Function provider_ancestor 

pub fn provider_ancestor(
    table: &[Proc],
    pid: u32,
    provider: &str,
) -> Option<u32>

Walks from pid up the parent chain; returns the nearest process whose image is the provider.