diff options
| author | Jaeyeong Lee <[email protected]> | 2026-08-29 20:48:24 +0900 |
|---|---|---|
| committer | Rbb666 <[email protected]> | 2026-10-11 17:37:11 +0800 |
| commit | 8a3ca7bfa3fb0b779fe24fd912a3a72cc2aeb59d (patch) | |
| tree | 3c816b64788d3f5bb77372fe1804e63a2a60eb90 /components/net/netdev | |
| parent | 3577e7a6ed0f183534e207179de5251e155fd49e (diff) | |
fix[usb]: stop aliasing rt_ringbuffer as rt_serial_rx_fifo in VCOM
With RT_USB_DEVICE_CDC and RT_USING_SERIAL_V2 both enabled, _function_enable
assigned the embedded rx_ringbuffer to serial.serial_rx. Serial V2 reads that
pointer as a struct rt_serial_rx_fifo, whose first member is a rt_ringbuffer,
so ring-buffer access happened to work while rx_cpt, rx_cpt_index and
rx_timeout landed on the following members of struct vcom, corrupting tx_rbp.
The layout shifts again with RT_SERIAL_USING_DMA, which inserts dma_ping_rb
ahead of those fields.
Serial V2 already owns the receive FIFO: dev_serial_v2.c allocates it with
rt_malloc on open and releases it with rt_free on close, so the assignment
also made rt_free run on memory inside struct vcom.
Drop the assignment and read the FIFO Serial V2 owns. rt_hw_serial_isr
reports RX_IND from serial_rx->rb, so the endpoint handler now fills that
ring buffer and _vcom_getc drains it. The Serial V1 path is unchanged.
Fixes #11739
Signed-off-by: Jaeyeong Lee <[email protected]>
Diffstat (limited to 'components/net/netdev')
0 files changed, 0 insertions, 0 deletions
