update kernel to 5.10.198

hc

2024-01-03 2f7c68cb55ecb7331f2381deb497c27155f32faf

 kernel/drivers/gpu/drm/virtio/virtgpu_ioctl.c
..
..
@@ -279,10 +279,18 @@
279
279
 		drm_gem_object_release(obj);
280
280
 		return ret;
281
281
 	}
282
-	drm_gem_object_put(obj);
283
282
 
284
283
 	rc->res_handle = qobj->hw_res_handle; /* similiar to a VM address */
285
284
 	rc->bo_handle = handle;
285
+
286
+	/*
287
+	 * The handle owns the reference now.  But we must drop our
288
+	 * remaining reference *after* we no longer need to dereference
289
+	 * the obj.  Otherwise userspace could guess the handle and
290
+	 * race closing it from another thread.
291
+	 */
292
+	drm_gem_object_put(obj);
293
+
286
294
 	return 0;
287
295
 }
288
296