ceph: fix null pointer dereference in discard_cap_releases()

commit 00bd8edb upstream.

send_mds_reconnect() may call discard_cap_releases() after all
release messages have been dropped by cleanup_cap_releases()
Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
Reviewed-by: Sage Weil <sage@inktank.com>
Cc: Markus Blank-Burian <burian@muenster.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fs/ceph/mds_client.c

@@ -1461,15 +1461,18 @@ static void discard_cap_releases(struct ceph_mds_client *mdsc,
 
 	dout("discard_cap_releases mds%d\n", session->s_mds);
 
+	if (!list_empty(&session->s_cap_releases)) {
 		/* zero out the in-progress message */
 		msg = list_first_entry(&session->s_cap_releases,
 					struct ceph_msg, list_head);
 		head = msg->front.iov_base;
 		num = le32_to_cpu(head->num);
-	dout("discard_cap_releases mds%d %p %u\n", session->s_mds, msg, num);
+		dout("discard_cap_releases mds%d %p %u\n",
+		     session->s_mds, msg, num);
 		head->num = cpu_to_le32(0);
 		msg->front.iov_len = sizeof(*head);
 		session->s_num_cap_releases += num;
+	}
 
 	/* requeue completed messages */
 	while (!list_empty(&session->s_cap_releases_done)) {