================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:724:31
index 65 is out of range for type 'const int[34]'
CPU: 0 PID: 4198 Comm: syz.0.1276 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 dump_stack+0x15/0x24 lib/dump_stack.c:113
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
 aiptek_irq+0x2153/0x29b0 drivers/input/tablet/aiptek.c:724
 __usb_hcd_giveback_urb+0x364/0x520 drivers/usb/core/hcd.c:1675
 usb_hcd_giveback_urb+0x11c/0x410 drivers/usb/core/hcd.c:1758
 dummy_timer+0x88c/0x3070 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x3bb/0x8e0 kernel/time/hrtimer.c:1749
 hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:stack_trace_consume_entry+0x54/0x290 kernel/stacktrace.c:89
Code: 84 c0 0f 85 0f 01 00 00 44 8b 57 10 4c 8d 4f 08 4d 89 cd 49 c1 ed 03 41 0f b6 44 15 00 84 c0 0f 85 28 01 00 00 45 3b 11 73 3c <4c> 8d 67 0c 4d 89 e7 49 c1 ef 03 41 0f b6 04 17 84 c0 0f 85 53 01
RSP: 0018:ffffc900031cee50 EFLAGS: 00000287
RAX: 0000000000000000 RBX: 1ffff92000639dee RCX: 00000000031cee00
RDX: dffffc0000000000 RSI: ffffffff81bf8559 RDI: ffffc900031cef60
RBP: ffffc900031cee98 R08: ffffc900031cef70 R09: ffffc900031cef68
R10: 000000000000000c R11: fffff52000639de1 R12: ffff8881439d1440
R13: 1ffff92000639ded R14: ffffffff81621770 R15: ffffc900031ceea8
 arch_stack_walk+0x118/0x150 arch/x86/kernel/stacktrace.c:27
 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
 save_stack+0x121/0x230 mm/page_owner.c:147
 __set_page_owner+0x1f/0x60 mm/page_owner.c:210
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2672
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2679
 get_page_from_freelist+0x2d12/0x2d80 mm/page_alloc.c:4585
 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5929
 __folio_alloc+0x12/0x40 mm/page_alloc.c:5962
 __folio_alloc_node include/linux/gfp.h:245 [inline]
 folio_alloc include/linux/gfp.h:274 [inline]
 shmem_alloc_folio mm/shmem.c:1597 [inline]
 shmem_alloc_and_acct_folio+0x6dd/0x8c0 mm/shmem.c:1622
 shmem_get_folio_gfp+0x119f/0x2230 mm/shmem.c:1951
 shmem_get_folio mm/shmem.c:2082 [inline]
 shmem_write_begin+0xea/0x2c0 mm/shmem.c:2567
 generic_perform_write+0x32d/0x740 mm/filemap.c:3914
 __generic_file_write_iter+0x17a/0x230 mm/filemap.c:4013
 generic_file_write_iter+0xae/0x310 mm/filemap.c:4042
 call_write_iter include/linux/fs.h:2282 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x603/0xce0 fs/read_write.c:584
 ksys_write+0x149/0x250 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:646
 x64_sys_call+0x27b/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f68e0d5d68e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f68df7f6da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f68df7f76c0 RCX: 00007f68e0d5d68e
RDX: 0000000004000000 RSI: 00007f68d73d7000 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007
R13: 00007f68df7f6ee0 R14: 00007f68df7f6ea0 R15: 00007f68d73d7000
 </TASK>
================================================================================
aiptek 6-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
   0:	84 c0                	test   %al,%al
   2:	0f 85 0f 01 00 00    	jne    0x117
   8:	44 8b 57 10          	mov    0x10(%rdi),%r10d
   c:	4c 8d 4f 08          	lea    0x8(%rdi),%r9
  10:	4d 89 cd             	mov    %r9,%r13
  13:	49 c1 ed 03          	shr    $0x3,%r13
  17:	41 0f b6 44 15 00    	movzbl 0x0(%r13,%rdx,1),%eax
  1d:	84 c0                	test   %al,%al
  1f:	0f 85 28 01 00 00    	jne    0x14d
  25:	45 3b 11             	cmp    (%r9),%r10d
  28:	73 3c                	jae    0x66
* 2a:	4c 8d 67 0c          	lea    0xc(%rdi),%r12 <-- trapping instruction
  2e:	4d 89 e7             	mov    %r12,%r15
  31:	49 c1 ef 03          	shr    $0x3,%r15
  35:	41 0f b6 04 17       	movzbl (%r15,%rdx,1),%eax
  3a:	84 c0                	test   %al,%al
  3c:	0f                   	.byte 0xf
  3d:	85 53 01             	test   %edx,0x1(%rbx)