Linux 6.9+ on x86_64: New FRED Feature Adds 16 Bytes to Kernel Stack, Breaks Some eBPF Code

When eBPF task->stack->pt_regs reads return garbage on the latest Linux kernels, blame Fred! - Tanel Poder Consulting

TLDR; Starting from Linux kernel version 6.9 on x86_64, there’s a new config option CONFIG_X86_FRED enabled and it adds 16 bytes to the bottom of a task’s kernel stack area, so you’ll need to account for this extra padding in your “raw” kernel stack & pt_regs lookup code. Introduction I’ve been using Ubuntu 24.04 as my main eBPF development and testing platform without issues since its release. It is shipped with Linux kernel version 6.8.0, but Canonical recently released an optional newer kerne...