Re: Bug in do_munmap (fwd)

["Benjamin C.R. LaHaise" <blah@kvack.org>]

> I think I found the problem.  In zap_page_range:
...
> As you can see, dir is never freed.  If you look at zap_pmd_range, dir
> is used as a lookup point.  dir is what's being left around after the
> mmap.  The reason that this isn't a system wide memory leak is because
> the pages are freed when the process is reaped. Does this sound right?

Even if this particular aspect of it is fixed, the user can still bring
down the system by doing an anon mmap of 1 page at each 4MB boundry...
The correct fix is to have some sort of ulimit on the size of page tables,
or to make page tables swappable (uh-oh, that's a toughie fraught with
races).

		-ben