Re: [PATCH bpf 1/2] bpf: Fix state pruning regression in bpf_loop() callbacks

[Eduard Zingerman <eddyz87@gmail.com>]

On Thu, 2026-10-08 at 19:36 -0400, David Windsor wrote:
> Commit f597664454bd ("bpf: bpf_scc_visit instance and backedges
> accumulation for bpf_loop()") left dead stack slots in cached callback
> states while SCC backedges were pending, defeating state pruning and
> causing previously valid programs to hit the verifier instruction limit. On
> affected kernels, ActPlane fails to load with -E2BIG.
> 
> Removing the incomplete_read_marks() check from clean_live_states() is
> safe because zero-branch states have already had their stack read/write
> effects propagated into the liveness masks consumed by
> clean_verifier_state(). Pending SCC backedges only defer verifier-state
> precision propagation and cannot add stack-liveness requirements after
> cleanup.

The patch does not apply, clean_live_states() no longer exists.
Also, before submitting v2, please re-read the series [1] in order to
understand the motivation for the change. States w/o branches can
still contribute their precision marks to their parent states,
in case if these states form a loop on a state graph.
The loops are formed on e.g. iterator or callback-based loops convergence.

[1] https://lore.kernel.org/bpf/20251229-scc-for-callbacks-v1-0-ceadfe679900@gmail.com/

pw-bot: cr.

> 
> Fixes: f597664454bd ("bpf: bpf_scc_visit instance and backedges accumulation for bpf_loop()")
> 
> Signed-off-by: David Windsor <dwindsor@gmail.com>
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index e3814152b52f8139a5565b2e4ac1b80d82d1ea65..1e300ca71a8a833eb4c2a340b4f94342f54af5f2 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -19791,8 +19791,6 @@ static void clean_live_states(struct bpf_verifier_env *env, int insn,
>  		if (sl->state.cleaned)
>  			/* all regs in this state in all frames were already marked */
>  			continue;
> -		if (incomplete_read_marks(env, &sl->state))
> -			continue;
>  		clean_verifier_state(env, &sl->state);
>  	}
>  }