------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 19545 is out of range for type 'const int[34]'
CPU: 1 UID: 0 PID: 310 Comm: kworker/1:2 Not tainted syzkaller #0 c4896d72d1fb51cdc6291d08376a37fd8080d7bb
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:94
dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
dump_stack+0x19/0x20 lib/dump_stack.c:129
ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
__ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
aiptek_irq+0x208d/0x2a00 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x36e/0x530 drivers/usb/core/hcd.c:1648
usb_hcd_giveback_urb+0x12b/0x400 drivers/usb/core/hcd.c:1732
dummy_timer+0xa3f/0x4900 drivers/usb/gadget/udc/dummy_hcd.c:2003
__run_hrtimer kernel/time/hrtimer.c:1757 [inline]
__hrtimer_run_queues+0x3ae/0x8e0 kernel/time/hrtimer.c:1821
hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1838
handle_softirqs+0x1aa/0x620 kernel/softirq.c:621
__do_softirq kernel/softirq.c:659 [inline]
invoke_softirq kernel/softirq.c:476 [inline]
__irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:preempt_schedule_common+0x55/0x60 kernel/sched/core.c:8068
Code: ff ff 65 ff 0d 84 e4 5f 7a 65 48 8b 1d 74 e4 5f 7a 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 c9 48 89 df e8 ce 2e 3b fc eb bf 5b <41> 5e 5d c3 cc cc cc cc cc 66 90 b8 d2 25 fa b2 90 90 90 90 90 90
RSP: 0018:ffffc9000b766c28 EFLAGS: 00000246
RAX: 1ffff110211ea980 RBX: 1ffff920016ecd88 RCX: dffffc0000000000
RDX: 0000000040000002 RSI: 0000000000000000 RDI: ffff8881f6f4fa40
RBP: ffffc9000b766c30 R08: ffff888108f54c07 R09: 1ffff110211ea980
R10: dffffc0000000000 R11: ffffed10211ea981 R12: 000000000000f3d8
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff888101652401
preempt_schedule+0xc5/0xe0 kernel/sched/core.c:8083
preempt_schedule_thunk+0x1a/0x40 arch/x86/entry/thunk.S:12
idr_preload_end include/linux/idr.h:174 [inline]
__kernfs_new_node+0x526/0x740 fs/kernfs/dir.c:640
kernfs_new_node+0x154/0x280 fs/kernfs/dir.c:704
__kernfs_create_file+0x52/0x280 fs/kernfs/file.c:1053
sysfs_add_file_mode_ns+0x1d2/0x280 fs/sysfs/file.c:307
create_files fs/sysfs/group.c:76 [inline]
internal_create_group+0x66c/0xe80 fs/sysfs/group.c:180
internal_create_groups fs/sysfs/group.c:220 [inline]
sysfs_create_groups+0x5c/0x130 fs/sysfs/group.c:246
device_add_groups+0x21/0x30 drivers/base/core.c:2839
really_probe+0x63c/0x8b0 drivers/base/dd.c:676
__driver_probe_device+0x193/0x280 drivers/base/dd.c:799
driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829
__device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957
bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459
__device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029
device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078
bus_probe_device+0x18b/0x270 drivers/base/bus.c:534
device_add+0x7fd/0xbf0 drivers/base/core.c:3692
usb_set_configuration+0x1aad/0x2080 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x95/0x160 drivers/usb/core/generic.c:254
usb_probe_device+0x1ef/0x3b0 drivers/usb/core/driver.c:295
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x2e1/0x8b0 drivers/base/dd.c:657
__driver_probe_device+0x193/0x280 drivers/base/dd.c:799
driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829
__device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957
bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459
__device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029
device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078
bus_probe_device+0x18b/0x270 drivers/base/bus.c:534
device_add+0x7fd/0xbf0 drivers/base/core.c:3692
usb_new_device+0x98d/0x1500 drivers/usb/core/hub.c:2703
hub_port_connect drivers/usb/core/hub.c:5574 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5714 [inline]
port_event drivers/usb/core/hub.c:5878 [inline]
hub_event+0x2dbd/0x4360 drivers/usb/core/hub.c:5960
process_one_work kernel/workqueue.c:3273 [inline]
process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
kthread+0x2c7/0x360 kernel/kthread.c:389
ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
---[ end trace ]---
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 19546 is out of range for type 'const int[34]'
CPU: 1 UID: 0 PID: 310 Comm: kworker/1:2 Not tainted syzkaller #0 c4896d72d1fb51cdc6291d08376a37fd8080d7bb
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:94
dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
dump_stack+0x19/0x20 lib/dump_stack.c:129
ubsan_epilogue+0xe/0x40 lib/ubsan.c:231
__ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:429
aiptek_irq+0x1f3c/0x2a00 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x36e/0x530 drivers/usb/core/hcd.c:1648
usb_hcd_giveback_urb+0x12b/0x400 drivers/usb/core/hcd.c:1732
dummy_timer+0xa3f/0x4900 drivers/usb/gadget/udc/dummy_hcd.c:2003
__run_hrtimer kernel/time/hrtimer.c:1757 [inline]
__hrtimer_run_queues+0x3ae/0x8e0 kernel/time/hrtimer.c:1821
hrtimer_run_softirq+0x159/0x560 kernel/time/hrtimer.c:1838
handle_softirqs+0x1aa/0x620 kernel/softirq.c:621
__do_softirq kernel/softirq.c:659 [inline]
invoke_softirq kernel/softirq.c:476 [inline]
__irq_exit_rcu+0x47/0xb0 kernel/softirq.c:708
irq_exit_rcu+0xd/0x30 kernel/softirq.c:720
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:preempt_schedule_common+0x55/0x60 kernel/sched/core.c:8068
Code: ff ff 65 ff 0d 84 e4 5f 7a 65 48 8b 1d 74 e4 5f 7a 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 c9 48 89 df e8 ce 2e 3b fc eb bf 5b <41> 5e 5d c3 cc cc cc cc cc 66 90 b8 d2 25 fa b2 90 90 90 90 90 90
RSP: 0018:ffffc9000b766c28 EFLAGS: 00000246
RAX: 1ffff110211ea980 RBX: 1ffff920016ecd88 RCX: dffffc0000000000
RDX: 0000000040000002 RSI: 0000000000000000 RDI: ffff8881f6f4fa40
RBP: ffffc9000b766c30 R08: ffff888108f54c07 R09: 1ffff110211ea980
R10: dffffc0000000000 R11: ffffed10211ea981 R12: 000000000000f3d8
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff888101652401
preempt_schedule+0xc5/0xe0 kernel/sched/core.c:8083
preempt_schedule_thunk+0x1a/0x40 arch/x86/entry/thunk.S:12
idr_preload_end include/linux/idr.h:174 [inline]
__kernfs_new_node+0x526/0x740 fs/kernfs/dir.c:640
kernfs_new_node+0x154/0x280 fs/kernfs/dir.c:704
__kernfs_create_file+0x52/0x280 fs/kernfs/file.c:1053
sysfs_add_file_mode_ns+0x1d2/0x280 fs/sysfs/file.c:307
create_files fs/sysfs/group.c:76 [inline]
internal_create_group+0x66c/0xe80 fs/sysfs/group.c:180
internal_create_groups fs/sysfs/group.c:220 [inline]
sysfs_create_groups+0x5c/0x130 fs/sysfs/group.c:246
device_add_groups+0x21/0x30 drivers/base/core.c:2839
really_probe+0x63c/0x8b0 drivers/base/dd.c:676
__driver_probe_device+0x193/0x280 drivers/base/dd.c:799
driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829
__device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957
bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459
__device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029
device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078
bus_probe_device+0x18b/0x270 drivers/base/bus.c:534
device_add+0x7fd/0xbf0 drivers/base/core.c:3692
usb_set_configuration+0x1aad/0x2080 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x95/0x160 drivers/usb/core/generic.c:254
usb_probe_device+0x1ef/0x3b0 drivers/usb/core/driver.c:295
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x2e1/0x8b0 drivers/base/dd.c:657
__driver_probe_device+0x193/0x280 drivers/base/dd.c:799
driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829
__device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957
bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459
__device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029
device_initial_probe+0x1e/0x30 drivers/base/dd.c:1078
bus_probe_device+0x18b/0x270 drivers/base/bus.c:534
device_add+0x7fd/0xbf0 drivers/base/core.c:3692
usb_new_device+0x98d/0x1500 drivers/usb/core/hub.c:2703
hub_port_connect drivers/usb/core/hub.c:5574 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5714 [inline]
port_event drivers/usb/core/hub.c:5878 [inline]
hub_event+0x2dbd/0x4360 drivers/usb/core/hub.c:5960
process_one_work kernel/workqueue.c:3273 [inline]
process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
kthread+0x2c7/0x360 kernel/kthread.c:389
ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
---[ end trace ]---
aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess), 1 bytes skipped:
0: ff 65 ff jmp *-0x1(%rbp)
3: 0d 84 e4 5f 7a or $0x7a5fe484,%eax
8: 65 48 8b 1d 74 e4 5f mov %gs:0x7a5fe474(%rip),%rbx # 0x7a5fe484
f: 7a
10: 48 89 d8 mov %rbx,%rax
13: 48 c1 e8 03 shr $0x3,%rax
17: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1)
1c: 74 c9 je 0xffffffe7
1e: 48 89 df mov %rbx,%rdi
21: e8 ce 2e 3b fc call 0xfc3b2ef4
26: eb bf jmp 0xffffffe7
28: 5b pop %rbx
* 29: 41 5e pop %r14 <-- trapping instruction
2b: 5d pop %rbp
2c: c3 ret
2d: cc int3
2e: cc int3
2f: cc int3
30: cc int3
31: cc int3
32: 66 90 xchg %ax,%ax
34: b8 d2 25 fa b2 mov $0xb2fa25d2,%eax
39: 90 nop
3a: 90 nop
3b: 90 nop
3c: 90 nop
3d: 90 nop
3e: 90 nop