From: Shihuang Liu <shlomojune6@gmail.com>
To: linux-input@vger.kernel.org, linux-hardening@vger.kernel.org
Cc: Marcus Folkesson <marcus.folkesson@gmail.com>,
Dmitry Torokhov <dmitry.torokhov@gmail.com>,
Ville Syrjala <syrjala@sci.fi>,
Henk Vergonet <Henk.Vergonet@gmail.com>,
Henrik Rydberg <rydberg@bitmath.org>,
linux-kernel@vger.kernel.org,
Shihuang Liu <shlomojune6@gmail.com>
Subject: [PATCH 4/5] Input: tablet - replace strlcat() with strscpy()
Date: Sat, 17 Oct 2026 01:04:10 +0800 [thread overview]
Message-ID: <20261016170411.51025-5-shlomojune6@gmail.com> (raw)
In-Reply-To: <20261016170411.51025-1-shlomojune6@gmail.com>
The acecad, aiptek, hanwang, kbtab and pegasus_notetaker drivers
build the physical path by appending a constant "/input0" suffix
with strlcat() after usb_make_path().
In preparation for removing the deprecated strlcat() API[1],
replace it with strnlen() followed by strscpy() into the remainder
of the buffer, as commit 34b228b739f5 ("HID: usbhid: replace
strlcat with better alternatives") did for the usbhid drivers.
Link: https://github.com/KSPP/linux/issues/370 [1]
Signed-off-by: Shihuang Liu <shlomojune6@gmail.com>
---
drivers/input/tablet/acecad.c | 4 +++-
drivers/input/tablet/aiptek.c | 7 +++++--
drivers/input/tablet/hanwang.c | 4 +++-
drivers/input/tablet/kbtab.c | 4 +++-
drivers/input/tablet/pegasus_notetaker.c | 4 +++-
5 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/drivers/input/tablet/acecad.c b/drivers/input/tablet/acecad.c
index ba79dff21aac8..8fec79c46d4b0 100644
--- a/drivers/input/tablet/acecad.c
+++ b/drivers/input/tablet/acecad.c
@@ -117,6 +117,7 @@ static int usb_acecad_probe(struct usb_interface *intf, const struct usb_device_
struct input_dev *input_dev;
int pipe, maxp;
int err;
+ size_t len;
if (interface->desc.bNumEndpoints != 1)
return -ENODEV;
@@ -161,7 +162,8 @@ static int usb_acecad_probe(struct usb_interface *intf, const struct usb_device_
}
usb_make_path(dev, acecad->phys, sizeof(acecad->phys));
- strlcat(acecad->phys, "/input0", sizeof(acecad->phys));
+ len = strnlen(acecad->phys, sizeof(acecad->phys));
+ strscpy(acecad->phys + len, "/input0", sizeof(acecad->phys) - len);
input_dev->name = acecad->name;
input_dev->phys = acecad->phys;
diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
index 0c1acb9e6b437..e868d0bac771d 100644
--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -1637,6 +1637,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
AIPTEK_PROGRAMMABLE_DELAY_300
};
int err = -ENOMEM;
+ size_t len;
/* programmableDelay is where the command-line specified
* delay is kept. We make it the first element of speeds[],
@@ -1707,8 +1708,10 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
*/
usb_make_path(usbdev, aiptek->features.usbPath,
sizeof(aiptek->features.usbPath));
- strlcat(aiptek->features.usbPath, "/input0",
- sizeof(aiptek->features.usbPath));
+ len = strnlen(aiptek->features.usbPath,
+ sizeof(aiptek->features.usbPath));
+ strscpy(aiptek->features.usbPath + len, "/input0",
+ sizeof(aiptek->features.usbPath) - len);
/* Set up client data, pointers to open and close routines
* for the input device.
diff --git a/drivers/input/tablet/hanwang.c b/drivers/input/tablet/hanwang.c
index fd5a7e761dcc4..a75d10dd2fc7d 100644
--- a/drivers/input/tablet/hanwang.c
+++ b/drivers/input/tablet/hanwang.c
@@ -318,6 +318,7 @@ static int hanwang_probe(struct usb_interface *intf, const struct usb_device_id
struct input_dev *input_dev;
int error;
int i;
+ size_t len;
if (intf->cur_altsetting->desc.bNumEndpoints < 1)
return -ENODEV;
@@ -351,7 +352,8 @@ static int hanwang_probe(struct usb_interface *intf, const struct usb_device_id
hanwang->dev = input_dev;
usb_make_path(dev, hanwang->phys, sizeof(hanwang->phys));
- strlcat(hanwang->phys, "/input0", sizeof(hanwang->phys));
+ len = strnlen(hanwang->phys, sizeof(hanwang->phys));
+ strscpy(hanwang->phys + len, "/input0", sizeof(hanwang->phys) - len);
strscpy(hanwang->name, hanwang->features->name, sizeof(hanwang->name));
input_dev->name = hanwang->name;
diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
index 6ce70c8e2d7cc..79a5e217654b6 100644
--- a/drivers/input/tablet/kbtab.c
+++ b/drivers/input/tablet/kbtab.c
@@ -113,6 +113,7 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
struct kbtab *kbtab;
struct input_dev *input_dev;
int error = -ENOMEM;
+ size_t len;
if (intf->cur_altsetting->desc.bNumEndpoints < 1)
return -ENODEV;
@@ -138,7 +139,8 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
kbtab->dev = input_dev;
usb_make_path(dev, kbtab->phys, sizeof(kbtab->phys));
- strlcat(kbtab->phys, "/input0", sizeof(kbtab->phys));
+ len = strnlen(kbtab->phys, sizeof(kbtab->phys));
+ strscpy(kbtab->phys + len, "/input0", sizeof(kbtab->phys) - len);
input_dev->name = "KB Gear Tablet";
input_dev->phys = kbtab->phys;
diff --git a/drivers/input/tablet/pegasus_notetaker.c b/drivers/input/tablet/pegasus_notetaker.c
index 85390ae423076..679600bd214e4 100644
--- a/drivers/input/tablet/pegasus_notetaker.c
+++ b/drivers/input/tablet/pegasus_notetaker.c
@@ -277,6 +277,7 @@ static int pegasus_probe(struct usb_interface *intf,
struct input_dev *input_dev;
int error;
int pipe;
+ size_t len;
/* We control interface 0 */
if (intf->cur_altsetting->desc.bInterfaceNumber >= 1)
@@ -355,7 +356,8 @@ static int pegasus_probe(struct usb_interface *intf,
le16_to_cpu(dev->descriptor.idProduct));
usb_make_path(dev, pegasus->phys, sizeof(pegasus->phys));
- strlcat(pegasus->phys, "/input0", sizeof(pegasus->phys));
+ len = strnlen(pegasus->phys, sizeof(pegasus->phys));
+ strscpy(pegasus->phys + len, "/input0", sizeof(pegasus->phys) - len);
INIT_WORK(&pegasus->init, pegasus_init);
--
2.43.0
next prev parent reply other threads:[~2026-10-16 17:04 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-16 17:04 [PATCH 0/5] Input: replace strlcat() with strscpy() in USB input drivers Shihuang Liu
2026-10-16 17:04 ` [PATCH 1/5] Input: joystick - replace strlcat() with strscpy() Shihuang Liu
2026-10-16 17:04 ` [PATCH 2/5] Input: misc " Shihuang Liu
2026-10-16 17:04 ` [PATCH 3/5] Input: mouse " Shihuang Liu
2026-10-16 17:04 ` Shihuang Liu [this message]
2026-10-16 17:04 ` [PATCH 5/5] Input: touchscreen " Shihuang Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261016170411.51025-5-shlomojune6@gmail.com \
--to=shlomojune6@gmail.com \
--cc=Henk.Vergonet@gmail.com \
--cc=dmitry.torokhov@gmail.com \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcus.folkesson@gmail.com \
--cc=rydberg@bitmath.org \
--cc=syrjala@sci.fi \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).