rocess permissive=1
[ 15.467708][ T24] audit: type=1400 audit(1781163424.140:63): avc: denied { siginh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '10.128.0.244' (ED25519) to the list of known hosts.
2026/06/11 07:37:14 parsed 1 programs
[ 25.459921][ T24] audit: type=1400 audit(1781163434.180:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 25.481326][ T24] audit: type=1400 audit(1781163434.190:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1
[ 25.500896][ T24] audit: type=1400 audit(1781163434.190:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 26.398723][ T24] audit: type=1400 audit(1781163435.120:67): avc: denied { mounton } for pid=294 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 26.402677][ T294] cgroup: Unknown subsys name 'net'
[ 26.421506][ T24] audit: type=1400 audit(1781163435.120:68): avc: denied { mount } for pid=294 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 26.449367][ T24] audit: type=1400 audit(1781163435.150:69): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 26.449899][ T294] cgroup: Unknown subsys name 'devices'
[ 26.622106][ T294] cgroup: Unknown subsys name 'hugetlb'
[ 26.628239][ T294] cgroup: Unknown subsys name 'rlimit'
[ 26.807523][ T24] audit: type=1400 audit(1781163435.530:70): avc: denied { setattr } for pid=294 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 26.830712][ T24] audit: type=1400 audit(1781163435.530:71): avc: denied { create } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 26.852038][ T24] audit: type=1400 audit(1781163435.530:72): avc: denied { write } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 26.866747][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 26.872863][ T24] audit: type=1400 audit(1781163435.530:73): avc: denied { read } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 26.917088][ T294] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 27.376846][ T300] request_module fs-gadgetfs succeeded, but still no fs?
[ 27.388268][ T300] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation
[ 27.584873][ T316] bridge0: port 1(bridge_slave_0) entered blocking state
[ 27.592225][ T316] bridge0: port 1(bridge_slave_0) entered disabled state
[ 27.599579][ T316] device bridge_slave_0 entered promiscuous mode
[ 27.606668][ T316] bridge0: port 2(bridge_slave_1) entered blocking state
[ 27.613829][ T316] bridge0: port 2(bridge_slave_1) entered disabled state
[ 27.621335][ T316] device bridge_slave_1 entered promiscuous mode
[ 27.662287][ T316] bridge0: port 2(bridge_slave_1) entered blocking state
[ 27.669904][ T316] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 27.677382][ T316] bridge0: port 1(bridge_slave_0) entered blocking state
[ 27.684434][ T316] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 27.703761][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 27.711384][ T9] bridge0: port 1(bridge_slave_0) entered disabled state
[ 27.719545][ T9] bridge0: port 2(bridge_slave_1) entered disabled state
[ 27.728469][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 27.736709][ T9] bridge0: port 1(bridge_slave_0) entered blocking state
[ 27.743780][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 27.753261][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 27.761486][ T9] bridge0: port 2(bridge_slave_1) entered blocking state
[ 27.768897][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 27.780836][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 27.790042][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 27.805017][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 27.816856][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 27.825340][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 27.833001][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 27.841504][ T316] device veth0_vlan entered promiscuous mode
[ 27.851355][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 27.861405][ T316] device veth1_macvtap entered promiscuous mode
[ 27.870799][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 27.880932][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
2026/06/11 07:37:17 executed programs: 0
[ 28.541112][ T366] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.548244][ T366] bridge0: port 1(bridge_slave_0) entered disabled state
[ 28.555734][ T366] device bridge_slave_0 entered promiscuous mode
[ 28.562620][ T366] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.569651][ T366] bridge0: port 2(bridge_slave_1) entered disabled state
[ 28.577254][ T366] device bridge_slave_1 entered promiscuous mode
[ 28.632863][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 28.640749][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 28.649220][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 28.657980][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 28.667273][ T9] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.674338][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 28.682465][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 28.690854][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 28.699186][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 28.707409][ T9] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.714463][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 28.730554][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 28.739771][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 28.757517][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 28.768643][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 28.777340][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 28.784865][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 28.793055][ T366] device veth0_vlan entered promiscuous mode
[ 28.806652][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 28.816503][ T366] device veth1_macvtap entered promiscuous mode
[ 28.826208][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 28.835782][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 28.845007][ T7] device bridge_slave_1 left promiscuous mode
[ 28.851430][ T7] bridge0: port 2(bridge_slave_1) entered disabled state
[ 28.858822][ T7] device bridge_slave_0 left promiscuous mode
[ 28.865236][ T7] bridge0: port 1(bridge_slave_0) entered disabled state
[ 28.873304][ T7] device veth1_macvtap left promiscuous mode
[ 28.879310][ T7] device veth0_vlan left promiscuous mode
[ 29.220363][ T320] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 29.590430][ T320] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 29.601386][ T320] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[ 29.610893][ T320] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 29.621028][ T320] usb 3-1: config 0 descriptor??
[ 29.950372][ T320] usbhid 3-1:0.0: can't add hid device: -71
[ 29.956356][ T320] usbhid: probe of 3-1:0.0 failed with error -71
[ 29.963547][ T320] usb 3-1: USB disconnect, device number 2
[ 30.420361][ T320] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[ 30.780451][ T320] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 30.791638][ T320] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40
[ 30.800854][ T320] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 30.809605][ T320] usb 3-1: config 0 descriptor??
[ 31.720500][ T371] udc-core: couldn't find an available UDC or it's busy
[ 31.727593][ T371] misc raw-gadget: fail, usb_gadget_probe_driver returned -16
[ 31.740445][ T320] aiptek 3-1:0.0: Aiptek using 400 ms programming speed
[ 31.748510][ T320] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input4
[ 32.330354][ C0] ================================================================================
[ 32.339670][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
[ 32.348349][ C0] index 547 is out of range for type 'const int[34]'
[ 32.355029][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
[ 32.362070][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 32.372216][ C0] Call Trace:
[ 32.375495][ C0]
[ 32.378356][ C0] __dump_stack+0x21/0x24
[ 32.382675][ C0] dump_stack_lvl+0x1a7/0x208
[ 32.387351][ C0] ? show_regs_print_info+0x18/0x18
[ 32.392539][ C0] ? secondary_startup_64_no_verify+0xad/0xbb
[ 32.398618][ C0] dump_stack+0x15/0x1c
[ 32.402764][ C0] ubsan_epilogue+0xe/0x40
[ 32.407171][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0
[ 32.412883][ C0] aiptek_irq+0x1fdf/0x2860
[ 32.417381][ C0] ? debug_smp_processor_id+0x17/0x20
[ 32.422766][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80
[ 32.428583][ C0] ? usb_unanchor_urb+0xa1/0xc0
[ 32.433430][ C0] __usb_hcd_giveback_urb+0x333/0x4f0
[ 32.439056][ C0] usb_hcd_giveback_urb+0x119/0x410
[ 32.444246][ C0] ? _raw_spin_unlock+0x4d/0x70
[ 32.449094][ C0] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120
[ 32.454978][ C0] dummy_timer+0x8be/0x30e0
[ 32.459477][ C0] ? dummy_free_streams+0x5b0/0x5b0
[ 32.464668][ C0] ? dummy_free_streams+0x5b0/0x5b0
[ 32.469856][ C0] call_timer_fn+0x38/0x290
[ 32.474352][ C0] ? dummy_free_streams+0x5b0/0x5b0
[ 32.479542][ C0] __run_timers+0x650/0x9e0
[ 32.484040][ C0] ? calc_index+0x200/0x200
[ 32.489185][ C0] ? sched_clock_cpu+0x1b/0x3d0
[ 32.494367][ C0] run_timer_softirq+0x6a/0xf0
[ 32.499137][ C0] __do_softirq+0x255/0x563
[ 32.503643][ C0] asm_call_irq_on_stack+0xf/0x20
[ 32.508653][ C0]
[ 32.511590][ C0] do_softirq_own_stack+0x60/0x80
[ 32.516609][ C0] __irq_exit_rcu+0x128/0x150
[ 32.521285][ C0] irq_exit_rcu+0x9/0x10
[ 32.525651][ C0] sysvec_apic_timer_interrupt+0xbf/0xe0
[ 32.531418][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 32.537469][ C0] RIP: 0010:default_idle+0x12/0x20
[ 32.542621][ C0] Code: 44 2a 00 00 49 bd 00 00 00 00 00 fc ff df e9 67 ff ff ff e8 d0 f7 fa ff 55 48 89 e5 0f 1f 44 00 00 0f 00 2d b0 f6 61 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56
[ 32.562396][ C0] RSP: 0018:ffffffff86407d78 EFLAGS: 00000242
[ 32.568471][ C0] RAX: ffff8881f7000000 RBX: ffffffff8641c100 RCX: 00000000000072f6
[ 32.576466][ C0] RDX: 0000000000000001 RSI: ffffffff85409040 RDI: ffffffff85409000
[ 32.584441][ C0] RBP: ffffffff86407d78 R08: ffff8881f70573d3 R09: 1ffff1103ee0ae7a
[ 32.592427][ C0] R10: dffffc0000000000 R11: ffffed103ee0ae7b R12: 0000000000000000
[ 32.600429][ C0] R13: 1ffffffff0c83820 R14: dffffc0000000000 R15: dffffc0000000000
[ 32.608412][ C0] arch_cpu_idle+0xa/0x10
[ 32.612741][ C0] default_idle_call+0x71/0x1d0
[ 32.617726][ C0] do_idle+0x217/0x620
[ 32.621801][ C0] ? idle_inject_timer_fn+0x60/0x60
[ 32.627005][ C0] ? radix_tree_lookup+0x183/0x1d0
[ 32.632121][ C0] ? debug_smp_processor_id+0x17/0x20
[ 32.637491][ C0] cpu_startup_entry+0x18/0x20
[ 32.642250][ C0] rest_init+0xe8/0xf0
[ 32.646324][ C0] ? time_init+0x38/0x38
[ 32.650572][ C0] arch_call_rest_init+0xe/0x10
[ 32.655421][ C0] start_kernel+0x431/0x49f
[ 32.659925][ C0] x86_64_start_reservations+0x2a/0x2c
[ 32.665380][ C0] x86_64_start_kernel+0x60/0x63
[ 32.670314][ C0] secondary_startup_64_no_verify+0xad/0xbb
[ 32.676203][ C0] ================================================================================
[ 32.685479][ C0] ==================================================================
[ 32.693564][ C0] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x1ffd/0x2860
[ 32.701112][ C0] Read of size 4 at addr ffffffff855b380c by task swapper/0/0
[ 32.708552][ C0]
[ 32.710888][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
[ 32.718268][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 32.728321][ C0] Call Trace:
[ 32.731617][ C0]
[ 32.734467][ C0] __dump_stack+0x21/0x24
[ 32.738789][ C0] dump_stack_lvl+0x1a7/0x208
[ 32.743471][ C0] ? show_regs_print_info+0x18/0x18
[ 32.748685][ C0] ? thaw_kernel_threads+0x220/0x220
[ 32.753976][ C0] ? secondary_startup_64_no_verify+0xad/0xbb
[ 32.760045][ C0] print_address_description+0x7f/0x2c0
[ 32.765598][ C0] ? aiptek_irq+0x1ffd/0x2860
[ 32.770278][ C0] kasan_report+0xe2/0x130
[ 32.774710][ C0] ? aiptek_irq+0x1ffd/0x2860
[ 32.779423][ C0] __asan_report_load4_noabort+0x14/0x20
[ 32.785070][ C0] aiptek_irq+0x1ffd/0x2860
[ 32.789631][ C0] ? debug_smp_processor_id+0x17/0x20
[ 32.795026][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80
[ 32.800958][ C0] ? usb_unanchor_urb+0xa1/0xc0
[ 32.805830][ C0] __usb_hcd_giveback_urb+0x333/0x4f0
[ 32.811212][ C0] usb_hcd_giveback_urb+0x119/0x410
[ 32.816420][ C0] ? _raw_spin_unlock+0x4d/0x70
[ 32.821286][ C0] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120
[ 32.827179][ C0] dummy_timer+0x8be/0x30e0
[ 32.831695][ C0] ? dummy_free_streams+0x5b0/0x5b0
[ 32.836900][ C0] ? dummy_free_streams+0x5b0/0x5b0
[ 32.842101][ C0] call_timer_fn+0x38/0x290
[ 32.846738][ C0] ? dummy_free_streams+0x5b0/0x5b0
[ 32.851948][ C0] __run_timers+0x650/0x9e0
[ 32.856465][ C0] ? calc_index+0x200/0x200
[ 32.861009][ C0] ? sched_clock_cpu+0x1b/0x3d0
[ 32.865866][ C0] run_timer_softirq+0x6a/0xf0
[ 32.870637][ C0] __do_softirq+0x255/0x563
[ 32.875143][ C0] asm_call_irq_on_stack+0xf/0x20
[ 32.880165][ C0]
[ 32.883113][ C0] do_softirq_own_stack+0x60/0x80
[ 32.888136][ C0] __irq_exit_rcu+0x128/0x150
[ 32.892814][ C0] irq_exit_rcu+0x9/0x10
[ 32.897059][ C0] sysvec_apic_timer_interrupt+0xbf/0xe0
[ 32.902703][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 32.908686][ C0] RIP: 0010:default_idle+0x12/0x20
[ 32.913803][ C0] Code: 44 2a 00 00 49 bd 00 00 00 00 00 fc ff df e9 67 ff ff ff e8 d0 f7 fa ff 55 48 89 e5 0f 1f 44 00 00 0f 00 2d b0 f6 61 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56
[ 32.933507][ C0] RSP: 0018:ffffffff86407d78 EFLAGS: 00000242
[ 32.939672][ C0] RAX: ffff8881f7000000 RBX: ffffffff8641c100 RCX: 00000000000072f6
[ 32.947646][ C0] RDX: 0000000000000001 RSI: ffffffff85409040 RDI: ffffffff85409000
[ 32.955623][ C0] RBP: ffffffff86407d78 R08: ffff8881f70573d3 R09: 1ffff1103ee0ae7a
[ 32.963596][ C0] R10: dffffc0000000000 R11: ffffed103ee0ae7b R12: 0000000000000000
[ 32.971575][ C0] R13: 1ffffffff0c83820 R14: dffffc0000000000 R15: dffffc0000000000
[ 32.979557][ C0] arch_cpu_idle+0xa/0x10
[ 32.983897][ C0] default_idle_call+0x71/0x1d0
[ 32.988754][ C0] do_idle+0x217/0x620
[ 32.992829][ C0] ? idle_inject_timer_fn+0x60/0x60
[ 32.998039][ C0] ? radix_tree_lookup+0x183/0x1d0
[ 33.003157][ C0] ? debug_smp_processor_id+0x17/0x20
[ 33.008538][ C0] cpu_startup_entry+0x18/0x20
[ 33.013307][ C0] rest_init+0xe8/0xf0
[ 33.017378][ C0] ? time_init+0x38/0x38
[ 33.021674][ C0] arch_call_rest_init+0xe/0x10
[ 33.026548][ C0] start_kernel+0x431/0x49f
[ 33.031099][ C0] x86_64_start_reservations+0x2a/0x2c
[ 33.036565][ C0] x86_64_start_kernel+0x60/0x63
[ 33.041530][ C0] secondary_startup_64_no_verify+0xad/0xbb
[ 33.047438][ C0]
[ 33.049773][ C0] The buggy address belongs to the variable:
[ 33.055752][ C0] .str.57+0xc/0x20
[ 33.059558][ C0]
[ 33.061891][ C0] Memory state around the buggy address:
[ 33.067533][ C0] ffffffff855b3700: 04 f9 f9 f9 00 f9 f9 f9 06 f9 f9 f9 07 f9 f9 f9
[ 33.075595][ C0] ffffffff855b3780: 06 f9 f9 f9 00 04 f9 f9 05 f9 f9 f9 00 03 f9 f9
[ 33.083660][ C0] >ffffffff855b3800: 00 03 f9 f9 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9
[ 33.091717][ C0] ^
[ 33.096052][ C0] ffffffff855b3880: 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
[ 33.104133][ C0] ffffffff855b3900: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9
[ 33.112198][ C0] ==================================================================
[ 33.120263][ C0] Disabling lock debugging due to kernel taint
[ 33.126422][ C0] ================================================================================
[ 33.135710][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
[ 33.144295][ C0] index 548 is out of range for type 'const int[34]'
[ 33.150980][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B syzkaller #0
[ 33.159390][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 33.169452][ C0] Call Trace:
[ 33.172743][ C0]
[ 33.175606][ C0] __dump_stack+0x21/0x24
[ 33.179936][ C0] dump_stack_lvl+0x1a7/0x208
[ 33.184620][ C0] ? show_regs_print_info+0x18/0x18
[ 33.189820][ C0] ? _raw_spin_lock_irqsave+0xc2/0x130
[ 33.195419][ C0] ? __kasan_check_read+0x11/0x20
[ 33.200462][ C0] dump_stack+0x15/0x1c
[ 33.204628][ C0] ubsan_epilogue+0xe/0x40
[ 33.209057][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0
[ 33.214784][ C0] aiptek_irq+0x1ebf/0x2860
[ 33.219294][ C0] ? debug_smp_processor_id+0x17/0x20
[ 33.224678][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80
[ 33.230496][ C0] ? usb_unanchor_urb+0xa1/0xc0
[ 33.235355][ C0] __usb_hcd_giveback_urb+0x333/0x4f0
[ 33.240730][ C0] usb_hcd_giveback_urb+0x119/0x410
[ 33.245931][ C0] ? _raw_spin_unlock+0x4d/0x70
[ 33.251002][ C0] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120
[ 33.256908][ C0] dummy_timer+0x8be/0x30e0
[ 33.261436][ C0] ? dummy_free_streams+0x5b0/0x5b0
[ 33.266648][ C0] ? dummy_free_streams+0x5b0/0x5b0
[ 33.271856][ C0] call_timer_fn+0x38/0x290
[ 33.276398][ C0] ? dummy_free_streams+0x5b0/0x5b0
[ 33.281615][ C0] __run_timers+0x650/0x9e0
[ 33.286254][ C0] ? calc_index+0x200/0x200
[ 33.290769][ C0] ? sched_clock_cpu+0x1b/0x3d0
[ 33.295727][ C0] run_timer_softirq+0x6a/0xf0
[ 33.300547][ C0] __do_softirq+0x255/0x563
[ 33.305078][ C0] asm_call_irq_on_stack+0xf/0x20
[ 33.310108][ C0]
[ 33.313053][ C0] do_softirq_own_stack+0x60/0x80
[ 33.318083][ C0] __irq_exit_rcu+0x128/0x150
[ 33.322764][ C0] irq_exit_rcu+0x9/0x10
[ 33.327024][ C0] sysvec_apic_timer_interrupt+0xbf/0xe0
[ 33.332751][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 33.338741][ C0] RIP: 0010:default_idle+0x12/0x20
[ 33.343860][ C0] Code: 44 2a 00 00 49 bd 00 00 00 00 00 fc ff df e9 67 ff ff ff e8 d0 f7 fa ff 55 48 89 e5 0f 1f 44 00 00 0f 00 2d b0 f6 61 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56
[ 33.363557][ C0] RSP: 0018:ffffffff86407d78 EFLAGS: 00000242
[ 33.369668][ C0] RAX: ffff8881f7000000 RBX: ffffffff8641c100 RCX: 00000000000072f6
[ 33.377649][ C0] RDX: 0000000000000001 RSI: ffffffff85409040 RDI: ffffffff85409000
[ 33.386505][ C0] RBP: ffffffff86407d78 R08: ffff8881f70573d3 R09: 1ffff1103ee0ae7a
[ 33.394492][ C0] R10: dffffc0000000000 R11: ffffed103ee0ae7b R12: 0000000000000000
[ 33.402466][ C0] R13: 1ffffffff0c83820 R14: dffffc0000000000 R15: dffffc0000000000
[ 33.410454][ C0] arch_cpu_idle+0xa/0x10
[ 33.414789][ C0] default_idle_call+0x71/0x1d0
[ 33.419641][ C0] do_idle+0x217/0x620
[ 33.423719][ C0] ? idle_inject_timer_fn+0x60/0x60
[ 33.428924][ C0] ? radix_tree_lookup+0x183/0x1d0
[ 33.434048][ C0] ? debug_smp_processor_id+0x17/0x20
[ 33.439426][ C0] cpu_startup_entry+0x18/0x20
[ 33.444208][ C0] rest_init+0xe8/0xf0
[ 33.448283][ C0] ? time_init+0x38/0x38
[ 33.452547][ C0] arch_call_rest_init+0xe/0x10
[ 33.457405][ C0] start_kernel+0x431/0x49f
[ 33.461915][ C0] x86_64_start_reservations+0x2a/0x2c
[ 33.467375][ C0] x86_64_start_kernel+0x60/0x63
[ 33.472313][ C0] secondary_startup_64_no_verify+0xad/0xbb
[ 33.478208][ C0] ================================================================================
[ 33.490549][ T399] usb 3-1: USB disconnect, device number 3