diff --git a/ChangeLog b/ChangeLog
index a0e0d077f4..7032850088 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2017-11-15  Florian Weimer  <fweimer@redhat.com>
+
+	[BZ #22439]
+	* malloc/malloc.c (__malloc_info): Count all heaps in an arena,
+	not just the top one.  Output a new "subheaps" statistic.
+
 2017-11-15  Florian Weimer  <fweimer@redhat.com>
 
 	[BZ #22408]
diff --git a/NEWS b/NEWS
index b7281621f4..520db40982 100644
--- a/NEWS
+++ b/NEWS
@@ -63,6 +63,9 @@ Deprecated and removed features, and other changes affecting compatibility:
 * The res_hnok, res_dnok, res_mailok and res_ownok functions now check that
   the specified string can be parsed as a domain name.
 
+* In the malloc_info output, the <heap> element may contain another <aspace>
+  element, "subheaps", which contains the number of sub-heaps.
+
 Changes to build and runtime requirements:
 
   [Add changes to build and runtime requirements here]
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 0494e8c39f..2999ac4d2f 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -5457,11 +5457,19 @@ __malloc_info (int options, FILE *fp)
 
       size_t heap_size = 0;
       size_t heap_mprotect_size = 0;
+      size_t heap_count = 0;
       if (ar_ptr != &main_arena)
 	{
+	  /* Iterate over the arena heaps from back to front.  */
 	  heap_info *heap = heap_for_ptr (top (ar_ptr));
-	  heap_size = heap->size;
-	  heap_mprotect_size = heap->mprotect_size;
+	  do
+	    {
+	      heap_size += heap->size;
+	      heap_mprotect_size += heap->mprotect_size;
+	      heap = heap->prev;
+	      ++heap_count;
+	    }
+	  while (heap != NULL);
 	}
 
       __libc_lock_unlock (ar_ptr->mutex);
@@ -5499,8 +5507,9 @@ __malloc_info (int options, FILE *fp)
 	{
 	  fprintf (fp,
 		   "<aspace type=\"total\" size=\"%zu\"/>\n"
-		   "<aspace type=\"mprotect\" size=\"%zu\"/>\n",
-		   heap_size, heap_mprotect_size);
+		   "<aspace type=\"mprotect\" size=\"%zu\"/>\n"
+		   "<aspace type=\"subheaps\" size=\"%zu\"/>\n",
+		   heap_size, heap_mprotect_size, heap_count);
 	  total_aspace += heap_size;
 	  total_aspace_mprotect += heap_mprotect_size;
 	}