* [PATCH 1/5] Input: joystick - replace strlcat() with strscpy()
2026-10-16 17:04 [PATCH 0/5] Input: replace strlcat() with strscpy() in USB input drivers Shihuang Liu
@ 2026-10-16 17:04 ` Shihuang Liu
2026-10-16 19:17 ` Dmitry Torokhov
2026-10-16 17:04 ` [PATCH 2/5] Input: misc " Shihuang Liu
` (3 subsequent siblings)
4 siblings, 1 reply; 7+ messages in thread
From: Shihuang Liu @ 2026-10-16 17:04 UTC (permalink / raw)
To: linux-input, linux-hardening
Cc: Marcus Folkesson, Dmitry Torokhov, Ville Syrjala, Henk Vergonet,
Henrik Rydberg, linux-kernel, Shihuang Liu
The pxrc and xpad drivers build the physical path by appending a
constant "/input0" suffix with strlcat() after usb_make_path().
In preparation for removing the deprecated strlcat() API[1],
replace it with strnlen() followed by strscpy() into the remainder
of the buffer, as commit 34b228b739f5 ("HID: usbhid: replace
strlcat with better alternatives") did for the usbhid drivers.
Link: https://github.com/KSPP/linux/issues/370 [1]
Signed-off-by: Shihuang Liu <shlomojune6@gmail.com>
---
drivers/input/joystick/pxrc.c | 4 +++-
drivers/input/joystick/xpad.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/input/joystick/pxrc.c b/drivers/input/joystick/pxrc.c
index 52d9eab667b7a..9abda2394fffb 100644
--- a/drivers/input/joystick/pxrc.c
+++ b/drivers/input/joystick/pxrc.c
@@ -121,6 +121,7 @@ static int pxrc_probe(struct usb_interface *intf,
struct pxrc *pxrc;
struct usb_endpoint_descriptor *epirq;
size_t xfer_size;
+ size_t len;
void *xfer_buf;
int error;
@@ -170,7 +171,8 @@ static int pxrc_probe(struct usb_interface *intf,
pxrc->input->name = "PXRC Flight Controller Adapter";
usb_make_path(udev, pxrc->phys, sizeof(pxrc->phys));
- strlcat(pxrc->phys, "/input0", sizeof(pxrc->phys));
+ len = strnlen(pxrc->phys, sizeof(pxrc->phys));
+ strscpy(pxrc->phys + len, "/input0", sizeof(pxrc->phys) - len);
pxrc->input->phys = pxrc->phys;
usb_to_input_id(udev, &pxrc->input->id);
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index feb8f368f834e..4f2bb9ca74936 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -2045,6 +2045,7 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
struct usb_xpad *xpad;
struct usb_endpoint_descriptor *ep_irq_in, *ep_irq_out;
int i, error;
+ size_t len;
if (intf->cur_altsetting->desc.bNumEndpoints != 2)
return -ENODEV;
@@ -2060,7 +2061,8 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
return -ENOMEM;
usb_make_path(udev, xpad->phys, sizeof(xpad->phys));
- strlcat(xpad->phys, "/input0", sizeof(xpad->phys));
+ len = strnlen(xpad->phys, sizeof(xpad->phys));
+ strscpy(xpad->phys + len, "/input0", sizeof(xpad->phys) - len);
xpad->idata = usb_alloc_coherent(udev, XPAD_PKT_LEN,
GFP_KERNEL, &xpad->idata_dma);
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH 1/5] Input: joystick - replace strlcat() with strscpy()
2026-10-16 17:04 ` [PATCH 1/5] Input: joystick - replace strlcat() with strscpy() Shihuang Liu
@ 2026-10-16 19:17 ` Dmitry Torokhov
0 siblings, 0 replies; 7+ messages in thread
From: Dmitry Torokhov @ 2026-10-16 19:17 UTC (permalink / raw)
To: Shihuang Liu
Cc: linux-input, linux-hardening, Marcus Folkesson, Ville Syrjala,
Henk Vergonet, Henrik Rydberg, linux-kernel
Hi Shihuang,
On Sat, Oct 17, 2026 at 01:04:07AM +0800, Shihuang Liu wrote:
> The pxrc and xpad drivers build the physical path by appending a
> constant "/input0" suffix with strlcat() after usb_make_path().
>
> In preparation for removing the deprecated strlcat() API[1],
> replace it with strnlen() followed by strscpy() into the remainder
> of the buffer, as commit 34b228b739f5 ("HID: usbhid: replace
> strlcat with better alternatives") did for the usbhid drivers.
...
> usb_make_path(udev, pxrc->phys, sizeof(pxrc->phys));
> - strlcat(pxrc->phys, "/input0", sizeof(pxrc->phys));
> + len = strnlen(pxrc->phys, sizeof(pxrc->phys));
> + strscpy(pxrc->phys + len, "/input0", sizeof(pxrc->phys) - len);
I really dislike this conversion pattern, and I do not want to see it
open-coded across 18 drivers in this series.
usb_make_path() is just a trivial wrapper around snprintf() that already
returns the length of the formatted string. Calling usb_make_path(),
ignoring its return value, rescanning the buffer with strnlen(), and
then open-coding pointer and size arithmetic for strscpy() (along with
an extra local variable in every probe function) makes the code much
uglier and harder to read than what we had before.
All of these USB input drivers already include <linux/usb/input.h>, and
drivers across other subsystems (drivers/hid/usbhid/, drivers/media/rc/,
drivers/media/usb/, sound/usb/caiaq/, drivers/usb/storage/onetouch.c)
all use the exact same usb_make_path() + suffix pattern ("/input0",
"/input%d", "/ir0", "/button", etc.).
If we want to get rid of strlcat() here, please introduce a generic
helper in include/linux/usb.h (or a USB input helper in
include/linux/usb/input.h) that formats the USB path together with the
subpath in a single pass, for example:
__printf(4, 5)
int usb_make_subpath(struct usb_device *dev, char *buf, size_t size,
const char *fmt, ...);
(or a simple const char *suffix variant if formatting is not needed).
Then each driver can do:
usb_make_subpath(udev, pxrc->phys, sizeof(pxrc->phys), "input0");
and even drivers/hid/usbhid/hid-core.c can simply do:
usb_make_subpath(dev, hid->phys, sizeof(hid->phys),
"input%d", intf->altsetting[0].desc.bInterfaceNumber);
instead of repeating this strnlen() + strscpy() boilerplate everywhere.
Thanks.
--
Dmitry
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 2/5] Input: misc - replace strlcat() with strscpy()
2026-10-16 17:04 [PATCH 0/5] Input: replace strlcat() with strscpy() in USB input drivers Shihuang Liu
2026-10-16 17:04 ` [PATCH 1/5] Input: joystick - replace strlcat() with strscpy() Shihuang Liu
@ 2026-10-16 17:04 ` Shihuang Liu
2026-10-16 17:04 ` [PATCH 3/5] Input: mouse " Shihuang Liu
` (2 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Shihuang Liu @ 2026-10-16 17:04 UTC (permalink / raw)
To: linux-input, linux-hardening
Cc: Marcus Folkesson, Dmitry Torokhov, Ville Syrjala, Henk Vergonet,
Henrik Rydberg, linux-kernel, Shihuang Liu
The ati_remote2, cm109, ims-pcu, keyspan_remote, powermate and
yealink drivers build the physical path by appending a constant
"/input0" suffix with strlcat() after usb_make_path().
In preparation for removing the deprecated strlcat() API[1],
replace it with strnlen() followed by strscpy() into the remainder
of the buffer, as commit 34b228b739f5 ("HID: usbhid: replace
strlcat with better alternatives") did for the usbhid drivers.
Link: https://github.com/KSPP/linux/issues/370 [1]
Signed-off-by: Shihuang Liu <shlomojune6@gmail.com>
---
drivers/input/misc/ati_remote2.c | 4 +++-
drivers/input/misc/cm109.c | 4 +++-
drivers/input/misc/ims-pcu.c | 8 ++++++--
drivers/input/misc/keyspan_remote.c | 4 +++-
drivers/input/misc/powermate.c | 4 +++-
drivers/input/misc/yealink.c | 4 +++-
6 files changed, 21 insertions(+), 7 deletions(-)
diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c
index 8db2dca84975c..929163f52177e 100644
--- a/drivers/input/misc/ati_remote2.c
+++ b/drivers/input/misc/ati_remote2.c
@@ -767,6 +767,7 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
struct usb_device *udev = interface_to_usbdev(interface);
struct usb_host_interface *alt = interface->cur_altsetting;
struct ati_remote2 *ar2;
+ size_t len;
int r;
if (alt->desc.bInterfaceNumber)
@@ -823,7 +824,8 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
goto fail3;
usb_make_path(udev, ar2->phys, sizeof(ar2->phys));
- strlcat(ar2->phys, "/input0", sizeof(ar2->phys));
+ len = strnlen(ar2->phys, sizeof(ar2->phys));
+ strscpy(ar2->phys + len, "/input0", sizeof(ar2->phys) - len);
strlcat(ar2->name, "ATI Remote Wonder II", sizeof(ar2->name));
diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index 353d3c1d347d5..d3aee3c498702 100644
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -685,6 +685,7 @@ static int cm109_usb_probe(struct usb_interface *intf,
struct input_dev *input_dev = NULL;
int ret, pipe, i;
int error = -ENOMEM;
+ size_t len;
interface = intf->cur_altsetting;
@@ -766,7 +767,8 @@ static int cm109_usb_probe(struct usb_interface *intf,
/* find out the physical bus location */
usb_make_path(udev, dev->phys, sizeof(dev->phys));
- strlcat(dev->phys, "/input0", sizeof(dev->phys));
+ len = strnlen(dev->phys, sizeof(dev->phys));
+ strscpy(dev->phys + len, "/input0", sizeof(dev->phys) - len);
/* register settings for the input device */
input_dev->name = nfo->name;
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index b1a0edcc49b4e..697813fb11da8 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -205,6 +205,7 @@ static int ims_pcu_setup_buttons(struct ims_pcu *pcu,
struct input_dev *input;
int i;
int error;
+ size_t len;
input = input_allocate_device();
if (!input) {
@@ -216,7 +217,8 @@ static int ims_pcu_setup_buttons(struct ims_pcu *pcu,
"IMS PCU#%d Button Interface", pcu->device_no);
usb_make_path(pcu->udev, buttons->phys, sizeof(buttons->phys));
- strlcat(buttons->phys, "/input0", sizeof(buttons->phys));
+ len = strnlen(buttons->phys, sizeof(buttons->phys));
+ strscpy(buttons->phys + len, "/input0", sizeof(buttons->phys) - len);
memcpy(buttons->keymap, keymap, sizeof(*keymap) * keymap_len);
@@ -286,6 +288,7 @@ static int ims_pcu_setup_gamepad(struct ims_pcu *pcu)
struct ims_pcu_gamepad *gamepad;
struct input_dev *input;
int error;
+ size_t len;
gamepad = kzalloc_obj(*gamepad);
input = input_allocate_device();
@@ -302,7 +305,8 @@ static int ims_pcu_setup_gamepad(struct ims_pcu *pcu)
"IMS PCU#%d Gamepad Interface", pcu->device_no);
usb_make_path(pcu->udev, gamepad->phys, sizeof(gamepad->phys));
- strlcat(gamepad->phys, "/input1", sizeof(gamepad->phys));
+ len = strnlen(gamepad->phys, sizeof(gamepad->phys));
+ strscpy(gamepad->phys + len, "/input1", sizeof(gamepad->phys) - len);
input->name = gamepad->name;
input->phys = gamepad->phys;
diff --git a/drivers/input/misc/keyspan_remote.c b/drivers/input/misc/keyspan_remote.c
index 70cd6586459ef..f0f31f2823d57 100644
--- a/drivers/input/misc/keyspan_remote.c
+++ b/drivers/input/misc/keyspan_remote.c
@@ -430,6 +430,7 @@ static int keyspan_probe(struct usb_interface *interface, const struct usb_devic
struct usb_keyspan *remote;
struct input_dev *input_dev;
int i, error;
+ size_t len;
error = usb_find_int_in_endpoint(interface->cur_altsetting, &endpoint);
if (error)
@@ -482,7 +483,8 @@ static int keyspan_probe(struct usb_interface *interface, const struct usb_devic
le16_to_cpu(udev->descriptor.idProduct));
usb_make_path(udev, remote->phys, sizeof(remote->phys));
- strlcat(remote->phys, "/input0", sizeof(remote->phys));
+ len = strnlen(remote->phys, sizeof(remote->phys));
+ strscpy(remote->phys + len, "/input0", sizeof(remote->phys) - len);
memcpy(remote->keymap, keyspan_key_table, sizeof(remote->keymap));
input_dev->name = remote->name;
diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c
index 754379d2625cf..dbf9f06f3059e 100644
--- a/drivers/input/misc/powermate.c
+++ b/drivers/input/misc/powermate.c
@@ -299,6 +299,7 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i
struct input_dev *input_dev;
int pipe, maxp;
int error = -ENOMEM;
+ size_t len;
interface = intf->cur_altsetting;
if (interface->desc.bNumEndpoints < 1)
@@ -334,7 +335,8 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i
pm->input = input_dev;
usb_make_path(udev, pm->phys, sizeof(pm->phys));
- strlcat(pm->phys, "/input0", sizeof(pm->phys));
+ len = strnlen(pm->phys, sizeof(pm->phys));
+ strscpy(pm->phys + len, "/input0", sizeof(pm->phys) - len);
spin_lock_init(&pm->lock);
diff --git a/drivers/input/misc/yealink.c b/drivers/input/misc/yealink.c
index 560f895a00cda..1a3bebc8c3513 100644
--- a/drivers/input/misc/yealink.c
+++ b/drivers/input/misc/yealink.c
@@ -812,6 +812,7 @@ static int usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
struct yealink_dev *yld;
struct input_dev *input_dev;
int ret, pipe, i;
+ size_t len;
interface = intf->cur_altsetting;
@@ -891,7 +892,8 @@ static int usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
/* find out the physical bus location */
usb_make_path(udev, yld->phys, sizeof(yld->phys));
- strlcat(yld->phys, "/input0", sizeof(yld->phys));
+ len = strnlen(yld->phys, sizeof(yld->phys));
+ strscpy(yld->phys + len, "/input0", sizeof(yld->phys) - len);
/* register settings for the input device */
input_dev->name = nfo->name;
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 3/5] Input: mouse - replace strlcat() with strscpy()
2026-10-16 17:04 [PATCH 0/5] Input: replace strlcat() with strscpy() in USB input drivers Shihuang Liu
2026-10-16 17:04 ` [PATCH 1/5] Input: joystick - replace strlcat() with strscpy() Shihuang Liu
2026-10-16 17:04 ` [PATCH 2/5] Input: misc " Shihuang Liu
@ 2026-10-16 17:04 ` Shihuang Liu
2026-10-16 17:04 ` [PATCH 4/5] Input: tablet " Shihuang Liu
2026-10-16 17:04 ` [PATCH 5/5] Input: touchscreen " Shihuang Liu
4 siblings, 0 replies; 7+ messages in thread
From: Shihuang Liu @ 2026-10-16 17:04 UTC (permalink / raw)
To: linux-input, linux-hardening
Cc: Marcus Folkesson, Dmitry Torokhov, Ville Syrjala, Henk Vergonet,
Henrik Rydberg, linux-kernel, Shihuang Liu
The appletouch, bcm5974 and synaptics_usb drivers build the
physical path by appending a constant "/input0" suffix with
strlcat() after usb_make_path().
In preparation for removing the deprecated strlcat() API[1],
replace it with strnlen() followed by strscpy() into the remainder
of the buffer, as commit 34b228b739f5 ("HID: usbhid: replace
strlcat with better alternatives") did for the usbhid drivers.
Link: https://github.com/KSPP/linux/issues/370 [1]
Signed-off-by: Shihuang Liu <shlomojune6@gmail.com>
---
drivers/input/mouse/appletouch.c | 4 +++-
drivers/input/mouse/bcm5974.c | 4 +++-
drivers/input/mouse/synaptics_usb.c | 4 +++-
3 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c
index eebeb57515e1c..aa43f7ae274ce 100644
--- a/drivers/input/mouse/appletouch.c
+++ b/drivers/input/mouse/appletouch.c
@@ -832,6 +832,7 @@ static int atp_probe(struct usb_interface *iface,
struct usb_endpoint_descriptor *ep;
int error;
const struct atp_info *info = (const struct atp_info *)id->driver_info;
+ size_t len;
/* set up the endpoint information */
/* use only the first interrupt-in endpoint */
@@ -875,7 +876,8 @@ static int atp_probe(struct usb_interface *iface,
goto err_free_buffer;
usb_make_path(udev, dev->phys, sizeof(dev->phys));
- strlcat(dev->phys, "/input0", sizeof(dev->phys));
+ len = strnlen(dev->phys, sizeof(dev->phys));
+ strscpy(dev->phys + len, "/input0", sizeof(dev->phys) - len);
input_dev->name = "appletouch";
input_dev->phys = dev->phys;
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index e772bac3b64c0..64e26cca2c2c4 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -928,6 +928,7 @@ static int bcm5974_probe(struct usb_interface *iface,
struct bcm5974 *dev;
struct input_dev *input_dev;
int error = -ENOMEM;
+ size_t len;
/* find the product index */
cfg = bcm5974_get_config(udev);
@@ -990,7 +991,8 @@ static int bcm5974_probe(struct usb_interface *iface,
/* create bcm5974 device */
usb_make_path(udev, dev->phys, sizeof(dev->phys));
- strlcat(dev->phys, "/input0", sizeof(dev->phys));
+ len = strnlen(dev->phys, sizeof(dev->phys));
+ strscpy(dev->phys + len, "/input0", sizeof(dev->phys) - len);
input_dev->name = "bcm5974";
input_dev->phys = dev->phys;
diff --git a/drivers/input/mouse/synaptics_usb.c b/drivers/input/mouse/synaptics_usb.c
index 880a0c79148cd..e1a4a9746dbee 100644
--- a/drivers/input/mouse/synaptics_usb.c
+++ b/drivers/input/mouse/synaptics_usb.c
@@ -279,6 +279,7 @@ static int synusb_probe(struct usb_interface *intf,
unsigned int intf_num = intf->cur_altsetting->desc.bInterfaceNumber;
unsigned int altsetting = min(intf->num_altsetting, 1U);
int error;
+ size_t len;
error = usb_set_interface(udev, intf_num, altsetting);
if (error) {
@@ -354,7 +355,8 @@ static int synusb_probe(struct usb_interface *intf,
strlcat(synusb->name, " (Stick)", sizeof(synusb->name));
usb_make_path(udev, synusb->phys, sizeof(synusb->phys));
- strlcat(synusb->phys, "/input0", sizeof(synusb->phys));
+ len = strnlen(synusb->phys, sizeof(synusb->phys));
+ strscpy(synusb->phys + len, "/input0", sizeof(synusb->phys) - len);
input_dev->name = synusb->name;
input_dev->phys = synusb->phys;
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 4/5] Input: tablet - replace strlcat() with strscpy()
2026-10-16 17:04 [PATCH 0/5] Input: replace strlcat() with strscpy() in USB input drivers Shihuang Liu
` (2 preceding siblings ...)
2026-10-16 17:04 ` [PATCH 3/5] Input: mouse " Shihuang Liu
@ 2026-10-16 17:04 ` Shihuang Liu
2026-10-16 17:04 ` [PATCH 5/5] Input: touchscreen " Shihuang Liu
4 siblings, 0 replies; 7+ messages in thread
From: Shihuang Liu @ 2026-10-16 17:04 UTC (permalink / raw)
To: linux-input, linux-hardening
Cc: Marcus Folkesson, Dmitry Torokhov, Ville Syrjala, Henk Vergonet,
Henrik Rydberg, linux-kernel, Shihuang Liu
The acecad, aiptek, hanwang, kbtab and pegasus_notetaker drivers
build the physical path by appending a constant "/input0" suffix
with strlcat() after usb_make_path().
In preparation for removing the deprecated strlcat() API[1],
replace it with strnlen() followed by strscpy() into the remainder
of the buffer, as commit 34b228b739f5 ("HID: usbhid: replace
strlcat with better alternatives") did for the usbhid drivers.
Link: https://github.com/KSPP/linux/issues/370 [1]
Signed-off-by: Shihuang Liu <shlomojune6@gmail.com>
---
drivers/input/tablet/acecad.c | 4 +++-
drivers/input/tablet/aiptek.c | 7 +++++--
drivers/input/tablet/hanwang.c | 4 +++-
drivers/input/tablet/kbtab.c | 4 +++-
drivers/input/tablet/pegasus_notetaker.c | 4 +++-
5 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/drivers/input/tablet/acecad.c b/drivers/input/tablet/acecad.c
index ba79dff21aac8..8fec79c46d4b0 100644
--- a/drivers/input/tablet/acecad.c
+++ b/drivers/input/tablet/acecad.c
@@ -117,6 +117,7 @@ static int usb_acecad_probe(struct usb_interface *intf, const struct usb_device_
struct input_dev *input_dev;
int pipe, maxp;
int err;
+ size_t len;
if (interface->desc.bNumEndpoints != 1)
return -ENODEV;
@@ -161,7 +162,8 @@ static int usb_acecad_probe(struct usb_interface *intf, const struct usb_device_
}
usb_make_path(dev, acecad->phys, sizeof(acecad->phys));
- strlcat(acecad->phys, "/input0", sizeof(acecad->phys));
+ len = strnlen(acecad->phys, sizeof(acecad->phys));
+ strscpy(acecad->phys + len, "/input0", sizeof(acecad->phys) - len);
input_dev->name = acecad->name;
input_dev->phys = acecad->phys;
diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
index 0c1acb9e6b437..e868d0bac771d 100644
--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -1637,6 +1637,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
AIPTEK_PROGRAMMABLE_DELAY_300
};
int err = -ENOMEM;
+ size_t len;
/* programmableDelay is where the command-line specified
* delay is kept. We make it the first element of speeds[],
@@ -1707,8 +1708,10 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
*/
usb_make_path(usbdev, aiptek->features.usbPath,
sizeof(aiptek->features.usbPath));
- strlcat(aiptek->features.usbPath, "/input0",
- sizeof(aiptek->features.usbPath));
+ len = strnlen(aiptek->features.usbPath,
+ sizeof(aiptek->features.usbPath));
+ strscpy(aiptek->features.usbPath + len, "/input0",
+ sizeof(aiptek->features.usbPath) - len);
/* Set up client data, pointers to open and close routines
* for the input device.
diff --git a/drivers/input/tablet/hanwang.c b/drivers/input/tablet/hanwang.c
index fd5a7e761dcc4..a75d10dd2fc7d 100644
--- a/drivers/input/tablet/hanwang.c
+++ b/drivers/input/tablet/hanwang.c
@@ -318,6 +318,7 @@ static int hanwang_probe(struct usb_interface *intf, const struct usb_device_id
struct input_dev *input_dev;
int error;
int i;
+ size_t len;
if (intf->cur_altsetting->desc.bNumEndpoints < 1)
return -ENODEV;
@@ -351,7 +352,8 @@ static int hanwang_probe(struct usb_interface *intf, const struct usb_device_id
hanwang->dev = input_dev;
usb_make_path(dev, hanwang->phys, sizeof(hanwang->phys));
- strlcat(hanwang->phys, "/input0", sizeof(hanwang->phys));
+ len = strnlen(hanwang->phys, sizeof(hanwang->phys));
+ strscpy(hanwang->phys + len, "/input0", sizeof(hanwang->phys) - len);
strscpy(hanwang->name, hanwang->features->name, sizeof(hanwang->name));
input_dev->name = hanwang->name;
diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
index 6ce70c8e2d7cc..79a5e217654b6 100644
--- a/drivers/input/tablet/kbtab.c
+++ b/drivers/input/tablet/kbtab.c
@@ -113,6 +113,7 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
struct kbtab *kbtab;
struct input_dev *input_dev;
int error = -ENOMEM;
+ size_t len;
if (intf->cur_altsetting->desc.bNumEndpoints < 1)
return -ENODEV;
@@ -138,7 +139,8 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
kbtab->dev = input_dev;
usb_make_path(dev, kbtab->phys, sizeof(kbtab->phys));
- strlcat(kbtab->phys, "/input0", sizeof(kbtab->phys));
+ len = strnlen(kbtab->phys, sizeof(kbtab->phys));
+ strscpy(kbtab->phys + len, "/input0", sizeof(kbtab->phys) - len);
input_dev->name = "KB Gear Tablet";
input_dev->phys = kbtab->phys;
diff --git a/drivers/input/tablet/pegasus_notetaker.c b/drivers/input/tablet/pegasus_notetaker.c
index 85390ae423076..679600bd214e4 100644
--- a/drivers/input/tablet/pegasus_notetaker.c
+++ b/drivers/input/tablet/pegasus_notetaker.c
@@ -277,6 +277,7 @@ static int pegasus_probe(struct usb_interface *intf,
struct input_dev *input_dev;
int error;
int pipe;
+ size_t len;
/* We control interface 0 */
if (intf->cur_altsetting->desc.bInterfaceNumber >= 1)
@@ -355,7 +356,8 @@ static int pegasus_probe(struct usb_interface *intf,
le16_to_cpu(dev->descriptor.idProduct));
usb_make_path(dev, pegasus->phys, sizeof(pegasus->phys));
- strlcat(pegasus->phys, "/input0", sizeof(pegasus->phys));
+ len = strnlen(pegasus->phys, sizeof(pegasus->phys));
+ strscpy(pegasus->phys + len, "/input0", sizeof(pegasus->phys) - len);
INIT_WORK(&pegasus->init, pegasus_init);
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 5/5] Input: touchscreen - replace strlcat() with strscpy()
2026-10-16 17:04 [PATCH 0/5] Input: replace strlcat() with strscpy() in USB input drivers Shihuang Liu
` (3 preceding siblings ...)
2026-10-16 17:04 ` [PATCH 4/5] Input: tablet " Shihuang Liu
@ 2026-10-16 17:04 ` Shihuang Liu
4 siblings, 0 replies; 7+ messages in thread
From: Shihuang Liu @ 2026-10-16 17:04 UTC (permalink / raw)
To: linux-input, linux-hardening
Cc: Marcus Folkesson, Dmitry Torokhov, Ville Syrjala, Henk Vergonet,
Henrik Rydberg, linux-kernel, Shihuang Liu
The sur40 and usbtouchscreen drivers build the physical path by
appending a constant "/input0" suffix with strlcat() after
usb_make_path().
In preparation for removing the deprecated strlcat() API[1],
replace it with strnlen() followed by strscpy() into the remainder
of the buffer, as commit 34b228b739f5 ("HID: usbhid: replace
strlcat with better alternatives") did for the usbhid drivers.
Link: https://github.com/KSPP/linux/issues/370 [1]
Signed-off-by: Shihuang Liu <shlomojune6@gmail.com>
---
drivers/input/touchscreen/sur40.c | 4 +++-
drivers/input/touchscreen/usbtouchscreen.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index 77ec2c94b91fd..72ec3882e3d40 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -657,6 +657,7 @@ static int sur40_probe(struct usb_interface *interface,
struct usb_endpoint_descriptor *endpoint;
struct input_dev *input;
int error;
+ size_t len;
/* Check if we really have the right interface. */
iface_desc = interface->cur_altsetting;
@@ -691,7 +692,8 @@ static int sur40_probe(struct usb_interface *interface,
input->name = DRIVER_LONG;
usb_to_input_id(usbdev, &input->id);
usb_make_path(usbdev, sur40->phys, sizeof(sur40->phys));
- strlcat(sur40->phys, "/input0", sizeof(sur40->phys));
+ len = strnlen(sur40->phys, sizeof(sur40->phys));
+ strscpy(sur40->phys + len, "/input0", sizeof(sur40->phys) - len);
input->phys = sur40->phys;
input->dev.parent = &interface->dev;
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index 0bbacb517c286..e6f88bd9a3408 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -1438,6 +1438,7 @@ static int usbtouch_probe(struct usb_interface *intf,
struct usb_device *udev = interface_to_usbdev(intf);
const struct usbtouch_device_info *type;
int err;
+ size_t len;
/* some devices are ignored */
type = (const struct usbtouch_device_info *)id->driver_info;
@@ -1513,7 +1514,8 @@ static int usbtouch_probe(struct usb_interface *intf,
le16_to_cpu(udev->descriptor.idProduct));
usb_make_path(udev, usbtouch->phys, sizeof(usbtouch->phys));
- strlcat(usbtouch->phys, "/input0", sizeof(usbtouch->phys));
+ len = strnlen(usbtouch->phys, sizeof(usbtouch->phys));
+ strscpy(usbtouch->phys + len, "/input0", sizeof(usbtouch->phys) - len);
input_dev->name = usbtouch->name;
input_dev->phys = usbtouch->phys;
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread