diff --git a/net/rds/loop.c b/net/rds/loop.c
index ac9295a766b1..e6b0750bbeda 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -89,7 +89,11 @@ static int rds_loop_xmit(struct rds_connection *conn, struct rds_message *rm,
 
 	BUG_ON(hdr_off || sg || off);
 
-	rds_inc_init(&rm->m_inc, conn, &conn->c_laddr);
+	/* rds_send_queue_rm() stored the connection path in this embedded
+	 * inc; use the path init so the re-initialization keeps the field
+	 * valid instead of discarding it.
+	 */
+	rds_inc_path_init(&rm->m_inc, &conn->c_path[0], &conn->c_laddr);
 	/* For the embedded inc. Matching put is in loop_inc_free() */
 	rds_message_addref(rm);
 
diff --git a/net/rds/recv.c b/net/rds/recv.c
index cf3884d87931..f1513dfb2716 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -47,6 +47,7 @@ void rds_inc_init(struct rds_incoming *inc, struct rds_connection *conn,
 	refcount_set(&inc->i_refcount, 1);
 	INIT_LIST_HEAD(&inc->i_item);
 	inc->i_conn = conn;
+	inc->i_conn_path = NULL;
 	inc->i_saddr = *saddr;
 	inc->i_usercopy.rdma_cookie = 0;
 	inc->i_usercopy.rx_tstamp = ktime_set(0, 0);
diff --git a/net/rds/send.c b/net/rds/send.c
index 309021e0cc9b..15a1b97f13e7 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -200,6 +200,14 @@ int rds_send_xmit(struct rds_conn_path *cp)
 restart:
 	batch_count = 0;
 
+	/* The drop processing after over_batch relies on
+	 * rds_send_remove_from_sock() emptying to_be_dropped entry by
+	 * entry; warn if that post-condition ever stops holding, and
+	 * re-initialize the list head.
+	 */
+	WARN_ON_ONCE(!list_empty(&to_be_dropped));
+	INIT_LIST_HEAD(&to_be_dropped);
+
 	/*
 	 * sendmsg calls here after having queued its message on the send
 	 * queue.  We only have one task feeding the connection at a time.  If