What You Will Learn

Prerequisites

Designing the Experiment

The idea is simple: start with a small allocation size, request it with kmalloc(), immediately free it, then increase the requested size by a fixed step and repeat. The moment kmalloc() returns NULL, we know we have found (or nearly found) the ceiling for that specific run. We log every successful size to dmesg so we can watch it climb in real time.

A Configurable, Original Test Module

Here is a complete, original kernel module written specifically for this lecture. It uses module_param so you can control the step size from the command line without recompiling, which makes it easy to run the experiment at several different granularities.

// epath_kmalloc_probe.c
// EmbeddedPathashala — kmalloc() ceiling probe module

#include <linux/module.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/kernel.h>

static unsigned long probe_step = 65536; /* 64 KB default step */
module_param(probe_step, ulong, 0644);
MODULE_PARM_DESC(probe_step, "Byte increment applied on every successful allocation");

static size_t last_good_size;

static int __init epath_probe_init(void)
{
    size_t current_size = probe_step;
    void *buf;

    pr_info("epath_kmalloc_probe: starting, step=%lu bytes\n", probe_step);

    while (true) {
        buf = kmalloc(current_size, GFP_KERNEL);
        if (!buf) {
            pr_alert("epath_kmalloc_probe: FAILED at %zu bytes (%zu KB)\n",
                     current_size, current_size / 1024);
            break;
        }

        last_good_size = current_size;
        pr_info("epath_kmalloc_probe: OK   %8zu bytes (%4zu KB)\n",
                current_size, current_size / 1024);

        kfree(buf);
        current_size += probe_step;
    }

    pr_info("epath_kmalloc_probe: last successful size = %zu bytes (%zu KB)\n",
            last_good_size, last_good_size / 1024);

    /* Returning an error here is intentional: it keeps the module from
     * staying resident, since its only job is to run the probe once. */
    return -ENOMEM;
}

static void __exit epath_probe_exit(void)
{
    /* Nothing to clean up — init never leaves anything allocated. */
}

module_init(epath_probe_init);
module_exit(epath_probe_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("EmbeddedPathashala");
MODULE_DESCRIPTION("Empirically probes the kmalloc() maximum single-call allocation size");

Building and Running the Probe

Build the module against your running kernel’s headers, then load it and read the results from the kernel log:

$ make -C /lib/modules/$(uname -r)/build M=$(pwd) modules
$ sudo insmod epath_kmalloc_probe.ko probe_step=131072
$ dmesg | tail -30
$ sudo rmmod epath_kmalloc_probe 2>/dev/null   # module refuses to stay loaded, this is expected

Interpreting the Output

Real-World Use Cases

Common Mistakes and Troubleshooting

Best Practices

Performance and Security Considerations

Performance: the repeated allocate-then-immediately-free pattern used here is intentionally simple and is not representative of real driver workloads — it exists purely to map the ceiling, not to benchmark throughput.

Security: never adapt a “probe until failure” style loop into production driver code driven by user-controlled input; an attacker-influenced step size or starting size could be used to intentionally stress the allocator.

Summary / Key Takeaways

Conclusion

Pairing theory with hands-on measurement is what separates guessing from genuinely understanding the Linux kernel’s memory allocator. With this two-part lecture, you now know both why the kmalloc() ceiling exists and how to independently verify it on any kernel you have access to — a skill that will serve you well throughout the rest of this free Linux kernel development course and free Linux device drivers course.

FAQ