================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 512 is out of range for type 'const int[34]'
CPU: 0 PID: 7890 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:217
 __ubsan_handle_out_of_bounds+0xe3/0xf0 lib/ubsan.c:348
 aiptek_irq+0x1eb8/0x2920 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1648
 dummy_timer+0xa40/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1754 [inline]
 __hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
 hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__sanitizer_cov_trace_switch+0x58/0xe0 kernel/kcov.c:349
Code: 48 8b 06 48 85 c0 0f 84 a4 00 00 00 41 57 41 56 41 54 53 48 8d 4c 09 01 48 8b 54 24 20 65 4c 8b 05 dd cd 7c 7e 45 31 c9 eb 08 <49> ff c1 4c 39 c8 74 77 4e 8b 54 ce 10 65 44 8b 1d cb cd 7c 7e 41
RSP: 0018:ffffc900035af810 EFLAGS: 00000293
RAX: 0000000000000002 RBX: ffffffff8f196a8a RCX: 0000000000000003
RDX: ffffffff813b2a28 RSI: ffffffff8cfa05a0 RDI: 0000000000000002
RBP: ffffc900035af958 R08: ffff88801aeabc00 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8f196a8f
R13: ffffc900035af908 R14: 0000000000000002 R15: dffffc0000000000
 unwind_next_frame+0x658/0x2990 arch/x86/kernel/unwind_orc.c:505
 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:164 [inline]
 slab_free_hook mm/slub.c:1811 [inline]
 slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837
 slab_free mm/slub.c:3830 [inline]
 kmem_cache_free+0xf8/0x290 mm/slub.c:3852
 vfs_fstatat+0x134/0x1b0 fs/stat.c:300
 __do_sys_newfstatat fs/stat.c:463 [inline]
 __se_sys_newfstatat fs/stat.c:457 [inline]
 __x64_sys_newfstatat+0x149/0x1f0 fs/stat.c:457
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa0f5511b0a
Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7
RSP: 002b:00007ffcc9d00da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 00007ffcc9d01240 RCX: 00007fa0f5511b0a
RDX: 00007ffcc9d00db0 RSI: 00007ffcc9d01240 RDI: 00000000ffffff9c
RBP: 0000559542a77910 R08: 0000000000000000 R09: 0000000000000020
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc9d00e40
R13: 00007ffcc9d01675 R14: 000055953d5f2ca4 R15: 000055953d5f2bcc
 </TASK>
================================================================================
----------------
Code disassembly (best guess):
   0:	48 8b 06             	mov    (%rsi),%rax
   3:	48 85 c0             	test   %rax,%rax
   6:	0f 84 a4 00 00 00    	je     0xb0
   c:	41 57                	push   %r15
   e:	41 56                	push   %r14
  10:	41 54                	push   %r12
  12:	53                   	push   %rbx
  13:	48 8d 4c 09 01       	lea    0x1(%rcx,%rcx,1),%rcx
  18:	48 8b 54 24 20       	mov    0x20(%rsp),%rdx
  1d:	65 4c 8b 05 dd cd 7c 	mov    %gs:0x7e7ccddd(%rip),%r8        # 0x7e7cce02
  24:	7e
  25:	45 31 c9             	xor    %r9d,%r9d
  28:	eb 08                	jmp    0x32
* 2a:	49 ff c1             	inc    %r9 <-- trapping instruction
  2d:	4c 39 c8             	cmp    %r9,%rax
  30:	74 77                	je     0xa9
  32:	4e 8b 54 ce 10       	mov    0x10(%rsi,%r9,8),%r10
  37:	65 44 8b 1d cb cd 7c 	mov    %gs:0x7e7ccdcb(%rip),%r11d        # 0x7e7cce0a
  3e:	7e
  3f:	41                   	rex.B