Warning: Permanently added '10.128.0.218' (ED25519) to the list of known hosts.
2026/06/10 15:58:20 parsed 1 programs
[ 26.763249][ T28] audit: type=1400 audit(1781107100.233:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 26.784815][ T28] audit: type=1400 audit(1781107100.233:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 27.908865][ T28] audit: type=1400 audit(1781107101.373:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 27.912585][ T301] cgroup: Unknown subsys name 'net'
[ 27.931668][ T28] audit: type=1400 audit(1781107101.373:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 27.959042][ T28] audit: type=1400 audit(1781107101.413:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 27.959585][ T301] cgroup: Unknown subsys name 'devices'
[ 28.104620][ T301] cgroup: Unknown subsys name 'hugetlb'
[ 28.110252][ T301] cgroup: Unknown subsys name 'rlimit'
[ 28.223257][ T28] audit: type=1400 audit(1781107101.693:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 28.246511][ T28] audit: type=1400 audit(1781107101.693:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 28.266999][ T28] audit: type=1400 audit(1781107101.693:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 28.287369][ T28] audit: type=1400 audit(1781107101.693:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 28.307793][ T28] audit: type=1400 audit(1781107101.693:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 28.319959][ T306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 28.383009][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 29.067838][ T308] request_module fs-gadgetfs succeeded, but still no fs?
[ 29.880760][ T359] bridge0: port 1(bridge_slave_0) entered blocking state
[ 29.887880][ T359] bridge0: port 1(bridge_slave_0) entered disabled state
[ 29.895407][ T359] device bridge_slave_0 entered promiscuous mode
[ 29.902399][ T359] bridge0: port 2(bridge_slave_1) entered blocking state
[ 29.909521][ T359] bridge0: port 2(bridge_slave_1) entered disabled state
[ 29.917118][ T359] device bridge_slave_1 entered promiscuous mode
[ 29.968720][ T359] bridge0: port 2(bridge_slave_1) entered blocking state
[ 29.975828][ T359] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 29.983303][ T359] bridge0: port 1(bridge_slave_0) entered blocking state
[ 29.990367][ T359] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 30.011267][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 30.018991][ T10] bridge0: port 1(bridge_slave_0) entered disabled state
[ 30.027275][ T10] bridge0: port 2(bridge_slave_1) entered disabled state
[ 30.041307][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 30.049762][ T10] bridge0: port 1(bridge_slave_0) entered blocking state
[ 30.056838][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 30.065854][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 30.074117][ T10] bridge0: port 2(bridge_slave_1) entered blocking state
[ 30.081143][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 30.098029][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 30.107056][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 30.123332][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 30.140657][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 30.148903][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 30.156640][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 30.164979][ T359] device veth0_vlan entered promiscuous mode
[ 30.179264][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 30.188532][ T359] device veth1_macvtap entered promiscuous mode
[ 30.198202][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 30.208472][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
2026/06/10 15:58:23 executed programs: 0
[ 30.450639][ T370] bridge0: port 1(bridge_slave_0) entered blocking state
[ 30.457918][ T370] bridge0: port 1(bridge_slave_0) entered disabled state
[ 30.465543][ T370] device bridge_slave_0 entered promiscuous mode
[ 30.473019][ T370] bridge0: port 2(bridge_slave_1) entered blocking state
[ 30.480079][ T370] bridge0: port 2(bridge_slave_1) entered disabled state
[ 30.487720][ T370] device bridge_slave_1 entered promiscuous mode
[ 30.535305][ T370] bridge0: port 2(bridge_slave_1) entered blocking state
[ 30.542354][ T370] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 30.549659][ T370] bridge0: port 1(bridge_slave_0) entered blocking state
[ 30.556709][ T370] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 30.576900][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 30.584587][ T10] bridge0: port 1(bridge_slave_0) entered disabled state
[ 30.591807][ T10] bridge0: port 2(bridge_slave_1) entered disabled state
[ 30.601684][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 30.610312][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 30.618573][ T10] bridge0: port 1(bridge_slave_0) entered blocking state
[ 30.625609][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 30.634367][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 30.642757][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 30.650868][ T10] bridge0: port 2(bridge_slave_1) entered blocking state
[ 30.657923][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 30.669508][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 30.677680][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 30.687072][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 30.695268][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 30.708995][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 30.717479][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 30.729128][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 30.737295][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 30.745931][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 30.753833][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 30.762147][ T370] device veth0_vlan entered promiscuous mode
[ 30.772682][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 30.780933][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 30.790487][ T370] device veth1_macvtap entered promiscuous mode
[ 30.800073][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 30.808016][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 30.816620][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 30.832641][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 30.840999][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 31.132525][ T374] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 31.263496][ T8] device bridge_slave_1 left promiscuous mode
[ 31.269724][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 31.277331][ T8] device bridge_slave_0 left promiscuous mode
[ 31.283545][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 31.291571][ T8] device veth1_macvtap left promiscuous mode
[ 31.297789][ T8] device veth0_vlan left promiscuous mode
[ 31.323733][ T374] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 31.334725][ T374] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[ 31.347300][ T374] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 31.359162][ T374] usb 3-1: config 0 descriptor??
[ 31.566950][ T374] usbhid 3-1:0.0: can't add hid device: -71
[ 31.572959][ T374] usbhid: probe of 3-1:0.0 failed with error -71
[ 31.579997][ T374] usb 3-1: USB disconnect, device number 2
[ 32.152505][ T374] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[ 32.333598][ T374] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 32.344556][ T374] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40
[ 32.353636][ T374] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 32.362374][ T374] usb 3-1: config 0 descriptor??
[ 33.182934][ T374] aiptek 3-1:0.0: Aiptek using 400 ms programming speed
[ 33.190584][ T374] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input4
[ 33.248061][ C1] ================================================================================
[ 33.257370][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
[ 33.265978][ C1] index 4775 is out of range for type 'const int[34]'
[ 33.272765][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
[ 33.279799][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 33.289873][ C1] Call Trace:
[ 33.293199][ C1]
[ 33.296048][ C1] __dump_stack+0x21/0x24
[ 33.300397][ C1] dump_stack_lvl+0x110/0x170
[ 33.305085][ C1] ? __cfi_dump_stack_lvl+0x8/0x8
[ 33.310147][ C1] dump_stack+0x15/0x24
[ 33.314309][ C1] ubsan_epilogue+0xe/0x40
[ 33.318736][ C1] __ubsan_handle_out_of_bounds+0xdf/0xf0
[ 33.324459][ C1] ? __kasan_check_write+0x14/0x20
[ 33.329580][ C1] aiptek_irq+0x208d/0x29b0
[ 33.334084][ C1] ? kcov_remote_start+0xe8/0x370
[ 33.339126][ C1] ? usb_unanchor_urb+0xa1/0xc0
[ 33.344006][ C1] __usb_hcd_giveback_urb+0x364/0x520
[ 33.349407][ C1] usb_hcd_giveback_urb+0x11c/0x410
[ 33.354617][ C1] dummy_timer+0x88c/0x3070
[ 33.359150][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 33.364104][ C1] ? timerqueue_del+0xd3/0x120
[ 33.368887][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 33.373835][ C1] __hrtimer_run_queues+0x3bb/0x8e0
[ 33.379058][ C1] ? hrtimer_interrupt+0x8c0/0x8c0
[ 33.384209][ C1] hrtimer_run_softirq+0x19b/0x260
[ 33.389330][ C1] handle_softirqs+0x1d7/0x600
[ 33.394100][ C1] ? irqtime_account_irq+0xc4/0x240
[ 33.399312][ C1] __irq_exit_rcu+0x52/0xf0
[ 33.403819][ C1] irq_exit_rcu+0x9/0x10
[ 33.408063][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 33.413711][ C1]
[ 33.416639][ C1]
[ 33.419574][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 33.425564][ C1] RIP: 0010:default_idle+0xf/0x20
[ 33.430590][ C1] Code: 37 e3 b4 fc e9 3d ff ff ff 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 23 f3 63 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[ 33.450193][ C1] RSP: 0018:ffffc90000147dd8 EFLAGS: 00000257
[ 33.456276][ C1] RAX: ffff8881f6f00000 RBX: ffff888100333cc0 RCX: 1e30b99ca2d91000
[ 33.464252][ C1] RDX: 0000000000000001 RSI: ffffffff85ca8e00 RDI: ffffffff85ca8dc0
[ 33.472227][ C1] RBP: ffffc90000147dd8 R08: ffff8881f6f348b3 R09: 1ffff1103ede6916
[ 33.480234][ C1] R10: 0000000000000000 R11: ffffffff85023e50 R12: dffffc0000000000
[ 33.488205][ C1] R13: 0000000000000001 R14: ffff888100333cc0 R15: dffffc0000000000
[ 33.496207][ C1] ? __cfi_default_idle+0x10/0x10
[ 33.501254][ C1] arch_cpu_idle+0x1c/0x20
[ 33.505695][ C1] default_idle_call+0x71/0x1d0
[ 33.510574][ C1] do_idle+0x354/0x640
[ 33.514666][ C1] ? ct_irq_exit+0x9/0x10
[ 33.519010][ C1] ? irqentry_exit+0x30/0x40
[ 33.523604][ C1] ? idle_inject_timer_fn+0x60/0x60
[ 33.528812][ C1] cpu_startup_entry+0x43/0x60
[ 33.533583][ C1] start_secondary+0x119/0x120
[ 33.538363][ C1] secondary_startup_64_no_verify+0xce/0xdb
[ 33.544263][ C1]
[ 33.547283][ C1] ================================================================================
[ 33.556585][ C1] ==================================================================
[ 33.564648][ C1] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x20ab/0x29b0
[ 33.572197][ C1] Read of size 4 at addr ffffffff85e6f19c by task swapper/1/0
[ 33.579647][ C1]
[ 33.581974][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
[ 33.588991][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 33.599048][ C1] Call Trace:
[ 33.602331][ C1]
[ 33.605176][ C1] __dump_stack+0x21/0x24
[ 33.609516][ C1] dump_stack_lvl+0x110/0x170
[ 33.614197][ C1] ? __cfi_dump_stack_lvl+0x8/0x8
[ 33.619231][ C1] ? _printk+0xda/0x128
[ 33.623386][ C1] ? aiptek_irq+0x20ab/0x29b0
[ 33.628076][ C1] print_address_description+0x71/0x200
[ 33.633625][ C1] print_report+0x4a/0x60
[ 33.637964][ C1] kasan_report+0x122/0x150
[ 33.642480][ C1] ? aiptek_irq+0x20ab/0x29b0
[ 33.647158][ C1] __asan_report_load4_noabort+0x14/0x20
[ 33.652804][ C1] aiptek_irq+0x20ab/0x29b0
[ 33.657328][ C1] ? kcov_remote_start+0xe8/0x370
[ 33.662370][ C1] ? usb_unanchor_urb+0xa1/0xc0
[ 33.667371][ C1] __usb_hcd_giveback_urb+0x364/0x520
[ 33.672820][ C1] usb_hcd_giveback_urb+0x11c/0x410
[ 33.678116][ C1] dummy_timer+0x88c/0x3070
[ 33.682628][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 33.687571][ C1] ? timerqueue_del+0xd3/0x120
[ 33.692338][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 33.697281][ C1] __hrtimer_run_queues+0x3bb/0x8e0
[ 33.702494][ C1] ? hrtimer_interrupt+0x8c0/0x8c0
[ 33.707630][ C1] hrtimer_run_softirq+0x19b/0x260
[ 33.712739][ C1] handle_softirqs+0x1d7/0x600
[ 33.717507][ C1] ? irqtime_account_irq+0xc4/0x240
[ 33.722717][ C1] __irq_exit_rcu+0x52/0xf0
[ 33.727249][ C1] irq_exit_rcu+0x9/0x10
[ 33.731502][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 33.737142][ C1]
[ 33.740075][ C1]
[ 33.743010][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 33.749017][ C1] RIP: 0010:default_idle+0xf/0x20
[ 33.754173][ C1] Code: 37 e3 b4 fc e9 3d ff ff ff 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 23 f3 63 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[ 33.773778][ C1] RSP: 0018:ffffc90000147dd8 EFLAGS: 00000257
[ 33.779880][ C1] RAX: ffff8881f6f00000 RBX: ffff888100333cc0 RCX: 1e30b99ca2d91000
[ 33.787849][ C1] RDX: 0000000000000001 RSI: ffffffff85ca8e00 RDI: ffffffff85ca8dc0
[ 33.795828][ C1] RBP: ffffc90000147dd8 R08: ffff8881f6f348b3 R09: 1ffff1103ede6916
[ 33.803802][ C1] R10: 0000000000000000 R11: ffffffff85023e50 R12: dffffc0000000000
[ 33.811773][ C1] R13: 0000000000000001 R14: ffff888100333cc0 R15: dffffc0000000000
[ 33.819752][ C1] ? __cfi_default_idle+0x10/0x10
[ 33.824793][ C1] arch_cpu_idle+0x1c/0x20
[ 33.829215][ C1] default_idle_call+0x71/0x1d0
[ 33.834576][ C1] do_idle+0x354/0x640
[ 33.839508][ C1] ? ct_irq_exit+0x9/0x10
[ 33.843856][ C1] ? irqentry_exit+0x30/0x40
[ 33.848451][ C1] ? idle_inject_timer_fn+0x60/0x60
[ 33.853656][ C1] cpu_startup_entry+0x43/0x60
[ 33.858451][ C1] start_secondary+0x119/0x120
[ 33.863223][ C1] secondary_startup_64_no_verify+0xce/0xdb
[ 33.869138][ C1]
[ 33.872169][ C1]
[ 33.874487][ C1] The buggy address belongs to the variable:
[ 33.880483][ C1] .str.3+0x3c/0x60
[ 33.884298][ C1]
[ 33.886622][ C1] The buggy address belongs to the physical page:
[ 33.893030][ C1] page:ffffea0000179bc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e6f
[ 33.903116][ C1] flags: 0x1000(reserved|zone=0)
[ 33.908078][ C1] raw: 0000000000001000 ffffea0000179bc8 ffffea0000179bc8 0000000000000000
[ 33.916660][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 33.925262][ C1] page dumped because: kasan: bad access detected
[ 33.931679][ C1] page_owner info is not present (never set?)
[ 33.937733][ C1]
[ 33.940059][ C1] Memory state around the buggy address:
[ 33.945706][ C1] ffffffff85e6f080: 00 00 00 00 00 00 00 00 00 01 f9 f9 04 f9 f9 f9
[ 33.953857][ C1] ffffffff85e6f100: 00 00 00 00 00 02 f9 f9 f9 f9 f9 f9 00 00 00 00
[ 33.961925][ C1] >ffffffff85e6f180: 00 00 00 04 f9 f9 f9 f9 00 00 00 00 00 00 02 f9
[ 33.969976][ C1] ^
[ 33.974824][ C1] ffffffff85e6f200: f9 f9 f9 f9 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
[ 33.982886][ C1] ffffffff85e6f280: 00 00 00 00 00 00 01 f9 f9 f9 f9 f9 00 00 00 02
[ 33.990942][ C1] ==================================================================
[ 33.999028][ C1] Disabling lock debugging due to kernel taint
[ 34.005179][ C1] ================================================================================
[ 34.014458][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
[ 34.023048][ C1] index 4776 is out of range for type 'const int[34]'
[ 34.030008][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B syzkaller #0
[ 34.038526][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 34.048616][ C1] Call Trace:
[ 34.051900][ C1]
[ 34.054745][ C1] __dump_stack+0x21/0x24
[ 34.059096][ C1] dump_stack_lvl+0x110/0x170
[ 34.063810][ C1] ? __cfi_dump_stack_lvl+0x8/0x8
[ 34.068859][ C1] dump_stack+0x15/0x24
[ 34.073028][ C1] ubsan_epilogue+0xe/0x40
[ 34.077461][ C1] __ubsan_handle_out_of_bounds+0xdf/0xf0
[ 34.083197][ C1] aiptek_irq+0x1f6d/0x29b0
[ 34.087719][ C1] __usb_hcd_giveback_urb+0x364/0x520
[ 34.093115][ C1] usb_hcd_giveback_urb+0x11c/0x410
[ 34.098335][ C1] dummy_timer+0x88c/0x3070
[ 34.102862][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 34.107804][ C1] ? timerqueue_del+0xd3/0x120
[ 34.112572][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 34.117512][ C1] __hrtimer_run_queues+0x3bb/0x8e0
[ 34.122722][ C1] ? hrtimer_interrupt+0x8c0/0x8c0
[ 34.127846][ C1] hrtimer_run_softirq+0x19b/0x260
[ 34.132961][ C1] handle_softirqs+0x1d7/0x600
[ 34.137728][ C1] ? irqtime_account_irq+0xc4/0x240
[ 34.142936][ C1] __irq_exit_rcu+0x52/0xf0
[ 34.147452][ C1] irq_exit_rcu+0x9/0x10
[ 34.151710][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 34.157403][ C1]
[ 34.160436][ C1]
[ 34.163373][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 34.169366][ C1] RIP: 0010:default_idle+0xf/0x20
[ 34.174402][ C1] Code: 37 e3 b4 fc e9 3d ff ff ff 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 23 f3 63 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[ 34.194014][ C1] RSP: 0018:ffffc90000147dd8 EFLAGS: 00000257
[ 34.200092][ C1] RAX: ffff8881f6f00000 RBX: ffff888100333cc0 RCX: 1e30b99ca2d91000
[ 34.208072][ C1] RDX: 0000000000000001 RSI: ffffffff85ca8e00 RDI: ffffffff85ca8dc0
[ 34.212814][ T6] usb 3-1: USB disconnect, device number 3
[ 34.216067][ C1] RBP: ffffc90000147dd8 R08: ffff8881f6f348b3 R09: 1ffff1103ede6916
[ 34.230047][ C1] R10: 0000000000000000 R11: ffffffff85023e50 R12: dffffc0000000000
[ 34.238058][ C1] R13: 0000000000000001 R14: ffff888100333cc0 R15: dffffc0000000000
[ 34.246070][ C1] ? __cfi_default_idle+0x10/0x10
[ 34.251146][ C1] arch_cpu_idle+0x1c/0x20
[ 34.255608][ C1] default_idle_call+0x71/0x1d0
[ 34.260512][ C1] do_idle+0x354/0x640
[ 34.264628][ C1] ? ct_irq_exit+0x9/0x10
[ 34.269011][ C1] ? irqentry_exit+0x30/0x40
[ 34.273648][ C1] ? idle_inject_timer_fn+0x60/0x60
[ 34.278899][ C1] cpu_startup_entry+0x43/0x60
[ 34.283707][ C1] start_secondary+0x119/0x120
[ 34.288514][ C1] secondary_startup_64_no_verify+0xce/0xdb
[ 34.294454][ C1]
[ 34.297515][ C1] ================================================================================
[ 34.306879][ C1] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
[ 34.316185][ T28] kauditd_printk_skb: 34 callbacks suppressed
[ 34.316202][ T28] audit: type=1400 audit(1781107107.723:108): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 34.346490][ T28] audit: type=1400 audit(1781107107.723:109): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 34.368430][ T28] audit: type=1400 audit(1781107107.723:110): avc: denied { write } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 34.389895][ T28] audit: type=1400 audit(1781107107.723:111): avc: denied { add_name } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 34.410548][ T28] audit: type=1400 audit(1781107107.723:112): avc: denied { create } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 34.431147][ T28] audit: type=1400 audit(1781107107.723:113): avc: denied { append open } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 34.454225][ T28] audit: type=1400 audit(1781107107.723:114): avc: denied { getattr } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1