================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 53266 is out of range for type 'const int[34]'
CPU: 1 PID: 1241 Comm: syz.0.212 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 dump_stack+0x15/0x24 lib/dump_stack.c:113
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
 aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1673
 usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1756
 dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
 __hrtimer_run_queues+0x398/0x8a0 kernel/time/hrtimer.c:1753
 hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1770
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:find_stack lib/stackdepot.c:303 [inline]
RIP: 0010:__stack_depot_save+0x171/0x490 lib/stackdepot.c:452
Code: c1 c7 04 29 fe 31 f2 c1 c6 0e 29 f2 41 31 d7 c1 c2 18 41 29 d7 4c 8b 15 d5 45 2e 05 44 8b 25 ca 45 2e 05 45 21 fc 4f 8b 2c e2 <4d> 85 ed 74 62 89 ca eb 09 4d 8b 6d 00 4d 85 ed 74 55 45 39 7d 08
RSP: 0018:ffffc90013d3f690 EFLAGS: 00000202
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000016
RDX: 00000000e0a2d466 RSI: 00000000b31e34e8 RDI: 00000000eca2cc2b
RBP: ffffc90013d3f6f0 R08: 0000000000000800 R09: 0000000000000001
R10: ffff8881f5a00000 R11: 000000000282718c R12: 00000000000b75bc
R13: ffff888110355220 R14: ffffc90013d3f700 R15: 000000003b7b75bc
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_set_track+0x60/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:242
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250
 kasan_slab_free include/linux/kasan.h:178 [inline]
 slab_free_hook mm/slub.c:1750 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776
 slab_free mm/slub.c:3712 [inline]
 __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728
 kfree+0x6f/0xf0 mm/slab_common.c:990
 destroy_curseg fs/f2fs/segment.c:5357 [inline]
 f2fs_destroy_segment_manager+0x8e5/0xd70 fs/f2fs/segment.c:5407
 f2fs_put_super+0x6c3/0xcb0 fs/f2fs/super.c:1718
 generic_shutdown_super+0x16c/0x480 fs/super.c:506
 kill_block_super+0x7f/0xf0 fs/super.c:1475
 kill_f2fs_super+0x310/0x3d0 fs/f2fs/super.c:4896
 deactivate_locked_super+0xb5/0x120 fs/super.c:336
 deactivate_super+0xaf/0xe0 fs/super.c:367
 cleanup_mnt+0x45e/0x4e0 fs/namespace.c:1192
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1199
 task_work_run+0x1e1/0x250 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f839819f3ca
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8399085e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffec RBX: 00007f8399085ee0 RCX: 00007f839819f3ca
RDX: 00002000000000c0 RSI: 0000200000000100 RDI: 00007f8399085ea0
RBP: 00002000000000c0 R08: 00007f8399085ee0 R09: 0000000002800412
R10: 0000000002800412 R11: 0000000000000246 R12: 0000200000000100
R13: 00007f8399085ea0 R14: 0000000000005580 R15: 00002000000002c0
 </TASK>
================================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 53267 is out of range for type 'const int[34]'
CPU: 1 PID: 1241 Comm: syz.0.212 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 dump_stack+0x15/0x24 lib/dump_stack.c:113
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
 aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1673
 usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1756
 dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
 __hrtimer_run_queues+0x398/0x8a0 kernel/time/hrtimer.c:1753
 hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1770
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:find_stack lib/stackdepot.c:303 [inline]
RIP: 0010:__stack_depot_save+0x171/0x490 lib/stackdepot.c:452
Code: c1 c7 04 29 fe 31 f2 c1 c6 0e 29 f2 41 31 d7 c1 c2 18 41 29 d7 4c 8b 15 d5 45 2e 05 44 8b 25 ca 45 2e 05 45 21 fc 4f 8b 2c e2 <4d> 85 ed 74 62 89 ca eb 09 4d 8b 6d 00 4d 85 ed 74 55 45 39 7d 08
RSP: 0018:ffffc90013d3f690 EFLAGS: 00000202
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000016
RDX: 00000000e0a2d466 RSI: 00000000b31e34e8 RDI: 00000000eca2cc2b
RBP: ffffc90013d3f6f0 R08: 0000000000000800 R09: 0000000000000001
R10: ffff8881f5a00000 R11: 000000000282718c R12: 00000000000b75bc
R13: ffff888110355220 R14: ffffc90013d3f700 R15: 000000003b7b75bc
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_set_track+0x60/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:242
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250
 kasan_slab_free include/linux/kasan.h:178 [inline]
 slab_free_hook mm/slub.c:1750 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776
 slab_free mm/slub.c:3712 [inline]
 __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728
 kfree+0x6f/0xf0 mm/slab_common.c:990
 destroy_curseg fs/f2fs/segment.c:5357 [inline]
 f2fs_destroy_segment_manager+0x8e5/0xd70 fs/f2fs/segment.c:5407
 f2fs_put_super+0x6c3/0xcb0 fs/f2fs/super.c:1718
 generic_shutdown_super+0x16c/0x480 fs/super.c:506
 kill_block_super+0x7f/0xf0 fs/super.c:1475
 kill_f2fs_super+0x310/0x3d0 fs/f2fs/super.c:4896
 deactivate_locked_super+0xb5/0x120 fs/super.c:336
 deactivate_super+0xaf/0xe0 fs/super.c:367
 cleanup_mnt+0x45e/0x4e0 fs/namespace.c:1192
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1199
 task_work_run+0x1e1/0x250 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f839819f3ca
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8399085e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffec RBX: 00007f8399085ee0 RCX: 00007f839819f3ca
RDX: 00002000000000c0 RSI: 0000200000000100 RDI: 00007f8399085ea0
RBP: 00002000000000c0 R08: 00007f8399085ee0 R09: 0000000002800412
R10: 0000000002800412 R11: 0000000000000246 R12: 0000200000000100
R13: 00007f8399085ea0 R14: 0000000000005580 R15: 00002000000002c0
 </TASK>
================================================================================
aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
   0:	c1 c7 04             	rol    $0x4,%edi
   3:	29 fe                	sub    %edi,%esi
   5:	31 f2                	xor    %esi,%edx
   7:	c1 c6 0e             	rol    $0xe,%esi
   a:	29 f2                	sub    %esi,%edx
   c:	41 31 d7             	xor    %edx,%r15d
   f:	c1 c2 18             	rol    $0x18,%edx
  12:	41 29 d7             	sub    %edx,%r15d
  15:	4c 8b 15 d5 45 2e 05 	mov    0x52e45d5(%rip),%r10        # 0x52e45f1
  1c:	44 8b 25 ca 45 2e 05 	mov    0x52e45ca(%rip),%r12d        # 0x52e45ed
  23:	45 21 fc             	and    %r15d,%r12d
  26:	4f 8b 2c e2          	mov    (%r10,%r12,8),%r13
* 2a:	4d 85 ed             	test   %r13,%r13 <-- trapping instruction
  2d:	74 62                	je     0x91
  2f:	89 ca                	mov    %ecx,%edx
  31:	eb 09                	jmp    0x3c
  33:	4d 8b 6d 00          	mov    0x0(%r13),%r13
  37:	4d 85 ed             	test   %r13,%r13
  3a:	74 55                	je     0x91
  3c:	45 39 7d 08          	cmp    %r15d,0x8(%r13)