[greybus-dev] Re: [PATCH] staging: greybus: hid: fix off-by-one in SET_REPORT allocation

On Thu, Sep 10, 2026 at 09:32:47PM +0000, Farhad Alemi wrote:

gb_hid_set_report() sizes its request payload as sizeof(*request) + len - 1, but report[] in struct gb_hid_set_report_request is a flexible array member that sizeof() already excludes. The buffer is therefore one byte too small, so memcpy(request->report, buf, len) writes one byte past its end, which KASAN reports as a slab-out-of-bounds write. Drop the stray - 1 so the allocation covers the whole report.

Closes: https://lore.kernel.org/all/CA+0ovCgLrz4WhPKP5LGW5HZa8VOodgeo6pWuyQGgHE7UY57... Signed-off-by: Farhad Alemi farhad.alemi@berkeley.edu

Did you forget an Assisted-by: tag?

---

The device was emulated.

emulated how?

thanks,

greg k-h