ci2-android-6-12-rust/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-12-rust/syz-executor1543833694 <...> Warning: Permanently added '10.128.1.121' (ED25519) to the list of known hosts. execve("ci2-android-6-12-rust/syz-executor1543833694", ["ci2-android-6-12-rust/syz-executor1543833694"], 0x7ffef1991480 /* 10 vars */) = 0 brk(NULL) = 0x555580986000 brk(0x555580986d40) = 0x555580986d40 arch_prctl(ARCH_SET_FS, 0x5555809863c0) = 0 set_tid_address(0x555580986690) = 313 set_robust_list(0x5555809866a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-12-rust/syz-executor1543833694", 4096) = 50 getrandom("\xaa\x1a\xf2\x92\x0c\x7a\x09\xf9", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555580986d40 brk(0x5555809a7d40) = 0x5555809a7d40 brk(0x5555809a8000) = 0x5555809a8000 mprotect(0x7fd50e920000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 write(1, "executing program\n", 18) = 18 executing program add_key(NULL, NULL, "\x30\x82\x05\x55\x30\x82\x03\x3d\xa0\x03\x02\x01\x02\x02\x14\x73\x98\xea\x98\x2d\xd0\x2e\xa8\xb1\xcf\x57\xc7\xf2\x97\xb3\xe6\x1a\xfc\x8c\x0a\x30\x0d\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x01\x0b\x05\x00\x30\x34\x31\x32\x30\x30\x06\x03\x55", 59, 0) = -1 EFAULT (Bad address) openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 ioctl(3, USB_RAW_IOCTL_INIT, 0x7fff38194720) = 0 ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194720) = 0 [ 31.777478][ T36] audit: type=1400 audit(1789234686.860:64): avc: denied { execmem } for pid=313 comm="syz-executor154" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 31.799333][ T36] audit: type=1400 audit(1789234686.860:65): avc: denied { read write } for pid=313 comm="syz-executor154" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194720) = 0 [ 31.823200][ T36] audit: type=1400 audit(1789234686.860:66): avc: denied { open } for pid=313 comm="syz-executor154" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.846843][ T36] audit: type=1400 audit(1789234686.860:67): avc: denied { ioctl } for pid=313 comm="syz-executor154" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194720) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194720) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff38193710) = 18 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194720) = 0 [ 32.012298][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194720) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194720) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff38193710) = 18 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194720) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff38193710) = 9 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194720) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff38193710) = 36 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194720) = 0 ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0) = 0 ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fd50e926b4c) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff38193710) = 0 [ 32.164634][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.175772][ T10] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 32.184886][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.194196][ T10] usb 1-1: config 0 descriptor?? close(3) = 0 [ 32.403623][ T10] usbhid 1-1:0.0: can't add hid device: -71 [ 32.409616][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 32.418133][ T10] usb 1-1: USB disconnect, device number 2 openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 ioctl(3, USB_RAW_IOCTL_INIT, 0x7fff38194730) = 0 ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194730) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194730) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194730) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194730) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff38193720) = 18 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194730) = 0 [ 32.842292][ T46] usb 1-1: new high-speed USB device number 3 using dummy_hcd ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194730) = 0 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194730) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff38193720) = 18 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194730) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff38193720) = 9 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194730) = 0 ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fff38193720) = 36 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194730) = 0 ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0) = 0 ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0) = -1 EINVAL (Invalid argument) ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fd50e926b4c) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff38193720) = 0 [ 32.994217][ T46] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.005394][ T46] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 33.014480][ T46] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.023268][ T46] usb 1-1: config 0 descriptor?? ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194760) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff38193750) = 3 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194760) = 0 ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fff38193750) = 3 ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fff38194760) = 0 ioctl(3, USB_RAW_IOCTL_EP0_STALL, 0) = 0 [ 33.843018][ T46] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 33.850608][ T46] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input4 [ 33.866851][ C1] ------------[ cut here ]------------ [ 33.872359][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 33.880947][ C1] index 21762 is out of range for type 'const int[34]' [ 33.887815][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 [ 33.887836][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.887852][ C1] Call Trace: [ 33.887858][ C1] [ 33.887865][ C1] __dump_stack+0x21/0x30 [ 33.887900][ C1] dump_stack_lvl+0x140/0x1c0 [ 33.887921][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 33.887943][ C1] ? common_startup_64+0x13b/0x157 [ 33.887966][ C1] dump_stack+0x19/0x20 [ 33.887986][ C1] ubsan_epilogue+0xe/0x40 [ 33.888000][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 33.888025][ C1] aiptek_irq+0x208d/0x2a00 [ 33.888048][ C1] ? _raw_spin_unlock+0x45/0x60 [ 33.888067][ C1] ? kcov_remote_start+0xfa/0x3c0 [ 33.888083][ C1] ? _raw_spin_lock+0x92/0x120 [ 33.888096][ C1] __usb_hcd_giveback_urb+0x36e/0x530 [ 33.888114][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 33.888129][ C1] dummy_timer+0xa3f/0x4900 [ 33.888152][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 33.888169][ C1] ? timerqueue_del+0xd7/0x130 [ 33.888190][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 33.888213][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 33.888229][ C1] __hrtimer_run_queues+0x3ab/0x8e0 [ 33.888254][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 33.888276][ C1] ? read_tsc+0xd/0x20 [ 33.888296][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 33.888316][ C1] hrtimer_run_softirq+0x159/0x560 [ 33.888330][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 33.888356][ C1] handle_softirqs+0x1aa/0x620 [ 33.888373][ C1] __irq_exit_rcu+0x47/0xb0 [ 33.888388][ C1] irq_exit_rcu+0xd/0x30 [ 33.888402][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 33.888422][ C1] [ 33.888427][ C1] [ 33.888432][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 33.888452][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 33.888473][ C1] Code: cc cc cc cc cc cc cc b8 0d ee 83 1e 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 03 48 42 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 33.888486][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2 [ 33.888505][ C1] RAX: ffff8881f6f00000 RBX: ffff88810366cc00 RCX: ffffffff85a514fd [ 33.888517][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000000196c4 [ 33.888526][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd [ 33.888537][ C1] R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000 [ 33.888548][ C1] R13: 1ffff110206cd980 R14: dffffc0000000000 R15: ffffffff87ece068 [ 33.888560][ C1] ? ct_kernel_exit+0x7d/0xb0 [ 33.888582][ C1] default_idle+0x17/0x30 [ 33.888602][ C1] arch_cpu_idle+0xd/0x20 [ 33.888623][ C1] default_idle_call+0x3e/0x80 [ 33.888644][ C1] do_idle+0x2fc/0x570 [ 33.888660][ C1] ? idle_inject_timer_fn+0x80/0x80 [ 33.888679][ C1] cpu_startup_entry+0x47/0x60 [ 33.888696][ C1] start_secondary+0x12e/0x140 [ 33.888717][ C1] common_startup_64+0x13b/0x157 [ 33.888740][ C1] [ 33.888745][ C1] ---[ end trace ]--- [ 34.185524][ C1] ------------[ cut here ]------------ [ 34.190973][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 34.199556][ C1] index 21763 is out of range for type 'const int[34]' [ 34.206396][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 [ 34.206416][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.206426][ C1] Call Trace: [ 34.206432][ C1] [ 34.206439][ C1] __dump_stack+0x21/0x30 [ 34.206465][ C1] dump_stack_lvl+0x140/0x1c0 [ 34.206487][ C1] ? __cfi_dump_stack_lvl+0x10/0x10 [ 34.206509][ C1] ? input_event_dispose+0x2f5/0x6d0 [ 34.206526][ C1] dump_stack+0x19/0x20 [ 34.206546][ C1] ubsan_epilogue+0xe/0x40 [ 34.206559][ C1] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 34.206583][ C1] aiptek_irq+0x1f3c/0x2a00 [ 34.206606][ C1] ? kcov_remote_start+0xfa/0x3c0 [ 34.206624][ C1] __usb_hcd_giveback_urb+0x36e/0x530 [ 34.206640][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 34.206655][ C1] dummy_timer+0xa3f/0x4900 [ 34.206679][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 34.206696][ C1] ? timerqueue_del+0xd7/0x130 [ 34.206717][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 34.206741][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 34.206756][ C1] __hrtimer_run_queues+0x3ab/0x8e0 [ 34.206781][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 34.206803][ C1] ? read_tsc+0xd/0x20 [ 34.206824][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 34.206844][ C1] hrtimer_run_softirq+0x159/0x560 [ 34.206857][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 34.206880][ C1] handle_softirqs+0x1aa/0x620 [ 34.206897][ C1] __irq_exit_rcu+0x47/0xb0 [ 34.206911][ C1] irq_exit_rcu+0xd/0x30 [ 34.206925][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 34.206945][ C1] [ 34.206950][ C1] [ 34.206956][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 34.206975][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 34.206997][ C1] Code: cc cc cc cc cc cc cc b8 0d ee 83 1e 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 03 48 42 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 [ 34.207009][ C1] RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2 [ 34.207022][ C1] RAX: ffff8881f6f00000 RBX: ffff88810366cc00 RCX: ffffffff85a514fd [ 34.207034][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000000196c4 [ 34.207044][ C1] RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd [ 34.207055][ C1] R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000 [ 34.207065][ C1] R13: 1ffff110206cd980 R14: dffffc0000000000 R15: ffffffff87ece068 [ 34.207078][ C1] ? ct_kernel_exit+0x7d/0xb0 [ 34.207128][ C1] default_idle+0x17/0x30 [ 34.207148][ C1] arch_cpu_idle+0xd/0x20 [ 34.207169][ C1] default_idle_call+0x3e/0x80 [ 34.207190][ C1] do_idle+0x2fc/0x570 [ 34.207206][ C1] ? idle_inject_timer_fn+0x80/0x80 [ 34.207225][ C1] cpu_startup_entry+0x47/0x60 [ 34.207242][ C1] start_secondary+0x12e/0x140 [ 34.207263][ C1] common_startup_64+0x13b/0x157 [ 34.207287][ C1] [ 34.207292][ C1] ---[ end trace ]--- ioctl(3, USB_RAW_IOCTL_EP_WRITE, 0x7fff38194760) = 4096 exit_group(0) = ? +++ exited with 0 +++