[v5.15] general protection fault in rmi_driver_suspend
1 view
Skip to first unread message
syzbot
Aug 4, 2026, 6:09:40 PM (6 days ago) Aug 4
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 6e2fd6534337 Linux 5.15.213
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12ce7649580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=39db608e3c9f0f81355b
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d7b46606b13d/disk-6e2fd653.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da120fdeb081/vmlinux-6e2fd653.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c2643457e3f/bzImage-6e2fd653.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+39db60...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
CPU: 0 PID: 13 Comm: kworker/0:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: pm pm_runtime_work
RIP: 0010:dev_get_drvdata include/linux/device.h:732 [inline]
RIP: 0010:rmi_suspend_functions drivers/input/rmi4/rmi_driver.c:277 [inline]
RIP: 0010:rmi_driver_suspend+0x2c/0x170 drivers/input/rmi4/rmi_driver.c:949
Code: 57 41 56 41 55 41 54 53 50 89 74 24 04 48 89 fb 48 bd 00 00 00 00 00 fc ff df e8 ef ba 12 fb 4c 8d 73 78 4c 89 f0 48 c1 e8 03 <80> 3c 28 00 74 08 4c 89 f7 e8 96 dd 57 fb 4d 8b 36 4c 89 f0 48 c1
RSP: 0018:ffffc90000d277b0 EFLAGS: 00010206
RAX: 000000000000000f RBX: 0000000000000000 RCX: ffff88813fe28000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: dffffc0000000000
R13: 0000000000000003 R14: 0000000000000078 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055557a0124e8 CR3: 00000000637d6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
rmi_suspend+0xa3/0xf0 drivers/hid/hid-rmi.c:449
hid_suspend+0x5c5/0x640 drivers/hid/usbhid/hid-core.c:1610
usb_suspend_interface drivers/usb/core/driver.c:1307 [inline]
usb_suspend_both+0x281/0x1030 drivers/usb/core/driver.c:1412
usb_runtime_suspend+0x54/0x100 drivers/usb/core/driver.c:1950
__rpm_callback+0x2fd/0x790 drivers/base/power/runtime.c:395
rpm_callback drivers/base/power/runtime.c:532 [inline]
rpm_suspend+0x8cf/0x1b00 drivers/base/power/runtime.c:672
pm_runtime_work+0x10b/0x1b0 drivers/base/power/runtime.c:969
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Modules linked in:
---[ end trace 8672d91f51cfeb81 ]---
RIP: 0010:dev_get_drvdata include/linux/device.h:732 [inline]
RIP: 0010:rmi_suspend_functions drivers/input/rmi4/rmi_driver.c:277 [inline]
RIP: 0010:rmi_driver_suspend+0x2c/0x170 drivers/input/rmi4/rmi_driver.c:949
Code: 57 41 56 41 55 41 54 53 50 89 74 24 04 48 89 fb 48 bd 00 00 00 00 00 fc ff df e8 ef ba 12 fb 4c 8d 73 78 4c 89 f0 48 c1 e8 03 <80> 3c 28 00 74 08 4c 89 f7 e8 96 dd 57 fb 4d 8b 36 4c 89 f0 48 c1
RSP: 0018:ffffc90000d277b0 EFLAGS: 00010206
RAX: 000000000000000f RBX: 0000000000000000 RCX: ffff88813fe28000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: dffffc0000000000
R13: 0000000000000003 R14: 0000000000000078 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055557a0124e8 CR3: 00000000637d6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 57 push %rdi
1: 41 56 push %r14
3: 41 55 push %r13
5: 41 54 push %r12
7: 53 push %rbx
8: 50 push %rax
9: 89 74 24 04 mov %esi,0x4(%rsp)
d: 48 89 fb mov %rdi,%rbx
10: 48 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%rbp
17: fc ff df
1a: e8 ef ba 12 fb call 0xfb12bb0e
1f: 4c 8d 73 78 lea 0x78(%rbx),%r14
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
33: e8 96 dd 57 fb call 0xfb57ddce
38: 4d 8b 36 mov (%r14),%r14
3b: 4c 89 f0 mov %r14,%rax
3e: 48 rex.W
3f: c1 .byte 0xc1
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 6e2fd6534337 Linux 5.15.213
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12ce7649580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f161cbc9aef65db0
dashboard link: https://syzkaller.appspot.com/bug?extid=39db608e3c9f0f81355b
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d7b46606b13d/disk-6e2fd653.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/da120fdeb081/vmlinux-6e2fd653.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3c2643457e3f/bzImage-6e2fd653.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+39db60...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
CPU: 0 PID: 13 Comm: kworker/0:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: pm pm_runtime_work
RIP: 0010:dev_get_drvdata include/linux/device.h:732 [inline]
RIP: 0010:rmi_suspend_functions drivers/input/rmi4/rmi_driver.c:277 [inline]
RIP: 0010:rmi_driver_suspend+0x2c/0x170 drivers/input/rmi4/rmi_driver.c:949
Code: 57 41 56 41 55 41 54 53 50 89 74 24 04 48 89 fb 48 bd 00 00 00 00 00 fc ff df e8 ef ba 12 fb 4c 8d 73 78 4c 89 f0 48 c1 e8 03 <80> 3c 28 00 74 08 4c 89 f7 e8 96 dd 57 fb 4d 8b 36 4c 89 f0 48 c1
RSP: 0018:ffffc90000d277b0 EFLAGS: 00010206
RAX: 000000000000000f RBX: 0000000000000000 RCX: ffff88813fe28000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: dffffc0000000000
R13: 0000000000000003 R14: 0000000000000078 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055557a0124e8 CR3: 00000000637d6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
rmi_suspend+0xa3/0xf0 drivers/hid/hid-rmi.c:449
hid_suspend+0x5c5/0x640 drivers/hid/usbhid/hid-core.c:1610
usb_suspend_interface drivers/usb/core/driver.c:1307 [inline]
usb_suspend_both+0x281/0x1030 drivers/usb/core/driver.c:1412
usb_runtime_suspend+0x54/0x100 drivers/usb/core/driver.c:1950
__rpm_callback+0x2fd/0x790 drivers/base/power/runtime.c:395
rpm_callback drivers/base/power/runtime.c:532 [inline]
rpm_suspend+0x8cf/0x1b00 drivers/base/power/runtime.c:672
pm_runtime_work+0x10b/0x1b0 drivers/base/power/runtime.c:969
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Modules linked in:
---[ end trace 8672d91f51cfeb81 ]---
RIP: 0010:dev_get_drvdata include/linux/device.h:732 [inline]
RIP: 0010:rmi_suspend_functions drivers/input/rmi4/rmi_driver.c:277 [inline]
RIP: 0010:rmi_driver_suspend+0x2c/0x170 drivers/input/rmi4/rmi_driver.c:949
Code: 57 41 56 41 55 41 54 53 50 89 74 24 04 48 89 fb 48 bd 00 00 00 00 00 fc ff df e8 ef ba 12 fb 4c 8d 73 78 4c 89 f0 48 c1 e8 03 <80> 3c 28 00 74 08 4c 89 f7 e8 96 dd 57 fb 4d 8b 36 4c 89 f0 48 c1
RSP: 0018:ffffc90000d277b0 EFLAGS: 00010206
RAX: 000000000000000f RBX: 0000000000000000 RCX: ffff88813fe28000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: dffffc0000000000
R13: 0000000000000003 R14: 0000000000000078 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055557a0124e8 CR3: 00000000637d6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 57 push %rdi
1: 41 56 push %r14
3: 41 55 push %r13
5: 41 54 push %r12
7: 53 push %rbx
8: 50 push %rax
9: 89 74 24 04 mov %esi,0x4(%rsp)
d: 48 89 fb mov %rdi,%rbx
10: 48 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%rbp
17: fc ff df
1a: e8 ef ba 12 fb call 0xfb12bb0e
1f: 4c 8d 73 78 lea 0x78(%rbx),%r14
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
33: e8 96 dd 57 fb call 0xfb57ddce
38: 4d 8b 36 mov (%r14),%r14
3b: 4c 89 f0 mov %r14,%rax
3e: 48 rex.W
3f: c1 .byte 0xc1
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Aug 4, 2026, 7:41:40 PM (6 days ago) Aug 4
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: fb28aa725e05 Linux 6.1.180
syzbot found the following issue on:
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15d97649580000
kernel config: https://syzkaller.appspot.com/x/.config?x=31dfefc4a14efea3
dashboard link: https://syzkaller.appspot.com/bug?extid=22c75ec70451edd5deab
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9a6fe2a54d0f/disk-fb28aa72.raw.xz
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
vmlinux: https://storage.googleapis.com/syzbot-assets/742b23a1d931/vmlinux-fb28aa72.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b3f257c16d2e/bzImage-fb28aa72.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound async_run_entry_fn
RIP: 0010:dev_get_drvdata include/linux/device.h:808 [inline]
RIP: 0010:rmi_suspend_functions drivers/input/rmi4/rmi_driver.c:277 [inline]
RIP: 0010:rmi_driver_suspend+0x2c/0x170 drivers/input/rmi4/rmi_driver.c:949
Code: 57 41 56 41 55 41 54 53 50 89 74 24 04 48 89 fb 48 bd 00 00 00 00 00 fc ff df e8 1f 17 d0 fa 4c 8d 73 78 4c 89 f0 48 c1 e8 03 <80> 3c 28 00 74 08 4c 89 f7 e8 c6 43 21 fb 4d 8b 36 4c 89 f0 48 c1
RIP: 0010:rmi_driver_suspend+0x2c/0x170 drivers/input/rmi4/rmi_driver.c:949
RSP: 0018:ffffc9000c32f930 EFLAGS: 00010206
RAX: 000000000000000f RBX: 0000000000000000 RCX: ffff88807928da00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffff88807928da00 R09: 0000000000000002
R10: 0000000000000008 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000003 R14: 0000000000000078 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff1663a960 CR3: 000000000c88e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
rmi_suspend+0xa3/0xf0 drivers/hid/hid-rmi.c:449
hid_suspend+0xa8/0x4f0 drivers/hid/usbhid/hid-core.c:1621
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
rmi_suspend+0xa3/0xf0 drivers/hid/hid-rmi.c:449
usb_suspend_interface drivers/usb/core/driver.c:1308 [inline]
usb_suspend_both+0x281/0x1030 drivers/usb/core/driver.c:1413
usb_suspend+0x388/0x4a0 drivers/usb/core/driver.c:1573
dpm_run_callback+0x78/0x480 drivers/base/power/main.c:490
__device_suspend+0x763/0xda0 drivers/base/power/main.c:1708
async_suspend+0x23/0x1e0 drivers/base/power/main.c:1737
async_run_entry_fn+0x93/0x3e0 kernel/async.c:127
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dev_get_drvdata include/linux/device.h:808 [inline]
RIP: 0010:rmi_suspend_functions drivers/input/rmi4/rmi_driver.c:277 [inline]
RIP: 0010:rmi_driver_suspend+0x2c/0x170 drivers/input/rmi4/rmi_driver.c:949
Code: 57 41 56 41 55 41 54 53 50 89 74 24 04 48 89 fb 48 bd 00 00 00 00 00 fc ff df e8 1f 17 d0 fa 4c 8d 73 78 4c 89 f0 48 c1 e8 03 <80> 3c 28 00 74 08 4c 89 f7 e8 c6 43 21 fb 4d 8b 36 4c 89 f0 48 c1
RIP: 0010:rmi_driver_suspend+0x2c/0x170 drivers/input/rmi4/rmi_driver.c:949
RSP: 0018:ffffc9000c32f930 EFLAGS: 00010206
RAX: 000000000000000f RBX: 0000000000000000 RCX: ffff88807928da00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffff88807928da00 R09: 0000000000000002
R10: 0000000000000008 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000003 R14: 0000000000000078 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff1663a960 CR3: 000000000c88e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 57 push %rdi
1: 41 56 push %r14
3: 41 55 push %r13
5: 41 54 push %r12
7: 53 push %rbx
8: 50 push %rax
9: 89 74 24 04 mov %esi,0x4(%rsp)
d: 48 89 fb mov %rdi,%rbx
10: 48 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%rbp
17: fc ff df
1a: e8 1f 17 d0 fa call 0xfad0173e
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 57 push %rdi
1: 41 56 push %r14
3: 41 55 push %r13
5: 41 54 push %r12
7: 53 push %rbx
8: 50 push %rax
9: 89 74 24 04 mov %esi,0x4(%rsp)
d: 48 89 fb mov %rdi,%rbx
10: 48 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%rbp
17: fc ff df
1f: 4c 8d 73 78 lea 0x78(%rbx),%r14
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
33: e8 c6 43 21 fb call 0xfb2143fe
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 f7 mov %r14,%rdi
Reply all
Reply to author
Forward
0 new messages