================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 14764 is out of range for type 'const int[34]'
CPU: 0 PID: 19 Comm: kworker/0:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: rcu_gp process_srcu
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x208d/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x364/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11c/0x410 drivers/usb/core/hcd.c:1758
dummy_timer+0x88c/0x3070 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x3bb/0x8e0 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:preempt_latency_start kernel/sched/core.c:5884 [inline]
RIP: 0010:preempt_count_add+0xd8/0x1b0 kernel/sched/core.c:5907
Code: 00 48 8b 58 08 65 4c 8b 35 75 c6 b5 7e 49 81 c6 c8 0a 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 38 7c 6a 00 <49> 89 1e 5b 41 5e 41 5f 5d c3 89 fb e8 47 a1 19 01 89 df 85 c0 74
RSP: 0018:ffffc90000137b38 EFLAGS: 00000246
RAX: 1ffff11020066b79 RBX: ffffffff84f64487 RCX: ffffffff87b7c100
RDX: 0000000000000042 RSI: ffffffff85ca8cc0 RDI: ffffffff84f64487
RBP: ffffc90000137b50 R08: ffffc90000137ba7 R09: 1ffff92000026f74
R10: 0000000000000000 R11: ffffffff84f64420 R12: 000000000000201d
R13: ffffffff87bd3810 R14: ffff888100335bc8 R15: dffffc0000000000
delay_tsc+0x67/0xc0 arch/x86/lib/delay.c:79
__delay arch/x86/lib/delay.c:203 [inline]
__const_udelay+0x73/0x80 arch/x86/lib/delay.c:217
__udelay+0x10/0x20 arch/x86/lib/delay.c:223
try_check_zero+0x3ff/0x420 kernel/rcu/srcutree.c:975
srcu_advance_state kernel/rcu/srcutree.c:1549 [inline]
process_srcu+0x1eb/0x11e0 kernel/rcu/srcutree.c:1651
process_one_work+0x71f/0xc40 kernel/workqueue.c:2302
worker_thread+0xa29/0x11e0 kernel/workqueue.c:2449
kthread+0x281/0x320 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
================================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 14765 is out of range for type 'const int[34]'
CPU: 0 PID: 19 Comm: kworker/0:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: rcu_gp process_srcu
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f6d/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x364/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11c/0x410 drivers/usb/core/hcd.c:1758
dummy_timer+0x88c/0x3070 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x3bb/0x8e0 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:preempt_latency_start kernel/sched/core.c:5884 [inline]
RIP: 0010:preempt_count_add+0xd8/0x1b0 kernel/sched/core.c:5907
Code: 00 48 8b 58 08 65 4c 8b 35 75 c6 b5 7e 49 81 c6 c8 0a 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 38 7c 6a 00 <49> 89 1e 5b 41 5e 41 5f 5d c3 89 fb e8 47 a1 19 01 89 df 85 c0 74
RSP: 0018:ffffc90000137b38 EFLAGS: 00000246
RAX: 1ffff11020066b79 RBX: ffffffff84f64487 RCX: ffffffff87b7c100
RDX: 0000000000000042 RSI: ffffffff85ca8cc0 RDI: ffffffff84f64487
RBP: ffffc90000137b50 R08: ffffc90000137ba7 R09: 1ffff92000026f74
R10: 0000000000000000 R11: ffffffff84f64420 R12: 000000000000201d
R13: ffffffff87bd3810 R14: ffff888100335bc8 R15: dffffc0000000000
delay_tsc+0x67/0xc0 arch/x86/lib/delay.c:79
__delay arch/x86/lib/delay.c:203 [inline]
__const_udelay+0x73/0x80 arch/x86/lib/delay.c:217
__udelay+0x10/0x20 arch/x86/lib/delay.c:223
try_check_zero+0x3ff/0x420 kernel/rcu/srcutree.c:975
srcu_advance_state kernel/rcu/srcutree.c:1549 [inline]
process_srcu+0x1eb/0x11e0 kernel/rcu/srcutree.c:1651
process_one_work+0x71f/0xc40 kernel/workqueue.c:2302
worker_thread+0xa29/0x11e0 kernel/workqueue.c:2449
kthread+0x281/0x320 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
================================================================================
aiptek 6-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
0: 00 48 8b add %cl,-0x75(%rax)
3: 58 pop %rax
4: 08 65 4c or %ah,0x4c(%rbp)
7: 8b 35 75 c6 b5 7e mov 0x7eb5c675(%rip),%esi # 0x7eb5c682
d: 49 81 c6 c8 0a 00 00 add $0xac8,%r14
14: 4c 89 f0 mov %r14,%rax
17: 48 c1 e8 03 shr $0x3,%rax
1b: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
20: 74 08 je 0x2a
22: 4c 89 f7 mov %r14,%rdi
25: e8 38 7c 6a 00 call 0x6a7c62
* 2a: 49 89 1e mov %rbx,(%r14) <-- trapping instruction
2d: 5b pop %rbx
2e: 41 5e pop %r14
30: 41 5f pop %r15
32: 5d pop %rbp
33: c3 ret
34: 89 fb mov %edi,%ebx
36: e8 47 a1 19 01 call 0x119a182
3b: 89 df mov %ebx,%edi
3d: 85 c0 test %eax,%eax
3f: 74 .byte 0x74