================================================================================ UBSAN: array-index-out-of-bounds in kernel/locking/osq_lock.c:34:9 index -30592 is out of range for type 'unsigned long[8]' CPU: 0 PID: 31014 Comm: syz.6.8906 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x169/0x1d8 lib/dump_stack.c:118 dump_stack+0x15/0x1c lib/dump_stack.c:135 ubsan_epilogue+0xe/0x40 lib/ubsan.c:148 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:347 decode_cpu kernel/locking/osq_lock.c:34 [inline] osq_lock+0x4c9/0x510 kernel/locking/osq_lock.c:111 mutex_optimistic_spin kernel/locking/mutex.c:672 [inline] __mutex_lock_common kernel/locking/mutex.c:976 [inline] __mutex_lock+0x224/0xc50 kernel/locking/mutex.c:1117 __mutex_lock_slowpath+0xe/0x10 kernel/locking/mutex.c:1379 mutex_lock+0xcf/0xe0 kernel/locking/mutex.c:299 steam_input_open+0x91/0x160 drivers/hid/hid-steam.c:297 input_open_device+0x14c/0x2a0 drivers/input/input.c:635 evdev_open_device drivers/input/evdev.c:400 [inline] evdev_open+0x4d2/0x5e0 drivers/input/evdev.c:487 chrdev_open+0x597/0x670 fs/char_dev.c:414 do_dentry_open+0x793/0x1090 fs/open.c:819 vfs_open+0x73/0x80 fs/open.c:942 do_open fs/namei.c:3391 [inline] path_openat+0x27ad/0x3160 fs/namei.c:3509 do_filp_open+0x1b3/0x3e0 fs/namei.c:3536 do_sys_openat2+0x14c/0x6d0 fs/open.c:1217 do_sys_open fs/open.c:1233 [inline] __do_sys_openat fs/open.c:1249 [inline] __se_sys_openat fs/open.c:1244 [inline] __x64_sys_openat+0x136/0x160 fs/open.c:1244 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f733cf05590 Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44 RSP: 002b:00007f733b96eb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f733cf05590 RDX: 0000000000000000 RSI: 00007f733b96ec10 RDI: 00000000ffffff9c RBP: 00007f733b96ec10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd R13: 00007f733d14e038 R14: 00007f733d14dfa0 R15: 00007ffda0c48298 ================================================================================ general protection fault, probably for non-canonical address 0xe68640064664b480: 0000 [#1] PREEMPT SMP KASAN KASAN: maybe wild-memory-access in range [0x343220323325a400-0x343220323325a407] CPU: 0 PID: 31014 Comm: syz.6.8906 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 RIP: 0010:osq_lock+0x148/0x510 kernel/locking/osq_lock.c:126 Code: c5 08 4c 89 e8 48 c1 e8 03 4c 03 33 48 89 45 b0 42 80 3c 20 00 74 08 4c 89 ef e8 63 85 52 00 4d 89 75 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 49 85 52 00 48 8b 45 c0 49 89 06 RSP: 0018:ffffc90001187468 EFLAGS: 00010202 RAX: 068644064664b480 RBX: ffffffff85988ac0 RCX: ffff8881615f2780 RDX: 0000000000000000 RSI: 0000000000000003 RDI: 00000000ffffffff RBP: ffffc900011874d0 R08: 0000000000000004 R09: 0000000000000003 R10: fffffbfff0d8ee48 R11: 1ffffffff0d8ee48 R12: dffffc0000000000 R13: ffff8881f7057208 R14: 343220323325a400 R15: ffff8881f7057214 FS: 00007f733b96f6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f733ceea060 CR3: 000000015b732000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mutex_optimistic_spin kernel/locking/mutex.c:672 [inline] __mutex_lock_common kernel/locking/mutex.c:976 [inline] __mutex_lock+0x224/0xc50 kernel/locking/mutex.c:1117 __mutex_lock_slowpath+0xe/0x10 kernel/locking/mutex.c:1379 mutex_lock+0xcf/0xe0 kernel/locking/mutex.c:299 steam_input_open+0x91/0x160 drivers/hid/hid-steam.c:297 input_open_device+0x14c/0x2a0 drivers/input/input.c:635 evdev_open_device drivers/input/evdev.c:400 [inline] evdev_open+0x4d2/0x5e0 drivers/input/evdev.c:487 chrdev_open+0x597/0x670 fs/char_dev.c:414 do_dentry_open+0x793/0x1090 fs/open.c:819 vfs_open+0x73/0x80 fs/open.c:942 do_open fs/namei.c:3391 [inline] path_openat+0x27ad/0x3160 fs/namei.c:3509 do_filp_open+0x1b3/0x3e0 fs/namei.c:3536 do_sys_openat2+0x14c/0x6d0 fs/open.c:1217 do_sys_open fs/open.c:1233 [inline] __do_sys_openat fs/open.c:1249 [inline] __se_sys_openat fs/open.c:1244 [inline] __x64_sys_openat+0x136/0x160 fs/open.c:1244 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f733cf05590 Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44 RSP: 002b:00007f733b96eb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f733cf05590 RDX: 0000000000000000 RSI: 00007f733b96ec10 RDI: 00000000ffffff9c RBP: 00007f733b96ec10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd R13: 00007f733d14e038 R14: 00007f733d14dfa0 R15: 00007ffda0c48298 Modules linked in: ---[ end trace aabf91c61492e5a7 ]--- RIP: 0010:osq_lock+0x148/0x510 kernel/locking/osq_lock.c:126 Code: c5 08 4c 89 e8 48 c1 e8 03 4c 03 33 48 89 45 b0 42 80 3c 20 00 74 08 4c 89 ef e8 63 85 52 00 4d 89 75 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 49 85 52 00 48 8b 45 c0 49 89 06 RSP: 0018:ffffc90001187468 EFLAGS: 00010202 RAX: 068644064664b480 RBX: ffffffff85988ac0 RCX: ffff8881615f2780 RDX: 0000000000000000 RSI: 0000000000000003 RDI: 00000000ffffffff RBP: ffffc900011874d0 R08: 0000000000000004 R09: 0000000000000003 R10: fffffbfff0d8ee48 R11: 1ffffffff0d8ee48 R12: dffffc0000000000 R13: ffff8881f7057208 R14: 343220323325a400 R15: ffff8881f7057214 FS: 00007f733b96f6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f733ceea060 CR3: 000000015b732000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 08 4c 89 e8 or %cl,-0x18(%rcx,%rcx,4) 4: 48 c1 e8 03 shr $0x3,%rax 8: 4c 03 33 add (%rbx),%r14 b: 48 89 45 b0 mov %rax,-0x50(%rbp) f: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) 14: 74 08 je 0x1e 16: 4c 89 ef mov %r13,%rdi 19: e8 63 85 52 00 call 0x528581 1e: 4d 89 75 00 mov %r14,0x0(%r13) 22: 4c 89 f0 mov %r14,%rax 25: 48 c1 e8 03 shr $0x3,%rax * 29: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 f7 mov %r14,%rdi 33: e8 49 85 52 00 call 0x528581 38: 48 8b 45 c0 mov -0x40(%rbp),%rax 3c: 49 89 06 mov %rax,(%r14)