42

I know that when I call one of the exec() system calls in Linux that it will replace the currently running process with a new image. So when I fork a new process and run exec(), the child will be replaced with the new process.

What happens to any memory I've allocated from the heap? Say I want to parse an arbitrary number of commands and send it into exec(). To hold this arbitrary number, I'll likely have to allocate memory at some point since I don't think I can do it correctly with static sized arrays, so I'll likely use malloc() or something equivalent.

I need to keep this memory allocated until after I've called exec(), but exec() never returns.

Does the memory get reclaimed by the operating system?

sharptooth
  • 167,383
  • 100
  • 513
  • 979
Jonathan Sternberg
  • 6,421
  • 7
  • 39
  • 58
  • Btw here're a very similar question http://stackoverflow.com/questions/3617332/what-happens-with-memory-usage-after-exec – sharptooth Mar 25 '11 at 08:01

2 Answers2

39

When you call fork(), a copy of the calling process is created. This child process is (almost) exactly the same as the parent, i.e. memory allocated by malloc() is preserved and you're free to read or modify it. The modifications will not be visible to the parent process, though, as the parent and child processes are completely separate.

When you call exec() in the child, the child process is replaced by a new process. From execve(2):

execve() does not return on success, and the text, data, bss, and stack
of the calling process are overwritten by that of the program loaded.

By overwriting the data segment, the exec() call effectively reclaims the memory that was allocated before by malloc().

The parent process is unaffected by all this. Assuming that you allocated the memory in the parent process before calling fork(), the memory is still available in the parent process.

EDIT: Modern implementations of malloc() use anonymous memory mappings, see mmap(2). According to execve(2), memory mappings are not preserved over an exec() call, so this memory is also reclaimed.

Petri Lehtinen
  • 1,995
  • 2
  • 17
  • 22
  • 2
    That's doesn't explain what happens to the heap. Okay, the data segment is overwritten, but that implies the heap gets corrupted, not reset. – sharptooth Mar 25 '11 at 07:21
  • 2
    Heap is the data segment. In a simple implementation, `malloc()` would use `brk()` to grow the data segment and get more memory. When the data segment is overwritten, its size is also reset and the memory is effectively freed. – Petri Lehtinen Mar 25 '11 at 07:27
  • 1
    I think "heap corruption" normally means that the data structures in the heap that `malloc()` uses get corrupted (e.g. when a pointer is freed twice). When the data segment is overwritten, there's nothing to get corrupted anymore. – Petri Lehtinen Mar 25 '11 at 07:29
  • 1
    How does the heap know it has no memory to serve the user request from and has to call `brk()`? It uses service data for that. That service data resides in the data segment. Doing anything with that data will lead to classic heap corruption. – sharptooth Mar 25 '11 at 07:34
  • 1
    Upon `exec()`, the "service data" (the initial values of internal variable used by `malloc()`) is overwritten to reflect the situation at program start, i.e. zero bytes allocated with `malloc()`. When `malloc()` is first called, it knows that it needs to call `brk()`. – Petri Lehtinen Mar 25 '11 at 07:41
  • But memory got from OS when earlier (pre-`exec()`) calls to `brk()` will be then not used *and* still allocated to the process and that's a memory leak. – sharptooth Mar 25 '11 at 07:43
  • No. The memory will be freed because the data segment is overwritten and its size is reset to the size of the data segment of the new process. There's no memory for the process outside the data segment. After the program has started, `malloc()` uses `brk()` to grow the data segment (by incresing the address of the program break). – Petri Lehtinen Mar 25 '11 at 07:59
  • 1
    Actually, in modern implementations `malloc()` uses anonymous memory mappings acquired with `mmap()`. According to execve(2), memory mappings are not preserved over `exec()`, so no memory leak is possible this way either. – Petri Lehtinen Mar 25 '11 at 08:00
5

The entire heap -- allocated memory, and all of the logic malloc uses to manage it -- is part of the process image which gets replaced. It simply disappears, as far as your process is concerned. The system, of course, recovers it and recycles it.

James Kanze
  • 150,581
  • 18
  • 184
  • 329