================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 512 is out of range for type 'const int[34]'
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 dump_stack+0x15/0x1c lib/dump_stack.c:135
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:148
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:347
 aiptek_irq+0x1fa2/0x2860 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
 usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1748
 dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1986
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x637/0x9a0 kernel/time/timer.c:1789
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:need_resched include/linux/sched.h:1955 [inline]
RIP: 0010:do_idle+0xfb/0x620 kernel/sched/idle.c:304
Code: 00 44 89 f0 48 89 44 24 18 41 c1 ee 06 4e 8d 3c f5 68 6c c3 86 45 31 e4 48 c7 c0 20 6d c3 86 48 c1 e8 03 48 89 44 24 10 eb 0d <48> f7 03 08 00 00 00 0f 85 9d 04 00 00 0f ae e8 fa 4c 89 ff be 08
RSP: 0018:ffffffff86407dc0 EFLAGS: 00000246
RAX: ffffffff81591c01 RBX: ffffffff8641c100 RCX: ffffffff81466a56
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8641c100
RBP: ffffffff86407ea0 R08: ffffffff8641c107 R09: 1ffffffff0c83820
R10: dffffc0000000000 R11: fffffbfff0c83821 R12: 0000000081591c00
R13: 1ffffffff0c83820 R14: dffffc0000000000 R15: ffffffff86c36c68
 cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:425
 rest_init+0xe8/0xf0 init/main.c:728
 arch_call_rest_init+0xe/0x10 init/main.c:853
 start_kernel+0x431/0x49f init/main.c:1055
 x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:519
 x86_64_start_kernel+0x60/0x63 arch/x86/kernel/head64.c:500
 secondary_startup_64_no_verify+0xad/0xbb
================================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 513 is out of range for type 'const int[34]'
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 dump_stack+0x15/0x1c lib/dump_stack.c:135
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:148
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:347
 aiptek_irq+0x1e71/0x2860 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
 usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1748
 dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1986
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x637/0x9a0 kernel/time/timer.c:1789
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:need_resched include/linux/sched.h:1955 [inline]
RIP: 0010:do_idle+0xfb/0x620 kernel/sched/idle.c:304
Code: 00 44 89 f0 48 89 44 24 18 41 c1 ee 06 4e 8d 3c f5 68 6c c3 86 45 31 e4 48 c7 c0 20 6d c3 86 48 c1 e8 03 48 89 44 24 10 eb 0d <48> f7 03 08 00 00 00 0f 85 9d 04 00 00 0f ae e8 fa 4c 89 ff be 08
RSP: 0018:ffffffff86407dc0 EFLAGS: 00000246
RAX: ffffffff81591c01 RBX: ffffffff8641c100 RCX: ffffffff81466a56
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8641c100
RBP: ffffffff86407ea0 R08: ffffffff8641c107 R09: 1ffffffff0c83820
R10: dffffc0000000000 R11: fffffbfff0c83821 R12: 0000000081591c00
R13: 1ffffffff0c83820 R14: dffffc0000000000 R15: ffffffff86c36c68
 cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:425
 rest_init+0xe8/0xf0 init/main.c:728
 arch_call_rest_init+0xe/0x10 init/main.c:853
 start_kernel+0x431/0x49f init/main.c:1055
 x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:519
 x86_64_start_kernel+0x60/0x63 arch/x86/kernel/head64.c:500
 secondary_startup_64_no_verify+0xad/0xbb
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x1e8f/0x2860 drivers/input/tablet/aiptek.c:763
Read of size 4 at addr ffffffff855ade64 by task swapper/0/0

CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 aiptek_irq+0x1e8f/0x2860 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x32f/0x4f0 drivers/usb/core/hcd.c:1674
 usb_hcd_giveback_urb+0x11d/0x3f0 drivers/usb/core/hcd.c:1748
 dummy_timer+0xa34/0x31d0 drivers/usb/gadget/udc/dummy_hcd.c:1986
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x637/0x9a0 kernel/time/timer.c:1789
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:need_resched include/linux/sched.h:1955 [inline]
RIP: 0010:do_idle+0xfb/0x620 kernel/sched/idle.c:304
Code: 00 44 89 f0 48 89 44 24 18 41 c1 ee 06 4e 8d 3c f5 68 6c c3 86 45 31 e4 48 c7 c0 20 6d c3 86 48 c1 e8 03 48 89 44 24 10 eb 0d <48> f7 03 08 00 00 00 0f 85 9d 04 00 00 0f ae e8 fa 4c 89 ff be 08
RSP: 0018:ffffffff86407dc0 EFLAGS: 00000246
RAX: ffffffff81591c01 RBX: ffffffff8641c100 RCX: ffffffff81466a56
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8641c100
RBP: ffffffff86407ea0 R08: ffffffff8641c107 R09: 1ffffffff0c83820
R10: dffffc0000000000 R11: fffffbfff0c83821 R12: 0000000081591c00
R13: 1ffffffff0c83820 R14: dffffc0000000000 R15: ffffffff86c36c68
 cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:425
 rest_init+0xe8/0xf0 init/main.c:728
 arch_call_rest_init+0xe/0x10 init/main.c:853
 start_kernel+0x431/0x49f init/main.c:1055
 x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:519
 x86_64_start_kernel+0x60/0x63 arch/x86/kernel/head64.c:500
 secondary_startup_64_no_verify+0xad/0xbb

The buggy address belongs to the variable:
 .str.50+0x4/0x20

Memory state around the buggy address:
 ffffffff855add00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff855add80: f9 f9 f9 f9 06 f9 f9 f9 00 01 f9 f9 04 f9 f9 f9
>ffffffff855ade00: 00 f9 f9 f9 06 f9 f9 f9 07 f9 f9 f9 06 f9 f9 f9
                                                       ^
 ffffffff855ade80: 00 04 f9 f9 05 f9 f9 f9 00 03 f9 f9 00 03 f9 f9
 ffffffff855adf00: 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	00 44 89 f0          	add    %al,-0x10(%rcx,%rcx,4)
   4:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
   9:	41 c1 ee 06          	shr    $0x6,%r14d
   d:	4e 8d 3c f5 68 6c c3 	lea    -0x793c9398(,%r14,8),%r15
  14:	86
  15:	45 31 e4             	xor    %r12d,%r12d
  18:	48 c7 c0 20 6d c3 86 	mov    $0xffffffff86c36d20,%rax
  1f:	48 c1 e8 03          	shr    $0x3,%rax
  23:	48 89 44 24 10       	mov    %rax,0x10(%rsp)
  28:	eb 0d                	jmp    0x37
* 2a:	48 f7 03 08 00 00 00 	testq  $0x8,(%rbx) <-- trapping instruction
  31:	0f 85 9d 04 00 00    	jne    0x4d4
  37:	0f ae e8             	lfence
  3a:	fa                   	cli
  3b:	4c 89 ff             	mov    %r15,%rdi
  3e:	be                   	.byte 0xbe
  3f:	08                   	.byte 0x8