------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 9224 is out of range for type 'const int[34]'
CPU: 1 UID: 0 PID: 381 Comm: kworker/u8:54 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:94
dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
dump_stack+0x19/0x20 lib/dump_stack.c:129
ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
__ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
aiptek_irq+0x208d/0x2a00 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x36e/0x530 drivers/usb/core/hcd.c:1648
usb_hcd_giveback_urb+0x12b/0x400 drivers/usb/core/hcd.c:1732
dummy_timer+0xa3f/0x4900 drivers/usb/gadget/udc/dummy_hcd.c:2003
__run_hrtimer kernel/time/hrtimer.c:1757 [inline]
__hrtimer_run_queues+0x3ae/0x8e0 kernel/time/hrtimer.c:1821
hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1838
handle_softirqs+0x1aa/0x620 kernel/softirq.c:621
__do_softirq kernel/softirq.c:659 [inline]
invoke_softirq kernel/softirq.c:476 [inline]
__irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:56 [inline]
RIP: 0010:update_stack_state+0x1a6/0x4d0 arch/x86/kernel/unwind_frame.c:228
Code: 08 4c 89 e7 e8 ab 9b 9b 00 4c 89 e3 4d 8b 34 24 48 8b 85 58 ff ff ff 42 80 3c 38 00 74 0c 48 8b bd 78 ff ff ff e8 8a 9b 9b 00 <4d> 8b 65 10 48 8b 45 c0 42 0f b6 04 38 84 c0 0f 85 84 00 00 00 45
RSP: 0018:ffffc9000bb3e348 EFLAGS: 00000246
RAX: 1ffff92001767c8f RBX: ffffc9000bb3e470 RCX: 1ffff92001767c8f
RDX: 1ffff92001767c90 RSI: 1ffff92001767c8e RDI: ffffc9000bb3e4c0
RBP: ffffc9000bb3e3f8 R08: ffffc9000bb3e401 R09: 0000000000000000
R10: ffffc9000bb3e468 R11: fffff52001767c99 R12: ffffc9000bb3e470
R13: ffffc9000bb3e468 R14: ffffc9000bb38000 R15: dffffc0000000000
__unwind_start+0x215/0x400 arch/x86/kernel/unwind_frame.c:407
unwind_start arch/x86/include/asm/unwind.h:64 [inline]
arch_stack_walk+0xf2/0x170 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:49 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:70
kasan_save_free_info+0x44/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:249 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:266
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2445 [inline]
slab_free mm/slub.c:4714 [inline]
kmem_cache_free+0x1bd/0x4f0 mm/slub.c:4825
__es_free_extent fs/ext4/extents_status.c:509 [inline]
ext4_es_free_extent+0x3e0/0x4c0 fs/ext4/extents_status.c:526
__es_remove_extent+0x8d4/0x1820 fs/ext4/extents_status.c:1471
ext4_es_insert_extent+0x4d6/0x2760 fs/ext4/extents_status.c:895
ext4_map_create_blocks fs/ext4/inode.c:570 [inline]
ext4_map_blocks+0xb71/0x17f0 fs/ext4/inode.c:706
mpage_map_one_extent fs/ext4/inode.c:2222 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2275 [inline]
ext4_do_writepages+0x1c4a/0x39f0 fs/ext4/inode.c:2738
ext4_writepages+0x28c/0x550 fs/ext4/inode.c:2827
do_writepages+0x3d4/0x7f0 mm/page-writeback.c:2689
__writeback_single_inode+0xc8/0xba0 fs/fs-writeback.c:1674
writeback_sb_inodes+0x6a5/0xfb0 fs/fs-writeback.c:1970
__writeback_inodes_wb+0x129/0x280 fs/fs-writeback.c:2041
wb_writeback+0x3bb/0x850 fs/fs-writeback.c:2152
wb_check_old_data_flush fs/fs-writeback.c:2256 [inline]
wb_do_writeback fs/fs-writeback.c:2309 [inline]
wb_workfn+0xa03/0xef0 fs/fs-writeback.c:2337
process_one_work kernel/workqueue.c:3273 [inline]
process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
kthread+0x2c7/0x360 kernel/kthread.c:389
ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
---[ end trace ]---
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 9225 is out of range for type 'const int[34]'
CPU: 1 UID: 0 PID: 381 Comm: kworker/u8:54 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:94
dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
dump_stack+0x19/0x20 lib/dump_stack.c:129
ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
__ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
aiptek_irq+0x1f3c/0x2a00 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x36e/0x530 drivers/usb/core/hcd.c:1648
usb_hcd_giveback_urb+0x12b/0x400 drivers/usb/core/hcd.c:1732
dummy_timer+0xa3f/0x4900 drivers/usb/gadget/udc/dummy_hcd.c:2003
__run_hrtimer kernel/time/hrtimer.c:1757 [inline]
__hrtimer_run_queues+0x3ae/0x8e0 kernel/time/hrtimer.c:1821
hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1838
handle_softirqs+0x1aa/0x620 kernel/softirq.c:621
__do_softirq kernel/softirq.c:659 [inline]
invoke_softirq kernel/softirq.c:476 [inline]
__irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:56 [inline]
RIP: 0010:update_stack_state+0x1a6/0x4d0 arch/x86/kernel/unwind_frame.c:228
Code: 08 4c 89 e7 e8 ab 9b 9b 00 4c 89 e3 4d 8b 34 24 48 8b 85 58 ff ff ff 42 80 3c 38 00 74 0c 48 8b bd 78 ff ff ff e8 8a 9b 9b 00 <4d> 8b 65 10 48 8b 45 c0 42 0f b6 04 38 84 c0 0f 85 84 00 00 00 45
RSP: 0018:ffffc9000bb3e348 EFLAGS: 00000246
RAX: 1ffff92001767c8f RBX: ffffc9000bb3e470 RCX: 1ffff92001767c8f
RDX: 1ffff92001767c90 RSI: 1ffff92001767c8e RDI: ffffc9000bb3e4c0
RBP: ffffc9000bb3e3f8 R08: ffffc9000bb3e401 R09: 0000000000000000
R10: ffffc9000bb3e468 R11: fffff52001767c99 R12: ffffc9000bb3e470
R13: ffffc9000bb3e468 R14: ffffc9000bb38000 R15: dffffc0000000000
__unwind_start+0x215/0x400 arch/x86/kernel/unwind_frame.c:407
unwind_start arch/x86/include/asm/unwind.h:64 [inline]
arch_stack_walk+0xf2/0x170 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:49 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:70
kasan_save_free_info+0x44/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:249 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:266
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2445 [inline]
slab_free mm/slub.c:4714 [inline]
kmem_cache_free+0x1bd/0x4f0 mm/slub.c:4825
__es_free_extent fs/ext4/extents_status.c:509 [inline]
ext4_es_free_extent+0x3e0/0x4c0 fs/ext4/extents_status.c:526
__es_remove_extent+0x8d4/0x1820 fs/ext4/extents_status.c:1471
ext4_es_insert_extent+0x4d6/0x2760 fs/ext4/extents_status.c:895
ext4_map_create_blocks fs/ext4/inode.c:570 [inline]
ext4_map_blocks+0xb71/0x17f0 fs/ext4/inode.c:706
mpage_map_one_extent fs/ext4/inode.c:2222 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2275 [inline]
ext4_do_writepages+0x1c4a/0x39f0 fs/ext4/inode.c:2738
ext4_writepages+0x28c/0x550 fs/ext4/inode.c:2827
do_writepages+0x3d4/0x7f0 mm/page-writeback.c:2689
__writeback_single_inode+0xc8/0xba0 fs/fs-writeback.c:1674
writeback_sb_inodes+0x6a5/0xfb0 fs/fs-writeback.c:1970
__writeback_inodes_wb+0x129/0x280 fs/fs-writeback.c:2041
wb_writeback+0x3bb/0x850 fs/fs-writeback.c:2152
wb_check_old_data_flush fs/fs-writeback.c:2256 [inline]
wb_do_writeback fs/fs-writeback.c:2309 [inline]
wb_workfn+0xa03/0xef0 fs/fs-writeback.c:2337
process_one_work kernel/workqueue.c:3273 [inline]
process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
kthread+0x2c7/0x360 kernel/kthread.c:389
ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
---[ end trace ]---
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x1f5a/0x2a00 drivers/input/tablet/aiptek.c:763
Read of size 4 at addr ffffffff8670da24 by task kworker/u8:54/381
CPU: 1 UID: 0 PID: 381 Comm: kworker/u8:54 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:94
dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
print_address_description+0x71/0x210 mm/kasan/report.c:377
print_report+0x4a/0x70 mm/kasan/report.c:481
kasan_report+0x162/0x1a0 mm/kasan/report.c:594
__asan_report_load4_noabort+0x18/0x20 mm/kasan/report_generic.c:380
aiptek_irq+0x1f5a/0x2a00 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x36e/0x530 drivers/usb/core/hcd.c:1648
usb_hcd_giveback_urb+0x12b/0x400 drivers/usb/core/hcd.c:1732
dummy_timer+0xa3f/0x4900 drivers/usb/gadget/udc/dummy_hcd.c:2003
__run_hrtimer kernel/time/hrtimer.c:1757 [inline]
__hrtimer_run_queues+0x3ae/0x8e0 kernel/time/hrtimer.c:1821
hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1838
handle_softirqs+0x1aa/0x620 kernel/softirq.c:621
__do_softirq kernel/softirq.c:659 [inline]
invoke_softirq kernel/softirq.c:476 [inline]
__irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:56 [inline]
RIP: 0010:update_stack_state+0x1a6/0x4d0 arch/x86/kernel/unwind_frame.c:228
Code: 08 4c 89 e7 e8 ab 9b 9b 00 4c 89 e3 4d 8b 34 24 48 8b 85 58 ff ff ff 42 80 3c 38 00 74 0c 48 8b bd 78 ff ff ff e8 8a 9b 9b 00 <4d> 8b 65 10 48 8b 45 c0 42 0f b6 04 38 84 c0 0f 85 84 00 00 00 45
RSP: 0018:ffffc9000bb3e348 EFLAGS: 00000246
RAX: 1ffff92001767c8f RBX: ffffc9000bb3e470 RCX: 1ffff92001767c8f
RDX: 1ffff92001767c90 RSI: 1ffff92001767c8e RDI: ffffc9000bb3e4c0
RBP: ffffc9000bb3e3f8 R08: ffffc9000bb3e401 R09: 0000000000000000
R10: ffffc9000bb3e468 R11: fffff52001767c99 R12: ffffc9000bb3e470
R13: ffffc9000bb3e468 R14: ffffc9000bb38000 R15: dffffc0000000000
__unwind_start+0x215/0x400 arch/x86/kernel/unwind_frame.c:407
unwind_start arch/x86/include/asm/unwind.h:64 [inline]
arch_stack_walk+0xf2/0x170 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:49 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:70
kasan_save_free_info+0x44/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:249 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:266
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2445 [inline]
slab_free mm/slub.c:4714 [inline]
kmem_cache_free+0x1bd/0x4f0 mm/slub.c:4825
__es_free_extent fs/ext4/extents_status.c:509 [inline]
ext4_es_free_extent+0x3e0/0x4c0 fs/ext4/extents_status.c:526
__es_remove_extent+0x8d4/0x1820 fs/ext4/extents_status.c:1471
ext4_es_insert_extent+0x4d6/0x2760 fs/ext4/extents_status.c:895
ext4_map_create_blocks fs/ext4/inode.c:570 [inline]
ext4_map_blocks+0xb71/0x17f0 fs/ext4/inode.c:706
mpage_map_one_extent fs/ext4/inode.c:2222 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2275 [inline]
ext4_do_writepages+0x1c4a/0x39f0 fs/ext4/inode.c:2738
ext4_writepages+0x28c/0x550 fs/ext4/inode.c:2827
do_writepages+0x3d4/0x7f0 mm/page-writeback.c:2689
__writeback_single_inode+0xc8/0xba0 fs/fs-writeback.c:1674
writeback_sb_inodes+0x6a5/0xfb0 fs/fs-writeback.c:1970
__writeback_inodes_wb+0x129/0x280 fs/fs-writeback.c:2041
wb_writeback+0x3bb/0x850 fs/fs-writeback.c:2152
wb_check_old_data_flush fs/fs-writeback.c:2256 [inline]
wb_do_writeback fs/fs-writeback.c:2309 [inline]
wb_workfn+0xa03/0xef0 fs/fs-writeback.c:2337
process_one_work kernel/workqueue.c:3273 [inline]
process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
kthread+0x2c7/0x360 kernel/kthread.c:389
ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the variable:
.str.85+0x4/0x20
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x670d
flags: 0x4000(reserved|zone=0)
raw: 0000000000004000 ffffea000019c348 ffffea000019c348 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffffff8670d900: 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9
ffffffff8670d980: 04 f9 f9 f9 00 01 f9 f9 06 f9 f9 f9 05 f9 f9 f9
>ffffffff8670da00: 00 06 f9 f9 07 f9 f9 f9 00 f9 f9 f9 00 00 00 00
^
ffffffff8670da80: 00 f9 f9 f9 f9 f9 f9 f9 00 03 f9 f9 00 00 00 f9
ffffffff8670db00: f9 f9 f9 f9 00 00 00 01 f9 f9 f9 f9 06 f9 f9 f9
==================================================================
----------------
Code disassembly (best guess):
0: 08 4c 89 e7 or %cl,-0x19(%rcx,%rcx,4)
4: e8 ab 9b 9b 00 call 0x9b9bb4
9: 4c 89 e3 mov %r12,%rbx
c: 4d 8b 34 24 mov (%r12),%r14
10: 48 8b 85 58 ff ff ff mov -0xa8(%rbp),%rax
17: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
1c: 74 0c je 0x2a
1e: 48 8b bd 78 ff ff ff mov -0x88(%rbp),%rdi
25: e8 8a 9b 9b 00 call 0x9b9bb4
* 2a: 4d 8b 65 10 mov 0x10(%r13),%r12 <-- trapping instruction
2e: 48 8b 45 c0 mov -0x40(%rbp),%rax
32: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax
37: 84 c0 test %al,%al
39: 0f 85 84 00 00 00 jne 0xc3
3f: 45 rex.RB