get pid from sk_buff using proper wrapper function

Question

This is a follow up question of Getting PID from sk_buff and inode in Linux Kernel, And since I cannot comment under the answer, so here I am..

The answer is skb->sk->socket->file->f_owner->pid.

I'm asking because I had a hunch that it's error-prone to directly handling data using pointer in kernel space.

I have googled this but nothing useful came up.

Any help or suggestions would be appreciated.

By the way, the kernel version is 4.4 or 3.10. A solution based on the latest kernel headers is also fine.

score 1 · Answer 1 · edited Aug 28 '21 at 07:41

Since I'm working with 5.10.28 and Debian 11 this week, that's the solution you get. :-@) This comment from /usr/include/linux/pid.h (or debian/linux-headers/usr/src/linux-headers-5.10.28/include/linux/pid.h if you prefer) tells it better than I ever could on my own:

/*
 * What is struct pid?
 *
 * A struct pid is the kernel's internal notion of a process identifier.
 * It refers to individual tasks, process groups, and sessions.  While
 * there are processes attached to it the struct pid lives in a hash
 * table, so it and then the processes that it refers to can be found
 * quickly from the numeric pid value.  The attached processes may be
 * quickly accessed by following pointers from struct pid.
 *
 * Storing pid_t values in the kernel and referring to them later has a
 * problem.  The process originally with that pid may have exited and the
 * pid allocator wrapped, and another process could have come along
 * and been assigned that pid.
 *
 * Referring to user space processes by holding a reference to struct
 * task_struct has a problem.  When the user space process exits
 * the now useless task_struct is still kept.  A task_struct plus a
 * stack consumes around 10K of low kernel memory.  More precisely
 * this is THREAD_SIZE + sizeof(struct task_struct).  By comparison
 * a struct pid is about 64 bytes.
 *
 * Holding a reference to struct pid solves both of these problems.
 * It is small so holding a reference does not consume a lot of
 * resources, and since a new struct pid is allocated when the numeric pid
 * value is reused (when pids wrap around) we don't mistakenly refer to new
 * processes.
 */

Inspecting pid.h shows some utilities which will be helpful to you, if you are up to handling this in kernel space (given the dark warnings above, the need to understand namespaces a little bit, etc.). Your sk_buff holds a pointer to a struct pid, not just an integer pid, and could be of a userspace process that is now gone since you're in kernel space. Your best bet will be something like:

#include <pid.h>

struct pid *myspid;
pid_t mypid;

myspid = get_pid(skb->sk->socket->file->f_owner->pid);
if (myspid == NULL)
    /* forget it */
mypid = pid_nr(myspid);
return mypid;

but there will certainly be more to it than that. Just putting you into the ballpark.

Thanks for your input. I was actually looking for a way to get the `struct pid` from `struct sk_buff`. Manipulating data directly using pointers would result in kernel panic, hence the question. But I have found out that the pid information from `struct pid` represents the designated **receiver** of data from the socket rather than the actual **owner of the socket file**. Thank you anyway. — Newt, Jun 28 '21 at 08:00

get pid from sk_buff using proper wrapper function

1 Answers1