diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index 0555f553824de50d5305af2477f2aea41b0d37b4..0506d76ea81cca80f7e25155061a7fbfe46595a4 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -376,7 +376,8 @@ static int __smcr_tx_rdma_writes_rwwi(struct smc_connection *conn, int dst_off,
 	u8 saved_credits = 0;
 	bool cr_flag = false;
 	u8 conn_state_flags;
-	int diff_cons, rc;
+	int diff_cons = 0;
+	int rc;
 
 	BUILD_BUG_ON_MSG(sizeof(union smc_wr_imm_msg) > sizeof(__be32),
 			 "sizeof(union smc_wr_imm_msg) can not exceed the size of imm_data(__be32)");
@@ -409,10 +410,11 @@ static int __smcr_tx_rdma_writes_rwwi(struct smc_connection *conn, int dst_off,
 	if (conn_state_flags || prod_flags != urg_flags)
 		imm_msg.hdr.opcode = SMC_WR_OP_CTRL;
 
-	smc_curs_copy(&cfed, &conn->local_tx_ctrl.cons, conn);
-	smc_curs_copy(&cons_old, &conn->rx_curs_confirmed, conn);
-	diff_cons = smc_curs_diff(conn->rmb_desc->len, &cons_old,
-				  &conn->local_tx_ctrl.cons);
+	if (conn->rmb_desc) {
+		smc_curs_copy(&cfed, &conn->local_tx_ctrl.cons, conn);
+		smc_curs_copy(&cons_old, &conn->rx_curs_confirmed, conn);
+		diff_cons = smc_curs_diff(conn->rmb_desc->len, &cons_old, &cfed);
+	}
 	switch (imm_msg.hdr.opcode) {
 	case SMC_WR_OP_DATA:
 		if (diff_cons > SMC_DATA_MAX_DIFF_CONS)
@@ -462,7 +464,7 @@ static int __smcr_tx_rdma_writes_rwwi(struct smc_connection *conn, int dst_off,
 		/* do not update rx_curs_confirmed if all flags equal to 0,
 		 * since diff_cons will not be carried by imm_data in this case.
 		 */
-		if (update_rx_curs_confirmed)
+		if (update_rx_curs_confirmed && conn->rmb_desc)
 			smc_curs_add(conn->rmb_desc->len, &conn->rx_curs_confirmed, diff_cons);
 	} else {
 		smc_wr_rx_put_credits(link, saved_credits);