program:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x6a3, 0xcd7, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x12, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x96, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x80, 0x15, 0x87}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c04a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000c80)={0x0, 0x30, 0x1, ':'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0xa, 0x62080)
ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0)
[ 124.114397][ T4651] Bluetooth: hci0: command tx timeout
[ 124.455030][ T5350] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 124.602448][ T5350] usb 5-1: Using ep0 maxpacket: 16
[ 124.604117][ T5350] usb 5-1: New USB device found, idVendor=06a3, idProduct=0cd7, bcdDevice= 0.00
[ 124.605725][ T5350] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 128, changing to 11
[ 124.605743][ T5350] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[ 124.605756][ T5350] usb 5-1: config 0 interface 0 has no altsetting 0
[ 124.605774][ T5350] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 124.650895][ T5350] usb 5-1: config 0 descriptor??
[ 125.069456][ T5350] saitek 0003:06A3:0CD7.0002: unknown main item tag 0x0
[ 125.069487][ T5350] saitek 0003:06A3:0CD7.0002: unknown main item tag 0x0
[ 125.069502][ T5350] saitek 0003:06A3:0CD7.0002: unknown main item tag 0x0
[ 125.069515][ T5350] saitek 0003:06A3:0CD7.0002: unknown main item tag 0x0
[ 125.069528][ T5350] saitek 0003:06A3:0CD7.0002: unknown main item tag 0x0
[ 125.120924][ T5350] saitek 0003:06A3:0CD7.0002: hiddev0,hidraw1: USB HID v0.96 Device [HID 06a3:0cd7] on usb-dummy_hcd.0-1/input0
[ 125.675455][ C0] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] SMP KASAN NOPTI
[ 125.680034][ C0] KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
[ 125.683442][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full)
[ 125.687032][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 125.691011][ C0] RIP: 0010:saitek_event+0x51/0x2b0
[ 125.693370][ C0] Code: a8 f8 49 83 c6 78 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 7d 66 1b f9 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 60 66 1b f9 49 8b 06 48 89 04 24
[ 125.701087][ C0] RSP: 0018:ffffc90000007830 EFLAGS: 00010006
[ 125.703708][ C0] RAX: 0000000000000003 RBX: ffff8880452e8e88 RCX: ffffffff8fa8f000
[ 125.707061][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff88805397c000
[ 125.710515][ C0] RBP: 000000000000003a R08: 0000000000000000 R09: 0000000000000000
[ 125.714274][ C0] R10: ffff8880452e8ea8 R11: ffffffff891f3a00 R12: ffffffff910c30a8
[ 125.718230][ C0] R13: dffffc0000000000 R14: 0000000000000018 R15: ffff88805397c000
[ 125.722213][ C0] FS: 0000000000000000(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000
[ 125.725593][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 125.728089][ C0] CR2: 00007fdf77e8eff8 CR3: 00000000452ce000 CR4: 0000000000352ef0
[ 125.731211][ C0] Call Trace:
[ 125.732587][ C0]
[ 125.733763][ C0] ? hid_process_event+0x18f/0x620
[ 125.735855][ C0] hid_process_event+0x436/0x620
[ 125.737915][ C0] ? hidraw_report_event+0x37e/0x3a0
[ 125.740070][ C0] ? __pfx_saitek_event+0x10/0x10
[ 125.742274][ C0] hid_report_raw_event+0xf6a/0x1900
[ 125.744691][ C0] __hid_input_report+0x454/0x580
[ 125.746953][ C0] ? __pfx_saitek_raw_event+0x10/0x10
[ 125.749368][ C0] hid_ctrl+0x204/0x580
[ 125.751253][ C0] ? usb_anchor_suspend_wakeups+0x3b/0x50
[ 125.753786][ C0] __usb_hcd_giveback_urb+0x378/0x540
[ 125.756226][ C0] dummy_timer+0xa91/0x4cc0
[ 125.758362][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 125.760625][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 125.763272][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 125.765550][ C0] __hrtimer_run_queues+0x3bc/0xa10
[ 125.767952][ C0] hrtimer_run_softirq+0x1e3/0x2e0
[ 125.770288][ C0] handle_softirqs+0x226/0x860
[ 125.772464][ C0] ? __irq_exit_rcu+0xcb/0x220
[ 125.774517][ C0] __irq_exit_rcu+0xcb/0x220
[ 125.776518][ C0] irq_exit_rcu+0x9/0x30
[ 125.778479][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 125.780829][ C0]
[ 125.782207][ C0]
[ 125.783486][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 125.786166][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20
[ 125.788677][ C0] Code: 3b 89 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 c5 1e 00 fb f4 8c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
[ 125.796925][ C0] RSP: 0018:ffffffff8fa07ca0 EFLAGS: 00000246
[ 125.799453][ C0] RAX: 000000000009d92d RBX: ffffffff819bed20 RCX: 8000000000000001
[ 125.802936][ C0] RDX: 0000000000000001 RSI: ffffffff8e46c609 RDI: ffffffff8c6deb80
[ 125.806356][ C0] RBP: ffffffff8fa07d78 R08: ffff88801fa33a1b R09: 1ffff11003f46743
[ 125.809865][ C0] R10: dffffc0000000000 R11: ffffed1003f46744 R12: 0000000000000000
[ 125.813452][ C0] R13: 1ffffffff1f51e00 R14: 1ffffffff1f40f9c R15: dffffc0000000000
[ 125.817028][ C0] ? do_idle+0x2e0/0x540
[ 125.818942][ C0] default_idle+0x9/0x20
[ 125.820826][ C0] default_idle_call+0x72/0xb0
[ 125.822963][ C0] do_idle+0x2e0/0x540
[ 125.824832][ C0] ? __pfx_do_idle+0x10/0x10
[ 125.826967][ C0] cpu_startup_entry+0x43/0x60
[ 125.829141][ C0] rest_init+0x378/0x3a0
[ 125.831087][ C0] ? __pfx_rest_init+0x10/0x10
[ 125.833263][ C0] ? __pfx_kernel_init+0x10/0x10
[ 125.835545][ C0] ? acpi_ut_status_exit+0x120/0x1f0
[ 125.838012][ C0] ? acpi_ut_status_exit+0x120/0x1f0
[ 125.840413][ C0] ? acpi_enable_subsystem+0x286/0x3c0
[ 125.842938][ C0] start_kernel+0x392/0x3e0
[ 125.844951][ C0] x86_64_start_reservations+0x24/0x30
[ 125.847372][ C0] x86_64_start_kernel+0x137/0x1b0
[ 125.849694][ C0] common_startup_64+0x13e/0x157
[ 125.851992][ C0]
[ 125.853433][ C0] Modules linked in:
[ 125.855234][ C0] ---[ end trace 0000000000000000 ]---
[ 125.857686][ C0] RIP: 0010:saitek_event+0x51/0x2b0
[ 125.857713][ C0] Code: a8 f8 49 83 c6 78 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 7d 66 1b f9 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 60 66 1b f9 49 8b 06 48 89 04 24
[ 125.857723][ C0] RSP: 0018:ffffc90000007830 EFLAGS: 00010006
[ 125.857734][ C0] RAX: 0000000000000003 RBX: ffff8880452e8e88 RCX: ffffffff8fa8f000
[ 125.857742][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff88805397c000
[ 125.857750][ C0] RBP: 000000000000003a R08: 0000000000000000 R09: 0000000000000000
[ 125.857757][ C0] R10: ffff8880452e8ea8 R11: ffffffff891f3a00 R12: ffffffff910c30a8
[ 125.857764][ C0] R13: dffffc0000000000 R14: 0000000000000018 R15: ffff88805397c000
[ 125.857772][ C0] FS: 0000000000000000(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000
[ 125.857782][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 125.857790][ C0] CR2: 00007fdf77e8eff8 CR3: 00000000452ce000 CR4: 0000000000352ef0
[ 125.857827][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 125.902835][ C0] Kernel Offset: disabled
[ 125.904814][ C0] Rebooting in 86400 seconds..