ci2-android-6-12-rust/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-12-rust/syz-executor2411283022
<...>
syzkaller
syzkaller login: [ 14.284832][ T36] kauditd_printk_skb: 26 callbacks suppressed
[ 14.284850][ T36] audit: type=1400 audit(1787302130.820:59): avc: denied { transition } for pid=231 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.289549][ T36] audit: type=1400 audit(1787302130.820:60): avc: denied { noatsecure } for pid=231 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.292527][ T36] audit: type=1400 audit(1787302130.830:61): avc: denied { write } for pid=231 comm="sh" path="pipe:[3112]" dev="pipefs" ino=3112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 14.295696][ T36] audit: type=1400 audit(1787302130.830:62): avc: denied { rlimitinh } for pid=231 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.298715][ T36] audit: type=1400 audit(1787302130.830:63): avc: denied { siginh } for pid=231 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '10.128.0.202' (ED25519) to the list of known hosts.
execve("ci2-android-6-12-rust/syz-executor2411283022", ["ci2-android-6-12-rust/syz-executor2411283022"], 0x7ffd84a46650 /* 10 vars */) = 0
brk(NULL) = 0x55558180a000
brk(0x55558180ad40) = 0x55558180ad40
arch_prctl(ARCH_SET_FS, 0x55558180a3c0) = 0
set_tid_address(0x55558180a690) = 312
set_robust_list(0x55558180a6a0, 24) = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-12-rust/syz-executor2411283022", 4096) = 50
getrandom("\xcf\x1a\x34\x00\xd2\x8e\x89\xe7", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55558180ad40
brk(0x55558182bd40) = 0x55558182bd40
brk(0x55558182c000) = 0x55558182c000
mprotect(0x7f7eb2aeb000, 20480, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
write(1, "executing program\n", 18) = 18
openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3
ioctl(3, USB_RAW_IOCTL_INIT, 0x7fff188f6020) = 0
ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6020) = 0
executing program
[ 24.291827][ T36] audit: type=1400 audit(1787302140.830:64): avc: denied { execmem } for pid=312 comm="syz-executor241" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 24.311421][ T36] audit: type=1400 audit(1787302140.830:65): avc: denied { read write } for pid=312 comm="syz-executor241" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6020) = 0
[ 24.335195][ T36] audit: type=1400 audit(1787302140.830:66): avc: denied { open } for pid=312 comm="syz-executor241" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 24.358809][ T36] audit: type=1400 audit(1787302140.830:67): avc: denied { ioctl } for pid=312 comm="syz-executor241" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6020) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6020) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff188f5010) = 18
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6020) = 0
[ 24.526386][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6020) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6020) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff188f5010) = 18
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6020) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff188f5010) = 9
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6020) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff188f5010) = 36
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6020) = 0
ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0) = 0
ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f7eb2af1b4c) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff188f5010) = 0
[ 24.678088][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 24.689072][ T10] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[ 24.698131][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 24.707517][ T10] usb 1-1: config 0 descriptor??
ioctl(-1, KDFONTOP, {op=0x4 /* KD_FONT_OP_??? */, flags=0, width=5, height=0, charcount=256, data=0x2000000000c0}) = -1 EBADF (Bad file descriptor)
close(3) = 0
[ 24.916359][ T10] usbhid 1-1:0.0: can't add hid device: -71
[ 24.922339][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -71
[ 24.930815][ T10] usb 1-1: USB disconnect, device number 2
openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3
ioctl(3, USB_RAW_IOCTL_INIT, 0x7fff188f6030) = 0
ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6030) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6030) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6030) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6030) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff188f5020) = 18
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6030) = 0
[ 25.356333][ T45] usb 1-1: new high-speed USB device number 3 using dummy_hcd
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6030) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6030) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff188f5020) = 18
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6030) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff188f5020) = 9
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6030) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff188f5020) = 36
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6030) = 0
ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0) = 0
ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0
ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0) = -1 EINVAL (Invalid argument)
ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f7eb2af1b4c) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff188f5020) = 0
[ 25.508660][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 25.519701][ T45] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40
[ 25.529027][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 25.537587][ T45] usb 1-1: config 0 descriptor??
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6060) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff188f5050) = 3
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6060) = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff188f5050) = 3
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff188f6060) = 0
ioctl(3, USB_RAW_IOCTL_EP0_STALL, 0) = 0
[ 26.347113][ T45] aiptek 1-1:0.0: Aiptek using 400 ms programming speed
[ 26.354646][ T45] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input4
[ 26.367718][ C1] ------------[ cut here ]------------
[ 26.373210][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
[ 26.381792][ C1] index 19545 is out of range for type 'const int[34]'
[ 26.388630][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 8b5107c30037f7cfe212f1198c23c0388356dd7c
[ 26.388647][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 26.388654][ C1] Call Trace:
[ 26.388659][ C1]
[ 26.388664][ C1] __dump_stack+0x21/0x30
[ 26.388683][ C1] dump_stack_lvl+0x140/0x1c0
[ 26.388697][ C1] ? __cfi_dump_stack_lvl+0x10/0x10
[ 26.388712][ C1] ? common_startup_64+0x13b/0x157
[ 26.388728][ C1] dump_stack+0x19/0x20
[ 26.388742][ C1] ubsan_epilogue+0xe/0x40
[ 26.388752][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0
[ 26.388768][ C1] aiptek_irq+0x208d/0x2a00
[ 26.388784][ C1] ? _raw_spin_unlock+0x45/0x60
[ 26.388799][ C1] ? kcov_remote_start+0xfa/0x3c0
[ 26.388810][ C1] ? _raw_spin_lock+0x92/0x120
[ 26.388824][ C1] __usb_hcd_giveback_urb+0x36e/0x530
[ 26.388836][ C1] usb_hcd_giveback_urb+0x12b/0x400
[ 26.388852][ C1] dummy_timer+0xa3f/0x4900
[ 26.388868][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 26.388878][ C1] ? timerqueue_del+0xd7/0x130
[ 26.388892][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0
[ 26.388907][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 26.388918][ C1] __hrtimer_run_queues+0x3ae/0x8e0
[ 26.388934][ C1] ? hrtimer_interrupt+0xf30/0xf30
[ 26.388948][ C1] ? read_tsc+0xd/0x20
[ 26.388962][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0
[ 26.388976][ C1] hrtimer_run_softirq+0x159/0x560
[ 26.388986][ C1] ? irqtime_account_irq+0x51/0x1c0
[ 26.389001][ C1] handle_softirqs+0x1aa/0x620
[ 26.389013][ C1] __irq_exit_rcu+0x47/0xb0
[ 26.389023][ C1] irq_exit_rcu+0xd/0x30
[ 26.389033][ C1] sysvec_apic_timer_interrupt+0x82/0x90
[ 26.389045][ C1]
[ 26.389049][ C1]
[ 26.389053][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30
[ 26.389066][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20
[ 26.389080][ C1] Code: cc cc cc cc cc cc cc b8 92 8e ac 7a 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 b9 42 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
[ 26.389089][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2
[ 26.389101][ C1] RAX: ffff8881f6f00000 RBX: ffff888103669300 RCX: ffffffff85a4a4fd
[ 26.389109][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000001a7f4
[ 26.389116][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd
[ 26.389124][ C1] R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000
[ 26.389132][ C1] R13: 1ffff110206cd260 R14: dffffc0000000000 R15: ffffffff87ecc9a8
[ 26.389141][ C1] ? ct_kernel_exit+0x7d/0xb0
[ 26.389154][ C1] default_idle+0x17/0x30
[ 26.389166][ C1] arch_cpu_idle+0xd/0x20
[ 26.389178][ C1] default_idle_call+0x3e/0x80
[ 26.389190][ C1] do_idle+0x2fc/0x570
[ 26.389202][ C1] ? idle_inject_timer_fn+0x80/0x80
[ 26.389215][ C1] cpu_startup_entry+0x47/0x60
[ 26.389227][ C1] start_secondary+0x12e/0x140
[ 26.389241][ C1] common_startup_64+0x13b/0x157
[ 26.389256][ C1]
[ 26.389260][ C1] ---[ end trace ]---
[ 26.685191][ C1] ------------[ cut here ]------------
[ 26.690718][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
[ 26.699286][ C1] index 19546 is out of range for type 'const int[34]'
[ 26.706117][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 8b5107c30037f7cfe212f1198c23c0388356dd7c
[ 26.706132][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 26.706139][ C1] Call Trace:
[ 26.706143][ C1]
[ 26.706149][ C1] __dump_stack+0x21/0x30
[ 26.706166][ C1] dump_stack_lvl+0x140/0x1c0
[ 26.706181][ C1] ? __cfi_dump_stack_lvl+0x10/0x10
[ 26.706195][ C1] ? input_event_dispose+0x2f5/0x6d0
[ 26.706207][ C1] dump_stack+0x19/0x20
[ 26.706221][ C1] ubsan_epilogue+0xe/0x40
[ 26.706230][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0
[ 26.706247][ C1] aiptek_irq+0x1f3c/0x2a00
[ 26.706263][ C1] ? kcov_remote_start+0xfa/0x3c0
[ 26.706275][ C1] __usb_hcd_giveback_urb+0x36e/0x530
[ 26.706286][ C1] usb_hcd_giveback_urb+0x12b/0x400
[ 26.706302][ C1] dummy_timer+0xa3f/0x4900
[ 26.706317][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 26.706328][ C1] ? timerqueue_del+0xd7/0x130
[ 26.706341][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0
[ 26.706357][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 26.706372][ C1] __hrtimer_run_queues+0x3ae/0x8e0
[ 26.706388][ C1] ? hrtimer_interrupt+0xf30/0xf30
[ 26.706403][ C1] ? read_tsc+0xd/0x20
[ 26.706417][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0
[ 26.706430][ C1] hrtimer_run_softirq+0x159/0x560
[ 26.706440][ C1] ? irqtime_account_irq+0x51/0x1c0
[ 26.706455][ C1] handle_softirqs+0x1aa/0x620
[ 26.706467][ C1] __irq_exit_rcu+0x47/0xb0
[ 26.706478][ C1] irq_exit_rcu+0xd/0x30
[ 26.706487][ C1] sysvec_apic_timer_interrupt+0x82/0x90
[ 26.706499][ C1]
[ 26.706503][ C1]
[ 26.706507][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30
[ 26.706518][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20
[ 26.706532][ C1] Code: cc cc cc cc cc cc cc b8 92 8e ac 7a 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 b9 42 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
[ 26.706541][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2
[ 26.706552][ C1] RAX: ffff8881f6f00000 RBX: ffff888103669300 RCX: ffffffff85a4a4fd
[ 26.706560][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000001a7f4
[ 26.706568][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd
[ 26.706575][ C1] R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000
[ 26.706583][ C1] R13: 1ffff110206cd260 R14: dffffc0000000000 R15: ffffffff87ecc9a8
[ 26.706592][ C1] ? ct_kernel_exit+0x7d/0xb0
[ 26.706605][ C1] default_idle+0x17/0x30
[ 26.706617][ C1] arch_cpu_idle+0xd/0x20
[ 26.706629][ C1] default_idle_call+0x3e/0x80
[ 26.706641][ C1] do_idle+0x2fc/0x570
[ 26.706653][ C1] ? idle_inject_timer_fn+0x80/0x80
[ 26.706666][ C1] cpu_startup_entry+0x47/0x60
[ 26.706677][ C1] start_secondary+0x12e/0x140
[ 26.706692][ C1] common_startup_64+0x13b/0x157
[ 26.706707][ C1]
[ 26.706711][ C1] ---[ end trace ]---
ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7fff188f6060) = 4096
exit_group(0) = ?
+++ exited with 0 +++