From owner-freebsd-bugs@FreeBSD.ORG Mon Apr 11 09:50:34 2005 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BA02216A4CE for ; Mon, 11 Apr 2005 09:50:34 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 67FAF43D5D for ; Mon, 11 Apr 2005 09:50:34 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j3B9oYpZ079816 for ; Mon, 11 Apr 2005 09:50:34 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j3B9oYss079815; Mon, 11 Apr 2005 09:50:34 GMT (envelope-from gnats) Resent-Date: Mon, 11 Apr 2005 09:50:34 GMT Resent-Message-Id: <200504110950.j3B9oYss079815@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, LiangYi Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F15CF16A4CE for ; Mon, 11 Apr 2005 09:48:35 +0000 (GMT) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id CCCCC43D1D for ; Mon, 11 Apr 2005 09:48:35 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id j3B9mZJ5057320 for ; Mon, 11 Apr 2005 09:48:35 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id j3B9mZ0J057319; Mon, 11 Apr 2005 09:48:35 GMT (envelope-from nobody) Message-Id: <200504110948.j3B9mZ0J057319@www.freebsd.org> Date: Mon, 11 Apr 2005 09:48:35 GMT From: LiangYi To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Subject: kern/79785: realtek NIC will crash a heavy BSD system X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Apr 2005 09:50:34 -0000 >Number: 79785 >Category: kern >Synopsis: realtek NIC will crash a heavy BSD system >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Apr 11 09:50:33 GMT 2005 >Closed-Date: >Last-Modified: >Originator: LiangYi >Release: 5.3 >Organization: none >Environment: 5.3-RELEASE >Description: The realtek NIC is really the worst PCI ethernet controller ever made. When system is busy, the received data size will be wrong which will cause a warning like this "rl0: discard oversize frame (ether type ed72 flags 3 len 58817 > max 1514)". when you have got this message frequently your system will crash soon. >How-To-Repeat: Add some code at ip_input() function which can delay the system running for more than 0.5 second on each first process at a new second. The oversize warning message will appear. This will crash the system soon. Here is my sample code, on the top of the function ip_input(): { int iii; static unsignerd int last_sec=0; struct timeval tv; microtime(&tv); if(tv.tve_sec!=last_sec) { for(iii=0; iii<200000000; iii++); last_sec = tv.tv_sec; } } I think this bug can be repeated on FreeBSD 4.0-5.3. >Fix: First, no one know the data length received from realtek NIC. It will be a random count when the system is busy. So your buffer must be ready to receive 65536 bytes at any time. Otherwise two big continues frames will crash the system. The easy way is increase the DMA buffer size from "RL_RXBUFLEN + 1518" to "RL_RXBUFLEN + RL_RXBUFLEN" which can make your buffer big enough. >Release-Note: >Audit-Trail: >Unformatted: