On 21/10/2020 15:44, Sadique Urf Arbaz Sayyed wrote:
> The process will hold the 24Kb but actually the process is not visible in Task manager or anywhere but in RamMap we see that the executed process still occupied the Page table memory.
Did you mean 24KB, or is that really 3KB?
Any memory leakage that persists after the process is no longer visible
in the process table is down to the OS.
As already pointed out page table allocations are unlikely to be what
that memory is.
I'm not familiar with the details of Window NT family memory use
reporting, but the only legitimate carry over would be for cached pages.
Such pages are optimisations and don't deny memory to other processes.
Both Linux and Windows try and allocate nearly all their memory to
something. In the case of the Linux "free" command, it computes an
available figure which is much larger than the free figure, by including
memory that can safely be discarded. If there isn't an OS bug, I wonder
if you are seeing that effect.
One wild thought: is ntpq or one of its DLLs not position independent
code? I could speculate as to why Windows might keep relocated pages
around in case the code is reloaded at the same address before the page
gets reused for other reasons. However, I don't actually know if
Windows does something like that.