general protection fault, probably for non-canonical address 0xdffffc001fffa000: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x00000000fffd0000-0x00000000fffd0007]
CPU: 0 PID: 15866 Comm: kworker/u4:68 Not tainted 6.1.147-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: netns cleanup_net
RIP: 0010:mld_clear_delrec+0x34f/0x5d0 net/ipv6/mcast.c:834
Code: ff ff ff e8 83 d3 2f 01 89 c5 31 ff 89 c6 e8 58 79 9a f8 85 ed 74 45 e8 ef 75 9a f8 eb 05 e8 e8 75 9a f8 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 52 92 ea f8 4d 8b 27 49 83 c7 30
RSP: 0018:ffffc900065d75f0 EFLAGS: 00010206
RAX: 000000001fffa000 RBX: ffff88802477d538 RCX: ffff888027798000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: dffffc0000000000 R09: fffffbfff215ba5a
R10: fffffbfff215ba5a R11: 1ffffffff215ba59 R12: ffff88807cc50428
R13: dffffc0000000000 R14: ffff88807cc50400 R15: 00000000fffd0000
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8c754643c7 CR3: 0000000026ec1000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 ipv6_mc_destroy_dev+0x41/0x590 net/ipv6/mcast.c:2799
 addrconf_ifdown+0x151f/0x1a10 net/ipv6/addrconf.c:3942
 addrconf_notify+0x405/0xf40 net/ipv6/addrconf.c:-1
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:455
 call_netdevice_notifiers_extack net/core/dev.c:2039 [inline]
 call_netdevice_notifiers net/core/dev.c:2053 [inline]
 unregister_netdevice_many+0xfdc/0x1840 net/core/dev.c:10978
 default_device_exit_batch+0x9c3/0xa50 net/core/dev.c:11491
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x77b/0xb80 net/core/net_namespace.c:640
 process_one_work+0x898/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mld_clear_delrec+0x34f/0x5d0 net/ipv6/mcast.c:834
Code: ff ff ff e8 83 d3 2f 01 89 c5 31 ff 89 c6 e8 58 79 9a f8 85 ed 74 45 e8 ef 75 9a f8 eb 05 e8 e8 75 9a f8 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 52 92 ea f8 4d 8b 27 49 83 c7 30
RSP: 0018:ffffc900065d75f0 EFLAGS: 00010206
RAX: 000000001fffa000 RBX: ffff88802477d538 RCX: ffff888027798000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: dffffc0000000000 R09: fffffbfff215ba5a
R10: fffffbfff215ba5a R11: 1ffffffff215ba59 R12: ffff88807cc50428
R13: dffffc0000000000 R14: ffff88807cc50400 R15: 00000000fffd0000
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f35d145fd58 CR3: 0000000031b1f000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 3 bytes skipped:
   0:	e8 83 d3 2f 01       	call   0x12fd388
   5:	89 c5                	mov    %eax,%ebp
   7:	31 ff                	xor    %edi,%edi
   9:	89 c6                	mov    %eax,%esi
   b:	e8 58 79 9a f8       	call   0xf89a7968
  10:	85 ed                	test   %ebp,%ebp
  12:	74 45                	je     0x59
  14:	e8 ef 75 9a f8       	call   0xf89a7608
  19:	eb 05                	jmp    0x20
  1b:	e8 e8 75 9a f8       	call   0xf89a7608
  20:	4c 89 f8             	mov    %r15,%rax
  23:	48 c1 e8 03          	shr    $0x3,%rax
* 27:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2c:	74 08                	je     0x36
  2e:	4c 89 ff             	mov    %r15,%rdi
  31:	e8 52 92 ea f8       	call   0xf8ea9288
  36:	4d 8b 27             	mov    (%r15),%r12
  39:	49 83 c7 30          	add    $0x30,%r15