================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 1279 is out of range for type 'const int[34]'
CPU: 1 PID: 27 Comm: kworker/1:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
ubsan_epilogue+0xa/0x30 lib/ubsan.c:217
__ubsan_handle_out_of_bounds+0xe3/0xf0 lib/ubsan.c:348
aiptek_irq+0x1eb8/0x2920 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1648
dummy_timer+0xa58/0x34e0 drivers/usb/gadget/udc/dummy_hcd.c:2017
__run_hrtimer kernel/time/hrtimer.c:1754 [inline]
__hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:lock_acquire+0x208/0x420 kernel/locking/lockdep.c:5758
Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25
RSP: 0018:ffffc90000a2eac0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 4b8356eed453b700
RDX: 0000000000000000 RSI: ffffffff8acadd60 RDI: ffffffff8b1d32e0
RBP: ffffc90000a2ebc8 R08: dffffc0000000000 R09: 1ffffffff223daa2
R10: dffffc0000000000 R11: fffffbfff223daa3 R12: 1ffff92000145d64
R13: ffffffff8d2280a0 R14: 0000000000000246 R15: dffffc0000000000
fs_reclaim_acquire+0x98/0x100 mm/page_alloc.c:3617
might_alloc include/linux/sched/mm.h:303 [inline]
slab_pre_alloc_hook+0x2a/0x300 mm/slab.h:714
slab_alloc_node mm/slub.c:3477 [inline]
slab_alloc mm/slub.c:3503 [inline]
__kmem_cache_alloc_lru mm/slub.c:3510 [inline]
kmem_cache_alloc+0x5a/0x2c0 mm/slub.c:3519
kmem_cache_zalloc include/linux/slab.h:711 [inline]
__kernfs_new_node+0xe5/0x7f0 fs/kernfs/dir.c:624
kernfs_new_node+0x14c/0x260 fs/kernfs/dir.c:700
__kernfs_create_file+0x4b/0x2e0 fs/kernfs/file.c:1068
sysfs_add_file_mode_ns+0x237/0x2f0 fs/sysfs/file.c:298
create_files fs/sysfs/group.c:64 [inline]
internal_create_group+0x431/0xd10 fs/sysfs/group.c:152
internal_create_groups fs/sysfs/group.c:192 [inline]
sysfs_create_groups+0x59/0x120 fs/sysfs/group.c:218
really_probe+0x54c/0xae0 drivers/base/dd.c:736
__driver_probe_device+0x1f5/0x390 drivers/base/dd.c:879
driver_probe_device+0x4f/0x420 drivers/base/dd.c:909
__device_attach_driver+0x2ca/0x510 drivers/base/dd.c:1037
bus_for_each_drv+0x252/0x2e0 drivers/base/bus.c:459
__device_attach+0x2c1/0x420 drivers/base/dd.c:1109
bus_probe_device+0x180/0x260 drivers/base/bus.c:580
device_add+0x87c/0xc40 drivers/base/core.c:3700
usb_set_configuration+0x1ad0/0x2150 drivers/usb/core/message.c:2265
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:238
usb_probe_device+0x12a/0x260 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x247/0xae0 drivers/base/dd.c:717
__driver_probe_device+0x1f5/0x390 drivers/base/dd.c:879
driver_probe_device+0x4f/0x420 drivers/base/dd.c:909
__device_attach_driver+0x2ca/0x510 drivers/base/dd.c:1037
bus_for_each_drv+0x252/0x2e0 drivers/base/bus.c:459
__device_attach+0x2c1/0x420 drivers/base/dd.c:1109
bus_probe_device+0x180/0x260 drivers/base/bus.c:580
device_add+0x87c/0xc40 drivers/base/core.c:3700
usb_new_device+0x995/0x1550 drivers/usb/core/hub.c:2660
hub_port_connect drivers/usb/core/hub.c:5529 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5669 [inline]
port_event drivers/usb/core/hub.c:5833 [inline]
hub_event+0x29d5/0x4a80 drivers/usb/core/hub.c:5915
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
================================================================================
----------------
Code disassembly (best guess):
0: f7 84 24 80 00 00 00 testl $0x200,0x80(%rsp)
7: 00 02 00 00
b: 43 c6 44 3c 04 f8 movb $0xf8,0x4(%r12,%r15,1)
11: 0f 85 f0 00 00 00 jne 0x107
17: 41 f7 c6 00 02 00 00 test $0x200,%r14d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 60 0e 36 movq $0x45e0360e,0x60(%rsp)
28: e0 45
* 2a: 4b c7 04 3c 00 00 00 movq $0x0,(%r12,%r15,1) <-- trapping instruction
31: 00
32: 43 c7 44 3c 08 00 00 movl $0x0,0x8(%r12,%r15,1)
39: 00 00
3b: 65 gs
3c: 48 rex.W
3d: 8b .byte 0x8b
3e: 04 25 add $0x25,%al