--- /dev/null
+From a80bdd980bd58027933f24d689c886b0df90145c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 17:24:25 -0400
+Subject: ceph: use ceph_evict_inode to cleanup inode's resource
+
+From: Yan, Zheng <zyan@redhat.com>
+
+[ Upstream commit 87bc5b895d94a0f40fe170d4cf5771c8e8f85d15 ]
+
+remove_session_caps() relies on __wait_on_freeing_inode(), to wait for
+freeing inode to remove its caps. But VFS wakes freeing inode waiters
+before calling destroy_inode().
+
+[ jlayton: mainline moved to ->free_inode before the original patch was
+ merged. This backport reinstates ceph_destroy_inode and just
+ has it do the call_rcu call. ]
+
+Cc: stable@vger.kernel.org
+Link: https://tracker.ceph.com/issues/40102
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/inode.c | 10 ++++++++--
+ fs/ceph/super.c | 1 +
+ fs/ceph/super.h | 1 +
+ 3 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 11f19432a74c4..c06845237cbaa 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -528,13 +528,16 @@ static void ceph_i_callback(struct rcu_head *head)
+ kmem_cache_free(ceph_inode_cachep, ci);
+ }
+
+-void ceph_destroy_inode(struct inode *inode)
++void ceph_evict_inode(struct inode *inode)
+ {
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ struct ceph_inode_frag *frag;
+ struct rb_node *n;
+
+- dout("destroy_inode %p ino %llx.%llx\n", inode, ceph_vinop(inode));
++ dout("evict_inode %p ino %llx.%llx\n", inode, ceph_vinop(inode));
++
++ truncate_inode_pages_final(&inode->i_data);
++ clear_inode(inode);
+
+ ceph_fscache_unregister_inode_cookie(ci);
+
+@@ -576,7 +579,10 @@ void ceph_destroy_inode(struct inode *inode)
+ ceph_buffer_put(ci->i_xattrs.prealloc_blob);
+
+ ceph_put_string(rcu_dereference_raw(ci->i_layout.pool_ns));
++}
+
++void ceph_destroy_inode(struct inode *inode)
++{
+ call_rcu(&inode->i_rcu, ceph_i_callback);
+ }
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index c5cf46e43f2e7..ccab249a37f6a 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -830,6 +830,7 @@ static const struct super_operations ceph_super_ops = {
+ .destroy_inode = ceph_destroy_inode,
+ .write_inode = ceph_write_inode,
+ .drop_inode = ceph_drop_inode,
++ .evict_inode = ceph_evict_inode,
+ .sync_fs = ceph_sync_fs,
+ .put_super = ceph_put_super,
+ .remount_fs = ceph_remount,
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index 0180193097905..8d3eabf06d66a 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -854,6 +854,7 @@ static inline bool __ceph_have_pending_cap_snap(struct ceph_inode_info *ci)
+ extern const struct inode_operations ceph_file_iops;
+
+ extern struct inode *ceph_alloc_inode(struct super_block *sb);
++extern void ceph_evict_inode(struct inode *inode);
+ extern void ceph_destroy_inode(struct inode *inode);
+ extern int ceph_drop_inode(struct inode *inode);
+
+--
+2.20.1
+
--- /dev/null
+From 4afdee019ab4c6b3d3283db45db144158c48479f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 18:01:07 -0400
+Subject: Revert "ceph: use ceph_evict_inode to cleanup inode's resource"
+
+This reverts commit 812810399999a673d30f9d04d38659030a28051a.
+
+The backport was incorrect and was causing kernel panics. Revert and
+re-apply a correct backport from Jeff Layton.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/inode.c | 7 ++-----
+ fs/ceph/super.c | 2 +-
+ fs/ceph/super.h | 2 +-
+ 3 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 665a86f83f4b0..11f19432a74c4 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -528,16 +528,13 @@ static void ceph_i_callback(struct rcu_head *head)
+ kmem_cache_free(ceph_inode_cachep, ci);
+ }
+
+-void ceph_evict_inode(struct inode *inode)
++void ceph_destroy_inode(struct inode *inode)
+ {
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ struct ceph_inode_frag *frag;
+ struct rb_node *n;
+
+- dout("evict_inode %p ino %llx.%llx\n", inode, ceph_vinop(inode));
+-
+- truncate_inode_pages_final(&inode->i_data);
+- clear_inode(inode);
++ dout("destroy_inode %p ino %llx.%llx\n", inode, ceph_vinop(inode));
+
+ ceph_fscache_unregister_inode_cookie(ci);
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index 02528e11bf331..c5cf46e43f2e7 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -827,9 +827,9 @@ static int ceph_remount(struct super_block *sb, int *flags, char *data)
+
+ static const struct super_operations ceph_super_ops = {
+ .alloc_inode = ceph_alloc_inode,
++ .destroy_inode = ceph_destroy_inode,
+ .write_inode = ceph_write_inode,
+ .drop_inode = ceph_drop_inode,
+- .evict_inode = ceph_evict_inode,
+ .sync_fs = ceph_sync_fs,
+ .put_super = ceph_put_super,
+ .remount_fs = ceph_remount,
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index 6e968e48e5e4b..0180193097905 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -854,7 +854,7 @@ static inline bool __ceph_have_pending_cap_snap(struct ceph_inode_info *ci)
+ extern const struct inode_operations ceph_file_iops;
+
+ extern struct inode *ceph_alloc_inode(struct super_block *sb);
+-extern void ceph_evict_inode(struct inode *inode);
++extern void ceph_destroy_inode(struct inode *inode);
+ extern int ceph_drop_inode(struct inode *inode);
+
+ extern struct inode *ceph_get_inode(struct super_block *sb,
+--
+2.20.1
+