================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 9222 is out of range for type 'const int[34]'
CPU: 0 PID: 1976 Comm: syz.7.482 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__alloc_pages+0x136/0x460 mm/page_alloc.c:5819
Code: 4c 8d 4c 24 1c 89 de 48 8b 54 24 10 e8 f3 f5 ff ff 84 c0 0f 84 8a 01 00 00 4c 8b 64 24 60 4c 89 e0 48 c1 e8 03 42 80 3c 28 00 <74> 08 4c 89 e7 e8 50 cd 04 00 4d 8b 3c 24 41 bc 00 08 00 00 44 23
RSP: 0018:ffffc90001087840 EFLAGS: 00000246
RAX: 1ffffffff0dca6b0 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888119971d90 RSI: 0000000000000001 RDI: ffffffff86e53598
RBP: ffffc90001087928 R08: ffffc90001087858 R09: ffffc9000108785c
R10: dffffc0000000000 R11: fffff52000210f17 R12: ffffffff86e53580
R13: dffffc0000000000 R14: 1ffff92000210f0c R15: 0000000000000000
vm_area_alloc_pages mm/vmalloc.c:-1 [inline]
__vmalloc_area_node mm/vmalloc.c:2981 [inline]
__vmalloc_node_range+0x507/0xad0 mm/vmalloc.c:3147
alloc_thread_stack_node kernel/fork.c:258 [inline]
dup_task_struct+0x41e/0xc50 kernel/fork.c:949
copy_process+0x5e0/0x3280 kernel/fork.c:2182
kernel_clone+0x233/0x960 kernel/fork.c:2742
__do_sys_clone3 kernel/fork.c:3026 [inline]
__se_sys_clone3 kernel/fork.c:3010 [inline]
__x64_sys_clone3+0x2da/0x370 kernel/fork.c:3010
x64_sys_call+0x53e/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:436
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9828b41c49
Code: 90 b8 01 00 00 00 b9 01 00 00 00 eb ec 0f 1f 40 00 b8 ea ff ff ff 48 85 ff 74 28 48 85 d2 74 23 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 14 74 01 c3 31 ed 4c 89 c7 ff d2 48 89 c7 b8 3c 00 00
RSP: 002b:00007ffe8f8b03c8 EFLAGS: 00000202 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f9828afd1e0 RCX: 00007f9828b41c49
RDX: 00007f9828afd1e0 RSI: 0000000000000058 RDI: 00007ffe8f8b0420
RBP: 00007f982759b6c0 R08: 00007f982759b6c0 R09: 00007ffe8f8b0507
R10: 0000000000000008 R11: 0000000000000202 R12: ffffffffffffffe8
R13: 000000000000000b R14: 00007ffe8f8b0420 R15: 00007ffe8f8b0508
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff857f68b8 by task syz.7.482/1976
CPU: 0 PID: 1976 Comm: syz.7.482 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x10f/0x150 mm/kasan/report.c:444
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__alloc_pages+0x136/0x460 mm/page_alloc.c:5819
Code: 4c 8d 4c 24 1c 89 de 48 8b 54 24 10 e8 f3 f5 ff ff 84 c0 0f 84 8a 01 00 00 4c 8b 64 24 60 4c 89 e0 48 c1 e8 03 42 80 3c 28 00 <74> 08 4c 89 e7 e8 50 cd 04 00 4d 8b 3c 24 41 bc 00 08 00 00 44 23
RSP: 0018:ffffc90001087840 EFLAGS: 00000246
RAX: 1ffffffff0dca6b0 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888119971d90 RSI: 0000000000000001 RDI: ffffffff86e53598
RBP: ffffc90001087928 R08: ffffc90001087858 R09: ffffc9000108785c
R10: dffffc0000000000 R11: fffff52000210f17 R12: ffffffff86e53580
R13: dffffc0000000000 R14: 1ffff92000210f0c R15: 0000000000000000
vm_area_alloc_pages mm/vmalloc.c:-1 [inline]
__vmalloc_area_node mm/vmalloc.c:2981 [inline]
__vmalloc_node_range+0x507/0xad0 mm/vmalloc.c:3147
alloc_thread_stack_node kernel/fork.c:258 [inline]
dup_task_struct+0x41e/0xc50 kernel/fork.c:949
copy_process+0x5e0/0x3280 kernel/fork.c:2182
kernel_clone+0x233/0x960 kernel/fork.c:2742
__do_sys_clone3 kernel/fork.c:3026 [inline]
__se_sys_clone3 kernel/fork.c:3010 [inline]
__x64_sys_clone3+0x2da/0x370 kernel/fork.c:3010
x64_sys_call+0x53e/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:436
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9828b41c49
Code: 90 b8 01 00 00 00 b9 01 00 00 00 eb ec 0f 1f 40 00 b8 ea ff ff ff 48 85 ff 74 28 48 85 d2 74 23 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 14 74 01 c3 31 ed 4c 89 c7 ff d2 48 89 c7 b8 3c 00 00
RSP: 002b:00007ffe8f8b03c8 EFLAGS: 00000202 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f9828afd1e0 RCX: 00007f9828b41c49
RDX: 00007f9828afd1e0 RSI: 0000000000000058 RDI: 00007ffe8f8b0420
RBP: 00007f982759b6c0 R08: 00007f982759b6c0 R09: 00007ffe8f8b0507
R10: 0000000000000008 R11: 0000000000000202 R12: ffffffffffffffe8
R13: 000000000000000b R14: 00007ffe8f8b0420 R15: 00007ffe8f8b0508
The buggy address belongs to the variable:
.str.41+0x18/0x20
Memory state around the buggy address:
ffffffff857f6780: f9 f9 f9 f9 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9
ffffffff857f6800: 00 00 00 05 f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9
>ffffffff857f6880: 05 f9 f9 f9 06 f9 f9 f9 00 00 00 04 f9 f9 f9 f9
^
ffffffff857f6900: 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
ffffffff857f6980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 9223 is out of range for type 'const int[34]'
CPU: 0 PID: 1976 Comm: syz.7.482 Tainted: G B W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__alloc_pages+0x136/0x460 mm/page_alloc.c:5819
Code: 4c 8d 4c 24 1c 89 de 48 8b 54 24 10 e8 f3 f5 ff ff 84 c0 0f 84 8a 01 00 00 4c 8b 64 24 60 4c 89 e0 48 c1 e8 03 42 80 3c 28 00 <74> 08 4c 89 e7 e8 50 cd 04 00 4d 8b 3c 24 41 bc 00 08 00 00 44 23
RSP: 0018:ffffc90001087840 EFLAGS: 00000246
RAX: 1ffffffff0dca6b0 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888119971d90 RSI: 0000000000000001 RDI: ffffffff86e53598
RBP: ffffc90001087928 R08: ffffc90001087858 R09: ffffc9000108785c
R10: dffffc0000000000 R11: fffff52000210f17 R12: ffffffff86e53580
R13: dffffc0000000000 R14: 1ffff92000210f0c R15: 0000000000000000
vm_area_alloc_pages mm/vmalloc.c:-1 [inline]
__vmalloc_area_node mm/vmalloc.c:2981 [inline]
__vmalloc_node_range+0x507/0xad0 mm/vmalloc.c:3147
alloc_thread_stack_node kernel/fork.c:258 [inline]
dup_task_struct+0x41e/0xc50 kernel/fork.c:949
copy_process+0x5e0/0x3280 kernel/fork.c:2182
kernel_clone+0x233/0x960 kernel/fork.c:2742
__do_sys_clone3 kernel/fork.c:3026 [inline]
__se_sys_clone3 kernel/fork.c:3010 [inline]
__x64_sys_clone3+0x2da/0x370 kernel/fork.c:3010
x64_sys_call+0x53e/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:436
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9828b41c49
Code: 90 b8 01 00 00 00 b9 01 00 00 00 eb ec 0f 1f 40 00 b8 ea ff ff ff 48 85 ff 74 28 48 85 d2 74 23 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 14 74 01 c3 31 ed 4c 89 c7 ff d2 48 89 c7 b8 3c 00 00
RSP: 002b:00007ffe8f8b03c8 EFLAGS: 00000202 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f9828afd1e0 RCX: 00007f9828b41c49
RDX: 00007f9828afd1e0 RSI: 0000000000000058 RDI: 00007ffe8f8b0420
RBP: 00007f982759b6c0 R08: 00007f982759b6c0 R09: 00007ffe8f8b0507
R10: 0000000000000008 R11: 0000000000000202 R12: ffffffffffffffe8
R13: 000000000000000b R14: 00007ffe8f8b0420 R15: 00007ffe8f8b0508
================================================================================
----------------
Code disassembly (best guess):
0: 4c 8d 4c 24 1c lea 0x1c(%rsp),%r9
5: 89 de mov %ebx,%esi
7: 48 8b 54 24 10 mov 0x10(%rsp),%rdx
c: e8 f3 f5 ff ff call 0xfffff604
11: 84 c0 test %al,%al
13: 0f 84 8a 01 00 00 je 0x1a3
19: 4c 8b 64 24 60 mov 0x60(%rsp),%r12
1e: 4c 89 e0 mov %r12,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
* 2a: 74 08 je 0x34 <-- trapping instruction
2c: 4c 89 e7 mov %r12,%rdi
2f: e8 50 cd 04 00 call 0x4cd84
34: 4d 8b 3c 24 mov (%r12),%r15
38: 41 bc 00 08 00 00 mov $0x800,%r12d
3e: 44 rex.R
3f: 23 .byte 0x23