================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 2367 is out of range for type 'const int[34]'
CPU: 0 PID: 4553 Comm: kworker/u4:9 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: bat_events batadv_nc_worker
Call Trace:
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
ubsan_epilogue+0xa/0x30 lib/ubsan.c:217
__ubsan_handle_out_of_bounds+0xe3/0xf0 lib/ubsan.c:348
aiptek_irq+0x1eb8/0x2920 drivers/input/tablet/aiptek.c:741
__usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1648
dummy_timer+0xa40/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2003
__run_hrtimer kernel/time/hrtimer.c:1754 [inline]
__hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:kasan_check_range+0x1c2/0x290 mm/kasan/generic.c:-1
Code: 5c 24 07 4d 85 e4 49 0f 49 dc 48 83 e3 f8 49 29 dc 74 0e 41 80 3b 00 75 6b 49 ff c3 49 ff cc 75 f2 5b 41 5c 41 5d 41 5e 41 5f <5d> c3 45 84 ff 0f 85 91 00 00 00 41 f7 c7 00 ff 00 00 0f 85 89 00
RSP: 0018:ffffc9000eec7a30 EFLAGS: 00000256
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff81680367
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e8c6b28
RBP: ffffc9000eec7b48 R08: ffffffff8e8c6b2f R09: 1ffffffff1d18d65
R10: dffffc0000000000 R11: fffffbfff1d18d66 R12: 1ffff92001dd8f54
R13: ffffffff8d131da0 R14: 0000000000000000 R15: dffffc0000000000
instrument_atomic_read include/linux/instrumented.h:68 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
cpumask_test_cpu include/linux/cpumask.h:504 [inline]
cpu_online include/linux/cpumask.h:1082 [inline]
trace_lock_acquire include/trace/events/lock.h:24 [inline]
lock_acquire+0xb7/0x420 kernel/locking/lockdep.c:5725
rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
rcu_read_lock include/linux/rcupdate.h:786 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
batadv_nc_worker+0xef/0x600 net/batman-adv/network-coding.c:719
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
================================================================================
----------------
Code disassembly (best guess):
0: 5c pop %rsp
1: 24 07 and $0x7,%al
3: 4d 85 e4 test %r12,%r12
6: 49 0f 49 dc cmovns %r12,%rbx
a: 48 83 e3 f8 and $0xfffffffffffffff8,%rbx
e: 49 29 dc sub %rbx,%r12
11: 74 0e je 0x21
13: 41 80 3b 00 cmpb $0x0,(%r11)
17: 75 6b jne 0x84
19: 49 ff c3 inc %r11
1c: 49 ff cc dec %r12
1f: 75 f2 jne 0x13
21: 5b pop %rbx
22: 41 5c pop %r12
24: 41 5d pop %r13
26: 41 5e pop %r14
28: 41 5f pop %r15
* 2a: 5d pop %rbp <-- trapping instruction
2b: c3 ret
2c: 45 84 ff test %r15b,%r15b
2f: 0f 85 91 00 00 00 jne 0xc6
35: 41 f7 c7 00 ff 00 00 test $0xff00,%r15d
3c: 0f .byte 0xf
3d: 85 .byte 0x85
3e: 89 00 mov %eax,(%rax)