In linux, when I access /proc for a particular program it shows memory mapping for the program in maps file.

Something like this:

              address           perms offset  dev   inode       pathname
              00400000-00452000 r-xp 00000000 08:02 173521      /usr/bin/dbus-daemon
              00651000-00652000 r--p 00051000 08:02 173521      /usr/bin/dbus-daemon
              00652000-00655000 rw-p 00052000 08:02 173521      /usr/bin/dbus-daemon
              00e03000-00e24000 rw-p 00000000 00:00 0           [heap]
              00e24000-011f7000 rw-p 00000000 00:00 0           [heap]
              35b1800000-35b1820000 r-xp 00000000 08:02 135522  /usr/lib64/ld-2.15.so
              35b1a1f000-35b1a20000 r--p 0001f000 08:02 135522  /usr/lib64/ld-2.15.so
              35b1a20000-35b1a21000 rw-p 00020000 08:02 135522  /usr/lib64/ld-2.15.so
              35b1a21000-35b1a22000 rw-p 00000000 00:00 0
              35b1c00000-35b1dac000 r-xp 00000000 08:02 135870  /usr/lib64/libc-2.15.so
              35b1dac000-35b1fac000 ---p 001ac000 08:02 135870  /usr/lib64/libc-2.15.so
              35b1fac000-35b1fb0000 r--p 001ac000 08:02 135870  /usr/lib64/libc-2.15.so
              35b1fb0000-35b1fb2000 rw-p 001b0000 08:02 135870  /usr/lib64/libc-2.15.so
              f2c6ff8c000-7f2c7078c000 rw-p 00000000 00:00 0    [stack:986]
              7fffb2c0d000-7fffb2c2e000 rw-p 00000000 00:00 0   [stack]
              7fffb2d48000-7fffb2d49000 r-xp 00000000 00:00 0   [vdso]

I wanted to know what is this [stack] memory mapped to i.e the kernel stack or the user stack and how can I access the contents inside that memory area?

There is another file within the /proc directory called stack but it is the kernel stack as confirmed by the man page for proc(5)

Also, I wanted to know why there are 2 [heap]s in this process mapping?

I also checked the address range for [stack] of all the threads of a process and found them to be same for all of them. How is this possible when threads do not share stack?


1 Answer 1


The stack entries are described in man 5 proc: [stack] is the main thread’s stack, [stack:986] is thread 986’s stack. The latter is no longer visible on kernels since 4.5. This also addresses your last question: [stack] is only used by the main thread, every other thread has a different stack at a different address. You can access the stack like you would any other memory mapped in a given process.

I’m mostly guessing here, but the two heaps could be explained by the fact that brk can end up allocating a new VMA; this should show up as a separate entry in /proc/…/maps. Note however that the virtual addresses will always be contiguous.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .