================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 4607 is out of range for type 'const int[34]'
CPU: 1 PID: 308 Comm: kworker/1:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 06 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 b8 ba 17 00 eb 06 e8 b1 ba 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 a1 ba 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc900077f6380 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc900080ea000 RSI: 00000000000fffff RDI: 0000000000100000
RBP: ffffc900077f65f0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000efec60 R12: 000000000000004d
R13: fffff52000efec7c R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
dev_vprintk_emit+0x2c5/0x360 drivers/base/core.c:4648
dev_printk_emit+0xeb/0x140 drivers/base/core.c:4659
__dev_printk+0x17f/0x1b0 drivers/base/core.c:4671
_dev_warn+0x11b/0x170 drivers/base/core.c:4715
hid_parser_main+0x737/0xac0 drivers/hid/hid-core.c:635
hid_open_report+0x846/0xec0 drivers/hid/hid-core.c:1270
hid_parse include/linux/hid.h:1064 [inline]
holtek_probe+0x1e/0x350 drivers/hid/hid-holtekff.c:185
hid_device_probe+0x28d/0x390 drivers/hid/hid-core.c:2320
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x27d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x193/0x270 drivers/base/dd.c:755
driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785
__device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2b0/0x420 drivers/base/dd.c:979
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028
bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489
device_add+0xaef/0xe90 drivers/base/core.c:3422
hid_add_device+0x349/0x4b0 drivers/hid/hid-core.c:2470
usbhid_probe+0xb93/0xf30 drivers/hid/usbhid/hid-core.c:1442
usb_probe_interface+0x60f/0xb20 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x27d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x193/0x270 drivers/base/dd.c:755
driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785
__device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2b0/0x420 drivers/base/dd.c:979
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028
bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489
device_add+0xaef/0xe90 drivers/base/core.c:3422
usb_set_configuration+0x1a01/0x1f70 drivers/usb/core/message.c:2223
usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x143/0x250 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x27d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x193/0x270 drivers/base/dd.c:755
driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785
__device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2b0/0x420 drivers/base/dd.c:979
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028
bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489
device_add+0xaef/0xe90 drivers/base/core.c:3422
usb_new_device+0xa1f/0x1720 drivers/usb/core/hub.c:2638
hub_port_connect drivers/usb/core/hub.c:5555 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5695 [inline]
port_event drivers/usb/core/hub.c:5861 [inline]
hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5943
process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
================================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 4608 is out of range for type 'const int[34]'
CPU: 1 PID: 308 Comm: kworker/1:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 06 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 b8 ba 17 00 eb 06 e8 b1 ba 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 a1 ba 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc900077f6380 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc900080ea000 RSI: 00000000000fffff RDI: 0000000000100000
RBP: ffffc900077f65f0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000efec60 R12: 000000000000004d
R13: fffff52000efec7c R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
dev_vprintk_emit+0x2c5/0x360 drivers/base/core.c:4648
dev_printk_emit+0xeb/0x140 drivers/base/core.c:4659
__dev_printk+0x17f/0x1b0 drivers/base/core.c:4671
_dev_warn+0x11b/0x170 drivers/base/core.c:4715
hid_parser_main+0x737/0xac0 drivers/hid/hid-core.c:635
hid_open_report+0x846/0xec0 drivers/hid/hid-core.c:1270
hid_parse include/linux/hid.h:1064 [inline]
holtek_probe+0x1e/0x350 drivers/hid/hid-holtekff.c:185
hid_device_probe+0x28d/0x390 drivers/hid/hid-core.c:2320
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x27d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x193/0x270 drivers/base/dd.c:755
driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785
__device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2b0/0x420 drivers/base/dd.c:979
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028
bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489
device_add+0xaef/0xe90 drivers/base/core.c:3422
hid_add_device+0x349/0x4b0 drivers/hid/hid-core.c:2470
usbhid_probe+0xb93/0xf30 drivers/hid/usbhid/hid-core.c:1442
usb_probe_interface+0x60f/0xb20 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x27d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x193/0x270 drivers/base/dd.c:755
driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785
__device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2b0/0x420 drivers/base/dd.c:979
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028
bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489
device_add+0xaef/0xe90 drivers/base/core.c:3422
usb_set_configuration+0x1a01/0x1f70 drivers/usb/core/message.c:2223
usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x143/0x250 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x27d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x193/0x270 drivers/base/dd.c:755
driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785
__device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2b0/0x420 drivers/base/dd.c:979
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028
bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489
device_add+0xaef/0xe90 drivers/base/core.c:3422
usb_new_device+0xa1f/0x1720 drivers/usb/core/hub.c:2638
hub_port_connect drivers/usb/core/hub.c:5555 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5695 [inline]
port_event drivers/usb/core/hub.c:5861 [inline]
hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5943
process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x1f32/0x29b0 drivers/input/tablet/aiptek.c:763
Read of size 4 at addr ffffffff857f20a0 by task kworker/1:4/308
CPU: 1 PID: 308 Comm: kworker/1:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x10f/0x150 mm/kasan/report.c:444
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
aiptek_irq+0x1f32/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 06 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 b8 ba 17 00 eb 06 e8 b1 ba 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 a1 ba 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc900077f6380 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc900080ea000 RSI: 00000000000fffff RDI: 0000000000100000
RBP: ffffc900077f65f0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000efec60 R12: 000000000000004d
R13: fffff52000efec7c R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
dev_vprintk_emit+0x2c5/0x360 drivers/base/core.c:4648
dev_printk_emit+0xeb/0x140 drivers/base/core.c:4659
__dev_printk+0x17f/0x1b0 drivers/base/core.c:4671
_dev_warn+0x11b/0x170 drivers/base/core.c:4715
hid_parser_main+0x737/0xac0 drivers/hid/hid-core.c:635
hid_open_report+0x846/0xec0 drivers/hid/hid-core.c:1270
hid_parse include/linux/hid.h:1064 [inline]
holtek_probe+0x1e/0x350 drivers/hid/hid-holtekff.c:185
hid_device_probe+0x28d/0x390 drivers/hid/hid-core.c:2320
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x27d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x193/0x270 drivers/base/dd.c:755
driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785
__device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2b0/0x420 drivers/base/dd.c:979
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028
bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489
device_add+0xaef/0xe90 drivers/base/core.c:3422
hid_add_device+0x349/0x4b0 drivers/hid/hid-core.c:2470
usbhid_probe+0xb93/0xf30 drivers/hid/usbhid/hid-core.c:1442
usb_probe_interface+0x60f/0xb20 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x27d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x193/0x270 drivers/base/dd.c:755
driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785
__device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2b0/0x420 drivers/base/dd.c:979
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028
bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489
device_add+0xaef/0xe90 drivers/base/core.c:3422
usb_set_configuration+0x1a01/0x1f70 drivers/usb/core/message.c:2223
usb_generic_driver_probe+0x91/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x143/0x250 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x27d/0x970 drivers/base/dd.c:595
__driver_probe_device+0x193/0x270 drivers/base/dd.c:755
driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785
__device_attach_driver+0x2a6/0x460 drivers/base/dd.c:907
bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
__device_attach+0x2b0/0x420 drivers/base/dd.c:979
device_initial_probe+0x1a/0x20 drivers/base/dd.c:1028
bus_probe_device+0xc0/0x1e0 drivers/base/bus.c:489
device_add+0xaef/0xe90 drivers/base/core.c:3422
usb_new_device+0xa1f/0x1720 drivers/usb/core/hub.c:2638
hub_port_connect drivers/usb/core/hub.c:5555 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5695 [inline]
port_event drivers/usb/core/hub.c:5861 [inline]
hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5943
process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
The buggy address belongs to the variable:
.str.8+0x20/0x60
Memory state around the buggy address:
ffffffff857f1f80: 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9 00 00 00 01
ffffffff857f2000: f9 f9 f9 f9 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9
>ffffffff857f2080: 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9 00 05 f9 f9
^
ffffffff857f2100: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
ffffffff857f2180: 00 00 00 00 00 01 f9 f9 04 f9 f9 f9 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 28 4c 89 f6 sub %cl,-0xa(%rcx,%rcx,4)
4: 48 81 e6 00 02 00 00 and $0x200,%rsi
b: 31 ff xor %edi,%edi
d: e8 06 bf 17 00 call 0x17bf18
12: 49 81 e6 00 02 00 00 and $0x200,%r14
19: 75 07 jne 0x22
1b: e8 b8 ba 17 00 call 0x17bad8
20: eb 06 jmp 0x28
22: e8 b1 ba 17 00 call 0x17bad8
27: fb sti
28: 89 d8 mov %ebx,%eax
* 2a: 0a 44 24 1f or 0x1f(%rsp),%al <-- trapping instruction
2e: a8 01 test $0x1,%al
30: 74 0e je 0x40
32: e8 a1 ba 17 00 call 0x17bad8
37: 85 db test %ebx,%ebx
39: 74 19 je 0x54
3b: e9 1b 03 00 00 jmp 0x35b