Re: [PATCH] net: usb: lg-vl600: fix Ethernet header on fragmented RX packets

[Simon Horman]

On Mon, Aug 10, 2026 at 04:44:35PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@xxxxxxxxxxxxx>
> 
> The LG VL600 RX path can assemble one device frame from multiple USB RX
> URBs.  In the single-URB case, the input skb passed by usbnet is also the
> buffer being parsed, so @skb and @buf point to the same skb.
> 
> When a frame is completed from current_rx_buf, however, @buf points to
> the assembled skb while @skb still points to the last URB fragment.
> vl600_rx_fixup() returns @buf to the network stack in that path, but it
> currently obtains the Ethernet header from @skb.
> 
> As a result, the source/destination address fixups and the IPv6 ethertype
> fixup can be applied to the final fragment instead of the assembled skb
> that is actually delivered.  Use @buf for the Ethernet header so the
> fixups are applied to the packet being parsed and returned.
> 
> This has likely gone unnoticed because the common single-URB path has
> @skb == @buf and therefore behaves correctly.
> 
> Fixes: 7a635ea98999 ("net/usb: Ethernet quirks for the LG-VL600 4G modem")
> Signed-off-by: Xu Rao <raoxu@xxxxxxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>