================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 512 is out of range for type 'const int[34]'
CPU: 1 PID: 3624 Comm: acpid Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
 aiptek_irq+0x1e87/0x28f0 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1673
 dummy_timer+0xa21/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:check_kcov_mode kernel/kcov.c:193 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:245 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x32/0x80 kernel/kcov.c:313
Code: c4 4a 80 7e 65 8b 0d c5 4a 80 7e 81 e1 00 01 ff 00 74 11 81 f9 00 01 00 00 75 5b 83 ba 1c 16 00 00 00 74 52 8b 8a f8 15 00 00 <83> f9 03 75 47 48 8b 8a 00 16 00 00 44 8b 8a fc 15 00 00 49 c1 e1
RSP: 0018:ffffc90003276fd8 EFLAGS: 00000246
RAX: ffffffff8a1bff72 RBX: 00000000ffff0a00 RCX: 0000000000000000
RDX: ffff88807e985a00 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003277100 R08: ffffc90003277077 R09: ffffc90003277060
R10: dffffc0000000000 R11: fffff5200064ee0f R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8880203d8112 R15: 0000000000000001
 number+0x7d2/0xef0 lib/vsprintf.c:543
 vsnprintf+0x12d3/0x1c20 lib/vsprintf.c:2871
 snprintf+0xe5/0x140 lib/vsprintf.c:2940
 tomoyo_print_header security/tomoyo/audit.c:196 [inline]
 tomoyo_init_log+0xb58/0x1f90 security/tomoyo/audit.c:255
 tomoyo_supervisor+0x361/0x11b0 security/tomoyo/common.c:2088
 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
 tomoyo_path_permission+0x262/0x3a0 security/tomoyo/file.c:587
 tomoyo_check_open_permission+0x29b/0x440 security/tomoyo/file.c:777
 security_file_open+0x5e/0xa0 security/security.c:1682
 do_dentry_open+0x2fd/0x10b0 fs/open.c:869
 do_open fs/namei.c:3634 [inline]
 path_openat+0x2674/0x2f10 fs/namei.c:3791
 do_filp_open+0x1ee/0x420 fs/namei.c:3818
 do_sys_openat2+0x14b/0x4f0 fs/open.c:1320
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1347
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa7350d7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff50940910 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fa73504d740 RCX: 00007fa7350d7407
RDX: 0000000000080800 RSI: 00007fff50940b20 RDI: ffffffffffffff9c
RBP: 00007fff50940b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000040
R13: 00007fff50940c20 R14: 000055b1022f67fe R15: 00007fff50940c20
 </TASK>
================================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	4a 80 7e 65 8b       	rex.WX cmpb $0x8b,0x65(%rsi)
   5:	0d c5 4a 80 7e       	or     $0x7e804ac5,%eax
   a:	81 e1 00 01 ff 00    	and    $0xff0100,%ecx
  10:	74 11                	je     0x23
  12:	81 f9 00 01 00 00    	cmp    $0x100,%ecx
  18:	75 5b                	jne    0x75
  1a:	83 ba 1c 16 00 00 00 	cmpl   $0x0,0x161c(%rdx)
  21:	74 52                	je     0x75
  23:	8b 8a f8 15 00 00    	mov    0x15f8(%rdx),%ecx
* 29:	83 f9 03             	cmp    $0x3,%ecx <-- trapping instruction
  2c:	75 47                	jne    0x75
  2e:	48 8b 8a 00 16 00 00 	mov    0x1600(%rdx),%rcx
  35:	44 8b 8a fc 15 00 00 	mov    0x15fc(%rdx),%r9d
  3c:	49                   	rex.WB
  3d:	c1                   	.byte 0xc1
  3e:	e1                   	.byte 0xe1