================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 767 is out of range for type 'const int[34]'
CPU: 0 PID: 6258 Comm: syz.2.640 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
ubsan_epilogue+0xa/0x30 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1e87/0x28f0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1673
dummy_timer+0xa21/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1751 [inline]
__hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:lock_acquire+0x225/0x4a0 kernel/locking/lockdep.c:5680
Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3d 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 43 c7 44 3d 08 00 00 00 00 65 48 8b 04
RSP: 0000:ffffc9001b6ff8e0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 7964a8da8abbd700
RDX: 0000000000000000 RSI: ffffffff8a8c2920 RDI: ffffffff8adf5de0
RBP: ffffc9001b6ff9f0 R08: dffffc0000000000 R09: 1ffffffff2161e48
R10: dffffc0000000000 R11: fffffbfff2161e49 R12: 0000000000000000
R13: 1ffff920036dff28 R14: 0000000000000246 R15: dffffc0000000000
rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
rcu_read_lock include/linux/rcupdate.h:791 [inline]
page_ext_get+0x3a/0x2a0 mm/page_ext.c:157
page_table_check_set+0x51/0x6d0 mm/page_table_check.c:112
page_table_check_pte_set include/linux/page_table_check.h:83 [inline]
set_pte_at arch/x86/include/asm/pgtable.h:1009 [inline]
do_set_pte+0x452/0x460 mm/memory.c:4424
filemap_map_pages+0xd73/0x11e0 mm/filemap.c:3513
do_fault_around mm/memory.c:4598 [inline]
do_read_fault mm/memory.c:4624 [inline]
do_fault mm/memory.c:4758 [inline]
handle_pte_fault mm/memory.c:5029 [inline]
__handle_mm_fault mm/memory.c:5171 [inline]
handle_mm_fault+0x25e5/0x3d40 mm/memory.c:5292
do_user_addr_fault+0x58e/0xb20 arch/x86/mm/fault.c:1338
handle_page_fault arch/x86/mm/fault.c:1429 [inline]
exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1482
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f69ff0727b6
Code: ff 48 83 e8 01 48 89 de bf 01 00 00 00 48 c1 e0 0e 48 c1 ee 06 48 01 c8 48 89 d9 81 e6 ff 3f 00 00 48 c1 e9 03 83 e1 07 d3 e7 <40> 84 bc 06 20 20 00 00 0f 85 20 fe ff ff e9 d4 fd ff ff 0f 1f 80
RSP: 002b:00007ffe3b4b2810 EFLAGS: 00010202
RAX: 000000110c2e0000 RBX: ffffffff814dd12a RCX: 0000000000000005
RDX: 000000000000112a RSI: 0000000000003744 RDI: 0000000000000020
RBP: 0000000000000000 R08: 00007f69ff410000 R09: 00007f69ff412000
R10: 00000000814dd12e R11: 0000000000000001 R12: 00007f69ff426038
R13: 0000000000001cdd R14: ffffffff814dd7c5 R15: 00007f69fff55720
================================================================================
----------------
Code disassembly (best guess):
0: f7 84 24 80 00 00 00 testl $0x200,0x80(%rsp)
7: 00 02 00 00
b: 43 c6 44 3d 04 f8 movb $0xf8,0x4(%r13,%r15,1)
11: 0f 85 f0 00 00 00 jne 0x107
17: 41 f7 c6 00 02 00 00 test $0x200,%r14d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 60 0e 36 movq $0x45e0360e,0x60(%rsp)
28: e0 45
* 2a: 4b c7 44 3d 00 00 00 movq $0x0,0x0(%r13,%r15,1) <-- trapping instruction
31: 00 00
33: 43 c7 44 3d 08 00 00 movl $0x0,0x8(%r13,%r15,1)
3a: 00 00
3c: 65 gs
3d: 48 rex.W
3e: 8b .byte 0x8b
3f: 04 .byte 0x4