kernel - Fix long-standing vm_map token panic

* Bug turned out to be an error path in vm_map_find().

* This bug ate a lot of hours from several people, but Antonio was able
  to instrument the token path in a way that allowed us to narrow down
  and locate the problem.

Submitted-by: tuxillo, vsrinivas
Debugging-by: tuxillo

diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c
index 896ea47..7353a2a 100644 (file)
--- a/sys/vm/vm_map.c
+++ b/sys/vm/vm_map.c
@@ -1265,6 +1265,8 @@ vm_map_find(vm_map_t map, vm_object_t object, vm_ooffset_t offset,
                vm_object_hold(object);
        if (fitit) {
                if (vm_map_findspace(map, start, length, align, 0, addr)) {
+                       if (object)
+                               vm_object_drop(object);
                        vm_map_unlock(map);
                        vm_map_entry_release(count);
                        return (KERN_NO_SPACE);