_pages(struct kvm_vcpu *vcpu,  gfn_t gfn)
 {
         struct kvm_mmu_page *s;
-        struct hlist_node *node;
 
-        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn, node) {
+        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn) {
                 if (s->unsync)
                         continue;
                 WARN_ON(s->role.level != PT_PAGE_TABLE_LEVEL);
@@ -2302,10 +2298,9 @@ static int mmu_need_write_protect(struct kvm_vcpu *vcpu, gfn_t gfn,
                                   bool can_unsync)
 {
         struct kvm_mmu_page *s;
-        struct hlist_node *node;
         bool need_unsync = false;
 
-        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn, node) {
+        for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn) {
                 if (!can_unsync)
                         return 1;
 
@@ -3933,7 +3928,6 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
         gfn_t gfn = gpa >> PAGE_SHIFT;
         union kvm_mmu_page_role mask = { .word = 0 };
         struct kvm_mmu_page *sp;
-        struct hlist_node *node;
         LIST_HEAD(invalid_list);
         u64 entry, gentry, *spte;
         int npte;
@@ -3964,7 +3958,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
         kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
 
         mask.cr0_wp = mask.cr4_pae = mask.nxe = 1;
-        for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) {
+        for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) {
                 if (detect_write_misaligned(sp, gpa, bytes) ||
                       detect_write_flooding(sp)) {
                         zap_page |= !!kvm_mmu_prepare_zap_page(vcpu->kvm, sp,