================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 771 is out of range for type 'const int[34]'
CPU: 0 PID: 289 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x2045/0x29b0 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1758
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x398/0x890 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:update_stack_state+0x418/0x490 arch/x86/kernel/unwind_frame.c:257
Code: 48 8b 5d d0 48 83 c3 48 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 54 44 81 00 4c 89 33 43 80 3c 2c 00 48 8b 5d c8 <74> 08 48 89 df e8 4e 43 81 00 b0 01 48 83 3b 00 0f 85 82 fe ff ff
RSP: 0018:ffffc9000bb47708 EFLAGS: 00000246
RAX: 1ffff92001768f0e RBX: ffffc9000bb47868 RCX: ffffc9000bb47901
RDX: ffffc9000bb47960 RSI: 1ffff92001768f06 RDI: ffffc9000bb47850
RBP: ffffc9000bb477b8 R08: ffffc9000bb478f0 R09: ffffc9000bb478e8
R10: 0000000000000000 R11: fffff52001768f11 R12: 1ffff92001768f0d
R13: dffffc0000000000 R14: ffffffff81b6b32b R15: ffffc9000bb47880
unwind_next_frame+0x39e/0x660 arch/x86/kernel/unwind_frame.c:315
arch_stack_walk+0x124/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505
____kasan_kmalloc mm/kasan/common.c:380 [inline]
__kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389
kasan_kmalloc include/linux/kasan.h:212 [inline]
kmalloc_trace+0x40/0xb0 mm/slab_common.c:1033
kmalloc include/linux/slab.h:563 [inline]
kzalloc include/linux/slab.h:699 [inline]
ref_tracker_alloc+0x16b/0x4a0 lib/ref_tracker.c:85
netns_tracker_alloc include/net/net_namespace.h:357 [inline]
get_net_track include/net/net_namespace.h:373 [inline]
sk_alloc+0x1cb/0x460 net/core/sock.c:2126
inet_create+0x5af/0xef0 net/ipv4/af_inet.c:320
__sock_create+0x39e/0x7c0 net/socket.c:1539
sock_create net/socket.c:1595 [inline]
__sys_socket_create net/socket.c:1632 [inline]
__sys_socket+0xcd/0x1a0 net/socket.c:1660
__do_sys_socket net/socket.c:1673 [inline]
__se_sys_socket net/socket.c:1671 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1671
x64_sys_call+0x449/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:42
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc804f9e6c7
Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd4a8b7548 EFLAGS: 00000206 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc804f9e6c7
RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 00007ffd4a8b7c7c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 00007fc8051eafc0
R13: 00000000000927c0 R14: 0000000000007c32 R15: 00007fc8051ed180
================================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 772 is out of range for type 'const int[34]'
CPU: 0 PID: 289 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack+0x21/0x24 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x24 lib/dump_stack.c:113
ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
__ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
aiptek_irq+0x1f14/0x29b0 drivers/input/tablet/aiptek.c:763
__usb_hcd_giveback_urb+0x360/0x520 drivers/usb/core/hcd.c:1675
usb_hcd_giveback_urb+0x11f/0x3e0 drivers/usb/core/hcd.c:1758
dummy_timer+0xa25/0x3270 drivers/usb/gadget/udc/dummy_hcd.c:2004
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x398/0x890 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x19b/0x260 kernel/time/hrtimer.c:1766
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:update_stack_state+0x418/0x490 arch/x86/kernel/unwind_frame.c:257
Code: 48 8b 5d d0 48 83 c3 48 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 54 44 81 00 4c 89 33 43 80 3c 2c 00 48 8b 5d c8 <74> 08 48 89 df e8 4e 43 81 00 b0 01 48 83 3b 00 0f 85 82 fe ff ff
RSP: 0018:ffffc9000bb47708 EFLAGS: 00000246
RAX: 1ffff92001768f0e RBX: ffffc9000bb47868 RCX: ffffc9000bb47901
RDX: ffffc9000bb47960 RSI: 1ffff92001768f06 RDI: ffffc9000bb47850
RBP: ffffc9000bb477b8 R08: ffffc9000bb478f0 R09: ffffc9000bb478e8
R10: 0000000000000000 R11: fffff52001768f11 R12: 1ffff92001768f0d
R13: dffffc0000000000 R14: ffffffff81b6b32b R15: ffffc9000bb47880
unwind_next_frame+0x39e/0x660 arch/x86/kernel/unwind_frame.c:315
arch_stack_walk+0x124/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505
____kasan_kmalloc mm/kasan/common.c:380 [inline]
__kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389
kasan_kmalloc include/linux/kasan.h:212 [inline]
kmalloc_trace+0x40/0xb0 mm/slab_common.c:1033
kmalloc include/linux/slab.h:563 [inline]
kzalloc include/linux/slab.h:699 [inline]
ref_tracker_alloc+0x16b/0x4a0 lib/ref_tracker.c:85
netns_tracker_alloc include/net/net_namespace.h:357 [inline]
get_net_track include/net/net_namespace.h:373 [inline]
sk_alloc+0x1cb/0x460 net/core/sock.c:2126
inet_create+0x5af/0xef0 net/ipv4/af_inet.c:320
__sock_create+0x39e/0x7c0 net/socket.c:1539
sock_create net/socket.c:1595 [inline]
__sys_socket_create net/socket.c:1632 [inline]
__sys_socket+0xcd/0x1a0 net/socket.c:1660
__do_sys_socket net/socket.c:1673 [inline]
__se_sys_socket net/socket.c:1671 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1671
x64_sys_call+0x449/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:42
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc804f9e6c7
Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd4a8b7548 EFLAGS: 00000206 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc804f9e6c7
RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 00007ffd4a8b7c7c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 00007fc8051eafc0
R13: 00000000000927c0 R14: 0000000000007c32 R15: 00007fc8051ed180
================================================================================
aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
----------------
Code disassembly (best guess):
0: 48 8b 5d d0 mov -0x30(%rbp),%rbx
4: 48 83 c3 48 add $0x48,%rbx
8: 48 89 d8 mov %rbx,%rax
b: 48 c1 e8 03 shr $0x3,%rax
f: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
14: 74 08 je 0x1e
16: 48 89 df mov %rbx,%rdi
19: e8 54 44 81 00 call 0x814472
1e: 4c 89 33 mov %r14,(%rbx)
21: 43 80 3c 2c 00 cmpb $0x0,(%r12,%r13,1)
26: 48 8b 5d c8 mov -0x38(%rbp),%rbx
* 2a: 74 08 je 0x34 <-- trapping instruction
2c: 48 89 df mov %rbx,%rdi
2f: e8 4e 43 81 00 call 0x814382
34: b0 01 mov $0x1,%al
36: 48 83 3b 00 cmpq $0x0,(%rbx)
3a: 0f 85 82 fe ff ff jne 0xfffffec2