Thanks for reviewing this and involving the IPsec maintainer.
I understand the concern about stable backports.
For the same inputs to the skb setup block, the allocation request
is unchanged, and the tail offset is equal before and after:
hh_len + (fraglen + exthdrlen - pagedlen)
== (hh_len + exthdrlen) + (fraglen - pagedlen)
The network and transport header offsets from skb->head are also
unchanged. The initial pull in __ip_make_skb() becomes unnecessary
because skb->data already points to the network header.
These are local layout checks, not a proof that the change is
semantically neutral: skb->len intentionally excludes the reserved
space, which changes the subsequent fragmentation calculations.
Also, my claim that every skb has len <= maxfraglen was too strong:
an skb can reach mtu, which may exceed maxfraglen. I will correct
that wording in the next revision.
Understood on IPv6: the corresponding variable is dst_exthdrlen.
I'll wait for the additional review before respinning.
Thanks,
Anakin