================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 6691 is out of range for type 'const int[34]'
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
 aiptek_irq+0x1e87/0x28f0 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1673
 dummy_timer+0xa21/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:sched_core_balance+0x142/0xd70 kernel/sched/core.c:6237
Code: 40 c1 8b 8a e8 8f c9 09 00 4c 89 74 24 60 4c 89 6c 24 08 e9 bf 0b 00 00 4c 89 f7 e8 18 8b df 08 e8 d3 ab 2d 00 fb 41 83 fd 08 <0f> 83 8e 0b 00 00 4e 8d 34 ed 80 f9 65 8c 4c 89 f0 48 c1 e8 03 48
RSP: 0018:ffffc90000177a80 EFLAGS: 00000297
RAX: 6c3297d2dda99800 RBX: ffff8880b8f3ba48 RCX: 6c3297d2dda99800
RDX: dffffc0000000000 RSI: ffffffff8a8c17a0 RDI: ffffffff8adf42e0
RBP: ffffc90000177bd0 R08: ffff8880b8e3ad03 R09: 1ffff110171c75a0
R10: dffffc0000000000 R11: ffffed10171c75a1 R12: ffff8880b8f3ad00
R13: 0000000000000001 R14: ffff8880b8f3ad00 R15: dffffc0000000000
 do_balance_callbacks kernel/sched/core.c:4893 [inline]
 __balance_callbacks kernel/sched/core.c:4947 [inline]
 finish_lock_switch kernel/sched/core.c:5003 [inline]
 finish_task_switch+0x39b/0x8e0 kernel/sched/core.c:5122
 context_switch kernel/sched/core.c:5248 [inline]
 __schedule+0x1087/0x4030 kernel/sched/core.c:6562
 schedule_idle+0x4a/0x90 kernel/sched/core.c:6666
 do_idle+0x635/0x680 kernel/sched/idle.c:352
 cpu_startup_entry+0x3f/0x60 kernel/sched/idle.c:422
 start_secondary+0xe4/0xf0 arch/x86/kernel/smpboot.c:281
 secondary_startup_64_no_verify+0xcf/0xdb
 </TASK>
================================================================================
----------------
Code disassembly (best guess):
   0:	40 c1 8b 8a e8 8f c9 	rex rorl $0x9,-0x36701776(%rbx)
   7:	09
   8:	00 4c 89 74          	add    %cl,0x74(%rcx,%rcx,4)
   c:	24 60                	and    $0x60,%al
   e:	4c 89 6c 24 08       	mov    %r13,0x8(%rsp)
  13:	e9 bf 0b 00 00       	jmp    0xbd7
  18:	4c 89 f7             	mov    %r14,%rdi
  1b:	e8 18 8b df 08       	call   0x8df8b38
  20:	e8 d3 ab 2d 00       	call   0x2dabf8
  25:	fb                   	sti
  26:	41 83 fd 08          	cmp    $0x8,%r13d
* 2a:	0f 83 8e 0b 00 00    	jae    0xbbe <-- trapping instruction
  30:	4e 8d 34 ed 80 f9 65 	lea    -0x739a0680(,%r13,8),%r14
  37:	8c
  38:	4c 89 f0             	mov    %r14,%rax
  3b:	48 c1 e8 03          	shr    $0x3,%rax
  3f:	48                   	rex.W