--- name: "malloc" section: "9" platform: "freebsd" package: "base" version: "16.0-CURRENT-20261027-61c70dc16a79" release: "FreeBSD 16.0-CURRENT (2026-10-27)" platforms: ["linux", "freebsd"] url: "https://new.carta.tech/MALLOC_DECLARE" --- # malloc(9) kernel memory management routines Part of [MALLOC\_DECLARE(9)](/MALLOC_DECLARE/9.md). ## NAME **malloc**, **mallocarray**, **free**, **zfree**, **realloc**, **reallocf**, **malloc\_usable\_size**, **malloc\_aligned**, **malloc\_exec**, **MALLOC\_DECLARE**, **MALLOC\_DEFINE**, **malloc\_domainset**, **malloc\_domainset\_aligned**, **malloc\_domainset\_exec**, **mallocarray\_domainset** – kernel memory management routines ## SYNOPSIS **#include \** **#include \** *void* *\**\ **malloc**(*size\_t size*, *struct malloc\_type \*type*, *int flags*); *void* *\**\ **mallocarray**(*size\_t nmemb*, *size\_t size*, *struct malloc\_type \*type*, *int flags*); *void*\ **free**(*void \*addr*, *struct malloc\_type \*type*); *void*\ **zfree**(*void \*addr*, *struct malloc\_type \*type*); *void* *\**\ **realloc**(*void \*addr*, *size\_t size*, *struct malloc\_type \*type*, *int flags*); *void* *\**\ **reallocf**(*void \*addr*, *size\_t size*, *struct malloc\_type \*type*, *int flags*); *size\_t*\ **malloc\_usable\_size**(*const void \*addr*); *void* *\**\ **malloc\_aligned**(*size\_t size*, *size\_t align*, *struct malloc\_type \*type*, *int flags*); *void* *\**\ **malloc\_exec**(*size\_t size*, *struct malloc\_type \*type*, *int flags*); **MALLOC\_DECLARE**(*type*); **#include \** **#include \** **#include \** **MALLOC\_DEFINE**(*type*, *shortdesc*, *longdesc*); **#include \** **#include \** **#include \** *void* *\**\ **malloc\_domainset**(*size\_t size*, *struct malloc\_type \*type*, *struct domainset \*ds*, *int flags*); *void* *\**\ **malloc\_domainset\_aligned**(*size\_t size*, *size\_t align*, *struct malloc\_type \*type*, *struct domainset \*ds*, *int flags*); *void* *\**\ **malloc\_domainset\_exec**(*size\_t size*, *struct malloc\_type \*type*, *struct domainset \*ds*, *int flags*); *void* *\**\ **mallocarray\_domainset**(*size\_t nmemb*, *size\_t size*, *struct malloc\_type \*type*, *struct domainset \*ds*, *int flags*); ## DESCRIPTION The **malloc**() function allocates uninitialized memory in kernel address space for an object whose size is specified by *size*. The **malloc\_domainset**() variant allocates memory from a specific [numa(4)](/numa/4.md) domain using the specified domain selection policy. See [domainset(9)](/domainset/9.md) for some example policies. The **malloc\_aligned**() and **malloc\_domainset\_aligned**() variants return allocations aligned as specified by *align*, which must be non-zero, a power of two, and less than or equal to the page size. Both **malloc\_exec**() and **malloc\_domainset\_exec**() can be used to return executable memory. Not all platforms enforce a distinction between executable and non-executable memory. The **mallocarray**() function allocates uninitialized memory in kernel address space for an array of *nmemb* entries whose size is specified by *size*. The **mallocarray\_domainset**() variant allocates memory from a specific [numa(4)](/numa/4.md) domain using the specified domain selection policy. See [domainset(9)](/domainset/9.md) for some example policies. The **free**() function releases memory at address *addr* that was previously allocated by **malloc**() for re-use. The memory is not zeroed. If *addr* is NULL, then **free**() does nothing. Like **free**(), the **zfree**() function releases memory at address *addr* that was previously allocated by **malloc**() for re-use. However, **zfree**() will zero the memory before it is released. The **realloc**() function changes the size of the previously allocated memory referenced by *addr* to *size* bytes. The contents of the memory are unchanged up to the lesser of the new and old sizes. Note that the returned value may differ from *addr*. If the requested memory cannot be allocated, NULL is returned and the memory referenced by *addr* is valid and unchanged. If *addr* is NULL, the **realloc**() function behaves identically to **malloc**() for the specified size. The **reallocf**() function is identical to **realloc**() except that it will free the passed pointer when the requested memory cannot be allocated. The **malloc\_usable\_size**() function returns the usable size of the allocation pointed to by *addr*. The return value may be larger than the size that was requested during allocation. Unlike its standard C library counterpart ([malloc(3)](/malloc/3.md)), the kernel version takes two more arguments. The *flags* argument further qualifies **malloc**(*Ns*, *'s*) operational characteristics as follows: - M\_ZERO Causes the allocated memory to be set to all zeros. - M\_NODUMP For allocations greater than page size, causes the allocated memory to be excluded from kernel core dumps. - M\_NOWAIT Causes **malloc**(), **realloc**(), and **reallocf**() to return NULL if the request cannot be immediately fulfilled due to resource shortage. Note that M\_NOWAIT is required when running in an interrupt context. - M\_WAITOK Indicates that it is OK to wait for resources. If the request cannot be immediately fulfilled, the current process is put to sleep to wait for resources to be released by other processes. The **malloc**(), **mallocarray**(), **realloc**(), and **reallocf**() functions cannot return NULL if M\_WAITOK is specified. If the multiplication of *nmemb* and *size* would cause an integer overflow, the **mallocarray**() function induces a panic. - M\_USE\_RESERVE Indicates that the system can use its reserve of memory to satisfy the request. This option should only be used in combination with M\_NOWAIT when an allocation failure cannot be tolerated by the caller without catastrophic effects on the system. - M\_NEVERFREED This is an internal flag used by the [uma(9)](/uma/9.md) allocator and should not be used in regular **malloc**() invocations. See the description of VM\_ALLOC\_NOFREE in [vm\_page\_alloc(9)](/vm_page_alloc/9.md) for more details. Exactly one of either M\_WAITOK or M\_NOWAIT must be specified. The *type* argument is used to perform statistics on memory usage, and for basic sanity checks. It can be used to identify multiple allocations. The statistics can be examined by ‘vmstat -m’. A *type* is defined using *struct malloc\_type* via the **MALLOC\_DECLARE**() and **MALLOC\_DEFINE**() macros. ``` /* sys/something/foo_extern.h */ MALLOC_DECLARE(M_FOOBUF); /* sys/something/foo_main.c */ MALLOC_DEFINE(M_FOOBUF, "foobuffers", "Buffers to foo data into the ether"); /* sys/something/foo_subr.c */ ... buf = malloc(sizeof(*buf), M_FOOBUF, M_NOWAIT); ``` In order to use **MALLOC\_DEFINE**(), one must include ⟨sys/param.h⟩ (instead of ⟨sys/types.h⟩) and ⟨sys/kernel.h⟩. ## CONTEXT **malloc**(), **realloc**() and **reallocf**() may not be called from fast interrupts handlers. When called from threaded interrupts, *flags* must contain M\_NOWAIT. **malloc**(), **realloc**() and **reallocf**() may sleep when called with M\_WAITOK. **free**() never sleeps. However, **malloc**(), **realloc**(), **reallocf**() and **free**() may not be called in a critical section or while holding a spin lock. Any calls to **malloc**() (even with M\_NOWAIT) or **free**() when holding a [vnode(9)](/vnode/9.md) interlock, will cause a LOR (Lock Order Reversal) due to the intertwining of VM Objects and Vnodes. ## IMPLEMENTATION NOTES The memory allocator allocates memory in chunks that have size a power of two for requests up to the size of a page of memory. For larger requests, one or more pages is allocated. While it should not be relied upon, this information may be useful for optimizing the efficiency of memory use. ## RETURN VALUES The **malloc**(), **realloc**(), and **reallocf**() functions return a kernel virtual address that is suitably aligned for storage of any type of object, or NULL if the request could not be satisfied (implying that M\_NOWAIT was set). ## DIAGNOSTICS A kernel compiled with the INVARIANTS configuration option attempts to detect memory corruption caused by such things as writing outside the allocated area and imbalanced calls to the **malloc**() and **free**() functions. Failing consistency checks will cause a panic or a system console message. ## SEE ALSO [dtrace\_dtmalloc(4)](/dtrace_dtmalloc/4.md), [numa(4)](/numa/4.md), [vmstat(8)](/vmstat/8.md), [contigmalloc(9)](/contigmalloc/9.md), [domainset(9)](/domainset/9.md), [memguard(9)](/memguard/9.md), [vnode(9)](/vnode/9.md) ## HISTORY **zfree**() first appeared in FreeBSD 13.0.