1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
.\" Copyright (C) 1994, 1995, Daniel Quinlan <quinlan@yggdrasil.com>
.\" Copyright (C) 2002-2008, 2017, Michael Kerrisk <mtk.manpages@gmail.com>
.\" Copyright (C) 2023, Alejandro Colomar <alx@kernel.org>
.\"
.\" SPDX-License-Identifier: GPL-3.0-or-later
.\"
.TH proc_pid_maps 5 (date) "Linux man-pages (unreleased)"
.SH NAME
/proc/pid/maps \- mapped memory regions
.SH DESCRIPTION
.TP
.IR /proc/ pid /maps
A file containing the currently mapped memory regions and their access
permissions.
See
.BR mmap (2)
for some further information about memory mappings.
.IP
Permission to access this file is governed by a ptrace access mode
.B PTRACE_MODE_READ_FSCREDS
check; see
.BR ptrace (2).
.IP
The format of the file is:
.IP
.in +4n
.EX
.I "address perms offset dev inode pathname"
00400000\-00452000 r\-xp 00000000 08:02 173521 /usr/bin/dbus\-daemon
00651000\-00652000 r\-\-p 00051000 08:02 173521 /usr/bin/dbus\-daemon
00652000\-00655000 rw\-p 00052000 08:02 173521 /usr/bin/dbus\-daemon
00e03000\-00e24000 rw\-p 00000000 00:00 0 [heap]
00e24000\-011f7000 rw\-p 00000000 00:00 0 [heap]
\&...
35b1800000\-35b1820000 r\-xp 00000000 08:02 135522 /usr/lib64/ld\-2.15.so
35b1a1f000\-35b1a20000 r\-\-p 0001f000 08:02 135522 /usr/lib64/ld\-2.15.so
35b1a20000\-35b1a21000 rw\-p 00020000 08:02 135522 /usr/lib64/ld\-2.15.so
35b1a21000\-35b1a22000 rw\-p 00000000 00:00 0
35b1c00000\-35b1dac000 r\-xp 00000000 08:02 135870 /usr/lib64/libc\-2.15.so
35b1dac000\-35b1fac000 \-\-\-p 001ac000 08:02 135870 /usr/lib64/libc\-2.15.so
35b1fac000\-35b1fb0000 r\-\-p 001ac000 08:02 135870 /usr/lib64/libc\-2.15.so
35b1fb0000\-35b1fb2000 rw\-p 001b0000 08:02 135870 /usr/lib64/libc\-2.15.so
\&...
f2c6ff8c000\-7f2c7078c000 rw\-p 00000000 00:00 0 [stack:986]
\&...
7fffb2c0d000\-7fffb2c2e000 rw\-p 00000000 00:00 0 [stack]
7fffb2d48000\-7fffb2d49000 r\-xp 00000000 00:00 0 [vdso]
.EE
.in
.IP
The
.I address
field is the address space in the process that the mapping occupies.
The
.I perms
field is a set of permissions:
.IP
.in +4n
.EX
r = read
w = write
x = execute
s = shared
p = private (copy on write)
.EE
.in
.IP
The
.I offset
field is the offset into the file/whatever;
.I dev
is the device
(major:minor);
.I inode
is the inode on that device.
0 indicates that no inode is associated with the memory region,
as would be the case with BSS (uninitialized data).
.IP
The
.I pathname
field will usually be the file that is backing the mapping.
For ELF files,
you can easily coordinate with the
.I offset
field by looking at the
Offset field in the ELF program headers
.RI ( "readelf\ \-l" ).
.IP
There are additional helpful pseudo-paths:
.RS
.TP
.I [stack]
The initial process's (also known as the main thread's) stack.
.TP
.IR [stack: tid ] " (from Linux 3.4 to Linux 4.4)"
.\" commit b76437579d1344b612cf1851ae610c636cec7db0 (added)
.\" commit 65376df582174ffcec9e6471bf5b0dd79ba05e4a (removed)
A thread's stack (where the
.I tid
is a thread ID).
It corresponds to the
.IR /proc/ pid /task/ tid /
path.
This field was removed in Linux 4.5, since providing this information
for a process with large numbers of threads is expensive.
.TP
.I [vdso]
The virtual dynamically linked shared object.
See
.BR vdso (7).
.TP
.I [heap]
The process's heap.
.TP
.IR [anon: name ] " (since Linux 5.17)"
.\" Commit 9a10064f5625d5572c3626c1516e0bebc6c9fe9b
A named private anonymous mapping.
Set with
.BR prctl (2)
.BR PR_SET_VMA_ANON_NAME .
.TP
.IR [anon_shmem: name ] " (since Linux 6.2)"
.\" Commit d09e8ca6cb93bb4b97517a18fbbf7eccb0e9ff43
A named shared anonymous mapping.
Set with
.BR prctl (2)
.BR PR_SET_VMA_ANON_NAME .
.in
.RE
.IP
If the
.I pathname
field is blank,
this is an anonymous mapping as obtained via
.BR mmap (2).
There is no easy way to coordinate this back to a process's source,
short of running it through
.BR gdb (1),
.BR strace (1),
or similar.
.IP
.I pathname
is shown unescaped except for newline characters, which are replaced
with an octal escape sequence.
As a result, it is not possible to determine whether the original
pathname contained a newline character or the literal
.I \e012
character sequence.
.IP
If the mapping is file-backed and the file has been deleted, the string
" (deleted)" is appended to the pathname.
Note that this is ambiguous too.
.IP
Under Linux 2.0, there is no field giving pathname.
.SH SEE ALSO
.BR proc (5)
|
