================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 64046 is out of range for type 'const int[34]'
CPU: 1 PID: 2459 Comm: syz.6.766 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x208d/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x364/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11c/0x410 drivers/usb/core/hcd.c:1758
dummy_timer+0x88c/0x3070 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x3bb/0x8e0 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:209
Code: 89 fb e8 23 00 00 00 48 8b 3d 3c 78 21 06 48 89 de e8 44 ec 44 00 5b 5d c3 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 <55> 48 89 e5 48 8b 45 08 65 48 8b 0d 30 f0 90 7e 65 8b 15 31 f0 90
RSP: 0018:ffffc9000662f5f8 EFLAGS: 00000246
RAX: ffffffff83f01a6f RBX: 0000000000000000 RCX: 0000000000000002
RDX: ffff888120841440 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000662f690 R08: 0000000000000000 R09: ffffffff83f01cb0
R10: dffffc0000000000 R11: ffffed1024108289 R12: 0000000000000000
R13: 0000000000000080 R14: 0000000000000000 R15: 0000000000000000
skb_copy_datagram_iter+0x40/0x150 net/core/datagram.c:535
skb_copy_datagram_msg include/linux/skbuff.h:4036 [inline]
__unix_dgram_recvmsg+0x6aa/0xdc0 net/unix/af_unix.c:2492
unix_dgram_recvmsg+0xc7/0xe0 net/unix/af_unix.c:2550
____sys_recvmsg+0x2d9/0x5f0 net/socket.c:-1
___sys_recvmsg+0x212/0x590 net/socket.c:2769
do_recvmmsg+0x393/0x840 net/socket.c:2863
__sys_recvmmsg net/socket.c:2942 [inline]
__do_sys_recvmmsg net/socket.c:2965 [inline]
__se_sys_recvmmsg net/socket.c:2958 [inline]
__x64_sys_recvmmsg+0x195/0x250 net/socket.c:2958
x64_sys_call+0x3e7/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:300
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f544cf9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f544df14028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f544d216090 RCX: 00007f544cf9ce59
RDX: 00000000080002c1 RSI: 0000200000000040 RDI: 0000000000000004
RBP: 00007f544d032d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f544d216128 R14: 00007f544d216090 R15: 00007ffe18b7ad78
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x20ab/0x29b0 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff85ea8e78 by task syz.6.766/2459
CPU: 1 PID: 2459 Comm: syz.6.766 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x71/0x200 mm/kasan/report.c:316
print_report+0x4a/0x60 mm/kasan/report.c:420
kasan_report+0x122/0x150 mm/kasan/report.c:524
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
aiptek_irq+0x20ab/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x364/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11c/0x410 drivers/usb/core/hcd.c:1758
dummy_timer+0x88c/0x3070 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x3bb/0x8e0 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:209
Code: 89 fb e8 23 00 00 00 48 8b 3d 3c 78 21 06 48 89 de e8 44 ec 44 00 5b 5d c3 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 <55> 48 89 e5 48 8b 45 08 65 48 8b 0d 30 f0 90 7e 65 8b 15 31 f0 90
RSP: 0018:ffffc9000662f5f8 EFLAGS: 00000246
RAX: ffffffff83f01a6f RBX: 0000000000000000 RCX: 0000000000000002
RDX: ffff888120841440 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000662f690 R08: 0000000000000000 R09: ffffffff83f01cb0
R10: dffffc0000000000 R11: ffffed1024108289 R12: 0000000000000000
R13: 0000000000000080 R14: 0000000000000000 R15: 0000000000000000
skb_copy_datagram_iter+0x40/0x150 net/core/datagram.c:535
skb_copy_datagram_msg include/linux/skbuff.h:4036 [inline]
__unix_dgram_recvmsg+0x6aa/0xdc0 net/unix/af_unix.c:2492
unix_dgram_recvmsg+0xc7/0xe0 net/unix/af_unix.c:2550
____sys_recvmsg+0x2d9/0x5f0 net/socket.c:-1
___sys_recvmsg+0x212/0x590 net/socket.c:2769
do_recvmmsg+0x393/0x840 net/socket.c:2863
__sys_recvmmsg net/socket.c:2942 [inline]
__do_sys_recvmmsg net/socket.c:2965 [inline]
__se_sys_recvmmsg net/socket.c:2958 [inline]
__x64_sys_recvmmsg+0x195/0x250 net/socket.c:2958
x64_sys_call+0x3e7/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:300
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f544cf9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f544df14028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f544d216090 RCX: 00007f544cf9ce59
RDX: 00000000080002c1 RSI: 0000200000000040 RDI: 0000000000000004
RBP: 00007f544d032d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f544d216128 R14: 00007f544d216090 R15: 00007ffe18b7ad78
The buggy address belongs to the variable:
.str.64+0x58/0x80
The buggy address belongs to the physical page:
page:ffffea000017aa00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5ea8
flags: 0x1000(reserved|zone=0)
raw: 0000000000001000 ffffea000017aa08 ffffea000017aa08 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffffff85ea8d00: 07 f9 f9 f9 00 00 00 00 00 00 00 00 04 f9 f9 f9
ffffffff85ea8d80: f9 f9 f9 f9 00 00 00 00 00 00 00 00 05 f9 f9 f9
>ffffffff85ea8e00: f9 f9 f9 f9 00 00 00 00 00 00 00 00 01 f9 f9 f9
^
ffffffff85ea8e80: f9 f9 f9 f9 00 00 00 00 00 00 00 00 05 f9 f9 f9
ffffffff85ea8f00: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 64047 is out of range for type 'const int[34]'
CPU: 1 PID: 2459 Comm: syz.6.766 Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f6d/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x364/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11c/0x410 drivers/usb/core/hcd.c:1758
dummy_timer+0x88c/0x3070 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x3bb/0x8e0 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:209
Code: 89 fb e8 23 00 00 00 48 8b 3d 3c 78 21 06 48 89 de e8 44 ec 44 00 5b 5d c3 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 <55> 48 89 e5 48 8b 45 08 65 48 8b 0d 30 f0 90 7e 65 8b 15 31 f0 90
RSP: 0018:ffffc9000662f5f8 EFLAGS: 00000246
RAX: ffffffff83f01a6f RBX: 0000000000000000 RCX: 0000000000000002
RDX: ffff888120841440 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000662f690 R08: 0000000000000000 R09: ffffffff83f01cb0
R10: dffffc0000000000 R11: ffffed1024108289 R12: 0000000000000000
R13: 0000000000000080 R14: 0000000000000000 R15: 0000000000000000
skb_copy_datagram_iter+0x40/0x150 net/core/datagram.c:535
skb_copy_datagram_msg include/linux/skbuff.h:4036 [inline]
__unix_dgram_recvmsg+0x6aa/0xdc0 net/unix/af_unix.c:2492
unix_dgram_recvmsg+0xc7/0xe0 net/unix/af_unix.c:2550
____sys_recvmsg+0x2d9/0x5f0 net/socket.c:-1
___sys_recvmsg+0x212/0x590 net/socket.c:2769
do_recvmmsg+0x393/0x840 net/socket.c:2863
__sys_recvmmsg net/socket.c:2942 [inline]
__do_sys_recvmmsg net/socket.c:2965 [inline]
__se_sys_recvmmsg net/socket.c:2958 [inline]
__x64_sys_recvmmsg+0x195/0x250 net/socket.c:2958
x64_sys_call+0x3e7/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:300
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f544cf9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f544df14028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f544d216090 RCX: 00007f544cf9ce59
RDX: 00000000080002c1 RSI: 0000200000000040 RDI: 0000000000000004
RBP: 00007f544d032d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f544d216128 R14: 00007f544d216090 R15: 00007ffe18b7ad78
================================================================================
aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
0: 89 fb mov %edi,%ebx
2: e8 23 00 00 00 call 0x2a
7: 48 8b 3d 3c 78 21 06 mov 0x621783c(%rip),%rdi # 0x621784a
e: 48 89 de mov %rbx,%rsi
11: e8 44 ec 44 00 call 0x44ec5a
16: 5b pop %rbx
17: 5d pop %rbp
18: c3 ret
19: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax)
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: b8 0c 67 40 a5 mov $0xa540670c,%eax
* 2a: 55 push %rbp <-- trapping instruction
2b: 48 89 e5 mov %rsp,%rbp
2e: 48 8b 45 08 mov 0x8(%rbp),%rax
32: 65 48 8b 0d 30 f0 90 mov %gs:0x7e90f030(%rip),%rcx # 0x7e90f06a
39: 7e
3a: 65 gs
3b: 8b .byte 0x8b
3c: 15 .byte 0x15
3d: 31 f0 xor %esi,%eax
3f: 90 nop