Warning: Permanently added '10.128.0.212' (ED25519) to the list of known hosts.
2026/07/28 05:28:59 parsed 1 programs
2026/07/28 05:28:59 serving rpc on tcp://33481
[ 25.100797][ T28] audit: type=1400 audit(1785216539.440:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 25.121878][ T28] audit: type=1400 audit(1785216539.440:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 25.873020][ T28] audit: type=1400 audit(1785216540.220:66): avc: denied { mounton } for pid=303 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 25.874121][ T303] cgroup: Unknown subsys name 'net'
[ 25.895790][ T28] audit: type=1400 audit(1785216540.220:67): avc: denied { mount } for pid=303 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 25.924301][ T28] audit: type=1400 audit(1785216540.250:68): avc: denied { unmount } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 25.924446][ T303] cgroup: Unknown subsys name 'devices'
[ 26.043339][ T303] cgroup: Unknown subsys name 'hugetlb'
[ 26.049465][ T303] cgroup: Unknown subsys name 'rlimit'
[ 26.187131][ T28] audit: type=1400 audit(1785216540.530:69): avc: denied { setattr } for pid=303 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 26.210379][ T28] audit: type=1400 audit(1785216540.530:70): avc: denied { create } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 26.227051][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 26.231151][ T28] audit: type=1400 audit(1785216540.530:71): avc: denied { write } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 26.260718][ T28] audit: type=1400 audit(1785216540.530:72): avc: denied { read } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 26.283557][ T28] audit: type=1400 audit(1785216540.530:73): avc: denied { mounton } for pid=303 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 26.319985][ T303] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 26.889005][ T307] request_module fs-gadgetfs succeeded, but still no fs?
[ 27.107864][ T319] bridge0: port 1(bridge_slave_0) entered blocking state
[ 27.115835][ T319] bridge0: port 1(bridge_slave_0) entered disabled state
[ 27.123650][ T319] device bridge_slave_0 entered promiscuous mode
[ 27.131419][ T319] bridge0: port 2(bridge_slave_1) entered blocking state
[ 27.138711][ T319] bridge0: port 2(bridge_slave_1) entered disabled state
[ 27.146458][ T319] device bridge_slave_1 entered promiscuous mode
[ 27.185629][ T319] bridge0: port 2(bridge_slave_1) entered blocking state
[ 27.193061][ T319] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 27.200831][ T319] bridge0: port 1(bridge_slave_0) entered blocking state
[ 27.208371][ T319] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 27.226038][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 27.233431][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 27.240750][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 27.248646][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 27.258921][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 27.267245][ T8] bridge0: port 1(bridge_slave_0) entered blocking state
[ 27.275113][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 27.283914][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 27.292164][ T8] bridge0: port 2(bridge_slave_1) entered blocking state
[ 27.299446][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 27.312073][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 27.321343][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 27.334810][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 27.347134][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 27.355797][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 27.363872][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 27.372391][ T319] device veth0_vlan entered promiscuous mode
[ 27.382384][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 27.391984][ T319] device veth1_macvtap entered promiscuous mode
[ 27.400698][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 27.410805][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 27.443031][ T319] syz-executor (319) used greatest stack depth: 22016 bytes left
2026/07/28 05:29:02 executed programs: 0
[ 28.052682][ T43] device bridge_slave_1 left promiscuous mode
[ 28.059567][ T43] bridge0: port 2(bridge_slave_1) entered disabled state
[ 28.068055][ T43] device bridge_slave_0 left promiscuous mode
[ 28.074638][ T43] bridge0: port 1(bridge_slave_0) entered disabled state
[ 28.082748][ T43] device veth1_macvtap left promiscuous mode
[ 28.088765][ T43] device veth0_vlan left promiscuous mode
[ 28.207365][ T370] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.214537][ T370] bridge0: port 1(bridge_slave_0) entered disabled state
[ 28.222084][ T370] device bridge_slave_0 entered promiscuous mode
[ 28.228950][ T370] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.236254][ T370] bridge0: port 2(bridge_slave_1) entered disabled state
[ 28.243966][ T370] device bridge_slave_1 entered promiscuous mode
[ 28.280124][ T370] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.287555][ T370] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 28.295444][ T370] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.303028][ T370] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 28.324088][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 28.331820][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 28.339152][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 28.349535][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 28.358730][ T8] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.365781][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 28.374537][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 28.382775][ T8] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.389869][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 28.400961][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 28.410865][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 28.428837][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 28.440495][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 28.449341][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 28.457103][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 28.466001][ T370] device veth0_vlan entered promiscuous mode
[ 28.475645][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 28.485009][ T370] device veth1_macvtap entered promiscuous mode
[ 28.496806][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 28.506447][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 28.801743][ T324] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 29.002775][ T324] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 29.013815][ T324] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[ 29.023884][ T324] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 29.039293][ T324] usb 3-1: config 0 descriptor??
[ 29.250764][ T324] usbhid 3-1:0.0: can't add hid device: -71
[ 29.257197][ T324] usbhid: probe of 3-1:0.0 failed with error -71
[ 29.264319][ T324] usb 3-1: USB disconnect, device number 2
[ 29.811678][ T324] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[ 29.993395][ T324] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 30.004414][ T324] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40
[ 30.013625][ T324] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 30.022098][ T324] usb 3-1: config 0 descriptor??
[ 30.842175][ T324] aiptek 3-1:0.0: Aiptek using 400 ms programming speed
[ 30.843173][ T375] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 30.849705][ T324] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input4
[ 30.858440][ T375] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 30.878549][ C0] ================================================================================
[ 30.887878][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
[ 30.896464][ C0] index 547 is out of range for type 'const int[34]'
[ 30.904093][ C0] CPU: 0 PID: 103 Comm: udevd Not tainted syzkaller #0
[ 30.910918][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 30.921137][ C0] Call Trace:
[ 30.924500][ C0]
[ 30.927323][ C0] __dump_stack+0x21/0x24
[ 30.931647][ C0] dump_stack_lvl+0x110/0x170
[ 30.936300][ C0] ? __cfi_dump_stack_lvl+0x8/0x8
[ 30.941389][ C0] dump_stack+0x15/0x24
[ 30.945534][ C0] ubsan_epilogue+0xe/0x40
[ 30.949951][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0
[ 30.955669][ C0] aiptek_irq+0x2045/0x29b0
[ 30.960161][ C0] ? kcov_remote_start+0xef/0x370
[ 30.965270][ C0] ? usb_unanchor_urb+0xa1/0xc0
[ 30.970205][ C0] __usb_hcd_giveback_urb+0x360/0x520
[ 30.975570][ C0] usb_hcd_giveback_urb+0x11f/0x3e0
[ 30.980769][ C0] dummy_timer+0xa25/0x3270
[ 30.985452][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 30.990396][ C0] ? resched_curr+0x114/0x3a0
[ 30.995158][ C0] ? timerqueue_del+0xd3/0x120
[ 30.999942][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 31.004995][ C0] __hrtimer_run_queues+0x398/0x890
[ 31.010224][ C0] ? hrtimer_interrupt+0x8c0/0x8c0
[ 31.015439][ C0] hrtimer_run_softirq+0x19b/0x260
[ 31.020574][ C0] handle_softirqs+0x1d7/0x600
[ 31.025435][ C0] __irq_exit_rcu+0x52/0xf0
[ 31.029940][ C0] irq_exit_rcu+0x9/0x10
[ 31.034280][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 31.039950][ C0]
[ 31.042859][ C0]
[ 31.045771][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 31.051735][ C0] RIP: 0010:is_bpf_text_address+0x13c/0x190
[ 31.057634][ C0] Code: f6 74 0a e8 e6 77 f1 ff e9 4d ff ff ff e8 dc 77 f1 ff 45 31 e4 eb 0f e8 d2 77 f1 ff 45 31 e4 eb 09 e8 c8 77 f1 ff 4c 8b 6d d0 <8b> 05 7e cc 80 05 44 39 e8 74 14 e8 b4 77 f1 ff 49 bc 00 00 00 00
[ 31.077325][ C0] RSP: 0018:ffffc90000a377e0 EFLAGS: 00000246
[ 31.083388][ C0] RAX: ffffffff817fee6e RBX: 0000000000000000 RCX: ffff88810ffd1440
[ 31.091337][ C0] RDX: 0000000000000000 RSI: ffffffff85ca6940 RDI: 0000000000000000
[ 31.099373][ C0] RBP: ffffc90000a37810 R08: ffffc90000a37950 R09: ffffc90000a37948
[ 31.107323][ C0] R10: 000000000000000e R11: fffff52000146f1d R12: 0000000000000000
[ 31.115448][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 31.123660][ C0] ? is_bpf_text_address+0x12e/0x190
[ 31.128934][ C0] kernel_text_address+0xa0/0xd0
[ 31.133858][ C0] __kernel_text_address+0xd/0x30
[ 31.138868][ C0] unwind_get_return_address+0x4d/0x90
[ 31.144302][ C0] ? __cfi_stack_trace_consume_entry+0x10/0x10
[ 31.150451][ C0] arch_stack_walk+0xfc/0x150
[ 31.155126][ C0] stack_trace_save+0xa6/0xf0
[ 31.159780][ C0] ? __cfi_stack_trace_save+0x10/0x10
[ 31.165133][ C0] ? is_bpf_text_address+0x177/0x190
[ 31.170416][ C0] ? memset+0x35/0x40
[ 31.174378][ C0] kasan_set_track+0x4b/0x70
[ 31.179033][ C0] ? kasan_set_track+0x4b/0x70
[ 31.183770][ C0] ? kasan_save_free_info+0x2b/0x40
[ 31.189139][ C0] ? ____kasan_slab_free+0x132/0x180
[ 31.194399][ C0] ? __kasan_slab_free+0x11/0x20
[ 31.199325][ C0] ? slab_free_freelist_hook+0xc2/0x190
[ 31.204940][ C0] ? kmem_cache_free+0x12d/0x300
[ 31.209967][ C0] ? security_file_free+0xd8/0xf0
[ 31.215017][ C0] ? __fput+0x5fa/0x8f0
[ 31.219163][ C0] ? ____fput+0x15/0x20
[ 31.223317][ C0] ? task_work_run+0x1e1/0x250
[ 31.228066][ C0] ? exit_to_user_mode_loop+0x9b/0xb0
[ 31.233526][ C0] ? exit_to_user_mode_prepare+0x87/0xd0
[ 31.239138][ C0] ? syscall_exit_to_user_mode+0x1a/0x30
[ 31.244764][ C0] ? do_syscall_64+0x58/0xa0
[ 31.249348][ C0] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 31.255404][ C0] ? kmem_cache_free+0x12d/0x300
[ 31.260407][ C0] kasan_save_free_info+0x2b/0x40
[ 31.265417][ C0] ____kasan_slab_free+0x132/0x180
[ 31.270506][ C0] __kasan_slab_free+0x11/0x20
[ 31.275257][ C0] slab_free_freelist_hook+0xc2/0x190
[ 31.280713][ C0] ? security_file_free+0xd8/0xf0
[ 31.285732][ C0] kmem_cache_free+0x12d/0x300
[ 31.290486][ C0] security_file_free+0xd8/0xf0
[ 31.295343][ C0] __fput+0x5fa/0x8f0
[ 31.299358][ C0] ____fput+0x15/0x20
[ 31.303336][ C0] task_work_run+0x1e1/0x250
[ 31.307919][ C0] ? __cfi_task_work_run+0x10/0x10
[ 31.313104][ C0] ? fput+0x15b/0x1a0
[ 31.317116][ C0] exit_to_user_mode_loop+0x9b/0xb0
[ 31.322414][ C0] exit_to_user_mode_prepare+0x87/0xd0
[ 31.327866][ C0] syscall_exit_to_user_mode+0x1a/0x30
[ 31.333487][ C0] do_syscall_64+0x58/0xa0
[ 31.337971][ C0] ? clear_bhb_loop+0x30/0x80
[ 31.342647][ C0] ? clear_bhb_loop+0x30/0x80
[ 31.347496][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 31.353396][ C0] RIP: 0033:0x7f8b41ca7407
[ 31.357918][ C0] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 31.377833][ C0] RSP: 002b:00007ffe2699fd10 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[ 31.386331][ C0] RAX: 0000000000000000 RBX: 00007f8b42350880 RCX: 00007f8b41ca7407
[ 31.394380][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000c
[ 31.402423][ C0] RBP: 00007f8b423506e8 R08: 0000000000000000 R09: 0000000000000000
[ 31.410462][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000b
[ 31.418427][ C0] R13: 00000000ffffffff R14: ffffffffffffffff R15: 0000000000000000
[ 31.426406][ C0]
[ 31.429410][ C0] ================================================================================
[ 31.438765][ C0] ==================================================================
[ 31.446830][ C0] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0
[ 31.454368][ C0] Read of size 4 at addr ffffffff85e65d8c by task udevd/103
[ 31.461806][ C0]
[ 31.464114][ C0] CPU: 0 PID: 103 Comm: udevd Not tainted syzkaller #0
[ 31.470942][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 31.481080][ C0] Call Trace:
[ 31.484347][ C0]
[ 31.487210][ C0] __dump_stack+0x21/0x24
[ 31.491554][ C0] dump_stack_lvl+0x110/0x170
[ 31.496218][ C0] ? __cfi_dump_stack_lvl+0x8/0x8
[ 31.501229][ C0] ? _printk+0xda/0x128
[ 31.505374][ C0] ? aiptek_irq+0x2063/0x29b0
[ 31.510033][ C0] print_address_description+0x71/0x200
[ 31.515563][ C0] print_report+0x4a/0x60
[ 31.519878][ C0] kasan_report+0x122/0x150
[ 31.524371][ C0] ? aiptek_irq+0x2063/0x29b0
[ 31.529032][ C0] __asan_report_load4_noabort+0x14/0x20
[ 31.534836][ C0] aiptek_irq+0x2063/0x29b0
[ 31.539358][ C0] ? kcov_remote_start+0xef/0x370
[ 31.544373][ C0] ? usb_unanchor_urb+0xa1/0xc0
[ 31.549213][ C0] __usb_hcd_giveback_urb+0x360/0x520
[ 31.554579][ C0] usb_hcd_giveback_urb+0x11f/0x3e0
[ 31.559873][ C0] dummy_timer+0xa25/0x3270
[ 31.564382][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 31.569329][ C0] ? resched_curr+0x114/0x3a0
[ 31.573996][ C0] ? timerqueue_del+0xd3/0x120
[ 31.578747][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 31.583674][ C0] __hrtimer_run_queues+0x398/0x890
[ 31.588878][ C0] ? hrtimer_interrupt+0x8c0/0x8c0
[ 31.594014][ C0] hrtimer_run_softirq+0x19b/0x260
[ 31.599130][ C0] handle_softirqs+0x1d7/0x600
[ 31.604007][ C0] __irq_exit_rcu+0x52/0xf0
[ 31.608502][ C0] irq_exit_rcu+0x9/0x10
[ 31.612748][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 31.618373][ C0]
[ 31.621317][ C0]
[ 31.624236][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 31.630210][ C0] RIP: 0010:is_bpf_text_address+0x13c/0x190
[ 31.636095][ C0] Code: f6 74 0a e8 e6 77 f1 ff e9 4d ff ff ff e8 dc 77 f1 ff 45 31 e4 eb 0f e8 d2 77 f1 ff 45 31 e4 eb 09 e8 c8 77 f1 ff 4c 8b 6d d0 <8b> 05 7e cc 80 05 44 39 e8 74 14 e8 b4 77 f1 ff 49 bc 00 00 00 00
[ 31.655710][ C0] RSP: 0018:ffffc90000a377e0 EFLAGS: 00000246
[ 31.661767][ C0] RAX: ffffffff817fee6e RBX: 0000000000000000 RCX: ffff88810ffd1440
[ 31.669741][ C0] RDX: 0000000000000000 RSI: ffffffff85ca6940 RDI: 0000000000000000
[ 31.677695][ C0] RBP: ffffc90000a37810 R08: ffffc90000a37950 R09: ffffc90000a37948
[ 31.685650][ C0] R10: 000000000000000e R11: fffff52000146f1d R12: 0000000000000000
[ 31.693603][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 31.701555][ C0] ? is_bpf_text_address+0x12e/0x190
[ 31.706837][ C0] kernel_text_address+0xa0/0xd0
[ 31.711849][ C0] __kernel_text_address+0xd/0x30
[ 31.716861][ C0] unwind_get_return_address+0x4d/0x90
[ 31.722307][ C0] ? __cfi_stack_trace_consume_entry+0x10/0x10
[ 31.728450][ C0] arch_stack_walk+0xfc/0x150
[ 31.733118][ C0] stack_trace_save+0xa6/0xf0
[ 31.737780][ C0] ? __cfi_stack_trace_save+0x10/0x10
[ 31.743136][ C0] ? is_bpf_text_address+0x177/0x190
[ 31.748409][ C0] ? memset+0x35/0x40
[ 31.752386][ C0] kasan_set_track+0x4b/0x70
[ 31.756981][ C0] ? kasan_set_track+0x4b/0x70
[ 31.761732][ C0] ? kasan_save_free_info+0x2b/0x40
[ 31.766915][ C0] ? ____kasan_slab_free+0x132/0x180
[ 31.772186][ C0] ? __kasan_slab_free+0x11/0x20
[ 31.777110][ C0] ? slab_free_freelist_hook+0xc2/0x190
[ 31.782637][ C0] ? kmem_cache_free+0x12d/0x300
[ 31.787577][ C0] ? security_file_free+0xd8/0xf0
[ 31.792644][ C0] ? __fput+0x5fa/0x8f0
[ 31.796884][ C0] ? ____fput+0x15/0x20
[ 31.801030][ C0] ? task_work_run+0x1e1/0x250
[ 31.805781][ C0] ? exit_to_user_mode_loop+0x9b/0xb0
[ 31.811136][ C0] ? exit_to_user_mode_prepare+0x87/0xd0
[ 31.816754][ C0] ? syscall_exit_to_user_mode+0x1a/0x30
[ 31.822373][ C0] ? do_syscall_64+0x58/0xa0
[ 31.826989][ C0] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 31.833050][ C0] ? kmem_cache_free+0x12d/0x300
[ 31.837988][ C0] kasan_save_free_info+0x2b/0x40
[ 31.843005][ C0] ____kasan_slab_free+0x132/0x180
[ 31.848103][ C0] __kasan_slab_free+0x11/0x20
[ 31.852867][ C0] slab_free_freelist_hook+0xc2/0x190
[ 31.858245][ C0] ? security_file_free+0xd8/0xf0
[ 31.863270][ C0] kmem_cache_free+0x12d/0x300
[ 31.868048][ C0] security_file_free+0xd8/0xf0
[ 31.872975][ C0] __fput+0x5fa/0x8f0
[ 31.876948][ C0] ____fput+0x15/0x20
[ 31.881000][ C0] task_work_run+0x1e1/0x250
[ 31.885574][ C0] ? __cfi_task_work_run+0x10/0x10
[ 31.890667][ C0] ? fput+0x15b/0x1a0
[ 31.894632][ C0] exit_to_user_mode_loop+0x9b/0xb0
[ 31.899902][ C0] exit_to_user_mode_prepare+0x87/0xd0
[ 31.905379][ C0] syscall_exit_to_user_mode+0x1a/0x30
[ 31.910825][ C0] do_syscall_64+0x58/0xa0
[ 31.915232][ C0] ? clear_bhb_loop+0x30/0x80
[ 31.919900][ C0] ? clear_bhb_loop+0x30/0x80
[ 31.924565][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 31.930447][ C0] RIP: 0033:0x7f8b41ca7407
[ 31.934846][ C0] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 31.954532][ C0] RSP: 002b:00007ffe2699fd10 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[ 31.962933][ C0] RAX: 0000000000000000 RBX: 00007f8b42350880 RCX: 00007f8b41ca7407
[ 31.970973][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000c
[ 31.979032][ C0] RBP: 00007f8b423506e8 R08: 0000000000000000 R09: 0000000000000000
[ 31.987184][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000b
[ 31.995221][ C0] R13: 00000000ffffffff R14: ffffffffffffffff R15: 0000000000000000
[ 32.003348][ C0]
[ 32.006435][ C0]
[ 32.008823][ C0] The buggy address belongs to the variable:
[ 32.014769][ C0] .str.47+0xc/0x20
[ 32.018748][ C0]
[ 32.021277][ C0] The buggy address belongs to the physical page:
[ 32.027713][ C0] page:ffffea0000179940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e65
[ 32.037871][ C0] flags: 0x1000(reserved|zone=0)
[ 32.042822][ C0] raw: 0000000000001000 ffffea0000179948 ffffea0000179948 0000000000000000
[ 32.051477][ C0] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 32.060213][ C0] page dumped because: kasan: bad access detected
[ 32.066645][ C0] page_owner info is not present (never set?)
[ 32.072780][ C0]
[ 32.075109][ C0] Memory state around the buggy address:
[ 32.080763][ C0] ffffffff85e65c80: 05 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
[ 32.088995][ C0] ffffffff85e65d00: 00 00 00 00 f9 f9 f9 f9 06 f9 f9 f9 00 01 f9 f9
[ 32.097062][ C0] >ffffffff85e65d80: 04 f9 f9 f9 00 f9 f9 f9 06 f9 f9 f9 07 f9 f9 f9
[ 32.105097][ C0] ^
[ 32.109761][ C0] ffffffff85e65e00: 06 f9 f9 f9 00 04 f9 f9 05 f9 f9 f9 00 03 f9 f9
[ 32.117801][ C0] ffffffff85e65e80: 00 03 f9 f9 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9
[ 32.125844][ C0] ==================================================================
[ 32.133892][ C0] Disabling lock debugging due to kernel taint
[ 32.140068][ C0] ================================================================================
[ 32.149322][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
[ 32.157891][ C0] index 548 is out of range for type 'const int[34]'
[ 32.164542][ C0] CPU: 0 PID: 103 Comm: udevd Tainted: G B syzkaller #0
[ 32.172847][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 32.182893][ C0] Call Trace:
[ 32.186158][ C0]
[ 32.188985][ C0] __dump_stack+0x21/0x24
[ 32.193305][ C0] dump_stack_lvl+0x110/0x170
[ 32.197965][ C0] ? __cfi_dump_stack_lvl+0x8/0x8
[ 32.202986][ C0] ? _raw_spin_lock_irqsave+0xc2/0x130
[ 32.208434][ C0] ? __kasan_check_read+0x11/0x20
[ 32.213441][ C0] dump_stack+0x15/0x24
[ 32.217581][ C0] ubsan_epilogue+0xe/0x40
[ 32.221986][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0
[ 32.227778][ C0] aiptek_irq+0x1f14/0x29b0
[ 32.232286][ C0] ? kcov_remote_start+0xef/0x370
[ 32.237564][ C0] __usb_hcd_giveback_urb+0x360/0x520
[ 32.242928][ C0] usb_hcd_giveback_urb+0x11f/0x3e0
[ 32.248116][ C0] dummy_timer+0xa25/0x3270
[ 32.252619][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 32.257541][ C0] ? resched_curr+0x114/0x3a0
[ 32.262311][ C0] ? timerqueue_del+0xd3/0x120
[ 32.267064][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 32.271986][ C0] __hrtimer_run_queues+0x398/0x890
[ 32.277177][ C0] ? hrtimer_interrupt+0x8c0/0x8c0
[ 32.282282][ C0] hrtimer_run_softirq+0x19b/0x260
[ 32.287374][ C0] handle_softirqs+0x1d7/0x600
[ 32.292120][ C0] __irq_exit_rcu+0x52/0xf0
[ 32.296609][ C0] irq_exit_rcu+0x9/0x10
[ 32.300837][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 32.306459][ C0]
[ 32.309370][ C0]
[ 32.312310][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 32.318380][ C0] RIP: 0010:is_bpf_text_address+0x13c/0x190
[ 32.324289][ C0] Code: f6 74 0a e8 e6 77 f1 ff e9 4d ff ff ff e8 dc 77 f1 ff 45 31 e4 eb 0f e8 d2 77 f1 ff 45 31 e4 eb 09 e8 c8 77 f1 ff 4c 8b 6d d0 <8b> 05 7e cc 80 05 44 39 e8 74 14 e8 b4 77 f1 ff 49 bc 00 00 00 00
[ 32.343966][ C0] RSP: 0018:ffffc90000a377e0 EFLAGS: 00000246
[ 32.350118][ C0] RAX: ffffffff817fee6e RBX: 0000000000000000 RCX: ffff88810ffd1440
[ 32.358074][ C0] RDX: 0000000000000000 RSI: ffffffff85ca6940 RDI: 0000000000000000
[ 32.366045][ C0] RBP: ffffc90000a37810 R08: ffffc90000a37950 R09: ffffc90000a37948
[ 32.374150][ C0] R10: 000000000000000e R11: fffff52000146f1d R12: 0000000000000000
[ 32.382104][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 32.390158][ C0] ? is_bpf_text_address+0x12e/0x190
[ 32.395959][ C0] kernel_text_address+0xa0/0xd0
[ 32.400898][ C0] __kernel_text_address+0xd/0x30
[ 32.405994][ C0] unwind_get_return_address+0x4d/0x90
[ 32.411441][ C0] ? __cfi_stack_trace_consume_entry+0x10/0x10
[ 32.417582][ C0] arch_stack_walk+0xfc/0x150
[ 32.422268][ C0] stack_trace_save+0xa6/0xf0
[ 32.426941][ C0] ? __cfi_stack_trace_save+0x10/0x10
[ 32.433158][ C0] ? is_bpf_text_address+0x177/0x190
[ 32.439134][ C0] ? memset+0x35/0x40
[ 32.443134][ C0] kasan_set_track+0x4b/0x70
[ 32.447772][ C0] ? kasan_set_track+0x4b/0x70
[ 32.452525][ C0] ? kasan_save_free_info+0x2b/0x40
[ 32.457708][ C0] ? ____kasan_slab_free+0x132/0x180
[ 32.463160][ C0] ? __kasan_slab_free+0x11/0x20
[ 32.468364][ C0] ? slab_free_freelist_hook+0xc2/0x190
[ 32.473917][ C0] ? kmem_cache_free+0x12d/0x300
[ 32.478956][ C0] ? security_file_free+0xd8/0xf0
[ 32.484013][ C0] ? __fput+0x5fa/0x8f0
[ 32.488155][ C0] ? ____fput+0x15/0x20
[ 32.492315][ C0] ? task_work_run+0x1e1/0x250
[ 32.497064][ C0] ? exit_to_user_mode_loop+0x9b/0xb0
[ 32.502429][ C0] ? exit_to_user_mode_prepare+0x87/0xd0
[ 32.508042][ C0] ? syscall_exit_to_user_mode+0x1a/0x30
[ 32.513686][ C0] ? do_syscall_64+0x58/0xa0
[ 32.518284][ C0] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 32.524379][ C0] ? kmem_cache_free+0x12d/0x300
[ 32.529304][ C0] kasan_save_free_info+0x2b/0x40
[ 32.534490][ C0] ____kasan_slab_free+0x132/0x180
[ 32.539588][ C0] __kasan_slab_free+0x11/0x20
[ 32.544345][ C0] slab_free_freelist_hook+0xc2/0x190
[ 32.549700][ C0] ? security_file_free+0xd8/0xf0
[ 32.554885][ C0] kmem_cache_free+0x12d/0x300
[ 32.559640][ C0] security_file_free+0xd8/0xf0
[ 32.564563][ C0] __fput+0x5fa/0x8f0
[ 32.568544][ C0] ____fput+0x15/0x20
[ 32.572529][ C0] task_work_run+0x1e1/0x250
[ 32.577112][ C0] ? __cfi_task_work_run+0x10/0x10
[ 32.582211][ C0] ? fput+0x15b/0x1a0
[ 32.586178][ C0] exit_to_user_mode_loop+0x9b/0xb0
[ 32.591362][ C0] exit_to_user_mode_prepare+0x87/0xd0
[ 32.596862][ C0] syscall_exit_to_user_mode+0x1a/0x30
[ 32.602399][ C0] do_syscall_64+0x58/0xa0
[ 32.606822][ C0] ? clear_bhb_loop+0x30/0x80
[ 32.611487][ C0] ? clear_bhb_loop+0x30/0x80
[ 32.616152][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 32.622327][ C0] RIP: 0033:0x7f8b41ca7407
[ 32.626922][ C0] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 32.646685][ C0] RSP: 002b:00007ffe2699fd10 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[ 32.655093][ C0] RAX: 0000000000000000 RBX: 00007f8b42350880 RCX: 00007f8b41ca7407
[ 32.663050][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000c
[ 32.671002][ C0] RBP: 00007f8b423506e8 R08: 0000000000000000 R09: 0000000000000000
[ 32.679045][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000b
[ 32.687024][ C0] R13: 00000000ffffffff R14: ffffffffffffffff R15: 0000000000000000
[ 32.695000][ C0]
[ 32.698090][ C0] ================================================================================
[ 32.718198][ T28] kauditd_printk_skb: 34 callbacks suppressed
[ 32.718211][ T28] audit: type=1400 audit(1785216547.060:108): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 32.746382][ T28] audit: type=1400 audit(1785216547.060:109): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 32.767989][ T28] audit: type=1400 audit(1785216547.060:110): avc: denied { write } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 32.789240][ T28] audit: type=1400 audit(1785216547.060:111): avc: denied { add_name } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 32.809872][ T28] audit: type=1400 audit(1785216547.060:112): avc: denied { create } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 32.830512][ T28] audit: type=1400 audit(1785216547.060:113): avc: denied { append open } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 32.853419][ T28] audit: type=1400 audit(1785216547.060:114): avc: denied { getattr } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 33.136480][ T324] usb 3-1: USB disconnect, device number 3
[ 33.142356][ C0] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19