BUG: unable to handle page fault for address: ffffc90000008000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 100000067 
P4D 100000067 
PUD 100154067 
PMD 100155067 
PTE 0

Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 65 Comm: kworker/0:2 Not tainted 6.1.75-syzkaller-00069-gfa87a072a7fc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: mld mld_ifc_work

RIP: 0010:jhash include/linux/jhash.h:80 [inline]
RIP: 0010:hash+0x2a4/0xc20 kernel/bpf/bloom_filter.c:39
Code: 00 00 00 fc ff df 0f b6 04 10 84 c0 0f 85 ff 00 00 00 4a 8d 7c 36 03 48 89 f8 48 c1 e8 03 0f b6 04 10 84 c0 0f 85 17 01 00 00 <46> 03 3c 36 4a 8d 7c 36 04 48 89 f8 48 c1 e8 03 0f b6 04 10 84 c0
RSP: 0018:ffffc90000007208 EFLAGS: 00010286

RAX: 0000000000000000 RBX: 000000004cc253f2 RCX: ffffffff8191d585
RDX: dffffc0000000000 RSI: ffffc900000072c8 RDI: ffffc90000008003
RBP: ffffc90000007248 R08: 00000000fffff2b9 R09: fffffbfff0e9e1ae
R10: 0000000000000000 R11: dffffc0000000001 R12: 000000008364687d
R13: 00000000fffff2b9 R14: 0000000000000d38 R15: 00000000020bab06
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000008000 CR3: 0000000144faf000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 bloom_map_peek_elem+0xac/0x1a0 kernel/bpf/bloom_filter.c:51
 bpf_prog_00798911c748094f+0x3a/0x3e
 bpf_dispatcher_nop_func include/linux/bpf.h:987 [inline]
 __bpf_prog_run include/linux/filter.h:600 [inline]
 bpf_prog_run include/linux/filter.h:607 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2275 [inline]
 bpf_trace_run4+0x18d/0x2f0 kernel/trace/bpf_trace.c:2316
 __bpf_trace_fib6_table_lookup+0x35/0x40 include/trace/events/fib6.h:13
 trace_fib6_table_lookup include/trace/events/fib6.h:13 [inline]
 fib6_table_lookup+0xa1b/0xa80 net/ipv6/route.c:2198
 ip6_pol_route+0x151/0x14a0 net/ipv6/route.c:2221
 ip6_pol_route_input+0x55/0x80 net/ipv6/route.c:2278
 pol_lookup_func include/net/ip6_fib.h:589 [inline]
 fib6_rule_lookup+0x25a/0x620 net/ipv6/fib6_rules.c:116
 ip6_route_input_lookup net/ipv6/route.c:2290 [inline]
 ip6_route_input+0x733/0xc50 net/ipv6/route.c:2586
 ip6_rcv_finish_core net/ipv6/ip6_input.c:66 [inline]
 ip6_rcv_finish+0x150/0x350 net/ipv6/ip6_input.c:77
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ipv6_rcv+0xeb/0x270 net/ipv6/ip6_input.c:310
 __netif_receive_skb_one_core net/core/dev.c:5535 [inline]
 __netif_receive_skb+0x1c6/0x530 net/core/dev.c:5649
 process_backlog+0x32c/0x630 net/core/dev.c:5977
 __napi_poll+0xbe/0x5c0 net/core/dev.c:6544
 napi_poll net/core/dev.c:6611 [inline]
 net_rx_action+0x595/0xdd0 net/core/dev.c:6722
 __do_softirq+0x1d8/0x661 kernel/softirq.c:617
 do_softirq+0xf6/0x150 kernel/softirq.c:499
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x75/0x80 kernel/softirq.c:423
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:838 [inline]
 __dev_queue_xmit+0x1597/0x36e0 net/core/dev.c:4327
 dev_queue_xmit include/linux/netdevice.h:3076 [inline]
 neigh_hh_output include/net/neighbour.h:536 [inline]
 neigh_output include/net/neighbour.h:550 [inline]
 ip6_finish_output2+0x100d/0x1820 net/ipv6/ip6_output.c:134
 __ip6_finish_output net/ipv6/ip6_output.c:201 [inline]
 ip6_finish_output+0x50f/0xa60 net/ipv6/ip6_output.c:212
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0x1f7/0x4d0 net/ipv6/ip6_output.c:233
 dst_output include/net/dst.h:444 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 mld_sendpack+0x803/0xe40 net/ipv6/mcast.c:1820
 mld_send_cr net/ipv6/mcast.c:2121 [inline]
 mld_ifc_work+0x7dc/0xba0 net/ipv6/mcast.c:2653
 process_one_work+0x73d/0xcb0 kernel/workqueue.c:2299
 worker_thread+0xa60/0x1260 kernel/workqueue.c:2446
 kthread+0x26d/0x300 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
Modules linked in:
CR2: ffffc90000008000
---[ end trace 0000000000000000 ]---
RIP: 0010:jhash include/linux/jhash.h:80 [inline]
RIP: 0010:hash+0x2a4/0xc20 kernel/bpf/bloom_filter.c:39
Code: 00 00 00 fc ff df 0f b6 04 10 84 c0 0f 85 ff 00 00 00 4a 8d 7c 36 03 48 89 f8 48 c1 e8 03 0f b6 04 10 84 c0 0f 85 17 01 00 00 <46> 03 3c 36 4a 8d 7c 36 04 48 89 f8 48 c1 e8 03 0f b6 04 10 84 c0
RSP: 0018:ffffc90000007208 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 000000004cc253f2 RCX: ffffffff8191d585
RDX: dffffc0000000000 RSI: ffffc900000072c8 RDI: ffffc90000008003
RBP: ffffc90000007248 R08: 00000000fffff2b9 R09: fffffbfff0e9e1ae
R10: 0000000000000000 R11: dffffc0000000001 R12: 000000008364687d
R13: 00000000fffff2b9 R14: 0000000000000d38 R15: 00000000020bab06
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000008000 CR3: 0000000144faf000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess), 5 bytes skipped:
   0:	df 0f                	fisttps (%rdi)
   2:	b6 04                	mov    $0x4,%dh
   4:	10 84 c0 0f 85 ff 00 	adc    %al,0xff850f(%rax,%rax,8)
   b:	00 00                	add    %al,(%rax)
   d:	4a 8d 7c 36 03       	lea    0x3(%rsi,%r14,1),%rdi
  12:	48 89 f8             	mov    %rdi,%rax
  15:	48 c1 e8 03          	shr    $0x3,%rax
  19:	0f b6 04 10          	movzbl (%rax,%rdx,1),%eax
  1d:	84 c0                	test   %al,%al
  1f:	0f 85 17 01 00 00    	jne    0x13c
* 25:	46 03 3c 36          	add    (%rsi,%r14,1),%r15d <-- trapping instruction
  29:	4a 8d 7c 36 04       	lea    0x4(%rsi,%r14,1),%rdi
  2e:	48 89 f8             	mov    %rdi,%rax
  31:	48 c1 e8 03          	shr    $0x3,%rax
  35:	0f b6 04 10          	movzbl (%rax,%rdx,1),%eax
  39:	84 c0                	test   %al,%al