Print drop reason from sk_skb_reason_drop

This commit extracts a drop reason from sk_skb_reason_drop(), and prints it when sk_skb_drop_reason() is called.

This function was introduced in kernel v6.11-rc1. At the same time, kfree_skb_reason()   became an inline helper which just calls  sk_skb_reason_drop().

See: torvalds/linux@ba8de79

bpf/kprobe_pwru.c

@@ -86,6 +86,7 @@ struct event_t {
 	struct tuple tuple;
 	s64 print_stack_id;
 	u64 param_second;
+	u64 param_third;
 	u32 cpu_id;
 } __attribute__((packed));
 
@@ -504,6 +505,7 @@ kprobe_skb(struct sk_buff *skb, struct pt_regs *ctx, bool has_get_func_ip, u64 *
 	event.skb_addr = (u64) skb;
 	event.addr = has_get_func_ip ? bpf_get_func_ip(ctx) : PT_REGS_IP(ctx);
 	event.param_second = PT_REGS_PARM2(ctx);
+	event.param_third = PT_REGS_PARM3(ctx);
 	if (CFG.output_caller)
 		bpf_probe_read_kernel(&event.caller_addr, sizeof(event.caller_addr), (void *)PT_REGS_SP(ctx));
 

internal/pwru/output.go

@@ -351,6 +351,12 @@ func getOutFuncName(o *output, event *Event, addr uint64) string {
 		} else {
 			outFuncName = fmt.Sprintf("%s (%d)", funcName, event.ParamSecond)
 		}
+	} else if funcName == "sk_skb_reason_drop" {
+		if reason, ok := o.kfreeReasons[event.ParamThird]; ok {
+			outFuncName = fmt.Sprintf("%s(%s)", funcName, reason)
+		} else {
+			outFuncName = fmt.Sprintf("%s (%d)", funcName, event.ParamThird)
+		}
 	}
 
 	if event.Type != eventTypeKprobe {
@@ -478,8 +484,11 @@ func addrToStr(proto uint16, addr [16]byte) string {
 // defined in /include/net/dropreason.h.
 func getKFreeSKBReasons(spec *btf.Spec) (map[uint64]string, error) {
 	if _, err := spec.AnyTypeByName("kfree_skb_reason"); err != nil {
-		// Kernel is too old to have kfree_skb_reason
-		return nil, nil
+		if _, err := spec.AnyTypeByName("sk_skb_reason_drop"); err != nil {
+			// Kernel is too old to have either kfree_skb_reason or sk_skb_reason_drop
+			// see https://github.com/torvalds/linux/commit/ba8de796baf4bdc03530774fb284fe3c97875566
+			return nil, nil
+		}
 	}
 
 	var dropReasonsEnum *btf.Enum

internal/pwru/types.go

@@ -150,5 +150,6 @@ type Event struct {
 	Tuple         Tuple
 	PrintStackId  int64
 	ParamSecond   uint64
+	ParamThird    uint64
 	CPU           uint32
 }