Process memory layout - difference between heap, data and mmap areas
4
votes
1
answer
1130
views
I see in the web many conflicting or unclear descriptions of the memory layout of a Linux process. Usually the [common diagram](
https://stackoverflow.com/q/64038876/8529284) looks like:
And a common [description](https://www.quora.com/Is-the-data-segment-is-part-of-the-heap-or-the-heap-is-part-of-it/answer/Sudarshan-43?ch=15&oid=30002660&share=af08bbcb&srid=2KkSm&target_type=answer) would say that:
> The data segment contains only global or static variable which have a
> predefined value and can be modified. Heap contains the dynamically
> allocated data that is stored in a memory section we refer that as
> heap section and this section typically starts where data segments
> ends.
And [also](https://stackoverflow.com/a/14954147/8529284) :
> The heap is, generally speaking, one specific memory region created by
> the C runtime, and managed by

malloc
(which in turn uses the brk
> and sbrk
system calls to grow and shrink).
>
> mmap
is a way of creating new memory regions, independently of
> malloc
(and so independently of the heap). munmap
is simply its
> inverse, it releases these regions.
Many of the those explanations seem outdated, and I find many discrepancies. For instance, many articles - as the answer above - claim that the heap is used my malloc
, but this is actualy a library call that's using either sbrk
or mmap
, as the malloc
[man page](https://man7.org/linux/man-pages/man3/malloc.3.html) says:
> Normally, malloc()
allocates memory from the heap, and adjusts
> the size of the heap as required, using sbrk(2)
. When allocating
> blocks of memory larger than **MMAP_THRESHOLD** bytes, the glibc
> malloc()
implementation allocates the memory as a private
> anonymous mapping using mmap(2)
.
So if malloc
in many cases in implemented by mmap
, what's the difference between the heap and and the mmap area?
Another thing that seems like a contradiction is that many articles (as the malloc
man page itself) claim that brk
/sbrk
adjust the size of the heap, but their [man page](https://man7.org/linux/man-pages/man2/brk.2.html) says it actually adjust the size of the **data segment**:
> brk()
and sbrk()
change the location of the **program break**,
> which
> defines the end of the process's data segment (i.e., the program
> break is the first location after the end of the uninitialized
> data segment).
So I'm trying to get a clear, up-to-date overall explanation of the memory layout of processes nowadays with the different segments, that also addresses those questions:
1. What is the difference between the heap and the mmap areas? (From some tests I was attempting, by looking at the addresses I got from mmap
and comparing to the range of the heap in /proc/self/maps
, it seems that some mmap
allocated pages are actually allocated inside the heap segment.)
2. Does the **break** signifies the end of the **data segment**, or the end of the **heap**?
Other related questions:
* [how brk pointer grow after calling malloc](https://unix.stackexchange.com/q/610939/273579)
* [When is the heap used for dynamic memory allocation?](https://unix.stackexchange.com/q/411408/273579)
Asked by aviro
(6925 rep)
Feb 13, 2024, 01:07 PM
Last activity: Jun 9, 2025, 06:03 AM
Last activity: Jun 9, 2025, 06:03 AM