On Thu, 2026-10-08 at 19:36 -0400, David Windsor wrote:
> Commit f597664454bd ("bpf: bpf_scc_visit instance and backedges
> accumulation for bpf_loop()") left dead stack slots in cached callback
> states while SCC backedges were pending, defeating state pruning and
> causing previously valid programs to hit the verifier instruction limit. On
> affected kernels, ActPlane fails to load with -E2BIG.
>
> Removing the incomplete_read_marks() check from clean_live_states() is
> safe because zero-branch states have already had their stack read/write
> effects propagated into the liveness masks consumed by
> clean_verifier_state(). Pending SCC backedges only defer verifier-state
> precision propagation and cannot add stack-liveness requirements after
> cleanup.
The patch does not apply, clean_live_states() no longer exists.
Also, before submitting v2, please re-read the series [1] in order to
understand the motivation for the change. States w/o branches can
still contribute their precision marks to their parent states,
in case if these states form a loop on a state graph.
The loops are formed on e.g. iterator or callback-based loops convergence.
[1]
https://lore.kernel.org/bpf/[email protected]/
pw-bot: cr.
>
> Fixes: f597664454bd ("bpf: bpf_scc_visit instance and backedges accumulation
> for bpf_loop()")
>
> Signed-off-by: David Windsor <[email protected]>
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index
> e3814152b52f8139a5565b2e4ac1b80d82d1ea65..1e300ca71a8a833eb4c2a340b4f94342f54af5f2
> 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -19791,8 +19791,6 @@ static void clean_live_states(struct bpf_verifier_env
> *env, int insn,
> if (sl->state.cleaned)
> /* all regs in this state in all frames were already
> marked */
> continue;
> - if (incomplete_read_marks(env, &sl->state))
> - continue;
> clean_verifier_state(env, &sl->state);
> }
> }
