Fix null-pointer dereference crash when the system is intentionally

    run out of KVM through a mmap()/fork() bomb that allocates hundreds
    of thousands of vm_map_entry structures.

    Add panic to make null-pointer dereference crash a little more verbose.

    Add a new sysctl, vm.max_proc_mmap, which specifies the maximum number
    of mmap()'d spaces (discrete vm_map_entry's in the process).  The value
    defaults to around 9000 for a 128MB machine.  The test is scaled for the
    number of processes sharing a vmspace (aka linux threads).  Setting
    the value to 0 disables the feature.

PR: kern/16573
Approved by: jkh

1 files changed, 7 insertions, 1 deletions

diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c
index 3f5382e..7acaa51 100644
--- a/sys/vm/vm_map.c
+++ b/sys/vm/vm_map.c
@@ -284,7 +284,13 @@ static vm_map_entry_t
 vm_map_entry_create(map)
 	vm_map_t map;
 {
-	return zalloc((map->system_map || !mapentzone) ? kmapentzone : mapentzone);
+	vm_map_entry_t new_entry;
+
+	new_entry = zalloc((map->system_map || !mapentzone) ? 
+		kmapentzone : mapentzone);
+	if (new_entry == NULL)
+	    panic("vm_map_entry_create: kernel resources exhausted");
+	return(new_entry);
 }
 
 /*