Hi,

I'm attaching a test kernel module that reproduces this crash I'm seeing:

BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
[ 9120.221368] Call Trace: 
                                                      [ 9120.221530]  <TASK>
[ 9120.221675]  nf_ct_delete.part.0+0xa9/0x220 [nf_conntrack]
[ 9120.222022]  nf_ct_delete+0x21/0x30 [nf_conntrack]
[ 9120.222334]  my_hook.cold+0x6b/0xbd [netfilter_postrouting]
[ 9120.222685]  nf_hook_slow+0x45/0xf0
[ 9120.222920]  ip_output+0x121/0x1b0
[ 9120.223145]  ? path_openat+0x534/0x10a0
[ 9120.223394]  ? ip_finish_output2+0x590/0x590
[ 9120.223668]  __ip_queue_xmit+0x557/0x5b0
[ 9120.223921]  ip_queue_xmit+0x15/0x20
[ 9120.224153]  __tcp_transmit_skb+0xae1/0xcb0
[ 9120.224444]  ? srso_alias_return_thunk+0x5/0x7f

Steps to reproduce:

1. Build the kernel module.
2. insmod it.
3. iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
4. Send a lot of data (I just use iperf -c <IP> -t 300).

It should crash immediately.

Maybe this is what you're trying to fix in "[PATCH nf 0/4] netfilter: 
conntrack: fix obscure confirmed race"?

Thanks,
Razvan