diff --git a/[refs] b/[refs]
index 588b49bd1338..17f881e01f55 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 6c2af71f7f6ac10ab45e9461e1dd7aa09079643a
+refs/heads/master: ca23509fbaac0ea662ab0e287bebb72f743f9e1f
diff --git a/trunk/drivers/block/elevator.c b/trunk/drivers/block/elevator.c
index 36f1057084b0..d4a49a3df829 100644
--- a/trunk/drivers/block/elevator.c
+++ b/trunk/drivers/block/elevator.c
@@ -369,9 +369,14 @@ void __elv_add_request(request_queue_t *q, struct request *rq, int where,
 	case ELEVATOR_INSERT_SORT:
 		BUG_ON(!blk_fs_request(rq));
 		rq->flags |= REQ_SORTED;
-		q->elevator->ops->elevator_add_req_fn(q, rq);
 		if (q->last_merge == NULL && rq_mergeable(rq))
 			q->last_merge = rq;
+		/*
+		 * Some ioscheds (cfq) run q->request_fn directly, so
+		 * rq cannot be accessed after calling
+		 * elevator_add_req_fn.
+		 */
+		q->elevator->ops->elevator_add_req_fn(q, rq);
 		break;
 
 	default: