2 files changed, 15 insertions, 1 deletions

diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
index 7092ff67ecd..cd05e049d5f 100644
--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -346,6 +346,9 @@ void scsi_print_command(struct scsi_cmnd *cmd)
 {
         int k;
 
+        if (cmd->cmnd == NULL)
+                return;
+
         scmd_printk(KERN_INFO, cmd, "CDB: ");
         print_opcode_name(cmd->cmnd, cmd->cmd_len);
 
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 908d400b601..1dd4d840769 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1209,8 +1209,19 @@ static int sd_done(struct scsi_cmnd *SCpnt)
                 sd_dif_complete(SCpnt, good_bytes);
 
         if (scsi_host_dif_capable(sdkp->device->host, sdkp->protection_type)
-            == SD_DIF_TYPE2_PROTECTION && SCpnt->cmnd != SCpnt->request->cmd)
+            == SD_DIF_TYPE2_PROTECTION && SCpnt->cmnd != SCpnt->request->cmd) {
+
+                /* We have to print a failed command here as the
+                 * extended CDB gets freed before scsi_io_completion()
+                 * is called.
+                 */
+                if (result)
+                        scsi_print_command(SCpnt);
+
                 mempool_free(SCpnt->cmnd, sd_cdb_pool);
+                SCpnt->cmnd = NULL;
+                SCpnt->cmd_len = 0;
+        }
 
         return good_bytes;
 }