If the 'tag' passed to scsi_host_find_tag() is valid, I think there
shouldn't have such issue.

If you want to find outstanding IOs, maybe you can try
blk_mq_queue_tag_busy_iter()
or blk_mq_tagset_busy_iter(), because you may not know if the passed

'tag'

to
scsi_host_find_tag() is valid or not.

We tried quick change in mpt3sas driver using blk_mq_tagset_busy_iter and
it returns/callback for valid requests (no stale entries are returned).
Expected.
Above two APIs are only for blk-mq.  What about non-mq case ? Driver
should use scsi_host_find_tag for non-mq and blk_mq_tagset_busy_iter for
blk-mq case ?
I don't see that will be good interface. Also, blk_mq_tagset_busy_iter API
does not provide control if driver wants to quit in-between or do some
retry logic etc.

Why can't we add single API which provides the correct output.

scsi_host_find_tag () API works well in non-mq case because,
blk_queue_end_tag() set bqt->tag_index[tag] = NULL;.
We are missing similar reset upon request completion in blk-mq case. This
patch has similar approach as non-mq and there is no race condition I can
foresee.

BTW - My original patch is half fix. We also need below changes -

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 3f91c6e..d8f53ac 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c

@@ -477,8 +477,10 @@ static void __blk_mq_free_request(struct request *rq)
        const int sched_tag = rq->internal_tag;

        blk_pm_mark_last_busy(rq);
-       if (rq->tag != -1)
+       if (rq->tag != -1) {
+               hctx->tags->rqs[rq->tag] = NULL;
                blk_mq_put_tag(hctx, hctx->tags, ctx, rq->tag);
+       }
        if (sched_tag != -1)
                blk_mq_put_tag(hctx, hctx->sched_tags, ctx, sched_tag);
        blk_mq_sched_restart(hctx);

Thanks,
Ming