================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 6691 is out of range for type 'const int[34]'
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:flush_smp_call_function_from_idle+0x15e/0x1b0 kernel/smp.c:699
Code: e6 00 02 00 00 31 ff e8 70 5c 0a 00 49 81 e6 00 02 00 00 75 07 e8 22 58 0a 00 eb 06 e8 1b 58 0a 00 fb 48 c7 04 24 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 65 48 8b 04 25 28 00 00 00 48 3b 44 24 48
RSP: 0018:ffffc90000157d60 EFLAGS: 00000293
RAX: ffffffff815f54d5 RBX: 0000000000000000 RCX: ffff88810030cf00
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc90000157df0 R08: ffff88810030cf07 R09: 1ffff110200619e0
R10: dffffc0000000000 R11: ffffed10200619e1 R12: 1ffff9200002afac
R13: 1ffff110200619e0 R14: 0000000000000200 R15: dffffc0000000000
do_idle+0x5cc/0x620 kernel/sched/idle.c:354
cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:424
start_secondary+0x2c8/0x380 arch/x86/kernel/smpboot.c:281
secondary_startup_64_no_verify+0xb1/0xbb
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff857f43ec by task swapper/1/0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x10f/0x150 mm/kasan/report.c:444
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:flush_smp_call_function_from_idle+0x15e/0x1b0 kernel/smp.c:699
Code: e6 00 02 00 00 31 ff e8 70 5c 0a 00 49 81 e6 00 02 00 00 75 07 e8 22 58 0a 00 eb 06 e8 1b 58 0a 00 fb 48 c7 04 24 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 65 48 8b 04 25 28 00 00 00 48 3b 44 24 48
RSP: 0018:ffffc90000157d60 EFLAGS: 00000293
RAX: ffffffff815f54d5 RBX: 0000000000000000 RCX: ffff88810030cf00
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc90000157df0 R08: ffff88810030cf07 R09: 1ffff110200619e0
R10: dffffc0000000000 R11: ffffed10200619e1 R12: 1ffff9200002afac
R13: 1ffff110200619e0 R14: 0000000000000200 R15: dffffc0000000000
do_idle+0x5cc/0x620 kernel/sched/idle.c:354
cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:424
start_secondary+0x2c8/0x380 arch/x86/kernel/smpboot.c:281
secondary_startup_64_no_verify+0xb1/0xbb
The buggy address belongs to the variable:
.str.25+0xc/0x20
Memory state around the buggy address:
ffffffff857f4280: 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 00 00 00 00
ffffffff857f4300: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
>ffffffff857f4380: 04 f9 f9 f9 03 f9 f9 f9 05 f9 f9 f9 05 f9 f9 f9
^
ffffffff857f4400: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
ffffffff857f4480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 6692 is out of range for type 'const int[34]'
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:flush_smp_call_function_from_idle+0x15e/0x1b0 kernel/smp.c:699
Code: e6 00 02 00 00 31 ff e8 70 5c 0a 00 49 81 e6 00 02 00 00 75 07 e8 22 58 0a 00 eb 06 e8 1b 58 0a 00 fb 48 c7 04 24 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 65 48 8b 04 25 28 00 00 00 48 3b 44 24 48
RSP: 0018:ffffc90000157d60 EFLAGS: 00000293
RAX: ffffffff815f54d5 RBX: 0000000000000000 RCX: ffff88810030cf00
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc90000157df0 R08: ffff88810030cf07 R09: 1ffff110200619e0
R10: dffffc0000000000 R11: ffffed10200619e1 R12: 1ffff9200002afac
R13: 1ffff110200619e0 R14: 0000000000000200 R15: dffffc0000000000
do_idle+0x5cc/0x620 kernel/sched/idle.c:354
cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:424
start_secondary+0x2c8/0x380 arch/x86/kernel/smpboot.c:281
secondary_startup_64_no_verify+0xb1/0xbb
================================================================================
----------------
Code disassembly (best guess):
0: e6 00 out %al,$0x0
2: 02 00 add (%rax),%al
4: 00 31 add %dh,(%rcx)
6: ff ljmp (bad)
7: e8 70 5c 0a 00 call 0xa5c7c
c: 49 81 e6 00 02 00 00 and $0x200,%r14
13: 75 07 jne 0x1c
15: e8 22 58 0a 00 call 0xa583c
1a: eb 06 jmp 0x22
1c: e8 1b 58 0a 00 call 0xa583c
21: fb sti
22: 48 c7 04 24 0e 36 e0 movq $0x45e0360e,(%rsp)
29: 45
* 2a: 4b c7 04 3c 00 00 00 movq $0x0,(%r12,%r15,1) <-- trapping instruction
31: 00
32: 65 48 8b 04 25 28 00 mov %gs:0x28,%rax
39: 00 00
3b: 48 3b 44 24 48 cmp 0x48(%rsp),%rax