================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:724:31
index 59 is out of range for type 'const int[34]'
CPU: 0 PID: 307 Comm: kworker/0:2 Tainted: G S W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events kfree_rcu_work
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x210e/0x29b0 drivers/input/tablet/aiptek.c:724
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1758
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x398/0x890 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:__stack_depot_save+0x1cd/0x490 lib/stackdepot.c:513
Code: 4d 85 ed 74 09 b8 ff ff ff 07 41 23 45 10 65 48 8b 0c 25 28 00 00 00 48 3b 4d d0 0f 85 26 02 00 00 c1 e3 1b 09 d8 48 83 c4 38 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 4c 89 55 b0 48 89 4d a8 45 84 c9
RSP: 0018:ffffc9000dc6f858 EFLAGS: 00000282
RAX: 00000000075c0102 RBX: 0000000000000000 RCX: 704ba70093ee7d00
RDX: 000000000000000b RSI: 000000000000000b RDI: ffffffff810046bf
RBP: ffffc9000dc6f880 R08: 0000000000000800 R09: 0000000000000001
R10: ffff8881f5a00000 R11: 00000000ba2fbd58 R12: 0000000000042a3e
R13: ffff8881100535c0 R14: ffffc9000dc6f890 R15: 0000000097a42a3e
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_set_track+0x60/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0x132/0x180 mm/kasan/common.c:242
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:250
kasan_slab_free include/linux/kasan.h:178 [inline]
slab_free_hook mm/slub.c:1750 [inline]
slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776
slab_free mm/slub.c:3712 [inline]
kmem_cache_free_bulk+0x376/0x450 mm/slub.c:3833
kfree_bulk include/linux/slab.h:475 [inline]
kfree_rcu_work+0x22b/0x7a0 kernel/rcu/tree.c:3131
process_one_work+0x717/0xc30 kernel/workqueue.c:2302
worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449
kthread+0x281/0x320 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
================================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:680:38
index 59 is out of range for type 'const int[34]'
CPU: 0 PID: 4138 Comm: syz-executor Tainted: G S W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x22b3/0x29b0 drivers/input/tablet/aiptek.c:680
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1758
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x398/0x890 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:_compound_head include/linux/page-flags.h:261 [inline]
RIP: 0010:PageAnon include/linux/page-flags.h:675 [inline]
RIP: 0010:zap_pte_range mm/memory.c:1465 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1599 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1628 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1649 [inline]
RIP: 0010:unmap_page_range+0x1433/0x2360 mm/memory.c:1670
Code: 8b 1c 24 4d 85 ff 0f 84 8b 06 00 00 4d 8d 67 08 4c 89 e3 48 c1 eb 03 42 80 3c 33 00 74 08 4c 89 e7 e8 d1 e0 0b 00 4d 8b 2c 24 <44> 89 ee 83 e6 01 31 ff e8 d0 5a c6 ff 41 f6 c5 01 0f 85 6a 06 00
RSP: 0018:ffffc9000559f3e0 EFLAGS: 00000246
RAX: ffffffff81ab0c21 RBX: 1ffffd4000953401 RCX: ffff88811d1c3cc0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9000559f5b0 R08: ffff88811d1c3cc7 R09: 1ffff11023a38798
R10: dffffc0000000000 R11: ffffed1023a38799 R12: ffffea0004a9a008
R13: 0000000000000000 R14: dffffc0000000000 R15: ffffea0004a9a000
unmap_single_vma mm/memory.c:1716 [inline]
unmap_vmas+0x34c/0x480 mm/memory.c:1756
exit_mmap+0x2a4/0xc10 mm/mmap.c:3371
__mmput+0x92/0x340 kernel/fork.c:1319
mmput+0x4b/0x150 kernel/fork.c:1343
exit_mm kernel/exit.c:569 [inline]
do_exit+0xa51/0x2850 kernel/exit.c:874
do_group_exit+0x21b/0x2e0 kernel/exit.c:1030
get_signal+0x167c/0x1700 kernel/signal.c:2895
arch_do_signal_or_restart+0xd1/0x11c0 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff6e1559257
Code: Unable to access opcode bytes at 0x7ff6e155922d.
RSP: 002b:00007ffcccac9220 EFLAGS: 00000202 ORIG_RAX: 000000000000003d
RAX: fffffffffffffe00 RBX: 0000555578bee500 RCX: 00007ff6e1559257
RDX: 0000000040000000 RSI: 00007ffcccac927c RDI: ffffffffffffffff
RBP: 00007ffcccac927c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffcccac94d8 R15: 0000000000000000
================================================================================
aiptek 6-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
0: 4d 85 ed test %r13,%r13
3: 74 09 je 0xe
5: b8 ff ff ff 07 mov $0x7ffffff,%eax
a: 41 23 45 10 and 0x10(%r13),%eax
e: 65 48 8b 0c 25 28 00 mov %gs:0x28,%rcx
15: 00 00
17: 48 3b 4d d0 cmp -0x30(%rbp),%rcx
1b: 0f 85 26 02 00 00 jne 0x247
21: c1 e3 1b shl $0x1b,%ebx
24: 09 d8 or %ebx,%eax
26: 48 83 c4 38 add $0x38,%rsp
* 2a: 5b pop %rbx <-- trapping instruction
2b: 41 5c pop %r12
2d: 41 5d pop %r13
2f: 41 5e pop %r14
31: 41 5f pop %r15
33: 5d pop %rbp
34: c3 ret
35: 4c 89 55 b0 mov %r10,-0x50(%rbp)
39: 48 89 4d a8 mov %rcx,-0x58(%rbp)
3d: 45 84 c9 test %r9b,%r9b