================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 96 is out of range for type 'const int[34]'
CPU: 1 PID: 4322 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 ubsan_epilogue+0x14/0x48 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:282
 aiptek_irq+0x19a0/0x2360 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x2ec/0x50c drivers/usb/core/hcd.c:1673
 usb_hcd_giveback_urb+0x100/0x3a4 drivers/usb/core/hcd.c:1756
 dummy_timer+0x7c8/0x2840 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x444/0xc58 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x164/0x408 kernel/time/hrtimer.c:1832
 handle_softirqs+0x318/0xc90 kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq kernel/softirq.c:477 [inline]
 __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
 __percpu_read_32+0x0/0x58 arch/arm64/include/asm/preempt.h:-1
 lock_is_held include/linux/lockdep.h:283 [inline]
 mt_locked lib/maple_tree.c:-1 [inline]
 mt_slot lib/maple_tree.c:816 [inline]
 mas_slot lib/maple_tree.c:849 [inline]
 mas_get_slot lib/maple_tree.c:6680 [inline]
 mas_validate_gaps lib/maple_tree.c:6978 [inline]
 mt_validate+0x2a38/0x4664 lib/maple_tree.c:7246
 validate_mm_mt+0xc8/0x3bc mm/mmap.c:295
 validate_mm+0xc8/0x29c mm/mmap.c:332
 __vma_adjust+0x12ac/0x16fc mm/mmap.c:879
 vma_adjust include/linux/mm.h:2810 [inline]
 __split_vma+0x328/0x44c mm/mmap.c:-1
 do_mas_align_munmap+0x5f4/0xf28 mm/mmap.c:2501
 do_mas_munmap mm/mmap.c:2650 [inline]
 __vm_munmap+0x260/0x390 mm/mmap.c:2936
 __do_sys_munmap mm/mmap.c:2961 [inline]
 __se_sys_munmap mm/mmap.c:2958 [inline]
 __arm64_sys_munmap+0x64/0x7c mm/mmap.c:2958
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x19bc/0x2360 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffff800013180b40 by task udevd/4322

CPU: 1 PID: 4322 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350
 aiptek_irq+0x19bc/0x2360 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x2ec/0x50c drivers/usb/core/hcd.c:1673
 usb_hcd_giveback_urb+0x100/0x3a4 drivers/usb/core/hcd.c:1756
 dummy_timer+0x7c8/0x2840 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x444/0xc58 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x164/0x408 kernel/time/hrtimer.c:1832
 handle_softirqs+0x318/0xc90 kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq kernel/softirq.c:477 [inline]
 __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
 __percpu_read_32+0x0/0x58 arch/arm64/include/asm/preempt.h:-1
 lock_is_held include/linux/lockdep.h:283 [inline]
 mt_locked lib/maple_tree.c:-1 [inline]
 mt_slot lib/maple_tree.c:816 [inline]
 mas_slot lib/maple_tree.c:849 [inline]
 mas_get_slot lib/maple_tree.c:6680 [inline]
 mas_validate_gaps lib/maple_tree.c:6978 [inline]
 mt_validate+0x2a38/0x4664 lib/maple_tree.c:7246
 validate_mm_mt+0xc8/0x3bc mm/mmap.c:295
 validate_mm+0xc8/0x29c mm/mmap.c:332
 __vma_adjust+0x12ac/0x16fc mm/mmap.c:879
 vma_adjust include/linux/mm.h:2810 [inline]
 __split_vma+0x328/0x44c mm/mmap.c:-1
 do_mas_align_munmap+0x5f4/0xf28 mm/mmap.c:2501
 do_mas_munmap mm/mmap.c:2650 [inline]
 __vm_munmap+0x260/0x390 mm/mmap.c:2936
 __do_sys_munmap mm/mmap.c:2961 [inline]
 __se_sys_munmap mm/mmap.c:2958 [inline]
 __arm64_sys_munmap+0x64/0x7c mm/mmap.c:2958
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the variable:
 .str.8+0x40/0x60

The buggy address belongs to a 0-page vmalloc region starting at 0xffff800011c90000 allocated at map_kernel+0x110/0x360 arch/arm64/mm/mmu.c:786
The buggy address belongs to the physical page:
page:000000006829dc6f refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20bf80
flags: 0x5ffc00000001000(reserved|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000001000 fffffc00072fe008 fffffc00072fe008 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff800013180a00: 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9
 ffff800013180a80: 00 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9
>ffff800013180b00: 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
                                           ^
 ffff800013180b80: 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00 00 f9 f9 f9
 ffff800013180c00: f9 f9 f9 f9 00 02 f9 f9 00 03 f9 f9 00 00 00 00
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 97 is out of range for type 'const int[34]'
CPU: 1 PID: 4322 Comm: udevd Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 ubsan_epilogue+0x14/0x48 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:282
 aiptek_irq+0x186c/0x2360 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x2ec/0x50c drivers/usb/core/hcd.c:1673
 usb_hcd_giveback_urb+0x100/0x3a4 drivers/usb/core/hcd.c:1756
 dummy_timer+0x7c8/0x2840 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x444/0xc58 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x164/0x408 kernel/time/hrtimer.c:1832
 handle_softirqs+0x318/0xc90 kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq kernel/softirq.c:477 [inline]
 __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
 __percpu_read_32+0x0/0x58 arch/arm64/include/asm/preempt.h:-1
 lock_is_held include/linux/lockdep.h:283 [inline]
 mt_locked lib/maple_tree.c:-1 [inline]
 mt_slot lib/maple_tree.c:816 [inline]
 mas_slot lib/maple_tree.c:849 [inline]
 mas_get_slot lib/maple_tree.c:6680 [inline]
 mas_validate_gaps lib/maple_tree.c:6978 [inline]
 mt_validate+0x2a38/0x4664 lib/maple_tree.c:7246
 validate_mm_mt+0xc8/0x3bc mm/mmap.c:295
 validate_mm+0xc8/0x29c mm/mmap.c:332
 __vma_adjust+0x12ac/0x16fc mm/mmap.c:879
 vma_adjust include/linux/mm.h:2810 [inline]
 __split_vma+0x328/0x44c mm/mmap.c:-1
 do_mas_align_munmap+0x5f4/0xf28 mm/mmap.c:2501
 do_mas_munmap mm/mmap.c:2650 [inline]
 __vm_munmap+0x260/0x390 mm/mmap.c:2936
 __do_sys_munmap mm/mmap.c:2961 [inline]
 __se_sys_munmap mm/mmap.c:2958 [inline]
 __arm64_sys_munmap+0x64/0x7c mm/mmap.c:2958
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
================================================================================
aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19