Sophos Anti-Virus for Mac Home Edition

[ZeoS]

Hi,

today I have expirienced the Kernel Panic.

OS:

Mac OS X 10.7.3

Machine:

Model Name:    iMac
Model Identifier:    iMac11,1
Processor Name:    Intel Core i5
Processor Speed:    2.66 GHz
Number of Processors:    1
Total Number of Cores:    4
L2 Cache (per Core):    256 KB
L3 Cache:    8 MB
Memory:    16 GB
Processor Interconnect Speed:    4.8 GT/s
Boot ROM Version:    IM111.0034.B02
SMC Version (system):    1.54f36

Panic copy/paste ----------------------

Fri Apr 13 13:07:52 2012
panic(cpu 1 caller 0xffffff80002c266d): Kernel trap at 0xffffff7f81dfa97d, type 14=page fault, registers:
CR0: 0x000000008001003b, CR2: 0x000000000000001c, CR3: 0x000000004da6e000, CR4: 0x0000000000000660
RAX: 0x0000000000000023, RBX: 0x000000000000eb40, RCX: 0xffffff803e336000, RDX: 0xffffff8026c3f240
RSP: 0xffffff81c8d23780, RBP: 0xffffff81c8d23a00, RSI: 0x0000000027a31840, RDI: 0xffffff8026c3f240
R8:  0x000039104cea8d60, R9:  0xffffff8024d6d980, R10: 0x0000000000000048, R11: 0xffffff80002d8220
R12: 0xffffff81c8d239b0, R13: 0x0000000000000000, R14: 0xffffff80269d1d10, R15: 0xffffff8023fa0c60
RFL: 0x0000000000010246, RIP: 0xffffff7f81dfa97d, CS:  0x0000000000000008, SS:  0x0000000000000010
CR2: 0x000000000000001c, Error code: 0x0000000000000000, Faulting CPU: 0x1

Backtrace (CPU 1), Frame : Return Address
0xffffff81c8d23440 : 0xffffff8000220702 
0xffffff81c8d234c0 : 0xffffff80002c266d 
0xffffff81c8d23660 : 0xffffff80002d7a1d 
0xffffff81c8d23680 : 0xffffff7f81dfa97d 
0xffffff81c8d23a00 : 0xffffff7f81dfbfc2 
0xffffff81c8d23a40 : 0xffffff800052a2b4 
0xffffff81c8d23aa0 : 0xffffff80002f92ec 
0xffffff81c8d23af0 : 0xffffff8000311706 
0xffffff81c8d23b90 : 0xffffff800030a290 
0xffffff81c8d23c50 : 0xffffff800030a80e 
0xffffff81c8d23f50 : 0xffffff80005caa7b 
0xffffff81c8d23fb0 : 0xffffff80002d8363 
      Kernel Extensions in backtrace:
         com.sophos.kext.sav(8.0.1)[9F2DF25D-B665-7144-C1AE-C2168D411D43]@0xffffff7f81df9000->0xffffff7f81dfdfff

BSD process name corresponding to current thread: ath

Mac OS version:
11D50b

Kernel version:
Darwin Kernel Version 11.3.0: Thu Jan 12 18:47:41 PST 2012; root:xnu-1699.24.23~1/RELEASE_X86_64
Kernel UUID: 7B6546C7-70E8-3ED8-A6C3-C927E4D3D0D6
System model name: iMac11,1 (Mac-F2268DAE)

System uptime in nanoseconds: 62742172669353
last loaded kext at 56555585929769: com.apple.iokit.IOAVBFamily	1.0.0d22 (addr 0xffffff7f8078e000, size 36864)
last unloaded kext at 56620042886674: com.apple.iokit.IOAVBFamily	1.0.0d22 (addr 0xffffff7f8078e000, size 36864)
loaded kexts:
com.pihto.driver.KirguduDriver	1.0.5
com.parallels.kext.prl_hid_hook	6.0 12106.692267
com.parallels.kext.prl_hypervisor	6.0 12106.692267
com.parallels.kext.prl_usb_connect	6.0 12106.692267
com.sophos.kext.sav	8.0.1
foo.tap	1.0
foo.tun	1.0
com.taoeffect.ispy.kext	2.0.1
com.parallels.kext.prl_vnic	6.0 12106.692267
com.parallels.kext.prl_netbridge	6.0 12106.692267
com.metakine.handsoff.driver	2.0
com.apple.filesystems.smbfs	1.7.0
com.apple.filesystems.exfat	1.1
com.apple.filesystems.autofs	3.0
com.apple.driver.AppleBluetoothMultitouch	66.6
com.apple.driver.AppleHWSensor	1.9.4d0
com.apple.driver.AudioAUUC	1.59
com.apple.iokit.IOUserEthernet	1.0.0d1
com.apple.Dont_Steal_Mac_OS_X	7.0.0
com.apple.driver.AGPM	100.12.42
com.apple.driver.AppleMikeyHIDDriver	122
com.apple.driver.AppleHDA	2.1.7f9
com.apple.driver.AppleUpstreamUserClient	3.5.9
com.apple.driver.AppleMCCSControl	1.0.26
com.apple.kext.ATIFramebuffer	7.1.8
com.apple.driver.AppleMikeyDriver	2.1.7f9
com.apple.ATIRadeonX2000	7.1.8
com.apple.driver.AudioIPCDriver	1.2.2
com.apple.driver.ACPI_SMC_PlatformPlugin	4.7.5d4
com.apple.driver.AppleLPC	1.5.3
com.apple.driver.AppleBacklight	170.1.9
com.apple.driver.AppleIRController	312
com.apple.driver.AppleUSBCardReader	3.0.1
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless	1.0.0d1
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib	1.0.0d1
com.apple.BootCache	33
com.apple.iokit.SCSITaskUserClient	3.0.3
com.apple.iokit.IOAHCIBlockStorage	2.0.1
com.apple.driver.AppleFWOHCI	4.8.9
com.apple.driver.AirPort.Atheros40	503.60.3
com.apple.iokit.AppleBCM5701Ethernet	3.0.8b2
com.apple.driver.AppleUSBHub	4.5.0
com.apple.driver.AppleEFINVRAM	1.5.0
com.apple.driver.AppleAHCIPort	2.2.0
com.apple.driver.AppleUSBEHCI	4.5.8
com.apple.driver.AppleACPIButtons	1.4
com.apple.driver.AppleRTC	1.4
com.apple.driver.AppleHPET	1.6
com.apple.driver.AppleSMBIOS	1.7
com.apple.driver.AppleACPIEC	1.4
com.apple.driver.AppleAPIC	1.5
com.apple.driver.AppleIntelCPUPowerManagementClient	167.3.0
com.apple.nke.applicationfirewall	3.2.30
com.apple.security.quarantine	1.1
com.apple.driver.AppleIntelCPUPowerManagement	167.3.0
com.apple.kext.triggers	1.0
com.apple.driver.AppleMultitouchDriver	220.62.1
com.apple.driver.IOBluetoothHIDDriver	4.0.3f12
com.apple.iokit.IOSurface	80.0
com.apple.iokit.IOBluetoothSerialManager	4.0.3f12
com.apple.iokit.IOSerialFamily	10.0.5
com.apple.driver.DspFuncLib	2.1.7f9
com.apple.driver.AppleSMBusController	1.0.10d0
com.apple.kext.ATI4800Controller	7.1.8
com.apple.kext.ATISupport	7.1.8
com.apple.iokit.IOFireWireIP	2.2.4
com.apple.driver.AppleHDAController	2.1.7f9
com.apple.iokit.IOHDAFamily	2.1.7f9
com.apple.iokit.IOAudioFamily	1.8.6fc6
com.apple.kext.OSvKernDSPLib	1.3
com.apple.driver.ApplePolicyControl	3.0.16
com.apple.driver.AppleSMC	3.1.1d8
com.apple.driver.IOPlatformPluginFamily	4.7.5d4
com.apple.driver.AppleGraphicsControl	3.0.16
com.apple.driver.AppleSMBusPCI	1.0.10d0
com.apple.driver.AppleBacklightExpert	1.0.3
com.apple.iokit.IONDRVSupport	2.3.2
com.apple.iokit.IOGraphicsFamily	2.3.2
com.apple.driver.CoreStorage	182.10
com.apple.driver.AppleUSBHIDKeyboard	152.3
com.apple.driver.AppleHIDKeyboard	152.3
com.apple.driver.BroadcomUSBBluetoothHCIController	4.0.3f12
com.apple.driver.AppleUSBBluetoothHCIController	4.0.3f12
com.apple.iokit.IOBluetoothFamily	4.0.3f12
com.apple.iokit.IOUSBHIDDriver	4.4.5
com.apple.iokit.IOSCSIBlockCommandsDevice	3.0.3
com.apple.iokit.IOUSBMassStorageClass	3.0.1
com.apple.iokit.IOFireWireSerialBusProtocolTransport	2.1.0
com.apple.iokit.IOFireWireSBP2	4.2.0
com.apple.driver.AppleUSBMergeNub	4.5.3
com.apple.driver.AppleUSBComposite	4.5.8
com.apple.iokit.IOSCSIMultimediaCommandsDevice	3.0.3
com.apple.iokit.IOBDStorageFamily	1.6
com.apple.iokit.IODVDStorageFamily	1.7
com.apple.iokit.IOCDStorageFamily	1.7
com.apple.driver.XsanFilter	403
com.apple.iokit.IOAHCISerialATAPI	2.0.1
com.apple.iokit.IOSCSIArchitectureModelFamily	3.0.3
com.apple.iokit.IOFireWireFamily	4.4.5
com.apple.iokit.IO80211Family	412.2
com.apple.iokit.IOEthernetAVBController	1.0.0d5
com.apple.iokit.IONetworkingFamily	2.0
com.apple.iokit.IOUSBUserClient	4.5.8
com.apple.iokit.IOAHCIFamily	2.0.7
com.apple.iokit.IOUSBFamily	4.5.8
com.apple.driver.AppleEFIRuntime	1.5.0
com.apple.iokit.IOHIDFamily	1.7.1
com.apple.iokit.IOSMBusFamily	1.1
com.apple.security.sandbox	177.3
com.apple.kext.AppleMatch	1.0.0d1
com.apple.security.TMSafetyNet	7
com.apple.driver.DiskImages	331.3
com.apple.iokit.IOStorageFamily	1.7
com.apple.driver.AppleKeyStore	28.18
com.apple.driver.AppleACPIPlatform	1.4
com.apple.iokit.IOPCIFamily	2.6.8
com.apple.iokit.IOACPIFamily	1.4

 ---------------------------------------------

Cheers

[bobcook]

Hi,

Thanks for the note, and apologies that you've had this bad experience. There was another, similar report here. Both reports have only a couple of things in common, namely using Parallels and the version of the kernel. We've not been able to reproduce this in our testing lab though. Would you mind running the SDU and sending us the logs? You can find info about running the SDU here:

http://www.sophos.com/support/knowledgebase/article/33533.html

Also if there is anything that might be unique about your installation that might explain how to reproduce it, we'd be happy to hear it! As of this morning there are 75K people using this version, so this is certainly a pretty rare event and we'd really like to figure it out.

[ycul]

Hi Bob,

I have had two episodes of kernel panic on my older iMac (but not on a newer one or on my old MacBook) since I installed the free version (8.0.1C) last week.  Not running Parallels; don't know what kernel version is - or what kernel panic means, for that matter, other than bad news!  I ran the SDU - should I send it to someone?

Thanks in advance for your help,

Ycul

[padrino]

Installed 8.0.1C over the weekend, two kernel panics before turning off on access scanner since that seems to be what is causing the panics.. Running 10.7.3 but on a positive note this is a fairly fresh install without Parallels (yet). I ran the diag tool and will send something into support referencing this thread sicne I don't have a tech support reference number.

[padrino]

Tried with 8.0.2 but it's worse now, the second I enabled On-Access scanning the system froze and now on boot it hangs when it loads the Sophos On Access Kernel extension. No Parallels here..

I sent the diagnostic information as requested but I got a replay asking me for a contract, in any case it's been an interesting expireiment but I just went and purchased Mcafee to give myself something.

[chrischris]

Hey I have also been getting kernal Panics, but with 8.0.2. I also have Parralles installed...

Wed Apr 18 08:36:04 2012
panic(cpu 0 caller 0xffffff80002c266d): Kernel trap at 0xffffff7f821bcb0d, type 14=page fault, registers:
CR0: 0x000000008001003b, CR2: 0x000000000000001c, CR3: 0x0000000020bff026, CR4: 0x00000000000206e0
RAX: 0x0000000000000023, RBX: 0x0000000000000099, RCX: 0xffffff800e387700, RDX: 0xffffff800e00dda0
RSP: 0xffffff807c2937c0, RBP: 0xffffff807c293a00, RSI: 0x0000000027a3aee5, RDI: 0xffffff800e00dda0
R8:  0x7fffffffffffff00, R9:  0x0000000000000000, R10: 0x8000000020bff026, R11: 0x00000000cccccc00
R12: 0xffffff801327c4d8, R13: 0x0000000000000000, R14: 0xffffff800e387858, R15: 0xffffff807c2939b0
RFL: 0x0000000000010246, RIP: 0xffffff7f821bcb0d, CS:  0x0000000000000008, SS:  0x0000000000000010
CR2: 0x000000000000001c, Error code: 0x0000000000000000, Faulting CPU: 0x0

Backtrace (CPU 0), Frame : Return Address
0xffffff807c293480 : 0xffffff8000220702
0xffffff807c293500 : 0xffffff80002c266d
0xffffff807c2936a0 : 0xffffff80002d7a1d
0xffffff807c2936c0 : 0xffffff7f821bcb0d
0xffffff807c293a00 : 0xffffff7f821bdf42
0xffffff807c293a40 : 0xffffff800052a2b4
0xffffff807c293aa0 : 0xffffff80002f92ec
0xffffff807c293af0 : 0xffffff8000311706
0xffffff807c293b90 : 0xffffff800030a290
0xffffff807c293c50 : 0xffffff800030a80e
0xffffff807c293f50 : 0xffffff80005caa7b
0xffffff807c293fb0 : 0xffffff80002d8363
      Kernel Extensions in backtrace:
         com.sophos.kext.sav(8.0.2)[A5921E10-F693-9290-D24E-EE5A71E052FA]@0xffffff7f821bb000->0xffffff7f821bffff

BSD process name corresponding to current thread: WindowServer

Mac OS version:
11D50b

Kernel version:
Darwin Kernel Version 11.3.0: Thu Jan 12 18:47:41 PST 2012; root:xnu-1699.24.23~1/RELEASE_X86_64
Kernel UUID: 7B6546C7-70E8-3ED8-A6C3-C927E4D3D0D6
System model name: MacBookPro6,2 (Mac-F22586C8)

System uptime in nanoseconds: 46994831726798
last loaded kext at 15558351854182: com.apple.iokit.IOAVBFamily    1.0.0d22 (addr 0xffffff7f807ad000, size 36864)
last unloaded kext at 15618381137190: com.apple.iokit.IOAVBFamily    1.0.0d22 (addr 0xffffff7f807ad000, size 36864)
loaded kexts:
com.trusteer.driver.gakl_driver_2    1
com.razer.imperator.driver    1.0
com.parallels.kext.prl_hid_hook    7.0 14922.693916
com.parallels.kext.prl_hypervisor    7.0 14922.693916
com.parallels.kext.prl_usb_connect    7.0 14922.693916
com.sophos.kext.sav    8.0.2
com.parallels.kext.prl_vnic    7.0 14922.693916
com.parallels.kext.prl_netbridge    7.0 14922.693916
com.AmbrosiaSW.AudioSupport    4.0
at.obdev.nke.LittleSnitch    2.4.0
com.apple.driver.AppleHWSensor    1.9.4d0
com.apple.filesystems.autofs    3.0
com.apple.driver.AudioAUUC    1.59
com.apple.driver.AGPM    100.12.42
com.apple.driver.AppleMikeyHIDDriver    122
com.apple.iokit.IOUserEthernet    1.0.0d1
com.apple.driver.AppleMikeyDriver    2.1.7f9
com.apple.Dont_Steal_Mac_OS_X    7.0.0
com.apple.driver.AppleHDA    2.1.7f9
com.apple.driver.AppleUpstreamUserClient    3.5.9
com.apple.driver.AppleMCCSControl    1.0.26
com.apple.driver.SMCMotionSensor    3.0.1d2
com.apple.driver.ACPI_SMC_PlatformPlugin    4.7.5d4
com.apple.driver.AppleSMCLMU    2.0.1d2
com.apple.driver.AudioIPCDriver    1.2.2
com.apple.driver.AppleLPC    1.5.3
com.apple.driver.AppleMuxControl    3.0.16
com.apple.GeForce    7.1.8
com.apple.driver.AppleIntelHDGraphics    7.1.8
com.apple.driver.AppleIntelHDGraphicsFB    7.1.8
com.apple.driver.AppleUSBTCButtons    225.2
com.apple.driver.AppleUSBCardReader    3.0.1
com.apple.driver.AppleIRController    312
com.apple.driver.AppleUSBTCKeyboard    225.2
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless    1.0.0d1
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib    1.0.0d1
com.apple.BootCache    33
com.apple.iokit.IOAHCIBlockStorage    2.0.1
com.apple.driver.AppleSmartBatteryManager    161.0.0
com.apple.driver.AirPort.Brcm4331    513.20.19
com.apple.iokit.AppleBCM5701Ethernet    3.0.8b2
com.apple.driver.AppleEFINVRAM    1.5.0
com.apple.driver.AppleUSBHub    4.5.0
com.apple.driver.AppleFWOHCI    4.8.9
com.apple.driver.AppleAHCIPort    2.2.0
com.apple.driver.AppleACPIButtons    1.4
com.apple.driver.AppleUSBEHCI    4.5.8
com.apple.driver.AppleRTC    1.4
com.apple.driver.AppleHPET    1.6
com.apple.driver.AppleSMBIOS    1.7
com.apple.driver.AppleACPIEC    1.4
com.apple.driver.AppleAPIC    1.5
com.apple.driver.AppleIntelCPUPowerManagementClient    167.3.0
com.apple.nke.applicationfirewall    3.2.30
com.apple.security.quarantine    1.1
com.apple.driver.AppleIntelCPUPowerManagement    167.3.0
com.apple.kext.triggers    1.0
com.apple.iokit.IOSurface    80.0
com.apple.iokit.IOBluetoothSerialManager    4.0.3f12
com.apple.iokit.IOSerialFamily    10.0.5
com.apple.driver.DspFuncLib    2.1.7f9
com.apple.driver.AppleSMBusController    1.0.10d0
com.apple.driver.IOPlatformPluginFamily    4.7.5d4
com.apple.iokit.IOFireWireIP    2.2.4
com.apple.driver.AppleSMC    3.1.1d8
com.apple.driver.AppleHDAController    2.1.7f9
com.apple.iokit.IOHDAFamily    2.1.7f9
com.apple.iokit.IOAudioFamily    1.8.6fc6
com.apple.kext.OSvKernDSPLib    1.3
com.apple.driver.ApplePolicyControl    3.0.16
com.apple.driver.AppleSMBusPCI    1.0.10d0
com.apple.driver.AppleGraphicsControl    3.0.16
com.apple.driver.AppleBacklightExpert    1.0.3
com.apple.nvidia.nv50hal    7.1.8
com.apple.NVDAResman    7.1.8
com.apple.iokit.IONDRVSupport    2.3.2
com.apple.iokit.IOGraphicsFamily    2.3.2
com.apple.driver.BroadcomUSBBluetoothHCIController    4.0.3f12
com.apple.driver.AppleUSBBluetoothHCIController    4.0.3f12
com.apple.iokit.IOBluetoothFamily    4.0.3f12
com.apple.iokit.IOSCSIBlockCommandsDevice    3.0.3
com.apple.iokit.IOUSBMassStorageClass    3.0.1
com.apple.iokit.IOSCSIArchitectureModelFamily    3.0.3
com.apple.driver.AppleUSBMultitouch    227.1
com.apple.iokit.IOUSBHIDDriver    4.4.5
com.apple.driver.AppleUSBMergeNub    4.5.3
com.apple.driver.AppleUSBComposite    4.5.8
com.apple.driver.XsanFilter    403
com.apple.iokit.IO80211Family    412.2
com.apple.iokit.IOEthernetAVBController    1.0.0d5
com.apple.iokit.IONetworkingFamily    2.0
com.apple.iokit.IOUSBUserClient    4.5.8
com.apple.iokit.IOFireWireFamily    4.4.5
com.apple.iokit.IOAHCIFamily    2.0.7
com.apple.driver.AppleEFIRuntime    1.5.0
com.apple.iokit.IOHIDFamily    1.7.1
com.apple.iokit.IOUSBFamily    4.5.8
com.apple.iokit.IOSMBusFamily    1.1
com.apple.security.sandbox    177.3
com.apple.kext.AppleMatch    1.0.0d1
com.apple.security.TMSafetyNet    7
com.apple.driver.DiskImages    331.3
com.apple.iokit.IOStorageFamily    1.7
com.apple.driver.AppleKeyStore    28.18
com.apple.driver.AppleACPIPlatform    1.4
com.apple.iokit.IOPCIFamily    2.6.8
com.apple.iokit.IOACPIFamily    1.4
Model: MacBookPro6,2, BootROM MBP61.0057.B0F, 2 processors, Intel Core i7, 2.66 GHz, 4 GB, SMC 1.58f16
Graphics: NVIDIA GeForce GT 330M, NVIDIA GeForce GT 330M, PCIe, 512 MB
Graphics: Intel HD Graphics, Intel HD Graphics, Built-In, 288 MB
Memory Module: BANK 0/DIMM0, 2 GB, DDR3, 1067 MHz, 0x80CE, 0x4D34373142353637334648302D4346382020
Memory Module: BANK 1/DIMM0, 2 GB, DDR3, 1067 MHz, 0x80CE, 0x4D34373142353637334648302D4346382020
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x93), Broadcom BCM43xx 1.0 (5.100.98.75.19)
Bluetooth: Version 4.0.3f12, 2 service, 18 devices, 1 incoming serial ports
Network Service: AirPort, AirPort, en1
Serial ATA Device: OCZ-VERTEX2, 120.03 GB
Serial ATA Device: Hitachi HTS545050B9SA02, 500.11 GB
USB Device: hub_device, 0x0424  (SMSC), 0x2514, 0xfa100000 / 2
USB Device: BRCM2070 Hub, 0x0a5c  (Broadcom Corp.), 0x4500, 0xfa110000 / 5
USB Device: Bluetooth USB Host Controller, apple_vendor_id, 0x8218, 0xfa113000 / 8
USB Device: Apple Internal Keyboard / Trackpad, apple_vendor_id, 0x0236, 0xfa120000 / 4
USB Device: Internal Memory Card Reader, apple_vendor_id, 0x8403, 0xfa130000 / 3
USB Device: hub_device, 0x0424  (SMSC), 0x2514, 0xfd100000 / 2
USB Device: Built-in iSight, apple_vendor_id, 0x8507, 0xfd110000 / 4
USB Device: IR Receiver, apple_vendor_id, 0x8242, 0xfd120000 / 3

[maser]

I am also experiencing random kernel panics (4 in the past 10 days) -- both with 8.0.1 and now with 8.0.2

I do not have Parallels installed (but do have Virtual Box and VMWare Fusion installed) -- however neither were running at the time of the last kernel panic.

(I have also submitted log files up the chain -- but I wanted to chime in on this thread as it's not *only* Parallels-related...)

[Agile]

Thanks for the added data point!

By "up the chain" I presume you mean you sent them to Apple?

[maser]

By "up the chain" -- I mean to Sophos (we license the non-free version of this here...)  Sophos engineers have copies of my logs, etc.

But, yes, I also filed a bug with Apple.

[Agile]

Thanks!  This means the product team should have the log and be working on replicating the problem and finding  the fix.