On Fri, Nov 05, 2021 at 10:41:40AM +0000, Lorenz Bauer wrote: > > bpf-next with f30d4968e9ae on top: > > works! Awesome. > commit 3e8ce29850f1 ("bpf: Prevent pointer mismatch in > bpf_timer_init.") (found via bisection): > > BPF program is too large. Processed 1000001 insn > > commit 3e8ce29850f1^ ("bpf: Add map side support for bpf timers."): > > works! So with just 3e8ce29850f1 it's "too large" and with parent commit it works ? I've analyzed offending commit again and don't see how it can be causing state pruning to be more conservative for your asm. reg->map_uid should only be non-zero for lookups from inner maps, but your asm doesn't have lookups at all in that loop. Maybe in some case map_uid doesn't get cleared, but I couldn't find such code path with manual code analysis. I think it's worth investigating further. Please craft a reproducer.