================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 20872 is out of range for type 'const int[34]'
CPU: 1 PID: 5848 Comm: kworker/1:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <IRQ>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:217
 __ubsan_handle_out_of_bounds+0xe3/0xf0 lib/ubsan.c:348
 aiptek_irq+0x1eb8/0x2920 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1648
 dummy_timer+0xa40/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2003
 __run_hrtimer kernel/time/hrtimer.c:1754 [inline]
 __hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
 hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:check_kcov_mode kernel/kcov.c:184 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:245 [inline]
RIP: 0010:__sanitizer_cov_trace_switch+0x89/0xe0 kernel/kcov.c:350
Code: 77 4e 8b 54 ce 10 65 44 8b 1d cb cd 7c 7e 41 81 e3 00 01 ff 00 74 13 41 81 fb 00 01 00 00 75 d9 41 83 b8 1c 16 00 00 00 74 cf <45> 8b 98 f8 15 00 00 41 83 fb 03 75 c2 4d 8b 98 00 16 00 00 45 8b
RSP: 0018:ffffc9000490ec50 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffffffff8f0ee3b2 RCX: 0000000000000003
RDX: ffffffff813b2a28 RSI: ffffffff8cfa05a0 RDI: 0000000000000002
RBP: ffffc9000490ed98 R08: ffff88802df53c00 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8f0ee3b7
R13: ffffc9000490ed48 R14: 0000000000000002 R15: dffffc0000000000
 unwind_next_frame+0x658/0x2990 arch/x86/kernel/unwind_orc.c:505
 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:164 [inline]
 slab_free_hook mm/slub.c:1811 [inline]
 slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837
 slab_free mm/slub.c:3830 [inline]
 __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843
 dvb_media_device_free+0x1d6/0x510 drivers/media/dvb-core/dvbdev.c:223
 dvb_remove_device+0x107/0x270 drivers/media/dvb-core/dvbdev.c:607
 dvb_unregister_device+0x18/0xa0 drivers/media/dvb-core/dvbdev.c:637
 dvb_dmxdev_release+0x513/0x6a0 drivers/media/dvb-core/dmxdev.c:1472
 dvb_usb_adapter_dvb_exit+0x93/0x1b0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:224
 dvb_usb_adapter_exit+0x8d/0x240 drivers/media/usb/dvb-usb/dvb-usb-init.c:128
 dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:143 [inline]
 dvb_usb_device_exit+0x1c4/0x340 drivers/media/usb/dvb-usb/dvb-usb-init.c:338
 usb_unbind_interface+0x207/0x870 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:629 [inline]
 __device_release_driver drivers/base/dd.c:1352 [inline]
 device_release_driver_internal+0x458/0x6f0 drivers/base/dd.c:1375
 bus_remove_device+0x43b/0x520 drivers/base/bus.c:624
 device_del+0x51f/0x910 drivers/base/core.c:3889
 usb_disable_device+0x3ee/0x8a0 drivers/usb/core/message.c:1474
 usb_disconnect+0x340/0x8a0 drivers/usb/core/hub.c:2315
 hub_port_connect drivers/usb/core/hub.c:5369 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5669 [inline]
 port_event drivers/usb/core/hub.c:5833 [inline]
 hub_event+0x1d69/0x4a80 drivers/usb/core/hub.c:5915
 process_one_work kernel/workqueue.c:2653 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
================================================================================
----------------
Code disassembly (best guess):
   0:	77 4e                	ja     0x50
   2:	8b 54 ce 10          	mov    0x10(%rsi,%rcx,8),%edx
   6:	65 44 8b 1d cb cd 7c 	mov    %gs:0x7e7ccdcb(%rip),%r11d        # 0x7e7ccdd9
   d:	7e
   e:	41 81 e3 00 01 ff 00 	and    $0xff0100,%r11d
  15:	74 13                	je     0x2a
  17:	41 81 fb 00 01 00 00 	cmp    $0x100,%r11d
  1e:	75 d9                	jne    0xfffffff9
  20:	41 83 b8 1c 16 00 00 	cmpl   $0x0,0x161c(%r8)
  27:	00
  28:	74 cf                	je     0xfffffff9
* 2a:	45 8b 98 f8 15 00 00 	mov    0x15f8(%r8),%r11d <-- trapping instruction
  31:	41 83 fb 03          	cmp    $0x3,%r11d
  35:	75 c2                	jne    0xfffffff9
  37:	4d 8b 98 00 16 00 00 	mov    0x1600(%r8),%r11
  3e:	45                   	rex.RB
  3f:	8b                   	.byte 0x8b