Hi Dave,
this patch fixes offset calculation in skb_copy_expand.

        head_copy_len = skb_headroom(skb);
        head_copy_off = 0;
        if (newheadroom < head_copy_len) {
                head_copy_off = head_copy_len - newheadroom;
                head_copy_len = newheadroom;
        }
 
        /* Copy the linear header and data. */
        if (skb_copy_bits(skb, -head_copy_len, n->head + head_copy_off,
                          skb->len + head_copy_len))


It looks like it is intended to copy as much as possible, cutting off
bytes at the beginning is there is not enough room. For the case
newheadroom < head_copy_len that means it needs to copy newheadroom
bytes from skb->data - newheadroom to n->head, so head_copy_off
needs to be 0. I don't know how the data copied is used later on
but I assume it is intended to stay continous. That means in
the case that newheadroom > skb_headroom(skb) we need to copy
skb_headroom(skb) bytes to n->head + newheadroom - skb_headroom(skb),
so head_copy_off becomes newheadroom - head_copy_len.

In the patch the case newheadroom == skb_headroom(skb) is handled with
the first condition to save either a jump or a subtraction.

The patch is verified to fix the problem that led me to this, ipt_REJECT
produced broken RSTs which triggered the "ipt_hook: happy cracking!"
line in ip_conntrack_standalone.c.

Best regards,
Patrick