create_module(2)

💖 create_module(2) — the girlies' guide to a syscall that literally ghosted us 💀

okay bestie, gather round, because we're talking about create_module from the Linux System Calls Manual — and no cap, this one is a vintage situation. It's giving "found in the back of the closet, still tagged." 🎀

---

✨ NAME ✨

create_module — create a loadable module entry 🦋

---

🌸 SYNOPSIS 🌸

#include <linux/module.h>

[[deprecated]] caddr_t create_module(const char *name, size_t size);

not the [[deprecated]] tag already dragging it before we even start 💅

---

💜 DESCRIPTION 💜

Note: this system call is present only before Linux 2.6. So if you're on anything modern, it's not showing up to the party. 🙈

create_module() attempts to create a loadable module entry and reserve the kernel memory that will be needed to hold the module. It's literally reserving the VIP section for the module before it even arrives.

This system call requires privilege. No privilege, no entry — the bouncer is checking your CAP_SYS_MODULE and she is not flexible. 🔥

---

👑 RETURN VALUE 👑

On success, it returns the kernel address at which the module will reside. That's your little "here's where they're sitting" note. 🫶

On error, -1 is returned and errno is set to indicate the error. Classic. Sigh. 😭

---

💅 ERRORS 💅

• EEXIST — a module by that name already exists. Name already taken, bestie, pick a different one.
• EFAULT — name is outside the program's accessible address space. The pointer is wandering somewhere it's not allowed. Not on my watch.
• EINVAL — the requested size is too small even for the module header information. Like, babe, that's not enough room for the front matter.
• ENOMEM — the kernel could not allocate a contiguous block of memory large enough for the module. The kernel looked at your request and said "no contiguous blocks, sorry."
• ENOSYS — create_module() is not supported in this version of the kernel (e.g., Linux 2.6 or later). It simply does not exist here. Ghosted. Blocked. 💀
• EPERM — the caller was not privileged (did not have the CAP_SYS_MODULE capability). You didn't have the pass, so you didn't get in.

---

🌈 STANDARDS 🌈

Linux. That's it, that's the standard. 🧚

---

⭐ HISTORY ⭐

Removed in Linux 2.6. Gone. Retired. It went out on top.

This obsolete system call is not supported by glibc. There's no declaration provided in glibc headers — but through a quirk of history, glibc versions before glibc 2.23 did export an ABI for this system call. The way that ancient glibc was out here holding the door open for a syscall that already left… 😭

So, in order to employ this system call, it was sufficient to manually declare the interface in your code. Alternatively, you could invoke the system call using syscall(2). Two paths, both vintage, both a little bit feral. 🍓

---

💖 SEE ALSO 💖

• delete_module(2) — the breakup
• init_module(2)
• query_module(2)

---

and that's the whole page, bestie!! every last flag, error, and historical footnote accounted for. no details were harmed in the making of this rewrite ✨

signing off with the receipts: this little relic lives in Linux man-pages 6.20, dated 2025-05-17 — a manual page about a syscall removed in 2.6, still serving looks in 2025. iconic, honestly. 👑