==================================================================
BUG: KASAN: null-ptr-deref in mcp2221_raw_event+0xc1f/0x1030 drivers/hid/hid-mcp2221.c:818
Write of size 117 at addr 0000000000000000 by task dhcpcd-run-hook/5895
CPU: 1 UID: 0 PID: 5895 Comm: dhcpcd-run-hook Not tainted 6.15.0-rc1-syzkaller-00097-g3baea29dc0a7 #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
kasan_report+0xe0/0x110 mm/kasan/report.c:634
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
__asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106
mcp2221_raw_event+0xc1f/0x1030 drivers/hid/hid-mcp2221.c:818
__hid_input_report.constprop.0+0x311/0x450 drivers/hid/hid-core.c:2117
hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x38a/0x6e0 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1734
dummy_timer+0x180e/0x3a20 drivers/usb/gadget/udc/dummy_hcd.c:1994
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
handle_softirqs+0x205/0x8d0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:finish_task_switch.isra.0+0x1e9/0x9e0 kernel/sched/core.c:5250
Code: 0f 85 5f 07 00 00 8b 0d 89 a2 2a 09 85 c9 0f 85 b9 02 00 00 48 89 df e8 85 25 d8 05 e8 40 0e 36 00 fb 65 48 8b 1d 2f 7d 17 0b <48> 8d bb 50 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffffc9001365f678 EFLAGS: 00000206
RAX: 00000000000003c3 RBX: ffff88811bf71d40 RCX: 0000000000000007
RDX: 0000000000000000 RSI: ffffffff88ad7e80 RDI: ffffffff876851a0
RBP: ffffc9001365f6b8 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8a78a997 R11: 0000000000000000 R12: ffff888119551d40
R13: 0000000000000000 R14: ffff8881f5938418 R15: ffff8881f5938f18
context_switch kernel/sched/core.c:5385 [inline]
__schedule+0x1332/0x3b00 kernel/sched/core.c:6767
preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6947
__cond_resched+0x22/0x30 kernel/sched/core.c:7292
_cond_resched include/linux/sched.h:2099 [inline]
zap_pte_range mm/memory.c:1773 [inline]
zap_pmd_range mm/memory.c:1823 [inline]
zap_pud_range mm/memory.c:1852 [inline]
zap_p4d_range mm/memory.c:1873 [inline]
unmap_page_range+0xbcb/0x3570 mm/memory.c:1894
unmap_single_vma+0x194/0x2a0 mm/memory.c:1940
unmap_vmas+0x22c/0x490 mm/memory.c:1984
exit_mmap+0x1b9/0xb90 mm/mmap.c:1284
__mmput kernel/fork.c:1379 [inline]
mmput+0xdb/0x430 kernel/fork.c:1401
exit_mm kernel/exit.c:589 [inline]
do_exit+0x9d1/0x2c30 kernel/exit.c:940
do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
__do_sys_exit_group kernel/exit.c:1113 [inline]
__se_sys_exit_group kernel/exit.c:1111 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1111
x64_sys_call+0x1530/0x1730 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd9e2da8a90
Code: Unable to access opcode bytes at 0x7fd9e2da8a66.
RSP: 002b:00007ffe874e7e48 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000562976b62804 RCX: 00007fd9e2da8a90
RDX: 00000000000000e7 RSI: 000000000000003c RDI: 0000000000000000
RBP: 0000000000000003 R08: 00007ffe874e7f40 R09: 0000000000000002
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe874e8168
R13: 00007ffe874e8180 R14: 0000562943ba6169 R15: 00007fd9e2fa7a80
==================================================================
----------------
Code disassembly (best guess):
0: 0f 85 5f 07 00 00 jne 0x765
6: 8b 0d 89 a2 2a 09 mov 0x92aa289(%rip),%ecx # 0x92aa295
c: 85 c9 test %ecx,%ecx
e: 0f 85 b9 02 00 00 jne 0x2cd
14: 48 89 df mov %rbx,%rdi
17: e8 85 25 d8 05 call 0x5d825a1
1c: e8 40 0e 36 00 call 0x360e61
21: fb sti
22: 65 48 8b 1d 2f 7d 17 mov %gs:0xb177d2f(%rip),%rbx # 0xb177d59
29: 0b
* 2a: 48 8d bb 50 15 00 00 lea 0x1550(%rbx),%rdi <-- trapping instruction
31: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
38: fc ff df
3b: 48 89 fa mov %rdi,%rdx
3e: 48 rex.W
3f: c1 .byte 0xc1