Re: [PATCH] staging: greybus: hid: fix off-by-one in SET_REPORT allocation

On Thu, Sep 10, 2026 at 09:32:47PM +0000, Farhad Alemi wrote:

gb_hid_set_report() sizes its request payload as sizeof(*request) + len -
1, but report[] in struct gb_hid_set_report_request is a flexible array
member that sizeof() already excludes. The buffer is therefore one byte too
small, so memcpy(request->report, buf, len) writes one byte past its end,
which KASAN reports as a slab-out-of-bounds write. Drop the stray - 1 so
the allocation covers the whole report.

Closes: https://lore.kernel.org/all/CA+0ovCgLrz4WhPKP5LGW5HZa8VOodgeo6pWuyQGgHE7UY57Oog@mail.gmail.com/ (local)
Signed-off-by: Farhad Alemi <redacted>

Did you forget an Assisted-by: tag?

---
The device was emulated.

emulated how?

thanks,

greg k-h