3 files changed, 13 insertions, 6 deletions

diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 64c60edcdfbc..63fc7f06a014 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -763,6 +763,7 @@ again:
                         BUG_ON(new_map_idx >= segs_to_map);
                         if (unlikely(map[new_map_idx].status != 0)) {
                                 pr_debug(DRV_PFX "invalid buffer -- could not remap it\n");
+                                put_free_pages(blkif, &pages[seg_idx]->page, 1);
                                 pages[seg_idx]->handle = BLKBACK_INVALID_HANDLE;
                                 ret |= 1;
                                 goto next;
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 3a8b810b4980..54f408963201 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -270,6 +270,9 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
                 blkif->blk_rings.common.sring = NULL;
         }
 
+        /* Remove all persistent grants and the cache of ballooned pages. */
+        xen_blkbk_free_caches(blkif);
+
         return 0;
 }
 
@@ -281,9 +284,6 @@ static void xen_blkif_free(struct xen_blkif *blkif)
         xen_blkif_disconnect(blkif);
         xen_vbd_free(&blkif->vbd);
 
-        /* Remove all persistent grants and the cache of ballooned pages. */
-        xen_blkbk_free_caches(blkif);
-
         /* Make sure everything is drained before shutting down */
         BUG_ON(blkif->persistent_gnt_c != 0);
         BUG_ON(atomic_read(&blkif->persistent_gnt_in_use) != 0);
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 5deb235bd18f..6fc056ed1efd 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -582,6 +582,14 @@ static inline void flush_requests(struct blkfront_info *info)
                 notify_remote_via_irq(info->irq);
 }
 
+static inline bool blkif_request_flush_valid(struct request *req,
+                                             struct blkfront_info *info)
+{
+        return ((req->cmd_type != REQ_TYPE_FS) ||
+                ((req->cmd_flags & (REQ_FLUSH | REQ_FUA)) &&
+                !info->flush_op));
+}
+
 /*
  * do_blkif_request
  *  read a block; request is in a request queue
@@ -604,9 +612,7 @@ static void do_blkif_request(struct request_queue *rq)
 
                 blk_start_request(req);
 
-                if ((req->cmd_type != REQ_TYPE_FS) ||
-                    ((req->cmd_flags & (REQ_FLUSH | REQ_FUA)) &&
-                    !info->flush_op)) {
+                if (blkif_request_flush_valid(req, info)) {
                         __blk_end_request_all(req, -EIO);
                         continue;
                 }