From: Daniel Borkmann <daniel@iogearbox.net>
Date: Mon, 07 Sep 2015 16:54:46 +0200

On 08/17/2015 11:02 PM, David Miller wrote:
...

quoted

I would seriously rather see us do an expensive full copy of the SKB
than to have traffic which is unexpectedly invisible to taps.

I've been looking into this issue a bit further, so the copy for the
tap seems doable, but while further going through the code to find
similar
issues elsewhere, and doing some experiments, it looks like we write
shared info also in some edge-cases of upcalls such as nfqueue or ovs
when mmaped netlink is used for rx. I did a test with nfqueue using
the libmnl mmap branch [1].

Honestly if it's something isolated to something like nf_queue it can
be contained to just being a special fix there.

nf_queue is usually very special and needs hacks to handle things
properly since it acts as an "escape" point for various SKB things.

But if it's in OVS too....

I guess we need a more generic fix.