NAME¶
/proc/pid/maps - mapped memory regions
DESCRIPTION¶
- /proc/pid/maps
- A file containing the currently mapped memory regions and their access
permissions. See mmap(2) for some further information about memory
mappings.
- Permission to access this file is governed by a ptrace access mode
PTRACE_MODE_READ_FSCREDS check; see ptrace(2).
- The format of the file is:
-
address perms offset dev inode pathname
00400000-00452000 r-xp 00000000 08:02 173521 /usr/bin/dbus-daemon
00651000-00652000 r--p 00051000 08:02 173521 /usr/bin/dbus-daemon
00652000-00655000 rw-p 00052000 08:02 173521 /usr/bin/dbus-daemon
00e03000-00e24000 rw-p 00000000 00:00 0 [heap]
00e24000-011f7000 rw-p 00000000 00:00 0 [heap]
...
35b1800000-35b1820000 r-xp 00000000 08:02 135522 /usr/lib64/ld-2.15.so
35b1a1f000-35b1a20000 r--p 0001f000 08:02 135522 /usr/lib64/ld-2.15.so
35b1a20000-35b1a21000 rw-p 00020000 08:02 135522 /usr/lib64/ld-2.15.so
35b1a21000-35b1a22000 rw-p 00000000 00:00 0
35b1c00000-35b1dac000 r-xp 00000000 08:02 135870 /usr/lib64/libc-2.15.so
35b1dac000-35b1fac000 ---p 001ac000 08:02 135870 /usr/lib64/libc-2.15.so
35b1fac000-35b1fb0000 r--p 001ac000 08:02 135870 /usr/lib64/libc-2.15.so
35b1fb0000-35b1fb2000 rw-p 001b0000 08:02 135870 /usr/lib64/libc-2.15.so
...
f2c6ff8c000-7f2c7078c000 rw-p 00000000 00:00 0 [stack:986]
...
7fffb2c0d000-7fffb2c2e000 rw-p 00000000 00:00 0 [stack]
7fffb2d48000-7fffb2d49000 r-xp 00000000 00:00 0 [vdso]
- The address field is the address space in the process that the
mapping occupies. The perms field is a set of permissions:
-
r = read
w = write
x = execute
s = shared
p = private (copy on write)
- The offset field is the offset into the file/whatever; dev
is the device (major:minor); inode is the inode on that device. 0
indicates that no inode is associated with the memory region, as would be
the case with BSS (uninitialized data).
- The pathname field will usually be the file that is backing the
mapping. For ELF files, you can easily coordinate with the offset
field by looking at the Offset field in the ELF program headers
(readelf -l).
- There are additional helpful pseudo-paths:
- [stack]
- The initial process's (also known as the main thread's) stack.
- [stack:tid] (from Linux 3.4 to Linux 4.4)
- A thread's stack (where the tid is a thread ID). It corresponds to
the /proc/pid/task/tid/ path. This field was removed
in Linux 4.5, since providing this information for a process with large
numbers of threads is expensive.
- [vdso]
- The virtual dynamically linked shared object. See vdso(7).
- [heap]
- The process's heap.
- [anon:name] (since Linux 5.17)
- A named private anonymous mapping. Set with prctl(2)
PR_SET_VMA_ANON_NAME.
- [anon_shmem:name] (since Linux 6.2)
- A named shared anonymous mapping. Set with prctl(2)
PR_SET_VMA_ANON_NAME.
- If the pathname field is blank, this is an anonymous mapping as
obtained via mmap(2). There is no easy way to coordinate this back
to a process's source, short of running it through gdb(1),
strace(1), or similar.
- pathname is shown unescaped except for newline characters, which
are replaced with an octal escape sequence. As a result, it is not
possible to determine whether the original pathname contained a newline
character or the literal \012 character sequence.
- If the mapping is file-backed and the file has been deleted, the string
" (deleted)" is appended to the pathname. Note that this is
ambiguous too.
- Under Linux 2.0, there is no field giving pathname.