From: Xu Rao <raoxu@uniontech.com>

The LG VL600 RX path can assemble one device frame from multiple USB RX
URBs.  In the single-URB case, the input skb passed by usbnet is also the
buffer being parsed, so @skb and @buf point to the same skb.

When a frame is completed from current_rx_buf, however, @buf points to
the assembled skb while @skb still points to the last URB fragment.
vl600_rx_fixup() returns @buf to the network stack in that path, but it
currently obtains the Ethernet header from @skb.

As a result, the source/destination address fixups and the IPv6 ethertype
fixup can be applied to the final fragment instead of the assembled skb
that is actually delivered.  Use @buf for the Ethernet header so the
fixups are applied to the packet being parsed and returned.

This has likely gone unnoticed because the common single-URB path has
@skb == @buf and therefore behaves correctly.

Fixes: 7a635ea98999 ("net/usb: Ethernet quirks for the LG-VL600 4G modem")
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 drivers/net/usb/lg-vl600.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/lg-vl600.c b/drivers/net/usb/lg-vl600.c
index c4ad2d9f6f4f..d6b2e3e3d950 100644
--- a/drivers/net/usb/lg-vl600.c
+++ b/drivers/net/usb/lg-vl600.c
@@ -172,7 +172,7 @@ static int vl600_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 		 * the h_proto field is in the same place so we just leave it
 		 * alone and fill in the remaining fields.
 		 */
-		ethhdr = (struct ethhdr *) skb->data;
+		ethhdr = (struct ethhdr *)buf->data;
 		if (be16_to_cpup(&ethhdr->h_proto) == ETH_P_ARP &&
 				buf->len > 0x26) {
 			/* Copy the addresses from packet contents */
--
2.50.1

On Mon, Aug 10, 2026 at 04:44:35PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> The LG VL600 RX path can assemble one device frame from multiple USB RX
> URBs.  In the single-URB case, the input skb passed by usbnet is also the
> buffer being parsed, so @skb and @buf point to the same skb.
> 
> When a frame is completed from current_rx_buf, however, @buf points to
> the assembled skb while @skb still points to the last URB fragment.
> vl600_rx_fixup() returns @buf to the network stack in that path, but it
> currently obtains the Ethernet header from @skb.
> 
> As a result, the source/destination address fixups and the IPv6 ethertype
> fixup can be applied to the final fragment instead of the assembled skb
> that is actually delivered.  Use @buf for the Ethernet header so the
> fixups are applied to the packet being parsed and returned.
> 
> This has likely gone unnoticed because the common single-URB path has
> @skb == @buf and therefore behaves correctly.
> 
> Fixes: 7a635ea98999 ("net/usb: Ethernet quirks for the LG-VL600 4G modem")
> Signed-off-by: Xu Rao <raoxu@uniontech.com>

Reviewed-by: Simon Horman <horms@kernel.org>