Warning: Permanently added '10.128.0.186' (ED25519) to the list of known hosts. 2026/07/03 09:55:52 parsed 1 programs 2026/07/03 09:55:52 serving rpc on tcp://34387 [ 24.128113][ T30] audit: type=1400 audit(1783072552.288:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.149679][ T30] audit: type=1400 audit(1783072552.288:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 24.781821][ T30] audit: type=1400 audit(1783072552.938:66): avc: denied { mounton } for pid=300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.782907][ T300] cgroup: Unknown subsys name 'net' [ 24.804838][ T30] audit: type=1400 audit(1783072552.938:67): avc: denied { mount } for pid=300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.832087][ T30] audit: type=1400 audit(1783072552.968:68): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.832235][ T300] cgroup: Unknown subsys name 'devices' [ 24.948876][ T300] cgroup: Unknown subsys name 'hugetlb' [ 24.954619][ T300] cgroup: Unknown subsys name 'rlimit' [ 25.095932][ T30] audit: type=1400 audit(1783072553.248:69): avc: denied { setattr } for pid=300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.119131][ T30] audit: type=1400 audit(1783072553.248:70): avc: denied { create } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.139561][ T30] audit: type=1400 audit(1783072553.248:71): avc: denied { write } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.145297][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.159863][ T30] audit: type=1400 audit(1783072553.248:72): avc: denied { read } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.188602][ T30] audit: type=1400 audit(1783072553.248:73): avc: denied { mounton } for pid=300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.229488][ T300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.650439][ T308] request_module fs-gadgetfs succeeded, but still no fs? [ 26.128450][ T352] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.135487][ T352] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.142992][ T352] device bridge_slave_0 entered promiscuous mode [ 26.149882][ T352] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.156887][ T352] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.164317][ T352] device bridge_slave_1 entered promiscuous mode [ 26.202280][ T352] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.209343][ T352] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.216608][ T352] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.223643][ T352] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.240436][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.247958][ T319] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.255072][ T319] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.263942][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.272477][ T319] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.279511][ T319] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.288471][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.296621][ T319] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.303649][ T319] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.314493][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.324130][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.336742][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.348169][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.356136][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.363699][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.371643][ T352] device veth0_vlan entered promiscuous mode [ 26.380832][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.391254][ T352] device veth1_macvtap entered promiscuous mode [ 26.400118][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.409916][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/03 09:55:54 executed programs: 0 [ 26.673847][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.681029][ T367] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.688879][ T367] device bridge_slave_0 entered promiscuous mode [ 26.695726][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.703036][ T367] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.710486][ T367] device bridge_slave_1 entered promiscuous mode [ 26.749143][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.756196][ T367] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.763469][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.770495][ T367] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.779089][ T320] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.786331][ T320] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.804368][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.811895][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.820990][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.829335][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.837734][ T320] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.845686][ T320] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.867516][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.875882][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.884306][ T320] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.891498][ T320] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.903058][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.911570][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.919494][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.927649][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.935511][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.943878][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.959819][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.970611][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.979032][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.986457][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.995175][ T367] device veth0_vlan entered promiscuous mode [ 27.005777][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.014108][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.023621][ T367] device veth1_macvtap entered promiscuous mode [ 27.038293][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.046024][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.055778][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.064424][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.073021][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.367323][ T20] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 27.657970][ T8] device bridge_slave_1 left promiscuous mode [ 27.664092][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.671606][ T8] device bridge_slave_0 left promiscuous mode [ 27.677797][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.685457][ T8] device veth1_macvtap left promiscuous mode [ 27.691491][ T8] device veth0_vlan left promiscuous mode [ 27.757350][ T20] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.768289][ T20] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 27.777653][ T20] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.788373][ T20] usb 3-1: config 0 descriptor?? [ 28.117358][ T20] usbhid 3-1:0.0: can't add hid device: -71 [ 28.123296][ T20] usbhid: probe of 3-1:0.0 failed with error -71 [ 28.130198][ T20] usb 3-1: USB disconnect, device number 2 [ 28.647350][ T20] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 29.007359][ T20] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.018277][ T20] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 29.027319][ T20] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.036212][ T20] usb 3-1: config 0 descriptor?? [ 29.967327][ T20] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 29.974937][ T20] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input4 [ 30.507305][ C0] ================================================================================ [ 30.516600][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 30.525174][ C0] index 547 is out of range for type 'const int[34]' [ 30.531824][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 30.538822][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 30.548863][ C0] Call Trace: [ 30.552144][ C0] [ 30.554965][ C0] __dump_stack+0x21/0x30 [ 30.559283][ C0] dump_stack_lvl+0x110/0x170 [ 30.563935][ C0] ? show_regs_print_info+0x20/0x20 [ 30.569110][ C0] dump_stack+0x15/0x20 [ 30.573240][ C0] ubsan_epilogue+0xe/0x40 [ 30.577632][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0 [ 30.583327][ C0] aiptek_irq+0x2045/0x29b0 [ 30.587807][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 30.593590][ C0] ? kcov_remote_start+0xf3/0x350 [ 30.598587][ C0] ? usb_unanchor_urb+0xa1/0xc0 [ 30.603411][ C0] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 30.608777][ C0] usb_hcd_giveback_urb+0x11d/0x3f0 [ 30.613959][ C0] ? _raw_spin_unlock+0x4d/0x70 [ 30.618791][ C0] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 30.624656][ C0] dummy_timer+0xa34/0x31d0 [ 30.629138][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 30.634313][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 30.639485][ C0] call_timer_fn+0x38/0x290 [ 30.643984][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 30.649194][ C0] __run_timers+0x637/0x9a0 [ 30.653678][ C0] ? calc_index+0x200/0x200 [ 30.658155][ C0] ? sched_clock_cpu+0x18/0x3d0 [ 30.662982][ C0] run_timer_softirq+0x6a/0xf0 [ 30.667725][ C0] handle_softirqs+0x250/0x560 [ 30.672473][ C0] ? irqtime_account_irq+0xbe/0x390 [ 30.677651][ C0] __irq_exit_rcu+0x52/0xf0 [ 30.682127][ C0] irq_exit_rcu+0x9/0x10 [ 30.686342][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 30.691948][ C0] [ 30.694852][ C0] [ 30.697763][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 30.703716][ C0] RIP: 0010:default_idle+0xf/0x20 [ 30.708741][ C0] Code: 8c 4b ff ff ff 4c 89 f7 e8 6e d2 f5 fc e9 3e ff ff ff 00 00 cc cc 00 00 cc cc 00 55 48 89 e5 66 90 0f 00 2d 43 12 52 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 [ 30.728318][ C0] RSP: 0018:ffffffff86607d78 EFLAGS: 00000246 [ 30.734358][ C0] RAX: 0000000000003e28 RBX: ffffffff8661c400 RCX: 0000000000003e28 [ 30.742305][ C0] RDX: 0000000000000001 RSI: ffffffff85638320 RDI: ffffffff856382e0 [ 30.750254][ C0] RBP: ffffffff86607d78 R08: ffff8881f7038c73 R09: 1ffff1103ee0718e [ 30.758218][ C0] R10: dffffc0000000000 R11: ffffed103ee0718f R12: 0000000000000000 [ 30.766179][ C0] R13: 1ffffffff0cc3880 R14: dffffc0000000000 R15: dffffc0000000000 [ 30.774140][ C0] arch_cpu_idle+0xa/0x10 [ 30.778464][ C0] default_idle_call+0x71/0x1d0 [ 30.783294][ C0] do_idle+0x217/0x620 [ 30.787336][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 30.792512][ C0] cpu_startup_entry+0x18/0x20 [ 30.797256][ C0] rest_init+0x10a/0x130 [ 30.801479][ C0] ? time_init+0x40/0x40 [ 30.805692][ C0] arch_call_rest_init+0xe/0x10 [ 30.810687][ C0] start_kernel+0x46d/0x4e0 [ 30.815180][ C0] x86_64_start_reservations+0x2a/0x30 [ 30.820642][ C0] x86_64_start_kernel+0x5b/0x60 [ 30.825563][ C0] secondary_startup_64_no_verify+0xb1/0xbb [ 30.831440][ C0] [ 30.834442][ C0] ================================================================================ [ 30.843700][ C0] ================================================================== [ 30.851731][ C0] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0 [ 30.859259][ C0] Read of size 4 at addr ffffffff857ee3ec by task swapper/0/0 [ 30.866689][ C0] [ 30.868990][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 30.875982][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 30.886010][ C0] Call Trace: [ 30.889286][ C0] [ 30.892114][ C0] __dump_stack+0x21/0x30 [ 30.896427][ C0] dump_stack_lvl+0x110/0x170 [ 30.901082][ C0] ? show_regs_print_info+0x20/0x20 [ 30.906265][ C0] ? load_image+0x3f0/0x3f0 [ 30.910937][ C0] ? dump_stack_lvl+0x134/0x170 [ 30.917524][ C0] print_address_description+0x7f/0x2c0 [ 30.923066][ C0] ? aiptek_irq+0x2063/0x29b0 [ 30.927725][ C0] kasan_report+0x10f/0x150 [ 30.932221][ C0] ? aiptek_irq+0x2063/0x29b0 [ 30.936893][ C0] __asan_report_load4_noabort+0x14/0x20 [ 30.942517][ C0] aiptek_irq+0x2063/0x29b0 [ 30.947002][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 30.952796][ C0] ? kcov_remote_start+0xf3/0x350 [ 30.957797][ C0] ? usb_unanchor_urb+0xa1/0xc0 [ 30.962637][ C0] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 30.967986][ C0] usb_hcd_giveback_urb+0x11d/0x3f0 [ 30.973163][ C0] ? _raw_spin_unlock+0x4d/0x70 [ 30.977992][ C0] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 30.983858][ C0] dummy_timer+0xa34/0x31d0 [ 30.988340][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 30.993513][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 30.998689][ C0] call_timer_fn+0x38/0x290 [ 31.003177][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 31.008354][ C0] __run_timers+0x637/0x9a0 [ 31.012839][ C0] ? calc_index+0x200/0x200 [ 31.017322][ C0] ? sched_clock_cpu+0x18/0x3d0 [ 31.022172][ C0] run_timer_softirq+0x6a/0xf0 [ 31.026914][ C0] handle_softirqs+0x250/0x560 [ 31.031662][ C0] ? irqtime_account_irq+0xbe/0x390 [ 31.036836][ C0] __irq_exit_rcu+0x52/0xf0 [ 31.041318][ C0] irq_exit_rcu+0x9/0x10 [ 31.045539][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 31.051500][ C0] [ 31.054412][ C0] [ 31.057318][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 31.063276][ C0] RIP: 0010:default_idle+0xf/0x20 [ 31.068312][ C0] Code: 8c 4b ff ff ff 4c 89 f7 e8 6e d2 f5 fc e9 3e ff ff ff 00 00 cc cc 00 00 cc cc 00 55 48 89 e5 66 90 0f 00 2d 43 12 52 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 [ 31.087895][ C0] RSP: 0018:ffffffff86607d78 EFLAGS: 00000246 [ 31.093938][ C0] RAX: 0000000000003e28 RBX: ffffffff8661c400 RCX: 0000000000003e28 [ 31.101903][ C0] RDX: 0000000000000001 RSI: ffffffff85638320 RDI: ffffffff856382e0 [ 31.109848][ C0] RBP: ffffffff86607d78 R08: ffff8881f7038c73 R09: 1ffff1103ee0718e [ 31.117799][ C0] R10: dffffc0000000000 R11: ffffed103ee0718f R12: 0000000000000000 [ 31.125752][ C0] R13: 1ffffffff0cc3880 R14: dffffc0000000000 R15: dffffc0000000000 [ 31.133712][ C0] arch_cpu_idle+0xa/0x10 [ 31.138023][ C0] default_idle_call+0x71/0x1d0 [ 31.142850][ C0] do_idle+0x217/0x620 [ 31.146907][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 31.152078][ C0] cpu_startup_entry+0x18/0x20 [ 31.156814][ C0] rest_init+0x10a/0x130 [ 31.161028][ C0] ? time_init+0x40/0x40 [ 31.165373][ C0] arch_call_rest_init+0xe/0x10 [ 31.170251][ C0] start_kernel+0x46d/0x4e0 [ 31.174750][ C0] x86_64_start_reservations+0x2a/0x30 [ 31.180221][ C0] x86_64_start_kernel+0x5b/0x60 [ 31.185360][ C0] secondary_startup_64_no_verify+0xb1/0xbb [ 31.191244][ C0] [ 31.194244][ C0] [ 31.196540][ C0] The buggy address belongs to the variable: [ 31.202482][ C0] .str.60+0xc/0x20 [ 31.206272][ C0] [ 31.208577][ C0] Memory state around the buggy address: [ 31.214205][ C0] ffffffff857ee280: f9 f9 f9 f9 06 f9 f9 f9 00 01 f9 f9 04 f9 f9 f9 [ 31.222262][ C0] ffffffff857ee300: 00 f9 f9 f9 06 f9 f9 f9 07 f9 f9 f9 06 f9 f9 f9 [ 31.230304][ C0] >ffffffff857ee380: 00 04 f9 f9 05 f9 f9 f9 00 03 f9 f9 00 03 f9 f9 [ 31.238336][ C0] ^ [ 31.245770][ C0] ffffffff857ee400: 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 [ 31.253808][ C0] ffffffff857ee480: 03 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 01 f9 f9 f9 [ 31.261842][ C0] ================================================================== [ 31.269874][ C0] Disabling lock debugging due to kernel taint [ 31.276002][ C0] ================================================================================ [ 31.285246][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 31.293802][ C0] index 548 is out of range for type 'const int[34]' [ 31.300465][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B syzkaller #0 [ 31.308854][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 31.318908][ C0] Call Trace: [ 31.322174][ C0] [ 31.324994][ C0] __dump_stack+0x21/0x30 [ 31.329302][ C0] dump_stack_lvl+0x110/0x170 [ 31.333955][ C0] ? show_regs_print_info+0x20/0x20 [ 31.339125][ C0] dump_stack+0x15/0x20 [ 31.343251][ C0] ubsan_epilogue+0xe/0x40 [ 31.347639][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0 [ 31.353339][ C0] aiptek_irq+0x1f14/0x29b0 [ 31.357818][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 31.363596][ C0] ? kcov_remote_start+0xf3/0x350 [ 31.368593][ C0] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 31.373942][ C0] usb_hcd_giveback_urb+0x11d/0x3f0 [ 31.379115][ C0] ? _raw_spin_unlock+0x4d/0x70 [ 31.383957][ C0] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 31.389829][ C0] dummy_timer+0xa34/0x31d0 [ 31.394321][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 31.399501][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 31.404674][ C0] call_timer_fn+0x38/0x290 [ 31.409166][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 31.414350][ C0] __run_timers+0x637/0x9a0 [ 31.418839][ C0] ? calc_index+0x200/0x200 [ 31.423388][ C0] ? sched_clock_cpu+0x18/0x3d0 [ 31.428257][ C0] run_timer_softirq+0x6a/0xf0 [ 31.433011][ C0] handle_softirqs+0x250/0x560 [ 31.437753][ C0] ? irqtime_account_irq+0xbe/0x390 [ 31.442928][ C0] __irq_exit_rcu+0x52/0xf0 [ 31.447408][ C0] irq_exit_rcu+0x9/0x10 [ 31.451627][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 31.457243][ C0] [ 31.460176][ C0] [ 31.463082][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 31.469434][ C0] RIP: 0010:default_idle+0xf/0x20 [ 31.474465][ C0] Code: 8c 4b ff ff ff 4c 89 f7 e8 6e d2 f5 fc e9 3e ff ff ff 00 00 cc cc 00 00 cc cc 00 55 48 89 e5 66 90 0f 00 2d 43 12 52 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 [ 31.494052][ C0] RSP: 0018:ffffffff86607d78 EFLAGS: 00000246 [ 31.500102][ C0] RAX: 0000000000003e28 RBX: ffffffff8661c400 RCX: 0000000000003e28 [ 31.508050][ C0] RDX: 0000000000000001 RSI: ffffffff85638320 RDI: ffffffff856382e0 [ 31.515998][ C0] RBP: ffffffff86607d78 R08: ffff8881f7038c73 R09: 1ffff1103ee0718e [ 31.523942][ C0] R10: dffffc0000000000 R11: ffffed103ee0718f R12: 0000000000000000 [ 31.531889][ C0] R13: 1ffffffff0cc3880 R14: dffffc0000000000 R15: dffffc0000000000 [ 31.539840][ C0] arch_cpu_idle+0xa/0x10 [ 31.544149][ C0] default_idle_call+0x71/0x1d0 [ 31.548994][ C0] do_idle+0x217/0x620 [ 31.553041][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 31.558212][ C0] cpu_startup_entry+0x18/0x20 [ 31.562951][ C0] rest_init+0x10a/0x130 [ 31.567169][ C0] ? time_init+0x40/0x40 [ 31.571383][ C0] arch_call_rest_init+0xe/0x10 [ 31.576206][ C0] start_kernel+0x46d/0x4e0 [ 31.580681][ C0] x86_64_start_reservations+0x2a/0x30 [ 31.586110][ C0] x86_64_start_kernel+0x5b/0x60 [ 31.591021][ C0] secondary_startup_64_no_verify+0xb1/0xbb [ 31.596904][ C0] [ 31.599897][ C0] ================================================================================ [ 31.613955][ T6] usb 3-1: USB disconnect, device number 3 [ 31.627246][ C0] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19