crash when bpf is used heavily

[Don Bowman]

From: Kris Kennaway [mailto:kris at obsecurity.org]
> On Sat, May 29, 2004 at 04:03:45PM +0300, Sergey Lyubka wrote:
> 
> > put M_NOWAIT in bpf_allocbufs().
> > Got page fault now.
> > panic: kmem_malloc(4098) too small 
> 
> That means "You have run out of KVA" and need to reduce the workload,
> or retune the kernel memory allocations.

The problem the original post has, although on the
surface kind of nasty (easily able to panic from user
space), can be easily worked around by creating
less bpf devices (/dev/bpf0, ... create only 4 of
them) and appropriately resizing KVA. If I recall,
he had also increased quite dramatically the bpf
buffer size.

--don