================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 21762 is out of range for type 'const int[34]'
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 ubsan_epilogue+0x14/0x48 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:282
 aiptek_irq+0x19a0/0x2360 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x2ec/0x50c drivers/usb/core/hcd.c:1673
 usb_hcd_giveback_urb+0x100/0x3a4 drivers/usb/core/hcd.c:1756
 dummy_timer+0x7e4/0x29b0 drivers/usb/gadget/udc/dummy_hcd.c:2018
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x444/0xc58 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x164/0x408 kernel/time/hrtimer.c:1832
 handle_softirqs+0x318/0xc90 kernel/softirq.c:596
 run_ksoftirqd+0x7c/0x2ac kernel/softirq.c:968
 smpboot_thread_fn+0x4e8/0x960 kernel/smpboot.c:164
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
================================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in aiptek_irq+0x19bc/0x2360 drivers/input/tablet/aiptek.c:741
Read of size 4 at addr ffff8000131a6548 by task ksoftirqd/0/15

CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350
 aiptek_irq+0x19bc/0x2360 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x2ec/0x50c drivers/usb/core/hcd.c:1673
 usb_hcd_giveback_urb+0x100/0x3a4 drivers/usb/core/hcd.c:1756
 dummy_timer+0x7e4/0x29b0 drivers/usb/gadget/udc/dummy_hcd.c:2018
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x444/0xc58 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x164/0x408 kernel/time/hrtimer.c:1832
 handle_softirqs+0x318/0xc90 kernel/softirq.c:596
 run_ksoftirqd+0x7c/0x2ac kernel/softirq.c:968
 smpboot_thread_fn+0x4e8/0x960 kernel/smpboot.c:164
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

The buggy address belongs to the variable:
 .str.48+0x28/0x60

The buggy address belongs to a 0-page vmalloc region starting at 0xffff800011ca0000 allocated at map_kernel+0x110/0x360 arch/arm64/mm/mmu.c:786
The buggy address belongs to the physical page:
page:00000000fc121523 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20bfa6
flags: 0x5ffc00000001000(reserved|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000001000 fffffc00072fe988 fffffc00072fe988 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8000131a6400: 06 f9 f9 f9 f9 f9 f9 f9 00 02 f9 f9 00 00 00 00
 ffff8000131a6480: 06 f9 f9 f9 f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9
>ffff8000131a6500: 00 05 f9 f9 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9
                                              ^
 ffff8000131a6580: 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 00 00 00 00
 ffff8000131a6600: f9 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 00 00 00 00
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30
index 21763 is out of range for type 'const int[34]'
CPU: 0 PID: 15 Comm: ksoftirqd/0 Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 ubsan_epilogue+0x14/0x48 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:282
 aiptek_irq+0x186c/0x2360 drivers/input/tablet/aiptek.c:763
 __usb_hcd_giveback_urb+0x2ec/0x50c drivers/usb/core/hcd.c:1673
 usb_hcd_giveback_urb+0x100/0x3a4 drivers/usb/core/hcd.c:1756
 dummy_timer+0x7e4/0x29b0 drivers/usb/gadget/udc/dummy_hcd.c:2018
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x444/0xc58 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x164/0x408 kernel/time/hrtimer.c:1832
 handle_softirqs+0x318/0xc90 kernel/softirq.c:596
 run_ksoftirqd+0x7c/0x2ac kernel/softirq.c:968
 smpboot_thread_fn+0x4e8/0x960 kernel/smpboot.c:164
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
================================================================================
aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19