================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 1055 is out of range for type 'const int[34]'
CPU: 1 PID: 311 Comm: kworker/1:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1672
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1749
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 86 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 38 bb 17 00 eb 06 e8 31 bb 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 21 bb 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc90007827240 EFLAGS: 00000283
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc9000a013000 RSI: 000000000000a01f RDI: 000000000000a020
RBP: ffffc900078274b0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000f04e38 R12: 0000000000000065
R13: fffff52000f04e54 R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
dev_vprintk_emit+0x2c5/0x360 drivers/base/core.c:4660
dev_printk_emit+0xeb/0x140 drivers/base/core.c:4671
__dev_printk+0x17f/0x1b0 drivers/base/core.c:4683
_dev_info+0x11b/0x170 drivers/base/core.c:4729
announce_device+0xa7/0x2b0 drivers/usb/core/hub.c:2346
usb_new_device+0x613/0x1720 drivers/usb/core/hub.c:2619
hub_port_connect drivers/usb/core/hub.c:5555 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5695 [inline]
port_event drivers/usb/core/hub.c:5861 [inline]
hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5943
process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff857eecbc by task kworker/1:3/311
CPU: 1 PID: 311 Comm: kworker/1:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x10f/0x150 mm/kasan/report.c:444
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1672
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1749
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 86 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 38 bb 17 00 eb 06 e8 31 bb 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 21 bb 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc90007827240 EFLAGS: 00000283
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc9000a013000 RSI: 000000000000a01f RDI: 000000000000a020
RBP: ffffc900078274b0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000f04e38 R12: 0000000000000065
R13: fffff52000f04e54 R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
dev_vprintk_emit+0x2c5/0x360 drivers/base/core.c:4660
dev_printk_emit+0xeb/0x140 drivers/base/core.c:4671
__dev_printk+0x17f/0x1b0 drivers/base/core.c:4683
_dev_info+0x11b/0x170 drivers/base/core.c:4729
announce_device+0xa7/0x2b0 drivers/usb/core/hub.c:2346
usb_new_device+0x613/0x1720 drivers/usb/core/hub.c:2619
hub_port_connect drivers/usb/core/hub.c:5555 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5695 [inline]
port_event drivers/usb/core/hub.c:5861 [inline]
hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5943
process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
The buggy address belongs to the variable:
.str.2+0x1c/0x20
Memory state around the buggy address:
ffffffff857eeb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffff857eec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff857eec80: 00 f9 f9 f9 00 f9 f9 f9 00 00 00 00 00 00 00 04
^
ffffffff857eed00: f9 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 00 00 00 04
ffffffff857eed80: f9 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 00 00 00 03
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 1056 is out of range for type 'const int[34]'
CPU: 1 PID: 311 Comm: kworker/1:3 Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1672
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1749
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 86 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 38 bb 17 00 eb 06 e8 31 bb 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 21 bb 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc90007827240 EFLAGS: 00000283
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc9000a013000 RSI: 000000000000a01f RDI: 000000000000a020
RBP: ffffc900078274b0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000f04e38 R12: 0000000000000065
R13: fffff52000f04e54 R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
dev_vprintk_emit+0x2c5/0x360 drivers/base/core.c:4660
dev_printk_emit+0xeb/0x140 drivers/base/core.c:4671
__dev_printk+0x17f/0x1b0 drivers/base/core.c:4683
_dev_info+0x11b/0x170 drivers/base/core.c:4729
announce_device+0xa7/0x2b0 drivers/usb/core/hub.c:2346
usb_new_device+0x613/0x1720 drivers/usb/core/hub.c:2619
hub_port_connect drivers/usb/core/hub.c:5555 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5695 [inline]
port_event drivers/usb/core/hub.c:5861 [inline]
hub_event+0x291b/0x43f0 drivers/usb/core/hub.c:5943
process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
================================================================================
aiptek 7-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
0: 28 4c 89 f6 sub %cl,-0xa(%rcx,%rcx,4)
4: 48 81 e6 00 02 00 00 and $0x200,%rsi
b: 31 ff xor %edi,%edi
d: e8 86 bf 17 00 call 0x17bf98
12: 49 81 e6 00 02 00 00 and $0x200,%r14
19: 75 07 jne 0x22
1b: e8 38 bb 17 00 call 0x17bb58
20: eb 06 jmp 0x28
22: e8 31 bb 17 00 call 0x17bb58
27: fb sti
28: 89 d8 mov %ebx,%eax
* 2a: 0a 44 24 1f or 0x1f(%rsp),%al <-- trapping instruction
2e: a8 01 test $0x1,%al
30: 74 0e je 0x40
32: e8 21 bb 17 00 call 0x17bb58
37: 85 db test %ebx,%ebx
39: 74 19 je 0x54
3b: e9 1b 03 00 00 jmp 0x35b