when pmap_demote_pde() allocates a page table page to implement a
user-space demotion, it must increment the pmap's resident page count.
Not doing so, can lead to an underflow during address space termination
that causes pmap_remove() to exit prematurely, before it has destroyed
all of the mappings within the specified range. The ultimate effect or
symptom of this error is an assertion failure in vm_page_free_toq()
because the page being freed is still mapped.
This error is only possible when superpage promotion is enabled. Thus,
it only affects FreeBSD versions greater than 7.2.
Tested by: pho, alc
Reviewed by: alc
Approved by: re (rwatson)
MFC after: 1 week
78d3e2f45a