================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:685:31
index 124 is out of range for type 'const int[34]'
CPU: 1 PID: 669 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:77
dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
dump_stack+0x15/0x1c lib/dump_stack.c:135
ubsan_epilogue+0xe/0x40 lib/ubsan.c:148
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:347
aiptek_irq+0x24ac/0x2860 drivers/input/tablet/aiptek.c:685
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1748
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1986
call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
expire_timers kernel/time/timer.c:1495 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1789
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
__do_softirq+0x255/0x563 kernel/softirq.c:309
asm_call_irq_on_stack+0xf/0x20
__run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
invoke_softirq kernel/softirq.c:405 [inline]
__irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x51/0x80 kernel/locking/spinlock.c:191
Code: 89 fe 48 c7 c7 b0 73 4c 86 e8 fb 8d 1d fd 4c 89 f7 48 83 3d 60 e9 ca 01 00 74 34 e8 fd 48 ca fc 66 90 48 89 5d e8 ff 75 e8 9d 01 00 00 00 e8 f5 44 c3 fc 65 8b 05 1a e3 80 7b 85 c0 74 09 48
RSP: 0018:ffffc9000181fb48 EFLAGS: 00000a02
RAX: 0000000000000001 RBX: 0000000000000a02 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000a02 RDI: ffff8881f7149940
RBP: ffffc9000181fb60 R08: ffffc9000181fd37 R09: ffffc9000181fd28
R10: dffffc0000000000 R11: fffff52000303fa7 R12: 0000000000000a02
R13: ffffc9000181fd20 R14: dffffc0000000000 R15: ffffc9000181fd50
unlock_hrtimer_base kernel/time/hrtimer.c:905 [inline]
hrtimer_start_range_ns+0x994/0xa90 kernel/time/hrtimer.c:1191
hrtimer_start_expires include/linux/hrtimer.h:434 [inline]
hrtimer_sleeper_start_expires kernel/time/hrtimer.c:1867 [inline]
do_nanosleep+0x158/0x620 kernel/time/hrtimer.c:1943
hrtimer_nanosleep+0x1b6/0x400 kernel/time/hrtimer.c:1999
common_nsleep+0x8f/0xb0 kernel/time/posix-timers.c:1268
__do_sys_clock_nanosleep kernel/time/posix-timers.c:1309 [inline]
__se_sys_clock_nanosleep+0x30b/0x3a0 kernel/time/posix-timers.c:1286
__x64_sys_clock_nanosleep+0x9b/0xb0 kernel/time/posix-timers.c:1286
do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f1a3ea81fd7
Code: 48 89 fa 4c 89 df e8 a8 56 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffd45046890 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6
RAX: ffffffffffffffda RBX: 0000555585adb500 RCX: 00007f1a3ea81fd7
RDX: 00007ffd450468d0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffd4504693c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000001f
R13: 00000000000927c0 R14: 000000000000c223 R15: 00007ffd45046990
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x24ca/0x2860 drivers/input/tablet/aiptek.c:685
Read of size 4 at addr ffffffff855ad450 by task syz-executor/669
CPU: 1 PID: 669 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:77
dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:435 [inline]
kasan_report+0x100/0x140 mm/kasan/report.c:452
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
aiptek_irq+0x24ca/0x2860 drivers/input/tablet/aiptek.c:685
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1748
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1986
call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
expire_timers kernel/time/timer.c:1495 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1789
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
__do_softirq+0x255/0x563 kernel/softirq.c:309
asm_call_irq_on_stack+0xf/0x20
__run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
invoke_softirq kernel/softirq.c:405 [inline]
__irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x51/0x80 kernel/locking/spinlock.c:191
Code: 89 fe 48 c7 c7 b0 73 4c 86 e8 fb 8d 1d fd 4c 89 f7 48 83 3d 60 e9 ca 01 00 74 34 e8 fd 48 ca fc 66 90 48 89 5d e8 ff 75 e8 9d 01 00 00 00 e8 f5 44 c3 fc 65 8b 05 1a e3 80 7b 85 c0 74 09 48
RSP: 0018:ffffc9000181fb48 EFLAGS: 00000a02
RAX: 0000000000000001 RBX: 0000000000000a02 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000a02 RDI: ffff8881f7149940
RBP: ffffc9000181fb60 R08: ffffc9000181fd37 R09: ffffc9000181fd28
R10: dffffc0000000000 R11: fffff52000303fa7 R12: 0000000000000a02
R13: ffffc9000181fd20 R14: dffffc0000000000 R15: ffffc9000181fd50
unlock_hrtimer_base kernel/time/hrtimer.c:905 [inline]
hrtimer_start_range_ns+0x994/0xa90 kernel/time/hrtimer.c:1191
hrtimer_start_expires include/linux/hrtimer.h:434 [inline]
hrtimer_sleeper_start_expires kernel/time/hrtimer.c:1867 [inline]
do_nanosleep+0x158/0x620 kernel/time/hrtimer.c:1943
hrtimer_nanosleep+0x1b6/0x400 kernel/time/hrtimer.c:1999
common_nsleep+0x8f/0xb0 kernel/time/posix-timers.c:1268
__do_sys_clock_nanosleep kernel/time/posix-timers.c:1309 [inline]
__se_sys_clock_nanosleep+0x30b/0x3a0 kernel/time/posix-timers.c:1286
__x64_sys_clock_nanosleep+0x9b/0xb0 kernel/time/posix-timers.c:1286
do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f1a3ea81fd7
Code: 48 89 fa 4c 89 df e8 a8 56 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffd45046890 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6
RAX: ffffffffffffffda RBX: 0000555585adb500 RCX: 00007f1a3ea81fd7
RDX: 00007ffd450468d0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffd4504693c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000001f
R13: 00000000000927c0 R14: 000000000000c223 R15: 00007ffd45046990
The buggy address belongs to the variable:
.str.9+0x50/0x60
Memory state around the buggy address:
ffffffff855ad300: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 04
ffffffff855ad380: f9 f9 f9 f9 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9
>ffffffff855ad400: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00
^
ffffffff855ad480: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 03 f9 f9 f9
ffffffff855ad500: f9 f9 f9 f9 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9
==================================================================
----------------
Code disassembly (best guess):
0: 89 fe mov %edi,%esi
2: 48 c7 c7 b0 73 4c 86 mov $0xffffffff864c73b0,%rdi
9: e8 fb 8d 1d fd call 0xfd1d8e09
e: 4c 89 f7 mov %r14,%rdi
11: 48 83 3d 60 e9 ca 01 cmpq $0x0,0x1cae960(%rip) # 0x1cae979
18: 00
19: 74 34 je 0x4f
1b: e8 fd 48 ca fc call 0xfcca491d
20: 66 90 xchg %ax,%ax
22: 48 89 5d e8 mov %rbx,-0x18(%rbp)
26: ff 75 e8 push -0x18(%rbp)
29: 9d popf
* 2a: bf 01 00 00 00 mov $0x1,%edi <-- trapping instruction
2f: e8 f5 44 c3 fc call 0xfcc34529
34: 65 8b 05 1a e3 80 7b mov %gs:0x7b80e31a(%rip),%eax # 0x7b80e355
3b: 85 c0 test %eax,%eax
3d: 74 09 je 0x48
3f: 48 rex.W