================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 23191 is out of range for type 'const int[34]'
CPU: 1 PID: 312 Comm: kworker/1:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1758
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x398/0x890 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:console_emit_next_record+0x87e/0xa80 kernel/printk/printk.c:2797
Code: de 48 81 e6 00 02 00 00 31 ff e8 dd 82 19 00 48 81 e3 00 02 00 00 75 07 e8 0f 7e 19 00 eb 06 e8 08 7e 19 00 fb 0f b6 5c 24 17 <66> 43 c7 44 2f 20 f8 f8 43 c6 44 2f 22 f8 4f 89 74 2f 10 66 43 c7
RSP: 0018:ffffc90000ea71e0 EFLAGS: 00000293
RAX: ffffffff8157e838 RBX: 0000000000000001 RCX: ffff88810f84d100
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc90000ea73d0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520001d4e2c R12: ffffc90000ea741f
R13: dffffc0000000000 R14: f8f8f8f8f8f8f8f8 R15: 1ffff920001d4e48
console_flush_all kernel/printk/printk.c:-1 [inline]
console_unlock+0x246/0x560 kernel/printk/printk.c:2917
vprintk_emit+0x14d/0x420 kernel/printk/printk.c:2308
dev_vprintk_emit+0x32f/0x3e4 drivers/base/core.c:4934
dev_printk_emit+0xeb/0x13c drivers/base/core.c:4945
__dev_printk+0x17f/0x1b0 drivers/base/core.c:4957
_dev_info+0x11b/0x16c drivers/base/core.c:5003
announce_device+0x11d/0x2b0 drivers/usb/core/hub.c:2402
usb_new_device+0x490/0x1500 drivers/usb/core/hub.c:2665
hub_port_connect drivers/usb/core/hub.c:5594 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5734 [inline]
port_event drivers/usb/core/hub.c:5898 [inline]
hub_event+0x27fb/0x4310 drivers/usb/core/hub.c:5980
process_one_work+0x717/0xc30 kernel/workqueue.c:2302
worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449
kthread+0x281/0x320 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff85e7bf5c by task kworker/1:2/312
CPU: 1 PID: 312 Comm: kworker/1:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x71/0x200 mm/kasan/report.c:316
print_report+0x4a/0x60 mm/kasan/report.c:420
kasan_report+0x122/0x150 mm/kasan/report.c:524
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1758
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x398/0x890 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:console_emit_next_record+0x87e/0xa80 kernel/printk/printk.c:2797
Code: de 48 81 e6 00 02 00 00 31 ff e8 dd 82 19 00 48 81 e3 00 02 00 00 75 07 e8 0f 7e 19 00 eb 06 e8 08 7e 19 00 fb 0f b6 5c 24 17 <66> 43 c7 44 2f 20 f8 f8 43 c6 44 2f 22 f8 4f 89 74 2f 10 66 43 c7
RSP: 0018:ffffc90000ea71e0 EFLAGS: 00000293
RAX: ffffffff8157e838 RBX: 0000000000000001 RCX: ffff88810f84d100
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc90000ea73d0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520001d4e2c R12: ffffc90000ea741f
R13: dffffc0000000000 R14: f8f8f8f8f8f8f8f8 R15: 1ffff920001d4e48
console_flush_all kernel/printk/printk.c:-1 [inline]
console_unlock+0x246/0x560 kernel/printk/printk.c:2917
vprintk_emit+0x14d/0x420 kernel/printk/printk.c:2308
dev_vprintk_emit+0x32f/0x3e4 drivers/base/core.c:4934
dev_printk_emit+0xeb/0x13c drivers/base/core.c:4945
__dev_printk+0x17f/0x1b0 drivers/base/core.c:4957
_dev_info+0x11b/0x16c drivers/base/core.c:5003
announce_device+0x11d/0x2b0 drivers/usb/core/hub.c:2402
usb_new_device+0x490/0x1500 drivers/usb/core/hub.c:2665
hub_port_connect drivers/usb/core/hub.c:5594 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5734 [inline]
port_event drivers/usb/core/hub.c:5898 [inline]
hub_event+0x27fb/0x4310 drivers/usb/core/hub.c:5980
process_one_work+0x717/0xc30 kernel/workqueue.c:2302
worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449
kthread+0x281/0x320 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
The buggy address belongs to the variable:
.str.32+0x1c/0x20
The buggy address belongs to the physical page:
page:ffffea0000179ec0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e7b
flags: 0x1000(reserved|zone=0)
raw: 0000000000001000 ffffea0000179ec8 ffffea0000179ec8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffffff85e7be00: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9
ffffffff85e7be80: 00 04 f9 f9 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9
>ffffffff85e7bf00: 05 f9 f9 f9 06 f9 f9 f9 00 02 f9 f9 04 f9 f9 f9
^
ffffffff85e7bf80: 06 f9 f9 f9 00 00 00 00 00 00 05 f9 f9 f9 f9 f9
ffffffff85e7c000: 00 00 00 00 00 00 02 f9 f9 f9 f9 f9 00 00 00 00
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 23192 is out of range for type 'const int[34]'
CPU: 1 PID: 312 Comm: kworker/1:2 Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1758
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x398/0x890 kernel/time/hrtimer.c:1749
hrtimer_run_softir
----------------
Code disassembly (best guess):
0: de 48 81 fimuls -0x7f(%rax)
3: e6 00 out %al,$0x0
5: 02 00 add (%rax),%al
7: 00 31 add %dh,(%rcx)
9: ff ljmp (bad)
a: e8 dd 82 19 00 call 0x1982ec
f: 48 81 e3 00 02 00 00 and $0x200,%rbx
16: 75 07 jne 0x1f
18: e8 0f 7e 19 00 call 0x197e2c
1d: eb 06 jmp 0x25
1f: e8 08 7e 19 00 call 0x197e2c
24: fb sti
25: 0f b6 5c 24 17 movzbl 0x17(%rsp),%ebx
* 2a: 66 43 c7 44 2f 20 f8 movw $0xf8f8,0x20(%r15,%r13,1) <-- trapping instruction
31: f8
32: 43 c6 44 2f 22 f8 movb $0xf8,0x22(%r15,%r13,1)
38: 4f 89 74 2f 10 mov %r14,0x10(%r15,%r13,1)
3d: 66 data16
3e: 43 rex.XB
3f: c7 .byte 0xc7