Merge branch 'stable/for-jens-4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen into for-linus

Pull xen block changes from Konrad:

Two fixes, both of them spotted by Amazon:

 1) Fix in Xen-blkfront caused by the re-write in 4.8 time-frame.
 2) Fix in the xen_biovec_phys_mergeable which allowed guest
    requests when using NVMe - to slurp up more data than allowed
    leading to an XSA (which has been made public today).

2 files changed, 4 insertions, 5 deletions

diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 98e34e4c62b8..2468c28d4771 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2075,9 +2075,9 @@ static int blkfront_resume(struct xenbus_device *dev)
                         /*
                          * Get the bios in the request so we can re-queue them.
                          */
-                        if (req_op(shadow[i].request) == REQ_OP_FLUSH ||
-                            req_op(shadow[i].request) == REQ_OP_DISCARD ||
-                            req_op(shadow[i].request) == REQ_OP_SECURE_ERASE ||
+                        if (req_op(shadow[j].request) == REQ_OP_FLUSH ||
+                            req_op(shadow[j].request) == REQ_OP_DISCARD ||
+                            req_op(shadow[j].request) == REQ_OP_SECURE_ERASE ||
                             shadow[j].request->cmd_flags & REQ_FUA) {
                                 /*
                                  * Flush operations don't contain bios, so
diff --git a/drivers/xen/biomerge.c b/drivers/xen/biomerge.c
index 4da69dbf7dca..1bdd02a6d6ac 100644
--- a/drivers/xen/biomerge.c
+++ b/drivers/xen/biomerge.c
@@ -10,8 +10,7 @@ bool xen_biovec_phys_mergeable(const struct bio_vec *vec1,
         unsigned long bfn1 = pfn_to_bfn(page_to_pfn(vec1->bv_page));
         unsigned long bfn2 = pfn_to_bfn(page_to_pfn(vec2->bv_page));
 
-        return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&
-                ((bfn1 == bfn2) || ((bfn1+1) == bfn2));
+        return bfn1 + PFN_DOWN(vec1->bv_offset + vec1->bv_len) == bfn2;
 #else
         /*
          * XXX: Add support for merging bio_vec when using different page