System using McAfee's LinuxShield Antivirus becomes unresponsive.

Solution Verified - Updated -

Issue

  • McAfee's LinuxShield makes the system unresponsive.
  • The system log file is filled with the following type of error messages.
INFO: task tar:16922 blocked for more than 120 seconds.
      Not tainted 2.6.32-431.11.2.el6.x86_64 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
tar           D 0000000000000002     0 16922  16227 0x00000080
 ffff880534a93c38 0000000000000086 ffffffff81065df0 0000000000000000
 0000000000000000 0000000000000286 ffff880534a93bd8 ffff8805329aeb30
 ffff880532835058 ffff880534a93fd8 000000000000fbc8 ffff880532835058
Call Trace:
 [<ffffffff81065df0>] ? default_wake_function+0x0/0x20
 [<ffffffff8109b5be>] ? prepare_to_wait+0x4e/0x80
 [<ffffffffa031360d>] doScan+0x86d/0xe10 [linuxshield]         
 [<ffffffff8112200a>] ? generic_file_aio_write+0xba/0x100
 [<ffffffff8109b290>] ? autoremove_wake_function+0x0/0x40
 [<ffffffffa030fe60>] ? cacheLookup+0xf0/0x180 [linuxshield]   
 [<ffffffffa0313c70>] SC_doScan+0xc0/0x170 [linuxshield]
 [<ffffffffa030e519>] releaseHook+0xc9/0x1c0 [linuxshield]
 [<ffffffffa03026b5>] invokeCallbacks+0x1c5/0x870 [lshook]     
 [<ffffffffa03031d2>] fileReleaseHook+0xe2/0x130 [lshook]
 [<ffffffff8118a7f5>] __fput+0xf5/0x210
 [<ffffffff8118a935>] fput+0x25/0x30
 [<ffffffff81185c5d>] filp_close+0x5d/0x90
 [<ffffffff81185d35>] sys_close+0xa5/0x100
 [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b

OR

kernel: INFO: task osad:4315 blocked for more than 120 seconds.
kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kernel: osad          D ffff810009004420     0  4315      1          4329  4297 (NOTLB)
kernel:  ffff81022ae2bc88 0000000000000086 ffff81022ae2bbd8 0000000000000000
kernel:  ffff8101f9b28740 000000000000000a ffff81023fba9100 ffffffff80309b60
kernel:  000a7ee80327e12d 00000000000369d3 ffff81023fba92e8 000000008805cea0
kernel: Call Trace:
kernel:  [<ffffffff884801d4>] :linuxshield:doScan+0x91e/0xd37
kernel:  [<ffffffff800a1ba4>] autoremove_wake_function+0x0/0x2e
kernel:  [<ffffffff8847f4ce>] :linuxshield:cacheLookup+0x96/0x152
kernel:  [<ffffffff88481378>] :linuxshield:SC_doScan+0x108/0x115
kernel:  [<ffffffff8847e47e>] :linuxshield:releaseHook+0x108/0x177
kernel:  [<ffffffff8846fb05>] :lshook:invokeCallbacks+0x365/0x4f7
kernel:  [<ffffffff800a1ba4>] autoremove_wake_function+0x0/0x2e
kernel:  [<ffffffff80067b88>] do_page_fault+0x4fe/0x874
kernel:  [<ffffffff80065644>] __down_read+0x12/0x92
kernel:  [<ffffffff80022127>] __up_read+0x19/0x7f
kernel:  [<ffffffff88470762>] :lshook:fileReleaseHook+0x9e/0x108
kernel:  [<ffffffff80012ac5>] __fput+0xd3/0x1bd
kernel:  [<ffffffff80023bd1>] filp_close+0x5c/0x64
kernel:  [<ffffffff8001dff3>] sys_close+0x88/0xbd
kernel:  [<ffffffff8005e116>] system_call+0x7e/0x83
kernel: 

Environment

  • Red Hat Enterprise Linux
  • McAfee VirusScan Enterprise For Linux
  • Mcafee Endpoint Security for Linux
  • Unsigned (U) kernel modules: [linuxshield] / [lshook] / [fileaccess_mod]

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content