================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 1535 is out of range for type 'const int[34]'
CPU: 0 PID: 335 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1758
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x398/0x890 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:kernfs_dop_revalidate+0x33d/0x500 fs/kernfs/dir.c:1145
Code: 4c 89 e7 e8 85 b2 d5 ff 4d 8b 24 24 4d 39 e6 74 0a e8 97 27 90 ff 4d 89 fe eb 76 4c 89 75 c8 4c 89 e9 48 8b 45 d0 4c 8d 68 28 <4c> 89 e8 48 c1 e8 03 80 3c 08 00 4d 89 fe 74 08 4c 89 ef e8 4b b2
RSP: 0018:ffffc9000dd4f718 EFLAGS: 00000246
RAX: ffff888117c59dd0 RBX: ffff88812f18f190 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000ffffffff
RBP: ffffc9000dd4f750 R08: ffff88812f18f197 R09: 1ffff11025e31e32
R10: dffffc0000000000 R11: ffffed1025e31e33 R12: ffff88810de7e708
R13: ffff888117c59df8 R14: ffff88810de7e708 R15: ffff8881001b0f60
d_revalidate fs/namei.c:858 [inline]
lookup_fast+0x20c/0x520 fs/namei.c:-1
walk_component fs/namei.c:2001 [inline]
link_path_walk+0x608/0xeb0 fs/namei.c:2332
path_lookupat+0x8d/0x430 fs/namei.c:2485
filename_lookup+0x229/0x580 fs/namei.c:2515
vfs_statx+0x11b/0x6b0 fs/stat.c:229
vfs_fstatat fs/stat.c:267 [inline]
__do_sys_newfstatat fs/stat.c:437 [inline]
__se_sys_newfstatat+0x142/0x440 fs/stat.c:431
__x64_sys_newfstatat+0x9b/0xb0 fs/stat.c:431
x64_sys_call+0x77c/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:263
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9aa0b11b0a
Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7
RSP: 002b:00007ffdcbf76388 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 00007ffdcbf76820 RCX: 00007f9aa0b11b0a
RDX: 00007ffdcbf76390 RSI: 00007ffdcbf76820 RDI: 00000000ffffff9c
RBP: 0000563a7b1402c0 R08: 0000000000000000 R09: 0000000000000020
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcbf76420
R13: 00007ffdcbf76c55 R14: 0000563a670b2ca4 R15: 0000563a670b2bcc
================================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 1536 is out of range for type 'const int[34]'
CPU: 0 PID: 335 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1758
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x398/0x890 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:kernfs_dop_revalidate+0x33d/0x500 fs/kernfs/dir.c:1145
Code: 4c 89 e7 e8 85 b2 d5 ff 4d 8b 24 24 4d 39 e6 74 0a e8 97 27 90 ff 4d 89 fe eb 76 4c 89 75 c8 4c 89 e9 48 8b 45 d0 4c 8d 68 28 <4c> 89 e8 48 c1 e8 03 80 3c 08 00 4d 89 fe 74 08 4c 89 ef e8 4b b2
RSP: 0018:ffffc9000dd4f718 EFLAGS: 00000246
RAX: ffff888117c59dd0 RBX: ffff88812f18f190 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000ffffffff
RBP: ffffc9000dd4f750 R08: ffff88812f18f197 R09: 1ffff11025e31e32
R10: dffffc0000000000 R11: ffffed1025e31e33 R12: ffff88810de7e708
R13: ffff888117c59df8 R14: ffff88810de7e708 R15: ffff8881001b0f60
d_revalidate fs/namei.c:858 [inline]
lookup_fast+0x20c/0x520 fs/namei.c:-1
walk_component fs/namei.c:2001 [inline]
link_path_walk+0x608/0xeb0 fs/namei.c:2332
path_lookupat+0x8d/0x430 fs/namei.c:2485
filename_lookup+0x229/0x580 fs/namei.c:2515
vfs_statx+0x11b/0x6b0 fs/stat.c:229
vfs_fstatat fs/stat.c:267 [inline]
__do_sys_newfstatat fs/stat.c:437 [inline]
__se_sys_newfstatat+0x142/0x440 fs/stat.c:431
__x64_sys_newfstatat+0x9b/0xb0 fs/stat.c:431
x64_sys_call+0x77c/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:263
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9aa0b11b0a
Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7
RSP: 002b:00007ffdcbf76388 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 00007ffdcbf76820 RCX: 00007f9aa0b11b0a
RDX: 00007ffdcbf76390 RSI: 00007ffdcbf76820 RDI: 00000000ffffff9c
RBP: 0000563a7b1402c0 R08: 0000000000000000 R09: 0000000000000020
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcbf76420
R13: 00007ffdcbf76c55 R14: 0000563a670b2ca4 R15: 0000563a670b2bcc
================================================================================
aiptek 4-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
0: 4c 89 e7 mov %r12,%rdi
3: e8 85 b2 d5 ff call 0xffd5b28d
8: 4d 8b 24 24 mov (%r12),%r12
c: 4d 39 e6 cmp %r12,%r14
f: 74 0a je 0x1b
11: e8 97 27 90 ff call 0xff9027ad
16: 4d 89 fe mov %r15,%r14
19: eb 76 jmp 0x91
1b: 4c 89 75 c8 mov %r14,-0x38(%rbp)
1f: 4c 89 e9 mov %r13,%rcx
22: 48 8b 45 d0 mov -0x30(%rbp),%rax
26: 4c 8d 68 28 lea 0x28(%rax),%r13
* 2a: 4c 89 e8 mov %r13,%rax <-- trapping instruction
2d: 48 c1 e8 03 shr $0x3,%rax
31: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1)
35: 4d 89 fe mov %r15,%r14
38: 74 08 je 0x42
3a: 4c 89 ef mov %r13,%rdi
3d: e8 .byte 0xe8
3e: 4b rex.WXB
3f: b2 .byte 0xb2