# Linux Kernel Module Cheat

##### 27.2.1.1. malloc implementation

TODO: the exact answer is going to be hard.

But at least let’s verify that large `malloc` calls use the `mmap` syscall with:

    strace -x ./c/malloc_size.out 0x100000 2>&1 | grep mmap | tail -n 1
    strace -x ./c/malloc_size.out 0x200000 2>&1 | grep mmap | tail -n 1
    strace -x ./c/malloc_size.out 0x400000 2>&1 | grep mmap | tail -n 1

Source: userland/c/malloc_size.c.

From this we sese that the last `mmap` calls are:

    mmap(NULL, 1052672, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffff7ef2000
    mmap(NULL, 2101248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffff7271000
    mmap(NULL, 4198400, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffff7071000

which in hex are:

    printf '%x\n' 1052672
    # 101000
    printf '%x\n' 2101248
    # 201000
    printf '%x\n' 4198400
    # 401000

so we figured out the pattern: those 1, 2, and 4 MiB mallocs are mmaping N + 0x1000 bytes.