[mtdblock3] CPU usage every 10 seconds

[L&LD]

Welcome to the forums @zizzyzizzy.

It doesn't help to come in and the first thing you do is criticize.

Stay focused.

What router are you talking about? What firmware version? When was the last time you did a full reset to factory defaults and then minimally and manually configure the router to connect to your ISP and secure it? Without using any saved backup config file, nor re-inserting any previously used USB drive that was used for amtm (or other) scripts?

Keep in mind that some settings are 'sticky'. And just toggling them on/off is not the same as leaving them off in the first place. That is why a full reset is needed sometimes; to quickly get back to a good/known state with the least amount of time spent 'troubleshooting' needless internal firmware interactions.

[Wireless Router] When Standard Reset Isn’t Working: Hard Factory Reset - Models list | Official Support | ASUS Global

Find your model in the link above and follow the steps to do the Asus recommended method to a full reset to factory defaults and then see if your router is still exhibiting this issue.


Some routers seem extra hard to reset and require multiple times with different methods. If your router continues to exhibit the same behavior after following the above link, it might be helpful to try the suggestions in the link below.

Merlin on ASUS ax86U Question

I have an ASUS AX86U and contemplating the installation of Merlin firmware. The DDNS settings on the AX86U are limited to select dns providers. If I install Merlin, will I have more flexability (choices) with the DDNS Settings? Thanks in advance!

www.snbforums.com

 

[ColinTaylor]

**UPDATE** I updated the firmware with a release that came out two weeks ago. It's been 30 minutes with no high CPU or high load issues. I would still like to know why mtdblock3 is running in the first place and how to prevent this from happening again.

mtdblock3 (on the OP's router) is the kernel driver that provides access to the storage device containing the operating system. It's always present otherwise you wouldn't have a working system.

 

[zizzyzizzy]

It appears Asus caused this with a bad update to AIProtection asd, the built-in Trend Micro malware detection.

https://twitter.com/x/status/1659034066166099969

RT-AX89X going out of memory every 10 minutes (asd process?)

Hello, my router froze up overnight, so I rebooted it, and ever since the logs are showing that it is going OOM about every 10 minutes. First it starts spamming:May 17 10:44:26 kernel: [ 5872.720019] wlan: [0:E:QDF] NBUF alloc failed 12107B @ dp_get_ppdu_desc:3430 May 17 10:44:26 kernel: [...

rog-forum.asus.com

Apparently someone posted incorrectly that it was AIProtection, and everyone else started parroting the same information. Like these guys:

ASUS routers knocked offline worldwide by bad security update

ASUS has apologized to its customers for a server-side security maintenance error that has caused a wide range of impacted router models to lose network connectivity.

www.bleepingcomputer.com

 

[L&LD]

No, it didn't.

Aiprotection update error

https://www.tomshardware.com/news/asus-routers-offline-faulty-update

www.snbforums.com

 

[ColinTaylor]

It appears Asus caused this with a bad update to AIProtection. Never mind that AIProtection is not enabled on my router. It sounds like the daemon downloads updates regularly anyway.

ASUS routers knocked offline worldwide by bad security update

ASUS has apologized to its customers for a server-side security maintenance error that has caused a wide range of impacted router models to lose network connectivity.

www.bleepingcomputer.com

As RMerlin stated in another post this is nothing to do with AiProtection. Whoever wrote that piece doesn't understand what asd is.

 

[Viktor Jaep]

@Makaveli Another necro post here, another three years later. Can you guess why? Yup, this is STILL a problem in 2023, and this is the first post that comes up on a Google search. Condescending comments about necro posting relevant and current information are not appreciated or needed in a help forum.

Anyway, this is still an issue years later. I'm about ready to throw this Asus router out the window because it keeps grinding to a halt. The most likely suspect is mtdblock3, which is eating up 99% of the CPU and causing a load of over 32 on my router. Like the other poster, I don't need or want AI Cloud, which is why it's disabled and yet still bricking my router. Nothing has changed on this router in months.

Does anyone have any suggestions about this issue or comments as to why it's still in issue in 2023? Is there any way to rename or remove the file being run for no reason?

**UPDATE** I updated the firmware with a release that came out two weeks ago. It's been 30 minutes with no high CPU or high load issues. I would still like to know why mtdblock3 is running in the first place and how to prevent this from happening again.

You might want to ping @JGrana... he's got a good bit of knowledge with mtd...

 

[sfx2000]

Wonder if this is related?

Post dated 17 May 2023

Downtown Doug Brown » What happened with ASUS routers this morning?

www.downtowndougbrown.com

Seems like maybe limited to factory builds, not the forks...

 

[ColinTaylor]

It appears Asus caused this with a bad update to AIProtection asd, the built-in Trend Micro malware detection.

Again, asd is nothing to do with Trend Micro's malware detection. asd is Asus' code.

 

[Viktor Jaep]

Wonder if this is related?

Post dated 17 May 2023

Downtown Doug Brown » What happened with ASUS routers this morning?

www.downtowndougbrown.com

Seems like maybe limited to factory builds, not the forks...

This is why autoupdates are *SUCH* a bad idea...

 

[sfx2000]

Wonder if this is related?

Post dated 17 May 2023

Downtown Doug Brown » What happened with ASUS routers this morning?

www.downtowndougbrown.com

Seems like maybe limited to factory builds, not the forks...

It took 48 hours, but the mystery of the mass Asus router outage is solved

Asus finally responds after being castigated by users.

arstechnica.com

 

[Viktor Jaep]

It took 48 hours, but the mystery of the mass Asus router outage is solved

Asus finally responds after being castigated by users.

arstechnica.com

Oh snap... "Why were routers affected even when they had been configured to not automatically update and no manual update had been performed? Asus has yet to address this, but the likely answer is that the definitions file for ASD, which resides in memory and scans devices for security threats, gets updated whether or not automatic updates are enabled."

 

[SomeWhereOverTheRainBow]

It took 48 hours, but the mystery of the mass Asus router outage is solved

Asus finally responds after being castigated by users.

arstechnica.com

The explanation answered the question of what was causing routers to crash, but it raised a new one: Why were routers affected even when they had been configured to not automatically update and no manual update had been performed? Asus has yet to address this, but the likely answer is that the definitions file for ASD, which resides in memory and scans devices for security threats, gets updated whether or not automatic updates are enabled.


The long and short of things is that the 48-hour mystery surrounding the malfunctioning Asus routers has now been solved and a fix is in place. We now return you to your normally scheduled Internet usage.

This is a reason why ASD should not be in an asus router (may be wrong), eventually the users will need protection from it.

 

[ColinTaylor]

This is a reason why ASD should not be in an asus router (may be wrong), eventually the users will need protection from it.

asd is not AiProtection. asd is the thing that prevents and removes malware infections from the router. It's there because of all the criticism they got in the past when people didn't update their router's firmware and it got infected. You can't have it both ways.

 

[SomeWhereOverTheRainBow]

asd is not AiProtection. asd is the thing that prevents and removes malware infections from the router. It's there because of all the criticism they got in the past when people didn't update their router's firmware and it got infected. You can't have it both ways.

Obviously it is not "AI protect".
Agreed, but ASD should be removed. It was a bad addition that had good intentions. Apparently, it's auto update feature is in itself a potential for breaking the router now. It should atleast be a feature the user could turn on/off, and update themselves, but I don't suspect you experienced this bad definition update, otherwise you may have a different opinion. Pray you never do.

 

[ColinTaylor]

Obviously it is not "AI protect".

Before your edit you said it was. So you seemed to be confused about what exactly asd does.

Agreed, but ASD should be removed. It was a bad addition that had good intentions. Apparently, it's auto update feature is in itself a potential for breaking the router now.

I agree that this router breaking update should never have happened. The same as those times when Microsoft and Sophos pushed AV updates that bricked Windows. But there are numerous instances reported in these forums where it's prevented malware getting onto the router. There was one just the other day here. The alternative is to go back to the days when Asus routers were constantly being exploited by the likes of VPNFilter or "the Korean malware".

It should atleast be a feature the user could turn on/off, and update themselves...

That would seem like a reasonable compromise (but see RMerlin's comment below), just like AiProtection is optional. The default being on for both to protect the average non-technical user, but optionally off for the geeks who perhaps are running a separate firewall.

 

[SomeWhereOverTheRainBow]

Before your edit you said it was. So you seemed to be confused about what exactly asd does.

Not confused, uninformed until I looked at some more of the inner workings.

 

[Viktor Jaep]

Agree with @SomeWhereOverTheRainBow ... I wish we were given a way to remove it so we can run our own antivirus/malware on these routers... speaking of which... does anyone use clamav on their routers?

 

[JGrana]

You might want to ping @JGrana... he's got a good bit of knowledge with mtd...

As others have said, mtdblock3 is not a process/application that “runs”. It is the name of a device (flash memory) that “exists”. In the case of mtdblock3, it exists to store the root file system. The square brackets around the name in ps indicate it didn’t have a command line - it is usually a kernel thread or service. Invoked by another program.
It shows that some other program is using the service (reading and/or writing the root filesystem on the device - mtdblock3) heavily!

 

[RMerlin]

does anyone use clamav on their routers?

ClamAV has ZERO knowledge of any malware that runs on a router, and it has no understanding of the concept of nvram and JFFS scripts. ASD is specifically designed to handled malwares that targets Asus routers. ClamAV cannot do anything to protect you there - nothing else can. You need a custom-designed solution, just like QNAP has their own Malware Remover.

Allowing it to be disabled would rend it completely useless, because if the user can disable it, then obviously so could any malware targeting your router.

Broken signature files are just a fact of life. Microsoft, Trend Micro, Eset, Norton - they've all pushed a broken signature file at one point or another that broke Windows.

 

[Viktor Jaep]

ClamAV has ZERO knowledge of any malware that runs on a router, and it has no understanding of the concept of nvram and JFFS scripts.

Super interesting! Thanks for sharing, @RMerlin!