Re: [PATCH] staging: greybus: hid: fix off-by-one in SET_REPORT allocation

[Greg KH]

On Thu, Sep 10, 2026 at 09:32:47PM +0000, Farhad Alemi wrote:
> gb_hid_set_report() sizes its request payload as sizeof(*request) + len -
> 1, but report[] in struct gb_hid_set_report_request is a flexible array
> member that sizeof() already excludes. The buffer is therefore one byte too
> small, so memcpy(request->report, buf, len) writes one byte past its end,
> which KASAN reports as a slab-out-of-bounds write. Drop the stray - 1 so
> the allocation covers the whole report.
> 
> Closes: https://lore.kernel.org/all/CA+0ovCgLrz4WhPKP5LGW5HZa8VOodgeo6pWuyQGgHE7UY57Oog@xxxxxxxxxxxxxx/
> Signed-off-by: Farhad Alemi <farhad.alemi@xxxxxxxxxxxx>

Did you forget an Assisted-by: tag?

> ---
> The device was emulated.

emulated how?

thanks,

greg k-h