1291 	struct io_kiocb *req, *tmp;  in io_fallback_req_func()  local
1295 	llist_for_each_entry_safe(req, tmp, node, io_task_work.fallback_node)  in io_fallback_req_func()
1545 	struct io_kiocb *req, *tmp;  in io_flush_timeouts()  local
1548 	list_for_each_entry_safe(req, tmp, &ctx->timeout_list, timeout.list) {  in io_flush_timeouts()
2552 	struct io_kiocb *req, *tmp;  in io_do_iopoll()  local
2562 	list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, inflight_entry) {  in io_do_iopoll()
4449 	u64 tmp;  in io_remove_buffers_prep()  local
4455 	tmp = READ_ONCE(sqe->fd);  in io_remove_buffers_prep()
4456 	if (!tmp || tmp > USHRT_MAX)  in io_remove_buffers_prep()
4460 	p->nbufs = tmp;  in io_remove_buffers_prep()
4522 	u64 tmp;  in io_provide_buffers_prep()  local
4527 	tmp = READ_ONCE(sqe->fd);  in io_provide_buffers_prep()
4528 	if (!tmp || tmp > USHRT_MAX)  in io_provide_buffers_prep()
4530 	p->nbufs = tmp;  in io_provide_buffers_prep()
4545 	tmp = READ_ONCE(sqe->off);  in io_provide_buffers_prep()
4546 	if (tmp > USHRT_MAX)  in io_provide_buffers_prep()
4548 	p->bid = tmp;  in io_provide_buffers_prep()
6008 	struct hlist_node *tmp;  in io_poll_remove_all()  local
6018 		hlist_for_each_entry_safe(req, tmp, list, hash_node) {  in io_poll_remove_all()
8507 	struct io_rsrc_put *prsrc, *tmp;  in __io_rsrc_put_work()  local
8509 	list_for_each_entry_safe(prsrc, tmp, &ref_node->rsrc_list, list) {  in __io_rsrc_put_work()
9334 	unsigned long tmp, acct_len = iov->iov_len + (PAGE_SIZE - 1);  in io_buffer_validate()  local
9350 	if (check_add_overflow((unsigned long)iov->iov_base, acct_len, &tmp))  in io_buffer_validate()
9758 	struct io_kiocb *req, *tmp;  in io_kill_timeouts()  local
9763 	list_for_each_entry_safe(req, tmp, &ctx->timeout_list, timeout.list) {  in io_kill_timeouts()
10841 	__u32 tmp;  in __io_register_rsrc_update()  local
10844 	if (check_add_overflow(up->offset, nr_args, &tmp))  in __io_register_rsrc_update()