Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Tainted: G        W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: mld mld_ifc_work
RIP: 0010:ip6_pol_route+0x3bb/0x11a0
Code: 7b 58 47 fd 48 85 db 0f 84 27 03 00 00 e8 0d 5d 47 fd 48 8d bb 90 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e dc 0c 00 00 44 8b a3 90 00 00
RSP: 0018:ffff88806ce08780 EFLAGS: 00010217
RAX: dffffc0000000000 RBX: 0000000000000006 RCX: ffffffff842c8a65
RDX: 0000000000000012 RSI: ffffffff842c8a73 RDI: 0000000000000096
RBP: ffff88801868c740 R08: 0000000000000001 R09: ffff888013654280
R10: 0000000000000006 R11: 0000000000000001 R12: ffff88806ce08918
R13: 0000000000000080 R14: ffff88806ce08940 R15: ffff88806ce08800
FS:  0000000000000000(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557cb43234c8 CR3: 000000001d987000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 fib6_rule_lookup+0x20d/0x300
 ip6_route_input+0x606/0xb30
 ip6_rcv_finish_core.constprop.0+0x1a4/0x5e0
 ip6_list_rcv_finish.constprop.0+0x15f/0x9a0
 ipv6_list_rcv+0x2c7/0x3f0
 __netif_receive_skb_list_core+0x4c1/0x8d0
 netif_receive_skb_list_internal+0x6c1/0xc90
 netif_receive_skb_list+0x4f/0x410
 ieee80211_rx_napi+0x356/0x3c0
 ieee80211_handle_queued_frames+0xd9/0x130
 tasklet_action_common+0x235/0x3b0
 handle_softirqs+0x1b1/0x770
 do_softirq+0x48/0x80
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xf1/0x110
 __dev_queue_xmit+0xe2e/0x3cc0
 ip6_finish_output2+0xc9f/0x1aa0
 __ip6_finish_output+0x5d5/0xd10
 ip6_output+0x1c2/0x3e0
 mld_sendpack+0x95f/0x11b0
 mld_ifc_work+0x726/0xb60
 process_one_work+0x8e1/0x19c0
 worker_thread+0x67e/0xe90
 kthread+0x3c8/0x740
 ret_from_fork+0x34b/0x430
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ip6_pol_route+0x3bb/0x11a0
Code: 7b 58 47 fd 48 85 db 0f 84 27 03 00 00 e8 0d 5d 47 fd 48 8d bb 90 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e dc 0c 00 00 44 8b a3 90 00 00
RSP: 0018:ffff88806ce08780 EFLAGS: 00010217
RAX: dffffc0000000000 RBX: 0000000000000006 RCX: ffffffff842c8a65
RDX: 0000000000000012 RSI: ffffffff842c8a73 RDI: 0000000000000096
RBP: ffff88801868c740 R08: 0000000000000001 R09: ffff888013654280
R10: 0000000000000006 R11: 0000000000000001 R12: ffff88806ce08918
R13: 0000000000000080 R14: ffff88806ce08940 R15: ffff88806ce08800
FS:  0000000000000000(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557cb43234c8 CR3: 000000001d987000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	7b 58                	jnp    0x5a
   2:	47 fd                	rex.RXB std
   4:	48 85 db             	test   %rbx,%rbx
   7:	0f 84 27 03 00 00    	je     0x334
   d:	e8 0d 5d 47 fd       	callq  0xfd475d1f
  12:	48 8d bb 90 00 00 00 	lea    0x90(%rbx),%rdi
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	74 08                	je     0x3a
  32:	3c 03                	cmp    $0x3,%al
  34:	0f 8e dc 0c 00 00    	jle    0xd16
  3a:	44                   	rex.R
  3b:	8b                   	.byte 0x8b
  3c:	a3                   	.byte 0xa3
  3d:	90                   	nop