1

I am studying virtual memory mappings of memory regions in Linux. The executable is a simple counting program. When two instances of the program are run, the following are the mappings shown by /proc/pid/maps. The location of heap, stack, vvar, vdso, etc appear to have a random offset at load time. Why is this done?

Instance 1: Heap starts at 013f4000

00400000-00401000 r--p 00000000 08:16 3557412                            <program-exe>
00401000-00480000 r-xp 00001000 08:16 3557412                            <program-exe>
00480000-004a5000 r--p 00080000 08:16 3557412                            <program-exe>
004a6000-004ac000 rw-p 000a5000 08:16 3557412                            <program-exe>
004ac000-004ad000 rw-p 00000000 00:00 0 
013f4000-01417000 rw-p 00000000 00:00 0                                  [heap]
7ffd98bd8000-7ffd98bf9000 rw-p 00000000 00:00 0                          [stack]
7ffd98bfc000-7ffd98bff000 r--p 00000000 00:00 0                          [vvar]
7ffd98bff000-7ffd98c00000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]

Instance 2: Heap starts at 013cc000

00400000-00401000 r--p 00000000 08:16 3557412                            <program-exe>
00401000-00480000 r-xp 00001000 08:16 3557412                            <program-exe>
00480000-004a5000 r--p 00080000 08:16 3557412                            <program-exe>
004a6000-004ac000 rw-p 000a5000 08:16 3557412                            <program-exe>
004ac000-004ad000 rw-p 00000000 00:00 0 
013cc000-013ef000 rw-p 00000000 00:00 0                                  [heap]
7ffe3717d000-7ffe3719e000 rw-p 00000000 00:00 0                          [stack]
7ffe371fa000-7ffe371fd000 r--p 00000000 00:00 0                          [vvar]
7ffe371fd000-7ffe371fe000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]
1
  • Search for "Linux address space layout randomization".
    – kaylum
    Jan 1 '20 at 5:43
4

This is the result of a security feature called Address Space Layout Randomization (ASLR). When ASLR is enabled the kernel will load key process segments at random addresses. All recent Linux kernels have ASLR enabled by default. ASLR can be controlled via /proc/sys/kernel/randomize_va_space. From the proc man page:

/proc/sys/kernel/randomize_va_space (since Linux 2.6.12) Select the address space layout randomization (ASLR) policy for the system (on architectures that support ASLR). Three values are supported for this file:

          0  Turn ASLR off.  This is the default for architectures that
             don't support ASLR, and when the kernel is booted with the
             norandmaps parameter.

          1  Make the addresses of mmap(2) allocations, the stack, and
             the VDSO page randomized.  Among other things, this means
             that shared libraries will be loaded at randomized
             addresses.  The text segment of PIE-linked binaries will
             also be loaded at a randomized address.  This value is the
             default if the kernel was configured with CONFIG_COM‐
             PAT_BRK.

          2  (Since Linux 2.6.25) Also support heap randomization.  This
             value is the default if the kernel was not configured with
             CONFIG_COMPAT_BRK.

So to temporarily disable ASLR run the following as root:

echo 0 > /proc/sys/kernel/randomize_va_space

Now run your test again and you should find that both processes will now have the same address maps.

1
  • Thank you. That was it.
    – srinskit
    Jan 2 '20 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.