Re: [PATCH] Input: mouse: vsxxxaa: Replace strlcat() with strscpy()

[Alejandro Colomar <alx+linux-hardening@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 3671 bytes --]

Hi David,

> Date: 2026-11-05 11:28:13+0000
> From: David Laight <david.laight.linux@gmail.com>
>
> On Tue,  3 Nov 2026 22:23:18 -0800
> Mariia Nikitash <nikitash.mariiaw@gmail.com> wrote:
> 
> > In preparation for removing the deprecated strlcat() API[1], use
> > strscpy() to initialize the mouse device name.
> > 
> > The destination is zero-initialized, and the constant string fits
> > within the buffer. Since the return value is unused, this preserves
> > the existing behavior.
> > 
> > Link: https://github.com/KSPP/linux/issues/370 [1]
> > Signed-off-by: Mariia Nikitash <nikitash.mariiaw@gmail.com>
> > ---
> >  drivers/input/mouse/vsxxxaa.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/input/mouse/vsxxxaa.c b/drivers/input/mouse/vsxxxaa.c
> > index 042a17fe81db..b3a0d7ff5738 100644
> > --- a/drivers/input/mouse/vsxxxaa.c
> > +++ b/drivers/input/mouse/vsxxxaa.c
> > @@ -463,8 +463,8 @@ static int vsxxxaa_connect(struct serio *serio, struct serio_driver *drv)
> >  
> >  	mouse->dev = input_dev;
> >  	mouse->serio = serio;
> > -	strlcat(mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
> > -		 sizeof(mouse->name));
> > +	strscpy(mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
> > +		sizeof(mouse->name));
> 
> You might as well use the 2 argument form.
> Moreover, if you use strcpy() you'll get a compile-time error if the
> string doesn't fit.
> strscpy() will truncate and return an errors.
> 
> The other question is whether mouse->name even has to be char[].
> 
> Personally I think that while there are issues with strlcat()
> (mostly to do with its return value), and that there are often
> much better (and faster - so sprintf is out) ways of getting
> the same result, the deprecation really needs to propose a
> sensible alternative (not inlined strlen() + strscpy()).

One alternative would be to add strscat(), with the obvious internal
strlen(3).  This would be a drop-in replacement, and wouldn't have the
issues of strlcat(3) --mainly, the DoS vulnerability which is
consequence of the return value, and also the more difficult error
handling of doing '>=sizeof(...)' than '<0'--.

There's an implementation of strscat() in shadow-utils, where we call it
strtcat() --because what it does is Truncating the string, so a T feels
more appropriate--:
<https://github.com/shadow-maint/shadow/blob/214a2e6e0a5f81fa281b272be7cf9e9d3aff8f34/lib/string/strcpy/strtcat.h#L28>

Another alternative which would avoid the internal strlen(3) call, and
thus would be faster, would be to add a stpecpy() function, similar to
stpcpy(3), but which would take a pointer one-past-the-last element in
the buffer, to perform truncation.  This is fundamentally Plan9's
strecpy(2), except that Plan9's API has a bug.

There's an implementation of stpecpy() in shadow-utils:
<https://github.com/shadow-maint/shadow/blob/214a2e6e0a5f81fa281b272be7cf9e9d3aff8f34/lib/string/strcpy/stpecpy.h#L28>

We've been using stpecpy() quite extensively in shadow-utils, and it's
a great API.  Of course, there's also the decades-long experience in
Plan9, which apart from their bug --which I found, by comparing their
implementation to mine--, shows that it's a quite useful API.

And stpecpy() produces the simplest code of all truncating functions.


Have a lovely day!
Alex

> This case is, of course one of the 'better ways' cases.
> 
> David
> 
> >  	snprintf(mouse->phys, sizeof(mouse->phys), "%s/input0", serio->phys);
> >  
> >  	input_dev->name = mouse->name;
> 
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]