[Android 5.10] general protection fault in wacom_wireless_work
5 views
Skip to first unread message
syzbot
Oct 23, 2026, 7:51:23 PMOct 23
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: d3231d350eb8 Merge 7f9a05c930d3 ("xfrm: add extack to veri..
git tree: android13-5.10-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12370a95580000
kernel config: https://syzkaller.appspot.com/x/.config?x=40fa24cc6888ca30
dashboard link: https://syzkaller.appspot.com/bug?extid=44339f68e9f228bc3f47
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16370a95580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=114d150d580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/77a5afabe6f9/disk-d3231d35.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/94b2816c1caa/vmlinux-d3231d35.xz
kernel image: https://storage.googleapis.com/syzbot-assets/da333b6dcb5c/bzImage-d3231d35.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+44339f...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc00000000d0: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000680-0x0000000000000687]
CPU: 0 PID: 50 Comm: kworker/0:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: events wacom_wireless_work
RIP: 0010:wacom_release_resources drivers/hid/wacom_sys.c:2302 [inline]
RIP: 0010:wacom_wireless_work+0x187/0xb10 drivers/hid/wacom_sys.c:2500
Code: 00 00 00 fc ff df 42 80 3c 28 00 74 08 4c 89 ff e8 be 79 36 fe 4d 8b 3f 49 8d 97 80 06 00 00 48 89 d0 48 c1 e8 03 48 89 45 a0 <42> 0f b6 04 28 84 c0 48 89 55 c0 0f 85 65 07 00 00 80 3a 00 74 61
RSP: 0018:ffffc90000a77c90 EFLAGS: 00010202
RAX: 00000000000000d0 RBX: ffff88810ab57420 RCX: dffffc0000000000
RDX: 0000000000000680 RSI: 0000000000000008 RDI: ffff88810ab57420
RBP: ffffc90000a77d20 R08: ffff88810ab57427 R09: 1ffff1102156ae84
R10: dffffc0000000000 R11: ffffed102156ae85 R12: ffff88810ab52430
R13: dffffc0000000000 R14: 1ffff1102156a486 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564066f61660 CR3: 0000000106796000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
kthread+0x324/0x3b0 kernel/kthread.c:313
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 fc add %bh,%ah
4: ff lcall (bad)
5: df 42 80 filds -0x80(%rdx)
8: 3c 28 cmp $0x28,%al
a: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
e: 89 ff mov %edi,%edi
10: e8 be 79 36 fe call 0xfe3679d3
15: 4d 8b 3f mov (%r15),%r15
18: 49 8d 97 80 06 00 00 lea 0x680(%r15),%rdx
1f: 48 89 d0 mov %rdx,%rax
22: 48 c1 e8 03 shr $0x3,%rax
26: 48 89 45 a0 mov %rax,-0x60(%rbp)
* 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 48 89 55 c0 mov %rdx,-0x40(%rbp)
35: 0f 85 65 07 00 00 jne 0x7a0
3b: 80 3a 00 cmpb $0x0,(%rdx)
3e: 74 61 je 0xa1
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: d3231d350eb8 Merge 7f9a05c930d3 ("xfrm: add extack to veri..
git tree: android13-5.10-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12370a95580000
kernel config: https://syzkaller.appspot.com/x/.config?x=40fa24cc6888ca30
dashboard link: https://syzkaller.appspot.com/bug?extid=44339f68e9f228bc3f47
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16370a95580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=114d150d580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/77a5afabe6f9/disk-d3231d35.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/94b2816c1caa/vmlinux-d3231d35.xz
kernel image: https://storage.googleapis.com/syzbot-assets/da333b6dcb5c/bzImage-d3231d35.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+44339f...@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc00000000d0: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000680-0x0000000000000687]
CPU: 0 PID: 50 Comm: kworker/0:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: events wacom_wireless_work
RIP: 0010:wacom_release_resources drivers/hid/wacom_sys.c:2302 [inline]
RIP: 0010:wacom_wireless_work+0x187/0xb10 drivers/hid/wacom_sys.c:2500
Code: 00 00 00 fc ff df 42 80 3c 28 00 74 08 4c 89 ff e8 be 79 36 fe 4d 8b 3f 49 8d 97 80 06 00 00 48 89 d0 48 c1 e8 03 48 89 45 a0 <42> 0f b6 04 28 84 c0 48 89 55 c0 0f 85 65 07 00 00 80 3a 00 74 61
RSP: 0018:ffffc90000a77c90 EFLAGS: 00010202
RAX: 00000000000000d0 RBX: ffff88810ab57420 RCX: dffffc0000000000
RDX: 0000000000000680 RSI: 0000000000000008 RDI: ffff88810ab57420
RBP: ffffc90000a77d20 R08: ffff88810ab57427 R09: 1ffff1102156ae84
R10: dffffc0000000000 R11: ffffed102156ae85 R12: ffff88810ab52430
R13: dffffc0000000000 R14: 1ffff1102156a486 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564066f61660 CR3: 0000000106796000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
kthread+0x324/0x3b0 kernel/kthread.c:313
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 fc add %bh,%ah
4: ff lcall (bad)
5: df 42 80 filds -0x80(%rdx)
8: 3c 28 cmp $0x28,%al
a: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
e: 89 ff mov %edi,%edi
10: e8 be 79 36 fe call 0xfe3679d3
15: 4d 8b 3f mov (%r15),%r15
18: 49 8d 97 80 06 00 00 lea 0x680(%r15),%rdx
1f: 48 89 d0 mov %rdx,%rax
22: 48 c1 e8 03 shr $0x3,%rax
26: 48 89 45 a0 mov %rax,-0x60(%rbp)
* 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 48 89 55 c0 mov %rdx,-0x40(%rbp)
35: 0f 85 65 07 00 00 jne 0x7a0
3b: 80 3a 00 cmpb $0x0,(%rdx)
3e: 74 61 je 0xa1
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Oct 31, 2026, 7:55:33 AM (9 days ago) Oct 31
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 2316d138a3c3 Merge 5.15.223 into android13-5.15-lts
syzbot found the following issue on:
git tree: android13-5.15-lts
console+strace: https://syzkaller.appspot.com/x/log.txt?x=152c8981580000
kernel config: https://syzkaller.appspot.com/x/.config?x=98c60c31f9225e5e
dashboard link: https://syzkaller.appspot.com/bug?extid=dec438feb27c4dd44fca
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1753ccb1580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17b4528d580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/24d194ffc446/disk-2316d138.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ed78d0797a3f/vmlinux-2316d138.xz
kernel image: https://storage.googleapis.com/syzbot-assets/71675bd16c9b/bzImage-2316d138.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
general protection fault, probably for non-canonical address 0xdffffc00000000d0: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000680-0x0000000000000687]
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Workqueue: events wacom_wireless_work
RIP: 0010:wacom_release_resources drivers/hid/wacom_sys.c:2303 [inline]
RIP: 0010:wacom_wireless_work+0x187/0xb10 drivers/hid/wacom_sys.c:2507
Code: 00 00 00 fc ff df 42 80 3c 28 00 74 08 4c 89 ff e8 ce 04 20 fe 4d 8b 3f 49 8d 97 80 06 00 00 48 89 d0 48 c1 e8 03 48 89 45 a0 <42> 0f b6 04 28 84 c0 48 89 55 c0 0f 85 65 07 00 00 80 3a 00 74 61
RSP: 0018:ffffc90000907c78 EFLAGS: 00010202
RAX: 00000000000000d0 RBX: ffff888104fda430 RCX: dffffc0000000000
RDX: 0000000000000680 RSI: 0000000000000008 RDI: ffff888104fda430
RBP: ffffc90000907d08 R08: ffff888104fda437 R09: 1ffff110209fb486
R10: dffffc0000000000 R11: ffffed10209fb487 R12: ffff888104fde438
R13: dffffc0000000000 R14: 1ffff110209fbc87 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005601ca9b7410 CR3: 000000011fedb000 CR4: 00000000003506b0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TAS
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 fc add %bh,%ah
4: ff lcall (bad)
5: df 42 80 filds -0x80(%rdx)
8: 3c 28 cmp $0x28,%al
a: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
e: 89 ff mov %edi,%edi
10: e8 ce 04 20 fe call 0xfe2004e3
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 fc add %bh,%ah
4: ff lcall (bad)
5: df 42 80 filds -0x80(%rdx)
8: 3c 28 cmp $0x28,%al
a: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
e: 89 ff mov %edi,%edi
Reply all
Reply to author
Forward
0 new messages