Re: [PATCH v5] Input: gunze: replace deprecated APIs and fix warning style

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Off-by-one buffer overflow when NUL-terminating the receive buffer corrupts the device physical path.
- [High] Early return on coordinate parsing failure drops malformed release packets, permanently sticking the touch state.
--

--- Patch [1]: [PATCH v5] Input: gunze: replace deprecated APIs and fix warning style ---
commit e46d9a0baa3ae281ee5b9c02aad4e7f63a5cf33f
Author: Bivash Kumar Singh <bivashraj750@gmail.com>

Input: gunze: replace deprecated APIs and fix warning style

This commit updates the driver to use dev_warn_ratelimited() instead of
printk() and replaces simple_strtoul() with sscanf() for parsing coordinate
data. It also NUL-terminates the receive buffer to allow safe string parsing.

> diff --git a/drivers/input/touchscreen/gunze.c b/drivers/input/touchscreen/gunze.c
> index 2baeb4f3b941c..7a92052eba805 100644
> --- a/drivers/input/touchscreen/gunze.c
> +++ b/drivers/input/touchscreen/gunze.c
> @@ -41,15 +41,20 @@ struct gunze {
>  static void gunze_process_packet(struct gunze *gunze)
>  {
>  	struct input_dev *dev = gunze->dev;
> +	unsigned int x, y;
>  
> -	if (gunze->idx != GUNZE_MAX_LENGTH || gunze->data[5] != ',' ||
> -		(gunze->data[0] != 'T' && gunze->data[0] != 'R')) {
> -		printk(KERN_WARNING "gunze.c: bad packet: >%.*s<\n", GUNZE_MAX_LENGTH, gunze->data);
> +	if (gunze->data[0] != 'T' && gunze->data[0] != 'R') {
> +		dev_warn_ratelimited(&gunze->serio->dev, "bad packet: >%s<\n", gunze->data);
>  		return;
>  	}
>  
> -	input_report_abs(dev, ABS_X, simple_strtoul(gunze->data + 1, NULL, 10));
> -	input_report_abs(dev, ABS_Y, 1024 - simple_strtoul(gunze->data + 6, NULL, 10));
> +	if (sscanf(gunze->data + 1, "%4u,%4u", &x, &y) != 2) {
> +		dev_warn_ratelimited(&gunze->serio->dev, "bad packet: >%s<\n", gunze->data);
> +		return;
> +	}

[Severity: High]
Does this early return risk leaving the touch state permanently stuck?

If a release packet (starting with 'R') is received but the coordinate data
contains noise causing sscanf() to fail, this will return early and skip the
input_report_key() call below, dropping the release event.

> +
> +	input_report_abs(dev, ABS_X, x);
> +	input_report_abs(dev, ABS_Y, 1024 - y);
>  	input_report_key(dev, BTN_TOUCH, gunze->data[0] == 'T');
>  	input_sync(dev);
>  }
> @@ -60,6 +65,7 @@ static irqreturn_t gunze_interrupt(struct serio *serio,
>  	struct gunze *gunze = serio_get_drvdata(serio);
>  
>  	if (data == '\r') {
> +		gunze->data[gunze->idx] = '\0';

[Severity: High]
Can this write past the end of the data array and corrupt the physical path?

The data array in struct gunze is sized exactly to GUNZE_MAX_LENGTH (10):

struct gunze {
	...
	unsigned char data[GUNZE_MAX_LENGTH];
	char phys[32];
};

When a full-length valid touch packet is received followed by a '\r',
gunze->idx will be 10. Writing '\0' at this index will write out of bounds
and overwrite the adjacent phys array. Could the array size be increased to
accommodate the NUL terminator?

>  		gunze_process_packet(gunze);
>  		gunze->idx = 0;
>  	} else {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720032407.4644-1-bivashraj750@gmail.com?part=1