Willy's memory-management to-do list

What the patch does is keep a list of processes with more than 5000 mappings. That's no process on my laptop, but some workloads will have a process or two end up on this list. I understand ElectricFence creates a lot of mappings and so does UML.

Once any individual page goes over 2 billion mappings, we check the list. Anyone on the list with this page mapped more than 1000 times is deemed to be part of the attack and is killed.

https://lwn.net/Articles/748524/

Thanks for mentioning the KSM possibility. I hadn't thought of that. I'll take a look at the KSM code to see if it tries to avoid mapcount overflow. I think the zero page is treated specially, but it's not unreasonable to check for other special patterns.