diff --git a/[refs] b/[refs]
index 6f538a4fd427..d931ed46d89f 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8475f688d796b875bf98ed161acd53d00a1483ff
+refs/heads/master: 77c9cfc51b0d732b2524799810fb30018074fd60
diff --git a/trunk/drivers/scsi/constants.c b/trunk/drivers/scsi/constants.c
index 7092ff67ecd3..cd05e049d5f6 100644
--- a/trunk/drivers/scsi/constants.c
+++ b/trunk/drivers/scsi/constants.c
@@ -346,6 +346,9 @@ void scsi_print_command(struct scsi_cmnd *cmd)
 {
 	int k;
 
+	if (cmd->cmnd == NULL)
+		return;
+
 	scmd_printk(KERN_INFO, cmd, "CDB: ");
 	print_opcode_name(cmd->cmnd, cmd->cmd_len);
 
diff --git a/trunk/drivers/scsi/sd.c b/trunk/drivers/scsi/sd.c
index 908d400b601a..1dd4d8407694 100644
--- a/trunk/drivers/scsi/sd.c
+++ b/trunk/drivers/scsi/sd.c
@@ -1209,8 +1209,19 @@ static int sd_done(struct scsi_cmnd *SCpnt)
 		sd_dif_complete(SCpnt, good_bytes);
 
 	if (scsi_host_dif_capable(sdkp->device->host, sdkp->protection_type)
-	    == SD_DIF_TYPE2_PROTECTION && SCpnt->cmnd != SCpnt->request->cmd)
+	    == SD_DIF_TYPE2_PROTECTION && SCpnt->cmnd != SCpnt->request->cmd) {
+
+		/* We have to print a failed command here as the
+		 * extended CDB gets freed before scsi_io_completion()
+		 * is called.
+		 */
+		if (result)
+			scsi_print_command(SCpnt);
+
 		mempool_free(SCpnt->cmnd, sd_cdb_pool);
+		SCpnt->cmnd = NULL;
+		SCpnt->cmd_len = 0;
+	}
 
 	return good_bytes;
 }