---
name: "memguard"
section: "9freebsd"
platform: "linux"
package: "freebsd-manpages"
version: "12.2-2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/memguard/9freebsd"
---

# memguard(9freebsd)

memory allocator for debugging purposes

## NAME

**MemGuard** – memory allocator for debugging purposes

## SYNOPSIS

**options DEBUG\_MEMGUARD**

## DESCRIPTION

**MemGuard** is a simple and small replacement memory allocator designed to help detect tamper-after-free scenarios. These problems are more and more common and likely with multithreaded kernels where race conditions are more prevalent.

**MemGuard** can take over **malloc**(), **realloc**() and **free**() for a single malloc type. Alternatively **MemGuard** can take over **uma\_zalloc**(), **uma\_zalloc\_arg**() and **uma\_free**() for a single [uma(9)](/uma/9.md) zone. Also **MemGuard** can guard all allocations larger than PAGE\_SIZE, and can guard a random fraction of all allocations. There is also a knob to prevent allocations smaller than a specified size from being guarded, to limit memory waste.

## EXAMPLES

To use **MemGuard** for a memory type, either add an entry to */boot/loader.conf*:

```
vm.memguard.desc=<memory_type>
```

Or set the *vm.memguard.desc* [sysctl(8)](/sysctl/8.md) variable at run-time:

```
sysctl vm.memguard.desc=<memory_type>
```

Where *memory\_type* can be either a short description of the memory type to monitor, either name of [uma(9)](/uma/9.md) zone. Only allocations from that *memory\_type* made after *vm.memguard.desc* is set will potentially be guarded. If *vm.memguard.desc* is modified at run-time then only allocations of the new *memory\_type* will potentially be guarded once the [sysctl(8)](/sysctl/8.md) is set. Existing guarded allocations will still be properly released by either [free(9)](/free/9.md) or [uma\_zfree(9)](/uma_zfree/9.md), depending on what kind of allocation was taken over.

To determine short description of a [malloc(9)](/malloc/9.md) type one can either take it from the first column of [vmstat(8)](/vmstat/8.md) **-m** output, or to find it in the kernel source. It is the second argument to [MALLOC\_DEFINE(9)](/MALLOC_DEFINE/9.md) macro. To determine name of [uma(9)](/uma/9.md) zone one can either take it from the first column of [vmstat(8)](/vmstat/8.md) **-z** output, or to find it in the kernel source. It is the first argument to the [uma\_zcreate(9)](/uma_zcreate/9.md) function.

The *vm.memguard.divisor* boot-time tunable is used to scale how much of the system's physical memory **MemGuard** is allowed to consume. The default is 10, so up to *vm\_cnt.v\_page\_count*/10 pages can be used. **MemGuard** will reserve *vm\_kmem\_max* / *vm.memguard.divisor* bytes of virtual address space, limited by twice the physical memory size. The physical limit is reported as *vm.memguard.phys\_limit* and the virtual space reserved for **MemGuard** is reported as *vm.memguard.mapsize*.

**MemGuard** will not do page promotions for any allocation smaller than *vm.memguard.minsize* bytes. The default is 0, meaning all allocations can potentially be guarded. **MemGuard** can guard sufficiently large allocations randomly, with average frequency of every one in 100000 / *vm.memguard.frequency* allocations. The default is 0, meaning no allocations are randomly guarded.

**MemGuard** can optionally add unmapped guard pages around each allocation to detect overflow and underflow, if *vm.memguard.options* has the 1 bit set. This option is enabled by default. **MemGuard** will optionally guard all allocations of PAGE\_SIZE or larger if *vm.memguard.options* has the 2 bit set. This option is off by default. By default **MemGuard** does not guard [uma(9)](/uma/9.md) zones that have been initialized with the UMA\_ZONE\_NOFREE flag set, since it can produce false positives on them. However, this safety measure can be turned off by setting bit 3 of the *vm.memguard.options* tunable.

## SEE ALSO

[sysctl(8)](/sysctl/8.md), [vmstat(8)](/vmstat/8.md), [contigmalloc(9)](/contigmalloc/9.md), [malloc(9)](/malloc/9.md), [redzone(9)](/redzone/9.md), [uma(9)](/uma/9.md)

## HISTORY

**MemGuard** first appeared in FreeBSD 6.0.

## AUTHORS

**MemGuard** was originally written by Bosko Milekic ⟨*bmilekic@FreeBSD.org*⟩. This manual page was originally written by Christian Brueffer ⟨*brueffer@FreeBSD.org*⟩. Additions have been made by Matthew Fleming ⟨*mdf@FreeBSD.org*⟩ and Gleb Smirnoff ⟨*glebius@FreeBSD.org*⟩ to both the implementation and the documentation.