The epoll allocation for the fd lookup hash used to allocate up to 1MB
(depending on the "hint" size passed to epoll_create()) with
__get_free_pages(0), and this might lead to a "malicious" user to do
something like:

    for (i = 0; i < 1024; i++)
        epoll_create(BIG-NUM);

You can replace "malicious user" with IBM-ltp test suite, and the meaning
does not change.  The above code might exhaust memory badly, even before
the file creation limit is topped.  Also, the allocation was independent
from the number of fds pushed into the epoll fd hash.  Using an rb-tree
ther will be not pre-allocation of the hash, and the size of the memory
used will be proportional to the number of fds pushed into the epoll fd.
The patch also removes 100 lines of code, that is never a bad thing ;)
Signed-off-by: Davide Libenzi <davidel@xmailserver.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>