hi all: I add below function in free_uid to get which task try to free user_struct struct task_struct *p; struct cred *c; c = container_of(up,struct cred, user); p = container_of(c,struct task_struct,real_cred); printk("%s user %p, cred->user = %p p->pid = %d\n",__func__,up, c->user,p->pid); but p->pid is always 0. I think it is wrong for me to get cred and task by using container_of. 1. from kernel definition below, is it ok that member is pointer? #define container_of(ptr, type, member) 2. is there already exist macros or functions I can use for #1 above? 3. what is user_struct used for? When and under what circumstances kernel will try to release it. 4. since user_struct is allocated by kmem_cache_zalloc, is there api or tool I can monitor it? Thanks for your help,