------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 43023 is out of range for type 'const int[34]'
CPU: 0 UID: 0 PID: 491 Comm: syz.2.60 Not tainted syzkaller #0 696230b0126414627535663eb488b8b4d474df7d
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
 aiptek_irq+0x208d/0x2a00 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x371/0x530 drivers/usb/core/hcd.c:1646
 usb_hcd_giveback_urb+0x12b/0x400 drivers/usb/core/hcd.c:1730
 dummy_timer+0xa3f/0x4900 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1758 [inline]
 __hrtimer_run_queues+0x3ae/0x8e0 kernel/time/hrtimer.c:1822
 hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1839
 handle_softirqs+0x1b0/0x5b0 kernel/softirq.c:684
 __do_softirq kernel/softirq.c:722 [inline]
 invoke_softirq kernel/softirq.c:539 [inline]
 __irq_exit_rcu+0x47/0xb0 kernel/softirq.c:771
 irq_exit_rcu+0xd/0x30 kernel/softirq.c:783
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x5/0x90 kernel/kcov.c:320
Code: 10 48 89 74 11 18 48 89 44 11 20 5d e9 54 9c 23 04 cc 0f 1f 00 b8 77 a9 8e 07 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <48> 89 e5 48 8b 45 08 65 48 8b 0d 0c 84 7b 7e 65 8b 15 0d 84 7b 7e
RSP: 0018:ffffc9000df5f710 EFLAGS: 00000246
RAX: ffffffff81d2c600 RBX: 8000000126311007 RCX: ffff888118fecf00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000df5f9d0 R08: ffffea000498c447 R09: 1ffffd4000931888
R10: dffffc0000000000 R11: fffff94000931889 R12: 00007f707c738000
R13: ffffea000498c458 R14: 0400000000000040 R15: 1ffffd400093188b
 unmap_single_vma mm/memory.c:1962 [inline]
 unmap_vmas+0x2dd/0x400 mm/memory.c:2006
 exit_mmap+0x28a/0xc20 mm/mmap.c:1975
 __mmput+0x92/0x330 kernel/fork.c:1370
 mmput+0x55/0x170 kernel/fork.c:1394
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x9a5/0x2850 kernel/exit.c:948
 do_group_exit+0x21f/0x2f0 kernel/exit.c:1104
 __do_sys_exit_group kernel/exit.c:1115 [inline]
 __se_sys_exit_group kernel/exit.c:1113 [inline]
 __x64_sys_exit_group+0x43/0x50 kernel/exit.c:1113
 x64_sys_call+0x2ed2/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f707d19fb19
Code: Unable to access opcode bytes at 0x7f707d19faef.
RSP: 002b:00007ffd24e78c88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f707d19fb19
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffd24e78cec R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 000000000000000d
R13: 00000000000927c0 R14: 000000000000a80e R15: 00007ffd24e78d40
 </TASK>
---[ end trace ]---
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x20ab/0x2a00 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffffffff86735ddc by task syz.2.60/491

CPU: 0 UID: 0 PID: 491 Comm: syz.2.60 Not tainted syzkaller #0 696230b0126414627535663eb488b8b4d474df7d
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 print_address_description+0x71/0x210 mm/kasan/report.c:377
 print_report+0x4a/0x70 mm/kasan/report.c:481
 kasan_report+0x162/0x1a0 mm/kasan/report.c:594
 __asan_report_load4_noabort+0x18/0x20 mm/kasan/report_generic.c:380
 aiptek_irq+0x20ab/0x2a00 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x371/0x530 drivers/usb/core/hcd.c:1646
 usb_hcd_giveback_urb+0x12b/0x400 drivers/usb/core/hcd.c:1730
 dummy_timer+0xa3f/0x4900 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1758 [inline]
 __hrtimer_run_queues+0x3ae/0x8e0 kernel/time/hrtimer.c:1822
 hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1839
 handle_softirqs+0x1b0/0x5b0 kernel/softirq.c:684
 __do_softirq kernel/softirq.c:722 [inline]
 invoke_softirq kernel/softirq.c:539 [inline]
 __irq_exit_rcu+0x47/0xb0 kernel/softirq.c:771
 irq_exit_rcu+0xd/0x30 kernel/softirq.c:783
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x5/0x90 kernel/kcov.c:320
Code: 10 48 89 74 11 18 48 89 44 11 20 5d e9 54 9c 23 04 cc 0f 1f 00 b8 77 a9 8e 07 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <48> 89 e5 48 8b 45 08 65 48 8b 0d 0c 84 7b 7e 65 8b 15 0d 84 7b 7e
RSP: 0018:ffffc9000df5f710 EFLAGS: 00000246
RAX: ffffffff81d2c600 RBX: 8000000126311007 RCX: ffff888118fecf00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000df5f9d0 R08: ffffea000498c447 R09: 1ffffd4000931888
R10: dffffc0000000000 R11: fffff94000931889 R12: 00007f707c738000
R13: ffffea000498c458 R14: 0400000000000040 R15: 1ffffd400093188b
 unmap_single_vma mm/memory.c:1962 [inline]
 unmap_vmas+0x2dd/0x400 mm/memory.c:2006
 exit_mmap+0x28a/0xc20 mm/mmap.c:1975
 __mmput+0x92/0x330 kernel/fork.c:1370
 mmput+0x55/0x170 kernel/fork.c:1394
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x9a5/0x2850 kernel/exit.c:948
 do_group_exit+0x21f/0x2f0 kernel/exit.c:1104
 __do_sys_exit_group kernel/exit.c:1115 [inline]
 __se_sys_exit_group kernel/exit.c:1113 [inline]
 __x64_sys_exit_group+0x43/0x50 kernel/exit.c:1113
 x64_sys_call+0x2ed2/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f707d19fb19
Code: Unable to access opcode bytes at 0x7f707d19faef.
RSP: 002b:00007ffd24e78c88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f707d19fb19
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffd24e78cec R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 000000000000000d
R13: 00000000000927c0 R14: 000000000000a80e R15: 00007ffd24e78d40
 </TASK>

The buggy address belongs to the variable:
 .str.638+0x3c/0x40

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6735
flags: 0x4000(reserved|zone=0)
raw: 0000000000004000 ffffea000019cd48 ffffea000019cd48 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffffffff86735c80: 00 00 06 f9 f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9
 ffffffff86735d00: 00 00 02 f9 f9 f9 f9 f9 00 07 f9 f9 00 00 00 01
>ffffffff86735d80: f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9 00 00 f9 f9
                                                    ^
 ffffffff86735e00: 00 00 00 04 f9 f9 f9 f9 00 00 00 03 f9 f9 f9 f9
 ffffffff86735e80: 00 00 04 f9 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9
==================================================================
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 43024 is out of range for type 'const int[34]'
CPU: 0 UID: 0 PID: 491 Comm: syz.2.60 Tainted: G    B              syzkaller #0 696230b0126414627535663eb488b8b4d474df7d
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
 __ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
 aiptek_irq+0x1f3c/0x2a00 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x371/0x530 drivers/usb/core/hcd.c:1646
 usb_hcd_giveback_urb+0x12b/0x400 drivers/usb/core/hcd.c:1730
 dummy_timer+0xa3f/0x4900 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1758 [inline]
 __hrtimer_run_queues+0x3ae/0x8e0 kernel/time/hrtimer.c:1822
 hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1839
 handle_softirqs+0x1b0/0x5b0 kernel/softirq.c:684
 __do_softirq kernel/softirq.c:722 [inline]
 invoke_softirq kernel/softirq.c:539 [inline]
 __irq_exit_rcu+0x47/0xb0 kernel/softirq.c:771
 irq_exit_rcu+0xd/0x30 kernel/softirq.c:783
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x5/0x90 kernel/kcov.c:320
Code: 10 48 89 74 11 18 48 89 44 11 20 5d e9 54 9c 23 04 cc 0f 1f 00 b8 77 a9 8e 07 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <48> 89 e5 48 8b 45 08 65 48 8b 0d 0c 84 7b 7e 65 8b 15 0d 84 7b 7e
RSP: 0018:ffffc9000df5f710 EFLAGS: 00000246
RAX: ffffffff81d2c600 RBX: 8000000126311007 RCX: ffff888118fecf00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000df5f9d0 R08: ffffea000498c447 R09: 1ffffd4000931888
R10: dffffc0000000000 R11: fffff94000931889 R12: 00007f707c738000
R13: ffffea000498c458 R14: 0400000000000040 R15: 1ffffd400093188b
 unmap_single_vma mm/memory.c:1962 [inline]
 unmap_vmas+0x2dd/0x400 mm/memory.c:2006
 exit_mmap+0x28a/0xc20 mm/mmap.c:1975
 __mmput+0x92/0x330 kernel/fork.c:1370
 mmput+0x55/0x170 kernel/fork.c:1394
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x9a5/0x2850 kernel/exit.c:948
 do_group_exit+0x21f/0x2f0 kernel/exit.c:1104
 __do_sys_exit_group kernel/exit.c:1115 [inline]
 __se_sys_exit_group kernel/exit.c:1113 [inline]
 __x64_sys_exit_group+0x43/0x50 kernel/exit.c:1113
 x64_sys_call+0x2ed2/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f707d19fb19
Code: Unable to access opcode bytes at 0x7f707d19faef.
RSP: 002b:00007ffd24e78c88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f707d19fb19
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffd24e78cec R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 000000000000000d
R13: 00000000000927c0 R14: 000000000000a80e R15: 00007ffd24e78d40
 </TASK>
---[ end trace ]---
aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
   0:	10 48 89             	adc    %cl,-0x77(%rax)
   3:	74 11                	je     0x16
   5:	18 48 89             	sbb    %cl,-0x77(%rax)
   8:	44 11 20             	adc    %r12d,(%rax)
   b:	5d                   	pop    %rbp
   c:	e9 54 9c 23 04       	jmp    0x4239c65
  11:	cc                   	int3
  12:	0f 1f 00             	nopl   (%rax)
  15:	b8 77 a9 8e 07       	mov    $0x78ea977,%eax
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	90                   	nop
  24:	90                   	nop
  25:	f3 0f 1e fa          	endbr64
  29:	55                   	push   %rbp
* 2a:	48 89 e5             	mov    %rsp,%rbp <-- trapping instruction
  2d:	48 8b 45 08          	mov    0x8(%rbp),%rax
  31:	65 48 8b 0d 0c 84 7b 	mov    %gs:0x7e7b840c(%rip),%rcx        # 0x7e7b8445
  38:	7e
  39:	65 8b 15 0d 84 7b 7e 	mov    %gs:0x7e7b840d(%rip),%edx        # 0x7e7b844d