Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
CPU: 0 UID: 0 PID: 13 Comm: kworker/u32:1 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:__fib6_drop_pcpu_from.part.0+0x173/0x480 net/ipv6/ip6_fib.c:1004
Code: 85 d7 02 00 00 4d 8b 3f 4d 85 ff 74 37 e8 45 db cb f7 49 8d bf 90 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 96 02 00 00 49 8b 87 90 00 00 00 4c 39 e8 0f 84
RSP: 0018:ffffc90000107038 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 1ffffffff1c38d25
RDX: 0000000000000012 RSI: ffffffff8a3da33b RDI: 0000000000000091
RBP: fffffbfff1c38e16 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000001 R11: 000000000000755b R12: ffff8880436ca0c8
R13: ffff8880436ca000 R14: ffffffffffffffff R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880d637d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cc7dea5660 CR3: 000000002d27f000 CR4: 0000000000352ef0
DR0: 0000000000000101 DR1: 0000000000000007 DR2: 000000000000000f
DR3: 0000000000000006 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1037 [inline]
 fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1038 [inline]
 fib6_purge_rt+0x84d/0xb60 net/ipv6/ip6_fib.c:1049
 fib6_del_route net/ipv6/ip6_fib.c:2050 [inline]
 fib6_del+0xa64/0x1790 net/ipv6/ip6_fib.c:2095
 fib6_clean_node+0x424/0x5d0 net/ipv6/ip6_fib.c:2257
 fib6_walk_continue+0x451/0x8d0 net/ipv6/ip6_fib.c:2179
 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2227
 fib6_clean_tree+0xdc/0x120 net/ipv6/ip6_fib.c:2307
 __fib6_clean_all+0x107/0x2d0 net/ipv6/ip6_fib.c:2323
 rt6_sync_down_dev net/ipv6/route.c:5026 [inline]
 rt6_disable_ip+0x2a6/0x980 net/ipv6/route.c:5031
 addrconf_ifdown.isra.0+0x11d/0x1b70 net/ipv6/addrconf.c:3867
 addrconf_notify+0x4a3/0x1ba0 net/ipv6/addrconf.c:3790
 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85
 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2249
 call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
 call_netdevice_notifiers net/core/dev.c:2301 [inline]
 netif_close_many+0x319/0x630 net/core/dev.c:1805
 unregister_netdevice_many_notify+0x840/0x24f0 net/core/dev.c:12391
 ops_exit_rtnl_list net/core/net_namespace.c:187 [inline]
 ops_undo_list+0x8ff/0xab0 net/core/net_namespace.c:248
 cleanup_net+0x499/0x920 net/core/net_namespace.c:702
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3314
 process_scheduled_works kernel/workqueue.c:3397 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fib6_drop_pcpu_from.part.0+0x173/0x480 net/ipv6/ip6_fib.c:1004
Code: 85 d7 02 00 00 4d 8b 3f 4d 85 ff 74 37 e8 45 db cb f7 49 8d bf 90 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 96 02 00 00 49 8b 87 90 00 00 00 4c 39 e8 0f 84
RSP: 0018:ffffc90000107038 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 1ffffffff1c38d25
RDX: 0000000000000012 RSI: ffffffff8a3da33b RDI: 0000000000000091
RBP: fffffbfff1c38e16 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000001 R11: 000000000000755b R12: ffff8880436ca0c8
R13: ffff8880436ca000 R14: ffffffffffffffff R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880d637d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cc7dea5660 CR3: 000000002d27f000 CR4: 0000000000352ef0
DR0: 0000000000000101 DR1: 0000000000000007 DR2: 000000000000000f
DR3: 0000000000000006 DR6: 00000000ffff0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 3 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	4d 8b 3f             	mov    (%r15),%r15
   5:	4d 85 ff             	test   %r15,%r15
   8:	74 37                	je     0x41
   a:	e8 45 db cb f7       	call   0xf7cbdb54
   f:	49 8d bf 90 00 00 00 	lea    0x90(%r15),%rdi
  16:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1d:	fc ff df
  20:	48 89 fa             	mov    %rdi,%rdx
  23:	48 c1 ea 03          	shr    $0x3,%rdx
* 27:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2b:	0f 85 96 02 00 00    	jne    0x2c7
  31:	49 8b 87 90 00 00 00 	mov    0x90(%r15),%rax
  38:	4c 39 e8             	cmp    %r13,%rax
  3b:	0f                   	.byte 0xf
  3c:	84                   	.byte 0x84