================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 6691 is out of range for type 'const int[34]'
CPU: 0 PID: 1826 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:217
 __ubsan_handle_out_of_bounds+0xe3/0xf0 lib/ubsan.c:348
 aiptek_irq+0x1eb8/0x2920 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1648
 dummy_timer+0xa58/0x34e0 drivers/usb/gadget/udc/dummy_hcd.c:2017
 __run_hrtimer kernel/time/hrtimer.c:1754 [inline]
 __hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
 hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__sanitizer_cov_trace_switch+0x4/0xe0 kernel/kcov.c:326
Code: 28 4d 39 ca 77 1e 49 ff c0 4c 89 02 48 c7 44 0a 08 07 00 00 00 48 89 7c 0a 10 48 89 74 0a 18 48 89 44 0a 20 c3 90 f3 0f 1e fa <48> 8b 46 08 48 8d 48 ff 48 89 c2 48 31 ca 48 39 ca 0f 86 c3 00 00
RSP: 0018:ffffc9000bb4f110 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffffffff8f1cca4d RCX: ffff8880281d1e00
RDX: 0000000000000000 RSI: ffffffff8cfa0950 RDI: 0000000000000002
RBP: ffffc9000bb4f9a0 R08: ffff8880281d1e00 R09: 0000000000000008
R10: 0000000000000009 R11: 0000000000000000 R12: ffffffff8f1cca4c
R13: ffffc9000bb4f1e8 R14: 0000000000000002 R15: dffffc0000000000
 unwind_next_frame+0xe42/0x2990 arch/x86/kernel/unwind_orc.c:581
 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:198 [inline]
 __do_kmalloc_node mm/slab_common.c:1007 [inline]
 __kmalloc+0xb7/0x240 mm/slab_common.c:1020
 kmalloc include/linux/slab.h:604 [inline]
 kzalloc include/linux/slab.h:721 [inline]
 tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
 tomoyo_encode+0x2ad/0x570 security/tomoyo/realpath.c:80
 tomoyo_realpath_from_path+0x57c/0x5c0 security/tomoyo/realpath.c:283
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_check_open_permission+0x224/0x460 security/tomoyo/file.c:771
 security_file_open+0x62/0xa0 security/security.c:2968
 do_dentry_open+0x32b/0x14b0 fs/open.c:916
 do_open fs/namei.c:3683 [inline]
 path_openat+0x284f/0x3270 fs/namei.c:3844
 do_filp_open+0x1f2/0x430 fs/namei.c:3871
 do_sys_openat2+0x134/0x1d0 fs/open.c:1422
 do_sys_open fs/open.c:1437 [inline]
 __do_sys_openat fs/open.c:1453 [inline]
 __se_sys_openat fs/open.c:1448 [inline]
 __x64_sys_openat+0x139/0x160 fs/open.c:1448
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f33928a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffc73993fe0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f339302f880 RCX: 00007f33928a7407
RDX: 0000000000080000 RSI: 00007ffc73994160 RDI: ffffffffffffff9c
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000055daa23177f5
R13: 000055daa23177f5 R14: 0000000000000001 R15: 000055daa2332140
 </TASK>
================================================================================
----------------
Code disassembly (best guess):
   0:	28 4d 39             	sub    %cl,0x39(%rbp)
   3:	ca 77 1e             	lret   $0x1e77
   6:	49 ff c0             	inc    %r8
   9:	4c 89 02             	mov    %r8,(%rdx)
   c:	48 c7 44 0a 08 07 00 	movq   $0x7,0x8(%rdx,%rcx,1)
  13:	00 00
  15:	48 89 7c 0a 10       	mov    %rdi,0x10(%rdx,%rcx,1)
  1a:	48 89 74 0a 18       	mov    %rsi,0x18(%rdx,%rcx,1)
  1f:	48 89 44 0a 20       	mov    %rax,0x20(%rdx,%rcx,1)
  24:	c3                   	ret
  25:	90                   	nop
  26:	f3 0f 1e fa          	endbr64
* 2a:	48 8b 46 08          	mov    0x8(%rsi),%rax <-- trapping instruction
  2e:	48 8d 48 ff          	lea    -0x1(%rax),%rcx
  32:	48 89 c2             	mov    %rax,%rdx
  35:	48 31 ca             	xor    %rcx,%rdx
  38:	48 39 ca             	cmp    %rcx,%rdx
  3b:	0f                   	.byte 0xf
  3c:	86 c3                	xchg   %al,%bl