What Do “buffers” and “cached” Really Mean in Linux’s free Command?

Background

The free command is the most common tool for checking memory usage on Linux, but many users cannot clearly differentiate the meanings of the buffers and cached columns.

Definition of buffers and cached

buffers

represents cache pages occupied by block devices, including direct block‑device I/O and filesystem metadata such as the superblock. cached represents cache pages occupied by ordinary file data, i.e., page cache for regular files.

Analysis process

Using strace on free shows that the command reads /proc/meminfo to obtain its numbers:

# strace free
... 
open('/proc/meminfo', O_RDONLY) = 3
lseek(3, 0, SEEK_SET) = 0
read(3, 'MemTotal: ...', 2047) = 1170
...

Inspecting /proc/meminfo confirms the values:

# cat /proc/meminfo
MemTotal:       3848656 kB
MemFree:         865640 kB
Buffers:         324432 kB
Cached:        2024904 kB
...

The kernel source file fs/proc/meminfo.c implements meminfo_proc_show(), where the Cached value is calculated as:

global_page_state(NR_FILE_PAGES) – total_swapcache_pages – i.bufferram

global_page_state(NR_FILE_PAGES)

counts all page‑cache pages, which include: Cached (ordinary file pages) Buffers (the i.bufferram term, derived from nr_blockdev_pages())

Swap cache pages

The value global_page_state(NR_FILE_PAGES) comes from vmstat[NR_FILE_PAGES], viewable via /proc/vmstat and expressed in pages (4 KB each), while free reports in kilobytes.

Swap cache

Anonymous pages (e.g., memory allocated by malloc()) that are swapped out are stored in a swap cache, which is essentially a page cache for swap devices. Only pages that are about to be swapped out or have been swapped in remain in the swap cache temporarily.

cached calculation

Thus cached equals the total file‑page cache minus buffers and swap cache, i.e., the amount of ordinary file data cached.

buffers calculation

The buffers value originates from the function nr_blockdev_pages():

long nr_blockdev_pages(void)
{
    struct block_device *bdev;
    long ret = 0;
    spin_lock(&bdev_lock);
    list_for_each_entry(bdev, &all_bdevs, bd_list) {
        ret += bdev->bd_inode->i_mapping->nrpages;
    }
    spin_unlock(&bdev_lock);
    return ret;
}

This code iterates over all block devices and sums the nrpages of each device’s inode mapping, which is exactly what buffers counts.

Updates to nrpages happen via the generic functions add_to_page_cache_locked and delete_from_page_cache, which are used by both block devices and regular files. Whether the statistic contributes to buffers or cached depends on the mapping argument: a block‑device mapping updates buffers, while a file‑inode mapping updates cached.

Block devices are opened with bdev->bd_inode->i_mapping (see blkdev_open), and filesystem metadata such as the superblock also uses the block‑device mapping, so its cache pages are counted as buffers. Indirect blocks, being metadata, follow the same path.

Verification

Running free, then creating many files with find, shows an increase in the buffers column, confirming that filesystem metadata contributes to it.

# free
              total       used       free     shared    buffers     cached
Mem:       3848656    2889508    959148       5316    263896    2023340
-/+ buffers/cache:    602272    3246384

# find / -name abc.def
# free
              total       used       free     shared    buffers     cached
Mem:       3848656    2984052    864604       5320    319612    2023348
-/+ buffers/cache:    641092    3207564

Reading directly from a block device with dd also raises the buffers value.

# free
... buffers 331020 ...
# dd if=/dev/sda1 of=/dev/null count=2000
2000+0 records in
2000+0 records out
1024000 bytes (1.0 MB) copied, 0.026413 s, 38.8 MB/s
# free
... buffers 331872 ...

Conclusion

The buffers column shown by free reports cache pages used by block devices, including direct block‑device I/O and filesystem metadata such as superblocks; the cached column reports cache pages used by ordinary files.