==================================================================
BUG: KASAN: null-ptr-deref in mcp2221_raw_event+0xc1f/0x1030 drivers/hid/hid-mcp2221.c:910
Write of size 242 at addr 0000000000000000 by task modprobe/493

CPU: 0 UID: 0 PID: 493 Comm: modprobe Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
 __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106
 mcp2221_raw_event+0xc1f/0x1030 drivers/hid/hid-mcp2221.c:910
 __hid_input_report.constprop.0+0x314/0x450 drivers/hid/hid-core.c:2130
 hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
 __usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
 dummy_timer+0x1814/0x3a30 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
 handle_softirqs+0x208/0x8d0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:debug_smp_processor_id+0x0/0x20 lib/smp_processor_id.c:57
Code: e8 c5 24 1f fa e8 40 7c f4 ff 90 65 ff 0d f8 aa 54 05 e9 40 ff ff ff 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 c7 c6 60 63 89 87 48 c7 c7 a0 63 89 87 e9 f9 fe ff
RSP: 0000:ffffc90005f7fa70 EFLAGS: 00000283
RAX: 0000000000000000 RBX: ffffffff892c7360 RCX: ffffffff81b42e53
RDX: ffff888124cfd700 RSI: ffffffff81b42c78 RDI: ffffffff892c7360
RBP: ffffea00045789b4 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff81b42c78
R13: 000000000000001c R14: dffffc0000000000 R15: 1ffff92000beff89
 rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
 rcu_is_watching+0x12/0xc0 kernel/rcu/tree.c:751
 trace_lock_release include/trace/events/lock.h:69 [inline]
 lock_release+0x201/0x2f0 kernel/locking/lockdep.c:5879
 rcu_lock_release include/linux/rcupdate.h:341 [inline]
 rcu_read_unlock include/linux/rcupdate.h:871 [inline]
 page_ref_add_unless.constprop.0+0x11d/0x390 include/linux/page_ref.h:239
 folio_ref_add_unless include/linux/page_ref.h:248 [inline]
 folio_try_get include/linux/page_ref.h:264 [inline]
 next_uptodate_folio+0xac/0x4a0 mm/filemap.c:3605
 filemap_map_pages+0x5d7/0x13c0 mm/filemap.c:3789
 do_fault_around mm/memory.c:5531 [inline]
 do_read_fault mm/memory.c:5564 [inline]
 do_fault mm/memory.c:5707 [inline]
 do_pte_missing mm/memory.c:4234 [inline]
 handle_pte_fault mm/memory.c:6052 [inline]
 __handle_mm_fault+0x1fa5/0x3210 mm/memory.c:6195
 handle_mm_fault+0x589/0xd10 mm/memory.c:6364
 do_user_addr_fault+0x613/0x1240 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x5c/0xb0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f81a5a66850
Code: Unable to access opcode bytes at 0x7f81a5a66826.
RSP: 002b:00007ffec542ac28 EFLAGS: 00010246
RAX: 0000000000000004 RBX: 00007ffec542ace0 RCX: 00007ffec542ac30
RDX: 00007ffec542ac80 RSI: 00007ffec542b5a8 RDI: 0000000000000004
RBP: 00007ffec542b240 R08: 0000000000000000 R09: 0000000000000001
R10: 000000000000006c R11: 00007ffec542addc R12: 0000000000000000
R13: 00007f81a5c28c3f R14: 00007ffec542b250 R15: 0000000000000000
 </TASK>
==================================================================
----------------
Code disassembly (best guess):
   0:	e8 c5 24 1f fa       	call   0xfa1f24ca
   5:	e8 40 7c f4 ff       	call   0xfff47c4a
   a:	90                   	nop
   b:	65 ff 0d f8 aa 54 05 	decl   %gs:0x554aaf8(%rip)        # 0x554ab0a
  12:	e9 40 ff ff ff       	jmp    0xffffff57
  17:	0f 1f 00             	nopl   (%rax)
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	90                   	nop
  24:	90                   	nop
  25:	90                   	nop
  26:	90                   	nop
  27:	90                   	nop
  28:	90                   	nop
  29:	90                   	nop
* 2a:	f3 0f 1e fa          	endbr64 <-- trapping instruction
  2e:	48 c7 c6 60 63 89 87 	mov    $0xffffffff87896360,%rsi
  35:	48 c7 c7 a0 63 89 87 	mov    $0xffffffff878963a0,%rdi
  3c:	e9                   	.byte 0xe9
  3d:	f9                   	stc
  3e:	fe                   	(bad)
  3f:	ff                   	.byte 0xff