CC 3.6 causing crash on macOS 10.15.7?

BWC

Hi,

for a couple of weeks now my Mac mini (2018) is crashing now and then. It suddenly reboots for no obvious reason.

The Crash Report shows some reference to SonicWallWebProtection every single time, which got me thinking if CC could be the cause of that? It might get started with deployment of CC 3.6, can't think of crashes while using 3.1.

panic(cpu 2 caller 0xffffff800f74ad5a): "tcp_lock: so=0xffffff80648c3160 NO PCB! lr=0xffffff7f93670e42 lrh= 0xffffff800f8de88b:0xffffff800f8fd576 0xffffff800f8cd28d:0xffffff800f8fd576 0xffffff800f8dd22d:0xffffff800f73b692 0xffffff800f720b57:0xffffff800f8fd576 \n"@/AppleInternal/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-6153.141.33/bsd/netinet/tcp_subr.c:3309
Backtrace (CPU 2), Frame : Return Address
0xffffff83b84db820 : 0xffffff800f31c63d 
0xffffff83b84db870 : 0xffffff800f456b25 
0xffffff83b84db8b0 : 0xffffff800f4486ae 
0xffffff83b84db900 : 0xffffff800f2c2a40 
0xffffff83b84db920 : 0xffffff800f31bd07 
0xffffff83b84dba20 : 0xffffff800f31c0f7 
0xffffff83b84dba70 : 0xffffff800fac0b3c 
0xffffff83b84dbae0 : 0xffffff800f74ad5a 
0xffffff83b84dbb10 : 0xffffff800f8d17fe 
0xffffff83b84dbc30 : 0xffffff7f93670e42 
0xffffff83b84dbca0 : 0xffffff7f9367d0a0 
0xffffff83b84dbcd0 : 0xffffff7f9367d248 
0xffffff83b84dbd10 : 0xffffff7f9366eab1 
0xffffff83b84dbd40 : 0xffffff7f93671a78 
0xffffff83b84dbd80 : 0xffffff800f859183 
0xffffff83b84dbdd0 : 0xffffff800f8d6917 
0xffffff83b84dbee0 : 0xffffff800f8e6b6e 
0xffffff83b84dbf40 : 0xffffff800f983cb7 
0xffffff83b84dbfa0 : 0xffffff800f2c3206 
   Kernel Extensions in backtrace:
     com.sonicwall.ses.CFDriver(308.0)[D8E188B5-39CE-3CF8-A651-00F001BD1125]@0xffffff7f9366d000->0xffffff7f93684fff

BSD process name corresponding to current thread: SonicWallWebProt
Boot args: chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
19H1217

Is anyone else experiencing this kind of trouble?

WebProtection seems to be picky, it complained about an internal URL (https://myserver.mydomain.internal) a couple days ago, but that's maybe another story.

--Michael@BWC

mrt2222

yes, i experience this occasionally. i'm gathering crash logs and will eventually submit a case. it is not easily reproduced so i do not expect a quick resolution. I experienced it with the 3.1 client, too.

BWC

Thanks @mrt2222 I'am not that eager to open a support case as well. Maybe if it happens more often I feel the pressure.

--Michael@BWC

BWC

@SuroopMC are you aware of any cases which addressing the macOS Crashes? It happened again to me today while sitting in Google Chrome. It all points to SonicWallWebProtection.

Latest macOS Upates are applied.

panic(cpu 2 caller 0xffffff801ab4ad7a): "tcp_lock: so=0xffffff8069a66b40 NO PCB! lr=0xffffff7f9e30ee42 lrh= 0xffffff801acde8ab:0xffffff801acfd596 0xffffff801accd2ad:0xffffff801acfd596 0xffffff801acde8ab:0xffffff801acd02bc 0xffffff801accd2ad:0xffffff801acfd596 \n"@/AppleInternal/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-6153.141.35/bsd/netinet/tcp_subr.c:3309
Backtrace (CPU 2), Frame : Return Address
0xffffff83c3793820 : 0xffffff801a71c63d 
0xffffff83c3793870 : 0xffffff801a856b25 
0xffffff83c37938b0 : 0xffffff801a8486ae 
0xffffff83c3793900 : 0xffffff801a6c2a40 
0xffffff83c3793920 : 0xffffff801a71bd07 
0xffffff83c3793a20 : 0xffffff801a71c0f7 
0xffffff83c3793a70 : 0xffffff801aec0b5c 
0xffffff83c3793ae0 : 0xffffff801ab4ad7a 
0xffffff83c3793b10 : 0xffffff801acd181e 
0xffffff83c3793c30 : 0xffffff7f9e30ee42 
0xffffff83c3793ca0 : 0xffffff7f9e31b0a0 
0xffffff83c3793cd0 : 0xffffff7f9e31b248 
0xffffff83c3793d10 : 0xffffff7f9e30cab1 
0xffffff83c3793d40 : 0xffffff7f9e30fa78 
0xffffff83c3793d80 : 0xffffff801ac591a3 
0xffffff83c3793dd0 : 0xffffff801acd6937 
0xffffff83c3793ee0 : 0xffffff801ace6b8e 
0xffffff83c3793f40 : 0xffffff801ad83cd7 
0xffffff83c3793fa0 : 0xffffff801a6c3206 
      Kernel Extensions in backtrace:
         com.sonicwall.ses.CFDriver(308.0)[D8E188B5-39CE-3CF8-A651-00F001BD1125]@0xffffff7f9e30b000->0xffffff7f9e322fff


BSD process name corresponding to current thread: SonicWallWebProt
Boot args: chunklist-security-epoch=0 -chunklist-no-rev2-dev


Mac OS version:
19H1323

And while we are on it, when checking the CC policies, it appears to me that Web Content Filter isn't enabled for any Group but still blocking, how is that a thing?

--Michael@BWC

BWC

The weekly crash starts early this week, anyone else having these crashes? @SuroopMC any idea how to tackle this?

panic(cpu 2 caller 0xffffff800774ad7a): "tcp_lock: so=0xffffff80861b03c0 NO PCB! lr=0xffffff7f8b671e42 lrh= 0xffffff80078de8ab:0xffffff80078fd596 0xffffff80078cd2ad:0xffffff80078fd596 0xffffff80078dd24d:0xffffff800773b6b2 0xffffff8007720b77:0xffffff80078fd596 \n"@/AppleInternal/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-6153.141.35/bsd/netinet/tcp_subr.c:3309
Backtrace (CPU 2), Frame : Return Address
0xffffff83b0583820 : 0xffffff800731c63d 
0xffffff83b0583870 : 0xffffff8007456b25 
0xffffff83b05838b0 : 0xffffff80074486ae 
0xffffff83b0583900 : 0xffffff80072c2a40 
0xffffff83b0583920 : 0xffffff800731bd07 
0xffffff83b0583a20 : 0xffffff800731c0f7 
0xffffff83b0583a70 : 0xffffff8007ac0b5c 
0xffffff83b0583ae0 : 0xffffff800774ad7a 
0xffffff83b0583b10 : 0xffffff80078d181e 
0xffffff83b0583c30 : 0xffffff7f8b671e42 
0xffffff83b0583ca0 : 0xffffff7f8b67e0a0 
0xffffff83b0583cd0 : 0xffffff7f8b67e248 
0xffffff83b0583d10 : 0xffffff7f8b66fab1 
0xffffff83b0583d40 : 0xffffff7f8b672a78 
0xffffff83b0583d80 : 0xffffff80078591a3 
0xffffff83b0583dd0 : 0xffffff80078d6937 
0xffffff83b0583ee0 : 0xffffff80078e6b8e 
0xffffff83b0583f40 : 0xffffff8007983cd7 
0xffffff83b0583fa0 : 0xffffff80072c3206 
      Kernel Extensions in backtrace:
         com.sonicwall.ses.CFDriver(308.0)[D8E188B5-39CE-3CF8-A651-00F001BD1125]@0xffffff7f8b66e000->0xffffff7f8b685fff


BSD process name corresponding to current thread: SonicWallWebProt
Boot args: chunklist-security-epoch=0 -chunklist-no-rev2-dev


Mac OS version:
19H1323

--Michael@BWC

BWC

Just a follow-up, since uninstalling Capture Client no more crashes, just saying.

And while we're on it, S1 Agent did not got uninstalled for unknown reason. This usually needs a Passphrase from the S1 backend or a Cleaner Tool.

I opened Ticket #43754704 11 Days ago, and Support is not able to solve this simple Request. No progress on the ticket except some obviously not verified command line tips.

Isn't @SuroopMC around any longer? He seems to be the guy for shorten my pain on this.

I decided to stop uninstallation of other Endpoints because of this dilemma. But days are counted on that.

--Michael@BWC

ThK

@BWC for one week now i have this issue on my iMac. Maybe after the apple security-update last week. I have several crashes a day.

BSD process name corresponding to current thread: SonicWallWebProt

Mac OS version: 19H1824

CC 3.6.30, S1 21.7.4.5853

--Thomas

BWC

@ThK SonicWallWebProtection, a constant beacon of joy. I ditched CC and couldn't be more relaxed (endpoint-wise speaking).

--Michael@BWC

ThK

@BWC as a personal decision to use the cc it's ok to delete it, but my sales pitches for the customer solution keep catching up with me and require unnecessary arguments and that's annoying

--Thomas