Skip to content

munlockall

Intro

munlockall - Unlocks all currently locked-in-memory pages

Description

The munlockall () system call unlocks all pages in the address space of the current process that were previously locked via mlockall (). After the call, pages are unlocked regardless of the current reference counts. It has no effect on any pages that were not previously locked via mlockall ().

The munlockall () system call does not unlock the amount of memory locked for the process. The amount of locked memory for the process remains the same after a call to munlockall (). However, the call does reset the list of mlocked regions. Any subsequent mlock() and mlock2() system calls are limited by the amount of memory that is currently locked for the process.

Arguments

  • addr:void *[U] - Pointer to a memory region.

Available Tags

  • K - Originated from kernel-space.
  • U - Originated from user space (for example, pointer to user space memory used to get it)
  • TOCTOU - Vulnerable to TOCTOU (time of check, time of use)
  • OPT - Optional argument - might not always be available (passed with null value)

Hooks

munlockall

Type

Kprobes

Purpose

To monitor a process's memory utilization, and detect excessive page locking.

Example Use Case

An application may need to allocate a large chunk of memory and lock it down for its exclusive use. With munlockall () an application can quickly establish multiple regions of locked memory that it does not need to allocate and initialize each time.

Issues

munlockall() may cause performance issues on some systems due to the additional IO operations performed.

  • mlockall()
  • mlock()
  • munlock()

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.