UBSAN: array-index-out-of-bounds in aiptek_irq

Status: premoderation: reported C repro on 2026/06/10 12:41
Bug presence: origin:lts
[Documentation on labels]
Reported-by: syzbot+2f11d982e4c9566d10f6@syzkaller.appspotmail.com
First crash: 94d, last: 24m
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2026/06/15 lts (merge base) e7a3953084a7 C [report] lost connection to test machine
2026/08/21 upstream (ToT) 818bebeb63dd C Didn't crash
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 UBSAN: array-index-out-of-bounds in aiptek_irq 15 syz, C 170 3d22h 94d 0/3 upstream: reported C repro on 2026/06/10 19:26
android-6-1 UBSAN: array-index-out-of-bounds in aiptek_irq origin:upstream 15 syz, C 584 6h42m 94d 0/2 upstream: reported C repro on 2026/06/10 15:23
linux-6.6 UBSAN: array-index-out-of-bounds in aiptek_irq origin:lts-only 15 syz, C inconclusive 161 5d17h 94d 0/2 upstream: reported C repro on 2026/06/10 20:15
linux-5.15 UBSAN: array-index-out-of-bounds in aiptek_irq origin:lts-only 15 syz, C done 22 12d 94d 0/3 upstream: reported C repro on 2026/06/10 17:51
android-5-15 UBSAN: array-index-out-of-bounds in aiptek_irq origin:upstream missing-backport 15 syz, C 55 13d 93d 0/2 upstream: reported C repro on 2026/06/11 06:49
android-5-10 UBSAN: array-index-out-of-bounds in aiptek_irq 15 syz, C 71 12d 94d 0/2 upstream: reported C repro on 2026/06/10 13:22

Sample crash report:
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 21762 is out of range for type 'const int[34]'
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
 aiptek_irq+0x208d/0x2a00 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x36e/0x530 drivers/usb/core/hcd.c:1648
 usb_hcd_giveback_urb+0x12b/0x400 drivers/usb/core/hcd.c:1732
 dummy_timer+0xa3f/0x4900 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1758 [inline]
 __hrtimer_run_queues+0x3ab/0x8e0 kernel/time/hrtimer.c:1822
 hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1839
 handle_softirqs+0x1aa/0x620 kernel/softirq.c:621
 __do_softirq kernel/softirq.c:659 [inline]
 invoke_softirq kernel/softirq.c:476 [inline]
 __irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
 irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:116
Code: cc cc cc cc cc cc cc b8 0d ee 83 1e 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 03 48 42 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2
RAX: ffff8881f6f00000 RBX: ffff88810366cc00 RCX: ffffffff85a514fd
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000000196c4
RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd
R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000
R13: 1ffff110206cd980 R14: dffffc0000000000 R15: ffffffff87ece068
 arch_safe_halt arch/x86/include/asm/paravirt.h:-1 [inline]
 default_idle+0x17/0x30 arch/x86/kernel/process.c:754
 arch_cpu_idle+0xd/0x20 arch/x86/kernel/process.c:791
 default_idle_call+0x3e/0x80 kernel/sched/idle.c:117
 cpuidle_idle_call kernel/sched/idle.c:193 [inline]
 do_idle+0x2fc/0x570 kernel/sched/idle.c:346
 cpu_startup_entry+0x47/0x60 kernel/sched/idle.c:445
 start_secondary+0x12e/0x140 arch/x86/kernel/smpboot.c:314
 common_startup_64+0x13b/0x157
 </TASK>
---[ end trace ]---
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 21763 is out of range for type 'const int[34]'
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
 aiptek_irq+0x1f3c/0x2a00 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x36e/0x530 drivers/usb/core/hcd.c:1648
 usb_hcd_giveback_urb+0x12b/0x400 drivers/usb/core/hcd.c:1732
 dummy_timer+0xa3f/0x4900 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1758 [inline]
 __hrtimer_run_queues+0x3ab/0x8e0 kernel/time/hrtimer.c:1822
 hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1839
 handle_softirqs+0x1aa/0x620 kernel/softirq.c:621
 __do_softirq kernel/softirq.c:659 [inline]
 invoke_softirq kernel/softirq.c:476 [inline]
 __irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
 irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:116
Code: cc cc cc cc cc cc cc b8 0d ee 83 1e 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 03 48 42 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c2
RAX: ffff8881f6f00000 RBX: ffff88810366cc00 RCX: ffffffff85a514fd
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000000196c4
RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd
R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000
R13: 1ffff110206cd980 R14: dffffc0000000000 R15: ffffffff87ece068
 arch_safe_halt arch/x86/include/asm/paravirt.h:-1 [inline]
 default_idle+0x17/0x30 arch/x86/kernel/process.c:754
 arch_cpu_idle+0xd/0x20 arch/x86/kernel/process.c:791
 default_idle_call+0x3e/0x80 kernel/sched/idle.c:117
 cpuidle_idle_call kernel/sched/idle.c:193 [inline]
 do_idle+0x2fc/0x570 kernel/sched/idle.c:346
 cpu_startup_entry+0x47/0x60 kernel/sched/idle.c:445
 start_secondary+0x12e/0x140 arch/x86/kernel/smpboot.c:314
 common_startup_64+0x13b/0x157
 </TASK>
---[ end trace ]---
----------------
Code disassembly (best guess):
   0:	cc                   	int3
   1:	cc                   	int3
   2:	cc                   	int3
   3:	cc                   	int3
   4:	cc                   	int3
   5:	cc                   	int3
   6:	cc                   	int3
   7:	b8 0d ee 83 1e       	mov    $0x1e83ee0d,%eax
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	f3 0f 1e fa          	endbr64
  1b:	66 90                	xchg   %ax,%ax
  1d:	0f 00 2d 03 48 42 00 	verw   0x424803(%rip)        # 0x424827
  24:	55                   	push   %rbp
  25:	48 89 e5             	mov    %rsp,%rbp
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	5d                   	pop    %rbp <-- trapping instruction
  2b:	c3                   	ret
  2c:	cc                   	int3
  2d:	cc                   	int3
  2e:	cc                   	int3
  2f:	cc                   	int3
  30:	cc                   	int3
  31:	cc                   	int3
  32:	cc                   	int3
  33:	cc                   	int3
  34:	cc                   	int3
  35:	cc                   	int3
  36:	cc                   	int3
  37:	b8 00 00 00 00       	mov    $0x0,%eax
  3c:	90                   	nop
  3d:	90                   	nop
  3e:	90                   	nop
  3f:	90                   	nop

Crashes (1293):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/12 17:38 android16-6.12 8eff909dd82d 70a60e12 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/21 08:49 android16-6.12 11fb45c3d713 1e72964b .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/13 21:54 android16-6.12 8f68185b8289 1d2f3589 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/11 10:11 android16-6.12 5eaad0115056 b754d2d8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/11 08:21 android16-6.12 5eaad0115056 b754d2d8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/10 22:54 android16-6.12 cf3d484a7cc5 f79bac11 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/10 16:01 android16-6.12 cf3d484a7cc5 f79bac11 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/10 14:22 android16-6.12 cf3d484a7cc5 f79bac11 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/10 13:51 android16-6.12 cf3d484a7cc5 f79bac11 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/10 13:29 android16-6.12 cf3d484a7cc5 f79bac11 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/10 13:06 android16-6.12 cf3d484a7cc5 f79bac11 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/12 22:20 android16-6.12 8eff909dd82d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/12 19:45 android16-6.12 8eff909dd82d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/12 17:15 android16-6.12 8eff909dd82d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/12 16:11 android16-6.12 8eff909dd82d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/12 14:49 android16-6.12 8eff909dd82d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/12 12:32 android16-6.12 8eff909dd82d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/12 10:18 android16-6.12 8eff909dd82d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/12 07:35 android16-6.12 8eff909dd82d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/12 04:43 android16-6.12 8eff909dd82d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/12 03:12 android16-6.12 8eff909dd82d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/12 03:10 android16-6.12 8eff909dd82d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/11 21:26 android16-6.12 37fc3d36e6e2 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/11 19:33 android16-6.12 37fc3d36e6e2 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/11 16:02 android16-6.12 37fc3d36e6e2 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/10 02:37 android16-6.12 89698cd757af 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/09 15:53 android16-6.12 d768b2f486b5 8387c273 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/08 16:47 android16-6.12 136b3cf43ec1 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/08 05:24 android16-6.12 e0485c4d49da 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/08 04:07 android16-6.12 e0485c4d49da 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/08 01:36 android16-6.12 e0485c4d49da 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/07 23:50 android16-6.12 e0485c4d49da 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/07 22:28 android16-6.12 e0485c4d49da 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/07 19:51 android16-6.12 e0485c4d49da 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/07 18:40 android16-6.12 e0485c4d49da 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/07 08:37 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/07 06:41 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/07 05:10 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/07 04:09 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/06 22:18 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/06 19:04 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/06 15:48 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/06 13:20 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/06 12:38 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/06 10:43 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/06 09:30 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/06 05:48 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/06 00:00 android16-6.12 4e585dd7f3b7 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/03 12:19 android16-6.12 8473ff8a565c 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/03 09:34 android16-6.12 8473ff8a565c 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/02 10:56 android16-6.12 97fb1ec747d3 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/02 07:55 android16-6.12 97fb1ec747d3 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/02 05:32 android16-6.12 97fb1ec747d3 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/01 23:31 android16-6.12 77b3c87e00dc 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
2026/09/01 19:48 android16-6.12 77b3c87e00dc 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust UBSAN: array-index-out-of-bounds in aiptek_irq
* Struck through repros no longer work on HEAD.