Sophos Anti-Virus for Mac Home Edition

[NearlyNT]

I'm also experiencing this kernel panic issue on 3 of my 4 Macs (iMac, MacBook and MacBook Air).  All devices are on OS 10.7.3, however none of are running Parallels.

[Martin]

I'm also experiencing kernel panics with version 8.0.1c when "On-Access Scanning" is enabled. When this option is disabled, everything is fine.

Looking back at the last release of version 3 (3.7.9C ?), I was having the same kernel panics when "On-Access Scanning" was enabled. For some reason, that option had always been disabled, and as soon as I enabled it, the kennel panics started.

I do not have, and never had, Parallels installed.

OS: Mac OS X 10.7.3

[wabonnett]

I'm having the same issue.  This morning I uninstalled Sophos with hopes to re-install at a later date.  Here is the Kernel panic from yesterday:

Interval Since Last Panic Report:  1743679 sec

Panics Since Last Report:          1

Anonymous UUID:                    DC149150-2AEF-4ACA-AA66-5167102B404A

Tue Apr 24 06:41:51 2012

panic(cpu 1 caller 0xffffff80002c266d): Kernel trap at 0xffffff7f8206ab0d, type 14=page fault, registers:

CR0: 0x000000008001003b, CR2: 0x000000000000001c, CR3: 0x000000000c824036, CR4: 0x00000000000606e0

RAX: 0x0000000000000023, RBX: 0x000000000000000b, RCX: 0xffffff8013eec2e0, RDX: 0xffffff8015b35730

RSP: 0xffffff81166bb7c0, RBP: 0xffffff81166bba00, RSI: 0x000000001dcd64ff, RDI: 0xffffff8015b35730

R8:  0x000027b31aaa5600, R9:  0x0000000000000001, R10: 0x000000000c824036, R11: 0xffffff80002d8200

R12: 0xffffff80247fbba0, R13: 0x0000000000000000, R14: 0xffffff8013eec438, R15: 0xffffff81166bb9b0

RFL: 0x0000000000010246, RIP: 0xffffff7f8206ab0d, CS:  0x0000000000000008, SS:  0x0000000000000010

CR2: 0x000000000000001c, Error code: 0x0000000000000000, Faulting CPU: 0x1

Backtrace (CPU 1), Frame : Return Address

0xffffff81166bb480 : 0xffffff8000220702

0xffffff81166bb500 : 0xffffff80002c266d

0xffffff81166bb6a0 : 0xffffff80002d7a1d

0xffffff81166bb6c0 : 0xffffff7f8206ab0d

0xffffff81166bba00 : 0xffffff7f8206bf42

0xffffff81166bba40 : 0xffffff800052a2b4

0xffffff81166bbaa0 : 0xffffff80002f92ec

0xffffff81166bbaf0 : 0xffffff8000311706

0xffffff81166bbb90 : 0xffffff800030a290

0xffffff81166bbc50 : 0xffffff800030a80e

0xffffff81166bbf50 : 0xffffff80005caa7b

0xffffff81166bbfb0 : 0xffffff80002d8363

      Kernel Extensions in backtrace:

         com.sophos.kext.sav(8.0.2)[A5921E10-F693-9290-D24E-EE5A71E052FA]@0xffffff7f82069000->0xffffff7f8206dfff

BSD process name corresponding to current thread: UserEventAgent

Mac OS version:

11D50b

Kernel version:

Darwin Kernel Version 11.3.0: Thu Jan 12 18:47:41 PST 2012; root:xnu-1699.24.23~1/RELEASE_X86_64

Kernel UUID: 7B6546C7-70E8-3ED8-A6C3-C927E4D3D0D6

System model name: MacBookPro8,2 (Mac-94245A3940C91C80)

System uptime in nanoseconds: 43650200001595

last loaded kext at 82061874439: com.vmware.kext.vmnet          3.1.3 (addr 0xffffff7f8215a000, size 45056)

last unloaded kext at 350708184963: com.apple.driver.AppleUSBUHCI    4.4.5 (addr 0xffffff7f80a4e000, size 65536)

loaded kexts:

com.vmware.kext.vmnet            3.1.3

com.vmware.kext.vmioplug       3.1.3

com.vmware.kext.vmci                3.1.3

com.vmware.kext.vmx86            3.1.3

com.sophos.kext.sav     8.0.2

org.virtualbox.kext.VBoxNetAdp             3.0.10

org.virtualbox.kext.VBoxNetFlt 3.0.10

org.virtualbox.kext.VBoxUSB     3.0.10

org.virtualbox.kext.VBoxDrv      3.0.10

com.apple.driver.AppleHWSensor           1.9.4d0

com.apple.filesystems.autofs    3.0

com.apple.driver.AppleMikeyHIDDriver                122

com.apple.driver.AppleHDA       2.1.7f9

com.apple.driver.AppleMikeyDriver       2.1.7f9

com.apple.driver.AudioAUUC    1.59

com.apple.driver.AGPM               100.12.42

com.apple.kext.ATIFramebuffer              7.1.8

com.apple.driver.AppleUpstreamUserClient      3.5.9

com.apple.driver.AppleMCCSControl     1.0.26

com.apple.driver.SMCMotionSensor      3.0.1d2

com.apple.iokit.IOUserEthernet               1.0.0d1

com.apple.driver.AppleSMCLMU             2.0.1d2

com.apple.Dont_Steal_Mac_OS_X          7.0.0

com.apple.driver.AudioIPCDriver             1.2.2

com.apple.driver.ACPI_SMC_PlatformPlugin      4.7.5d4

com.apple.driver.AppleMuxControl        3.0.16

com.apple.ATIRadeonX3000       7.1.8

com.apple.driver.AppleLPC         1.5.3

com.apple.driver.AppleIntelHD3000Graphics      7.1.8

com.apple.driver.MaxTranserSizeOverrideDriver             3.0.1

com.apple.driver.AppleUSBTCButtons   225.2

com.apple.driver.AppleUSBTCKeyboard               225.2

com.apple.driver.AppleIRController        312

com.apple.iokit.SCSITaskUserClient        3.0.3

com.apple.AppleFSCompression.AppleFSCompressionTypeDataless      1.0.0d1

com.apple.AppleFSCompression.AppleFSCompressionTypeZlib                1.0.0d1

com.apple.BootCache   33

com.apple.iokit.IOAHCIBlockStorage      2.0.1

com.apple.driver.AppleSDXC     1.1.4

com.apple.driver.AppleUSBHub               4.5.0

com.apple.driver.AppleFWOHCI               4.8.9

com.apple.driver.AirPort.Brcm4331         513.20.19

com.apple.iokit.AppleBCM5701Ethernet              3.0.8b2

com.apple.driver.AppleEFINVRAM          1.5.0

com.apple.driver.AppleSmartBatteryManager   161.0.0

com.apple.driver.AppleAHCIPort             2.2.0

com.apple.driver.AppleUSBEHCI              4.5.8

com.apple.driver.AppleACPIButtons      1.4

com.apple.driver.AppleRTC        1.4

com.apple.driver.AppleHPET      1.6

com.apple.driver.AppleSMBIOS                1.7

com.apple.driver.AppleACPIEC 1.4

com.apple.driver.AppleAPIC      1.5

com.apple.driver.AppleIntelCPUPowerManagementClient         167.3.0

com.apple.nke.applicationfirewall           3.2.30

com.apple.security.quarantine  1.1

com.apple.driver.AppleIntelCPUPowerManagement     167.3.0

com.apple.driver.AppleBluetoothHIDMouse      170.4

com.apple.driver.AppleHIDMouse          170.4

com.apple.driver.AppleBluetoothHIDKeyboard 152.3

com.apple.driver.AppleHIDKeyboard     152.3

com.apple.driver.IOBluetoothHIDDriver               4.0.3f12

com.apple.kext.triggers                1.0

com.apple.driver.DspFuncLib     2.1.7f9

com.apple.driver.AppleAVBAudio           1.0.0d11

com.apple.driver.AppleSMBusController              1.0.10d0

com.apple.driver.AppleUSBAudio            2.8.2f5

com.apple.iokit.IOFireWireIP     2.2.4

com.apple.iokit.IOSurface           80.0

com.apple.iokit.IOBluetoothSerialManager         4.0.3f12

com.apple.iokit.IOSerialFamily   10.0.5

com.apple.iokit.IOAVBFamily     1.0.0d22

com.apple.iokit.IOAudioFamily  1.8.6fc6

com.apple.kext.OSvKernDSPLib                1.3

com.apple.driver.AppleHDAController   2.1.7f9

com.apple.iokit.IOHDAFamily     2.1.7f9

com.apple.driver.ApplePolicyControl     3.0.16

com.apple.driver.AppleSMC       3.1.1d8

com.apple.driver.IOPlatformPluginFamily            4.7.5d4

com.apple.driver.AppleGraphicsControl               3.0.16

com.apple.driver.AppleSMBusPCI           1.0.10d0

com.apple.driver.AppleBacklightExpert 1.0.3

com.apple.kext.ATI6000Controller           7.1.8

com.apple.kext.ATISupport        7.1.8

com.apple.iokit.IONDRVSupport              2.3.2

com.apple.driver.AppleIntelSNBGraphicsFB        7.1.8

com.apple.iokit.IOGraphicsFamily            2.3.2

com.apple.iokit.IOSCSIBlockCommandsDevice   3.0.3

com.apple.driver.BroadcomUSBBluetoothHCIController               4.0.3f12

com.apple.driver.AppleUSBBluetoothHCIController        4.0.3f12

com.apple.iokit.IOBluetoothFamily         4.0.3f12

com.apple.iokit.IOUSBMassStorageClass              3.0.1

com.apple.driver.AppleUSBMultitouch 227.1

com.apple.driver.AppleThunderboltDPInAdapter            1.5.9

com.apple.driver.AppleThunderboltDPAdapterFamily   1.5.9

com.apple.driver.AppleThunderboltPCIDownAdapter   1.2.1

com.apple.iokit.IOUSBHIDDriver               4.4.5

com.apple.driver.AppleUSBMergeNub 4.5.3

com.apple.driver.AppleUSBComposite  4.5.8

com.apple.iokit.IOSCSIMultimediaCommandsDevice      3.0.3

com.apple.iokit.IOBDStorageFamily        1.6

com.apple.iokit.IODVDStorageFamily     1.7

com.apple.iokit.IOCDStorageFamily        1.7

com.apple.driver.XsanFilter        403

com.apple.iokit.IOAHCISerialATAPI         2.0.1

com.apple.iokit.IOSCSIArchitectureModelFamily              3.0.3

com.apple.driver.AppleThunderboltNHI               1.3.2

com.apple.iokit.IOThunderboltFamily    1.7.4

com.apple.iokit.IOUSBUserClient             4.5.8

com.apple.iokit.IOFireWireFamily            4.4.5

com.apple.iokit.IO80211Family  412.2

com.apple.iokit.IOEthernetAVBController            1.0.0d5

com.apple.iokit.IONetworkingFamily      2.0

com.apple.iokit.IOAHCIFamily    2.0.7

com.apple.iokit.IOUSBFamily     4.5.8

com.apple.driver.AppleEFIRuntime         1.5.0

com.apple.iokit.IOHIDFamily      1.7.1

com.apple.iokit.IOSMBusFamily                1.1

com.apple.security.sandbox       177.3

com.apple.kext.AppleMatch      1.0.0d1

com.apple.security.TMSafetyNet             7

com.apple.driver.DiskImages     331.3

com.apple.iokit.IOStorageFamily              1.7

com.apple.driver.AppleKeyStore             28.18

com.apple.driver.AppleACPIPlatform     1.4

com.apple.iokit.IOPCIFamily       2.6.8

com.apple.iokit.IOACPIFamily    1.4

Model: MacBookPro8,2, BootROM MBP81.0047.B27, 4 processors, Intel Core i7, 2 GHz, 8 GB, SMC 1.69f3

Graphics: AMD Radeon HD 6490M, AMD Radeon HD 6490M, PCIe, 256 MB

Graphics: Intel HD Graphics 3000, Intel HD Graphics 3000, Built-In, 512 MB

Memory Module: BANK 0/DIMM0, 4 GB, DDR3, 1333 MHz, 0x04CD, 0x46332D3130363636434C392D344742535100

Memory Module: BANK 1/DIMM0, 4 GB, DDR3, 1333 MHz, 0x04CD, 0x46332D3130363636434C392D344742535100

AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0xD6), Broadcom BCM43xx 1.0 (5.100.98.75.19)

Bluetooth: Version 4.0.3f12, 2 service, 18 devices, 1 incoming serial ports

Network Service: Ethernet, Ethernet, en0

Serial ATA Device: ST9500325ASG, 500.11 GB

Serial ATA Device: MAT**bleep**ADVD-R   UJ-898

USB Device: FaceTime HD Camera (Built-in), apple_vendor_id, 0x8509, 0xfa200000 / 3

USB Device: hub_device, 0x0424  (SMSC), 0x2513, 0xfa100000 / 2

USB Device: CodeMeter-Stick, 0x064f  (WIBU-Systems AG), 0x03e9, 0xfa130000 / 6

USB Device: Apple Internal Keyboard / Trackpad, apple_vendor_id, 0x0245, 0xfa120000 / 5

USB Device: BRCM2070 Hub, 0x0a5c  (Broadcom Corp.), 0x4500, 0xfa110000 / 4

USB Device: Bluetooth USB Host Controller, apple_vendor_id, 0x821a, 0xfa113000 / 8

USB Device: hub_device, 0x0424  (SMSC), 0x2513, 0xfd100000 / 2

USB Device: USB2.0 Hub, 0x05e3  (Genesys Logic, Inc.), 0x0606, 0xfd120000 / 4

USB Device: hub_device, 0x058f  (Alcor Micro, Corp.), 0x6254, 0xfd122000 / 6

USB Device: FreeAgent, 0x0bc2  (Seagate LLC), 0x3008, 0xfd122400 / 11

USB Device: FreeAgent, 0x0bc2  (Seagate LLC), 0x3008, 0xfd122300 / 10

USB Device: USB2.0 Hub, 0x05e3  (Genesys Logic, Inc.), 0x0606, 0xfd124000 / 5

USB Device: USB Reader, 0x05e3  (Genesys Logic, Inc.), 0x070e, 0xfd124400 / 9

USB Device: iMic USB audio system, 0x077d, 0x07af, 0xfd124300 / 8

USB Device: Oxygen 49, 0x0763  (M-Audio), 0x2027, 0xfd124200 / 7

USB Device: IR Receiver, apple_vendor_id, 0x8242, 0xfd110000 / 3

[bobcook]

Hey guys, thanks for all the kernel panic dumps. Through analysis of that information we've identified the root cause. Its the same issue for everyone that has reported their kernel panic so far, and related to how many simultaneous scans can be going (not related to virtualization directly, but that may be a contributing factor).

We will be fixing it in 8.0.4. Apologies its going to take so long but we need the extra time to make sure we haven't broken anything else (its in a tricky piece of code).

[maser]

Does this mean you will be disabling the automatic updating from 7.x to 8.x until 8.0.4 is available (which would be early June, right?).

[bobcook]

@maser: That is our current thinking, no reason to cause any discomfort for anyone, even if its only a few people. And yes, 8.0.4 is currently planned for the first week in June.

[wabonnett]

That's great news!  Looking forward to re-installing your app soon.  As a programmer I understand how complexity can cause the need for extra testing steps to ensure all is well. 

Sophos, you rock!

[maser]

Now that 8.0.4 is out through auto-update (at least for 8.x installs)...

1)  There's a presumption that this will fix the kernel panics -- is this confirmed?

2)  If so, when will Sophos 7.x users get the 8.0.4 update automatically?

[bobcook]

8.0.4 is confirmed to address the kernel panics reported in this forum and what we've been able to reproduce in house. Definitely interested to hear if anyone sees anything different.

The rollover of users with the Home Edition to 8.0.4 will happen in June, exact timing is being worked out. We figure it is a good idea to let 8.0.4 run with the current population for a litle while, to assure ourselves that we aren't going to cause anyone problems.

[stukey]

Hi Bob,

Does 8.0.4 also fix the problem with the /.DocumentRevisions-V100/ on-access scanning too? If so is it safe to remove that folder from the Excluded Items setting?

It would be great if Sophos could post what has been fixed/changed in this new release.

Thanks,

Stuart