RHEL6: panics in __nf_conntrack_confirm()

Issue

• A customer faced multiple panics in __nf_conntrack_confirm() while doing connect().

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffffa029b7ca>] __nf_conntrack_confirm+0x10a/0x3b0 [nf_conntrack]
PGD 42a9e5067 PUD 42a9e6067 PMD 0 
Oops: 0002 [#1] SMP 
last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/scaling_setspeed
CPU 9 
Modules linked in: des_generic ecb md4 nls_utf8 cifs mptctl mptbase pcc_cpufreq bonding 8021q garp stp llc ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack iptable_filter ip_tables uinput hpilo hpwdt sg power_meter bnx2x(U) libcrc32c mdio be2net(U) microcode serio_raw iTCO_wdt iTCO_vendor_support ioatdma dca shpchp ext3 jbd mbcache sd_mod crc_t10dif hpsa(U) video output dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]

Pid: 20296, comm: nginx Not tainted 2.6.32-279.22.1.el6.x86_64 #1 HP ProLiant BL460c Gen8
RIP: 0010:[<ffffffffa029b7ca>]  [<ffffffffa029b7ca>] __nf_conntrack_confirm+0x10a/0x3b0 [nf_conntrack]
RSP: 0018:ffff8804338eba08  EFLAGS: 00010246
RAX: ffff88046e9e1b58 RBX: ffff8804a53393f8 RCX: 000000000006feb3
RDX: 0000000000000000 RSI: 0000000000063e95 RDI: ffffffffa02a6520
RBP: ffff8804338eba38 R08: 000000001d728d5b R09: 0000000018dee6e1
R10: 0000000057e30938 R11: ffff8804a5339460 R12: ffffffff8200bec0
R13: 00000000000031b8 R14: 0000000000000637 R15: 000000000001b0b0
FS:  00007f67daf94700(0000) GS:ffff88044e420000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000426e6f000 CR4: 00000000000406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process nginx (pid: 20296, threadinfo ffff8804338ea000, task ffff880429689540)
Stack:
 0000000000000000 ffff8804667b5be8 0000000080000000 ffff8804a53393f8
<d> 0000000000000002 0000000000000004 ffff8804338ebaa8 ffffffffa02c657d
<d> 0000000000000000 ffff880432c5e020 0faa1aac00023e95 0000000000000000
Call Trace:
 [<ffffffffa02c657d>] ipv4_confirm+0xad/0x1d0 [nf_conntrack_ipv4]
 [<ffffffff814549d9>] nf_iterate+0x69/0xb0
 [<ffffffff81465230>] ? ip_finish_output+0x0/0x310
 [<ffffffff81454b94>] nf_hook_slow+0x74/0x110
 [<ffffffff81465230>] ? ip_finish_output+0x0/0x310
 [<ffffffff81462230>] ? dst_output+0x0/0x20
 [<ffffffff814655e4>] ip_output+0xa4/0xc0
 [<ffffffff814648bf>] ? __ip_local_out+0x9f/0xb0
 [<ffffffff814648f5>] ip_local_out+0x25/0x30
 [<ffffffff81464dd0>] ip_queue_xmit+0x190/0x420
 [<ffffffff81468b6b>] ? __inet_check_established+0x25b/0x320
 [<ffffffff81479a5e>] tcp_transmit_skb+0x3fe/0x7b0
 [<ffffffff8115d109>] ? ksize+0x19/0x80
 [<ffffffff8147b849>] tcp_connect+0x369/0x4a0
 [<ffffffff81480b5e>] tcp_v4_connect+0x46e/0x570
 [<ffffffff81490b92>] inet_stream_connect+0x272/0x2c0
 [<ffffffff811b9748>] ? ep_call_nested.clone.0+0xc8/0x100
 [<ffffffff81417947>] sys_connect+0xd7/0xf0
 [<ffffffff810d3f47>] ? audit_syscall_entry+0x1d7/0x200
 [<ffffffff810d3c95>] ? __audit_syscall_exit+0x265/0x290
 [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b
Code: 4e 8d 2c f5 00 00 00 00 a8 01 75 15 8b 53 50 66 90 39 50 10 0f 84 d7 01 00 00 48 8b 00 a8 01 74 f0 48 8b 43 08 48 8b 53 10 a8 01 <48> 89 02 75 04 48 89 50 08 48 bf 00 02 20 00 00 00 ad de 48 89 
RIP  [<ffffffffa029b7ca>] __nf_conntrack_confirm+0x10a/0x3b0 [nf_conntrack]
 RSP <ffff8804338eba08>
CR2: 0000000000000000