[PATCH] staging: greybus: hid: fix off-by-one in SET_REPORT allocation

gb_hid_set_report() sizes its request payload as sizeof(*request) + len -
1, but report[] in struct gb_hid_set_report_request is a flexible array
member that sizeof() already excludes. The buffer is therefore one byte too
small, so memcpy(request->report, buf, len) writes one byte past its end,
which KASAN reports as a slab-out-of-bounds write. Drop the stray - 1 so
the allocation covers the whole report.

Closes: https://lore.kernel.org/all/CA+0ovCgLrz4WhPKP5LGW5HZa8VOodgeo6pWuyQGgHE7UY57Oog@mail.gmail.com/ (local)
Signed-off-by: Farhad Alemi <redacted>
---
The device was emulated.

--- a/drivers/staging/greybus/hid.c
+++ b/drivers/staging/greybus/hid.c

@@ -97,7 +97,8 @@ static int gb_hid_set_report(struct gb_hid *ghid, u8

report_type, u8 report_id,
 {
 	struct gb_hid_set_report_request *request;
 	struct gb_operation *operation;
-	int ret, size = sizeof(*request) + len - 1;
+	/* report[] is a flexible array, so sizeof() already excludes it. */
+	int ret, size = sizeof(*request) + len;

 	ret = gb_pm_runtime_get_sync(ghid->bundle);
 	if (ret)