================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 65036 is out of range for type 'const int[34]'
CPU: 1 PID: 11628 Comm: syz.1.2375 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
 aiptek_irq+0x1e87/0x28f0 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1673
 dummy_timer+0xa39/0x34e0 drivers/usb/gadget/udc/dummy_hcd.c:2018
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:check_preemption_disabled+0x4b/0x110 lib/smp_processor_id.c:55
Code: 0d 72 12 d1 75 f7 c1 ff ff ff 7f 74 1f 65 48 8b 0c 25 28 00 00 00 48 3b 4c 24 08 0f 85 c4 00 00 00 48 83 c4 10 5b 41 5e 41 5f <5d> c3 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 74
RSP: 0018:ffffc9001c6bf1f0 EFLAGS: 00000286
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 4161be8915b8e100
RDX: 0000000000000000 RSI: ffffffff8adf6400 RDI: ffffffff8adf63c0
RBP: ffffc9001c6bf328 R08: ffffffff8e2116af R09: 1ffffffff1c422d5
R10: dffffc0000000000 R11: fffffbfff1c422d6 R12: 0000000000000001
R13: 1ffff920038d7e50 R14: 0000000000000000 R15: dffffc0000000000
 rcu_dynticks_curr_cpu_in_eqs include/linux/context_tracking.h:122 [inline]
 rcu_is_watching+0x11/0xa0 kernel/rcu/tree.c:721
 trace_lock_acquire include/trace/events/lock.h:24 [inline]
 lock_acquire+0xe3/0x4a0 kernel/locking/lockdep.c:5647
 rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 rcu_read_lock include/linux/rcupdate.h:791 [inline]
 folio_memcg_lock+0x9e/0x320 mm/memcontrol.c:2101
 page_remove_rmap+0x2e/0xef0 mm/rmap.c:1426
 zap_pte_range mm/memory.c:1451 [inline]
 zap_pmd_range mm/memory.c:1572 [inline]
 zap_pud_range mm/memory.c:1601 [inline]
 zap_p4d_range mm/memory.c:1622 [inline]
 unmap_page_range+0x10db/0x25b0 mm/memory.c:1643
 unmap_vmas+0x260/0x390 mm/memory.c:1728
 exit_mmap+0x20d/0x970 mm/mmap.c:3250
 __mmput+0x118/0x3a0 kernel/fork.c:1210
 exit_mm+0x24d/0x350 kernel/exit.c:572
 do_exit+0x958/0x2570 kernel/exit.c:874
 do_group_exit+0x229/0x2e0 kernel/exit.c:1030
 get_signal+0x1259/0x1340 kernel/signal.c:2880
 arch_do_signal_or_restart+0xc4/0x1310 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f44c299e159
Code: Unable to access opcode bytes at 0x7f44c299e12f.
RSP: 002b:00007f44c3884028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f44c2c26090 RCX: 00007f44c299e159
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000006
RBP: 00007f44c2a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f44c2c26128 R14: 00007f44c2c26090 R15: 00007ffd2a198e88
 </TASK>
================================================================================
----------------
Code disassembly (best guess):
   0:	0d 72 12 d1 75       	or     $0x75d11272,%eax
   5:	f7 c1 ff ff ff 7f    	test   $0x7fffffff,%ecx
   b:	74 1f                	je     0x2c
   d:	65 48 8b 0c 25 28 00 	mov    %gs:0x28,%rcx
  14:	00 00
  16:	48 3b 4c 24 08       	cmp    0x8(%rsp),%rcx
  1b:	0f 85 c4 00 00 00    	jne    0xe5
  21:	48 83 c4 10          	add    $0x10,%rsp
  25:	5b                   	pop    %rbx
  26:	41 5e                	pop    %r14
  28:	41 5f                	pop    %r15
* 2a:	5d                   	pop    %rbp <-- trapping instruction
  2b:	c3                   	ret
  2c:	48 c7 04 24 00 00 00 	movq   $0x0,(%rsp)
  33:	00
  34:	9c                   	pushf
  35:	8f 04 24             	pop    (%rsp)
  38:	f7 04 24 00 02 00 00 	testl  $0x200,(%rsp)
  3f:	74                   	.byte 0x74