0

I am trying to see how many times is the malloc function called in userspace using a kernel module and kprobes on mmap and brk. I found the system calls inside the kernel as sys_mmap and sys_brk, but when I try to insert the module inside the kernel it says:

insmod: can't insert mallocmonitor.ko. Operation not permitted

Also, when I register a kprobe on __kmalloc, kfree, or map_region functions it works without any problem.

Does anyone has an insight on this?

ginger
  • 55
  • 6
  • Try [this existing answer](https://stackoverflow.com/questions/14476325/how-can-i-count-malloc-in-linux-kernel-with-kprobe). You can't use kprobes directly since malloc is a library function rather than a syscall, but BCC will allow you to probe syscalls of your malloc implementation (or USDTs of a specific program if you prefer) as documented in its reference guide: [BCC refguide](https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md#8-system-call-tracepoints). Lots of code examples there. – Frank Hoeflich Jun 04 '21 at 14:21
  • Thank you! I'll will look it up. – ginger Jun 07 '21 at 14:59

0 Answers0