Extracting prog: 1m13.60690681s
Minimizing prog: 13m53.218117834s
Simplifying prog options: 0s
Extracting C: 23.090008912s
Simplifying C: 3m4.16801657s


extracting reproducer from 10 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-syz_usb_disconnect-syz_usb_connect-syz_usb_connect$uac2-syz_usb_connect-syz_open_dev$char_usb-write$char_usb-syz_usb_control_io$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io$hid-syz_usb_control_io$lan78xx-syz_usb_connect$midi
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000500)={{0x12, 0x1, 0x110, 0x59, 0xa6, 0x90, 0x40, 0x46d, 0x920, 0x7855, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x95, 0x10, 0x99, "", [{{0x9, 0x4, 0x5b, 0x18, 0x0, 0x22, 0x1a, 0xd1, 0x1}}]}}]}}, 0x0)
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="1201500254300510b00d6968b373010203010902120001000000000904"], &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0})
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000c0780a402a1101007f9e0102030109022400010000000009040000020a"], 0x0)
r2 = syz_usb_connect$uac2(0x6, 0xb4, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x3263, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x81, 0x40, 0x3, {0x8, 0xb, 0x2, 0x0, 0x1, 0x0, 0x20, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x1, 0x1d, 0x6}, [@source_unit={0x8, 0x24, 0xa, 0x5, 0x4, 0x9, 0x4, 0x4}, @selector_unit={0xc, 0x24, 0xb, 0xf8, 0x7, "caa4e8dbddb509"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_discrete={0x10, 0x24, 0x2, 0x1, 0x5, 0x4, 0x8, 0x60, "f19cf3276d5e27c5"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x1, 0x9, 0x6, 0x9, 0x4}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0xc, 0x1, 0x0, {0x8, 0x25, 0x1, 0x0, 0xf, 0x0, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x7f, 0x2, 0x8, 0x3, "5dba33", "ea"}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x7, 0x2, 0x6, {0x8, 0x25, 0x1, 0x3, 0x3, 0x9a}}}}}}}}]}}, &(0x7f0000000580)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x250, 0x7, 0x6, 0x6, 0x10, 0x8a}, 0x17, &(0x7f00000001c0)={0x5, 0xf, 0x17, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0xd, 0xa, 0x8e}, @wireless={0xb, 0x10, 0x1, 0xc, 0x2d8189fb9b508ca2, 0x6, 0x36, 0x1, 0xf0}]}, 0x7, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x1407}}, {0x1a, &(0x7f0000000280)=@string={0x1a, 0x3, "2145dad55af18d628a70c6e411b4b90212d850971162d2e0"}}, {0x44, &(0x7f00000002c0)=@string={0x44, 0x3, "b842f8d5eda8e42f7c2909473c88dd56936d68c18ebeddfd300916f71a283c4fbc73db5f678346c73da510728035d30ff0580c567251c638692a01b685273af8a233"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x810}}, {0x5a, &(0x7f0000000400)=@string={0x5a, 0x3, "a73c8f9cb481edf7ec8a8b6ba4ef81c26d7718e513efac7a79ec71dc911ced4507c0cd2d689be748897eaf9c4224b4273d60f45ca93c8c13cc78844cce98c19385b4afeb464fb67ea44db1d605cb8828057a1e87bd0bcbc7"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x41d}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x436}}]})
r3 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYRES16=r2], 0x0)
r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000)
write$char_usb(r4, 0x0, 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_usb_connect(0x5, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="120100002d306c10ce0aff2001010102030109022400010000000009040000029e0238000d050d0000000000000905a8"], 0x0)
syz_usb_disconnect(r1)
r5 = syz_usb_connect(0x2, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="52010000ead4a320d118af1e6309010203010902240001f60720400904a67602ab52634a"], 0x0)
syz_usb_control_io$cdc_ecm(r5, &(0x7f0000000f40)={0x14, 0x0, &(0x7f0000000f00)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)
syz_usb_control_io$hid(r5, 0x0, 0x0)
syz_usb_control_io$lan78xx(r5, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000200)={0x40, 0x5, 0x2, "80c1"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_connect$midi(0x5, 0x31, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000403e13150840000102030109021f00010109100409040000010103000b09050503"], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
syz_usb_disconnect(0xffffffffffffffff)
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(0xffffffffffffffff, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0x0, 0x0)

program did not crash
testing program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0x0, &(0x7f0000000100))

program did not crash
extracting C reproducer
testing compiled C program (duration=35.695731861s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
simplifying C reproducer
testing compiled C program (duration=35.695731861s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
testing compiled C program (duration=35.695731861s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
testing compiled C program (duration=35.695731861s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
testing compiled C program (duration=35.695731861s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
testing compiled C program (duration=35.695731861s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
testing compiled C program (duration=35.695731861s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
testing program (duration=35.695731861s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
validation run: crashed=true
testing program (duration=35.695731861s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
validation run: crashed=true
testing program (duration=35.695731861s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$lan78xx-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000b00)={0x0, 0x8, 0x88, "60f086d9abd285cfba2ed4e7bfb7889c00ca9cb4c4745b286359886a07057b6685821c6c63b119b8d5da21ae68c2a4dbb31884f708b27d70518906a812395904000a51532271a4c1979778745cc3ab11d39bec75851816519ab23d75875fc64beddd53c7f905524f7850b38f35c89326e5a08529d09d5e08c4cdba621fafd96f3356039e8217a0ff"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")

program crashed: UBSAN: array-index-out-of-bounds in aiptek_irq
validation run: crashed=true
reproducing took 20m27.100114519s
repro crashed as (corrupted=false):
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 4775 is out of range for type 'const int[34]'
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 c36f08223ec58598e05683a28d55b954d63a7946
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
 aiptek_irq+0x20cb/0x2a00 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x375/0x540 drivers/usb/core/hcd.c:1648
 usb_hcd_giveback_urb+0x11b/0x410 drivers/usb/core/hcd.c:1732
 dummy_timer+0x816/0x4300 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1753 [inline]
 __hrtimer_run_queues+0x3ab/0x8e0 kernel/time/hrtimer.c:1817
 hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1834
 handle_softirqs+0x1aa/0x630 kernel/softirq.c:621
 __do_softirq kernel/softirq.c:659 [inline]
 invoke_softirq kernel/softirq.c:476 [inline]
 __irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
 irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:106
Code: cc cc cc cc cc cc cc b8 ca aa a5 18 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 df 3e 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c6
RAX: ffff8881f6f00000 RBX: ffff888103668000 RCX: ffffffff85a87bcd
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000001fcf4
RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd
R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000
R13: 1ffff110206cd000 R14: dffffc0000000000 R15: ffffffff87ed4668
 arch_safe_halt arch/x86/include/asm/paravirt.h:112 [inline]
 default_idle+0x17/0x30 arch/x86/kernel/process.c:754
 arch_cpu_idle+0xd/0x20 arch/x86/kernel/process.c:791
 default_idle_call+0x3e/0x80 kernel/sched/idle.c:117
 cpuidle_idle_call kernel/sched/idle.c:193 [inline]
 do_idle+0x2fc/0x570 kernel/sched/idle.c:346
 cpu_startup_entry+0x47/0x60 kernel/sched/idle.c:445
 start_secondary+0x12e/0x140 arch/x86/kernel/smpboot.c:314
 common_startup_64+0x13b/0x157
 </TASK>
---[ end trace ]---
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x20e9/0x2a00 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff867135dc by task swapper/1/0

CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 c36f08223ec58598e05683a28d55b954d63a7946
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 print_address_description+0x71/0x210 mm/kasan/report.c:377
 print_report+0x4a/0x70 mm/kasan/report.c:481
 kasan_report+0x162/0x1a0 mm/kasan/report.c:594
 __asan_report_load4_noabort+0x18/0x20 mm/kasan/report_generic.c:380
 aiptek_irq+0x20e9/0x2a00 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x375/0x540 drivers/usb/core/hcd.c:1648
 usb_hcd_giveback_urb+0x11b/0x410 drivers/usb/core/hcd.c:1732
 dummy_timer+0x816/0x4300 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1753 [inline]
 __hrtimer_run_queues+0x3ab/0x8e0 kernel/time/hrtimer.c:1817
 hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1834
 handle_softirqs+0x1aa/0x630 kernel/softirq.c:621
 __do_softirq kernel/softirq.c:659 [inline]
 invoke_softirq kernel/softirq.c:476 [inline]
 __irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
 irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:106
Code: cc cc cc cc cc cc cc b8 ca aa a5 18 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 df 3e 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c6
RAX: ffff8881f6f00000 RBX: ffff888103668000 RCX: ffffffff85a87bcd
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000001fcf4
RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd
R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000
R13: 1ffff110206cd000 R14: dffffc0000000000 R15: ffffffff87ed4668
 arch_safe_halt arch/x86/include/asm/paravirt.h:112 [inline]
 default_idle+0x17/0x30 arch/x86/kernel/process.c:754
 arch_cpu_idle+0xd/0x20 arch/x86/kernel/process.c:791
 default_idle_call+0x3e/0x80 kernel/sched/idle.c:117
 cpuidle_idle_call kernel/sched/idle.c:193 [inline]
 do_idle+0x2fc/0x570 kernel/sched/idle.c:346
 cpu_startup_entry+0x47/0x60 kernel/sched/idle.c:445
 start_secondary+0x12e/0x140 arch/x86/kernel/smpboot.c:314
 common_startup_64+0x13b/0x157
 </TASK>

The buggy address belongs to the variable:
 .str.1+0x3c/0x40

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6713
flags: 0x4000(reserved|zone=0)
raw: 0000000000004000 ffffea000019c4c8 ffffea000019c4c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffffffff86713480: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 01 f9 f9
 ffffffff86713500: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 03
>ffffffff86713580: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 07 f9
                                                    ^
 ffffffff86713600: f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9 00 00 f9 f9
 ffffffff86713680: 00 00 f9 f9 00 00 01 f9 f9 f9 f9 f9 00 00 01 f9
==================================================================
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 4776 is out of range for type 'const int[34]'
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G    B              syzkaller #0 c36f08223ec58598e05683a28d55b954d63a7946
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
 aiptek_irq+0x1f85/0x2a00 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x375/0x540 drivers/usb/core/hcd.c:1648
 usb_hcd_giveback_urb+0x11b/0x410 drivers/usb/core/hcd.c:1732
 dummy_timer+0x816/0x4300 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1753 [inline]
 __hrtimer_run_queues+0x3ab/0x8e0 kernel/time/hrtimer.c:1817
 hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1834
 handle_softirqs+0x1aa/0x630 kernel/softirq.c:621
 __do_softirq kernel/softirq.c:659 [inline]
 invoke_softirq kernel/softirq.c:476 [inline]
 __irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
 irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:106
Code: cc cc cc cc cc cc cc b8 ca aa a5 18 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 df 3e 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c6
RAX: ffff8881f6f00000 RBX: ffff888103668000 RCX: ffffffff85a87bcd
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000001fcf4
RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd
R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000
R13: 1ffff110206cd000 R14: dffffc0000000000 R15: ffffffff87ed4668
 arch_safe_halt arch/x86/include/asm/paravirt.h:112 [inline]
 default_idle+0x17/0x30 arch/x86/kernel/process.c:754
 arch_cpu_idle+0xd/0x20 arch/x86/kernel/process.c:791
 default_idle_call+0x3e/0x80 kernel/sched/idle.c:117
 cpuidle_idle_call kernel/sched/idle.c:193 [inline]
 do_idle+0x2fc/0x570 kernel/sched/idle.c:346
 cpu_startup_entry+0x47/0x60 kernel/sched/idle.c:445
 start_secondary+0x12e/0x140 arch/x86/kernel/smpboot.c:314
 common_startup_64+0x13b/0x157
 </TASK>
---[ end trace ]---
aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
   0:	cc                   	int3
   1:	cc                   	int3
   2:	cc                   	int3
   3:	cc                   	int3
   4:	cc                   	int3
   5:	cc                   	int3
   6:	cc                   	int3
   7:	b8 ca aa a5 18       	mov    $0x18a5aaca,%eax
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	f3 0f 1e fa          	endbr64
  1b:	66 90                	xchg   %ax,%ax
  1d:	0f 00 2d f3 df 3e 00 	verw   0x3edff3(%rip)        # 0x3ee017
  24:	55                   	push   %rbp
  25:	48 89 e5             	mov    %rsp,%rbp
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	5d                   	pop    %rbp <-- trapping instruction
  2b:	c3                   	ret
  2c:	cc                   	int3
  2d:	cc                   	int3
  2e:	cc                   	int3
  2f:	cc                   	int3
  30:	cc                   	int3
  31:	cc                   	int3
  32:	cc                   	int3
  33:	cc                   	int3
  34:	cc                   	int3
  35:	cc                   	int3
  36:	cc                   	int3
  37:	b8 00 00 00 00       	mov    $0x0,%eax
  3c:	90                   	nop
  3d:	90                   	nop
  3e:	90                   	nop
  3f:	90                   	nop

final repro crashed as (corrupted=false):
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 4775 is out of range for type 'const int[34]'
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 c36f08223ec58598e05683a28d55b954d63a7946
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
 aiptek_irq+0x20cb/0x2a00 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x375/0x540 drivers/usb/core/hcd.c:1648
 usb_hcd_giveback_urb+0x11b/0x410 drivers/usb/core/hcd.c:1732
 dummy_timer+0x816/0x4300 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1753 [inline]
 __hrtimer_run_queues+0x3ab/0x8e0 kernel/time/hrtimer.c:1817
 hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1834
 handle_softirqs+0x1aa/0x630 kernel/softirq.c:621
 __do_softirq kernel/softirq.c:659 [inline]
 invoke_softirq kernel/softirq.c:476 [inline]
 __irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
 irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:106
Code: cc cc cc cc cc cc cc b8 ca aa a5 18 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 df 3e 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c6
RAX: ffff8881f6f00000 RBX: ffff888103668000 RCX: ffffffff85a87bcd
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000001fcf4
RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd
R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000
R13: 1ffff110206cd000 R14: dffffc0000000000 R15: ffffffff87ed4668
 arch_safe_halt arch/x86/include/asm/paravirt.h:112 [inline]
 default_idle+0x17/0x30 arch/x86/kernel/process.c:754
 arch_cpu_idle+0xd/0x20 arch/x86/kernel/process.c:791
 default_idle_call+0x3e/0x80 kernel/sched/idle.c:117
 cpuidle_idle_call kernel/sched/idle.c:193 [inline]
 do_idle+0x2fc/0x570 kernel/sched/idle.c:346
 cpu_startup_entry+0x47/0x60 kernel/sched/idle.c:445
 start_secondary+0x12e/0x140 arch/x86/kernel/smpboot.c:314
 common_startup_64+0x13b/0x157
 </TASK>
---[ end trace ]---
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x20e9/0x2a00 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff867135dc by task swapper/1/0

CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 c36f08223ec58598e05683a28d55b954d63a7946
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 print_address_description+0x71/0x210 mm/kasan/report.c:377
 print_report+0x4a/0x70 mm/kasan/report.c:481
 kasan_report+0x162/0x1a0 mm/kasan/report.c:594
 __asan_report_load4_noabort+0x18/0x20 mm/kasan/report_generic.c:380
 aiptek_irq+0x20e9/0x2a00 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x375/0x540 drivers/usb/core/hcd.c:1648
 usb_hcd_giveback_urb+0x11b/0x410 drivers/usb/core/hcd.c:1732
 dummy_timer+0x816/0x4300 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1753 [inline]
 __hrtimer_run_queues+0x3ab/0x8e0 kernel/time/hrtimer.c:1817
 hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1834
 handle_softirqs+0x1aa/0x630 kernel/softirq.c:621
 __do_softirq kernel/softirq.c:659 [inline]
 invoke_softirq kernel/softirq.c:476 [inline]
 __irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
 irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:106
Code: cc cc cc cc cc cc cc b8 ca aa a5 18 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 df 3e 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c6
RAX: ffff8881f6f00000 RBX: ffff888103668000 RCX: ffffffff85a87bcd
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000001fcf4
RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd
R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000
R13: 1ffff110206cd000 R14: dffffc0000000000 R15: ffffffff87ed4668
 arch_safe_halt arch/x86/include/asm/paravirt.h:112 [inline]
 default_idle+0x17/0x30 arch/x86/kernel/process.c:754
 arch_cpu_idle+0xd/0x20 arch/x86/kernel/process.c:791
 default_idle_call+0x3e/0x80 kernel/sched/idle.c:117
 cpuidle_idle_call kernel/sched/idle.c:193 [inline]
 do_idle+0x2fc/0x570 kernel/sched/idle.c:346
 cpu_startup_entry+0x47/0x60 kernel/sched/idle.c:445
 start_secondary+0x12e/0x140 arch/x86/kernel/smpboot.c:314
 common_startup_64+0x13b/0x157
 </TASK>

The buggy address belongs to the variable:
 .str.1+0x3c/0x40

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6713
flags: 0x4000(reserved|zone=0)
raw: 0000000000004000 ffffea000019c4c8 ffffea000019c4c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffffffff86713480: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 01 f9 f9
 ffffffff86713500: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 03
>ffffffff86713580: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 07 f9
                                                    ^
 ffffffff86713600: f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9 00 00 f9 f9
 ffffffff86713680: 00 00 f9 f9 00 00 01 f9 f9 f9 f9 f9 00 00 01 f9
==================================================================
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 4776 is out of range for type 'const int[34]'
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G    B              syzkaller #0 c36f08223ec58598e05683a28d55b954d63a7946
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
 aiptek_irq+0x1f85/0x2a00 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x375/0x540 drivers/usb/core/hcd.c:1648
 usb_hcd_giveback_urb+0x11b/0x410 drivers/usb/core/hcd.c:1732
 dummy_timer+0x816/0x4300 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1753 [inline]
 __hrtimer_run_queues+0x3ab/0x8e0 kernel/time/hrtimer.c:1817
 hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1834
 handle_softirqs+0x1aa/0x630 kernel/softirq.c:621
 __do_softirq kernel/softirq.c:659 [inline]
 invoke_softirq kernel/softirq.c:476 [inline]
 __irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
 irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:106
Code: cc cc cc cc cc cc cc b8 ca aa a5 18 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 df 3e 00 55 48 89 e5 fb f4 <5d> c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
RSP: 0018:ffffc900001a7e00 EFLAGS: 000002c6
RAX: ffff8881f6f00000 RBX: ffff888103668000 RCX: ffffffff85a87bcd
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 000000000001fcf4
RBP: ffffc900001a7e00 R08: ffff8881f6f395eb R09: 1ffff1103ede72bd
R10: dffffc0000000000 R11: ffffed103ede72be R12: 0000000000000000
R13: 1ffff110206cd000 R14: dffffc0000000000 R15: ffffffff87ed4668
 arch_safe_halt arch/x86/include/asm/paravirt.h:112 [inline]
 default_idle+0x17/0x30 arch/x86/kernel/process.c:754
 arch_cpu_idle+0xd/0x20 arch/x86/kernel/process.c:791
 default_idle_call+0x3e/0x80 kernel/sched/idle.c:117
 cpuidle_idle_call kernel/sched/idle.c:193 [inline]
 do_idle+0x2fc/0x570 kernel/sched/idle.c:346
 cpu_startup_entry+0x47/0x60 kernel/sched/idle.c:445
 start_secondary+0x12e/0x140 arch/x86/kernel/smpboot.c:314
 common_startup_64+0x13b/0x157
 </TASK>
---[ end trace ]---
aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
   0:	cc                   	int3
   1:	cc                   	int3
   2:	cc                   	int3
   3:	cc                   	int3
   4:	cc                   	int3
   5:	cc                   	int3
   6:	cc                   	int3
   7:	b8 ca aa a5 18       	mov    $0x18a5aaca,%eax
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	f3 0f 1e fa          	endbr64
  1b:	66 90                	xchg   %ax,%ax
  1d:	0f 00 2d f3 df 3e 00 	verw   0x3edff3(%rip)        # 0x3ee017
  24:	55                   	push   %rbp
  25:	48 89 e5             	mov    %rsp,%rbp
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	5d                   	pop    %rbp <-- trapping instruction
  2b:	c3                   	ret
  2c:	cc                   	int3
  2d:	cc                   	int3
  2e:	cc                   	int3
  2f:	cc                   	int3
  30:	cc                   	int3
  31:	cc                   	int3
  32:	cc                   	int3
  33:	cc                   	int3
  34:	cc                   	int3
  35:	cc                   	int3
  36:	cc                   	int3
  37:	b8 00 00 00 00       	mov    $0x0,%eax
  3c:	90                   	nop
  3d:	90                   	nop
  3e:	90                   	nop
  3f:	90                   	nop