Thanks for the answer! I set the clear interrupt flag from this article: http://vulnfactory.org/blog/2011/08/12/wp-safe-or-not/ As apparently if not done it could lead to a scheduling problem on SMP systems? Thanks, Enzo On Thu, Apr 23, 2020 at 2:05 AM 양원혁 <kjhg4321@naver.com> wrote:

According to the log, the page frame of sys_call_table is not currently present.

So it should be handled by page fault handler. But. disable_write_protection blocks the interrupt via the cli instruction. So the page fault handler cannot be performed.

...

[ 4024.772066] Module loading [ 4024.790716] + sys_call_table address = 00000000055df43d [ 4024.790718] Execve syscall # 59 [ 4024.791116] BUG: unable to handle page fault for address: 000000008004020b [ 4024.792614] #PF: supervisor write access in kernel mode [ 4024.793944] #PF: error_code(0x0002) - not-present page