When list_for_each_entry() completes the iteration over the whole list
without breaking the loop, the iterator value will be a bogus pointer
computed based on the head element.

While it is safe to use the pointer to determine if it was computed
based on the head element, either with list_entry_is_head() or
&pos->member == head, using the iterator variable after the loop should
be avoided.

In preparation to limiting the scope of a list iterator to the list
traversal loop, use a dedicated pointer to point to the found element.

Signed-off-by: Jakob Koschel <jakobkosc...@gmail.com>
---
 arch/arm/mach-mmp/sram.c                      |  9 ++--
 arch/arm/plat-pxa/ssp.c                       | 28 +++++-------
 drivers/block/drbd/drbd_req.c                 | 45 ++++++++++++-------
 drivers/counter/counter-chrdev.c              | 26 ++++++-----
 drivers/crypto/cavium/nitrox/nitrox_main.c    | 11 +++--
 drivers/dma/ppc4xx/adma.c                     | 11 +++--
 drivers/firewire/core-transaction.c           | 32 +++++++------
 drivers/firewire/sbp2.c                       | 14 +++---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c        | 19 +++++---
 drivers/gpu/drm/drm_memory.c                  | 15 ++++---
 drivers/gpu/drm/drm_mm.c                      | 17 ++++---
 drivers/gpu/drm/drm_vm.c                      | 13 +++---
 drivers/gpu/drm/gma500/oaktrail_lvds.c        |  9 ++--
 drivers/gpu/drm/i915/gem/i915_gem_context.c   | 14 +++---
 .../gpu/drm/i915/gem/i915_gem_execbuffer.c    | 15 ++++---
 drivers/gpu/drm/i915/gt/intel_ring.c          | 15 ++++---
 .../gpu/drm/nouveau/nvkm/subdev/fb/ramgk104.c | 13 +++---
 drivers/gpu/drm/scheduler/sched_main.c        | 14 +++---
 drivers/gpu/drm/ttm/ttm_bo.c                  | 19 ++++----
 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c           | 22 +++++----
 drivers/infiniband/hw/hfi1/tid_rdma.c         | 16 ++++---
 drivers/infiniband/hw/mlx4/main.c             | 12 ++---
 drivers/media/dvb-frontends/mxl5xx.c          | 11 +++--
 drivers/media/v4l2-core/v4l2-ctrls-api.c      | 31 +++++++------
 drivers/misc/mei/interrupt.c                  | 12 ++---
 .../net/ethernet/qlogic/qede/qede_filter.c    | 11 +++--
 .../net/wireless/intel/ipw2x00/libipw_rx.c    | 15 ++++---
 drivers/power/supply/cpcap-battery.c          | 11 +++--
 drivers/scsi/lpfc/lpfc_bsg.c                  | 16 ++++---
 drivers/staging/rtl8192e/rtl819x_TSProc.c     | 17 +++----
 drivers/staging/rtl8192e/rtllib_rx.c          | 17 ++++---
 .../staging/rtl8192u/ieee80211/ieee80211_rx.c | 15 ++++---
 .../rtl8192u/ieee80211/rtl819x_TSProc.c       | 19 ++++----
 drivers/usb/gadget/composite.c                |  9 ++--
 fs/cifs/smb2misc.c                            | 10 +++--
 fs/proc/kcore.c                               | 13 +++---
 kernel/debug/kdb/kdb_main.c                   | 36 +++++++++------
 kernel/power/snapshot.c                       | 10 +++--
 kernel/trace/ftrace.c                         | 22 +++++----
 kernel/trace/trace_eprobe.c                   | 15 ++++---
 kernel/trace/trace_events.c                   | 11 ++---
 net/9p/trans_xen.c                            | 11 +++--
 net/ipv4/udp_tunnel_nic.c                     | 10 +++--
 net/tipc/name_table.c                         | 11 +++--
 net/tipc/socket.c                             | 11 +++--
 net/xfrm/xfrm_ipcomp.c                        | 11 +++--
 sound/soc/intel/catpt/pcm.c                   | 13 +++---
 sound/soc/sprd/sprd-mcdt.c                    | 13 +++---
 48 files changed, 455 insertions(+), 315 deletions(-)

diff --git a/arch/arm/mach-mmp/sram.c b/arch/arm/mach-mmp/sram.c
index 6794e2db1ad5..fc47c107059b 100644
--- a/arch/arm/mach-mmp/sram.c
+++ b/arch/arm/mach-mmp/sram.c
@@ -39,19 +39,22 @@ static LIST_HEAD(sram_bank_list);
 struct gen_pool *sram_get_gpool(char *pool_name)
 {
        struct sram_bank_info *info = NULL;
+       struct sram_bank_info *tmp;

        if (!pool_name)
                return NULL;

        mutex_lock(&sram_lock);

-       list_for_each_entry(info, &sram_bank_list, node)
-               if (!strcmp(pool_name, info->pool_name))
+       list_for_each_entry(tmp, &sram_bank_list, node)
+               if (!strcmp(pool_name, tmp->pool_name)) {
+                       info = tmp;
                        break;
+               }

        mutex_unlock(&sram_lock);

-       if (&info->node == &sram_bank_list)
+       if (!info)
                return NULL;

        return info->gpool;
diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
index 563440315acd..4884a8c0c89b 100644
--- a/arch/arm/plat-pxa/ssp.c
+++ b/arch/arm/plat-pxa/ssp.c
@@ -38,22 +38,20 @@ static LIST_HEAD(ssp_list);
 struct ssp_device *pxa_ssp_request(int port, const char *label)
 {
        struct ssp_device *ssp = NULL;
+       struct ssp_device *tmp;

        mutex_lock(&ssp_lock);

-       list_for_each_entry(ssp, &ssp_list, node) {
-               if (ssp->port_id == port && ssp->use_count == 0) {
-                       ssp->use_count++;
-                       ssp->label = label;
+       list_for_each_entry(tmp, &ssp_list, node) {
+               if (tmp->port_id == port && tmp->use_count == 0) {
+                       tmp->use_count++;
+                       tmp->label = label;
+                       ssp = tmp;
                        break;
                }
        }

        mutex_unlock(&ssp_lock);
-
-       if (&ssp->node == &ssp_list)
-               return NULL;
-
        return ssp;
 }
 EXPORT_SYMBOL(pxa_ssp_request);
@@ -62,22 +60,20 @@ struct ssp_device *pxa_ssp_request_of(const struct 
device_node *of_node,
                                      const char *label)
 {
        struct ssp_device *ssp = NULL;
+       struct ssp_device *tmp;

        mutex_lock(&ssp_lock);

-       list_for_each_entry(ssp, &ssp_list, node) {
-               if (ssp->of_node == of_node && ssp->use_count == 0) {
-                       ssp->use_count++;
-                       ssp->label = label;
+       list_for_each_entry(tmp, &ssp_list, node) {
+               if (tmp->of_node == of_node && tmp->use_count == 0) {
+                       tmp->use_count++;
+                       tmp->label = label;
+                       ssp = tmp;
                        break;
                }
        }

        mutex_unlock(&ssp_lock);
-
-       if (&ssp->node == &ssp_list)
-               return NULL;
-
        return ssp;
 }
 EXPORT_SYMBOL(pxa_ssp_request_of);
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index 3235532ae077..ee7ee8b657bd 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -332,17 +332,22 @@ static void set_if_null_req_next(struct drbd_peer_device 
*peer_device, struct dr
 static void advance_conn_req_next(struct drbd_peer_device *peer_device, struct 
drbd_request *req)
 {
        struct drbd_connection *connection = peer_device ? 
peer_device->connection : NULL;
+       struct drbd_request *tmp;
        if (!connection)
                return;
        if (connection->req_next != req)
                return;
-       list_for_each_entry_continue(req, &connection->transfer_log, 
tl_requests) {
-               const unsigned s = req->rq_state;
-               if (s & RQ_NET_QUEUED)
+
+       tmp = req;
+       req = NULL;
+       list_for_each_entry_continue(tmp, &connection->transfer_log, 
tl_requests) {
+               const unsigned int s = tmp->rq_state;
+
+               if (s & RQ_NET_QUEUED) {
+                       req = tmp;
                        break;
+               }
        }
-       if (&req->tl_requests == &connection->transfer_log)
-               req = NULL;
        connection->req_next = req;
 }

@@ -358,17 +363,22 @@ static void set_if_null_req_ack_pending(struct 
drbd_peer_device *peer_device, st
 static void advance_conn_req_ack_pending(struct drbd_peer_device *peer_device, 
struct drbd_request *req)
 {
        struct drbd_connection *connection = peer_device ? 
peer_device->connection : NULL;
+       struct drbd_request *tmp;
        if (!connection)
                return;
        if (connection->req_ack_pending != req)
                return;
-       list_for_each_entry_continue(req, &connection->transfer_log, 
tl_requests) {
-               const unsigned s = req->rq_state;
-               if ((s & RQ_NET_SENT) && (s & RQ_NET_PENDING))
+
+       tmp = req;
+       req = NULL;
+       list_for_each_entry_continue(tmp, &connection->transfer_log, 
tl_requests) {
+               const unsigned int s = tmp->rq_state;
+
+               if ((s & RQ_NET_SENT) && (s & RQ_NET_PENDING)) {
+                       req = tmp;
                        break;
+               }
        }
-       if (&req->tl_requests == &connection->transfer_log)
-               req = NULL;
        connection->req_ack_pending = req;
 }

@@ -384,17 +394,22 @@ static void set_if_null_req_not_net_done(struct 
drbd_peer_device *peer_device, s
 static void advance_conn_req_not_net_done(struct drbd_peer_device 
*peer_device, struct drbd_request *req)
 {
        struct drbd_connection *connection = peer_device ? 
peer_device->connection : NULL;
+       struct drbd_request *tmp;
        if (!connection)
                return;
        if (connection->req_not_net_done != req)
                return;
-       list_for_each_entry_continue(req, &connection->transfer_log, 
tl_requests) {
-               const unsigned s = req->rq_state;
-               if ((s & RQ_NET_SENT) && !(s & RQ_NET_DONE))
+
+       tmp = req;
+       req = NULL;
+       list_for_each_entry_continue(tmp, &connection->transfer_log, 
tl_requests) {
+               const unsigned int s = tmp->rq_state;
+
+               if ((s & RQ_NET_SENT) && !(s & RQ_NET_DONE)) {
+                       req = tmp;
                        break;
+               }
        }
-       if (&req->tl_requests == &connection->transfer_log)
-               req = NULL;
        connection->req_not_net_done = req;
 }

diff --git a/drivers/counter/counter-chrdev.c b/drivers/counter/counter-chrdev.c
index b7c62f957a6a..6548dd9f02ac 100644
--- a/drivers/counter/counter-chrdev.c
+++ b/drivers/counter/counter-chrdev.c
@@ -131,18 +131,21 @@ static int counter_set_event_node(struct counter_device 
*const counter,
                                  struct counter_watch *const watch,
                                  const struct counter_comp_node *const cfg)
 {
-       struct counter_event_node *event_node;
+       struct counter_event_node *event_node = NULL;
+       struct counter_event_node *tmp;
        int err = 0;
        struct counter_comp_node *comp_node;

        /* Search for event in the list */
-       list_for_each_entry(event_node, &counter->next_events_list, l)
-               if (event_node->event == watch->event &&
-                   event_node->channel == watch->channel)
+       list_for_each_entry(tmp, &counter->next_events_list, l)
+               if (tmp->event == watch->event &&
+                   tmp->channel == watch->channel) {
+                       event_node = tmp;
                        break;
+               }

        /* If event is not already in the list */
-       if (&event_node->l == &counter->next_events_list) {
+       if (!event_node) {
                /* Allocate new event node */
                event_node = kmalloc(sizeof(*event_node), GFP_KERNEL);
                if (!event_node)
@@ -535,7 +538,8 @@ void counter_push_event(struct counter_device *const 
counter, const u8 event,
        struct counter_event ev;
        unsigned int copied = 0;
        unsigned long flags;
-       struct counter_event_node *event_node;
+       struct counter_event_node *event_node = NULL;
+       struct counter_event_node *tmp;
        struct counter_comp_node *comp_node;

        ev.timestamp = ktime_get_ns();
@@ -546,13 +550,15 @@ void counter_push_event(struct counter_device *const 
counter, const u8 event,
        spin_lock_irqsave(&counter->events_list_lock, flags);

        /* Search for event in the list */
-       list_for_each_entry(event_node, &counter->events_list, l)
-               if (event_node->event == event &&
-                   event_node->channel == channel)
+       list_for_each_entry(tmp, &counter->events_list, l)
+               if (tmp->event == event &&
+                   tmp->channel == channel) {
+                       event_node = tmp;
                        break;
+               }

        /* If event is not in the list */
-       if (&event_node->l == &counter->events_list)
+       if (!event_node)
                goto exit_early;

        /* Read and queue relevant comp for userspace */
diff --git a/drivers/crypto/cavium/nitrox/nitrox_main.c 
b/drivers/crypto/cavium/nitrox/nitrox_main.c
index 6c61817996a3..a003659bf66f 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_main.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_main.c
@@ -269,15 +269,18 @@ static void nitrox_remove_from_devlist(struct 
nitrox_device *ndev)

 struct nitrox_device *nitrox_get_first_device(void)
 {
-       struct nitrox_device *ndev;
+       struct nitrox_device *ndev = NULL;
+       struct nitrox_device *tmp;

        mutex_lock(&devlist_lock);
-       list_for_each_entry(ndev, &ndevlist, list) {
-               if (nitrox_ready(ndev))
+       list_for_each_entry(tmp, &ndevlist, list) {
+               if (nitrox_ready(tmp)) {
+                       ndev = tmp;
                        break;
+               }
        }
        mutex_unlock(&devlist_lock);
-       if (&ndev->list == &ndevlist)
+       if (!ndev)
                return NULL;

        refcount_inc(&ndev->refcnt);
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
index 5e46e347e28b..542286e1f0cf 100644
--- a/drivers/dma/ppc4xx/adma.c
+++ b/drivers/dma/ppc4xx/adma.c
@@ -935,23 +935,26 @@ static void ppc440spe_adma_device_clear_eot_status(
                        if (rv & DMA_CDB_STATUS_MSK) {
                                /* ZeroSum check failed
                                 */
-                               struct ppc440spe_adma_desc_slot *iter;
+                               struct ppc440spe_adma_desc_slot *iter = NULL;
+                               struct ppc440spe_adma_desc_slot *tmp;
                                dma_addr_t phys = rv & ~DMA_CDB_MSK;

                                /*
                                 * Update the status of corresponding
                                 * descriptor.
                                 */
-                               list_for_each_entry(iter, &chan->chain,
+                               list_for_each_entry(tmp, &chan->chain,
                                    chain_node) {
-                                       if (iter->phys == phys)
+                                       if (tmp->phys == phys) {
+                                               iter = tmp;
                                                break;
+                                       }
                                }
                                /*
                                 * if cannot find the corresponding
                                 * slot it's a bug
                                 */
-                               BUG_ON(&iter->chain_node == &chan->chain);
+                               BUG_ON(!iter);

                                if (iter->xor_check_result) {
                                        if (test_bit(PPC440SPE_DESC_PCHECK,
diff --git a/drivers/firewire/core-transaction.c 
b/drivers/firewire/core-transaction.c
index ac487c96bb71..870cbfb84f4f 100644
--- a/drivers/firewire/core-transaction.c
+++ b/drivers/firewire/core-transaction.c
@@ -73,24 +73,26 @@ static int try_cancel_split_timeout(struct fw_transaction 
*t)
 static int close_transaction(struct fw_transaction *transaction,
                             struct fw_card *card, int rcode)
 {
-       struct fw_transaction *t;
+       struct fw_transaction *t = NULL;
+       struct fw_transaction *tmp;
        unsigned long flags;

        spin_lock_irqsave(&card->lock, flags);
-       list_for_each_entry(t, &card->transaction_list, link) {
-               if (t == transaction) {
-                       if (!try_cancel_split_timeout(t)) {
+       list_for_each_entry(tmp, &card->transaction_list, link) {
+               if (tmp == transaction) {
+                       if (!try_cancel_split_timeout(tmp)) {
                                spin_unlock_irqrestore(&card->lock, flags);
                                goto timed_out;
                        }
-                       list_del_init(&t->link);
-                       card->tlabel_mask &= ~(1ULL << t->tlabel);
+                       list_del_init(&tmp->link);
+                       card->tlabel_mask &= ~(1ULL << tmp->tlabel);
+                       t = tmp;
                        break;
                }
        }
        spin_unlock_irqrestore(&card->lock, flags);

-       if (&t->link != &card->transaction_list) {
+       if (t) {
                t->callback(card, rcode, NULL, 0, t->callback_data);
                return 0;
        }
@@ -935,7 +937,8 @@ EXPORT_SYMBOL(fw_core_handle_request);

 void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
 {
-       struct fw_transaction *t;
+       struct fw_transaction *t = NULL;
+       struct fw_transaction *tmp;
        unsigned long flags;
        u32 *data;
        size_t data_length;
@@ -947,20 +950,21 @@ void fw_core_handle_response(struct fw_card *card, struct 
fw_packet *p)
        rcode   = HEADER_GET_RCODE(p->header[1]);

        spin_lock_irqsave(&card->lock, flags);
-       list_for_each_entry(t, &card->transaction_list, link) {
-               if (t->node_id == source && t->tlabel == tlabel) {
-                       if (!try_cancel_split_timeout(t)) {
+       list_for_each_entry(tmp, &card->transaction_list, link) {
+               if (tmp->node_id == source && tmp->tlabel == tlabel) {
+                       if (!try_cancel_split_timeout(tmp)) {
                                spin_unlock_irqrestore(&card->lock, flags);
                                goto timed_out;
                        }
-                       list_del_init(&t->link);
-                       card->tlabel_mask &= ~(1ULL << t->tlabel);
+                       list_del_init(&tmp->link);
+                       card->tlabel_mask &= ~(1ULL << tmp->tlabel);
+                       t = tmp;
                        break;
                }
        }
        spin_unlock_irqrestore(&card->lock, flags);

-       if (&t->link == &card->transaction_list) {
+       if (!t) {
  timed_out:
                fw_notice(card, "unsolicited response (source %x, tlabel %x)\n",
                          source, tlabel);
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 85cd379fd383..d01aabda7cad 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -408,7 +408,8 @@ static void sbp2_status_write(struct fw_card *card, struct 
fw_request *request,
                              void *payload, size_t length, void *callback_data)
 {
        struct sbp2_logical_unit *lu = callback_data;
-       struct sbp2_orb *orb;
+       struct sbp2_orb *orb = NULL;
+       struct sbp2_orb *tmp;
        struct sbp2_status status;
        unsigned long flags;

@@ -433,17 +434,18 @@ static void sbp2_status_write(struct fw_card *card, 
struct fw_request *request,

        /* Lookup the orb corresponding to this status write. */
        spin_lock_irqsave(&lu->tgt->lock, flags);
-       list_for_each_entry(orb, &lu->orb_list, link) {
+       list_for_each_entry(tmp, &lu->orb_list, link) {
                if (STATUS_GET_ORB_HIGH(status) == 0 &&
-                   STATUS_GET_ORB_LOW(status) == orb->request_bus) {
-                       orb->rcode = RCODE_COMPLETE;
-                       list_del(&orb->link);
+                   STATUS_GET_ORB_LOW(status) == tmp->request_bus) {
+                       tmp->rcode = RCODE_COMPLETE;
+                       list_del(&tmp->link);
+                       orb = tmp;
                        break;
                }
        }
        spin_unlock_irqrestore(&lu->tgt->lock, flags);

-       if (&orb->link != &lu->orb_list) {
+       if (orb) {
                orb->callback(orb, &status);
                kref_put(&orb->kref, free_orb); /* orb callback reference */
        } else {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index b37fc7d7d2c7..8b38e2fb0674 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -2444,26 +2444,31 @@ int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
                       struct amdgpu_bo_va *bo_va,
                       uint64_t saddr)
 {
-       struct amdgpu_bo_va_mapping *mapping;
+       struct amdgpu_bo_va_mapping *mapping = NULL;
+       struct amdgpu_bo_va_mapping *tmp;
        struct amdgpu_vm *vm = bo_va->base.vm;
        bool valid = true;

        saddr /= AMDGPU_GPU_PAGE_SIZE;

-       list_for_each_entry(mapping, &bo_va->valids, list) {
-               if (mapping->start == saddr)
+       list_for_each_entry(tmp, &bo_va->valids, list) {
+               if (tmp->start == saddr) {
+                       mapping = tmp;
                        break;
+               }
        }

-       if (&mapping->list == &bo_va->valids) {
+       if (!mapping) {
                valid = false;

-               list_for_each_entry(mapping, &bo_va->invalids, list) {
-                       if (mapping->start == saddr)
+               list_for_each_entry(tmp, &bo_va->invalids, list) {
+                       if (tmp->start == saddr) {
+                               mapping = tmp;
                                break;
+                       }
                }

-               if (&mapping->list == &bo_va->invalids)
+               if (!mapping)
                        return -ENOENT;
        }

diff --git a/drivers/gpu/drm/drm_memory.c b/drivers/gpu/drm/drm_memory.c
index d2e1dccd8113..99ddb7ad9eb7 100644
--- a/drivers/gpu/drm/drm_memory.c
+++ b/drivers/gpu/drm/drm_memory.c
@@ -60,7 +60,8 @@ static void *agp_remap(unsigned long offset, unsigned long 
size,
 {
        unsigned long i, num_pages =
            PAGE_ALIGN(size) / PAGE_SIZE;
-       struct drm_agp_mem *agpmem;
+       struct drm_agp_mem *agpmem = NULL;
+       struct drm_agp_mem *tmp;
        struct page **page_map;
        struct page **phys_page_map;
        void *addr;
@@ -71,12 +72,14 @@ static void *agp_remap(unsigned long offset, unsigned long 
size,
        offset -= dev->hose->mem_space->start;
 #endif

-       list_for_each_entry(agpmem, &dev->agp->memory, head)
-               if (agpmem->bound <= offset
-                   && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
-                   (offset + size))
+       list_for_each_entry(tmp, &dev->agp->memory, head)
+               if (tmp->bound <= offset
+                   && (tmp->bound + (tmp->pages << PAGE_SHIFT)) >=
+                   (offset + size)) {
+                       agpmem = tmp;
                        break;
-       if (&agpmem->head == &dev->agp->memory)
+               }
+       if (!agpmem)
                return NULL;

        /*
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 8257f9d4f619..0124e8dfa134 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -912,7 +912,8 @@ EXPORT_SYMBOL(drm_mm_scan_remove_block);
 struct drm_mm_node *drm_mm_scan_color_evict(struct drm_mm_scan *scan)
 {
        struct drm_mm *mm = scan->mm;
-       struct drm_mm_node *hole;
+       struct drm_mm_node *hole = NULL;
+       struct drm_mm_node *tmp;
        u64 hole_start, hole_end;

        DRM_MM_BUG_ON(list_empty(&mm->hole_stack));
@@ -925,18 +926,20 @@ struct drm_mm_node *drm_mm_scan_color_evict(struct 
drm_mm_scan *scan)
         * in the hole_stack list, but due to side-effects in the driver it
         * may not be.
         */
-       list_for_each_entry(hole, &mm->hole_stack, hole_stack) {
-               hole_start = __drm_mm_hole_node_start(hole);
-               hole_end = hole_start + hole->hole_size;
+       list_for_each_entry(tmp, &mm->hole_stack, hole_stack) {
+               hole_start = __drm_mm_hole_node_start(tmp);
+               hole_end = hole_start + tmp->hole_size;

                if (hole_start <= scan->hit_start &&
-                   hole_end >= scan->hit_end)
+                   hole_end >= scan->hit_end) {
+                       hole = tmp;
                        break;
+               }
        }

        /* We should only be called after we found the hole previously */
-       DRM_MM_BUG_ON(&hole->hole_stack == &mm->hole_stack);
-       if (unlikely(&hole->hole_stack == &mm->hole_stack))
+       DRM_MM_BUG_ON(!hole);
+       if (unlikely(!hole))
                return NULL;

        DRM_MM_BUG_ON(hole_start > scan->hit_start);
diff --git a/drivers/gpu/drm/drm_vm.c b/drivers/gpu/drm/drm_vm.c
index e957d4851dc0..630b2bbd172e 100644
--- a/drivers/gpu/drm/drm_vm.c
+++ b/drivers/gpu/drm/drm_vm.c
@@ -138,7 +138,8 @@ static vm_fault_t drm_vm_fault(struct vm_fault *vmf)
                 */
                resource_size_t offset = vmf->address - vma->vm_start;
                resource_size_t baddr = map->offset + offset;
-               struct drm_agp_mem *agpmem;
+               struct drm_agp_mem *agpmem = NULL;
+               struct drm_agp_mem *tmp;
                struct page *page;

 #ifdef __alpha__
@@ -151,13 +152,15 @@ static vm_fault_t drm_vm_fault(struct vm_fault *vmf)
                /*
                 * It's AGP memory - find the real physical page to map
                 */
-               list_for_each_entry(agpmem, &dev->agp->memory, head) {
-                       if (agpmem->bound <= baddr &&
-                           agpmem->bound + agpmem->pages * PAGE_SIZE > baddr)
+               list_for_each_entry(tmp, &dev->agp->memory, head) {
+                       if (tmp->bound <= baddr &&
+                           tmp->bound + tmp->pages * PAGE_SIZE > baddr) {
+                               agpmem = tmp;
                                break;
+                       }
                }

-               if (&agpmem->head == &dev->agp->memory)
+               if (!agpmem)
                        goto vm_fault_error;

                /*
diff --git a/drivers/gpu/drm/gma500/oaktrail_lvds.c 
b/drivers/gpu/drm/gma500/oaktrail_lvds.c
index 28b995ef2844..2df1cbef0965 100644
--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
+++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
@@ -87,6 +87,7 @@ static void oaktrail_lvds_mode_set(struct drm_encoder 
*encoder,
        struct psb_intel_mode_device *mode_dev = &dev_priv->mode_dev;
        struct drm_mode_config *mode_config = &dev->mode_config;
        struct drm_connector *connector = NULL;
+       struct drm_connector *tmp;
        struct drm_crtc *crtc = encoder->crtc;
        u32 lvds_port;
        uint64_t v = DRM_MODE_SCALE_FULLSCREEN;
@@ -112,12 +113,14 @@ static void oaktrail_lvds_mode_set(struct drm_encoder 
*encoder,
        REG_WRITE(LVDS, lvds_port);

        /* Find the connector we're trying to set up */
-       list_for_each_entry(connector, &mode_config->connector_list, head) {
-               if (connector->encoder && connector->encoder->crtc == crtc)
+       list_for_each_entry(tmp, &mode_config->connector_list, head) {
+               if (tmp->encoder && tmp->encoder->crtc == crtc) {
+                       connector = tmp;
                        break;
+               }
        }

-       if (list_entry_is_head(connector, &mode_config->connector_list, head)) {
+       if (!connector) {
                DRM_ERROR("Couldn't find connector when setting mode");
                gma_power_end(dev);
                return;
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c 
b/drivers/gpu/drm/i915/gem/i915_gem_context.c
index 00327b750fbb..80c79028901a 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
@@ -107,25 +107,27 @@ static void lut_close(struct i915_gem_context *ctx)
        radix_tree_for_each_slot(slot, &ctx->handles_vma, &iter, 0) {
                struct i915_vma *vma = rcu_dereference_raw(*slot);
                struct drm_i915_gem_object *obj = vma->obj;
-               struct i915_lut_handle *lut;
+               struct i915_lut_handle *lut = NULL;
+               struct i915_lut_handle *tmp;

                if (!kref_get_unless_zero(&obj->base.refcount))
                        continue;

                spin_lock(&obj->lut_lock);
-               list_for_each_entry(lut, &obj->lut_list, obj_link) {
-                       if (lut->ctx != ctx)
+               list_for_each_entry(tmp, &obj->lut_list, obj_link) {
+                       if (tmp->ctx != ctx)
                                continue;

-                       if (lut->handle != iter.index)
+                       if (tmp->handle != iter.index)
                                continue;

-                       list_del(&lut->obj_link);
+                       list_del(&tmp->obj_link);
+                       lut = tmp;
                        break;
                }
                spin_unlock(&obj->lut_lock);

-               if (&lut->obj_link != &obj->lut_list) {
+               if (lut) {
                        i915_lut_handle_free(lut);
                        radix_tree_iter_delete(&ctx->handles_vma, &iter, slot);
                        i915_vma_close(vma);
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c 
b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
index 1736efa43339..fda9e3685ad2 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -2444,7 +2444,8 @@ static struct i915_request *eb_throttle(struct 
i915_execbuffer *eb, struct intel
 {
        struct intel_ring *ring = ce->ring;
        struct intel_timeline *tl = ce->timeline;
-       struct i915_request *rq;
+       struct i915_request *rq = NULL;
+       struct i915_request *tmp;

        /*
         * Completely unscientific finger-in-the-air estimates for suitable
@@ -2460,15 +2461,17 @@ static struct i915_request *eb_throttle(struct 
i915_execbuffer *eb, struct intel
         * claiming our resources, but not so long that the ring completely
         * drains before we can submit our next request.
         */
-       list_for_each_entry(rq, &tl->requests, link) {
-               if (rq->ring != ring)
+       list_for_each_entry(tmp, &tl->requests, link) {
+               if (tmp->ring != ring)
                        continue;

-               if (__intel_ring_space(rq->postfix,
-                                      ring->emit, ring->size) > ring->size / 2)
+               if (__intel_ring_space(tmp->postfix,
+                                      ring->emit, ring->size) > ring->size / 
2) {
+                       rq = tmp;
                        break;
+               }
        }
-       if (&rq->link == &tl->requests)
+       if (!rq)
                return NULL; /* weird, we will check again later for real */

        return i915_request_get(rq);
diff --git a/drivers/gpu/drm/i915/gt/intel_ring.c 
b/drivers/gpu/drm/i915/gt/intel_ring.c
index 2fdd52b62092..4881c4e0c407 100644
--- a/drivers/gpu/drm/i915/gt/intel_ring.c
+++ b/drivers/gpu/drm/i915/gt/intel_ring.c
@@ -191,24 +191,27 @@ wait_for_space(struct intel_ring *ring,
               struct intel_timeline *tl,
               unsigned int bytes)
 {
-       struct i915_request *target;
+       struct i915_request *target = NULL;
+       struct i915_request *tmp;
        long timeout;

        if (intel_ring_update_space(ring) >= bytes)
                return 0;

        GEM_BUG_ON(list_empty(&tl->requests));
-       list_for_each_entry(target, &tl->requests, link) {
-               if (target->ring != ring)
+       list_for_each_entry(tmp, &tl->requests, link) {
+               if (tmp->ring != ring)
                        continue;

                /* Would completion of this request free enough space? */
-               if (bytes <= __intel_ring_space(target->postfix,
-                                               ring->emit, ring->size))
+               if (bytes <= __intel_ring_space(tmp->postfix,
+                                               ring->emit, ring->size)) {
+                       target = tmp;
                        break;
+               }
        }

-       if (GEM_WARN_ON(&target->link == &tl->requests))
+       if (GEM_WARN_ON(!target))
                return -ENOSPC;

        timeout = i915_request_wait(target,
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgk104.c 
b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgk104.c
index 2b678b60b4d3..c1f99d34e334 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgk104.c
@@ -1155,17 +1155,20 @@ static void
 gk104_ram_prog_0(struct gk104_ram *ram, u32 freq)
 {
        struct nvkm_device *device = ram->base.fb->subdev.device;
-       struct nvkm_ram_data *cfg;
+       struct nvkm_ram_data *cfg = NULL;
+       struct nvkm_ram_data *tmp;
        u32 mhz = freq / 1000;
        u32 mask, data;

-       list_for_each_entry(cfg, &ram->cfg, head) {
-               if (mhz >= cfg->bios.rammap_min &&
-                   mhz <= cfg->bios.rammap_max)
+       list_for_each_entry(tmp, &ram->cfg, head) {
+               if (mhz >= tmp->bios.rammap_min &&
+                   mhz <= tmp->bios.rammap_max) {
+                       cfg = tmp;
                        break;
+               }
        }

-       if (&cfg->head == &ram->cfg)
+       if (!cfg)
                return;

        if (mask = 0, data = 0, ram->diff.rammap_11_0a_03fe) {
diff --git a/drivers/gpu/drm/scheduler/sched_main.c 
b/drivers/gpu/drm/scheduler/sched_main.c
index f91fb31ab7a7..2051abe5337a 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -1081,7 +1081,8 @@ void drm_sched_increase_karma_ext(struct drm_sched_job 
*bad, int type)
 {
        int i;
        struct drm_sched_entity *tmp;
-       struct drm_sched_entity *entity;
+       struct drm_sched_entity *entity = NULL;
+       struct drm_sched_entity *iter;
        struct drm_gpu_scheduler *sched = bad->sched;

        /* don't change @bad's karma if it's from KERNEL RQ,
@@ -1099,16 +1100,17 @@ void drm_sched_increase_karma_ext(struct drm_sched_job 
*bad, int type)
                        struct drm_sched_rq *rq = &sched->sched_rq[i];

                        spin_lock(&rq->lock);
-                       list_for_each_entry_safe(entity, tmp, &rq->entities, 
list) {
+                       list_for_each_entry_safe(iter, tmp, &rq->entities, 
list) {
                                if (bad->s_fence->scheduled.context ==
-                                   entity->fence_context) {
-                                       if (entity->guilty)
-                                               atomic_set(entity->guilty, 
type);
+                                   iter->fence_context) {
+                                       if (iter->guilty)
+                                               atomic_set(iter->guilty, type);
+                                       entity = iter;
                                        break;
                                }
                        }
                        spin_unlock(&rq->lock);
-                       if (&entity->list != &rq->entities)
+                       if (entity)
                                break;
                }
        }
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index db3dc7ef5382..d4e0899f87d3 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -672,37 +672,36 @@ int ttm_mem_evict_first(struct ttm_device *bdev,
                        struct ttm_operation_ctx *ctx,
                        struct ww_acquire_ctx *ticket)
 {
-       struct ttm_buffer_object *bo = NULL, *busy_bo = NULL;
+       struct ttm_buffer_object *bo = NULL, *tmp, *busy_bo = NULL;
        bool locked = false;
        unsigned i;
        int ret;

        spin_lock(&bdev->lru_lock);
        for (i = 0; i < TTM_MAX_BO_PRIORITY; ++i) {
-               list_for_each_entry(bo, &man->lru[i], lru) {
+               list_for_each_entry(tmp, &man->lru[i], lru) {
                        bool busy;

-                       if (!ttm_bo_evict_swapout_allowable(bo, ctx, place,
+                       if (!ttm_bo_evict_swapout_allowable(tmp, ctx, place,
                                                            &locked, &busy)) {
                                if (busy && !busy_bo && ticket !=
-                                   dma_resv_locking_ctx(bo->base.resv))
-                                       busy_bo = bo;
+                                   dma_resv_locking_ctx(tmp->base.resv))
+                                       busy_bo = tmp;
                                continue;
                        }

-                       if (!ttm_bo_get_unless_zero(bo)) {
+                       if (!ttm_bo_get_unless_zero(tmp)) {
                                if (locked)
-                                       dma_resv_unlock(bo->base.resv);
+                                       dma_resv_unlock(tmp->base.resv);
                                continue;
                        }
+                       bo = tmp;
                        break;
                }

                /* If the inner loop terminated early, we have our candidate */
-               if (&bo->lru != &man->lru[i])
+               if (bo)
                        break;
-
-               bo = NULL;
        }

        if (!bo) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index bbd2f4ec08ec..8f1890cf438e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -2582,22 +2582,26 @@ int vmw_kms_fbdev_init_data(struct vmw_private 
*dev_priv,
                            struct drm_crtc **p_crtc,
                            struct drm_display_mode **p_mode)
 {
-       struct drm_connector *con;
+       struct drm_connector *con = NULL;
+       struct drm_connector *tmp1;
        struct vmw_display_unit *du;
-       struct drm_display_mode *mode;
+       struct drm_display_mode *mode = NULL;
+       struct drm_display_mode *tmp2;
        int i = 0;
        int ret = 0;

        mutex_lock(&dev_priv->drm.mode_config.mutex);
-       list_for_each_entry(con, &dev_priv->drm.mode_config.connector_list,
+       list_for_each_entry(tmp1, &dev_priv->drm.mode_config.connector_list,
                            head) {
-               if (i == unit)
+               if (i == unit) {
+                       con = tmp1;
                        break;
+               }

                ++i;
        }

-       if (&con->head == &dev_priv->drm.mode_config.connector_list) {
+       if (!con) {
                DRM_ERROR("Could not find initial display unit.\n");
                ret = -EINVAL;
                goto out_unlock;
@@ -2616,12 +2620,14 @@ int vmw_kms_fbdev_init_data(struct vmw_private 
*dev_priv,
        *p_con = con;
        *p_crtc = &du->crtc;

-       list_for_each_entry(mode, &con->modes, head) {
-               if (mode->type & DRM_MODE_TYPE_PREFERRED)
+       list_for_each_entry(tmp2, &con->modes, head) {
+               if (tmp2->type & DRM_MODE_TYPE_PREFERRED) {
+                       mode = tmp2;
                        break;
+               }
        }

-       if (&mode->head == &con->modes) {
+       if (!mode) {
                WARN_ONCE(true, "Could not find initial preferred mode.\n");
                *p_mode = list_first_entry(&con->modes,
                                           struct drm_display_mode,
diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c 
b/drivers/infiniband/hw/hfi1/tid_rdma.c
index 2a7abf7a1f7f..a069847b56aa 100644
--- a/drivers/infiniband/hw/hfi1/tid_rdma.c
+++ b/drivers/infiniband/hw/hfi1/tid_rdma.c
@@ -1239,7 +1239,7 @@ static int kern_alloc_tids(struct tid_rdma_flow *flow)
        struct hfi1_ctxtdata *rcd = flow->req->rcd;
        struct hfi1_devdata *dd = rcd->dd;
        u32 ngroups, pageidx = 0;
-       struct tid_group *group = NULL, *used;
+       struct tid_group *group = NULL, *used, *tmp;
        u8 use;

        flow->tnode_cnt = 0;
@@ -1248,13 +1248,15 @@ static int kern_alloc_tids(struct tid_rdma_flow *flow)
                goto used_list;

        /* First look at complete groups */
-       list_for_each_entry(group,  &rcd->tid_group_list.list, list) {
-               kern_add_tid_node(flow, rcd, "complete groups", group,
-                                 group->size);
+       list_for_each_entry(tmp,  &rcd->tid_group_list.list, list) {
+               kern_add_tid_node(flow, rcd, "complete groups", tmp,
+                                 tmp->size);

-               pageidx += group->size;
-               if (!--ngroups)
+               pageidx += tmp->size;
+               if (!--ngroups) {
+                       group = tmp;
                        break;
+               }
        }

        if (pageidx >= flow->npagesets)
@@ -1277,7 +1279,7 @@ static int kern_alloc_tids(struct tid_rdma_flow *flow)
         * However, if we are at the head, we have reached the end of the
         * complete groups list from the first loop above
         */
-       if (group && &group->list == &rcd->tid_group_list.list)
+       if (!group)
                goto bail_eagain;
        group = list_prepare_entry(group, &rcd->tid_group_list.list,
                                   list);
diff --git a/drivers/infiniband/hw/mlx4/main.c 
b/drivers/infiniband/hw/mlx4/main.c
index 93b1650eacfa..4659d879e97d 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1920,17 +1920,19 @@ static int mlx4_ib_mcg_detach(struct ib_qp *ibqp, union 
ib_gid *gid, u16 lid)

        if (mdev->dev->caps.steering_mode ==
            MLX4_STEERING_MODE_DEVICE_MANAGED) {
-               struct mlx4_ib_steering *ib_steering;
+               struct mlx4_ib_steering *ib_steering = NULL;
+               struct mlx4_ib_steering *tmp;

                mutex_lock(&mqp->mutex);
-               list_for_each_entry(ib_steering, &mqp->steering_rules, list) {
-                       if (!memcmp(ib_steering->gid.raw, gid->raw, 16)) {
-                               list_del(&ib_steering->list);
+               list_for_each_entry(tmp, &mqp->steering_rules, list) {
+                       if (!memcmp(tmp->gid.raw, gid->raw, 16)) {
+                               list_del(&tmp->list);
+                               ib_steering = tmp;
                                break;
                        }
                }
                mutex_unlock(&mqp->mutex);
-               if (&ib_steering->list == &mqp->steering_rules) {
+               if (!ib_steering) {
                        pr_err("Couldn't find reg_id for mgid. Steering rule is 
left attached\n");
                        return -EINVAL;
                }
diff --git a/drivers/media/dvb-frontends/mxl5xx.c 
b/drivers/media/dvb-frontends/mxl5xx.c
index 934d1c0b214a..78c37ce56e32 100644
--- a/drivers/media/dvb-frontends/mxl5xx.c
+++ b/drivers/media/dvb-frontends/mxl5xx.c
@@ -492,17 +492,20 @@ static int enable_tuner(struct mxl *state, u32 tuner, u32 
enable);
 static int sleep(struct dvb_frontend *fe)
 {
        struct mxl *state = fe->demodulator_priv;
-       struct mxl *p;
+       struct mxl *p = NULL;
+       struct mxl *tmp;

        cfg_demod_abort_tune(state);
        if (state->tuner_in_use != 0xffffffff) {
                mutex_lock(&state->base->tune_lock);
                state->tuner_in_use = 0xffffffff;
-               list_for_each_entry(p, &state->base->mxls, mxl) {
-                       if (p->tuner_in_use == state->tuner)
+               list_for_each_entry(tmp, &state->base->mxls, mxl) {
+                       if (tmp->tuner_in_use == state->tuner) {
+                               p = tmp;
                                break;
+                       }
                }
-               if (&p->mxl == &state->base->mxls)
+               if (!p)
                        enable_tuner(state, state->tuner, 0);
                mutex_unlock(&state->base->tune_lock);
        }
diff --git a/drivers/media/v4l2-core/v4l2-ctrls-api.c 
b/drivers/media/v4l2-core/v4l2-ctrls-api.c
index db9baa0bd05f..9245fd5e546c 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls-api.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-api.c
@@ -942,6 +942,7 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, 
struct v4l2_query_ext_ctr
        const unsigned int next_flags = V4L2_CTRL_FLAG_NEXT_CTRL | 
V4L2_CTRL_FLAG_NEXT_COMPOUND;
        u32 id = qc->id & V4L2_CTRL_ID_MASK;
        struct v4l2_ctrl_ref *ref;
+       struct v4l2_ctrl_ref *tmp;
        struct v4l2_ctrl *ctrl;

        if (!hdl)
@@ -976,15 +977,17 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, 
struct v4l2_query_ext_ctr
                         * We found a control with the given ID, so just get
                         * the next valid one in the list.
                         */
-                       list_for_each_entry_continue(ref, &hdl->ctrl_refs, 
node) {
-                               is_compound = ref->ctrl->is_array ||
-                                       ref->ctrl->type >= 
V4L2_CTRL_COMPOUND_TYPES;
-                               if (id < ref->ctrl->id &&
-                                   (is_compound & mask) == match)
+                       tmp = ref;
+                       ref = NULL;
+                       list_for_each_entry_continue(tmp, &hdl->ctrl_refs, 
node) {
+                               is_compound = tmp->ctrl->is_array ||
+                                       tmp->ctrl->type >= 
V4L2_CTRL_COMPOUND_TYPES;
+                               if (id < tmp->ctrl->id &&
+                                   (is_compound & mask) == match) {
+                                       ref = tmp;
                                        break;
+                               }
                        }
-                       if (&ref->node == &hdl->ctrl_refs)
-                               ref = NULL;
                } else {
                        /*
                         * No control with the given ID exists, so start
@@ -992,15 +995,15 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, 
struct v4l2_query_ext_ctr
                         * is one, otherwise the first 'if' above would have
                         * been true.
                         */
-                       list_for_each_entry(ref, &hdl->ctrl_refs, node) {
-                               is_compound = ref->ctrl->is_array ||
-                                       ref->ctrl->type >= 
V4L2_CTRL_COMPOUND_TYPES;
-                               if (id < ref->ctrl->id &&
-                                   (is_compound & mask) == match)
+                       list_for_each_entry(tmp, &hdl->ctrl_refs, node) {
+                               is_compound = tmp->ctrl->is_array ||
+                                       tmp->ctrl->type >= 
V4L2_CTRL_COMPOUND_TYPES;
+                               if (id < tmp->ctrl->id &&
+                                   (is_compound & mask) == match) {
+                                       ref = tmp;
                                        break;
+                               }
                        }
-                       if (&ref->node == &hdl->ctrl_refs)
-                               ref = NULL;
                }
        }
        mutex_unlock(hdl->lock);
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index a67f4f2d33a9..f15b91e22b9d 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -329,7 +329,8 @@ int mei_irq_read_handler(struct mei_device *dev,
 {
        struct mei_msg_hdr *mei_hdr;
        struct mei_ext_meta_hdr *meta_hdr = NULL;
-       struct mei_cl *cl;
+       struct mei_cl *cl = NULL;
+       struct mei_cl *tmp;
        int ret;
        u32 hdr_size_left;
        u32 hdr_size_ext;
@@ -421,15 +422,16 @@ int mei_irq_read_handler(struct mei_device *dev,
        }

        /* find recipient cl */
-       list_for_each_entry(cl, &dev->file_list, link) {
-               if (mei_cl_hbm_equal(cl, mei_hdr)) {
-                       cl_dbg(dev, cl, "got a message\n");
+       list_for_each_entry(tmp, &dev->file_list, link) {
+               if (mei_cl_hbm_equal(tmp, mei_hdr)) {
+                       cl_dbg(dev, tmp, "got a message\n");
+                       cl = tmp;
                        break;
                }
        }

        /* if no recipient cl was found we assume corrupted header */
-       if (&cl->link == &dev->file_list) {
+       if (!cl) {
                /* A message for not connected fixed address clients
                 * should be silently discarded
                 * On power down client may be force cleaned,
diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c 
b/drivers/net/ethernet/qlogic/qede/qede_filter.c
index 3010833ddde3..d3e59ee13705 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c
@@ -829,18 +829,21 @@ int qede_configure_vlan_filters(struct qede_dev *edev)
 int qede_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)
 {
        struct qede_dev *edev = netdev_priv(dev);
-       struct qede_vlan *vlan;
+       struct qede_vlan *vlan = NULL;
+       struct qede_vlan *tmp;
        int rc = 0;

        DP_VERBOSE(edev, NETIF_MSG_IFDOWN, "Removing vlan 0x%04x\n", vid);

        /* Find whether entry exists */
        __qede_lock(edev);
-       list_for_each_entry(vlan, &edev->vlan_list, list)
-               if (vlan->vid == vid)
+       list_for_each_entry(tmp, &edev->vlan_list, list)
+               if (tmp->vid == vid) {
+                       vlan = tmp;
                        break;
+               }

-       if (list_entry_is_head(vlan, &edev->vlan_list, list)) {
+       if (!vlan) {
                DP_VERBOSE(edev, (NETIF_MSG_IFUP | NETIF_MSG_IFDOWN),
                           "Vlan isn't configured\n");
                goto out;
diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_rx.c 
b/drivers/net/wireless/intel/ipw2x00/libipw_rx.c
index 7a684b76f39b..c78372e0dc15 100644
--- a/drivers/net/wireless/intel/ipw2x00/libipw_rx.c
+++ b/drivers/net/wireless/intel/ipw2x00/libipw_rx.c
@@ -1507,7 +1507,8 @@ static void libipw_process_probe_response(struct 
libipw_device
 {
        struct net_device *dev = ieee->dev;
        struct libipw_network network = { };
-       struct libipw_network *target;
+       struct libipw_network *target = NULL;
+       struct libipw_network *tmp;
        struct libipw_network *oldest = NULL;
 #ifdef CONFIG_LIBIPW_DEBUG
        struct libipw_info_element *info_element = beacon->info_element;
@@ -1555,18 +1556,20 @@ static void libipw_process_probe_response(struct 
libipw_device

        spin_lock_irqsave(&ieee->lock, flags);

-       list_for_each_entry(target, &ieee->network_list, list) {
-               if (is_same_network(target, &network))
+       list_for_each_entry(tmp, &ieee->network_list, list) {
+               if (is_same_network(tmp, &network)) {
+                       target = tmp;
                        break;
+               }

                if ((oldest == NULL) ||
-                   time_before(target->last_scanned, oldest->last_scanned))
-                       oldest = target;
+                   time_before(tmp->last_scanned, oldest->last_scanned))
+                       oldest = tmp;
        }

        /* If we didn't find a match, then get a new network slot to initialize
         * with this beacon's information */
-       if (&target->list == &ieee->network_list) {
+       if (!target) {
                if (list_empty(&ieee->network_free_list)) {
                        /* If there are no more slots, expire the oldest */
                        list_del(&oldest->list);
diff --git a/drivers/power/supply/cpcap-battery.c 
b/drivers/power/supply/cpcap-battery.c
index 18e3ff0e15d5..6542ff3eeccc 100644
--- a/drivers/power/supply/cpcap-battery.c
+++ b/drivers/power/supply/cpcap-battery.c
@@ -789,17 +789,20 @@ static irqreturn_t cpcap_battery_irq_thread(int irq, void 
*data)
 {
        struct cpcap_battery_ddata *ddata = data;
        struct cpcap_battery_state_data *latest;
-       struct cpcap_interrupt_desc *d;
+       struct cpcap_interrupt_desc *d = NULL;
+       struct cpcap_interrupt_desc *tmp;

        if (!atomic_read(&ddata->active))
                return IRQ_NONE;

-       list_for_each_entry(d, &ddata->irq_list, node) {
-               if (irq == d->irq)
+       list_for_each_entry(tmp, &ddata->irq_list, node) {
+               if (irq == tmp->irq) {
+                       d = tmp;
                        break;
+               }
        }

-       if (list_entry_is_head(d, &ddata->irq_list, node))
+       if (!d)
                return IRQ_NONE;

        latest = cpcap_battery_latest(ddata);
diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
index fdf08cb57207..30174bddf024 100644
--- a/drivers/scsi/lpfc/lpfc_bsg.c
+++ b/drivers/scsi/lpfc/lpfc_bsg.c
@@ -1185,7 +1185,8 @@ lpfc_bsg_hba_set_event(struct bsg_job *job)
        struct lpfc_hba *phba = vport->phba;
        struct fc_bsg_request *bsg_request = job->request;
        struct set_ct_event *event_req;
-       struct lpfc_bsg_event *evt;
+       struct lpfc_bsg_event *evt = NULL;
+       struct lpfc_bsg_event *tmp;
        int rc = 0;
        struct bsg_job_data *dd_data = NULL;
        uint32_t ev_mask;
@@ -1205,17 +1206,18 @@ lpfc_bsg_hba_set_event(struct bsg_job *job)
        ev_mask = ((uint32_t)(unsigned long)event_req->type_mask &
                                FC_REG_EVENT_MASK);
        spin_lock_irqsave(&phba->ct_ev_lock, flags);
-       list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
-               if (evt->reg_id == event_req->ev_reg_id) {
-                       lpfc_bsg_event_ref(evt);
-                       evt->wait_time_stamp = jiffies;
-                       dd_data = (struct bsg_job_data *)evt->dd_data;
+       list_for_each_entry(tmp, &phba->ct_ev_waiters, node) {
+               if (tmp->reg_id == event_req->ev_reg_id) {
+                       lpfc_bsg_event_ref(tmp);
+                       tmp->wait_time_stamp = jiffies;
+                       dd_data = (struct bsg_job_data *)tmp->dd_data;
+                       evt = tmp;
                        break;
                }
        }
        spin_unlock_irqrestore(&phba->ct_ev_lock, flags);

-       if (&evt->node == &phba->ct_ev_waiters) {
+       if (!evt) {
                /* no event waiting struct yet - first call */
                dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
                if (dd_data == NULL) {
diff --git a/drivers/staging/rtl8192e/rtl819x_TSProc.c 
b/drivers/staging/rtl8192e/rtl819x_TSProc.c
index 34b00a76b6bd..7ed60edc5aa8 100644
--- a/drivers/staging/rtl8192e/rtl819x_TSProc.c
+++ b/drivers/staging/rtl8192e/rtl819x_TSProc.c
@@ -213,6 +213,7 @@ static struct ts_common_info *SearchAdmitTRStream(struct 
rtllib_device *ieee,
        bool    search_dir[4] = {0};
        struct list_head *psearch_list;
        struct ts_common_info *pRet = NULL;
+       struct ts_common_info *tmp;

        if (ieee->iw_mode == IW_MODE_MASTER) {
                if (TxRxSelect == TX_DIR) {
@@ -247,19 +248,19 @@ static struct ts_common_info *SearchAdmitTRStream(struct 
rtllib_device *ieee,
        for (dir = 0; dir <= DIR_BI_DIR; dir++) {
                if (!search_dir[dir])
                        continue;
-               list_for_each_entry(pRet, psearch_list, List) {
-                       if (memcmp(pRet->Addr, Addr, 6) == 0 &&
-                           pRet->TSpec.f.TSInfo.field.ucTSID == TID &&
-                           pRet->TSpec.f.TSInfo.field.ucDirection == dir)
+               list_for_each_entry(tmp, psearch_list, List) {
+                       if (memcmp(tmp->Addr, Addr, 6) == 0 &&
+                           tmp->TSpec.f.TSInfo.field.ucTSID == TID &&
+                           tmp->TSpec.f.TSInfo.field.ucDirection == dir) {
+                               pRet = tmp;
                                break;
+                       }
                }
-               if (&pRet->List  != psearch_list)
+               if (pRet)
                        break;
        }

-       if (pRet && &pRet->List  != psearch_list)
-               return pRet;
-       return NULL;
+       return pRet;
 }

 static void MakeTSEntry(struct ts_common_info *pTsCommonInfo, u8 *Addr,
diff --git a/drivers/staging/rtl8192e/rtllib_rx.c 
b/drivers/staging/rtl8192e/rtllib_rx.c
index e3d0a361d370..5f44bc5dcd76 100644
--- a/drivers/staging/rtl8192e/rtllib_rx.c
+++ b/drivers/staging/rtl8192e/rtllib_rx.c
@@ -2540,7 +2540,8 @@ static inline void rtllib_process_probe_response(
        struct rtllib_probe_response *beacon,
        struct rtllib_rx_stats *stats)
 {
-       struct rtllib_network *target;
+       struct rtllib_network *target = NULL;
+       struct rtllib_network *tmp;
        struct rtllib_network *oldest = NULL;
        struct rtllib_info_element *info_element = &beacon->info_element[0];
        unsigned long flags;
@@ -2623,19 +2624,21 @@ static inline void rtllib_process_probe_response(
                                ieee->LinkDetectInfo.NumRecvBcnInPeriod++;
                }
        }
-       list_for_each_entry(target, &ieee->network_list, list) {
-               if (is_same_network(target, network,
-                  (target->ssid_len ? 1 : 0)))
+       list_for_each_entry(tmp, &ieee->network_list, list) {
+               if (is_same_network(tmp, network,
+                  (tmp->ssid_len ? 1 : 0))) {
+                       target = tmp;
                        break;
+               }
                if ((oldest == NULL) ||
-                   (target->last_scanned < oldest->last_scanned))
-                       oldest = target;
+                   (tmp->last_scanned < oldest->last_scanned))
+                       oldest = tmp;
        }

        /* If we didn't find a match, then get a new network slot to initialize
         * with this beacon's information
         */
-       if (&target->list == &ieee->network_list) {
+       if (!target) {
                if (list_empty(&ieee->network_free_list)) {
                        /* If there are no more slots, expire the oldest */
                        list_del(&oldest->list);
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c 
b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
index b58e75932ecd..2843c1c1c2f2 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
@@ -2239,7 +2239,8 @@ static inline void ieee80211_process_probe_response(
        struct ieee80211_rx_stats *stats)
 {
        struct ieee80211_network *network;
-       struct ieee80211_network *target;
+       struct ieee80211_network *target = NULL;
+       struct ieee80211_network *tmp;
        struct ieee80211_network *oldest = NULL;
 #ifdef CONFIG_IEEE80211_DEBUG
        struct ieee80211_info_element *info_element = &beacon->info_element[0];
@@ -2357,17 +2358,19 @@ static inline void ieee80211_process_probe_response(
                        network->flags = (~NETWORK_EMPTY_ESSID & 
network->flags) | (NETWORK_EMPTY_ESSID & ieee->current_network.flags);
        }

-       list_for_each_entry(target, &ieee->network_list, list) {
-               if (is_same_network(target, network, ieee))
+       list_for_each_entry(tmp, &ieee->network_list, list) {
+               if (is_same_network(tmp, network, ieee)) {
+                       target = tmp;
                        break;
+               }
                if (!oldest ||
-                   (target->last_scanned < oldest->last_scanned))
-                       oldest = target;
+                   (tmp->last_scanned < oldest->last_scanned))
+                       oldest = tmp;
        }

        /* If we didn't find a match, then get a new network slot to initialize
         * with this beacon's information */
-       if (&target->list == &ieee->network_list) {
+       if (!target) {
                if (list_empty(&ieee->network_free_list)) {
                        /* If there are no more slots, expire the oldest */
                        list_del(&oldest->list);
diff --git a/drivers/staging/rtl8192u/ieee80211/rtl819x_TSProc.c 
b/drivers/staging/rtl8192u/ieee80211/rtl819x_TSProc.c
index 3aabb401b15a..1b8f3fd8e51d 100644
--- a/drivers/staging/rtl8192u/ieee80211/rtl819x_TSProc.c
+++ b/drivers/staging/rtl8192u/ieee80211/rtl819x_TSProc.c
@@ -209,6 +209,7 @@ static struct ts_common_info *SearchAdmitTRStream(struct 
ieee80211_device *ieee,
        bool                            search_dir[4] = {0};
        struct list_head                *psearch_list; //FIXME
        struct ts_common_info   *pRet = NULL;
+       struct ts_common_info   *tmp;
        if (ieee->iw_mode == IW_MODE_MASTER) { //ap mode
                if (TxRxSelect == TX_DIR) {
                        search_dir[DIR_DOWN] = true;
@@ -243,23 +244,21 @@ static struct ts_common_info *SearchAdmitTRStream(struct 
ieee80211_device *ieee,
        for (dir = 0; dir <= DIR_BI_DIR; dir++) {
                if (!search_dir[dir])
                        continue;
-               list_for_each_entry(pRet, psearch_list, list) {
-       //              IEEE80211_DEBUG(IEEE80211_DL_TS, "ADD:%pM, TID:%d, 
dir:%d\n", pRet->Addr, pRet->TSpec.ts_info.ucTSID, 
pRet->TSpec.ts_info.ucDirection);
-                       if (memcmp(pRet->addr, Addr, 6) == 0)
-                               if (pRet->t_spec.ts_info.uc_tsid == TID)
-                                       if (pRet->t_spec.ts_info.uc_direction 
== dir) {
+               list_for_each_entry(tmp, psearch_list, list) {
+       //              IEEE80211_DEBUG(IEEE80211_DL_TS, "ADD:%pM, TID:%d, 
dir:%d\n", tmp->Addr, tmp->TSpec.ts_info.ucTSID, 
tmp->TSpec.ts_info.ucDirection);
+                       if (memcmp(tmp->addr, Addr, 6) == 0)
+                               if (tmp->t_spec.ts_info.uc_tsid == TID)
+                                       if (tmp->t_spec.ts_info.uc_direction == 
dir) {
        //                                      printk("Bingo! got it\n");
+       //                                      pRet = tmp;
                                                break;
                                        }
                }
-               if (&pRet->list  != psearch_list)
+               if (pRet)
                        break;
        }

-       if (&pRet->list  != psearch_list)
-               return pRet;
-       else
-               return NULL;
+       return pRet;
 }

 static void MakeTSEntry(struct ts_common_info *pTsCommonInfo, u8 *Addr,
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 9315313108c9..26908d012ac8 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1690,6 +1690,7 @@ composite_setup(struct usb_gadget *gadget, const struct 
usb_ctrlrequest *ctrl)
        u16                             w_value = le16_to_cpu(ctrl->wValue);
        u16                             w_length = le16_to_cpu(ctrl->wLength);
        struct usb_function             *f = NULL;
+       struct usb_function             *tmp;
        u8                              endp;

        if (w_length > USB_COMP_EP0_BUFSIZ) {
@@ -2046,12 +2047,12 @@ composite_setup(struct usb_gadget *gadget, const struct 
usb_ctrlrequest *ctrl)
                        if (!cdev->config)
                                break;
                        endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f);
-                       list_for_each_entry(f, &cdev->config->functions, list) {
-                               if (test_bit(endp, f->endpoints))
+                       list_for_each_entry(tmp, &cdev->config->functions, 
list) {
+                               if (test_bit(endp, tmp->endpoints)) {
+                                       f = tmp;
                                        break;
+                               }
                        }
-                       if (&f->list == &cdev->config->functions)
-                               f = NULL;
                        break;
                }
 try_fun_setup:
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index b25623e3fe3d..e012a2bdab82 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -150,16 +150,18 @@ smb2_check_message(char *buf, unsigned int len, struct 
TCP_Server_Info *srvr)
                struct smb2_transform_hdr *thdr =
                        (struct smb2_transform_hdr *)buf;
                struct cifs_ses *ses = NULL;
+               struct cifs_ses *tmp;

                /* decrypt frame now that it is completely read in */
                spin_lock(&cifs_tcp_ses_lock);
-               list_for_each_entry(ses, &srvr->smb_ses_list, smb_ses_list) {
-                       if (ses->Suid == le64_to_cpu(thdr->SessionId))
+               list_for_each_entry(tmp, &srvr->smb_ses_list, smb_ses_list) {
+                       if (tmp->Suid == le64_to_cpu(thdr->SessionId)) {
+                               ses = tmp;
                                break;
+                       }
                }
                spin_unlock(&cifs_tcp_ses_lock);
-               if (list_entry_is_head(ses, &srvr->smb_ses_list,
-                                      smb_ses_list)) {
+               if (!ses) {
                        cifs_dbg(VFS, "no decryption - session id not found\n");
                        return 1;
                }
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index 982e694aae77..f1ac6d765367 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -316,6 +316,7 @@ read_kcore(struct file *file, char __user *buffer, size_t 
buflen, loff_t *fpos)
        size_t page_offline_frozen = 1;
        size_t phdrs_len, notes_len;
        struct kcore_list *m;
+       struct kcore_list *tmp;
        size_t tsz;
        int nphdr;
        unsigned long start;
@@ -479,10 +480,13 @@ read_kcore(struct file *file, char __user *buffer, size_t 
buflen, loff_t *fpos)
                 * the previous entry, search for a matching entry.
                 */
                if (!m || start < m->addr || start >= m->addr + m->size) {
-                       list_for_each_entry(m, &kclist_head, list) {
-                               if (start >= m->addr &&
-                                   start < m->addr + m->size)
+                       m = NULL;
+                       list_for_each_entry(tmp, &kclist_head, list) {
+                               if (start >= tmp->addr &&
+                                   start < tmp->addr + tmp->size) {
+                                       m = tmp;
                                        break;
+                               }
                        }
                }

@@ -492,12 +496,11 @@ read_kcore(struct file *file, char __user *buffer, size_t 
buflen, loff_t *fpos)
                        page_offline_freeze();
                }

-               if (&m->list == &kclist_head) {
+               if (!m) {
                        if (clear_user(buffer, tsz)) {
                                ret = -EFAULT;
                                goto out;
                        }
-                       m = NULL;       /* skip the list anchor */
                        goto skip;
                }

diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 0852a537dad4..2d3d6558cef0 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -781,18 +781,21 @@ static int kdb_defcmd(int argc, const char **argv)
 static int kdb_exec_defcmd(int argc, const char **argv)
 {
        int ret;
-       kdbtab_t *kp;
+       kdbtab_t *kp = NULL;
+       kdbtab_t *tmp;
        struct kdb_macro *kmp;
        struct kdb_macro_statement *kms;

        if (argc != 0)
                return KDB_ARGCOUNT;

-       list_for_each_entry(kp, &kdb_cmds_head, list_node) {
-               if (strcmp(kp->name, argv[0]) == 0)
+       list_for_each_entry(tmp, &kdb_cmds_head, list_node) {
+               if (strcmp(tmp->name, argv[0]) == 0) {
+                       kp = tmp;
                        break;
+               }
        }
-       if (list_entry_is_head(kp, &kdb_cmds_head, list_node)) {
+       if (!kp) {
                kdb_printf("kdb_exec_defcmd: could not find commands for %s\n",
                           argv[0]);
                return KDB_NOTIMP;
@@ -919,7 +922,8 @@ int kdb_parse(const char *cmdstr)
        static char cbuf[CMD_BUFLEN+2];
        char *cp;
        char *cpp, quoted;
-       kdbtab_t *tp;
+       kdbtab_t *tp = NULL;
+       kdbtab_t *tmp;
        int escaped, ignore_errors = 0, check_grep = 0;

        /*
@@ -1010,17 +1014,21 @@ int kdb_parse(const char *cmdstr)
                ++argv[0];
        }

-       list_for_each_entry(tp, &kdb_cmds_head, list_node) {
+       list_for_each_entry(tmp, &kdb_cmds_head, list_node) {
                /*
                 * If this command is allowed to be abbreviated,
                 * check to see if this is it.
                 */
-               if (tp->minlen && (strlen(argv[0]) <= tp->minlen) &&
-                   (strncmp(argv[0], tp->name, tp->minlen) == 0))
+               if (tmp->minlen && (strlen(argv[0]) <= tmp->minlen) &&
+                   (strncmp(argv[0], tmp->name, tmp->minlen) == 0)) {
+                       tp = tmp;
                        break;
+               }

-               if (strcmp(argv[0], tp->name) == 0)
+               if (strcmp(argv[0], tmp->name) == 0) {
+                       tp = tmp;
                        break;
+               }
        }

        /*
@@ -1028,14 +1036,16 @@ int kdb_parse(const char *cmdstr)
         * few characters of this match any of the known commands.
         * e.g., md1c20 should match md.
         */
-       if (list_entry_is_head(tp, &kdb_cmds_head, list_node)) {
-               list_for_each_entry(tp, &kdb_cmds_head, list_node) {
-                       if (strncmp(argv[0], tp->name, strlen(tp->name)) == 0)
+       if (!tp) {
+               list_for_each_entry(tmp, &kdb_cmds_head, list_node) {
+                       if (strncmp(argv[0], tmp->name, strlen(tmp->name)) == 
0) {
+                               tp = tmp;
                                break;
+                       }
                }
        }

-       if (!list_entry_is_head(tp, &kdb_cmds_head, list_node)) {
+       if (tp) {
                int result;

                if (!kdb_check_flags(tp->flags, kdb_cmd_enabled, argc <= 1))
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 330d49937692..6ded22451c73 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -625,16 +625,18 @@ static int create_mem_extents(struct list_head *list, 
gfp_t gfp_mask)

        for_each_populated_zone(zone) {
                unsigned long zone_start, zone_end;
-               struct mem_extent *ext, *cur, *aux;
+               struct mem_extent *ext = NULL, *tmp, *cur, *aux;

                zone_start = zone->zone_start_pfn;
                zone_end = zone_end_pfn(zone);

-               list_for_each_entry(ext, list, hook)
-                       if (zone_start <= ext->end)
+               list_for_each_entry(tmp, list, hook)
+                       if (zone_start <= tmp->end) {
+                               ext = tmp;
                                break;
+                       }

-               if (&ext->hook == list || zone_end < ext->start) {
+               if (!ext || zone_end < ext->start) {
                        /* New extent is necessary */
                        struct mem_extent *new_ext;

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index f9feb197b2da..d1cc4dcf1b1e 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4544,7 +4544,8 @@ register_ftrace_function_probe(char *glob, struct 
trace_array *tr,
                               void *data)
 {
        struct ftrace_func_entry *entry;
-       struct ftrace_func_probe *probe;
+       struct ftrace_func_probe *probe = NULL;
+       struct ftrace_func_probe *tmp;
        struct ftrace_hash **orig_hash;
        struct ftrace_hash *old_hash;
        struct ftrace_hash *hash;
@@ -4563,11 +4564,13 @@ register_ftrace_function_probe(char *glob, struct 
trace_array *tr,

        mutex_lock(&ftrace_lock);
        /* Check if the probe_ops is already registered */
-       list_for_each_entry(probe, &tr->func_probes, list) {
-               if (probe->probe_ops == probe_ops)
+       list_for_each_entry(tmp, &tr->func_probes, list) {
+               if (tmp->probe_ops == probe_ops) {
+                       probe = tmp;
                        break;
+               }
        }
-       if (&probe->list == &tr->func_probes) {
+       if (!probe) {
                probe = kzalloc(sizeof(*probe), GFP_KERNEL);
                if (!probe) {
                        mutex_unlock(&ftrace_lock);
@@ -4687,7 +4690,8 @@ unregister_ftrace_function_probe_func(char *glob, struct 
trace_array *tr,
 {
        struct ftrace_ops_hash old_hash_ops;
        struct ftrace_func_entry *entry;
-       struct ftrace_func_probe *probe;
+       struct ftrace_func_probe *probe = NULL;
+       struct ftrace_func_probe *iter;
        struct ftrace_glob func_g;
        struct ftrace_hash **orig_hash;
        struct ftrace_hash *old_hash;
@@ -4715,11 +4719,13 @@ unregister_ftrace_function_probe_func(char *glob, 
struct trace_array *tr,

        mutex_lock(&ftrace_lock);
        /* Check if the probe_ops is already registered */
-       list_for_each_entry(probe, &tr->func_probes, list) {
-               if (probe->probe_ops == probe_ops)
+       list_for_each_entry(iter, &tr->func_probes, list) {
+               if (iter->probe_ops == probe_ops) {
+                       probe = iter;
                        break;
+               }
        }
-       if (&probe->list == &tr->func_probes)
+       if (!probe)
                goto err_unlock_ftrace;

        ret = -EINVAL;
diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c
index 191db32dec46..4d9143bc38c8 100644
--- a/kernel/trace/trace_eprobe.c
+++ b/kernel/trace/trace_eprobe.c
@@ -652,7 +652,8 @@ static struct trace_event_functions eprobe_funcs = {
 static int disable_eprobe(struct trace_eprobe *ep,
                          struct trace_array *tr)
 {
-       struct event_trigger_data *trigger;
+       struct event_trigger_data *trigger = NULL;
+       struct event_trigger_data *tmp;
        struct trace_event_file *file;
        struct eprobe_data *edata;

@@ -660,14 +661,16 @@ static int disable_eprobe(struct trace_eprobe *ep,
        if (!file)
                return -ENOENT;

-       list_for_each_entry(trigger, &file->triggers, list) {
-               if (!(trigger->flags & EVENT_TRIGGER_FL_PROBE))
+       list_for_each_entry(tmp, &file->triggers, list) {
+               if (!(tmp->flags & EVENT_TRIGGER_FL_PROBE))
                        continue;
-               edata = trigger->private_data;
-               if (edata->ep == ep)
+               edata = tmp->private_data;
+               if (edata->ep == ep) {
+                       trigger = tmp;
                        break;
+               }
        }
-       if (list_entry_is_head(trigger, &file->triggers, list))
+       if (!trigger)
                return -ENODEV;

        list_del_rcu(&trigger->list);
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 3147614c1812..6c0642ea42da 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -2264,6 +2264,7 @@ event_subsystem_dir(struct trace_array *tr, const char 
*name,
 {
        struct trace_subsystem_dir *dir;
        struct event_subsystem *system;
+       struct event_subsystem *tmp;
        struct dentry *entry;

        /* First see if we did not already create this dir */
@@ -2277,13 +2278,13 @@ event_subsystem_dir(struct trace_array *tr, const char 
*name,
        }

        /* Now see if the system itself exists. */
-       list_for_each_entry(system, &event_subsystems, list) {
-               if (strcmp(system->name, name) == 0)
+       system = NULL;
+       list_for_each_entry(tmp, &event_subsystems, list) {
+               if (strcmp(tmp->name, name) == 0) {
+                       system = tmp;
                        break;
+               }
        }
-       /* Reset system variable when not found */
-       if (&system->list == &event_subsystems)
-               system = NULL;

        dir = kmalloc(sizeof(*dir), GFP_KERNEL);
        if (!dir)
diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index eb9fb55280ef..a1222f9bdda3 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -115,7 +115,8 @@ static bool p9_xen_write_todo(struct xen_9pfs_dataring 
*ring, RING_IDX size)

 static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
 {
-       struct xen_9pfs_front_priv *priv;
+       struct xen_9pfs_front_priv *priv = NULL;
+       struct xen_9pfs_front_priv *tmp;
        RING_IDX cons, prod, masked_cons, masked_prod;
        unsigned long flags;
        u32 size = p9_req->tc.size;
@@ -123,12 +124,14 @@ static int p9_xen_request(struct p9_client *client, 
struct p9_req_t *p9_req)
        int num;

        read_lock(&xen_9pfs_lock);
-       list_for_each_entry(priv, &xen_9pfs_devs, list) {
-               if (priv->client == client)
+       list_for_each_entry(tmp, &xen_9pfs_devs, list) {
+               if (tmp->client == client) {
+                       priv = tmp;
                        break;
+               }
        }
        read_unlock(&xen_9pfs_lock);
-       if (list_entry_is_head(priv, &xen_9pfs_devs, list))
+       if (!priv)
                return -EINVAL;

        num = p9_req->tc.tag % priv->num_rings;
diff --git a/net/ipv4/udp_tunnel_nic.c b/net/ipv4/udp_tunnel_nic.c
index bc3a043a5d5c..981d1c5970c5 100644
--- a/net/ipv4/udp_tunnel_nic.c
+++ b/net/ipv4/udp_tunnel_nic.c
@@ -841,12 +841,14 @@ udp_tunnel_nic_unregister(struct net_device *dev, struct 
udp_tunnel_nic *utn)
         * and if there are other devices just detach.
         */
        if (info->shared) {
-               struct udp_tunnel_nic_shared_node *node, *first;
+               struct udp_tunnel_nic_shared_node *node = NULL, *first, *tmp;

-               list_for_each_entry(node, &info->shared->devices, list)
-                       if (node->dev == dev)
+               list_for_each_entry(tmp, &info->shared->devices, list)
+                       if (tmp->dev == dev) {
+                               node = tmp;
                                break;
-               if (list_entry_is_head(node, &info->shared->devices, list))
+                       }
+               if (!node)
                        return;

                list_del(&node->list);
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 1d8ba233d047..760a55f572b5 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -958,16 +958,19 @@ static int __tipc_nl_add_nametable_publ(struct 
tipc_nl_msg *msg,
                                        struct service_range *sr,
                                        u32 *last_key)
 {
-       struct publication *p;
+       struct publication *p = NULL;
+       struct publication *tmp;
        struct nlattr *attrs;
        struct nlattr *b;
        void *hdr;

        if (*last_key) {
-               list_for_each_entry(p, &sr->all_publ, all_publ)
-                       if (p->key == *last_key)
+               list_for_each_entry(tmp, &sr->all_publ, all_publ)
+                       if (tmp->key == *last_key) {
+                               p = tmp;
                                break;
-               if (list_entry_is_head(p, &sr->all_publ, all_publ))
+                       }
+               if (!p)
                        return -EPIPE;
        } else {
                p = list_first_entry(&sr->all_publ,
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 7545321c3440..60f12a8ed4d4 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -3742,14 +3742,17 @@ static int __tipc_nl_list_sk_publ(struct sk_buff *skb,
                                  struct tipc_sock *tsk, u32 *last_publ)
 {
        int err;
-       struct publication *p;
+       struct publication *p = NULL;
+       struct publication *tmp;

        if (*last_publ) {
-               list_for_each_entry(p, &tsk->publications, binding_sock) {
-                       if (p->key == *last_publ)
+               list_for_each_entry(tmp, &tsk->publications, binding_sock) {
+                       if (tmp->key == *last_publ) {
+                               p = tmp;
                                break;
+                       }
                }
-               if (list_entry_is_head(p, &tsk->publications, binding_sock)) {
+               if (!p) {
                        /* We never set seq or call nl_dump_check_consistent()
                         * this means that setting prev_seq here will cause the
                         * consistence check to fail in the netlink callback
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index cb40ff0ff28d..03a10bff89c5 100644
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -233,15 +233,18 @@ static void * __percpu *ipcomp_alloc_scratches(void)

 static void ipcomp_free_tfms(struct crypto_comp * __percpu *tfms)
 {
-       struct ipcomp_tfms *pos;
+       struct ipcomp_tfms *pos = NULL;
+       struct ipcomp_tfms *tmp;
        int cpu;

-       list_for_each_entry(pos, &ipcomp_tfms_list, list) {
-               if (pos->tfms == tfms)
+       list_for_each_entry(tmp, &ipcomp_tfms_list, list) {
+               if (tmp->tfms == tfms) {
+                       pos = tmp;
                        break;
+               }
        }

-       WARN_ON(list_entry_is_head(pos, &ipcomp_tfms_list, list));
+       WARN_ON(!pos);

        if (--pos->users)
                return;
diff --git a/sound/soc/intel/catpt/pcm.c b/sound/soc/intel/catpt/pcm.c
index 939a9b801dec..e030c59468bb 100644
--- a/sound/soc/intel/catpt/pcm.c
+++ b/sound/soc/intel/catpt/pcm.c
@@ -330,7 +330,8 @@ static int catpt_dai_apply_usettings(struct snd_soc_dai 
*dai,
                                     struct catpt_stream_runtime *stream)
 {
        struct snd_soc_component *component = dai->component;
-       struct snd_kcontrol *pos;
+       struct snd_kcontrol *pos = NULL;
+       struct snd_kcontrol *tmp;
        struct catpt_dev *cdev = dev_get_drvdata(dai->dev);
        const char *name;
        int ret;
@@ -354,12 +355,14 @@ static int catpt_dai_apply_usettings(struct snd_soc_dai 
*dai,
                return 0;
        }

-       list_for_each_entry(pos, &component->card->snd_card->controls, list) {
-               if (pos->private_data == component &&
-                   !strncmp(name, pos->id.name, sizeof(pos->id.name)))
+       list_for_each_entry(tmp, &component->card->snd_card->controls, list) {
+               if (tmp->private_data == component &&
+                   !strncmp(name, tmp->id.name, sizeof(tmp->id.name))) {
+                       pos = tmp;
                        break;
+               }
        }
-       if (list_entry_is_head(pos, &component->card->snd_card->controls, list))
+       if (!pos)
                return -ENOENT;

        if (stream->template->type != CATPT_STRM_TYPE_LOOPBACK)
diff --git a/sound/soc/sprd/sprd-mcdt.c b/sound/soc/sprd/sprd-mcdt.c
index f6a55fa60c1b..f37d503e4950 100644
--- a/sound/soc/sprd/sprd-mcdt.c
+++ b/sound/soc/sprd/sprd-mcdt.c
@@ -866,20 +866,19 @@ EXPORT_SYMBOL_GPL(sprd_mcdt_chan_dma_disable);
 struct sprd_mcdt_chan *sprd_mcdt_request_chan(u8 channel,
                                              enum sprd_mcdt_channel_type type)
 {
-       struct sprd_mcdt_chan *temp;
+       struct sprd_mcdt_chan *temp = NULL;
+       struct sprd_mcdt_chan *tmp;

        mutex_lock(&sprd_mcdt_list_mutex);

-       list_for_each_entry(temp, &sprd_mcdt_chan_list, list) {
-               if (temp->type == type && temp->id == channel) {
-                       list_del_init(&temp->list);
+       list_for_each_entry(tmp, &sprd_mcdt_chan_list, list) {
+               if (tmp->type == type && tmp->id == channel) {
+                       list_del_init(&tmp->list);
+                       temp = tmp;
                        break;
                }
        }

-       if (list_entry_is_head(temp, &sprd_mcdt_chan_list, list))
-               temp = NULL;
-
        mutex_unlock(&sprd_mcdt_list_mutex);

        return temp;
--
2.25.1

Reply via email to