Why are the virtual memory regions for the same program different on every run?

Question

I am studying virtual memory mappings of memory regions in Linux. The executable is a simple counting program. When two instances of the program are run, the following are the mappings shown by /proc/pid/maps. The location of heap, stack, vvar, vdso, etc appear to have a random offset at load time. Why is this done?

Instance 1: Heap starts at 013f4000

00400000-00401000 r--p 00000000 08:16 3557412                            <program-exe>
00401000-00480000 r-xp 00001000 08:16 3557412                            <program-exe>
00480000-004a5000 r--p 00080000 08:16 3557412                            <program-exe>
004a6000-004ac000 rw-p 000a5000 08:16 3557412                            <program-exe>
004ac000-004ad000 rw-p 00000000 00:00 0 
013f4000-01417000 rw-p 00000000 00:00 0                                  [heap]
7ffd98bd8000-7ffd98bf9000 rw-p 00000000 00:00 0                          [stack]
7ffd98bfc000-7ffd98bff000 r--p 00000000 00:00 0                          [vvar]
7ffd98bff000-7ffd98c00000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]

Instance 2: Heap starts at 013cc000

00400000-00401000 r--p 00000000 08:16 3557412                            <program-exe>
00401000-00480000 r-xp 00001000 08:16 3557412                            <program-exe>
00480000-004a5000 r--p 00080000 08:16 3557412                            <program-exe>
004a6000-004ac000 rw-p 000a5000 08:16 3557412                            <program-exe>
004ac000-004ad000 rw-p 00000000 00:00 0 
013cc000-013ef000 rw-p 00000000 00:00 0                                  [heap]
7ffe3717d000-7ffe3719e000 rw-p 00000000 00:00 0                          [stack]
7ffe371fa000-7ffe371fd000 r--p 00000000 00:00 0                          [vvar]
7ffe371fd000-7ffe371fe000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]

Answer 1

This is the result of a security feature called Address Space Layout Randomization (ASLR). When ASLR is enabled the kernel will load key process segments at random addresses. All recent Linux kernels have ASLR enabled by default. ASLR can be controlled via /proc/sys/kernel/randomize_va_space. From the proc man page:

/proc/sys/kernel/randomize_va_space (since Linux 2.6.12) Select the address space layout randomization (ASLR) policy for the system (on architectures that support ASLR). Three values are supported for this file:

          0  Turn ASLR off.  This is the default for architectures that
             don't support ASLR, and when the kernel is booted with the
             norandmaps parameter.

          1  Make the addresses of mmap(2) allocations, the stack, and
             the VDSO page randomized.  Among other things, this means
             that shared libraries will be loaded at randomized
             addresses.  The text segment of PIE-linked binaries will
             also be loaded at a randomized address.  This value is the
             default if the kernel was configured with CONFIG_COM‐
             PAT_BRK.

          2  (Since Linux 2.6.25) Also support heap randomization.  This
             value is the default if the kernel was not configured with
             CONFIG_COMPAT_BRK.

So to temporarily disable ASLR run the following as root:

echo 0 > /proc/sys/kernel/randomize_va_space

Now run your test again and you should find that both processes will now have the same address maps.