Warning: Permanently added '10.128.1.141' (ED25519) to the list of known hosts.
2026/07/27 03:14:14 parsed 1 programs
2026/07/27 03:14:14 serving rpc on tcp://35865
[ 31.436449][ T28] audit: type=1400 audit(1785122054.387:64): avc: denied { node_bind } for pid=296 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 31.457416][ T28] audit: type=1400 audit(1785122054.387:65): avc: denied { module_request } for pid=296 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 32.620709][ T28] audit: type=1400 audit(1785122055.567:66): avc: denied { mounton } for pid=302 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 32.623940][ T302] cgroup: Unknown subsys name 'net'
[ 32.643476][ T28] audit: type=1400 audit(1785122055.567:67): avc: denied { mount } for pid=302 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 32.670803][ T28] audit: type=1400 audit(1785122055.607:68): avc: denied { unmount } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 32.671185][ T302] cgroup: Unknown subsys name 'devices'
[ 32.816172][ T302] cgroup: Unknown subsys name 'hugetlb'
[ 32.821811][ T302] cgroup: Unknown subsys name 'rlimit'
[ 32.934228][ T28] audit: type=1400 audit(1785122055.887:69): avc: denied { setattr } for pid=302 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 32.957462][ T28] audit: type=1400 audit(1785122055.887:70): avc: denied { create } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 32.977923][ T28] audit: type=1400 audit(1785122055.887:71): avc: denied { write } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 32.998385][ T28] audit: type=1400 audit(1785122055.887:72): avc: denied { read } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 33.007437][ T306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
Setting up swapspace version 1, size = 127995904 bytes
[ 33.019334][ T28] audit: type=1400 audit(1785122055.887:73): avc: denied { mounton } for pid=302 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 33.071994][ T302] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 33.743211][ T309] request_module fs-gadgetfs succeeded, but still no fs?
[ 34.141003][ T336] bridge0: port 1(bridge_slave_0) entered blocking state
[ 34.148472][ T336] bridge0: port 1(bridge_slave_0) entered disabled state
[ 34.156118][ T336] device bridge_slave_0 entered promiscuous mode
[ 34.163785][ T336] bridge0: port 2(bridge_slave_1) entered blocking state
[ 34.170876][ T336] bridge0: port 2(bridge_slave_1) entered disabled state
[ 34.178341][ T336] device bridge_slave_1 entered promiscuous mode
[ 34.224795][ T336] bridge0: port 2(bridge_slave_1) entered blocking state
[ 34.231853][ T336] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 34.239213][ T336] bridge0: port 1(bridge_slave_0) entered blocking state
[ 34.246281][ T336] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 34.267636][ T314] bridge0: port 1(bridge_slave_0) entered disabled state
[ 34.275138][ T314] bridge0: port 2(bridge_slave_1) entered disabled state
[ 34.282568][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 34.290185][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 34.304735][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 34.312907][ T314] bridge0: port 1(bridge_slave_0) entered blocking state
[ 34.319983][ T314] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 34.327551][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 34.335833][ T314] bridge0: port 2(bridge_slave_1) entered blocking state
[ 34.342875][ T314] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 34.353462][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 34.363867][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 34.377946][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 34.389859][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 34.397958][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 34.405522][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 34.413819][ T336] device veth0_vlan entered promiscuous mode
[ 34.424489][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 34.433673][ T336] device veth1_macvtap entered promiscuous mode
[ 34.443220][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 34.453192][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 34.485726][ T336] syz-executor (336) used greatest stack depth: 22144 bytes left
2026/07/27 03:14:18 executed programs: 0
[ 35.088213][ T371] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.095564][ T371] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.103028][ T371] device bridge_slave_0 entered promiscuous mode
[ 35.110246][ T371] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.117506][ T371] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.125046][ T371] device bridge_slave_1 entered promiscuous mode
[ 35.180585][ T371] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.187651][ T371] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 35.194955][ T371] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.201994][ T371] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.210179][ T314] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.217389][ T314] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.237575][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 35.245026][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 35.253615][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 35.262062][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 35.270425][ T314] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.277516][ T314] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.285992][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 35.294452][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 35.302556][ T314] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.309608][ T314] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 35.321491][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 35.329668][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 35.338553][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 35.346846][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 35.361105][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 35.369648][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 35.380728][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 35.388907][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 35.397122][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 35.404634][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 35.413963][ T371] device veth0_vlan entered promiscuous mode
[ 35.424363][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 35.432520][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 35.441796][ T371] device veth1_macvtap entered promiscuous mode
[ 35.451320][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 35.459431][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 35.467722][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 35.477222][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 35.485538][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 35.784205][ T60] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 35.945032][ T8] device bridge_slave_1 left promiscuous mode
[ 35.951242][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.958910][ T8] device bridge_slave_0 left promiscuous mode
[ 35.965187][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.973363][ T60] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 35.984358][ T60] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[ 35.985104][ T8] device veth1_macvtap left promiscuous mode
[ 35.993421][ T60] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 35.998150][ T60] usb 3-1: config 0 descriptor??
[ 36.004552][ T8] device veth0_vlan left promiscuous mode
[ 36.217267][ T60] usbhid 3-1:0.0: can't add hid device: -71
[ 36.223648][ T60] usbhid: probe of 3-1:0.0 failed with error -71
[ 36.231131][ T60] usb 3-1: USB disconnect, device number 2
[ 36.784136][ T60] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[ 36.965313][ T60] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 36.976235][ T60] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40
[ 36.985296][ T60] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 36.993848][ T60] usb 3-1: config 0 descriptor??
[ 37.814731][ T376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 37.823207][ T376] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 37.831062][ T60] aiptek 3-1:0.0: Aiptek using 400 ms programming speed
[ 37.838594][ T60] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input4
[ 37.852371][ C1] ================================================================================
[ 37.861659][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
[ 37.870243][ C1] index 547 is out of range for type 'const int[34]'
[ 37.876926][ C1] CPU: 1 PID: 377 Comm: udevd Not tainted syzkaller #0
[ 37.883768][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 37.893825][ C1] Call Trace:
[ 37.897103][ C1]
[ 37.899945][ C1] __dump_stack+0x21/0x24
[ 37.904290][ C1] dump_stack_lvl+0x110/0x170
[ 37.908969][ C1] ? __cfi_dump_stack_lvl+0x8/0x8
[ 37.913991][ C1] ? x64_sys_call+0x2f/0x9a0
[ 37.918581][ C1] dump_stack+0x15/0x24
[ 37.922735][ C1] ubsan_epilogue+0xe/0x40
[ 37.927150][ C1] __ubsan_handle_out_of_bounds+0xdf/0xf0
[ 37.932868][ C1] aiptek_irq+0x2045/0x29b0
[ 37.937364][ C1] ? kcov_remote_start+0xef/0x370
[ 37.942387][ C1] ? usb_unanchor_urb+0xa1/0xc0
[ 37.947251][ C1] __usb_hcd_giveback_urb+0x360/0x520
[ 37.952630][ C1] usb_hcd_giveback_urb+0x11f/0x3e0
[ 37.957841][ C1] dummy_timer+0xa25/0x3270
[ 37.962354][ C1] ? __update_load_avg_cfs_rq+0xb1/0x2e0
[ 37.967987][ C1] ? enqueue_task_fair+0xbee/0x1d70
[ 37.973194][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 37.978130][ C1] ? timerqueue_del+0xd3/0x120
[ 37.982898][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 37.987835][ C1] __hrtimer_run_queues+0x398/0x890
[ 37.993040][ C1] ? hrtimer_interrupt+0x8c0/0x8c0
[ 37.998156][ C1] hrtimer_run_softirq+0x19b/0x260
[ 38.003262][ C1] handle_softirqs+0x1d7/0x600
[ 38.008029][ C1] __irq_exit_rcu+0x52/0xf0
[ 38.012531][ C1] irq_exit_rcu+0x9/0x10
[ 38.016767][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 38.022407][ C1]
[ 38.025338][ C1]
[ 38.028270][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 38.034256][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x36/0x60
[ 38.040415][ C1] Code: 70 07 91 7e 65 8b 15 71 07 91 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 6c 0b 00 00 00 74 2c 8b 91 48 0b 00 00 <83> fa 02 75 21 48 8b 91 50 0b 00 00 48 8b 32 48 8d 7e 01 8b 89 4c
[ 38.060018][ C1] RSP: 0018:ffffc900009675d0 EFLAGS: 00000246
[ 38.066103][ C1] RAX: ffffffff81bc4816 RBX: dffffc0000000000 RCX: ffff888113776540
[ 38.074086][ C1] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888103dd8b14
[ 38.082083][ C1] RBP: ffffc900009675d0 R08: ffff888103dd8b07 R09: 1ffff110207bb160
[ 38.090052][ C1] R10: dffffc0000000000 R11: ffffed10207bb161 R12: 0000000000000003
[ 38.098034][ C1] R13: ffff888103dd8b20 R14: ffff888103dd8b40 R15: 0000000000000002
[ 38.106021][ C1] ? __reset_page_owner+0xb6/0x190
[ 38.111131][ C1] __reset_page_owner+0xb6/0x190
[ 38.116073][ C1] free_unref_page_prepare+0x80c/0x820
[ 38.121533][ C1] free_unref_page+0x93/0x530
[ 38.126207][ C1] ? __cfi_free_unref_page+0x10/0x10
[ 38.131503][ C1] ? __kasan_check_write+0x14/0x20
[ 38.136606][ C1] ? _raw_spin_lock_irqsave+0xc2/0x130
[ 38.142090][ C1] __free_pages+0x67/0x100
[ 38.146503][ C1] __free_slab+0xc7/0x1a0
[ 38.150826][ C1] __unfreeze_partials+0x15a/0x190
[ 38.155933][ C1] put_cpu_partial+0xa9/0x100
[ 38.160613][ C1] __slab_free+0x1c4/0x280
[ 38.165032][ C1] ___cache_free+0xbf/0xd0
[ 38.169453][ C1] qlist_free_all+0xc6/0x140
[ 38.174037][ C1] kasan_quarantine_reduce+0x14a/0x170
[ 38.179524][ C1] __kasan_slab_alloc+0x24/0x80
[ 38.184377][ C1] slab_post_alloc_hook+0x4f/0x2d0
[ 38.189499][ C1] ? __slab_alloc+0x6b/0xa0
[ 38.194012][ C1] __kmem_cache_alloc_node+0x194/0x2d0
[ 38.199517][ C1] ? kvmalloc_node+0x28a/0x460
[ 38.204297][ C1] ? kvmalloc_node+0x28a/0x460
[ 38.209061][ C1] __kmalloc_node+0xa2/0x1e0
[ 38.213652][ C1] kvmalloc_node+0x28a/0x460
[ 38.218272][ C1] ? __cfi_kvmalloc_node+0x10/0x10
[ 38.223377][ C1] ? __kasan_check_write+0x14/0x20
[ 38.228479][ C1] ? _raw_spin_lock+0x94/0xf0
[ 38.233162][ C1] seq_read_iter+0x1f1/0xd80
[ 38.237781][ C1] ? avc_policy_seqno+0x1b/0x70
[ 38.242630][ C1] kernfs_fop_read_iter+0x14d/0x4e0
[ 38.247822][ C1] vfs_read+0x46e/0x930
[ 38.251974][ C1] ? __cfi_vfs_read+0x10/0x10
[ 38.256673][ C1] ? __kasan_check_read+0x11/0x20
[ 38.261695][ C1] ? __fdget_pos+0x2d4/0x380
[ 38.266285][ C1] ksys_read+0x14a/0x260
[ 38.270522][ C1] ? __cfi_ksys_read+0x10/0x10
[ 38.275276][ C1] ? fput+0x15b/0x1a0
[ 38.279266][ C1] ? debug_smp_processor_id+0x17/0x20
[ 38.284631][ C1] __x64_sys_read+0x7b/0x90
[ 38.289157][ C1] x64_sys_call+0x2f/0x9a0
[ 38.293568][ C1] do_syscall_64+0x4c/0xa0
[ 38.297981][ C1] ? clear_bhb_loop+0x30/0x80
[ 38.302656][ C1] ? clear_bhb_loop+0x30/0x80
[ 38.307324][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 38.313221][ C1] RIP: 0033:0x7f5ddaca7407
[ 38.317645][ C1] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 38.337244][ C1] RSP: 002b:00007ffe088a40f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 38.345650][ C1] RAX: ffffffffffffffda RBX: 00007f5ddb49b880 RCX: 00007f5ddaca7407
[ 38.353621][ C1] RDX: 0000000000001000 RSI: 00007ffe088a45d0 RDI: 0000000000000008
[ 38.361614][ C1] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
[ 38.369580][ C1] R10: 0000000000000000 R11: 0000000000000202 R12: 000055f3078ae130
[ 38.377549][ C1] R13: 00007ffe088a41d0 R14: 00007ffe088a45d0 R15: 000055f2dceb0bcc
[ 38.385522][ C1]
[ 38.388553][ C1] ================================================================================
[ 38.397844][ C1] ==================================================================
[ 38.405892][ C1] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0
[ 38.413433][ C1] Read of size 4 at addr ffffffff85e65d8c by task udevd/377
[ 38.420705][ C1]
[ 38.423023][ C1] CPU: 1 PID: 377 Comm: udevd Not tainted syzkaller #0
[ 38.429859][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 38.439905][ C1] Call Trace:
[ 38.443182][ C1]
[ 38.446043][ C1] __dump_stack+0x21/0x24
[ 38.450392][ C1] dump_stack_lvl+0x110/0x170
[ 38.455065][ C1] ? __cfi_dump_stack_lvl+0x8/0x8
[ 38.460103][ C1] ? _printk+0xda/0x128
[ 38.464276][ C1] ? aiptek_irq+0x2063/0x29b0
[ 38.468946][ C1] print_address_description+0x71/0x200
[ 38.474492][ C1] print_report+0x4a/0x60
[ 38.478832][ C1] kasan_report+0x122/0x150
[ 38.483335][ C1] ? aiptek_irq+0x2063/0x29b0
[ 38.488004][ C1] __asan_report_load4_noabort+0x14/0x20
[ 38.493642][ C1] aiptek_irq+0x2063/0x29b0
[ 38.498161][ C1] ? kcov_remote_start+0xef/0x370
[ 38.503207][ C1] ? usb_unanchor_urb+0xa1/0xc0
[ 38.508077][ C1] __usb_hcd_giveback_urb+0x360/0x520
[ 38.513536][ C1] usb_hcd_giveback_urb+0x11f/0x3e0
[ 38.518749][ C1] dummy_timer+0xa25/0x3270
[ 38.523254][ C1] ? __update_load_avg_cfs_rq+0xb1/0x2e0
[ 38.528980][ C1] ? enqueue_task_fair+0xbee/0x1d70
[ 38.534196][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 38.539132][ C1] ? timerqueue_del+0xd3/0x120
[ 38.543895][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 38.548830][ C1] __hrtimer_run_queues+0x398/0x890
[ 38.554033][ C1] ? hrtimer_interrupt+0x8c0/0x8c0
[ 38.559177][ C1] hrtimer_run_softirq+0x19b/0x260
[ 38.564295][ C1] handle_softirqs+0x1d7/0x600
[ 38.569059][ C1] __irq_exit_rcu+0x52/0xf0
[ 38.573559][ C1] irq_exit_rcu+0x9/0x10
[ 38.577793][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 38.583445][ C1]
[ 38.586368][ C1]
[ 38.589306][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 38.595288][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x36/0x60
[ 38.601443][ C1] Code: 70 07 91 7e 65 8b 15 71 07 91 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 6c 0b 00 00 00 74 2c 8b 91 48 0b 00 00 <83> fa 02 75 21 48 8b 91 50 0b 00 00 48 8b 32 48 8d 7e 01 8b 89 4c
[ 38.621040][ C1] RSP: 0018:ffffc900009675d0 EFLAGS: 00000246
[ 38.627106][ C1] RAX: ffffffff81bc4816 RBX: dffffc0000000000 RCX: ffff888113776540
[ 38.635090][ C1] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888103dd8b14
[ 38.643071][ C1] RBP: ffffc900009675d0 R08: ffff888103dd8b07 R09: 1ffff110207bb160
[ 38.651049][ C1] R10: dffffc0000000000 R11: ffffed10207bb161 R12: 0000000000000003
[ 38.659028][ C1] R13: ffff888103dd8b20 R14: ffff888103dd8b40 R15: 0000000000000002
[ 38.666994][ C1] ? __reset_page_owner+0xb6/0x190
[ 38.672104][ C1] __reset_page_owner+0xb6/0x190
[ 38.677038][ C1] free_unref_page_prepare+0x80c/0x820
[ 38.682501][ C1] free_unref_page+0x93/0x530
[ 38.687187][ C1] ? __cfi_free_unref_page+0x10/0x10
[ 38.692475][ C1] ? __kasan_check_write+0x14/0x20
[ 38.697586][ C1] ? _raw_spin_lock_irqsave+0xc2/0x130
[ 38.703055][ C1] __free_pages+0x67/0x100
[ 38.707475][ C1] __free_slab+0xc7/0x1a0
[ 38.711800][ C1] __unfreeze_partials+0x15a/0x190
[ 38.716906][ C1] put_cpu_partial+0xa9/0x100
[ 38.721594][ C1] __slab_free+0x1c4/0x280
[ 38.726018][ C1] ___cache_free+0xbf/0xd0
[ 38.730446][ C1] qlist_free_all+0xc6/0x140
[ 38.735046][ C1] kasan_quarantine_reduce+0x14a/0x170
[ 38.740551][ C1] __kasan_slab_alloc+0x24/0x80
[ 38.745429][ C1] slab_post_alloc_hook+0x4f/0x2d0
[ 38.750543][ C1] ? __slab_alloc+0x6b/0xa0
[ 38.755064][ C1] __kmem_cache_alloc_node+0x194/0x2d0
[ 38.760520][ C1] ? kvmalloc_node+0x28a/0x460
[ 38.765276][ C1] ? kvmalloc_node+0x28a/0x460
[ 38.770034][ C1] __kmalloc_node+0xa2/0x1e0
[ 38.774617][ C1] kvmalloc_node+0x28a/0x460
[ 38.779210][ C1] ? __cfi_kvmalloc_node+0x10/0x10
[ 38.784314][ C1] ? __kasan_check_write+0x14/0x20
[ 38.789423][ C1] ? _raw_spin_lock+0x94/0xf0
[ 38.794105][ C1] seq_read_iter+0x1f1/0xd80
[ 38.798712][ C1] ? avc_policy_seqno+0x1b/0x70
[ 38.803560][ C1] kernfs_fop_read_iter+0x14d/0x4e0
[ 38.808756][ C1] vfs_read+0x46e/0x930
[ 38.812905][ C1] ? __cfi_vfs_read+0x10/0x10
[ 38.817578][ C1] ? __kasan_check_read+0x11/0x20
[ 38.822597][ C1] ? __fdget_pos+0x2d4/0x380
[ 38.827185][ C1] ksys_read+0x14a/0x260
[ 38.831425][ C1] ? __cfi_ksys_read+0x10/0x10
[ 38.836182][ C1] ? fput+0x15b/0x1a0
[ 38.840170][ C1] ? debug_smp_processor_id+0x17/0x20
[ 38.845546][ C1] __x64_sys_read+0x7b/0x90
[ 38.846999][ T204] usb 3-1: USB disconnect, device number 3
[ 38.850072][ C1] x64_sys_call+0x2f/0x9a0
[ 38.860324][ C1] do_syscall_64+0x4c/0xa0
[ 38.864780][ C1] ? clear_bhb_loop+0x30/0x80
[ 38.869485][ C1] ? clear_bhb_loop+0x30/0x80
[ 38.874202][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 38.880143][ C1] RIP: 0033:0x7f5ddaca7407
[ 38.884596][ C1] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 38.904235][ C1] RSP: 002b:00007ffe088a40f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[ 38.912690][ C1] RAX: ffffffffffffffda RBX: 00007f5ddb49b880 RCX: 00007f5ddaca7407
[ 38.920719][ C1] RDX: 0000000000001000 RSI: 00007ffe088a45d0 RDI: 0000000000000008
[ 38.928718][ C1] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
[ 38.936737][ C1] R10: 0000000000000000 R11: 0000000000000202 R12: 000055f3078ae130
[ 38.944739][ C1] R13: 00007ffe088a41d0 R14: 00007ffe088a45d0 R15: 000055f2dceb0bcc
[ 38.952741][ C1]
[ 38.955779][ C1]
[ 38.958113][ C1] The buggy address belongs to the variable:
[ 38.964106][ C1] .str.47+0xc/0x20
[ 38.967944][ C1]
[ 38.970279][ C1] The buggy address belongs to the physical page:
[ 38.976725][ C1] page:ffffea0000179940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e65
[ 38.986825][ C1] flags: 0x1000(reserved|zone=0)
[ 38.991830][ C1] raw: 0000000000001000 ffffea0000179948 ffffea0000179948 0000000000000000
[ 39.000460][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 39.009050][ C1] page dumped because: kasan: bad access detected
[ 39.015479][ C1] page_owner info is not present (never set?)
[ 39.021565][ C1]
[ 39.023901][ C1] Memory state around the buggy address:
[ 39.029548][ C1] ffffffff85e65c80: 05 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
[ 39.037628][ C1] ffffffff85e65d00: 00 00 00 00 f9 f9 f9 f9 06 f9 f9 f9 00 01 f9 f9
[ 39.045744][ C1] >ffffffff85e65d80: 04 f9 f9 f9 00 f9 f9 f9 06 f9 f9 f9 07 f9 f9 f9
[ 39.053822][ C1] ^
[ 39.058179][ C1] ffffffff85e65e00: 06 f9 f9 f9 00 04 f9 f9 05 f9 f9 f9 00 03 f9 f9
[ 39.066274][ C1] ffffffff85e65e80: 00 03 f9 f9 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9
[ 39.074355][ C1] ==================================================================
[ 39.082436][ C1] Disabling lock debugging due to kernel taint
[ 39.088615][ C1] ================================================================================
[ 39.097900][ C1] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
[ 39.106510][ C1] index 548 is out of range for type 'const int[34]'
[ 39.113197][ C1] CPU: 1 PID: 377 Comm: udevd Tainted: G B syzkaller #0
[ 39.121545][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 39.131633][ C1] Call Trace:
[ 39.134926][ C1]
[ 39.137811][ C1] __dump_stack+0x21/0x24
[ 39.142180][ C1] dump_stack_lvl+0x110/0x170
[ 39.146898][ C1] ? __cfi_dump_stack_lvl+0x8/0x8
[ 39.151950][ C1] ? _raw_spin_lock_irqsave+0xc2/0x130
[ 39.157447][ C1] ? __kasan_check_read+0x11/0x20
[ 39.162499][ C1] dump_stack+0x15/0x24
[ 39.166682][ C1] ubsan_epilogue+0xe/0x40
[ 39.171137][ C1] __ubsan_handle_out_of_bounds+0xdf/0xf0
[ 39.176898][ C1] aiptek_irq+0x1f14/0x29b0
[ 39.181440][ C1] ? kcov_remote_start+0xef/0x370
[ 39.186525][ C1] __usb_hcd_giveback_urb+0x360/0x520
[ 39.191928][ C1] usb_hcd_giveback_urb+0x11f/0x3e0
[ 39.197154][ C1] dummy_timer+0xa25/0x3270
[ 39.201691][ C1] ? __update_load_avg_cfs_rq+0xb1/0x2e0
[ 39.207361][ C1] ? enqueue_task_fair+0xbee/0x1d70
[ 39.212682][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 39.217654][ C1] ? timerqueue_del+0xd3/0x120
[ 39.222454][ C1] ? __cfi_dummy_timer+0x10/0x10
[ 39.227413][ C1] __hrtimer_run_queues+0x398/0x890
[ 39.232656][ C1] ? hrtimer_interrupt+0x8c0/0x8c0
[ 39.237808][ C1] hrtimer_run_softirq+0x19b/0x260
[ 39.242944][ C1] handle_softirqs+0x1d7/0x600
[ 39.247741][ C1] __irq_exit_rcu+0x52/0xf0
[ 39.252277][ C1] irq_exit_rcu+0x9/0x10
[ 39.256547][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 39.262215][ C1]
[ 39.265160][ C1]
[ 39.268108][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 39.274122][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x36/0x60
[ 39.280322][ C1] Code: 70 07 91 7e 65 8b 15 71 07 91 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 6c 0b 00 00 00 74 2c 8b 91 48 0b 00 00 <83> fa 02 75 21 48 8b 91 50 0b 00 00 48 8b 32 48 8d 7e 01 8b 89 4c
[ 39.299948][ C1] RSP: 0018:ffffc900009675d0 EFLAGS: 00000246
[ 39.306042][ C1] RAX: ffffffff81bc4816 RBX: dffffc0000000000 RCX: ffff888113776540
[ 39.314037][ C1] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888103dd8