==================================================================
BUG: KASAN: null-ptr-deref in mcp2221_raw_event+0xc1f/0x1030 drivers/hid/hid-mcp2221.c:910
Write of size 183 at addr 0000000000000000 by task swapper/0/0

CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
 __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106
 mcp2221_raw_event+0xc1f/0x1030 drivers/hid/hid-mcp2221.c:910
 __hid_input_report.constprop.0+0x314/0x450 drivers/hid/hid-core.c:2130
 hid_irq_in+0x35e/0x870 drivers/hid/usbhid/hid-core.c:286
 __usb_hcd_giveback_urb+0x38b/0x610 drivers/usb/core/hcd.c:1661
 usb_hcd_giveback_urb+0x39b/0x450 drivers/usb/core/hcd.c:1745
 dummy_timer+0x1814/0x3a30 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
 handle_softirqs+0x208/0x8d0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline]
RIP: 0010:cpuidle_idle_call kernel/sched/idle.c:248 [inline]
RIP: 0010:do_idle+0x275/0x510 kernel/sched/idle.c:330
Code: 0f 85 34 02 00 00 48 8b 01 a8 08 0f 85 89 01 00 00 48 8b 3c 24 4c 89 fe e8 28 dc 52 04 65 48 8b 05 c8 a4 3d 0b f0 80 48 02 20 <9c> 58 f6 c4 02 0f 85 90 fe ff ff 90 0f 0b 90 e8 27 08 31 00 fb e9
RSP: 0018:ffffffff89007e20 EFLAGS: 00000202
RAX: ffffffff8902e7c0 RBX: 0000000000000000 RCX: ffffffff8153a861
RDX: 0000000000000000 RSI: ffffffff88d27954 RDI: ffffffff878963e0
RBP: fffffbfff1205cf8 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8a9d73d7 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8902e7c0 R14: ffffffff8a9d73d0 R15: 0000000000000000
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:428
 rest_init+0x16b/0x2b0 init/main.c:744
 start_kernel+0x3e9/0x4d0 init/main.c:1097
 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:307
 x86_64_start_kernel+0x130/0x190 arch/x86/kernel/head64.c:288
 common_startup_64+0x13e/0x148
 </TASK>
==================================================================
----------------
Code disassembly (best guess):
   0:	0f 85 34 02 00 00    	jne    0x23a
   6:	48 8b 01             	mov    (%rcx),%rax
   9:	a8 08                	test   $0x8,%al
   b:	0f 85 89 01 00 00    	jne    0x19a
  11:	48 8b 3c 24          	mov    (%rsp),%rdi
  15:	4c 89 fe             	mov    %r15,%rsi
  18:	e8 28 dc 52 04       	call   0x452dc45
  1d:	65 48 8b 05 c8 a4 3d 	mov    %gs:0xb3da4c8(%rip),%rax        # 0xb3da4ed
  24:	0b
  25:	f0 80 48 02 20       	lock orb $0x20,0x2(%rax)
* 2a:	9c                   	pushf <-- trapping instruction
  2b:	58                   	pop    %rax
  2c:	f6 c4 02             	test   $0x2,%ah
  2f:	0f 85 90 fe ff ff    	jne    0xfffffec5
  35:	90                   	nop
  36:	0f 0b                	ud2
  38:	90                   	nop
  39:	e8 27 08 31 00       	call   0x310865
  3e:	fb                   	sti
  3f:	e9                   	.byte 0xe9