ceph: fix null pointer dereference in discard_cap_releases()

send_mds_reconnect() may call discard_cap_releases() after all
release messages have been dropped by cleanup_cap_releases()

Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
Reviewed-by: Sage Weil <sage@inktank.com>

1 files changed, 12 insertions, 9 deletions

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index f260bd8d61cd..77640ada487a 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1462,15 +1462,18 @@ static void discard_cap_releases(struct ceph_mds_client *mdsc,
 
         dout("discard_cap_releases mds%d\n", session->s_mds);
 
-        /* zero out the in-progress message */
-        msg = list_first_entry(&session->s_cap_releases,
-                               struct ceph_msg, list_head);
-        head = msg->front.iov_base;
-        num = le32_to_cpu(head->num);
-        dout("discard_cap_releases mds%d %p %u\n", session->s_mds, msg, num);
-        head->num = cpu_to_le32(0);
-        msg->front.iov_len = sizeof(*head);
-        session->s_num_cap_releases += num;
+        if (!list_empty(&session->s_cap_releases)) {
+                /* zero out the in-progress message */
+                msg = list_first_entry(&session->s_cap_releases,
+                                        struct ceph_msg, list_head);
+                head = msg->front.iov_base;
+                num = le32_to_cpu(head->num);
+                dout("discard_cap_releases mds%d %p %u\n",
+                     session->s_mds, msg, num);
+                head->num = cpu_to_le32(0);
+                msg->front.iov_len = sizeof(*head);
+                session->s_num_cap_releases += num;
+        }
 
         /* requeue completed messages */
         while (!list_empty(&session->s_cap_releases_done)) {