mm/map: limit the count of memory mapping for the task

No memory map count limit that will exhaust memory and cause
the system hang. Also that fix pass LTP posix case mmap/24-1.c

Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>

fs/shm/shmfs.c

@@ -302,7 +302,7 @@ static int shmfs_mmap(FAR struct file *filep,
         {
           entry->munmap = shmfs_munmap;
           entry->priv.p = (FAR void *)filep->f_inode;
-          mm_map_add(get_current_mm(), entry);
+          ret = mm_map_add(get_current_mm(), entry);
         }
     }
 

include/nuttx/mm/map.h

@@ -75,6 +75,8 @@ struct mm_map_s
 {
   sq_queue_t mm_map_sq;
 
+  size_t map_count;
+
 #ifdef CONFIG_ARCH_VMA_MAPPING
   GRAN_HANDLE mm_map_vpages;
 #endif

mm/Kconfig

@@ -98,6 +98,12 @@ config MM_REGIONS
 		that the memory manager must handle and enables the API
 		mm_addregion(heap, start, end);
 
+config MM_MAP_COUNT_MAX
+	int "The maximum number of memory map areas for each task"
+	default 1024
+	---help---
+		The maximum number of memory map areas for each task.
+
 config ARCH_HAVE_HEAP2
 	bool
 	default n

mm/map/Make.defs

@@ -26,7 +26,7 @@ ifeq ($(CONFIG_ARCH_VMA_MAPPING),y)
 CSRCS += vm_region.c
 endif
 
-# Add the shared memory directory to the build
+# Add the map directory to the build
 
 DEPPATH += --dep-path map
 VPATH += :map

mm/map/mm_map.c

@@ -93,6 +93,7 @@ void mm_map_initialize(FAR struct mm_map_s *mm, bool kernel)
 {
   sq_init(&mm->mm_map_sq);
   nxrmutex_init(&mm->mm_map_mutex);
+  mm->map_count = 0;
 
   /* Create the virtual pages allocator for user process */
 
@@ -148,9 +149,13 @@ void mm_map_destroy(FAR struct mm_map_s *mm)
             }
         }
 
+      mm->map_count--;
+
       kmm_free(entry);
     }
 
+  DEBUGASSERT(mm->map_count == 0);
+
   nxrmutex_destroy(&mm->mm_map_mutex);
 
   /* Release the virtual pages allocator */
@@ -198,6 +203,17 @@ int mm_map_add(FAR struct mm_map_s *mm, FAR struct mm_map_entry_s *entry)
       return ret;
     }
 
+  /* Too many mappings? */
+
+  if (mm->map_count >= CONFIG_MM_MAP_COUNT_MAX)
+    {
+      kmm_free(new_entry);
+      nxrmutex_unlock(&mm->mm_map_mutex);
+      return -ENOMEM;
+    }
+
+  mm->map_count++;
+
   sq_addfirst((sq_entry_t *)new_entry, &mm->mm_map_sq);
 
   nxrmutex_unlock(&mm->mm_map_mutex);
@@ -309,6 +325,7 @@ int mm_map_remove(FAR struct mm_map_s *mm,
   if (entry == prev_entry)
     {
       sq_remfirst(&mm->mm_map_sq);
+      mm->map_count--;
       removed_entry = prev_entry;
     }
   else
@@ -321,6 +338,7 @@ int mm_map_remove(FAR struct mm_map_s *mm,
           if (entry == removed_entry)
             {
               sq_remafter((sq_entry_t *)prev_entry, &mm->mm_map_sq);
+              mm->map_count--;
               break;
             }