[PATCH] Input: mouse: vsxxxaa: Replace strlcat() with strscpy()

[PATCH] Input: mouse: vsxxxaa: Replace strlcat() with strscpy()

[Mariia Nikitash]

In preparation for removing the deprecated strlcat() API[1], use
strscpy() to initialize the mouse device name.

The destination is zero-initialized, and the constant string fits
within the buffer. Since the return value is unused, this preserves
the existing behavior.

Link: https://github.com/KSPP/linux/issues/370 [1]
Signed-off-by: Mariia Nikitash <nikitash.mariiaw@gmail.com>
---
 drivers/input/mouse/vsxxxaa.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/mouse/vsxxxaa.c b/drivers/input/mouse/vsxxxaa.c
index 042a17fe81db..b3a0d7ff5738 100644
--- a/drivers/input/mouse/vsxxxaa.c
+++ b/drivers/input/mouse/vsxxxaa.c
@@ -463,8 +463,8 @@ static int vsxxxaa_connect(struct serio *serio, struct serio_driver *drv)
 
 	mouse->dev = input_dev;
 	mouse->serio = serio;
-	strlcat(mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
-		 sizeof(mouse->name));
+	strscpy(mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
+		sizeof(mouse->name));
 	snprintf(mouse->phys, sizeof(mouse->phys), "%s/input0", serio->phys);
 
 	input_dev->name = mouse->name;
-- 
2.43.0

Re: [PATCH] Input: mouse: vsxxxaa: Replace strlcat() with strscpy()

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 1698 bytes --]

Hi Mariia,

> Date: 2026-11-03 22:23:18-0800
> From: Mariia Nikitash <nikitash.mariiaw@gmail.com>
>
> In preparation for removing the deprecated strlcat() API[1], use
> strscpy() to initialize the mouse device name.
> 
> The destination is zero-initialized, and the constant string fits
> within the buffer. Since the return value is unused, this preserves
> the existing behavior.

Huh!  Indeed, it was very weird that it was using strlcat(3), when
strlcpy(3) would have been okay.  The commit that added strlcat(3) was
obviously confused: 08ffce4560e0 (2006-06-26; "Input: fix potential
overflows in driver/input/mouse").

> 
> Link: https://github.com/KSPP/linux/issues/370 [1]
> Signed-off-by: Mariia Nikitash <nikitash.mariiaw@gmail.com>

Reviewed-by: Alejandro Colomar <alx@kernel.org>


Have a lovely day!
Alex

> ---
>  drivers/input/mouse/vsxxxaa.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/input/mouse/vsxxxaa.c b/drivers/input/mouse/vsxxxaa.c
> index 042a17fe81db..b3a0d7ff5738 100644
> --- a/drivers/input/mouse/vsxxxaa.c
> +++ b/drivers/input/mouse/vsxxxaa.c
> @@ -463,8 +463,8 @@ static int vsxxxaa_connect(struct serio *serio, struct serio_driver *drv)
>  
>  	mouse->dev = input_dev;
>  	mouse->serio = serio;
> -	strlcat(mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
> -		 sizeof(mouse->name));
> +	strscpy(mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
> +		sizeof(mouse->name));
>  	snprintf(mouse->phys, sizeof(mouse->phys), "%s/input0", serio->phys);
>  
>  	input_dev->name = mouse->name;
> -- 
> 2.43.0
> 
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] Input: mouse: vsxxxaa: Replace strlcat() with strscpy()

[Shihuang Liu]

On Tue, Nov 03, 2026 at 10:23:18PM -0800, Mariia Nikitash wrote:
> In preparation for removing the deprecated strlcat() API[1], use
> strscpy() to initialize the mouse device name.
> 
> The destination is zero-initialized, and the constant string fits
> within the buffer. Since the return value is unused, this preserves
> the existing behavior.
> 
> Link: https://github.com/KSPP/linux/issues/370 [1]
> Signed-off-by: Mariia Nikitash <nikitash.mariiaw@gmail.com>

Reviewed-by: Shihuang Liu <shlomojune6@gmail.com>

Re: [PATCH] Input: mouse: vsxxxaa: Replace strlcat() with strscpy()

[David Laight]

On Tue,  3 Nov 2026 22:23:18 -0800
Mariia Nikitash <nikitash.mariiaw@gmail.com> wrote:

> In preparation for removing the deprecated strlcat() API[1], use
> strscpy() to initialize the mouse device name.
> 
> The destination is zero-initialized, and the constant string fits
> within the buffer. Since the return value is unused, this preserves
> the existing behavior.
> 
> Link: https://github.com/KSPP/linux/issues/370 [1]
> Signed-off-by: Mariia Nikitash <nikitash.mariiaw@gmail.com>
> ---
>  drivers/input/mouse/vsxxxaa.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/input/mouse/vsxxxaa.c b/drivers/input/mouse/vsxxxaa.c
> index 042a17fe81db..b3a0d7ff5738 100644
> --- a/drivers/input/mouse/vsxxxaa.c
> +++ b/drivers/input/mouse/vsxxxaa.c
> @@ -463,8 +463,8 @@ static int vsxxxaa_connect(struct serio *serio, struct serio_driver *drv)
>  
>  	mouse->dev = input_dev;
>  	mouse->serio = serio;
> -	strlcat(mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
> -		 sizeof(mouse->name));
> +	strscpy(mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
> +		sizeof(mouse->name));

You might as well use the 2 argument form.
Moreover, if you use strcpy() you'll get a compile-time error if the
string doesn't fit.
strscpy() will truncate and return an errors.

The other question is whether mouse->name even has to be char[].

Personally I think that while there are issues with strlcat()
(mostly to do with its return value), and that there are often
much better (and faster - so sprintf is out) ways of getting
the same result, the deprecation really needs to propose a
sensible alternative (not inlined strlen() + strscpy()).

This case is, of course one of the 'better ways' cases.

David

>  	snprintf(mouse->phys, sizeof(mouse->phys), "%s/input0", serio->phys);
>  
>  	input_dev->name = mouse->name;

Re: [PATCH] Input: mouse: vsxxxaa: Replace strlcat() with strscpy()

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 3671 bytes --]

Hi David,

> Date: 2026-11-05 11:28:13+0000
> From: David Laight <david.laight.linux@gmail.com>
>
> On Tue,  3 Nov 2026 22:23:18 -0800
> Mariia Nikitash <nikitash.mariiaw@gmail.com> wrote:
> 
> > In preparation for removing the deprecated strlcat() API[1], use
> > strscpy() to initialize the mouse device name.
> > 
> > The destination is zero-initialized, and the constant string fits
> > within the buffer. Since the return value is unused, this preserves
> > the existing behavior.
> > 
> > Link: https://github.com/KSPP/linux/issues/370 [1]
> > Signed-off-by: Mariia Nikitash <nikitash.mariiaw@gmail.com>
> > ---
> >  drivers/input/mouse/vsxxxaa.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/input/mouse/vsxxxaa.c b/drivers/input/mouse/vsxxxaa.c
> > index 042a17fe81db..b3a0d7ff5738 100644
> > --- a/drivers/input/mouse/vsxxxaa.c
> > +++ b/drivers/input/mouse/vsxxxaa.c
> > @@ -463,8 +463,8 @@ static int vsxxxaa_connect(struct serio *serio, struct serio_driver *drv)
> >  
> >  	mouse->dev = input_dev;
> >  	mouse->serio = serio;
> > -	strlcat(mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
> > -		 sizeof(mouse->name));
> > +	strscpy(mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
> > +		sizeof(mouse->name));
> 
> You might as well use the 2 argument form.
> Moreover, if you use strcpy() you'll get a compile-time error if the
> string doesn't fit.
> strscpy() will truncate and return an errors.
> 
> The other question is whether mouse->name even has to be char[].
> 
> Personally I think that while there are issues with strlcat()
> (mostly to do with its return value), and that there are often
> much better (and faster - so sprintf is out) ways of getting
> the same result, the deprecation really needs to propose a
> sensible alternative (not inlined strlen() + strscpy()).

One alternative would be to add strscat(), with the obvious internal
strlen(3).  This would be a drop-in replacement, and wouldn't have the
issues of strlcat(3) --mainly, the DoS vulnerability which is
consequence of the return value, and also the more difficult error
handling of doing '>=sizeof(...)' than '<0'--.

There's an implementation of strscat() in shadow-utils, where we call it
strtcat() --because what it does is Truncating the string, so a T feels
more appropriate--:
<https://github.com/shadow-maint/shadow/blob/214a2e6e0a5f81fa281b272be7cf9e9d3aff8f34/lib/string/strcpy/strtcat.h#L28>

Another alternative which would avoid the internal strlen(3) call, and
thus would be faster, would be to add a stpecpy() function, similar to
stpcpy(3), but which would take a pointer one-past-the-last element in
the buffer, to perform truncation.  This is fundamentally Plan9's
strecpy(2), except that Plan9's API has a bug.

There's an implementation of stpecpy() in shadow-utils:
<https://github.com/shadow-maint/shadow/blob/214a2e6e0a5f81fa281b272be7cf9e9d3aff8f34/lib/string/strcpy/stpecpy.h#L28>

We've been using stpecpy() quite extensively in shadow-utils, and it's
a great API.  Of course, there's also the decades-long experience in
Plan9, which apart from their bug --which I found, by comparing their
implementation to mine--, shows that it's a quite useful API.

And stpecpy() produces the simplest code of all truncating functions.


Have a lovely day!
Alex

> This case is, of course one of the 'better ways' cases.
> 
> David
> 
> >  	snprintf(mouse->phys, sizeof(mouse->phys), "%s/input0", serio->phys);
> >  
> >  	input_dev->name = mouse->name;
> 
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] Input: mouse: vsxxxaa: Replace strlcat() with strscpy()

[David Laight]

On Thu, 5 Nov 2026 12:49:59 +0100
Alejandro Colomar <alx+linux-hardening@kernel.org> wrote:

> > Personally I think that while there are issues with strlcat()
> > (mostly to do with its return value), and that there are often
> > much better (and faster - so sprintf is out) ways of getting
> > the same result, the deprecation really needs to propose a
> > sensible alternative (not inlined strlen() + strscpy()).  
> 
> One alternative would be to add strscat(), with the obvious internal
> strlen(3).  This would be a drop-in replacement, and wouldn't have the
> issues of strlcat(3) --mainly, the DoS vulnerability which is
> consequence of the return value, and also the more difficult error
> handling of doing '>=sizeof(...)' than '<0'--.

I've had thoughts of a more general function - but I've not tried to
write it.

int str_append(char *dest, size_t dest_sz, size_t dest_off, const char *src, size_t src_max_len);

Where dest_sz is usually sizeof(*dest) and the header can substitute that for
  a constant zero.
dest_off would similarly default to strlen(dest), if -ve the function would
  return that value immediately.
src_max_len would be used for an effective strnlen(src, src_max_len).

The idea would be that calls like:
	char tgt[100];
	len = str_append(tgt, 0, strscpy(tgt, src_1), src_2, 0);
would append src_1 and src_2 in tgt returning -ve on overflow.
(Further chaining would then work.)

But, as I said, I've not tried to write it or see what it would look like in use.

David

Re: [PATCH] Input: mouse: vsxxxaa: Replace strlcat() with strscpy()

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 3198 bytes --]

Hi David,

> Date: 2026-11-05 20:53:21+0000
> From: David Laight <david.laight.linux@gmail.com>
>
> On Thu, 5 Nov 2026 12:49:59 +0100
> Alejandro Colomar <alx+linux-hardening@kernel.org> wrote:
> 
> > > Personally I think that while there are issues with strlcat()
> > > (mostly to do with its return value), and that there are often
> > > much better (and faster - so sprintf is out) ways of getting
> > > the same result, the deprecation really needs to propose a
> > > sensible alternative (not inlined strlen() + strscpy()).  
> > 
> > One alternative would be to add strscat(), with the obvious internal
> > strlen(3).  This would be a drop-in replacement, and wouldn't have the
> > issues of strlcat(3) --mainly, the DoS vulnerability which is
> > consequence of the return value, and also the more difficult error
> > handling of doing '>=sizeof(...)' than '<0'--.
> 
> I've had thoughts of a more general function - but I've not tried to
> write it.
> 
> int str_append(char *dest, size_t dest_sz, size_t dest_off, const char *src, size_t src_max_len);
> 
> Where dest_sz is usually sizeof(*dest) and the header can substitute that for
>   a constant zero.
> dest_off would similarly default to strlen(dest), if -ve the function would
>   return that value immediately.
> src_max_len would be used for an effective strnlen(src, src_max_len).
> 
> The idea would be that calls like:
> 	char tgt[100];
> 	len = str_append(tgt, 0, strscpy(tgt, src_1), src_2, 0);
> would append src_1 and src_2 in tgt returning -ve on overflow.
> (Further chaining would then work.)
> 
> But, as I said, I've not tried to write it or see what it would look like in use.

I think it's too complex for what it does.  See how stpecpy() works:

	char  tgt[100];
	char  *p, *e;

	e = tgt + _Countof(tgt);
	p = tgt;
	p = stpecpy(p, e, src_1);
	p = stpecpy(p, e, src_2);
	p = stpecpy(p, e, src_3);
	p = stpecpy(p, e, src_4);
	p = stpecpy(p, e, src_5);
	...
	p = stpecpy(p, e, src_9);
	if (p == NULL)
		goto truncated;

	// 'p - tgt' is the length of the string.
	// In other words, 'p' points to the '\0'.

It copies all the strings into tgt, with truncation.  If any of the 5
calls resulted in truncation, it will be reported as a NULL.

You can also do the chain in a single line:

	p = stpecpy(stpecpy(stpecpy(p, e, src_1), e, src_2), e, src_3);

But IMO it reads better one per line.

Then, strscpy(9) is trivially implementable as:

	ssize_t
	strscpy(char *dst, const char *src, size_t dsize)
	{
		char  *p;

		BUG_ON(dsize == 0);
		p = stpecpy(dst, dst + dsize, src);
		return p ? p - dst : -E2BIG;
	}

And a hypothetical strscat() would be:

	ssize_t
	strscat(char *dst, const char *src, size_t dsize)
	{
		char  *p;

		BUG_ON(dsize == 0);
		p = stpecpy(dst + strlen(dst), dst + dsize, src);
		return p ? p - dst : -E2BIG;
	}

I have been working literally years on this API, and believe it has
reached perfection.  It includes some feedback I got from Doug McIlroy
about the design, which improved the usability and safety.


Have a lovely night!
Alex

> 
> David

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]