invalid bpf_context access off=2784 size=4 (2 line(s) omitted)

[linliaoy]

struct {
  __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
} output_events SEC(".maps");

struct data_t {
    u32 pid;
    u32 tgid;
    u64 currtime;
};

SEC("tracepoint/sched/sched_wakeup")
  int trace_sched_wakeup(struct task_struct *ctx) {
      u64 ts = bpf_ktime_get_ns();
      struct data_t data ;
      data.pid = ctx->pid;
      data.tgid = ctx->tgid;
      data.delta_us = ts;
      //bpf_perf_event_output((struct pt_regs *)ctx, &output_events,BPF_F_CURRENT_CPU, &data, sizeof(data));
      //return trace_enqueue(p->tgid, p->pid,p);
    return 0;
}

I use cilium/ebpf, inside the k8s pod
I reported an error when I used bpf_perf_event_output. It can be closed and executed normally。
I was in a container that was privileged。
I don't know why？

[linliaoy]

I figured out the problem，There is a problem with &data.

[linliaoy]

But I want to use data_t struct

[linliaoy]

int trace_sched_wakeup(struct trace_event_raw_sched_wakeup_template *ctx)
trace_sched_wakeup should be passed using the struct in format
/sys/kernel/debug/tracing/events/sched/sched_wakeup/format