================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 64046 is out of range for type 'const int[34]'
CPU: 1 PID: 315 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 dump_stack+0x15/0x24 lib/dump_stack.c:113
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
 aiptek_irq+0x208d/0x29b0 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x364/0x520 drivers/usb/core/hcd.c:1675
 usb_hcd_giveback_urb+0x11c/0x410 drivers/usb/core/hcd.c:1758
 dummy_timer+0x88c/0x3070 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x3bb/0x8e0 kernel/time/hrtimer.c:1749
 hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:85 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:102 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:128 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x85/0x2a0 mm/kasan/generic.c:189
Code: ff 4d 89 c1 49 c1 e9 03 4b 8d 1c 29 49 89 dc 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 45 01 00 00 4c 89 cb 48 f7 d3 4c 01 f3 <41> 80 3b 00 0f 85 95 01 00 00 49 ff c3 48 ff c3 75 ee e9 25 01 00
RSP: 0018:ffffc9000dca7520 EFLAGS: 00000286
RAX: ffffffff823a3a01 RBX: fffffffffffffffc RCX: ffffffff823a3b0e
RDX: 0000000000000001 RSI: 0000000000000038 RDI: ffffc9000dca75e0
RBP: ffffc9000dca7548 R08: ffffc9000dca7617 R09: 1ffff92001b94ec2
R10: dffffc0000000000 R11: fffff52001b94ebf R12: 0000000000000007
R13: dffffc0000000001 R14: 1ffff92001b94ebc R15: ffffc9000dca75e0
 memset+0x23/0x40 mm/kasan/shadow.c:44
 avc_has_perm_noaudit+0xbe/0x490 security/selinux/avc.c:1151
 selinux_inode_permission+0x3a0/0x5f0 security/selinux/hooks.c:3121
 security_inode_permission+0xb5/0x110 security/security.c:1341
 inode_permission+0xef/0x4b0 fs/namei.c:535
 may_lookup fs/namei.c:1727 [inline]
 link_path_walk+0x2db/0xe80 fs/namei.c:2274
 path_openat+0x27c/0x2f80 fs/namei.c:3786
 do_filp_open+0x1f1/0x430 fs/namei.c:3817
 do_sys_openat2+0x15e/0x810 fs/open.c:1343
 do_sys_open fs/open.c:1359 [inline]
 __do_sys_openat fs/open.c:1375 [inline]
 __se_sys_openat fs/open.c:1370 [inline]
 __x64_sys_openat+0x136/0x160 fs/open.c:1370
 x64_sys_call+0x783/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fddc50a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcccdb1410 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fddc57c6880 RCX: 00007fddc50a7407
RDX: 0000000000080000 RSI: 00005579d8e5efe0 RDI: ffffffffffffff9c
RBP: 00005579d8e4bd40 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffcccdc1bd0
R13: 0000000000000003 R14: 00005579aa49800c R15: 0000000000000000
 </TASK>
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x20ab/0x29b0 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff85ea8e78 by task udevd/315

CPU: 1 PID: 315 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x71/0x200 mm/kasan/report.c:316
 print_report+0x4a/0x60 mm/kasan/report.c:420
 kasan_report+0x122/0x150 mm/kasan/report.c:524
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
 aiptek_irq+0x20ab/0x29b0 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x364/0x520 drivers/usb/core/hcd.c:1675
 usb_hcd_giveback_urb+0x11c/0x410 drivers/usb/core/hcd.c:1758
 dummy_timer+0x88c/0x3070 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x3bb/0x8e0 kernel/time/hrtimer.c:1749
 hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:85 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:102 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:128 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x85/0x2a0 mm/kasan/generic.c:189
Code: ff 4d 89 c1 49 c1 e9 03 4b 8d 1c 29 49 89 dc 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 45 01 00 00 4c 89 cb 48 f7 d3 4c 01 f3 <41> 80 3b 00 0f 85 95 01 00 00 49 ff c3 48 ff c3 75 ee e9 25 01 00
RSP: 0018:ffffc9000dca7520 EFLAGS: 00000286
RAX: ffffffff823a3a01 RBX: fffffffffffffffc RCX: ffffffff823a3b0e
RDX: 0000000000000001 RSI: 0000000000000038 RDI: ffffc9000dca75e0
RBP: ffffc9000dca7548 R08: ffffc9000dca7617 R09: 1ffff92001b94ec2
R10: dffffc0000000000 R11: fffff52001b94ebf R12: 0000000000000007
R13: dffffc0000000001 R14: 1ffff92001b94ebc R15: ffffc9000dca75e0
 memset+0x23/0x40 mm/kasan/shadow.c:44
 avc_has_perm_noaudit+0xbe/0x490 security/selinux/avc.c:1151
 selinux_inode_permission+0x3a0/0x5f0 security/selinux/hooks.c:3121
 security_inode_permission+0xb5/0x110 security/security.c:1341
 inode_permission+0xef/0x4b0 fs/namei.c:535
 may_lookup fs/namei.c:1727 [inline]
 link_path_walk+0x2db/0xe80 fs/namei.c:2274
 path_openat+0x27c/0x2f80 fs/namei.c:3786
 do_filp_open+0x1f1/0x430 fs/namei.c:3817
 do_sys_openat2+0x15e/0x810 fs/open.c:1343
 do_sys_open fs/open.c:1359 [inline]
 __do_sys_openat fs/open.c:1375 [inline]
 __se_sys_openat fs/open.c:1370 [inline]
 __x64_sys_openat+0x136/0x160 fs/open.c:1370
 x64_sys_call+0x783/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fddc50a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcccdb1410 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fddc57c6880 RCX: 00007fddc50a7407
RDX: 0000000000080000 RSI: 00005579d8e5efe0 RDI: ffffffffffffff9c
RBP: 00005579d8e4bd40 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffcccdc1bd0
R13: 0000000000000003 R14: 00005579aa49800c R15: 0000000000000000
 </TASK>

The buggy address belongs to the variable:
 .str.64+0x58/0x80

The buggy address belongs to the physical page:
page:ffffea000017aa00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5ea8
flags: 0x1000(reserved|zone=0)
raw: 0000000000001000 ffffea000017aa08 ffffea000017aa08 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffffffff85ea8d00: 07 f9 f9 f9 00 00 00 00 00 00 00 00 04 f9 f9 f9
 ffffffff85ea8d80: f9 f9 f9 f9 00 00 00 00 00 00 00 00 05 f9 f9 f9
>ffffffff85ea8e00: f9 f9 f9 f9 00 00 00 00 00 00 00 00 01 f9 f9 f9
                                                                ^
 ffffffff85ea8e80: f9 f9 f9 f9 00 00 00 00 00 00 00 00 05 f9 f9 f9
 ffffffff85ea8f00: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 64047 is out of range for type 'const int[34]'
CPU: 1 PID: 315 Comm: udevd Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 dump_stack+0x15/0x24 lib/dump_stack.c:113
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
 aiptek_irq+0x1f6d/0x29b0 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x364/0x520 drivers/usb/core/hcd.c:1675
 usb_hcd_giveback_urb+0x11c/0x410 drivers/usb/core/hcd.c:1758
 dummy_timer+0x88c/0x3070 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x3bb/0x8e0 kernel/time/hrtimer.c:1749
 hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:85 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:102 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:128 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x85/0x2a0 mm/kasan/generic.c:189
Code: ff 4d 89 c1 49 c1 e9 03 4b 8d 1c 29 49 89 dc 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 45 01 00 00 4c 89 cb 48 f7 d3 4c 01 f3 <41> 80 3b 00 0f 85 95 01 00 00 49 ff c3 48 ff c3 75 ee e9 25 01 00
RSP: 0018:ffffc9000dca7520 EFLAGS: 00000286
RAX: ffffffff823a3a01 RBX: fffffffffffffffc RCX: ffffffff823a3b0e
RDX: 0000000000000001 RSI: 0000000000000038 RDI: ffffc9000dca75e0
RBP: ffffc9000dca7548 R08: ffffc9000dca7617 R09: 1ffff92001b94ec2
R10: dffffc0000000000 R11: fffff52001b94ebf R12: 0000000000000007
R13: dffffc0000000001 R14: 1ffff92001b94ebc R15: ffffc9000dca75e0
 memset+0x23/0x40 mm/kasan/shadow.c:44
 avc_has_perm_noaudit+0xbe/0x490 security/selinux/avc.c:1151
 selinux_inode_permission+0x3a0/0x5f0 security/selinux/hooks.c:3121
 security_inode_permission+0xb5/0x110 security/security.c:1341
 inode_permission+0xef/0x4b0 fs/namei.c:535
 may_lookup fs/namei.c:1727 [inline]
 link_path_walk+0x2db/0xe80 fs/namei.c:2274
 path_openat+0x27c/0x2f80 fs/namei.c:3786
 do_filp_open+0x1f1/0x430 fs/namei.c:3817
 do_sys_openat2+0x15e/0x810 fs/open.c:1343
 do_sys_open fs/open.c:1359 [inline]
 __do_sys_openat fs/open.c:1375 [inline]
 __se_sys_openat fs/open.c:1370 [inline]
 __x64_sys_openat+0x136/0x160 fs/open.c:1370
 x64_sys_call+0x783/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fddc50a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcccdb1410 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fddc57c6880 RCX: 00007fddc50a7407
RDX: 0000000000080000 RSI: 00005579d8e5efe0 RDI: ffffffffffffff9c
RBP: 00005579d8e4bd40 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffcccdc1bd0
R13: 0000000000000003 R14: 00005579aa49800c R15: 0000000000000000
 </TASK>
================================================================================
aiptek 6-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
   0:	ff 4d 89             	decl   -0x77(%rbp)
   3:	c1 49 c1 e9          	rorl   $0xe9,-0x3f(%rcx)
   7:	03 4b 8d             	add    -0x73(%rbx),%ecx
   a:	1c 29                	sbb    $0x29,%al
   c:	49 89 dc             	mov    %rbx,%r12
   f:	4d 29 dc             	sub    %r11,%r12
  12:	49 83 fc 10          	cmp    $0x10,%r12
  16:	7f 29                	jg     0x41
  18:	4d 85 e4             	test   %r12,%r12
  1b:	0f 84 45 01 00 00    	je     0x166
  21:	4c 89 cb             	mov    %r9,%rbx
  24:	48 f7 d3             	not    %rbx
  27:	4c 01 f3             	add    %r14,%rbx
* 2a:	41 80 3b 00          	cmpb   $0x0,(%r11) <-- trapping instruction
  2e:	0f 85 95 01 00 00    	jne    0x1c9
  34:	49 ff c3             	inc    %r11
  37:	48 ff c3             	inc    %rbx
  3a:	75 ee                	jne    0x2a
  3c:	e9                   	.byte 0xe9
  3d:	25                   	.byte 0x25
  3e:	01 00                	add    %eax,(%rax)