kern/79785: realtek NIC will crash a heavy BSD system

[LiangYi]

>Number:         79785
>Category:       kern
>Synopsis:       realtek NIC will crash a heavy BSD system
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Apr 11 09:50:33 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     LiangYi
>Release:        5.3
>Organization:
none
>Environment:
5.3-RELEASE
>Description:
      The realtek NIC is really the worst PCI ethernet controller ever made. When system is busy, the received data size will be wrong which will cause a warning like this "rl0: discard oversize frame (ether type ed72 flags 3 len 58817 > max 1514)". when you have got this message frequently your system will crash soon. 
>How-To-Repeat:
      Add some code at ip_input() function which can delay the system running for more than 0.5 second on each first process at a new second. The oversize warning message will appear. This will crash the system soon.
      Here is my sample code, on the top of the function ip_input():
        {
          int iii;
          static unsignerd int last_sec=0;
          struct timeval tv;
          microtime(&tv);
          if(tv.tve_sec!=last_sec)
          {
                  for(iii=0; iii<200000000; iii++);
                  last_sec = tv.tv_sec;
          }
        }
      I think this bug can be repeated on FreeBSD 4.0-5.3.

>Fix:
      First, no one know the data length received from realtek NIC. It will be a random count when the system is busy. So your buffer must be ready to receive 65536 bytes at any time. Otherwise two big continues frames will crash the system.
      The easy way is increase the DMA buffer size from "RL_RXBUFLEN + 1518" to "RL_RXBUFLEN + RL_RXBUFLEN" which can make your buffer big enough.

>Release-Note:
>Audit-Trail:
>Unformatted: