basically the idea is very simple:

• allocate a large virtual address space (like vmalloc does)
• regular allocation (OBD_MALLOC) allocates a new page and maps it to that virtual address space
• regular deallocation (OBD_FREE) unmaps the page from VA and releases it
• given VA is large enough we can use it in round-robin manner so that VA address is not re-used for new allocation for a period - so catch use-after-free
• address returned by OBD_MALLOC() can be at the beginning of new page or at the end - so catch out-of-range access