general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 0 PID: 52 Comm: kworker/0:2 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: events_power_efficient neigh_periodic_work
RIP: 0010:saitek_event+0x51/0x2c0 drivers/hid/hid-saitek.c:154
Code: 00 fe 49 83 c6 60 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 cd 88 3b fe 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 b0 88 3b fe 49 8b 06 48 89 45 d0
RSP: 0018:ffffc90000007700 EFLAGS: 00010006
RAX: 0000000000000003 RBX: ffff88811eeadb70 RCX: 0000000000040000
RDX: ffffc90000482000 RSI: 000000000000001e RDI: 000000000000001f
RBP: ffffc90000007730 R08: 0000000000000000 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000000e88 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000018 R15: ffff888116cd8000
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33763fff CR3: 000000000640f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 hid_process_event+0x3ea/0x5a0 drivers/hid/hid-core.c:1538
 hid_input_field drivers/hid/hid-core.c:1592 [inline]
 __hid_report_raw_event+0x143b/0x1dd0 drivers/hid/hid-core.c:1847
 hid_input_report+0x44c/0x500 drivers/hid/hid-core.c:1922
 hid_ctrl+0x235/0x510 drivers/hid/usbhid/hid-core.c:486
 __usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
 usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1748
 dummy_timer+0xa3a/0x32d0 drivers/usb/gadget/udc/dummy_hcd.c:2000
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x637/0x9a0 kernel/time/timer.c:1789
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x49/0x70 kernel/locking/spinlock.c:199
Code: 12 48 89 fb 48 c7 c7 70 73 4c 86 e8 91 3a 1c fd 48 89 df 48 83 3d 56 69 c9 01 00 74 27 e8 83 ce c8 fc 66 90 fb bf 01 00 00 00 <e8> 52 c7 c1 fc 65 8b 05 57 63 7f 7b 85 c0 74 03 5b 5d c3 e8 43 63
RSP: 0018:ffffc90000a97d18 EFLAGS: 00000246
RAX: 0000000000000001 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000001
RBP: ffffc90000a97d20 R08: ffffffff86b1b73f R09: 1ffffffff0d636e7
R10: dffffc0000000000 R11: fffffbfff0d636e8 R12: ffff88810bfd6e00
R13: ffffffff86b1b738 R14: 0000000000000001 R15: dffffc0000000000
 process_one_work+0x6d7/0xbc0 kernel/workqueue.c:2274
 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
 kthread+0x324/0x3b0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Modules linked in:
---[ end trace 5552d54d125ea1b4 ]---
RIP: 0010:saitek_event+0x51/0x2c0 drivers/hid/hid-saitek.c:154
Code: 00 fe 49 83 c6 60 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 cd 88 3b fe 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 b0 88 3b fe 49 8b 06 48 89 45 d0
RSP: 0018:ffffc90000007700 EFLAGS: 00010006
RAX: 0000000000000003 RBX: ffff88811eeadb70 RCX: 0000000000040000
RDX: ffffc90000482000 RSI: 000000000000001e RDI: 000000000000001f
RBP: ffffc90000007730 R08: 0000000000000000 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000000e88 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000018 R15: ffff888116cd8000
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33763fff CR3: 000000000640f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	00 fe                	add    %bh,%dh
   2:	49 83 c6 60          	add    $0x60,%r14
   6:	4c 89 f0             	mov    %r14,%rax
   9:	48 c1 e8 03          	shr    $0x3,%rax
   d:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
  12:	74 08                	je     0x1c
  14:	4c 89 f7             	mov    %r14,%rdi
  17:	e8 cd 88 3b fe       	call   0xfe3b88e9
  1c:	4d 8b 36             	mov    (%r14),%r14
  1f:	49 83 c6 18          	add    $0x18,%r14
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 f7             	mov    %r14,%rdi
  34:	e8 b0 88 3b fe       	call   0xfe3b88e9
  39:	49 8b 06             	mov    (%r14),%rax
  3c:	48 89 45 d0          	mov    %rax,-0x30(%rbp)