RT-Thread Version
v5.3.0
Affected area
Device drivers
Hardware/BSP vendor
Not applicable / Other
Architecture
Not applicable / Other
Board and hardware details
Not board-specific. The issue is in the common legacy USB CDC VCOM and Serial V2 code. It can affect BSPs that provide a USB device controller with RT_USB_DEVICE_CDC and RT_USING_SERIAL_V2 enabled
Develop Toolchain
Other
Describe the bug
When RT_USB_DEVICE_CDC and RT_USING_SERIAL_V2 are enabled, _function_enable() replaces serial_rx with the address of an embedded struct rt_ringbuffer:
data->serial.serial_rx = &data->rx_ringbuffer;
Serial V2 later interprets serial_rx as a struct rt_serial_rx_fifo *. Although rt_ringbuffer is the first member of rt_serial_rx_fifo, the embedded VCOM ring buffer is not contained in an rt_serial_rx_fifo object.
As a result, accesses to fields such as rx_cpt, rx_cpt_index, and rx_timeout go beyond data->rx_ringbuffer and can overwrite adjacent members such as data->tx_rbp. The serial close path may also call rt_free() on this embedded ring-buffer address even though it was not dynamically allocated.
The assignment can overwrite the valid RX FIFO allocated when the serial device was opened, making the problem reachable after the USB host configures the CDC device.
Contribution
Ijae Kim (ijk5201@psu.edu), Myeonghun Pak (mhun512@gmail.com), Yuho Choi (yqc5929@psu.edu), Taegyu Kim (tgkim@psu.edu)
Other additional context
No response
RT-Thread Version
v5.3.0
Affected area
Device drivers
Hardware/BSP vendor
Not applicable / Other
Architecture
Not applicable / Other
Board and hardware details
Not board-specific. The issue is in the common legacy USB CDC VCOM and Serial V2 code. It can affect BSPs that provide a USB device controller with RT_USB_DEVICE_CDC and RT_USING_SERIAL_V2 enabled
Develop Toolchain
Other
Describe the bug
When RT_USB_DEVICE_CDC and RT_USING_SERIAL_V2 are enabled, _function_enable() replaces serial_rx with the address of an embedded struct rt_ringbuffer:
Serial V2 later interprets serial_rx as a struct rt_serial_rx_fifo *. Although rt_ringbuffer is the first member of rt_serial_rx_fifo, the embedded VCOM ring buffer is not contained in an rt_serial_rx_fifo object.
As a result, accesses to fields such as rx_cpt, rx_cpt_index, and rx_timeout go beyond data->rx_ringbuffer and can overwrite adjacent members such as data->tx_rbp. The serial close path may also call rt_free() on this embedded ring-buffer address even though it was not dynamically allocated.
The assignment can overwrite the valid RX FIFO allocated when the serial device was opened, making the problem reachable after the USB host configures the CDC device.
Contribution
Ijae Kim (ijk5201@psu.edu), Myeonghun Pak (mhun512@gmail.com), Yuho Choi (yqc5929@psu.edu), Taegyu Kim (tgkim@psu.edu)
Other additional context
No response