fix[usb]: stop aliasing rt_ringbuffer as rt_serial_rx_fifo in VCOM - #11770
fix[usb]: stop aliasing rt_ringbuffer as rt_serial_rx_fifo in VCOM#11770Finder16 wants to merge 1 commit into
Conversation
With RT_USB_DEVICE_CDC and RT_USING_SERIAL_V2 both enabled, _function_enable assigned the embedded rx_ringbuffer to serial.serial_rx. Serial V2 reads that pointer as a struct rt_serial_rx_fifo, whose first member is a rt_ringbuffer, so ring-buffer access happened to work while rx_cpt, rx_cpt_index and rx_timeout landed on the following members of struct vcom, corrupting tx_rbp. The layout shifts again with RT_SERIAL_USING_DMA, which inserts dma_ping_rb ahead of those fields. Serial V2 already owns the receive FIFO: dev_serial_v2.c allocates it with rt_malloc on open and releases it with rt_free on close, so the assignment also made rt_free run on memory inside struct vcom. Drop the assignment and read the FIFO Serial V2 owns. rt_hw_serial_isr reports RX_IND from serial_rx->rb, so the endpoint handler now fills that ring buffer and _vcom_getc drains it. The Serial V1 path is unchanged. Fixes RT-Thread#11739 Signed-off-by: Jaeyeong Lee <lee@jaeyeong.cc>
|
|
|
👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread! 为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。 🛠 操作步骤 | Steps
完成后，提交将自动更新至 如有问题欢迎联系我们，再次感谢您的贡献！💐 |
📌 Code Review Assignment🏷️ Tag: componentsReviewers: @Maihuanyi Changed Files (Click to expand)
📊 Current Review Status (Last Updated: 2026-08-29 20:29 CST)
📝 Review Instructions
|
2 participants
拉取/合并请求描述：(PR description)
为什么提交这份PR (why to submit this PR)
Fixes #11739
With
RT_USB_DEVICE_CDCandRT_USING_SERIAL_V2both enabled,_function_enable()assigned the embeddedrx_ringbuffertoserial.serial_rx:Serial V2 reads that pointer as a
struct rt_serial_rx_fifo *. Becausert_ringbufferis the first member ofrt_serial_rx_fifo, ring-buffer access happened to work, whilerx_cpt,rx_cpt_indexandrx_timeoutlanded on the members that followrx_ringbufferinsidestruct vcom, corruptingtx_rbp. The layout shifts again whenRT_SERIAL_USING_DMAis enabled, which insertsdma_ping_rbahead of those fields.Serial V2 already owns the receive FIFO:
dev_serial_v2.callocates it withrt_malloc()on open and releases it withrt_free()on close. The assignment therefore also overwrote the FIFO allocated at open time, and made the close path callrt_free()on memory insidestruct vcomthat was never dynamically allocated. The problem becomes reachable once the USB host configures the CDC device.你的解决方案是什么 (what is your solution)
data->serial.serial_rx = &data->rx_ringbuffer;assignment from_function_enable(), so the RX FIFO that Serial V2 allocated on open stays intact._ep_out_handler(), underRT_USING_SERIAL_V2, castserial.serial_rxtostruct rt_serial_rx_fifo *and push the received data intorx_fifo->rb, guarded againstRT_NULLfor the case where the serial device has not been opened yet. This matchesrt_hw_serial_isr(), which reportsRX_INDfromserial_rx->rb._vcom_getc(), drain the same FIFO underRT_USING_SERIAL_V2.#elsebranches, sodata->rx_ringbufferis still used whenRT_USING_SERIAL_V2is not defined.No API or Kconfig change is involved. The diff is limited to
components/legacy/usb/usbdevice/class/cdc_vcom.c(+23 / -4).请提供验证的bsp和config (provide the config and bsp)
BSP: Not board-specific. The change is in the common component
components/legacy/usb/usbdevice/class/cdc_vcom.c, which is shared by every BSP thatprovides a USB device controller. It was not verified on physical hardware. Verification
was done by code review, struct-layout analysis of
struct vcomversusstruct rt_serial_rx_fifo, and build checks. Testing on a board with a USB devicecontroller and
RT_USB_DEVICE_CDC+RT_USING_SERIAL_V2enabled is very welcome..config:
RT_USING_SERIAL_V2,RT_USB_DEVICE,RT_USB_DEVICE_CDCaction: https://github.com/Finder16/rt-thread/actions/runs/33252216932
(
qemu-vexpress-a9,sourcery-arm, branchfix/vcom-serial-v2-rx-fifo, result: success)Note: no BSP in the tree enables
RT_USB_DEVICE_CDCtogether withRT_USING_SERIAL_V2inits default
.config, socdc_vcom.cis not compiled by the BSP build CI. The linked runonly confirms that the tree still builds with this change applied. Review of the USB CDC
path itself, and testing on hardware with a USB device controller, would be appreciated.
贡献者 (Contributors)
This issue was analyzed and reported together with:
当前拉取/合并请求的状态 Intent for your PR
必须选择一项 Choose one (Mandatory):
代码质量 Code Quality：
我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:
#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up