update kernel to 5.10.198

hc

2024-01-03 2f7c68cb55ecb7331f2381deb497c27155f32faf

 kernel/drivers/char/ipmi/ipmi_msghandler.c
..
..
@@ -1284,6 +1284,7 @@
1284
1284
 	unsigned long    flags;
1285
1285
 	struct cmd_rcvr  *rcvr;
1286
1286
 	struct cmd_rcvr  *rcvrs = NULL;
1287
+	struct module    *owner;
1287
1288
 
1288
1289
 	if (!acquire_ipmi_user(user, &i)) {
1289
1290
 		/*
..
..
@@ -1345,8 +1346,9 @@
1345
1346
 		kfree(rcvr);
1346
1347
 	}
1347
1348
 
1349
+	owner = intf->owner;
1348
1350
 	kref_put(&intf->refcount, intf_free);
1349
-	module_put(intf->owner);
1351
+	module_put(owner);
1350
1352
 }
1351
1353
 
1352
1354
 int ipmi_destroy_user(struct ipmi_user *user)
..
..
@@ -3540,12 +3542,16 @@
3540
3542
 				     struct ipmi_smi_msg *msg,
3541
3543
 				     unsigned char err)
3542
3544
 {
3545
+	int rv;
3543
3546
 	msg->rsp[0] = msg->data[0] | 4;
3544
3547
 	msg->rsp[1] = msg->data[1];
3545
3548
 	msg->rsp[2] = err;
3546
3549
 	msg->rsp_size = 3;
3547
-	/* It's an error, so it will never requeue, no need to check return. */
3548
-	handle_one_recv_msg(intf, msg);
3550
+
3551
+	/* This will never requeue, but it may ask us to free the message. */
3552
+	rv = handle_one_recv_msg(intf, msg);
3553
+	if (rv == 0)
3554
+		ipmi_free_smi_msg(msg);
3549
3555
 }
3550
3556
 
3551
3557
 static void cleanup_smi_msgs(struct ipmi_smi *intf)