Module: xenomai-2.6
Branch: master
Commit: 3bd10539f01b5dfb2eaddcadd030275fd04c67a0

Author: Paul Janzen <>
Date:   Sun Mar 17 11:56:46 2013 -0700

rtcan_module: Fix tx_timeout buffer size inconsistency

When formatting /proc/rtcan/sockets, tx_timeout is defined as
char[16], but a length of 20 is passed to rtcan_get_timeout_name. If
tx_timeout for any socket is infinite, this causes snprintf to zero
outside the buffer, leading to stack overflow and a kernel panic.
Make the tx_timeout buffer 20 bytes long instead.

Signed-off-by: Paul Janzen <>
Acked-by: Wolfgang Grandegger <>


 ksrc/drivers/can/rtcan_module.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/ksrc/drivers/can/rtcan_module.c b/ksrc/drivers/can/rtcan_module.c
index 3ebc333..f270f65 100644
--- a/ksrc/drivers/can/rtcan_module.c
+++ b/ksrc/drivers/can/rtcan_module.c
@@ -165,7 +165,7 @@ static int rtcan_read_proc_sockets(char *buf, char **start, 
off_t offset,
     struct rtdm_dev_context *context;
     struct rtcan_device *dev;
     char name[IFNAMSIZ] = "not-bound";
-    char rx_timeout[20], tx_timeout[16];
+    char rx_timeout[20], tx_timeout[20];
     rtdm_lockctx_t lock_ctx;
     int ifindex;

Xenomai-git mailing list

Reply via email to