net: usb: lg-vl600: fix Ethernet header on fragmented RX packets

The LG VL600 RX path can assemble one device frame from multiple USB RX
URBs.  In the single-URB case, the input skb passed by usbnet is also the
buffer being parsed, so @skb and @buf point to the same skb.

When a frame is completed from current_rx_buf, however, @buf points to
the assembled skb while @skb still points to the last URB fragment.
vl600_rx_fixup() returns @buf to the network stack in that path, but it
currently obtains the Ethernet header from @skb.

As a result, the source/destination address fixups and the IPv6 ethertype
fixup can be applied to the final fragment instead of the assembled skb
that is actually delivered.  Use @buf for the Ethernet header so the
fixups are applied to the packet being parsed and returned.

This has likely gone unnoticed because the common single-URB path has
@skb == @buf and therefore behaves correctly.

Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/30CC616506DE5BC4+20260810084435.2099229-1-raoxu@uniontech.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

0 files changed, 0 insertions, 0 deletions