fix(core): fix usb vcp buffer size on stm32f4
What the developer wrote
Authored by cepetr
fix(core): fix usb vcp buffer size on stm32f4
[no changelog]
What changed, and why it matters
This commit fixes a USB communication bug in Trezor hardware wallets that use a high-speed USB chip running in full-speed mode. The device was incorrectly advertising a 512-byte packet size when it should have used 64 bytes. This mismatch could cause USB data corruption or connection failures, but the change is a straightforward buffer-size correction with no direct evidence of exploitability for theft of funds or private keys.
Treat as a reliability/correctness fix. Include in the next firmware release. If a device with this configuration was already shipped, assess whether USB VCP failures could have affected firmware update or debug workflows. No immediate user action is required beyond normal updates.
Security signals we found
Buffer size mismatch between declared USB endpoint max packet size and actual bus speed
Potential memory corruption or data truncation in USB VCP path
Peripheral-specific fix for STM32F4 high-speed USB used in full-speed mode
Evidence from the diff
The patch changes the VCP (Virtual COM Port) packet length definition in core/embed/io/usb/usb_config.c. Previously, any build with USE_USB_HS defined selected a 512-byte VCP_PACKET_LEN. The fix distinguishes between a high-speed USB peripheral actually running in high-speed mode (512 bytes) and the same peripheral running in full-speed mode (64 bytes) via the USE_USB_HS_IN_FS flag. This prevents a mismatch between the configured endpoint max packet size and the actual bus speed, which could lead to buffer overruns, dropped packets, or unreliable USB serial communication on affected STM32F4-based Trezor devices.
Changed components
core/embed/io/usb/usb_config.cUSB Virtual COM Port (VCP) interfaceSTM32F4-based Trezor devices with high-speed USB peripheral operating in full-speed modeInspect captured patch +4 / −2
diff --git a/core/embed/io/usb/usb_config.c b/core/embed/io/usb/usb_config.c
index 512e6379b..48b149749 100644
--- a/core/embed/io/usb/usb_config.c
+++ b/core/embed/io/usb/usb_config.c
@@ -213,8 +213,10 @@ static secbool usb_webauthn_iface_init(uint8_t *iface_num) {
}
#endif // USE_USB_IFACE_WEBAUTHN
-#if defined(USE_USB_HS)
-#define VCP_PACKET_LEN 512
+#if defined(USE_USB_HS) && !defined(USE_USB_HS_IN_FS)
+#define VCP_PACKET_LEN 512 // HS periperal in HS mode
+#elif defined(USE_USB_HS) && defined(USE_USB_HS_IN_FS)
+#define VCP_PACKET_LEN 64 // HS peripheral in FS mode
#elif defined(USE_USB_FS)
#define VCP_PACKET_LEN 64
#elif defined(TREZOR_EMULATOR)
Why this scored 33/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.