Hello Guys, fnic uses the following way to walk scsi commands in failure handling, which is obvious wrong, because caller of scsi_host_find_tag has to guarantee that the tag is active. for (tag = 0; tag < fnic->fnic_max_tag_id; tag++) { ... sc = scsi_host_find_tag(fnic->lport->host, tag); ... } Fix the issue by using scsi_host_busy_iter() to walk request/scsi_command. Hannes has posted similar patch[1] before, however which depends on the scsi reserved command patchset, so post them out in one standalone patchset, another difference is that this one is splited to 5 single patches for easy review. [1] https://marc.info/?l=linux-scsi&m=161400059528859&w=2 V2: - use scsi_host_busy_iter Ming Lei (5): scsi: fnic: use scsi_host_busy_iter in fnic_terminate_rport_io scsi: fnic: use scsi_host_busy_iter in fnic_clean_pending_aborts scsi: fnic: use scsi_host_busy_iter in fnic_cleanup_io scsi: fnic: use scsi_host_busy_iter in fnic_rport_exch_reset scsi: fnic: use scsi_host_busy_iter in fnic_is_abts_pending drivers/scsi/fnic/fnic_scsi.c | 924 ++++++++++++++++++---------------- 1 file changed, 484 insertions(+), 440 deletions(-) -- 2.29.2