On 28 April 2016 at 21:20, Mateusz Guzik <mgu...@redhat.com> wrote: > In this case get_cmdline in mm/util.c should also be patched for > completness. It tests for arg_end, but later accesses env_end.
But it'll do this only when argv[] was modified from what the kernel initially wrote, which, in turn, either requires the process to have started executing and messing with it's own argv[] or another process poking at it via ptrace(). In the former case env_end will be non-zero already and I don't know if the latter case is actually possible, i.e. if one can already attach to a process this early. If one can, then yes, that place needs to be modified, too. Thanks, Mathias