When eBPF task->stack->pt_regs reads return garbage on the latest Linux kernels, blame Fred!

TLDR; Starting from Linux kernel version 6.9 on x86_64, there&rsquo;s a new config option CONFIG_X86_FRED enabled and it adds 16 bytes to the starting point of a task&rsquo;s kernel stack area, so you&rsquo;ll need to account for this extra padding in your &ldquo;raw&rdquo; kernel stack & pt_regs lookup code. Update: It turns out that there&rsquo;s a bpf_task_pt_regs() helper function available in…