How to read kernel variable content using bpf?

--------------------------------test.c--------------------------------

#include
#include
#include
#include
#include
#include
#include
#include
#include
#include

#define TCP 6
#define UDP 17

void trace_start(struct pt_regs *ctx, struct sk_buff *skb, bool pfmemalloc) {
u64 ts = 0;
struct sock * sk = skb->sk;
u16 dport = skb->sk->__sk_common.skc_dport;
u16 port = ntohs(dport);
bpf_trace_printk("%u \n", port);
}

--------------------------------test.py--------------------------------

from __future__ import print_function
from bcc import BPF

import sys
import socket
import os
import struct

b = BPF(src_file="test.c")
b.attach_kprobe(event="udp_send_skb", fn_name="trace_start")

while 1:
(task, pid, cpu, flags, ts, msg) = b.trace_fields()
print("%s " % (msg))

However, the struct sock* sk is NULL and the port is always 0. The struct sk_buff *skb is not NULL. Can anyone tell me how to access the content of variables in the kernel? Thanks.

Start with test.c, especially trace_start and its skb access, then inspect test.py where udp_send_skb is attached and trace_fields() reads output. Run test.py against the relevant kernel activity and verify whether the socket and destination port can be read reliably; the issue is done when the observed kernel variable content is correctly reported.

Written by the indexing model from the issue text.