3 ms·
Interesting that procfs reads directly from userspace memory to answer queries from /proc/{pid}/cmdline. I wonder what happens if someone unmaps the memory cont
by 10000truths 4y ago
Interesting that procfs reads directly from userspace memory to answer queries from /proc/{pid}/cmdline. I wonder what happens if someone unmaps the memory containing those argv/envp strings?
- chenxiaolong 4y agoI just gave it a try in gdb on a C program with an empty main(). The argv/envp data was in this range: 7ffffffdd000-7ffffffff000 rw-p 00000000 00:00 0 [stack] Running `call (int) munmap(0x7ffffffdd000, 0x22000)` in gdb did indeed unmap the stack... and the program segfaulted immediately afterwards. But while the process was still in the stopped state and before it finished crashing/exiting, /proc/<pid>/cmdline was a 0-byte file.