Hello Guys, fnic uses the following way to walk scsi commands in failure handling, which is obvious wrong, because caller of scsi_host_find_tag has to guarantee that the tag is active. for (tag = 0; tag < fnic->fnic_max_tag_id; tag++) { ... sc = scsi_host_find_tag(fnic->lport->host, tag); ... } Fix the issue by using blk_mq_tagset_busy_iter() to walk request/scsi_command. thanks, Ming Ming Lei (5): scsi: fnic: use blk_mq_tagset_busy_iter() to walk scsi commands in fnic_terminate_rport_io scsi: fnic: use blk_mq_tagset_busy_iter() to walk scsi commands in fnic_clean_pending_aborts scsi: fnic: use blk_mq_tagset_busy_iter() to walk scsi commands in fnic_cleanup_io scsi: fnic: use blk_mq_tagset_busy_iter() to walk scsi commands in fnic_rport_exch_reset scsi: fnic: use blk_mq_tagset_busy_iter() to walk scsi commands in fnic_is_abts_pending drivers/scsi/fnic/fnic_scsi.c | 933 ++++++++++++++++++---------------- 1 file changed, 493 insertions(+), 440 deletions(-) Cc: Satish Kharat <satishkh@xxxxxxxxx> Cc: Karan Tilak Kumar <kartilak@xxxxxxxxx> Cc: David Jeffery <djeffery@xxxxxxxxxx> -- 2.29.2