ipv6: oops in datagram.c line 260

Hi all,

We running a Dell server which crash frequently with (dell crash video 
snapshot) vanilla 3.14.25

Capture viewed here: http://www.gtsys.com.hk/~chris/datagram_c_line260.png

The capture don't sadly don't show the full trace, so we lack on 
information.
1st line I can see in the crash video from the idrac : 
tcp_transmit_skb+0x461

RIP [<ffffffff815da587>] ipv6_local_error+0x17/0x140

The null pointer happen:
  Type "apropos word" to search for commands related to "word"...
Reading symbols from net/ipv6/datagram.o...done.
(gdb) list *(ipv6_local_error+0x17)
0xae7 is in ipv6_local_error (net/ipv6/datagram.c:260).
255        struct ipv6_pinfo *np = inet6_sk(sk);
256        struct sock_exterr_skb *serr;
257        struct ipv6hdr *iph;
258        struct sk_buff *skb;
259
260        if (!np->recverr)
261            return;
262
263        skb = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC);
264        if (!skb)
(gdb) quit


We running a 6in4 with ipsec tunnel on the 6. I found a pull request from
Steffen Klassert
here:
     http://article.gmane.org/gmane.linux.network/281469

Which might be relevant to this problem.

For time being I add a

         if (np == NULL){
                 LIMIT_NETDEBUG(KERN_DEBUG "ipv6_pinfo is NULL\n");
                 return;
         }

as work around to stop the server crashing


With kind regards
Chris