Module: xenomai-forge
Branch: next
Commit: 5dd4e10155bdc0701ccdbf6fa44daf92924b7d28

Author: Paul Janzen <>
Date:   Sun Mar 17 11:56:46 2013 -0700

drivers/can: fix tx_timeout buffer size inconsistency

When formatting /proc/rtcan/sockets, tx_timeout is defined as
char[16], but a length of 20 is passed to rtcan_get_timeout_name. If
tx_timeout for any socket is infinite, this causes snprintf to zero
outside the buffer, leading to stack overflow and a kernel panic.
Make the tx_timeout buffer 20 bytes long instead.

Signed-off-by: Paul Janzen <>
Acked-by: Wolfgang Grandegger <>


 kernel/drivers/can/rtcan_module.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/kernel/drivers/can/rtcan_module.c 
index 3ebc333..f270f65 100644
--- a/kernel/drivers/can/rtcan_module.c
+++ b/kernel/drivers/can/rtcan_module.c
@@ -165,7 +165,7 @@ static int rtcan_read_proc_sockets(char *buf, char **start, 
off_t offset,
     struct rtdm_dev_context *context;
     struct rtcan_device *dev;
     char name[IFNAMSIZ] = "not-bound";
-    char rx_timeout[20], tx_timeout[16];
+    char rx_timeout[20], tx_timeout[20];
     rtdm_lockctx_t lock_ctx;
     int ifindex;

Xenomai-git mailing list

Reply via email to