From: Hannes Reinecke <hare@suse.de>
Date: Mon, 22 Jun 2020 08:30:22 +0200
Subject: scsi: core: Only return started requests from scsi_host_find_tag()
Patch-mainline: v5.9-rc1
Git-commit: e73a5e8e8003978e65d368f5475e36e1e2a0613b
References: 1179851

scsi_host_find_tag() is used by the drivers to return a scsi command based
on the command tag. Typically it's used from the interrupt handler to fetch
the command associated with a value returned from hardware. Some drivers
like fnic or qla4xxx, however, also use it also to traverse outstanding
commands.  With the current implementation scsi_host_find_tag() will return
commands even if they are not started (i.e. passed to the driver).  This
will result in random errors with those drivers.  With this patch
scsi_host_find_tag() will only return 'started' commands (i.e. commands
which have been passed to the drivers) thus avoiding the above issue.  The
other use cases will be unaffected as the interrupt handler naturally will
only ever return 'started' requests.

Link: https://lore.kernel.org/r/20200622063022.67891-1-hare@suse.de
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
---
 include/scsi/scsi_tcq.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/scsi/scsi_tcq.h b/include/scsi/scsi_tcq.h
index 6053d46e794e..ea7848e74d25 100644
--- a/include/scsi/scsi_tcq.h
+++ b/include/scsi/scsi_tcq.h
@@ -34,7 +34,7 @@ static inline struct scsi_cmnd *scsi_host_find_tag(struct Scsi_Host *shost,
 					blk_mq_unique_tag_to_tag(tag));
 	}
 
-	if (!req)
+	if (!req || !blk_mq_request_started(req))
 		return NULL;
 	return blk_mq_rq_to_pdu(req);
 }
-- 
2.31.1