================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 4905 is out of range for type 'const int[34]'
CPU: 0 PID: 1812 Comm: syz.1.340 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1673
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1756
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x398/0x8a0 kernel/time/hrtimer.c:1753
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1770
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:unwind_next_frame+0x11/0x660 arch/x86/kernel/unwind_frame.c:265
Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 b8 b1 d2 a0 0a 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 28 <48> 89 fb 49 be 00 00 00 00 00 fc ff df 49 89 ff 49 c1 ef 03 43 0f
RSP: 0018:ffffc9000544efe8 EFLAGS: 00000296
RAX: 0000000000000001 RBX: ffffc9000544f100 RCX: 0000000000a89e00
RDX: dffffc0000000000 RSI: ffffffff8149bcd1 RDI: ffffc9000544f048
RBP: ffffc9000544f038 R08: ffffc9000544f110 R09: ffffc9000544f108
R10: 000000000000000e R11: fffff52000a89e15 R12: ffff88811d9f1440
R13: dffffc0000000000 R14: ffffffff81620a30 R15: ffffc9000544f048
arch_stack_walk+0x124/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xb6/0xc0 mm/kasan/generic.c:486
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:496
__call_rcu_common kernel/rcu/tree.c:2807 [inline]
call_rcu+0xcf/0xf50 kernel/rcu/tree.c:2926
security_inode_free+0xc5/0xe0 security/security.c:1073
__destroy_inode+0x175/0x500 fs/inode.c:289
destroy_inode fs/inode.c:312 [inline]
evict+0x777/0x8c0 fs/inode.c:724
iput_final fs/inode.c:1845 [inline]
iput+0x633/0x690 fs/inode.c:1871
dentry_unlink_inode+0x346/0x3f0 fs/dcache.c:405
__dentry_kill+0x46c/0x680 fs/dcache.c:611
dentry_kill+0xc0/0x2a0 fs/dcache.c:-1
dput+0x42/0x80 fs/dcache.c:918
__fput+0x5c0/0x8f0 fs/file_table.c:328
____fput+0x15/0x20 fs/file_table.c:348
task_work_run+0x1e1/0x250 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0xb0d/0x29f0 kernel/exit.c:896
do_group_exit+0x21b/0x2e0 kernel/exit.c:1040
get_signal+0x167c/0x1700 kernel/signal.c:2904
arch_do_signal_or_restart+0xd1/0x11c0 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff0b759e1d9
Code: Unable to access opcode bytes at 0x7ff0b759e1af.
RSP: 002b:00007ff0b8506028 EFLAGS: 00000246
ORIG_RAX: 00000000000000a5
RAX: fffffffffffffe00 RBX: 00007ff0b7825fa0 RCX: 00007ff0b759e1d9
RDX: 0000200000000140 RSI: 0000200000000100 RDI: 0000000000000000
RBP: 00007ff0b7635888 R08: 0000200000000180 R09: 0000000000000000
R10: 0000000000010044 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff0b7826038 R14: 00007ff0b7825fa0 R15: 00007ffdc379f7a8
================================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 4906 is out of range for type 'const int[34]'
CPU: 0 PID: 1812 Comm: syz.1.340 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1673
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1756
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x398/0x8a0 kernel/time/hrtimer.c:1753
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1770
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:unwind_next_frame+0x11/0x660 arch/x86/kernel/unwind_frame.c:265
Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 b8 b1 d2 a0 0a 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 28 <48> 89 fb 49 be 00 00 00 00 00 fc ff df 49 89 ff 49 c1 ef 03 43 0f
RSP: 0018:ffffc9000544efe8 EFLAGS: 00000296
RAX: 0000000000000001 RBX: ffffc9000544f100 RCX: 0000000000a89e00
RDX: dffffc0000000000 RSI: ffffffff8149bcd1 RDI: ffffc9000544f048
RBP: ffffc9000544f038 R08: ffffc9000544f110 R09: ffffc9000544f108
R10: 000000000000000e R11: fffff52000a89e15 R12: ffff88811d9f1440
R13: dffffc0000000000 R14: ffffffff81620a30 R15: ffffc9000544f048
arch_stack_walk+0x124/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xb6/0xc0 mm/kasan/generic.c:486
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:496
__call_rcu_common kernel/rcu/tree.c:2807 [inline]
call_rcu+0xcf/0xf50 kernel/rcu/tree.c:2926
security_inode_free+0xc5/0xe0 security/security.c:1073
__destroy_inode+0x175/0x500 fs/inode.c:289
destroy_inode fs/inode.c:312 [inline]
evict+0x777/0x8c0 fs/inode.c:724
iput_final fs/inode.c:1845 [inline]
iput+0x633/0x690 fs/inode.c:1871
dentry_unlink_inode+0x346/0x3f0 fs/dcache.c:405
__dentry_kill+0x46c/0x680 fs/dcache.c:611
dentry_kill+0xc0/0x2a0 fs/dcache.c:-1
dput+0x42/0x80 fs/dcache.c:918
__fput+0x5c0/0x8f0 fs/file_table.c:328
____fput+0x15/0x20 fs/file_table.c:348
task_work_run+0x1e1/0x250 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0xb0d/0x29f0 kernel/exit.c:896
do_group_exit+0x21b/0x2e0 kernel/exit.c:1040
get_signal+0x167c/0x1700 kernel/signal.c:2904
arch_do_signal_or_restart+0xd1/0x11c0 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff0b759e1d9
Code: Unable to access opcode bytes at 0x7ff0b759e1af.
RSP: 002b:00007ff0b8506028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: fffffffffffffe00 RBX: 00007ff0b7825fa0 RCX: 00007ff0b759e1d9
RDX: 0000200000000140 RSI: 0000200000000100 RDI: 0000000000000000
RBP: 00007ff0b7635888 R08: 0000200000000180 R09: 0000000000000000
R10: 0000000000010044 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff0b7826038 R14: 00007ff0b7825fa0 R15: 00007ffdc379f7a8
================================================================================
aiptek 6-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
0: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
7: 00
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: b8 b1 d2 a0 0a mov $0xaa0d2b1,%eax
19: 55 push %rbp
1a: 48 89 e5 mov %rsp,%rbp
1d: 41 57 push %r15
1f: 41 56 push %r14
21: 41 55 push %r13
23: 41 54 push %r12
25: 53 push %rbx
26: 48 83 ec 28 sub $0x28,%rsp
* 2a: 48 89 fb mov %rdi,%rbx <-- trapping instruction
2d: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14
34: fc ff df
37: 49 89 ff mov %rdi,%r15
3a: 49 c1 ef 03 shr $0x3,%r15
3e: 43 rex.XB
3f: 0f .byte 0xf