================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 1055 is out of range for type 'const int[34]'
CPU: 1 PID: 2945 Comm: syz.1.1007 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1672
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1749
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 86 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 38 bb 17 00 eb 06 e8 31 bb 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 21 bb 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc900009a7020 EFLAGS: 00000287
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000080000
RDX: ffffc90001b14000 RSI: 00000000000058b1 RDI: 00000000000058b2
RBP: ffffc900009a7290 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000134df4 R12: 0000000000000086
R13: fffff52000134e10 R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
vprintk_default+0x26/0x30 kernel/printk/printk.c:2309
vprintk+0x7a/0x80 kernel/printk/printk_safe.c:45
_printk+0xda/0x130 kernel/printk/printk.c:2319
__ext4_error_inode+0x3aa/0x4e0 fs/ext4/super.c:781
__xattr_check_inode+0x3db/0x440 fs/ext4/xattr.c:278
ext4_iget_extra_inode+0x178/0x370 fs/ext4/inode.c:4603
__ext4_iget+0x1e6c/0x3e80 fs/ext4/inode.c:4911
ext4_orphan_get+0x1e0/0x630 fs/ext4/ialloc.c:1406
ext4_orphan_cleanup+0x8c7/0x1120 fs/ext4/orphan.c:465
ext4_fill_super+0x84ce/0x8bf0 fs/ext4/super.c:4997
mount_bdev+0x28d/0x3c0 fs/super.c:1400
ext4_mount+0x34/0x40 fs/ext4/super.c:6650
legacy_get_tree+0xed/0x190 fs/fs_context.c:611
vfs_get_tree+0x89/0x260 fs/super.c:1530
do_new_mount+0x251/0xb40 fs/namespace.c:3037
path_mount+0x640/0xff0 fs/namespace.c:3367
do_mount fs/namespace.c:3380 [inline]
__do_sys_mount fs/namespace.c:3588 [inline]
__se_sys_mount+0x320/0x390 fs/namespace.c:3565
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3565
x64_sys_call+0x6bf/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:166
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7eff82c3228a
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007eff81689e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007eff81689ee0 RCX: 00007eff82c3228a
RDX: 0000200000000040 RSI: 0000200000000080 RDI: 00007eff81689ea0
RBP: 0000200000000040 R08: 00007eff81689ee0 R09: 0000000000004008
R10: 0000000000004008 R11: 0000000000000246 R12: 0000200000000080
R13: 00007eff81689ea0 R14: 00000000000004f3 R15: 0000200000001d40
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff857eecbc by task syz.1.1007/2945
CPU: 1 PID: 2945 Comm: syz.1.1007 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x10f/0x150 mm/kasan/report.c:444
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
aiptek_irq+0x2063/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1672
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1749
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 86 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 38 bb 17 00 eb 06 e8 31 bb 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 21 bb 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc900009a7020 EFLAGS: 00000287
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000080000
RDX: ffffc90001b14000 RSI: 00000000000058b1 RDI: 00000000000058b2
RBP: ffffc900009a7290 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000134df4 R12: 0000000000000086
R13: fffff52000134e10 R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
vprintk_default+0x26/0x30 kernel/printk/printk.c:2309
vprintk+0x7a/0x80 kernel/printk/printk_safe.c:45
_printk+0xda/0x130 kernel/printk/printk.c:2319
__ext4_error_inode+0x3aa/0x4e0 fs/ext4/super.c:781
__xattr_check_inode+0x3db/0x440 fs/ext4/xattr.c:278
ext4_iget_extra_inode+0x178/0x370 fs/ext4/inode.c:4603
__ext4_iget+0x1e6c/0x3e80 fs/ext4/inode.c:4911
ext4_orphan_get+0x1e0/0x630 fs/ext4/ialloc.c:1406
ext4_orphan_cleanup+0x8c7/0x1120 fs/ext4/orphan.c:465
ext4_fill_super+0x84ce/0x8bf0 fs/ext4/super.c:4997
mount_bdev+0x28d/0x3c0 fs/super.c:1400
ext4_mount+0x34/0x40 fs/ext4/super.c:6650
legacy_get_tree+0xed/0x190 fs/fs_context.c:611
vfs_get_tree+0x89/0x260 fs/super.c:1530
do_new_mount+0x251/0xb40 fs/namespace.c:3037
path_mount+0x640/0xff0 fs/namespace.c:3367
do_mount fs/namespace.c:3380 [inline]
__do_sys_mount fs/namespace.c:3588 [inline]
__se_sys_mount+0x320/0x390 fs/namespace.c:3565
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3565
x64_sys_call+0x6bf/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:166
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7eff82c3228a
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007eff81689e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007eff81689ee0 RCX: 00007eff82c3228a
RDX: 0000200000000040 RSI: 0000200000000080 RDI: 00007eff81689ea0
RBP: 0000200000000040 R08: 00007eff81689ee0 R09: 0000000000004008
R10: 0000000000004008 R11: 0000000000000246 R12: 0000200000000080
R13: 00007eff81689ea0 R14: 00000000000004f3 R15: 0000200000001d40
The buggy address belongs to the variable:
.str.2+0x1c/0x20
Memory state around the buggy address:
ffffffff857eeb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffff857eec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff857eec80: 00 f9 f9 f9 00 f9 f9 f9 00 00 00 00 00 00 00 04
^
ffffffff857eed00: f9 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 00 00 00 04
ffffffff857eed80: f9 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 00 00 00 03
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 1056 is out of range for type 'const int[34]'
CPU: 1 PID: 2945 Comm: syz.1.1007 Tainted: G B syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1672
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1749
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xb32/0xf10 kernel/printk/printk.c:2775
Code: 28 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 86 bf 17 00 49 81 e6 00 02 00 00 75 07 e8 38 bb 17 00 eb 06 e8 31 bb 17 00 fb 89 d8 <0a> 44 24 1f a8 01 74 0e e8 21 bb 17 00 85 db 74 19 e9 1b 03 00 00
RSP: 0018:ffffc900009a7020 EFLAGS: 00000287
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000080000
RDX: ffffc90001b14000 RSI: 00000000000058b1 RDI: 00000000000058b2
RBP: ffffc900009a7290 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000134df4 R12: 0000000000000086
R13: fffff52000134e10 R14: 0000000000000200 R15: dffffc0000000000
vprintk_emit+0x13f/0x320 kernel/printk/printk.c:2294
vprintk_default+0x26/0x30 kernel/printk/printk.c:2309
vprintk+0x7a/0x80 kernel/printk/printk_safe.c:45
_printk+0xda/0x130 kernel/printk/printk.c:2319
__ext4_error_inode+0x3aa/0x4e0 fs/ext4/super.c:781
__xattr_check_inode+0x3db/0x440 fs/ext4/xattr.c:278
ext4_iget_extra_inode+0x178/0x370 fs/ext4/inode.c:4603
__ext4_iget+0x1e6c/0x3e80 fs/ext4/inode.c:4911
ext4_orphan_get+0x1e0/0x630 fs/ext4/ialloc.c:1406
ext4_orphan_cleanup+0x8c7/0x1120 fs/ext4/orphan.c:465
ext4_fill_super+0x84ce/0x8bf0 fs/ext4/super.c:4997
mount_bdev+0x28d/0x3c0 fs/super.c:1400
ext4_mount+0x34/0x40 fs/ext4/super.c:6650
legacy_get_tree+0xed/0x190 fs/fs_context.c:611
vfs_get_tree+0x89/0x260 fs/super.c:1530
do_new_mount+0x251/0xb40 fs/namespace.c:3037
path_mount+0x640/0xff0 fs/namespace.c:3367
do_mount fs/namespace.c:3380 [inline]
__do_sys_mount fs/namespace.c:3588 [inline]
__se_sys_mount+0x320/0x390 fs/namespace.c:3565
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3565
x64_sys_call+0x6bf/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:166
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7eff82c3228a
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007eff81689e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007eff81689ee0 RCX: 00007eff82c3228a
RDX: 0000200000000040 RSI: 0000200000000080 RDI: 00007eff81689ea0
RBP: 0000200000000040 R08: 00007eff81689ee0 R09: 0000000000004008
R10: 0000000000004008 R11: 0000000000000246 R12: 0000200000000080
R13: 00007eff81689ea0 R14: 00000000000004f3 R15: 0000200000001d40
================================================================================
aiptek 7-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
0: 28 4c 89 f6 sub %cl,-0xa(%rcx,%rcx,4)
4: 48 81 e6 00 02 00 00 and $0x200,%rsi
b: 31 ff xor %edi,%edi
d: e8 86 bf 17 00 call 0x17bf98
12: 49 81 e6 00 02 00 00 and $0x200,%r14
19: 75 07 jne 0x22
1b: e8 38 bb 17 00 call 0x17bb58
20: eb 06 jmp 0x28
22: e8 31 bb 17 00 call 0x17bb58
27: fb sti
28: 89 d8 mov %ebx,%eax
* 2a: 0a 44 24 1f or 0x1f(%rsp),%al <-- trapping instruction
2e: a8 01 test $0x1,%al
30: 74 0e je 0x40
32: e8 21 bb 17 00 call 0x17bb58
37: 85 db test %ebx,%ebx
39: 74 19 je 0x54
3b: e9 1b 03 00 00 jmp 0x35b