scsi: core: Only return started requests from scsi_host_find_tag()

scsi_host_find_tag() is used by the drivers to return a scsi command based
on the command tag. Typically it's used from the interrupt handler to fetch
the command associated with a value returned from hardware. Some drivers
like fnic or qla4xxx, however, also use it also to traverse outstanding
commands.  With the current implementation scsi_host_find_tag() will return
commands even if they are not started (i.e. passed to the driver).  This
will result in random errors with those drivers.  With this patch
scsi_host_find_tag() will only return 'started' commands (i.e. commands
which have been passed to the drivers) thus avoiding the above issue.  The
other use cases will be unaffected as the interrupt handler naturally will
only ever return 'started' requests.

Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Hannes Reinecke <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>

Author: hreinecke

include/scsi/scsi_tcq.h

@@ -34,7 +34,7 @@ static inline struct scsi_cmnd *scsi_host_find_tag(struct Scsi_Host *shost,
 					blk_mq_unique_tag_to_tag(tag));
 	}
 
-	if (!req)
+	if (!req || !blk_mq_request_started(req))
 		return NULL;
 	return blk_mq_rq_to_pdu(req);
 }