Subject: Re: [PATCH net-next 2/2] net: filter: use block statements in tcpdump tests

From: Daniel Borkmann <[email-masked]>
Date: Tue, 27 May 2014 19:00:13 +0200

On 05/27/2014 08:20 AM, Alexei Starovoitov wrote:
...
>> +                       BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 2),
>> +                       BPF_STMT(BPF_MISC | BPF_TAX, 0x5), /* libpcap emits K on TAX */
>
> interesting observation. It means that libpcap doesn't init memory
> properly and other fields just have junk in them?
> and because it was doing it forever we need to accept such 'valid'
> instructions? Oh well. ok.

Hmm, doesn't look like totally random. Perhaps they're
storing some intermediate value in it or something, and
don't clear that out as we have accepted that since ever,
but that shouldn't do anything anyway here. ;)