UBSAN: array-index-out-of-bounds in aiptek_irq

Status: upstream: reported C repro on 2026/06/10 19:26
Reported-by: syzbot+74b75376ca81b21ff7ca@syzkaller.appspotmail.com
First crash: 78d, last: 8d03h
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2026/08/24 upstream (ToT) 4352b8aee980 C Failed due to an error; will retry later
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-6-1 UBSAN: array-index-out-of-bounds in aiptek_irq origin:upstream 15 syz, C 572 3d18h 78d 0/2 upstream: reported C repro on 2026/06/10 15:23
linux-6.6 UBSAN: array-index-out-of-bounds in aiptek_irq origin:lts-only 15 syz, C inconclusive 143 8d07h 78d 0/2 upstream: reported C repro on 2026/06/10 20:15
android-6-12 UBSAN: array-index-out-of-bounds in aiptek_irq origin:lts 15 syz, C 1199 5h08m 78d 0/1 premoderation: reported C repro on 2026/06/10 12:41
linux-5.15 UBSAN: array-index-out-of-bounds in aiptek_irq origin:lts-only 15 syz, C done 20 8d05h 78d 0/3 upstream: reported C repro on 2026/06/10 17:51
android-5-15 UBSAN: array-index-out-of-bounds in aiptek_irq origin:upstream missing-backport 15 syz, C 53 10h54m 77d 0/2 upstream: reported C repro on 2026/06/11 06:49
android-5-10 UBSAN: array-index-out-of-bounds in aiptek_irq 15 syz, C 67 4d01h 78d 0/2 upstream: reported C repro on 2026/06/10 13:22

Sample crash report:
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 19545 is out of range for type 'const int[34]'
CPU: 0 PID: 4320 Comm: kworker/0:6 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
 aiptek_irq+0x1e87/0x28f0 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1673
 dummy_timer+0xa21/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xbc/0x120 kernel/locking/spinlock.c:194
Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 3f 89 1e f7 65 8b 05 b0 3a c8 75 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc900043c65c0 EFLAGS: 00000206
RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: 00245d449e24ba00
RDX: dffffc0000000000 RSI: ffffffff8a8c17a0 RDI: 0000000000000001
RBP: ffffc900043c6658 R08: ffffffff90b10277 R09: 1ffffffff216204e
R10: dffffc0000000000 R11: fffffbfff216204f R12: dffffc0000000000
R13: ffff88807e677640 R14: ffffffff8d1dfdb0 R15: 1ffff92000878cb8
 __stack_depot_save+0x439/0x480 lib/stackdepot.c:502
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_set_track+0x60/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slab_common.c:936 [inline]
 __kmalloc_node_track_caller+0xb0/0x240 mm/slab_common.c:956
 kstrdup mm/util.c:61 [inline]
 kstrdup_const+0x56/0x90 mm/util.c:84
 __kernfs_new_node+0xa6/0x7f0 fs/kernfs/dir.c:610
 kernfs_new_node+0x148/0x250 fs/kernfs/dir.c:690
 kernfs_create_dir_ns+0x40/0x120 fs/kernfs/dir.c:1046
 sysfs_create_dir_ns+0x12c/0x290 fs/sysfs/dir.c:59
 create_dir lib/kobject.c:63 [inline]
 kobject_add_internal+0x617/0xca0 lib/kobject.c:231
 kobject_add_varg lib/kobject.c:366 [inline]
 kobject_add+0x160/0x230 lib/kobject.c:418
 device_add+0x470/0x1050 drivers/base/core.c:3632
 cdev_device_add+0x19d/0x340 fs/char_dev.c:549
 evdev_connect+0x350/0x3f0 drivers/input/evdev.c:1386
 input_attach_handler drivers/input/input.c:1060 [inline]
 input_register_device+0xd91/0x12d0 drivers/input/input.c:2470
 aiptek_probe+0x14a1/0x1ba0 drivers/input/tablet/aiptek.c:1845
 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:638
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2659
 hub_port_connect drivers/usb/core/hub.c:5517 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5899
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 process_scheduled_works kernel/workqueue.c:2355 [inline]
 worker_thread+0xd6e/0x12a0 kernel/workqueue.c:2441
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
================================================================================
----------------
Code disassembly (best guess):
   0:	c7 44 24 20 00 00 00 	movl   $0x0,0x20(%rsp)
   7:	00
   8:	9c                   	pushf
   9:	8f 44 24 20          	pop    0x20(%rsp)
   d:	f7 44 24 20 00 02 00 	testl  $0x200,0x20(%rsp)
  14:	00
  15:	41 c6 04 07 f8       	movb   $0xf8,(%r15,%rax,1)
  1a:	75 4b                	jne    0x67
  1c:	f7 c3 00 02 00 00    	test   $0x200,%ebx
  22:	74 01                	je     0x25
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 3f 89 1e f7       	call   0xf71e896e <-- trapping instruction
  2f:	65 8b 05 b0 3a c8 75 	mov    %gs:0x75c83ab0(%rip),%eax        # 0x75c83ae6
  36:	85 c0                	test   %eax,%eax
  38:	74 3c                	je     0x76
  3a:	48                   	rex.W
  3b:	c7                   	.byte 0xc7
  3c:	04 24                	add    $0x24,%al
  3e:	0e                   	(bad)
  3f:	36                   	ss

Crashes (153):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/10 00:20 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/11 09:51 linux-6.1.y 228da13e907e b754d2d8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/11 09:15 linux-6.1.y 228da13e907e b754d2d8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/11 08:26 linux-6.1.y 228da13e907e b754d2d8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/20 01:36 linux-6.1.y 7e6e67054721 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/19 14:15 linux-6.1.y e4f7d8be268e 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/18 06:33 linux-6.1.y e4f7d8be268e 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/17 09:14 linux-6.1.y e4f7d8be268e 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/14 19:31 linux-6.1.y e4f7d8be268e 6f9b3e89 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/13 04:40 linux-6.1.y e4f7d8be268e 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/13 04:39 linux-6.1.y e4f7d8be268e 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/12 10:53 linux-6.1.y e4f7d8be268e f8d35649 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/09 08:58 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/08 23:09 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/08 21:48 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/08 14:21 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/06 02:40 linux-6.1.y fb28aa725e05 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/03 02:45 linux-6.1.y fb28aa725e05 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/30 06:40 linux-6.1.y 1016ca6176ee 6ef5c1e2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/28 23:40 linux-6.1.y dc5c83b7f5f8 edc8a875 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/26 23:31 linux-6.1.y dc5c83b7f5f8 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/24 22:06 linux-6.1.y dc5c83b7f5f8 dd737a83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/24 11:09 linux-6.1.y 090666d3cc90 544adce9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/23 21:40 linux-6.1.y 090666d3cc90 71a13572 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/21 17:32 linux-6.1.y 090666d3cc90 7c5de9c3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/19 09:56 linux-6.1.y 090666d3cc90 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/19 06:08 linux-6.1.y 090666d3cc90 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/13 21:36 linux-6.1.y 090666d3cc90 cc4833d0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/12 15:29 linux-6.1.y 090666d3cc90 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/08 20:19 linux-6.1.y 090666d3cc90 88a4b44c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/08 18:05 linux-6.1.y 090666d3cc90 88a4b44c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/07 09:23 linux-6.1.y 090666d3cc90 8e71ce95 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/06 20:35 linux-6.1.y 090666d3cc90 88b240e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/05 20:35 linux-6.1.y 090666d3cc90 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/05 16:00 linux-6.1.y 090666d3cc90 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/05 07:53 linux-6.1.y 090666d3cc90 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/04 21:02 linux-6.1.y 090666d3cc90 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/29 23:53 linux-6.1.y fdb6fcb41cc7 6a0c72dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/29 22:37 linux-6.1.y fdb6fcb41cc7 6a0c72dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/29 09:21 linux-6.1.y fdb6fcb41cc7 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/27 15:56 linux-6.1.y fdb6fcb41cc7 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/26 15:00 linux-6.1.y fdb6fcb41cc7 7ff32d8b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/10 19:25 linux-6.1.y 228da13e907e f79bac11 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/09 20:50 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/08 18:31 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/08/08 09:41 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/09 23:47 linux-6.1.y 090666d3cc90 a0c310a3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/06 18:51 linux-6.1.y 090666d3cc90 88b240e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/07/05 05:19 linux-6.1.y 090666d3cc90 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/29 20:30 linux-6.1.y fdb6fcb41cc7 6a0c72dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/29 20:11 linux-6.1.y fdb6fcb41cc7 6a0c72dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/29 19:08 linux-6.1.y fdb6fcb41cc7 6a0c72dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
2026/06/26 23:59 linux-6.1.y fdb6fcb41cc7 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 UBSAN: array-index-out-of-bounds in aiptek_irq
* Struck through repros no longer work on HEAD.