By studying the placement of the tracepoint, one can probably
identify a nearly-equivalent kprobe as a fallback, which could
be listed in the .stp file thusly:

  probe kernel.trace("kfree_skb")!, 
        kernel.function("dev_kfree_skb" /* ? */) { ... }

If parameters are needed, one'd have to split this up into
tapset/alias constructs, like this:

probe kfree_skb_1 = kernel.trace("kfree_skb") { it=$arg1 ... }
probe kfree_skb_2 = kernel.function("dev_kfree_skb") { it=$foo ... }
probe kfree_skb_1 ! , kfree_skb_2 { println (it) }

See the definition of trace point in  kfree_skb(struct sk_buff *skb)
        ...
        else if (likely(!atomic_dec_and_test(&skb->users)))
                 return;
         trace_kfree_skb(skb, __builtin_return_address(0));
         __kfree_skb(skb);
 }

Maybe we can select __kfree_skb as the probe point. But Not easy to find the
replacement for the parameter __builtin_return_address(0).
 

> [...] But Not easy to find the
> replacement for the parameter __builtin_return_address(0).

That number should be available from the backtrace, as in caller*().
... except that doesn't work except from kretprobes.  That should
be fixed.

Created attachment 4046 [details]
draft code

The return_addr of patch is almost equivalent to __builtin_return_address(0),
except for calling from some modules. For example in i386 machine, 
typical outputs will have
...
19 packets dropped at location 0xc06a9197
1 packets dropped at location 0xd112a392
...

For 0xc06a9197, return_addr() will return the same number. But 
it can't resolve 0xd112a392, will return 0.  Also the implementation 
of return_addr() doesn't depend on architecture, is to extract number 
from backtrace() string.

See commit	2de206d6b209e5e3b518f38c9991e4434940f72e for PR #10604

Thanks, I think marking it UNTESTED when there isn't a kfree_skb tracepoint is fine.