BSD syscall#73
svc · unix #73
munmap
Unmaps a range of pages previously created by mmap from the process address space.
Prototype
int munmap(caddr_t addr, size_t len);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| addr | caddr_t | - | |
| len | size_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 73 |
| xnu-1486.2.11 | — | 73 |
| xnu-1504.15.3 | — | 73 |
| xnu-1504.3.12 | — | 73 |
| xnu-1504.7.4 | — | 73 |
| xnu-1504.9.17 | — | 73 |
| xnu-1504.9.26 | — | 73 |
| xnu-1504.9.37 | — | 73 |
Examples
C — release a mapping
if (munmap(p, 0x4000) != 0) {
perror("munmap");
}Notes
munmap(2) calls into mach_vm_deallocate() on the task's vm_map. The range must be page-aligned in length; the start address is rounded down to the page boundary. Partial unmaps are allowed and will split the surrounding VM entries — heavy use fragments the map and slows future allocations.
Detection
There is no Endpoint Security event for munmap. DTrace's syscall::munmap:entry is the simplest probe; for post-hoc analysis the corresponding VM region simply disappears from vmmap(1) output.
Related APIs
mmapmprotectvm_deallocatemach_vm_deallocatemadvise