================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 20872 is out of range for type 'const int[34]'
CPU: 0 PID: 4321 Comm: kworker/0:7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
 aiptek_irq+0x1e87/0x28f0 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1673
 dummy_timer+0xa21/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:___slab_alloc+0x1070/0x1240 mm/slub.c:3219
Code: 48 c7 44 24 70 00 00 00 00 9c 8f 44 24 70 f7 44 24 70 00 02 00 00 75 77 f7 c5 00 02 00 00 74 01 fb 65 48 8b 04 25 28 00 00 00 <48> 3b 44 24 78 0f 85 ec 00 00 00 4c 89 f8 48 81 c4 80 00 00 00 5b
RSP: 0018:ffffc90004536b48 EFLAGS: 00000206
RAX: 7e3396bf94e3de00 RBX: ffff8880b8e44620 RCX: 7e3396bf94e3de00
RDX: dffffc0000000000 RSI: ffffffff8a8c17a0 RDI: ffffffff8adee1a0
RBP: 0000000000000246 R08: ffffffff90af2267 R09: 1ffffffff215e44c
R10: dffffc0000000000 R11: fffffbfff215e44d R12: ffff8880b8e44620
R13: ffff8880b8e44600 R14: 0000000000000000 R15: ffff8880196cd000
 __slab_alloc mm/slub.c:3240 [inline]
 slab_alloc_node mm/slub.c:3325 [inline]
 kmem_cache_alloc_node+0x134/0x310 mm/slub.c:3404
 __alloc_skb+0xf9/0x7d0 net/core/skbuff.c:505
 alloc_skb include/linux/skbuff.h:1303 [inline]
 alloc_uevent_skb+0x7d/0x230 lib/kobject_uevent.c:290
 uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline]
 kobject_uevent_net_broadcast+0x2e6/0x530 lib/kobject_uevent.c:409
 kobject_uevent_env+0x555/0x890 lib/kobject_uevent.c:608
 device_add+0xac2/0x1050 drivers/base/core.c:3678
 cdev_device_add+0x19d/0x340 fs/char_dev.c:549
 evdev_connect+0x350/0x3f0 drivers/input/evdev.c:1386
 input_attach_handler drivers/input/input.c:1060 [inline]
 input_register_device+0xd91/0x12d0 drivers/input/input.c:2470
 aiptek_probe+0x14a1/0x1ba0 drivers/input/tablet/aiptek.c:1845
 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:639
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:805
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:835
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:963
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1035
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:639
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:805
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:835
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:963
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1035
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2659
 hub_port_connect drivers/usb/core/hub.c:5517 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5899
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 process_scheduled_works kernel/workqueue.c:2355 [inline]
 worker_thread+0xd6e/0x12a0 kernel/workqueue.c:2441
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
================================================================================
----------------
Code disassembly (best guess):
   0:	48 c7 44 24 70 00 00 	movq   $0x0,0x70(%rsp)
   7:	00 00
   9:	9c                   	pushf
   a:	8f 44 24 70          	pop    0x70(%rsp)
   e:	f7 44 24 70 00 02 00 	testl  $0x200,0x70(%rsp)
  15:	00
  16:	75 77                	jne    0x8f
  18:	f7 c5 00 02 00 00    	test   $0x200,%ebp
  1e:	74 01                	je     0x21
  20:	fb                   	sti
  21:	65 48 8b 04 25 28 00 	mov    %gs:0x28,%rax
  28:	00 00
* 2a:	48 3b 44 24 78       	cmp    0x78(%rsp),%rax <-- trapping instruction
  2f:	0f 85 ec 00 00 00    	jne    0x121
  35:	4c 89 f8             	mov    %r15,%rax
  38:	48 81 c4 80 00 00 00 	add    $0x80,%rsp
  3f:	5b                   	pop    %rbx