malloc looks like one function, but underneath it's a memory allocator juggling free lists, size classes, and the kernel. Knowing how it works explains fragmentation, allocator contention, and why your RSS never goes down.
The fastest malloc is a pointer bump; the fastest free is resetting one offset. Arenas trade individual deallocation for speed, locality, and the death of use-after-free within a lifetime — a trade half your workloads should take.
malloc has a supplier: the kernel's own allocators. The buddy system deals in power-of-two page blocks and fights fragmentation with math; the slab layer turns pages into typed object caches. Between them, every allocation on your machine.
Reorder three fields and a struct shrinks from 24 bytes to 16 — a 33% memory cut with zero code changes. Where padding comes from, how to see it with pahole, and when packing is a trap.
Every exploit needs an address; ASLR's bet is that the attacker shouldn't know any. How Linux randomizes stack, heap, and libraries, why PIE took years to become default, and the leak-one-pointer reality that keeps ASLR a speed bump, not a wall.
The Linux kernel's list_head puts the container inside the object instead of the object inside the container — one implementation, zero allocations, and a container_of macro that looks illegal but isn't. I built a library around the pattern; here's why it wins.
The textbook says linked lists win at insertion, O(1) vs O(n). Run the benchmark and the array wins insertion-heavy workloads too — often by 10x. The memory hierarchy voted, and it didn't vote for pointers.
Every process thinks it has a private, contiguous address space starting at zero. None of them do. Virtual memory is the translation layer that makes the lie hold — and it's why fork, mmap, and swap can exist at all.
Databases read disk through fixed-size pages cached in a buffer pool they manage themselves — duplicating what the kernel's page cache already does. The reasons why (eviction control, WAL ordering, O_DIRECT) are a masterclass in when to bypass the OS.
Every pointer dereference triggers a virtual-to-physical translation through a four-level radix tree. The only reason your machine isn't 5x slower is a tiny cache called the TLB — and when it misses, you feel it.
fork clones a 10 GB process in under a millisecond by copying nothing — just page tables, marked read-only. The first write to any page pays the real cost. Elegant, and the source of Redis's most famous operational trap.
A single unbounded copy can hand an attacker your instruction pointer. The classic stack smash, then the 25-year arms race — stack canaries, NX, ASLR — that turned a reliable exploit into a hard research problem.