general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f]
CPU: 1 PID: 9 Comm: kworker/u4:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound async_run_entry_fn
RIP: 0010:dev_get_drvdata include/linux/device.h:685 [inline]
RIP: 0010:rmi_suspend_functions drivers/input/rmi4/rmi_driver.c:277 [inline]
RIP: 0010:rmi_driver_suspend+0x38/0x180 drivers/input/rmi4/rmi_driver.c:949
Code: 83 ec 10 89 75 cc 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 da 64 42 fe 4c 89 75 d0 49 81 c6 98 00 00 00 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 da d9 7c fe 4d 8b 3e 4c 89 f8 48 c1
RSP: 0018:ffffc90000097930 EFLAGS: 00010202
RAX: 0000000000000013 RBX: dffffc0000000000 RCX: ffff888100248000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000097968 R08: ffff888100248000 R09: 0000000000000002
R10: 0000000000000008 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000003 R14: 0000000000000098 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9648fc8700 CR3: 000000000640f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 rmi_suspend+0xa3/0xf0 drivers/hid/hid-rmi.c:449
 hid_suspend+0xe5/0x610 drivers/hid/usbhid/hid-core.c:1618
 usb_suspend_interface drivers/usb/core/driver.c:1312 [inline]
 usb_suspend_both+0x2fc/0x11c0 drivers/usb/core/driver.c:1422
 usb_suspend+0x562/0x6c0 drivers/usb/core/driver.c:1587
 usb_dev_suspend+0x1a/0x20 drivers/usb/core/usb.c:540
 dpm_run_callback+0x70/0x4b0 drivers/base/power/main.c:491
 __device_suspend+0xaa8/0x1240 drivers/base/power/main.c:1716
 async_suspend+0x28/0x1e0 drivers/base/power/main.c:1748
 async_run_entry_fn+0xe7/0x410 kernel/async.c:123
 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
 kthread+0x324/0x3b0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Modules linked in:
---[ end trace 2d9684d073c7a857 ]---
RIP: 0010:dev_get_drvdata include/linux/device.h:685 [inline]
RIP: 0010:rmi_suspend_functions drivers/input/rmi4/rmi_driver.c:277 [inline]
RIP: 0010:rmi_driver_suspend+0x38/0x180 drivers/input/rmi4/rmi_driver.c:949
Code: 83 ec 10 89 75 cc 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 da 64 42 fe 4c 89 75 d0 49 81 c6 98 00 00 00 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 da d9 7c fe 4d 8b 3e 4c 89 f8 48 c1
RSP: 0018:ffffc90000097930 EFLAGS: 00010202
RAX: 0000000000000013 RBX: dffffc0000000000 RCX: ffff888100248000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000097968 R08: ffff888100248000 R09: 0000000000000002
R10: 0000000000000008 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000003 R14: 0000000000000098 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9648fc8700 CR3: 000000000640f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	83 ec 10             	sub    $0x10,%esp
   3:	89 75 cc             	mov    %esi,-0x34(%rbp)
   6:	49 89 fe             	mov    %rdi,%r14
   9:	48 bb 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbx
  10:	fc ff df
  13:	e8 da 64 42 fe       	call   0xfe4264f2
  18:	4c 89 75 d0          	mov    %r14,-0x30(%rbp)
  1c:	49 81 c6 98 00 00 00 	add    $0x98,%r14
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1) <-- trapping instruction
  2e:	74 08                	je     0x38
  30:	4c 89 f7             	mov    %r14,%rdi
  33:	e8 da d9 7c fe       	call   0xfe7cda12
  38:	4d 8b 3e             	mov    (%r14),%r15
  3b:	4c 89 f8             	mov    %r15,%rax
  3e:	48                   	rex.W
  3f:	c1                   	.byte 0xc1