================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 26530 is out of range for type 'const int[34]'
CPU: 0 PID: 2510 Comm: syz.6.447 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1673
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1756
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x398/0x8a0 kernel/time/hrtimer.c:1753
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1770
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:207 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:239 [inline]
RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
RIP: 0010:PageSwapBacked include/linux/page-flags.h:508 [inline]
RIP: 0010:mm_counter_file include/linux/mm.h:2476 [inline]
RIP: 0010:mm_counter include/linux/mm.h:2485 [inline]
RIP: 0010:zap_pte_range mm/memory.c:1473 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1599 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1628 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1649 [inline]
RIP: 0010:unmap_page_range+0x1609/0x2360 mm/memory.c:1670
Code: f6 c5 01 0f 85 15 05 00 00 e8 63 53 c6 ff 4d 89 fd 4c 89 ef be 08 00 00 00 e8 e3 e0 0b 00 4c 89 e8 48 c1 e8 03 42 80 3c 30 00 <74> 08 4c 89 ef e8 5d de 0b 00 49 8b 75 00 49 89 f5 49 c1 e5 2c 49
RSP: 0018:ffffc90006baf3e0 EFLAGS: 00000246
RAX: 1ffffd4000977170 RBX: 1ffffd4000977171 RCX: ffffffff81ab1aed
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea0004bb8b80
RBP: ffffc90006baf5b0 R08: ffffea0004bb8b87 R09: 1ffffd4000977170
R10: dffffc0000000000 R11: fffff94000977171 R12: ffffea0004bb8b88
R13: ffffea0004bb8b80 R14: dffffc0000000000 R15: ffffea0004bb8b80
unmap_single_vma mm/memory.c:1716 [inline]
unmap_vmas+0x34c/0x480 mm/memory.c:1756
exit_mmap+0x2a4/0xc10 mm/mmap.c:3371
__mmput+0x92/0x340 kernel/fork.c:1321
mmput+0x4b/0x150 kernel/fork.c:1345
exit_mm kernel/exit.c:575 [inline]
do_exit+0xa62/0x29f0 kernel/exit.c:883
do_group_exit+0x21b/0x2e0 kernel/exit.c:1040
get_signal+0x167c/0x1700 kernel/signal.c:2904
arch_do_signal_or_restart+0xd1/0x11c0 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f8fe259e159
Code: Unable to access opcode bytes at 0x7f8fe259e12f.
RSP: 002b:00007f8fe35350e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f8fe2825fa8 RCX: 00007f8fe259e159
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f8fe2825fac
RBP: 00007f8fe2825fa0 R08: 00049e6ae27a93b0 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8fe2826038 R14: 00007fffcc4d9cd0 R15: 00007fffcc4d9db8
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff85e7fec8 by task syz.6.447/2510
CPU: 0 PID: 2510 Comm: syz.6.447 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x71/0x200 mm/kasan/report.c:316
print_report+0x4a/0x60 mm/kasan/report.c:420
kasan_report+0x122/0x150 mm/kasan/report.c:524
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1673
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1756
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x398/0x8a0 kernel/time/hrtimer.c:1753
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1770
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:207 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:239 [inline]
RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
RIP: 0010:PageSwapBacked include/linux/page-flags.h:508 [inline]
RIP: 0010:mm_counter_file include/linux/mm.h:2476 [inline]
RIP: 0010:mm_counter include/linux/mm.h:2485 [inline]
RIP: 0010:zap_pte_range mm/memory.c:1473 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1599 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1628 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1649 [inline]
RIP: 0010:unmap_page_range+0x1609/0x2360 mm/memory.c:1670
Code: f6 c5 01 0f 85 15 05 00 00 e8 63 53 c6 ff 4d 89 fd 4c 89 ef be 08 00 00 00 e8 e3 e0 0b 00 4c 89 e8 48 c1 e8 03 42 80 3c 30 00 <74> 08 4c 89 ef e8 5d de 0b 00 49 8b 75 00 49 89 f5 49 c1 e5 2c 49
RSP: 0018:ffffc90006baf3e0 EFLAGS: 00000246
RAX: 1ffffd4000977170 RBX: 1ffffd4000977171 RCX: ffffffff81ab1aed
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea0004bb8b80
RBP: ffffc90006baf5b0 R08: ffffea0004bb8b87 R09: 1ffffd4000977170
R10: dffffc0000000000 R11: fffff94000977171 R12: ffffea0004bb8b88
R13: ffffea0004bb8b80 R14: dffffc0000000000 R15: ffffea0004bb8b80
unmap_single_vma mm/memory.c:1716 [inline]
unmap_vmas+0x34c/0x480 mm/memory.c:1756
exit_mmap+0x2a4/0xc10 mm/mmap.c:3371
__mmput+0x92/0x340 kernel/fork.c:1321
mmput+0x4b/0x150 kernel/fork.c:1345
exit_mm kernel/exit.c:575 [inline]
do_exit+0xa62/0x29f0 kernel/exit.c:883
do_group_exit+0x21b/0x2e0 kernel/exit.c:1040
get_signal+0x167c/0x1700 kernel/signal.c:2904
arch_do_signal_or_restart+0xd1/0x11c0 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f8fe259e159
Code: Unable to access opcode bytes at 0x7f8fe259e12f.
RSP: 002b:00007f8fe35350e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f8fe2825fa8 RCX: 00007f8fe259e159
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f8fe2825fac
RBP: 00007f8fe2825fa0 R08: 00049e6ae27a93b0 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8fe2826038 R14: 00007fffcc4d9cd0 R15: 00007fffcc4d9db8
The buggy address belongs to the variable:
.str.155+0x8/0x20
The buggy address belongs to the physical page:
page:ffffea0000179fc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e7f
flags: 0x1000(reserved|zone=0)
raw: 0000000000001000 ffffea0000179fc8 ffffea0000179fc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffffff85e7fd80: f9 f9 f9 f9 00 00 06 f9 f9 f9 f9 f9 00 04 f9 f9
ffffffff85e7fe00: 00 04 f9 f9 07 f9 f9 f9 00 00 00 00 00 00 00 00
>ffffffff85e7fe80: 00 00 00 05 f9 f9 f9 f9 07 f9 f9 f9 00 00 f9 f9
^
ffffffff85e7ff00: 00 00 06 f9 f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9
ffffffff85e7ff80: 00 00 04 f9 f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 26531 is out of range for type 'const int[34]'
CPU: 0 PID: 2510 Comm: syz.6.447 Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1673
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1756
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x398/0x8a0 kernel/time/hrtimer.c:1753
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1770
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:207 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:239 [inline]
RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
RIP: 0010:PageSwapBacked include/linux/page-flags.h:508 [inline]
RIP: 0010:mm_counter_file include/linux/mm.h:2476 [inline]
RIP: 0010:mm_counter include/linux/mm.h:2485 [inline]
RIP: 0010:zap_pte_range mm/memory.c:1473 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1599 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1628 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1649 [inline]
RIP: 0010:unmap_page_range+0x1609/0x2360 mm/memory.c:1670
Code: f6 c5 01 0f 85 15 05 00 00 e8 63 53 c6 ff 4d 89 fd 4c 89 ef be 08 00 00 00 e8 e3 e0 0b 00 4c 89 e8 48 c1 e8 03 42 80 3c 30 00 <74> 08 4c 89 ef e8 5d de 0b 00 49 8b 75 00 49 89 f5 49 c1 e5 2c 49
RSP: 0018:ffffc90006baf3e0 EFLAGS: 00000246
RAX: 1ffffd4000977170 RBX: 1ffffd4000977171 RCX: ffffffff81ab1aed
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea0004bb8b80
RBP: ffffc90006baf5b0 R08: ffffea0004bb8b87 R09: 1ffffd4000977170
R10: dffffc0000000000 R11: fffff94000977171 R12: ffffea0004bb8b88
R13: ffffea0004bb8b80 R14: dffffc0000000000 R15: ffffea0004bb8b80
unmap_single_vma mm/memory.c:1716 [inline]
unmap_vmas+0x34c/0x480 mm/memory.c:1756
exit_mmap+0x2a4/0xc10 mm/mmap.c:3371
__mmput+0x92/0x340 kernel/fork.c:1321
mmput+0x4b/0x150 kernel/fork.c:1345
exit_mm kernel/exit.c:575 [inline]
do_exit+0xa62/0x29f0 kernel/exit.c:883
do_group_exit+0x21b/0x2e0 kernel/exit.c:1040
get_signal+0x167c/0x1700 kernel/signal.c:2904
arch_do_signal_or_restart+0xd1/0x11c0 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f8fe259e159
Code: Unable to access opcode bytes at 0x7f8fe259e12f.
RSP: 002b:00007f8fe35350e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f8fe2825fa8 RCX: 00007f8fe259e159
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f8fe2825fac
RBP: 00007f8fe2825fa0 R08: 00049e6ae27a93b0 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8fe2826038 R14: 00007fffcc4d9cd0 R15: 00007fffcc4d9db8
================================================================================
aiptek 9-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
0: f6 c5 01 test $0x1,%ch
3: 0f 85 15 05 00 00 jne 0x51e
9: e8 63 53 c6 ff call 0xffc65371
e: 4d 89 fd mov %r15,%r13
11: 4c 89 ef mov %r13,%rdi
14: be 08 00 00 00 mov $0x8,%esi
19: e8 e3 e0 0b 00 call 0xbe101
1e: 4c 89 e8 mov %r13,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1)
* 2a: 74 08 je 0x34 <-- trapping instruction
2c: 4c 89 ef mov %r13,%rdi
2f: e8 5d de 0b 00 call 0xbde91
34: 49 8b 75 00 mov 0x0(%r13),%rsi
38: 49 89 f5 mov %rsi,%r13
3b: 49 c1 e5 2c shl $0x2c,%r13
3f: 49 rex.WB