mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-08-30 07:39:12 -04:00
4f93b12cf7
The LG VL600 RX path can assemble one device frame from multiple USB RX URBs. In the single-URB case, the input skb passed by usbnet is also the buffer being parsed, so @skb and @buf point to the same skb. When a frame is completed from current_rx_buf, however, @buf points to the assembled skb while @skb still points to the last URB fragment. vl600_rx_fixup() returns @buf to the network stack in that path, but it currently obtains the Ethernet header from @skb. As a result, the source/destination address fixups and the IPv6 ethertype fixup can be applied to the final fragment instead of the assembled skb that is actually delivered. Use @buf for the Ethernet header so the fixups are applied to the packet being parsed and returned. This has likely gone unnoticed because the common single-URB path has @skb == @buf and therefore behaves correctly. Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path Signed-off-by: Xu Rao <raoxu@uniontech.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/30CC616506DE5BC4+20260810084435.2099229-1-raoxu@uniontech.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>