RecursivePageTable::map_to allows breaking memory safety

[phil-opp]

The map_to method of the Mapper trait is not unsafe, but it is possible to break memory safety by passing a FrameAllocator that returns frames that are already in use.

To avoid this, we should either make the map_to method unsafe or make FrameAllocator an unsafe trait.

[phil-opp]

I thought about this and found another way how map_to can break memory safety: Unmap a mapped page, then map that page to an already mapped frame. A write to this page then corrupts the other page that is mapped to the same frame.