RT-Thread Version

v5.3.0

Affected area

Device drivers

Hardware/BSP vendor

Not applicable / Other

Architecture

Not applicable / Other

Board and hardware details

Not board-specific. The issue is in the common legacy USB CDC VCOM and Serial V2 code. It can affect BSPs that provide a USB device controller with RT_USB_DEVICE_CDC and RT_USING_SERIAL_V2 enabled

Develop Toolchain

Other

Describe the bug

When RT_USB_DEVICE_CDC and RT_USING_SERIAL_V2 are enabled, _function_enable() replaces serial_rx with the address of an embedded struct rt_ringbuffer:

data->serial.serial_rx = &data->rx_ringbuffer;

Serial V2 later interprets serial_rx as a struct rt_serial_rx_fifo *. Although rt_ringbuffer is the first member of rt_serial_rx_fifo, the embedded VCOM ring buffer is not contained in an rt_serial_rx_fifo object.

As a result, accesses to fields such as rx_cpt, rx_cpt_index, and rx_timeout go beyond data->rx_ringbuffer and can overwrite adjacent members such as data->tx_rbp. The serial close path may also call rt_free() on this embedded ring-buffer address even though it was not dynamically allocated.

The assignment can overwrite the valid RX FIFO allocated when the serial device was opened, making the problem reachable after the USB host configures the CDC device.

Contribution

Ijae Kim (ijk5201@psu.edu), Myeonghun Pak (mhun512@gmail.com), Yuho Choi (yqc5929@psu.edu), Taegyu Kim (tgkim@psu.edu)

Other additional context

No response