gb_hid_set_report() sizes its request payload as sizeof(*request) + len - 1, but report[] in struct gb_hid_set_report_request is a flexible array member that sizeof() already excludes. The buffer is therefore one byte too small, so memcpy(request->report, buf, len) writes one byte past its end, which KASAN reports as a slab-out-of-bounds write. Drop the stray - 1 so the allocation covers the whole report.
Closes: https://lore.kernel.org/all/CA+0ovCgLrz4WhPKP5LGW5HZa8VOodgeo6pWuyQGgHE7UY57... Signed-off-by: Farhad Alemi farhad.alemi@berkeley.edu --- The device was emulated.
--- a/drivers/staging/greybus/hid.c +++ b/drivers/staging/greybus/hid.c @@ -97,7 +97,8 @@ static int gb_hid_set_report(struct gb_hid *ghid, u8 report_type, u8 report_id, { struct gb_hid_set_report_request *request; struct gb_operation *operation; - int ret, size = sizeof(*request) + len - 1; + /* report[] is a flexible array, so sizeof() already excludes it. */ + int ret, size = sizeof(*request) + len;
ret = gb_pm_runtime_get_sync(ghid->bundle); if (ret)