search

objective-see / BlockBlock

BlockBlock provides continual protection by monitoring persistence locations.
GNU General Public License v3.0
626 stars 39 forks source link

Kernel memory leaks #12

Open Quiark opened 4 years ago

Quiark commented 4 years ago

I was getting rather horrible system crashes (half of UI restarting and freezing every few secs) reliably after installing BlockBlock and it stopped when I disabled them.

Console:

2020-08-03 21:59:36.366208+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Nothing to do for the largest zone [kalloc.128]. Waking up memorystatus thread.
2020-08-03 21:59:36.366262+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Zone map size 6126231552, capacity 6442450944 [jetsam limit 95%]
2020-08-03 21:59:36.366266+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Largest zone kalloc.128, size 5229490176
2020-08-03 21:59:36.366270+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Nothing to do for the largest zone [kalloc.128]. Waking up memorystatus thread.
2020-08-03 21:59:36.366557+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Zone map size 6126252032, capacity 6442450944 [jetsam limit 95%]
2020-08-03 21:59:36.366561+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Largest zone kalloc.128, size 5229490176
2020-08-03 21:59:36.366565+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Nothing to do for the largest zone [kalloc.128]. Waking up memorystatus thread.
2020-08-03 21:59:36.366732+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Zone map size 6126256128, capacity 6442450944 [jetsam limit 95%]
2020-08-03 21:59:36.366736+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Largest zone kalloc.128, size 5229490176
2020-08-03 21:59:36.366741+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Nothing to do for the largest zone [kalloc.128]. Waking up memorystatus thread.
2020-08-03 21:59:36.366750+0800 0x19e      Default     0x0                  0      0    kernel: 88588.284 memorystatus: killing_top_process pid 94854 [studentd] (zone-map-exhaustion 1) 804KB - memorystatus_available_pages: 1307805
2020-08-03 21:59:36.366760+0800 0x303635   Activity    0x34f060             522    0    runningboardd: (RunningBoard) Process Event
2020-08-03 21:59:36.366766+0800 0x303635   Default     0x34f060             522    0    runningboardd: (RunningBoard) [com.apple.runningboard:process] [daemon<com.apple.storeuid(501)>:1877] Death sentinel fired!
2020-08-03 21:59:36.366890+0800 0x4ff      Default     0x0                  137    0    UserEventAgent: (MemoryMonitor) [com.apple.MemoryMonitor:plugin] kernel jetsam snapshot note received
2020-08-03 21:59:36.367432+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Zone map size 6126301184, capacity 6442450944 [jetsam limit 95%]
2020-08-03 21:59:36.367436+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Largest zone kalloc.128, size 5229490176
2020-08-03 21:59:36.367440+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Nothing to do for the largest zone [kalloc.128]. Waking up memorystatus thread.
2020-08-03 21:59:36.368231+0800 0x19e      Default     0x0                  0      0    kernel: 88588.285 memorystatus: killing_top_process pid 1882 [storedownloadd] (zone-map-exhaustion 3) 3572KB - memorystatus_available_pages: 1307723
2020-08-03 21:59:36.368589+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Zone map size 6126268416, capacity 6442450944 [jetsam limit 95%]
2020-08-03 21:59:36.368593+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Largest zone kalloc.128, size 5229490176
2020-08-03 21:59:36.368597+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Nothing to do for the largest zone [kalloc.128]. Waking up memorystatus thread.
2020-08-03 21:59:36.368921+0800 0x19e      Default     0x0                  0      0    kernel: 88588.286 memorystatus: killing_top_process pid 94936 [sandboxd] (zone-map-exhaustion 1) 516KB - memorystatus_available_pages: 1308005
2020-08-03 21:59:36.369132+0800 0x30335e   Default     0x0                  94810  0    osanalyticshelper: extending prolongation transaction timer
2020-08-03 21:59:36.369162+0800 0x303366   Default     0x0                  94810  0    osanalyticshelper: Attempting to write jetsam report
2020-08-03 21:59:36.369384+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Zone map size 6126219264, capacity 6442450944 [jetsam limit 95%]
2020-08-03 21:59:36.369389+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Largest zone kalloc.128, size 5229490176
2020-08-03 21:59:36.369395+0800 0x202      Default     0x0                  0      0    kernel: zone_map_exhaustion: Nothing to do for the largest zone [kalloc.128]. Waking up memorystatus thread.
2020-08-03 21:59:36.369734+0800 0x303366   Default     0x0                  94810  0    osanalyticshelper: (OSAnalytics) Process studentd [94854] killed by jetsam reason zone-map-exhaust
2020-08-03 21:59:36.369756+0800 0x303366   Default     0x0                  94810  0    osanalyticshelper: (OSAnalytics) Process storedownloadd [1882] killed by jetsam reason zone-map-exhaust
2020-08-03 21:59:36.369766+0800 0x303366   Default     0x0                  94810  0    osanalyticshelper: (OSAnalytics) Process sandboxd [94936] killed by jetsam reason zone-map-exhaust

system.log

Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.CoreLocationAgent[94894]): Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.CoreLocation.agent
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.finder.FinderSync.IsExtensionEnabled): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.KernelEventAgent): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100006.Aqua): Caller not allowed to perform action: TextInputMenuAg.95209, action = pid-local registration, code = 1: Operation not permitted, uid = 501, euid = 501, gid = 20, egid = 20, asid = 100006
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.apsd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.metadata.mds): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.corebrightnessd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.eoshostd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.airportd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.fseventsd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.diskarbitrationd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.opendirectoryd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.logind): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.AirPlayXPCHelper): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.thermald): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.coreservices.launchservicesd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.bluetoothd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.mDNSResponder.reloaded): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.revisiond): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.PerfPowerServices): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.biokitaggdd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.cfprefsd.xpc.daemon): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.displaypolicyd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.auditd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.autofsd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.routined): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.apfsd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.netbiosd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.alf): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.SafariPlugInUpdateNotifier): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.bluetoothUIServer): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.uninstalld): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.usbmuxd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.icloud.searchpartyuseragent): Service only ran for 2 seconds. Pushing respawn out by 8 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.parsec-fbf): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.AddressBook.SourceSync): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.AOSHeartbeat): Service only ran for 1 seconds. Pushing respawn out by 9 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.MobileAccessoryUpdater): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.xartstorageremoted): Service only ran for 0 seconds. Pushing respawn out by 1 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.locationd): Service only ran for 0 seconds. Pushing respawn out by 3 seconds.
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.protectedcloudstorage.protectedcloudkeysyncing): Service only ran for 1 seconds. Pushing respawn out by 9 seconds.
Aug  3 21:59:50 Clymene xpcproxy[95180]: libcoreservices: _dirhelper_userdir: 557: bootstrap_look_up returned (ipc/send) invalid destination port
Aug  3 21:59:50 Clymene xpcproxy[95182]: libcoreservices: _dirhelper_userdir: 557: bootstrap_look_up returned (ipc/send) invalid destination port
Aug  3 21:59:50 Clymene com.apple.xpc.launchd[1] (com.apple.cmio.VDCAssistant): Service only ran for 0 seconds. Pushing respawn out by 1 seconds.
Aug  3 21:59:50 Clymene xpcproxy[95392]: libcoreservices: _dirhelper_userdir: 557: bootstrap_look_up returned (ipc/send) invalid destination port
Aug  3 21:59:51 Clymene com.apple.xpc.launchd[1] (com.apple.coreservicesd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  3 21:59:56 Clymene apsd[95435]: objc[95435]: Class APSPerAppTokenMap is implemented in both /System/Library/PrivateFrameworks/ApplePushService.framework/Versions/A/ApplePushService and /System/Library/PrivateFrameworks/ApplePushService.framework/apsd. One of the two will be used. Which one is undefined.
Aug  3 21:59:56 Clymene apsd[95435]: objc[95435]: Class APSPerAppTokenMapEntry is implemented in both /System/Library/PrivateFrameworks/ApplePushService.framework/Versions/A/ApplePushService and /System/Library/PrivateFrameworks/ApplePushService.framework/apsd. One of the two will be used. Which one is undefined.
Aug  3 21:59:56 Clymene apsd[95435]: objc[95435]: Class APSCertificateStorage is implemented in both /System/Library/PrivateFrameworks/ApplePushService.framework/Versions/A/ApplePushService and /System/Library/PrivateFrameworks/ApplePushService.framework/apsd. One of the two will be used. Which one is undefined.
Aug  3 21:59:56 Clymene apsd[95435]: objc[95435]: Class APSPreferences is implemented in both /System/Library/PrivateFrameworks/ApplePushService.framework/Versions/A/ApplePushService and /System/Library/PrivateFrameworks/ApplePushService.framework/apsd. One of the two will be used. Which one is undefined.
Quiark commented 4 years ago

The only other kext I have is VirtualBox but that has been installed for years.

Chasapple4 commented 4 years ago

I was seeing it also (even when it was disabled via the preferences). Also strange was the slow down of Time Machine back ups (which might be related to a macOS 10.15.x bug, macOS is set to auto report to ), a workaround might be to grab the installer to uninstall it (not sure if you can export your rules before the uninstall) until a update with a fix comes out.

objective-see commented 3 years ago

This may have been fixed (by Apple) in 10.15.6 supplemental

According to: 10.15.6 Supplemental Update "This does appear to fix the kernel zone memory leak which was causing panics when running VMWare and VirtualBox VMs, and seems to have restored stability to memory usage here too."

If you've fulled updated macOS, are you still seeing this issue? thanks!

electricsheep14 commented 3 years ago

I'm seeing memory leaks in 10.15.7 as well. While Block-Block (1.0.2) is active, monitoring the output of zprint -d shows a a steady number of allocations hitting zone kalloc.128. After about two weeks up uptime, this zone becomes the largest by far. Disabling Block-Block results in the frequency of allocations to this zone to drop dramatically.