diff --git a/net/rds/send.c b/net/rds/send.c
index 79d158b3def0fa16ef3d9048884b152a45c87fff..acad04243b41dfab790e0418a0e635bec840cbea 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -941,7 +941,8 @@ static int rds_cmsg_zcopy(struct rds_sock *rs, struct rds_message *rm,
 {
 	u32 *cookie;
 
-	if (cmsg->cmsg_len < CMSG_LEN(sizeof(*cookie)))
+	if (cmsg->cmsg_len < CMSG_LEN(sizeof(*cookie)) ||
+	    !rm->data.op_mmp_znotifier)
 		return -EINVAL;
 	cookie = CMSG_DATA(cmsg);
 	rm->data.op_mmp_znotifier->z_cookie = *cookie;