Heap Allocation & malloc

Two paths to the kernel

User-space allocators (malloc/free) sit above two kernel mechanisms:

Mechanism	Syscall	Typical use
Program break	brk/sbrk	Small, contiguous heap growth
Anonymous mapping	mmap(MAP_ANONYMOUS)	Large allocations, allocator arenas

glibc malloc uses arenas (per-thread to reduce lock contention), fastbins for small freed chunks, and an mmap threshold (~128 KiB default) above which allocations go directly to mmap — returning them on free via munmap.

Allocator internals (conceptual)

• Splitting — a free 256-byte chunk satisfies a 64-byte request; remainder stays on free list.
• Coalescing — adjacent free chunks merge to fight external fragmentation.
• Bins — size-class free lists for O(1) reuse.
• Internal fragmentation — rounding up to alignment or size class wastes bytes inside allocated blocks.

Allocator choice in production

Allocator	Strength	Common deployment
glibc malloc	Default, good enough for most	Everything unless measured otherwise
jemalloc	Lower fragmentation, arena tuning	Firefox, Redis, some JVM alternatives
tcmalloc	Fast per-thread caches	gRPC, high-QPS C++ services

Switch allocators only with profiling evidence (malloc_info, heap profilers, RSS over 24h soak).

Common bugs

• Memory leak — allocated, never freed; RSS climbs monotonically.
• Use-after-free — dangling pointer; security and heisenbugs.
• Double free — corrupts allocator metadata; often exploitable.
• Heap overflow — write past allocation; corrupts adjacent chunk headers.

Senior-level signal

Long-running servers that "slowly eat RAM" often have fragmentation, not leaks — RSS high but malloc_info shows plenty of free heap. MALLOC_ARENA_MAX=2 is a blunt glibc knob for container memory limits; jemalloc's background_thread helps return pages to OS.

Where this goes next

mmap & Shared Memory covers the other major allocation path — mapping files and sharing pages across processes for IPC and databases.