fix(driver): fixed build against linux 6.11.

[FedeDP]

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area driver-bpf
/area driver-modern-bpf

Does this PR require a change in the driver versions?

What this PR does / why we need it:

Fixes build against latest linux 6.11-rc{1...4}; the breaking commit is: torvalds/linux@3aa63a5

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

fix(driver): fixed build against linux 6.11.

/hold for now, until we are at least at rc6, as always.

[FedeDP]

/milestone next-driver

[github-actions]

Please double check driver/SCHEMA_VERSION file. See versioning.

/hold

[github-actions]

Perf diff from master - unit tests

     6.06%     +1.17%  [.] sinsp::next
     3.30%     -1.16%  [.] scap_event_decode_params
     4.03%     +0.89%  [.] sinsp_evt::load_params
    10.36%     -0.78%  [.] sinsp_parser::reset
     1.82%     -0.60%  [.] std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char const*>
     1.18%     -0.59%  [.] thread_group_info::get_first_thread
     4.20%     +0.49%  [.] sinsp_parser::process_event
     0.28%     +0.44%  [.] get_event_param_as<long>
     1.67%     +0.42%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release
     1.63%     -0.41%  [.] libsinsp::events::is_unknown_event

Perf diff from master - scap file

     2.98%     +9.44%  [.] sinsp_filter_check_event::extract_single
    20.62%     -7.88%  [.] sinsp_filter_check::tostring
     2.98%     +3.96%  [.] sinsp_filter_check_thread::extract_single
    14.76%     -3.62%  [.] sinsp_filter_check::extract_nocache
     8.77%     -2.37%  [.] std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char const*>
     5.94%     -2.10%  [.] formatted_dump
     2.98%     +1.52%  [.] 0x00000000000a77d4
     2.98%     +1.49%  [.] sinsp::fetch_next_event
     2.98%     -1.43%  [.] sinsp_filter_check::get_field_info
     8.93%     -0.46%  [.] sinsp_evt_formatter::tostring_withformat

Heap diff from master - unit tests

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

[FedeDP]

bpf build 🟢 : https://github.com/falcosecurity/libs/actions/runs/10467880669/job/28987560642

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 74.12%. Comparing base (df21b63) to head (3002b3c).
Report is 57 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2011   +/-   ##
=======================================
  Coverage   74.12%   74.12%           
=======================================
  Files         253      253           
  Lines       30805    30805           
  Branches     5415     5392   -23     
=======================================
+ Hits        22834    22835    +1     
+ Misses       7967     7942   -25     
- Partials        4       28   +24     

Flag	Coverage Δ
libsinsp	74.12% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[FedeDP]

cc @mavimo

[github-actions]

X64 kernel testing matrix

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-4.19	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2-5.10	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2023-6.1	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.0	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.7	🟢	🟢	🟢	🟢	🟢	🟢
centos-3.10	🟢	🟢	🟢	🟡	🟡	🟡
centos-4.18	🟢	🟢	🟢	🟢	🟢	🟢
centos-5.14	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.17	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.8	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-3.10	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-4.14	🟢	🟢	🟢	🟢	🟢	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-5.4	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-4.15	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-5.8	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

ARM64 kernel testing matrix

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-4.14	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

[Molter73]

/lgtm

I'm a bit surprised the kernel module doesn't need changes though.

[Andreagit97]

/approve

/hold

Waiting for 6.11 to be released or at least for one of the latest RC

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, Molter73

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• driver/OWNERS [Andreagit97,FedeDP,Molter73]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[FedeDP]

@Molter73 the kmod does not need changes because we don't directly access those fields there, instead we use kernel provided APIs!

[FedeDP]

6.11-rc5 still 🟢 https://github.com/falcosecurity/libs/actions/runs/10555854333/job/29240219034

[FedeDP]

RC6 still good: https://github.com/falcosecurity/libs/actions/runs/10662927623/job/29551043728

Merging.
/unhold