diff --git a/Makefile.rhelver b/Makefile.rhelver
index 7d5509eb36..d3799df3dd 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 10
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 553.83.1
+RHEL_RELEASE = 553.84.1
 
 #
 # ZSTREAM
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 75d8811b25..e52fb60be9 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -977,6 +977,11 @@ void nfs_delegation_mark_returned(struct inode *inode,
 	}
 
 	nfs_mark_delegation_revoked(delegation);
+	clear_bit(NFS_DELEGATION_RETURNING, &delegation->flags);
+	spin_unlock(&delegation->lock);
+	if (nfs_detach_delegation(NFS_I(inode), delegation, NFS_SERVER(inode)))
+		nfs_put_delegation(delegation);
+	goto out_rcu_unlock;
 
 out_clear_returning:
 	clear_bit(NFS_DELEGATION_RETURNING, &delegation->flags);
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 3e249a2763..47c66a30c6 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2133,11 +2133,12 @@ int cgroup_do_get_tree(struct fs_context *fc)
 
 		nsdentry = kernfs_node_dentry(cgrp->kn, sb);
 		dput(fc->root);
-		fc->root = nsdentry;
 		if (IS_ERR(nsdentry)) {
-			ret = PTR_ERR(nsdentry);
 			deactivate_locked_super(sb);
+			ret = PTR_ERR(nsdentry);
+			nsdentry = NULL;
 		}
+		fc->root = nsdentry;
 	}
 
 	if (!ctx->kfc.new_sb_created)
diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index 5541194b9d..30ab47c9e6 100644
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -506,8 +506,8 @@ static void virtio_transport_rx_work(struct work_struct *work)
 	do {
 		virtqueue_disable_cb(vq);
 		for (;;) {
+			unsigned int len, payload_len;
 			struct virtio_vsock_pkt *pkt;
-			unsigned int len;
 
 			if (!virtio_transport_more_replies(vsock)) {
 				/* Stop rx until the device processes already
@@ -531,6 +531,12 @@ static void virtio_transport_rx_work(struct work_struct *work)
 				continue;
 			}
 
+			payload_len = le32_to_cpu(pkt->hdr.len);
+			if (unlikely(payload_len > len - sizeof(pkt->hdr))) {
+				virtio_transport_free_pkt(pkt);
+				continue;
+			}
+
 			pkt->len = len - sizeof(pkt->hdr);
 			virtio_transport_deliver_tap_pkt(pkt);
 			virtio_transport_recv_pkt(&virtio_transport, pkt);