================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 261 is out of range for type 'const int[34]'
CPU: 1 PID: 6181 Comm: kworker/u4:25 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: bat_events batadv_nc_worker
Call Trace:
 <IRQ>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:217
 __ubsan_handle_out_of_bounds+0xe3/0xf0 lib/ubsan.c:348
 aiptek_irq+0x1eb8/0x2920 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1648
 dummy_timer+0xa40/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1754 [inline]
 __hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
 hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:104 [inline]
RIP: 0010:__local_bh_enable_ip+0x142/0x1c0 kernel/softirq.c:413
Code: 8a e8 32 a2 31 09 65 66 8b 05 2a 6c b1 7e 66 85 c0 75 54 bf 01 00 00 00 e8 2b 1d 0a 00 e8 c6 07 3b 00 fb 65 8b 05 f6 6b b1 7e <85> c0 75 05 e8 c5 50 ae ff 48 c7 04 24 0e 36 e0 45 4b c7 04 37 00
RSP: 0018:ffffc9000c1dfa40 EFLAGS: 00000286
RAX: 0000000080000000 RBX: 0000000000000201 RCX: d59246a6aa1a2b00
RDX: dffffc0000000000 RSI: ffffffff8acacb60 RDI: ffffffff8b1c7be0
RBP: ffffc9000c1dfac0 R08: ffffffff911bc5df R09: 1ffffffff22378bb
R10: dffffc0000000000 R11: fffffbfff22378bc R12: ffffffff8a4bb200
R13: ffff888018eb4fd0 R14: dffffc0000000000 R15: 1ffff9200183bf48
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 batadv_nc_purge_paths+0x300/0x3a0 net/batman-adv/network-coding.c:471
 batadv_nc_worker+0x363/0x600 net/batman-adv/network-coding.c:722
 process_one_work kernel/workqueue.c:2653 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
================================================================================
----------------
Code disassembly (best guess):
   0:	8a e8                	mov    %al,%ch
   2:	32 a2 31 09 65 66    	xor    0x66650931(%rdx),%ah
   8:	8b 05 2a 6c b1 7e    	mov    0x7eb16c2a(%rip),%eax        # 0x7eb16c38
   e:	66 85 c0             	test   %ax,%ax
  11:	75 54                	jne    0x67
  13:	bf 01 00 00 00       	mov    $0x1,%edi
  18:	e8 2b 1d 0a 00       	call   0xa1d48
  1d:	e8 c6 07 3b 00       	call   0x3b07e8
  22:	fb                   	sti
  23:	65 8b 05 f6 6b b1 7e 	mov    %gs:0x7eb16bf6(%rip),%eax        # 0x7eb16c20
* 2a:	85 c0                	test   %eax,%eax <-- trapping instruction
  2c:	75 05                	jne    0x33
  2e:	e8 c5 50 ae ff       	call   0xffae50f8
  33:	48 c7 04 24 0e 36 e0 	movq   $0x45e0360e,(%rsp)
  3a:	45
  3b:	4b                   	rex.WXB
  3c:	c7                   	.byte 0xc7
  3d:	04 37                	add    $0x37,%al