BUG: unable to handle page fault for address: ffff8880d4670000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1d12f067 P4D 1d12f067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 5886 Comm: kworker/2:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: mld mld_ifc_work
RIP: 0010:percpu_counter_add_batch+0x4b/0x230 lib/percpu_counter.c:98
Code: 8d 45 58 48 89 c2 48 89 44 24 08 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9f 01 00 00 4d 8b 65 58 4c 89 ff <65> 49 63 2c 24 4a 8d 54 35 00 48 89 6c 24 10 48 89 eb 48 89 d0 48
RSP: 0018:ffffc90000658d88 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8880387ed2c0 RCX: 0000000000000101
RDX: 1ffff11005a321bb RSI: ffffffff856fa340 RDI: 0000000000000020
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000001 R12: 0000000000000000
R13: ffff88802d190d80 R14: ffffffffffffffff R15: 0000000000000020
FS:  0000000000000000(0000) GS:ffff8880d4670000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8880d4670000 CR3: 0000000037b23000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 dst_entries_add include/net/dst_ops.h:59 [inline]
 dst_count_dec net/core/dst.c:163 [inline]
 dst_count_dec net/core/dst.c:160 [inline]
 dst_release net/core/dst.c:177 [inline]
 dst_release+0x2aa/0x330 net/core/dst.c:166
 ip_vs_dest_dst_rcu_free+0x32/0x50 net/netfilter/ipvs/ip_vs_ctl.c:1081
 rcu_do_batch kernel/rcu/tree.c:2650 [inline]
 rcu_core+0x5f0/0x1220 kernel/rcu/tree.c:2919
 handle_softirqs+0x216/0xa20 kernel/softirq.c:669
 do_softirq kernel/softirq.c:569 [inline]
 do_softirq+0xaf/0xf0 kernel/softirq.c:556
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 __alloc_skb+0x5db/0x710 net/core/skbuff.c:700
 alloc_skb include/linux/skbuff.h:1390 [inline]
 mld_newpack.isra.0+0x18e/0xa30 net/ipv6/mcast.c:1810
 add_grhead+0x299/0x340 net/ipv6/mcast.c:1921
 add_grec+0x13a3/0x1940 net/ipv6/mcast.c:2060
 mld_send_cr net/ipv6/mcast.c:2185 [inline]
 mld_ifc_work+0x3c5/0xc10 net/ipv6/mcast.c:2739
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
CR2: ffff8880d4670000
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_counter_add_batch+0x4b/0x230 lib/percpu_counter.c:98
Code: 8d 45 58 48 89 c2 48 89 44 24 08 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9f 01 00 00 4d 8b 65 58 4c 89 ff <65> 49 63 2c 24 4a 8d 54 35 00 48 89 6c 24 10 48 89 eb 48 89 d0 48
RSP: 0018:ffffc90000658d88 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8880387ed2c0 RCX: 0000000000000101
RDX: 1ffff11005a321bb RSI: ffffffff856fa340 RDI: 0000000000000020
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000001 R12: 0000000000000000
R13: ffff88802d190d80 R14: ffffffffffffffff R15: 0000000000000020
FS:  0000000000000000(0000) GS:ffff8880d4670000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8880d4670000 CR3: 0000000037b23000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	8d 45 58             	lea    0x58(%rbp),%eax
   3:	48 89 c2             	mov    %rax,%rdx
   6:	48 89 44 24 08       	mov    %rax,0x8(%rsp)
   b:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  12:	fc ff df
  15:	48 c1 ea 03          	shr    $0x3,%rdx
  19:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
  1d:	0f 85 9f 01 00 00    	jne    0x1c2
  23:	4d 8b 65 58          	mov    0x58(%r13),%r12
  27:	4c 89 ff             	mov    %r15,%rdi
* 2a:	65 49 63 2c 24       	movslq %gs:(%r12),%rbp <-- trapping instruction
  2f:	4a 8d 54 35 00       	lea    0x0(%rbp,%r14,1),%rdx
  34:	48 89 6c 24 10       	mov    %rbp,0x10(%rsp)
  39:	48 89 eb             	mov    %rbp,%rbx
  3c:	48 89 d0             	mov    %rdx,%rax
  3f:	48                   	rex.W