static inline void tcmu_free_cmd(struct tcmu_cmd *tcmu_cmd)
 {
+       if (tcmu_cmd->se_cmd)
+               tcmu_cmd->se_cmd->priv = NULL;
        kfree(tcmu_cmd->dbi);
        kmem_cache_free(tcmu_cmd_cache, tcmu_cmd);
 }
                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
 
        mutex_lock(&udev->cmdr_lock);
+       se_cmd->priv = tcmu_cmd;
        ret = queue_cmd_ring(tcmu_cmd, &scsi_ret);
-       mutex_unlock(&udev->cmdr_lock);
        if (ret < 0)
                tcmu_free_cmd(tcmu_cmd);
+       mutex_unlock(&udev->cmdr_lock);
        return scsi_ret;
 }
 
                target_complete_cmd(cmd->se_cmd, entry->rsp.scsi_status);
 
 out:
-       cmd->se_cmd = NULL;
        tcmu_cmd_free_data(cmd, cmd->dbi_cnt);
        tcmu_free_cmd(cmd);
 }
        set_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags);
        list_del_init(&cmd->queue_entry);
        se_cmd = cmd->se_cmd;
+       se_cmd->priv = NULL;
        cmd->se_cmd = NULL;
 
        pr_debug("Timing out inflight cmd %u on dev %s.\n",