================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 21762 is out of range for type 'const int[34]'
CPU: 1 PID: 4146 Comm: syz.7.1592 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1672
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1749
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:page_mapping+0x0/0x2d0 mm/util.c:800
Code: 48 83 fb 01 49 0f 44 c6 5b 41 5e 41 5f 5d c3 e8 96 6d d0 ff 49 ff ce 4c 89 f3 eb ae 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 89 fb 49 bc 00 00 00 00
RSP: 0018:ffffc90000caf2c0 EFLAGS: 00000293
RAX: ffffffff818fb7bd RBX: ffffea0004b84000 RCX: ffff888110fe13c0
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea0004b84000
RBP: ffffc90000caf2e8 R08: ffffea0004b84007 R09: 1ffffd4000970800
R10: dffffc0000000000 R11: fffff94000970801 R12: dffffc0000000000
R13: 4000000000080035 R14: ffff888129a705d0 R15: ffffea0004b84018
truncate_inode_page+0x5d/0x70 mm/truncate.c:222
shmem_undo_range+0x45c/0x13b0 mm/shmem.c:961
shmem_truncate_range mm/shmem.c:1064 [inline]
shmem_evict_inode+0x1dc/0x970 mm/shmem.c:1146
evict+0x4b6/0x8b0 fs/inode.c:650
iput_final fs/inode.c:1779 [inline]
iput+0x651/0x7e0 fs/inode.c:1805
dentry_unlink_inode+0x338/0x3e0 fs/dcache.c:380
__dentry_kill+0x45b/0x660 fs/dcache.c:586
dentry_kill+0xc0/0x2a0 fs/dcache.c:-1
dput+0x47/0x90 fs/dcache.c:893
__fput+0x5c7/0x900 fs/file_table.c:319
____fput+0x15/0x20 fs/file_table.c:339
task_work_run+0x127/0x190 kernel/task_work.c:188
exit_task_work include/linux/task_work.h:33 [inline]
do_exit+0xb70/0x29a0 kernel/exit.c:890
do_group_exit+0x149/0x310 kernel/exit.c:1004
get_signal+0x64f/0x1430 kernel/signal.c:2908
arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:154 [inline]
exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:178
exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f5517f35159
Code: Unable to access opcode bytes at RIP 0x7f5517f3512f.
RSP: 002b:00007f551696d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f55181bd098 RCX: 00007f5517f35159
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f55181bd098
RBP: 00007f55181bd090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f55181bd128 R14: 00007ffdbb9a37f0 R15: 00007ffdbb9a38d8
================================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 21763 is out of range for type 'const int[34]'
CPU: 1 PID: 4146 Comm: syz.7.1592 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1672
usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1749
dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1998
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:page_mapping+0x0/0x2d0 mm/util.c:800
Code: 48 83 fb 01 49 0f 44 c6 5b 41 5e 41 5f 5d c3 e8 96 6d d0 ff 49 ff ce 4c 89 f3 eb ae 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 89 fb 49 bc 00 00 00 00
RSP: 0018:ffffc90000caf2c0 EFLAGS: 00000293
RAX: ffffffff818fb7bd RBX: ffffea0004b84000 RCX: ffff888110fe13c0
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea0004b84000
RBP: ffffc90000caf2e8 R08: ffffea0004b84007 R09: 1ffffd4000970800
R10: dffffc0000000000 R11: fffff94000970801 R12: dffffc0000000000
R13: 4000000000080035 R14: ffff888129a705d0 R15: ffffea0004b84018
truncate_inode_page+0x5d/0x70 mm/truncate.c:222
shmem_undo_range+0x45c/0x13b0 mm/shmem.c:961
shmem_truncate_range mm/shmem.c:1064 [inline]
shmem_evict_inode+0x1dc/0x970 mm/shmem.c:1146
evict+0x4b6/0x8b0 fs/inode.c:650
iput_final fs/inode.c:1779 [inline]
iput+0x651/0x7e0 fs/inode.c:1805
dentry_unlink_inode+0x338/0x3e0 fs/dcache.c:380
__dentry_kill+0x45b/0x660 fs/dcache.c:586
dentry_kill+0xc0/0x2a0 fs/dcache.c:-1
dput+0x47/0x90 fs/dcache.c:893
__fput+0x5c7/0x900 fs/file_table.c:319
____fput+0x15/0x20 fs/file_table.c:339
task_work_run+0x127/0x190 kernel/task_work.c:188
exit_task_work include/linux/task_work.h:33 [inline]
do_exit+0xb70/0x29a0 kernel/exit.c:890
do_group_exit+0x149/0x310 kernel/exit.c:1004
get_signal+0x64f/0x1430 kernel/signal.c:2908
arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:154 [inline]
exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:178
exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f5517f35159
Code: Unable to access opcode bytes at RIP 0x7f5517f3512f.
RSP: 002b:00007f551696d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f55181bd098 RCX: 00007f5517f35159
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f55181bd098
RBP: 00007f55181bd090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f55181bd128 R14: 00007ffdbb9a37f0 R15: 00007ffdbb9a38d8
================================================================================
aiptek 10-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
0: 48 83 fb 01 cmp $0x1,%rbx
4: 49 0f 44 c6 cmove %r14,%rax
8: 5b pop %rbx
9: 41 5e pop %r14
b: 41 5f pop %r15
d: 5d pop %rbp
e: c3 ret
f: e8 96 6d d0 ff call 0xffd06daa
14: 49 ff ce dec %r14
17: 4c 89 f3 mov %r14,%rbx
1a: eb ae jmp 0xffffffca
1c: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
23: 00 00 00
26: 0f 1f 40 00 nopl 0x0(%rax)
* 2a: 55 push %rbp <-- trapping instruction
2b: 48 89 e5 mov %rsp,%rbp
2e: 41 57 push %r15
30: 41 56 push %r14
32: 41 55 push %r13
34: 41 54 push %r12
36: 53 push %rbx
37: 48 89 fb mov %rdi,%rbx
3a: 49 rex.WB
3b: bc 00 00 00 00 mov $0x0,%esp