================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 6691 is out of range for type 'const int[34]'
CPU: 0 PID: 30 Comm: kauditd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 06 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 b8 ba 17 00 eb 06 e8 b1 ba 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 a1 ba 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc900001ff880 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8881003bcf00
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc900001ffaf0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200003ff00 R12: 00000000000000da
R13: fffff5200003ff1c R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
vprintk_default+0x26/0x30 kernel/printk/printk.c:2309
vprintk+0x7a/0x80 kernel/printk/printk_safe.c:45
_printk+0xda/0x130 kernel/printk/printk.c:2319
kauditd_printk_skb kernel/audit.c:549 [inline]
kauditd_hold_skb+0x1bc/0x210 kernel/audit.c:584
kauditd_send_queue+0x28c/0x2e0 kernel/audit.c:769
kauditd_thread+0x4ea/0x880 kernel/audit.c:893
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff857f43ec by task kauditd/30
CPU: 0 PID: 30 Comm: kauditd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x10f/0x150 mm/kasan/report.c:444
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 06 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 b8 ba 17 00 eb 06 e8 b1 ba 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 a1 ba 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc900001ff880 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8881003bcf00
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc900001ffaf0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200003ff00 R12: 00000000000000da
R13: fffff5200003ff1c R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
vprintk_default+0x26/0x30 kernel/printk/printk.c:2309
vprintk+0x7a/0x80 kernel/printk/printk_safe.c:45
_printk+0xda/0x130 kernel/printk/printk.c:2319
kauditd_printk_skb kernel/audit.c:549 [inline]
kauditd_hold_skb+0x1bc/0x210 kernel/audit.c:584
kauditd_send_queue+0x28c/0x2e0 kernel/audit.c:769
kauditd_thread+0x4ea/0x880 kernel/audit.c:893
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
The buggy address belongs to the variable:
.str.25+0xc/0x20
Memory state around the buggy address:
ffffffff857f4280: 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 00 00 00 00
ffffffff857f4300: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
>ffffffff857f4380: 04 f9 f9 f9 03 f9 f9 f9 05 f9 f9 f9 05 f9 f9 f9
^
ffffffff857f4400: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
ffffffff857f4480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 6692 is out of range for type 'const int[34]'
CPU: 0 PID: 30 Comm: kauditd Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1751
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 06 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 b8 ba 17 00 eb 06 e8 b1 ba 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 a1 ba 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc900001ff880 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8881003bcf00
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc900001ffaf0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200003ff00 R12: 00000000000000da
R13: fffff5200003ff1c R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
vprintk_default+0x26/0x30 kernel/printk/printk.c:2309
vprintk+0x7a/0x80 kernel/printk/printk_safe.c:45
_printk+0xda/0x130 kernel/printk/printk.c:2319
kauditd_printk_skb kernel/audit.c:549 [inline]
kauditd_hold_skb+0x1bc/0x210 kernel/audit.c:584
kauditd_send_queue+0x28c/0x2e0 kernel/audit.c:769
kauditd_thread+0x4ea/0x880 kernel/audit.c:893
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
================================================================================
aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
0: 28 4c 89 f6 sub %cl,-0xa(%rcx,%rcx,4)
4: 48 81 e6 00 02 00 00 and $0x200,%rsi
b: 31 ff xor %edi,%edi
d: e8 06 bf 17 00 call 0x17bf18
12: 49 81 e6 00 02 00 00 and $0x200,%r14
19: 75 07 jne 0x22
1b: e8 b8 ba 17 00 call 0x17bad8
20: eb 06 jmp 0x28
22: e8 b1 ba 17 00 call 0x17bad8
27: fb sti
28: 89 d8 mov %ebx,%eax
* 2a: 0a 44 24 1f or 0x1f(%rsp),%al <-- trapping instruction
2e: a8 01 test $0x1,%al
30: 74 0e je 0x40
32: e8 a1 ba 17 00 call 0x17bad8
37: 85 db test %ebx,%ebx
39: 74 19 je 0x54
3b: e9 1b 03 00 00 jmp 0x35b