BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page PGD 10c9c5067 P4D 10c9c5067 PUD 120843067 PMD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 0 PID: 426 Comm: kworker/0:4 Not tainted 5.10.109-syzkaller-00693-g414e6c8e941c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:0x0 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. RSP: 0018:ffffc90000007ab8 EFLAGS: 00010246 RAX: 1ffff11020000005 RBX: ffff888100000028 RCX: ffff88810b81e2c0 RDX: 0000000080000101 RSI: 0000000000000000 RDI: ffff88810e922640 RBP: ffffc90000007bb0 R08: ffffffff8433ff05 R09: ffff88810e922640 R10: ffffc90000007500 R11: 1ffff92000000ece R12: 1ffff92000000f5c R13: dffffc0000000000 R14: 1ffff11021d244d3 R15: ffff88810e922698 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 000000012084b000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: dst_input include/net/dst.h:449 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:304 [inline] ipv6_rcv+0x297/0x550 net/ipv6/ip6_input.c:297 __netif_receive_skb_one_core net/core/dev.c:5361 [inline] __netif_receive_skb+0x1c5/0x500 net/core/dev.c:5475 process_backlog+0x352/0x690 net/core/dev.c:6381 napi_poll+0x1a3/0x650 net/core/dev.c:6832 net_rx_action+0x387/0x970 net/core/dev.c:6902 __do_softirq+0x27e/0x596 kernel/softirq.c:305 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77 do_softirq+0xca/0x110 kernel/softirq.c:355 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:190 local_bh_enable+0x1f/0x30 include/linux/bottom_half.h:32 rcu_read_unlock_bh include/linux/rcupdate.h:740 [inline] ip6_finish_output2+0x1094/0x1950 net/ipv6/ip6_output.c:146 __ip6_finish_output+0x653/0x810 net/ipv6/ip6_output.c:210 ip6_finish_output+0x1c9/0x1e0 net/ipv6/ip6_output.c:220 NF_HOOK_COND include/linux/netfilter.h:293 [inline] ip6_output+0x211/0x4c0 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:443 [inline] NF_HOOK include/linux/netfilter.h:304 [inline] ndisc_send_skb+0x6fe/0xc10 net/ipv6/ndisc.c:508 ndisc_send_ns+0x629/0x810 net/ipv6/ndisc.c:650 addrconf_dad_work+0xba6/0x15d0 net/ipv6/addrconf.c:4165 process_one_work+0x726/0xc10 kernel/workqueue.c:2296 worker_thread+0xb27/0x1550 kernel/workqueue.c:2442 kthread+0x349/0x3d0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 Modules linked in: CR2: 0000000000000000 ---[ end trace 34857169a7571141 ]--- RIP: 0010:0x0 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. RSP: 0018:ffffc90000007ab8 EFLAGS: 00010246 RAX: 1ffff11020000005 RBX: ffff888100000028 RCX: ffff88810b81e2c0 RDX: 0000000080000101 RSI: 0000000000000000 RDI: ffff88810e922640 RBP: ffffc90000007bb0 R08: ffffffff8433ff05 R09: ffff88810e922640 R10: ffffc90000007500 R11: 1ffff92000000ece R12: 1ffff92000000f5c R13: dffffc0000000000 R14: 1ffff11021d244d3 R15: ffff88810e922698 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 000000012084b000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400