diff --git a/[refs] b/[refs]
index 5257df26f157..1f215ca7207c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 5f233706592fcce7df57e12674461c349b8f591d
+refs/heads/master: 111c7d82436db4c7673922b6ba021cebb7d26dd8
diff --git a/trunk/mm/slub.c b/trunk/mm/slub.c
index 7d6c8b1ccf63..d2a54fe71ea2 100644
--- a/trunk/mm/slub.c
+++ b/trunk/mm/slub.c
@@ -2153,7 +2153,7 @@ static int init_kmem_cache_nodes(struct kmem_cache *s, gfp_t gfpflags)
 	int local_node;
 
 	if (slab_state >= UP && (s < kmalloc_caches ||
-			s > kmalloc_caches + KMALLOC_CACHES))
+			s >= kmalloc_caches + KMALLOC_CACHES))
 		local_node = page_to_nid(virt_to_page(s));
 	else
 		local_node = 0;
diff --git a/trunk/security/keys/keyring.c b/trunk/security/keys/keyring.c
index 1e4b0037935c..dd7cd0f8e13c 100644
--- a/trunk/security/keys/keyring.c
+++ b/trunk/security/keys/keyring.c
@@ -20,11 +20,6 @@
 #include <asm/uaccess.h>
 #include "internal.h"
 
-#define rcu_dereference_locked_keyring(keyring)				\
-	(rcu_dereference_protected(					\
-		(keyring)->payload.subscriptions,			\
-		rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem)))
-
 /*
  * when plumbing the depths of the key tree, this sets a hard limit set on how
  * deep we're willing to go
@@ -206,7 +201,8 @@ static long keyring_read(const struct key *keyring,
 	int loop, ret;
 
 	ret = 0;
-	klist = rcu_dereference_locked_keyring(keyring);
+	klist = keyring->payload.subscriptions;
+
 	if (klist) {
 		/* calculate how much data we could return */
 		qty = klist->nkeys * sizeof(key_serial_t);
@@ -530,8 +526,9 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
 	struct key *keyring;
 	int bucket;
 
+	keyring = ERR_PTR(-EINVAL);
 	if (!name)
-		return ERR_PTR(-EINVAL);
+		goto error;
 
 	bucket = keyring_hash(name);
 
@@ -558,18 +555,17 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
 					   KEY_SEARCH) < 0)
 				continue;
 
-			/* we've got a match but we might end up racing with
-			 * key_cleanup() if the keyring is currently 'dead'
-			 * (ie. it has a zero usage count) */
-			if (!atomic_inc_not_zero(&keyring->usage))
-				continue;
-			goto out;
+			/* we've got a match */
+			atomic_inc(&keyring->usage);
+			read_unlock(&keyring_name_lock);
+			goto error;
 		}
 	}
 
-	keyring = ERR_PTR(-ENOKEY);
-out:
 	read_unlock(&keyring_name_lock);
+	keyring = ERR_PTR(-ENOKEY);
+
+ error:
 	return keyring;
 
 } /* end find_keyring_by_name() */
@@ -724,7 +720,8 @@ int __key_link(struct key *keyring, struct key *key)
 	}
 
 	/* see if there's a matching key we can displace */
-	klist = rcu_dereference_locked_keyring(keyring);
+	klist = keyring->payload.subscriptions;
+
 	if (klist && klist->nkeys > 0) {
 		struct key_type *type = key->type;
 
@@ -768,6 +765,8 @@ int __key_link(struct key *keyring, struct key *key)
 	if (ret < 0)
 		goto error2;
 
+	klist = keyring->payload.subscriptions;
+
 	if (klist && klist->nkeys < klist->maxkeys) {
 		/* there's sufficient slack space to add directly */
 		atomic_inc(&key->usage);
@@ -869,7 +868,7 @@ int key_unlink(struct key *keyring, struct key *key)
 
 	down_write(&keyring->sem);
 
-	klist = rcu_dereference_locked_keyring(keyring);
+	klist = keyring->payload.subscriptions;
 	if (klist) {
 		/* search the keyring for the key */
 		for (loop = 0; loop < klist->nkeys; loop++)
@@ -960,7 +959,7 @@ int keyring_clear(struct key *keyring)
 		/* detach the pointer block with the locks held */
 		down_write(&keyring->sem);
 
-		klist = rcu_dereference_locked_keyring(keyring);
+		klist = keyring->payload.subscriptions;
 		if (klist) {
 			/* adjust the quota */
 			key_payload_reserve(keyring,
@@ -992,9 +991,7 @@ EXPORT_SYMBOL(keyring_clear);
  */
 static void keyring_revoke(struct key *keyring)
 {
-	struct keyring_list *klist;
-
-	klist = rcu_dereference_locked_keyring(keyring);
+	struct keyring_list *klist = keyring->payload.subscriptions;
 
 	/* adjust the quota */
 	key_payload_reserve(keyring, 0);
@@ -1028,7 +1025,7 @@ void keyring_gc(struct key *keyring, time_t limit)
 
 	down_write(&keyring->sem);
 
-	klist = rcu_dereference_locked_keyring(keyring);
+	klist = keyring->payload.subscriptions;
 	if (!klist)
 		goto no_klist;
 
diff --git a/trunk/security/keys/request_key.c b/trunk/security/keys/request_key.c
index d8c1a6a0fb08..d737cea5347c 100644
--- a/trunk/security/keys/request_key.c
+++ b/trunk/security/keys/request_key.c
@@ -94,7 +94,7 @@ static int call_sbin_request_key(struct key_construction *cons,
 	}
 
 	/* attach the auth key to the session keyring */
-	ret = key_link(keyring, authkey);
+	ret = __key_link(keyring, authkey);
 	if (ret < 0)
 		goto error_link;