[PATCH] net: usb: lg-vl600: fix Ethernet header on fragmented RX packets

[PATCH] net: usb: lg-vl600: fix Ethernet header on fragmented RX packets

[raoxu]

From: Xu Rao <raoxu@uniontech.com>

The LG VL600 RX path can assemble one device frame from multiple USB RX
URBs.  In the single-URB case, the input skb passed by usbnet is also the
buffer being parsed, so @skb and @buf point to the same skb.

When a frame is completed from current_rx_buf, however, @buf points to
the assembled skb while @skb still points to the last URB fragment.
vl600_rx_fixup() returns @buf to the network stack in that path, but it
currently obtains the Ethernet header from @skb.

As a result, the source/destination address fixups and the IPv6 ethertype
fixup can be applied to the final fragment instead of the assembled skb
that is actually delivered.  Use @buf for the Ethernet header so the
fixups are applied to the packet being parsed and returned.

This has likely gone unnoticed because the common single-URB path has
@skb == @buf and therefore behaves correctly.

Fixes: 7a635ea98999 ("net/usb: Ethernet quirks for the LG-VL600 4G modem")
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 drivers/net/usb/lg-vl600.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/lg-vl600.c b/drivers/net/usb/lg-vl600.c
index c4ad2d9f6f4f..d6b2e3e3d950 100644
--- a/drivers/net/usb/lg-vl600.c
+++ b/drivers/net/usb/lg-vl600.c
@@ -172,7 +172,7 @@ static int vl600_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 		 * the h_proto field is in the same place so we just leave it
 		 * alone and fill in the remaining fields.
 		 */
-		ethhdr = (struct ethhdr *) skb->data;
+		ethhdr = (struct ethhdr *)buf->data;
 		if (be16_to_cpup(&ethhdr->h_proto) == ETH_P_ARP &&
 				buf->len > 0x26) {
 			/* Copy the addresses from packet contents */
--
2.50.1

Re: [PATCH] net: usb: lg-vl600: fix Ethernet header on fragmented RX packets

[Simon Horman]

On Mon, Aug 10, 2026 at 04:44:35PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> The LG VL600 RX path can assemble one device frame from multiple USB RX
> URBs.  In the single-URB case, the input skb passed by usbnet is also the
> buffer being parsed, so @skb and @buf point to the same skb.
> 
> When a frame is completed from current_rx_buf, however, @buf points to
> the assembled skb while @skb still points to the last URB fragment.
> vl600_rx_fixup() returns @buf to the network stack in that path, but it
> currently obtains the Ethernet header from @skb.
> 
> As a result, the source/destination address fixups and the IPv6 ethertype
> fixup can be applied to the final fragment instead of the assembled skb
> that is actually delivered.  Use @buf for the Ethernet header so the
> fixups are applied to the packet being parsed and returned.
> 
> This has likely gone unnoticed because the common single-URB path has
> @skb == @buf and therefore behaves correctly.
> 
> Fixes: 7a635ea98999 ("net/usb: Ethernet quirks for the LG-VL600 4G modem")
> Signed-off-by: Xu Rao <raoxu@uniontech.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH] net: usb: lg-vl600: fix Ethernet header on fragmented RX packets

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 10 Aug 2026 16:44:35 +0800 you wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> The LG VL600 RX path can assemble one device frame from multiple USB RX
> URBs.  In the single-URB case, the input skb passed by usbnet is also the
> buffer being parsed, so @skb and @buf point to the same skb.
> 
> When a frame is completed from current_rx_buf, however, @buf points to
> the assembled skb while @skb still points to the last URB fragment.
> vl600_rx_fixup() returns @buf to the network stack in that path, but it
> currently obtains the Ethernet header from @skb.
> 
> [...]

Here is the summary with links:
  - net: usb: lg-vl600: fix Ethernet header on fragmented RX packets
    https://git.kernel.org/netdev/net-next/c/4f93b12cf7b2

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html