diff --git a/mysql-test/r/partition.result b/mysql-test/r/partition.result
index adb055dd5e5..93684ba05e5 100644
--- a/mysql-test/r/partition.result
+++ b/mysql-test/r/partition.result
@@ -1,4 +1,16 @@
 drop table if exists t1, t2;
+CREATE TABLE t1 (
+pk INT NOT NULL AUTO_INCREMENT,
+PRIMARY KEY (pk)
+)
+/*!50100 PARTITION BY HASH (pk)
+PARTITIONS 2 */;
+INSERT INTO t1 VALUES (NULL);
+INSERT INTO t1 VALUES (NULL);
+INSERT INTO t1 VALUES (NULL);
+SELECT * FROM t1 WHERE pk < 0 ORDER BY pk;
+pk
+DROP TABLE t1;
 CREATE TABLE t1 (a INT NOT NULL, KEY(a))
 PARTITION BY RANGE(a)
 (PARTITION p1 VALUES LESS THAN (200), PARTITION pmax VALUES LESS THAN MAXVALUE);
diff --git a/mysql-test/t/partition.test b/mysql-test/t/partition.test
index e8df2b01a94..6a12e4a4d12 100644
--- a/mysql-test/t/partition.test
+++ b/mysql-test/t/partition.test
@@ -14,6 +14,21 @@
 drop table if exists t1, t2;
 --enable_warnings
 
+#
+# Bug#40954: Crash if range search and order by.
+#
+CREATE TABLE t1 (
+  pk INT NOT NULL AUTO_INCREMENT,
+  PRIMARY KEY (pk)
+)
+/*!50100 PARTITION BY HASH (pk)
+PARTITIONS 2 */;
+INSERT INTO t1 VALUES (NULL);
+INSERT INTO t1 VALUES (NULL);
+INSERT INTO t1 VALUES (NULL);
+SELECT * FROM t1 WHERE pk < 0 ORDER BY pk;
+DROP TABLE t1;
+
 #
 # Bug#40494: Crash MYSQL server crashes on range access with partitioning
 #            and order by
diff --git a/sql/ha_partition.cc b/sql/ha_partition.cc
index a1131a99fa4..0c96b06381c 100644
--- a/sql/ha_partition.cc
+++ b/sql/ha_partition.cc
@@ -4490,7 +4490,8 @@ int ha_partition::handle_ordered_index_scan(uchar *buf, bool reverse_order)
         This can only read record to table->record[0], as it was set when
         the table was being opened. We have to memcpy data ourselves.
       */
-      error= file->read_range_first(&m_start_key, end_range, eq_range, TRUE);
+      error= file->read_range_first(m_start_key.key? &m_start_key: NULL,
+                                    end_range, eq_range, TRUE);
       memcpy(rec_buf_ptr, table->record[0], m_rec_length);
       reverse_order= FALSE;
       break;