[ 6.458481][ T28] audit: type=1400 audit(1785123790.563:58): avc: denied { read } for pid=195 comm="getty" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
syzkaller
syzkaller login: [ 14.072248][ T28] audit: type=1400 audit(1785123798.183:59): avc: denied { transition } for pid=225 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.075788][ T28] audit: type=1400 audit(1785123798.183:60): avc: denied { noatsecure } for pid=225 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.078450][ T28] audit: type=1400 audit(1785123798.183:61): avc: denied { write } for pid=225 comm="sh" path="pipe:[14779]" dev="pipefs" ino=14779 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 14.081577][ T28] audit: type=1400 audit(1785123798.183:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.084741][ T28] audit: type=1400 audit(1785123798.183:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '10.128.0.34' (ED25519) to the list of known hosts.
2026/07/27 03:43:26 parsed 1 programs
2026/07/27 03:43:26 serving rpc on tcp://36399
[ 22.790998][ T28] audit: type=1400 audit(1785123806.903:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 22.811959][ T28] audit: type=1400 audit(1785123806.903:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 23.560789][ T28] audit: type=1400 audit(1785123807.673:66): avc: denied { mounton } for pid=303 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 23.561834][ T303] cgroup: Unknown subsys name 'net'
[ 23.583437][ T28] audit: type=1400 audit(1785123807.673:67): avc: denied { mount } for pid=303 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 23.610703][ T28] audit: type=1400 audit(1785123807.703:68): avc: denied { unmount } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 23.610878][ T303] cgroup: Unknown subsys name 'devices'
[ 23.757247][ T303] cgroup: Unknown subsys name 'hugetlb'
[ 23.762864][ T303] cgroup: Unknown subsys name 'rlimit'
[ 23.900394][ T28] audit: type=1400 audit(1785123808.013:69): avc: denied { setattr } for pid=303 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 23.923624][ T28] audit: type=1400 audit(1785123808.013:70): avc: denied { create } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 23.941764][ T306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 23.944337][ T28] audit: type=1400 audit(1785123808.013:71): avc: denied { write } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 23.972885][ T28] audit: type=1400 audit(1785123808.013:72): avc: denied { read } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 23.982469][ T303] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 23.993456][ T28] audit: type=1400 audit(1785123808.013:73): avc: denied { mounton } for pid=303 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 24.643067][ T308] request_module fs-gadgetfs succeeded, but still no fs?
[ 25.284047][ T356] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.291216][ T356] bridge0: port 1(bridge_slave_0) entered disabled state
[ 25.298676][ T356] device bridge_slave_0 entered promiscuous mode
[ 25.305930][ T356] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.312942][ T356] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.320327][ T356] device bridge_slave_1 entered promiscuous mode
[ 25.355314][ T356] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.362395][ T356] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.369711][ T356] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.376757][ T356] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.394128][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 25.401767][ T10] bridge0: port 1(bridge_slave_0) entered disabled state
[ 25.409574][ T10] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.418398][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 25.426836][ T10] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.433960][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.442656][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 25.450872][ T10] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.457915][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.471006][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 25.480233][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 25.493620][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 25.504649][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 25.512818][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 25.520579][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 25.528935][ T356] device veth0_vlan entered promiscuous mode
[ 25.538827][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 25.547925][ T356] device veth1_macvtap entered promiscuous mode
[ 25.561368][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 25.571461][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 25.605012][ T356] syz-executor (356) used greatest stack depth: 21952 bytes left
2026/07/27 03:43:29 executed programs: 0
[ 25.832920][ T370] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.840020][ T370] bridge0: port 1(bridge_slave_0) entered disabled state
[ 25.847832][ T370] device bridge_slave_0 entered promiscuous mode
[ 25.854903][ T370] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.862142][ T370] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.869524][ T370] device bridge_slave_1 entered promiscuous mode
[ 25.911419][ T370] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.918485][ T370] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.925772][ T370] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.932790][ T370] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.957232][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 25.964798][ T10] bridge0: port 1(bridge_slave_0) entered disabled state
[ 25.972156][ T10] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.981410][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 25.989734][ T10] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.996774][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 26.006466][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 26.015290][ T10] bridge0: port 2(bridge_slave_1) entered blocking state
[ 26.022362][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 26.039999][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 26.047976][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 26.060472][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 26.071257][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 26.079759][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 26.087441][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 26.095526][ T370] device veth0_vlan entered promiscuous mode
[ 26.105160][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 26.116229][ T370] device veth1_macvtap entered promiscuous mode
[ 26.125652][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 26.136965][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 26.425495][ T19] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 26.606737][ T19] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 26.617699][ T19] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[ 26.627060][ T19] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 26.639403][ T19] usb 3-1: config 0 descriptor??
[ 26.726098][ T8] device bridge_slave_1 left promiscuous mode
[ 26.732255][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 26.740176][ T8] device bridge_slave_0 left promiscuous mode
[ 26.746480][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 26.754541][ T8] device veth1_macvtap left promiscuous mode
[ 26.760635][ T8] device veth0_vlan left promiscuous mode
[ 26.845970][ T19] usbhid 3-1:0.0: can't add hid device: -71
[ 26.852019][ T19] usbhid: probe of 3-1:0.0 failed with error -71
[ 26.859166][ T19] usb 3-1: USB disconnect, device number 2
[ 27.415452][ T19] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[ 27.596496][ T19] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 27.607450][ T19] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40
[ 27.616554][ T19] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 27.624984][ T19] usb 3-1: config 0 descriptor??
[ 28.445927][ T19] aiptek 3-1:0.0: Aiptek using 400 ms programming speed
[ 28.453312][ T19] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input4
[ 28.509696][ C0] ================================================================================
[ 28.519046][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
[ 28.527641][ C0] index 4775 is out of range for type 'const int[34]'
[ 28.534391][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
[ 28.541400][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 28.551478][ C0] Call Trace:
[ 28.554749][ C0]
[ 28.557580][ C0] __dump_stack+0x21/0x24
[ 28.561915][ C0] dump_stack_lvl+0x110/0x170
[ 28.566586][ C0] ? __cfi_dump_stack_lvl+0x8/0x8
[ 28.571601][ C0] dump_stack+0x15/0x24
[ 28.575760][ C0] ubsan_epilogue+0xe/0x40
[ 28.580195][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0
[ 28.585904][ C0] aiptek_irq+0x2045/0x29b0
[ 28.590403][ C0] ? kcov_remote_start+0xef/0x370
[ 28.595442][ C0] ? usb_unanchor_urb+0xa1/0xc0
[ 28.600279][ C0] __usb_hcd_giveback_urb+0x360/0x520
[ 28.605661][ C0] usb_hcd_giveback_urb+0x11f/0x3e0
[ 28.610843][ C0] dummy_timer+0xa25/0x3270
[ 28.615347][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 28.620329][ C0] ? _raw_spin_lock_irqsave+0xc2/0x130
[ 28.625774][ C0] ? timerqueue_del+0xd3/0x120
[ 28.630530][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 28.635452][ C0] __hrtimer_run_queues+0x398/0x890
[ 28.640639][ C0] ? hrtimer_interrupt+0x8c0/0x8c0
[ 28.645758][ C0] hrtimer_run_softirq+0x19b/0x260
[ 28.650870][ C0] handle_softirqs+0x1d7/0x600
[ 28.655626][ C0] __irq_exit_rcu+0x52/0xf0
[ 28.660110][ C0] irq_exit_rcu+0x9/0x10
[ 28.664329][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 28.670039][ C0]
[ 28.672958][ C0]
[ 28.675881][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 28.681860][ C0] RIP: 0010:default_idle+0xf/0x20
[ 28.686888][ C0] Code: cc 00 00 cc cc 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 53 5b 65 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[ 28.706474][ C0] RSP: 0018:ffffffff87007d58 EFLAGS: 00000257
[ 28.712531][ C0] RAX: ffff8881f6e00000 RBX: ffffffff8701c680 RCX: c02f2da952ffea00
[ 28.720491][ C0] RDX: 0000000000000001 RSI: ffffffff85ca6940 RDI: ffffffff85ca6900
[ 28.728447][ C0] RBP: ffffffff87007d58 R08: ffff8881f6e348b3 R09: 1ffff1103edc6916
[ 28.736412][ C0] R10: 0000000000000000 R11: ffffffff8500d380 R12: dffffc0000000000
[ 28.744388][ C0] R13: 0000000000000000 R14: ffffffff8701c680 R15: dffffc0000000000
[ 28.752364][ C0] ? __cfi_default_idle+0x10/0x10
[ 28.757386][ C0] arch_cpu_idle+0x1c/0x20
[ 28.761804][ C0] default_idle_call+0x71/0x1d0
[ 28.766650][ C0] do_idle+0x354/0x640
[ 28.770794][ C0] ? ct_irq_exit+0x9/0x10
[ 28.775124][ C0] ? irqentry_exit+0x30/0x40
[ 28.779714][ C0] ? idle_inject_timer_fn+0x60/0x60
[ 28.784908][ C0] cpu_startup_entry+0x43/0x60
[ 28.789668][ C0] rest_init+0x10a/0x130
[ 28.793896][ C0] ? __cfi_x86_late_time_init+0x8/0x8
[ 28.799254][ C0] arch_call_rest_init+0xe/0x10
[ 28.804108][ C0] start_kernel+0x483/0x4f1
[ 28.808624][ C0] x86_64_start_reservations+0x2a/0x2c
[ 28.814084][ C0] x86_64_start_kernel+0x7c/0x81
[ 28.819031][ C0] secondary_startup_64_no_verify+0xce/0xdb
[ 28.824920][ C0]
[ 28.827991][ C0] ================================================================================
[ 28.837258][ C0] ==================================================================
[ 28.845392][ C0] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0
[ 28.853150][ C0] Read of size 4 at addr ffffffff85e69f9c by task swapper/0/0
[ 28.860590][ C0]
[ 28.862909][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
[ 28.869911][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 28.879962][ C0] Call Trace:
[ 28.883295][ C0]
[ 28.886128][ C0] __dump_stack+0x21/0x24
[ 28.890450][ C0] dump_stack_lvl+0x110/0x170
[ 28.895132][ C0] ? __cfi_dump_stack_lvl+0x8/0x8
[ 28.900147][ C0] ? _printk+0xda/0x128
[ 28.904288][ C0] ? aiptek_irq+0x2063/0x29b0
[ 28.908944][ C0] print_address_description+0x71/0x200
[ 28.914475][ C0] print_report+0x4a/0x60
[ 28.918804][ C0] kasan_report+0x122/0x150
[ 28.923294][ C0] ? aiptek_irq+0x2063/0x29b0
[ 28.927954][ C0] __asan_report_load4_noabort+0x14/0x20
[ 28.933571][ C0] aiptek_irq+0x2063/0x29b0
[ 28.938167][ C0] ? kcov_remote_start+0xef/0x370
[ 28.943196][ C0] ? usb_unanchor_urb+0xa1/0xc0
[ 28.948147][ C0] __usb_hcd_giveback_urb+0x360/0x520
[ 28.953507][ C0] usb_hcd_giveback_urb+0x11f/0x3e0
[ 28.958693][ C0] dummy_timer+0xa25/0x3270
[ 28.963204][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 28.968143][ C0] ? _raw_spin_lock_irqsave+0xc2/0x130
[ 28.973608][ C0] ? timerqueue_del+0xd3/0x120
[ 28.978568][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 28.983506][ C0] __hrtimer_run_queues+0x398/0x890
[ 28.988718][ C0] ? hrtimer_interrupt+0x8c0/0x8c0
[ 28.993923][ C0] hrtimer_run_softirq+0x19b/0x260
[ 28.999019][ C0] handle_softirqs+0x1d7/0x600
[ 29.003773][ C0] __irq_exit_rcu+0x52/0xf0
[ 29.008265][ C0] irq_exit_rcu+0x9/0x10
[ 29.012492][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 29.018118][ C0]
[ 29.021030][ C0]
[ 29.023949][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 29.030011][ C0] RIP: 0010:default_idle+0xf/0x20
[ 29.035029][ C0] Code: cc 00 00 cc cc 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 53 5b 65 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[ 29.054620][ C0] RSP: 0018:ffffffff87007d58 EFLAGS: 00000257
[ 29.060679][ C0] RAX: ffff8881f6e00000 RBX: ffffffff8701c680 RCX: c02f2da952ffea00
[ 29.068731][ C0] RDX: 0000000000000001 RSI: ffffffff85ca6940 RDI: ffffffff85ca6900
[ 29.076689][ C0] RBP: ffffffff87007d58 R08: ffff8881f6e348b3 R09: 1ffff1103edc6916
[ 29.084648][ C0] R10: 0000000000000000 R11: ffffffff8500d380 R12: dffffc0000000000
[ 29.092604][ C0] R13: 0000000000000000 R14: ffffffff8701c680 R15: dffffc0000000000
[ 29.100571][ C0] ? __cfi_default_idle+0x10/0x10
[ 29.105598][ C0] arch_cpu_idle+0x1c/0x20
[ 29.110018][ C0] default_idle_call+0x71/0x1d0
[ 29.114853][ C0] do_idle+0x354/0x640
[ 29.118908][ C0] ? ct_irq_exit+0x9/0x10
[ 29.123228][ C0] ? irqentry_exit+0x30/0x40
[ 29.127802][ C0] ? idle_inject_timer_fn+0x60/0x60
[ 29.132989][ C0] cpu_startup_entry+0x43/0x60
[ 29.137735][ C0] rest_init+0x10a/0x130
[ 29.141972][ C0] ? __cfi_x86_late_time_init+0x8/0x8
[ 29.147351][ C0] arch_call_rest_init+0xe/0x10
[ 29.152201][ C0] start_kernel+0x483/0x4f1
[ 29.156711][ C0] x86_64_start_reservations+0x2a/0x2c
[ 29.162167][ C0] x86_64_start_kernel+0x7c/0x81
[ 29.167097][ C0] secondary_startup_64_no_verify+0xce/0xdb
[ 29.172978][ C0]
[ 29.175987][ C0]
[ 29.178294][ C0] The buggy address belongs to the variable:
[ 29.184274][ C0] .str.3+0x3c/0x60
[ 29.188065][ C0]
[ 29.190371][ C0] The buggy address belongs to the physical page:
[ 29.196773][ C0] page:ffffea0000179a40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e69
[ 29.206821][ C0] flags: 0x1000(reserved|zone=0)
[ 29.211762][ C0] raw: 0000000000001000 ffffea0000179a48 ffffea0000179a48 0000000000000000
[ 29.220325][ C0] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 29.228889][ C0] page dumped because: kasan: bad access detected
[ 29.235278][ C0] page_owner info is not present (never set?)
[ 29.241334][ C0]
[ 29.243639][ C0] Memory state around the buggy address:
[ 29.249252][ C0] ffffffff85e69e80: 00 00 00 00 00 00 00 00 00 01 f9 f9 04 f9 f9 f9
[ 29.257299][ C0] ffffffff85e69f00: 00 00 00 00 00 02 f9 f9 f9 f9 f9 f9 00 00 00 00
[ 29.265343][ C0] >ffffffff85e69f80: 00 00 00 04 f9 f9 f9 f9 00 00 00 00 00 00 02 f9
[ 29.273380][ C0] ^
[ 29.278205][ C0] ffffffff85e6a000: f9 f9 f9 f9 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
[ 29.286280][ C0] ffffffff85e6a080: 00 00 00 00 00 00 01 f9 f9 f9 f9 f9 00 00 00 02
[ 29.294319][ C0] ==================================================================
[ 29.302356][ C0] Disabling lock debugging due to kernel taint
[ 29.308489][ C0] ================================================================================
[ 29.317745][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
[ 29.326490][ C0] index 4776 is out of range for type 'const int[34]'
[ 29.333231][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B syzkaller #0
[ 29.341715][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 29.351754][ C0] Call Trace:
[ 29.355031][ C0]
[ 29.357873][ C0] __dump_stack+0x21/0x24
[ 29.362197][ C0] dump_stack_lvl+0x110/0x170
[ 29.366863][ C0] ? __cfi_dump_stack_lvl+0x8/0x8
[ 29.371884][ C0] dump_stack+0x15/0x24
[ 29.376028][ C0] ubsan_epilogue+0xe/0x40
[ 29.380442][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0
[ 29.386158][ C0] aiptek_irq+0x1f14/0x29b0
[ 29.390652][ C0] ? kcov_remote_start+0xef/0x370
[ 29.395700][ C0] __usb_hcd_giveback_urb+0x360/0x520
[ 29.401059][ C0] usb_hcd_giveback_urb+0x11f/0x3e0
[ 29.406246][ C0] dummy_timer+0xa25/0x3270
[ 29.410746][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 29.415670][ C0] ? _raw_spin_lock_irqsave+0xc2/0x130
[ 29.421118][ C0] ? timerqueue_del+0xd3/0x120
[ 29.425868][ C0] ? __cfi_dummy_timer+0x10/0x10
[ 29.430798][ C0] __hrtimer_run_queues+0x398/0x890
[ 29.435996][ C0] ? hrtimer_interrupt+0x8c0/0x8c0
[ 29.441099][ C0] hrtimer_run_softirq+0x19b/0x260
[ 29.446221][ C0] handle_softirqs+0x1d7/0x600
[ 29.450977][ C0] __irq_exit_rcu+0x52/0xf0
[ 29.455471][ C0] irq_exit_rcu+0x9/0x10
[ 29.459701][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 29.465416][ C0]
[ 29.468331][ C0]
[ 29.471249][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 29.477225][ C0] RIP: 0010:default_idle+0xf/0x20
[ 29.482241][ C0] Code: cc 00 00 cc cc 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 53 5b 65 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[ 29.501828][ C0] RSP: 0018:ffffffff87007d58 EFLAGS: 00000257
[ 29.507881][ C0] RAX: ffff8881f6e00000 RBX: ffffffff8701c680 RCX: c02f2da952ffea00
[ 29.516108][ C0] RDX: 0000000000000001 RSI: ffffffff85ca6940 RDI: ffffffff85ca6900
[ 29.524070][ C0] RBP: ffffffff87007d58 R08: ffff8881f6e348b3 R09: 1ffff1103edc6916
[ 29.532200][ C0] R10: 0000000000000000 R11: ffffffff8500d380 R12: dffffc0000000000
[ 29.540158][ C0] R13: 0000000000000000 R14: ffffffff8701c680 R15: dffffc0000000000
[ 29.548121][ C0] ? __cfi_default_idle+0x10/0x10
[ 29.553142][ C0] arch_cpu_idle+0x1c/0x20
[ 29.557543][ C0] default_idle_call+0x71/0x1d0
[ 29.562386][ C0] do_idle+0x354/0x640
[ 29.566446][ C0] ? ct_irq_exit+0x9/0x10
[ 29.570764][ C0] ? irqentry_exit+0x30/0x40
[ 29.575342][ C0] ? idle_inject_timer_fn+0x60/0x60
[ 29.580547][ C0] cpu_startup_entry+0x43/0x60
[ 29.585361][ C0] rest_init+0x10a/0x130
[ 29.589588][ C0] ? __cfi_x86_late_time_init+0x8/0x8
[ 29.595130][ C0] arch_call_rest_init+0xe/0x10
[ 29.599973][ C0] start_kernel+0x483/0x4f1
[ 29.604461][ C0] x86_64_start_reservations+0x2a/0x2c
[ 29.609912][ C0] x86_64_start_kernel+0x7c/0x81
[ 29.614933][ C0] secondary_startup_64_no_verify+0xce/0xdb
[ 29.620815][ C0]
[ 29.623815][ C0] ================================================================================
[ 29.634649][ T60] usb 3-1: USB disconnect, device number 3
[ 29.634787][ C0] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
[ 29.681032][ T28] kauditd_printk_skb: 34 callbacks suppressed
[ 29.681046][ T28] audit: type=1400 audit(1785123813.793:108): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 29.712817][ T28] audit: type=1400 audit(1785123813.793:109): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpf