On Thu, 2020-11-26 at 23:00 -0800, Yonghong Song wrote: > On 11/26/20 8:44 AM, Florent Revest wrote: > > +SEC("iter/task_file") > > +int fill_socket_owner(struct bpf_iter__task_file *ctx) > > +{ > > + struct task_struct *task = ctx->task; > > + struct file *file = ctx->file; > > + struct socket *sock; > > + int *sock_tgid; > > + > > + if (!task || !file || task->tgid != task->pid) > > task->tgid != task->pid is not needed here. > The task_file iterator already tries to skip task with task->pid > if its file table is the same as task->tgid. Good to know!