Here's an example of what the address space looks like in the AndroidHardening builds with github.com/AndroidHardeni:
gist.github.com/thestinger/426
This is a debug build with memory mappings labels enabled. This is with -DGUARD_SLABS_INTERVAL=1 for adding a guard slab after every slab.
Conversation
You can see that there's a large reserved region for slabs, with sub-regions for each size class, and high entropy random gaps between them:
gist.github.com/thestinger/426
Metadata for both slabs and large allocations is fully in a separate reserved region:
Replying to
Here's an active large allocation, showing the random gaps around it:
gist.github.com/thestinger/426
Here's a large allocation that was freed, resulting in it being turned into a fresh PROT_NONE mapping until it's pushed out of the virtual memory quarantine:
1
1