[Bug] Kernel Oops/Crash on Linux 6.12 (Intel IBT enabled): Missing ENDBR in kallsyms_lookup_name

[Jipok]

Running lunatik causes a Segmentation Fault in user space and a Kernel OOPs in dmesg on a system with Intel IBT (Indirect Branch Tracking) enabled.

Environment

• OS: Void Linux (GLIBC)
• Kernel: 6.12.63_1 (x86_64)
• Lunatik version: 3.7.1
• Hardware: Intel N100

Details

~/code $ sudo lunatik
Password:
Segmentation fault
Segmentation fault
Lunatik 3.7  Copyright (C) 2023-2025 ring-0 Ltda.
> return 42
42
> ~/code $ sudo lunatik status
lunatik is loaded
luadevice is loaded
lualinux is loaded
luanotifier is loaded
luasocket is loaded
luarcu is loaded
luathread is loaded
luafib is loaded
luadata is loaded
luaprobe is loaded
luasyscall is loaded
luaxdp is loaded
luafifo is loaded
luaxtable is loaded
luanetfilter is loaded
luacompletion is loaded
luacrypto_shash is loaded
luacrypto_skcipher is loaded
luacrypto_aead is loaded
luacrypto_rng is loaded
luacrypto_comp is loaded
lunatik_run is loaded
~/code $ sudo lunatik list

~/code $ sudo lunatik reload
rmmod: ERROR: Module luasyscall is in use
rmmod: ERROR: Module luaprobe is in use
rmmod: ERROR: Module lunatik is in use by:rmmod: ERROR:  luaprobermmod: ERROR:  luasyscallrmmod: ERROR:
~/code $

dmesg

[69912.280815] Missing ENDBR: kallsyms_lookup_name+0x4/0xd0
[69912.280840] ------------[ cut here ]------------
[69912.280842] kernel BUG at arch/x86/kernel/cet.c:132!
[69912.280853] Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
[69912.280860] CPU: 3 UID: 0 PID: 147520 Comm: modprobe Tainted: G           OE      6.12.63_1 #1
[69912.280868] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[69912.280871] Hardware name: CHUWI Innovation And Technology(ShenZhen)co.,Ltd GemiBook XPro/Default string, BIOS EM_IDL8329_SUB1_V2.0.22 09/28/2023
[69912.280875] RIP: 0010:exc_control_protection+0x29f/0x2b0
[69912.280884] Code: d8 b9 09 00 00 00 48 8b 93 80 00 00 00 be 80 00 00 00 48 c7 c7 26 35 55 a2 e8 ad 11 3d ff 80 a3 8a 00 00 00 fb e9 38 fe ff ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[69912.280889] RSP: 0018:ffffb9864c0b3bd8 EFLAGS: 00010002
[69912.280895] RAX: 000000000000002c RBX: ffffb9864c0b3c08 RCX: 0000000000000000
[69912.280899] RDX: 0000000000000000 RSI: ffffffffa255df65 RDI: 00000000ffffffff
[69912.280902] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb9864c0b3a78
[69912.280906] R10: ffffffffa2dbaf08 R11: 0000000000000003 R12: 0000000000000003
[69912.280908] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[69912.280911] FS:  00007f298e5bf080(0000) GS:ffffa015f7b80000(0000) knlGS:0000000000000000
[69912.280916] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[69912.280919] CR2: 000055be0c692000 CR3: 00000001c0a0e000 CR4: 0000000000f50ef0
[69912.280923] PKRU: 55555554
[69912.280926] Call Trace:
[69912.280929]  <TASK>
[69912.280933]  asm_exc_control_protection+0x26/0x30
[69912.280941] RIP: 0010:kallsyms_lookup_name+0x4/0xd0
[69912.280947] Code: d0 48 03 05 6e 82 30 01 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 <0f> 1f 44 00 00 53 48 83 ec 10 65 48 8b 04 25 28 00 00 00 48 89 44
[69912.280951] RSP: 0018:ffffb9864c0b3cb0 EFLAGS: 00010246
[69912.280955] RAX: ffffffffa11bd624 RBX: ffffffffc2858010 RCX: 0000000000000000
[69912.280958] RDX: 0000000000000000 RSI: ffffffffa255df65 RDI: ffffffffc2856025
[69912.280961] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
[69912.280963] R10: 0000000000000003 R11: 0000000000000001 R12: ffffb98640788625
[69912.280966] R13: ffffb9864c0b3cc0 R14: 000055bdf49e76d7 R15: ffffb9864c0b3d50
[69912.280972]  ? __pfx_luaprobe_init+0x10/0x10 [luaprobe]
[69912.280981]  ? kallsyms_lookup_name+0x4/0xd0
[69912.280988]  luaprobe_init+0x15/0xff0 [luaprobe]
[69912.280994]  do_one_initcall+0x58/0x310
[69912.281003]  do_init_module+0x60/0x230
[69912.281010]  __do_sys_init_module+0x17a/0x1b0
[69912.281019]  do_syscall_64+0x84/0x170
[69912.281027]  ? __vm_munmap+0xb9/0x170
[69912.281035]  ? fpregs_assert_state_consistent+0x25/0x50
[69912.281041]  ? arch_exit_to_user_mode_prepare.isra.0+0x16/0xa0
[69912.281049]  ? syscall_exit_to_user_mode+0x37/0x180
[69912.281056]  ? do_syscall_64+0x90/0x170
[69912.281061]  ? arch_exit_to_user_mode_prepare.isra.0+0x16/0xa0
[69912.281068]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[69912.281074] RIP: 0033:0x7f298e6c862a
[69912.281079] Code: 48 8b 0d e1 27 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 af 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ae 27 0d 00 f7 d8 64 89 01 48
[69912.281083] RSP: 002b:00007ffd723bd9c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000af
[69912.281088] RAX: ffffffffffffffda RBX: 000055be0c685a00 RCX: 00007f298e6c862a
[69912.281091] RDX: 000055bdf49e76d7 RSI: 0000000000006625 RDI: 000055be0c68d490
[69912.281094] RBP: 000055bdf49e76d7 R08: 0000000000020e50 R09: 00007f298e8d6871
[69912.281097] R10: 00007f298e6c4757 R11: 0000000000000246 R12: 0000000000000000
[69912.281100] R13: 000055be0c685b30 R14: 0000000000000000 R15: 000055be0c68d490
[69912.281105]  </TASK>
[69912.281107] Modules linked in: luaprobe(OE+) luadata(OE) luafib(OE) luathread(OE) luarcu(OE) luasocket(OE) luanotifier(OE) lualinux(OE) luadevice(OE) lunatik(OE) tls rfcomm snd_seq_dummy snd_hrtimer ctr ccm cmac algif_hash algif_skcipher af_alg bnep nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tcp_bbr sch_fq ext4 mbcache jbd2 nls_iso8859_1 nls_cp437 vfat fat dm_crypt encrypted_keys trusted asn1_encoder tee hid_multitouch iTCO_wdt intel_pmc_bxt iTCO_vendor_support joydev hid_microsoft ff_memless mei_hdcp intel_rapl_msr mei_pxp snd_sof_pci_intel_tgl x86_pkg_temp_thermal snd_sof_pci_intel_cnl snd_sof_intel_hda_generic soundwire_intel soundwire_cadence snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_soc_acpi_intel_match intel_powerclamp soundwire_generic_allocation snd_soc_acpi coretemp soundwire_bus snd_soc_avs kvm_intel snd_soc_hda_codec snd_hda_ext_core snd_soc_core kvm uvcvideo snd_hda_codec_hdmi
[69912.281218]  snd_compress videobuf2_vmalloc uvc snd_hda_codec_realtek iwlmvm irqbypass ac97_bus snd_hda_codec_generic videobuf2_memops rapl intel_cstate snd_hda_scodec_component intel_uncore snd_pcm_dmaengine mac80211 videobuf2_v4l2 snd_hda_intel videobuf2_common snd_intel_dspcfg spi_intel_pci snd_intel_sdw_acpi input_leds pcspkr snd_hda_codec libarc4 wmi_bmof spi_intel videodev hid_sensor_prox btusb snd_hda_core iwlwifi hid_sensor_trigger btrtl mc industrialio_triggered_buffer btintel i2c_i801 snd_hwdep btbcm kfifo_buf i2c_designware_platform processor_thermal_device_pci i2c_smbus usbhid snd_pcm processor_thermal_device i2c_mux i2c_designware_core btmtk processor_thermal_wt_hint hid_sensor_iio_common cfg80211 ccp processor_thermal_rfim processor_thermal_rapl industrialio intel_rapl_common mei_me processor_thermal_wt_req mei processor_thermal_power_floor processor_thermal_mbox tpm_crb thermal tpm_tis tpm_tis_core int3403_thermal fan intel_pmc_core int340x_thermal_zone tpm intel_vsec evdev libaescfb int3400_thermal
[69912.281325]  intel_hid pmt_telemetry mac_hid rng_core acpi_pad pmt_class sparse_keymap acpi_tad acpi_thermal_rel ac tiny_power_button vboxnetflt(OE) vboxnetadp(OE) vboxdrv(OE) i2c_dev snd_seq snd_seq_device snd_timer snd soundcore vhost_vsock vmw_vsock_virtio_transport_common vsock vhost_net vhost vhost_iotlb tap hci_vhci bluetooth rfkill ecdh_generic ecc crc16 vfio_iommu_type1 vfio iommufd uhid uinput userio ppp_generic slhc tun loop nvram cuse fuse xe drm_gpuvm drm_exec gpu_sched drm_suballoc_helper drm_ttm_helper hid_sensor_custom hid_sensor_hub hid_generic intel_ishtp_hid i915 intel_gtt drm_buddy i2c_algo_bit drm_display_helper cec spi_pxa2xx_platform rc_core dw_dmac dw_dmac_core ttm spi_pxa2xx_core crct10dif_pclmul crc32_pclmul agpgart polyval_clmulni ahci polyval_generic ghash_clmulni_intel libahci sha512_ssse3 sha256_ssse3 libata sha1_ssse3 aesni_intel gf128mul xhci_pci crypto_simd i2c_hid_acpi scsi_mod cryptd drm_kms_helper i2c_hid sdhci_pci xhci_hcd hid cqhci sdhci serio_raw mmc_core usbcore intel_lpss_pci
[69912.281462]  intel_ish_ipc scsi_common intel_lpss usb_common drm idma64 intel_ishtp virt_dma video battery wmi pinctrl_alderlake button dm_mirror dm_region_hash dm_log dm_mod btrfs blake2b_generic xor raid6_pq libcrc32c crc32c_generic crc32c_intel
[69912.281503] ---[ end trace 0000000000000000 ]---
[69912.281506] RIP: 0010:exc_control_protection+0x29f/0x2b0
[69912.281513] Code: d8 b9 09 00 00 00 48 8b 93 80 00 00 00 be 80 00 00 00 48 c7 c7 26 35 55 a2 e8 ad 11 3d ff 80 a3 8a 00 00 00 fb e9 38 fe ff ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[69912.281517] RSP: 0018:ffffb9864c0b3bd8 EFLAGS: 00010002
[69912.281521] RAX: 000000000000002c RBX: ffffb9864c0b3c08 RCX: 0000000000000000
[69912.281525] RDX: 0000000000000000 RSI: ffffffffa255df65 RDI: 00000000ffffffff
[69912.281528] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb9864c0b3a78
[69912.281530] R10: ffffffffa2dbaf08 R11: 0000000000000003 R12: 0000000000000003
[69912.281533] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[69912.281536] FS:  00007f298e5bf080(0000) GS:ffffa015f7b80000(0000) knlGS:0000000000000000
[69912.281540] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[69912.281543] CR2: 000055be0c692000 CR3: 00000001c0a0e000 CR4: 0000000000f50ef0
[69912.281547] PKRU: 55555554
[69912.281550] note: modprobe[147520] exited with irqs disabled
[69912.291668] Missing ENDBR: kallsyms_lookup_name+0x4/0xd0
[69912.291689] ------------[ cut here ]------------
[69912.291692] kernel BUG at arch/x86/kernel/cet.c:132!
[69912.291700] Oops: invalid opcode: 0000 [#2] PREEMPT SMP NOPTI
[69912.291708] CPU: 3 UID: 0 PID: 147529 Comm: modprobe Tainted: G      D    OE      6.12.63_1 #1
[69912.291716] Tainted: [D]=DIE, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[69912.291718] Hardware name: CHUWI Innovation And Technology(ShenZhen)co.,Ltd GemiBook XPro/Default string, BIOS EM_IDL8329_SUB1_V2.0.22 09/28/2023
[69912.291722] RIP: 0010:exc_control_protection+0x29f/0x2b0
[69912.291731] Code: d8 b9 09 00 00 00 48 8b 93 80 00 00 00 be 80 00 00 00 48 c7 c7 26 35 55 a2 e8 ad 11 3d ff 80 a3 8a 00 00 00 fb e9 38 fe ff ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[69912.291736] RSP: 0018:ffffb98640e5f968 EFLAGS: 00010002
[69912.291742] RAX: 000000000000002c RBX: ffffb98640e5f998 RCX: 0000000000000000
[69912.291745] RDX: 0000000000000000 RSI: ffffffffa255df65 RDI: 00000000ffffffff
[69912.291749] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb98640e5f808
[69912.291752] R10: ffffffffa2dbaf08 R11: 0000000000000003 R12: 0000000000000003
[69912.291755] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[69912.291758] FS:  00007f6d41a35080(0000) GS:ffffa015f7b80000(0000) knlGS:0000000000000000
[69912.291762] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[69912.291766] CR2: 000055d526357000 CR3: 00000001c0a0e000 CR4: 0000000000f50ef0
[69912.291769] PKRU: 55555554
[69912.291772] Call Trace:
[69912.291776]  <TASK>
[69912.291780]  asm_exc_control_protection+0x26/0x30
[69912.291788] RIP: 0010:kallsyms_lookup_name+0x4/0xd0
[69912.291794] Code: d0 48 03 05 6e 82 30 01 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 <0f> 1f 44 00 00 53 48 83 ec 10 65 48 8b 04 25 28 00 00 00 48 89 44
[69912.291798] RSP: 0018:ffffb98640e5fa40 EFLAGS: 00010246
[69912.291801] RAX: ffffffffa11bd624 RBX: ffffffffc2867010 RCX: 0000000000000000
[69912.291804] RDX: 0000000000000000 RSI: ffffffffc2867010 RDI: ffffffffc286301a
[69912.291807] RBP: 0000000000000000 R08: 0000000000000020 R09: ffffa014bdb70d20
[69912.291810] R10: ffffb98640e5fac0 R11: 0000000000000030 R12: ffffb98640788105
[69912.291812] R13: ffffb98640e5fa50 R14: 000055d50a4f76d7 R15: ffffb98640e5fae0
[69912.291816]  ? __pfx_luasyscall_init+0x10/0x10 [luasyscall]
[69912.291822]  ? kallsyms_lookup_name+0x4/0xd0
[69912.291828]  ? __pfx_luasyscall_init+0x10/0x10 [luasyscall]
[69912.291833]  luasyscall_init+0x15/0xff0 [luasyscall]
[69912.291838]  do_one_initcall+0x58/0x310
[69912.291846]  do_init_module+0x60/0x230
[69912.291853]  __do_sys_init_module+0x17a/0x1b0
[69912.291861]  do_syscall_64+0x84/0x170
[69912.291867]  ? vms_complete_munmap_vmas+0x16b/0x190
[69912.291872]  ? do_vmi_align_munmap+0x1d7/0x250
[69912.291880]  ? __vm_munmap+0xb9/0x170
[69912.291887]  ? fpregs_assert_state_consistent+0x25/0x50
[69912.291893]  ? arch_exit_to_user_mode_prepare.isra.0+0x16/0xa0
[69912.291900]  ? syscall_exit_to_user_mode+0x37/0x180
[69912.291906]  ? do_syscall_64+0x90/0x170
[69912.291913]  ? __count_memcg_events+0x72/0x100
[69912.291920]  ? count_memcg_events.constprop.0+0x1a/0x30
[69912.291926]  ? handle_mm_fault+0x21b/0x330
[69912.291931]  ? preempt_count_add+0x4b/0xa0
[69912.291935]  ? up_read+0x3b/0x80
[69912.291941]  ? do_user_addr_fault+0x36b/0x620
[69912.291946]  ? fpregs_assert_state_consistent+0x25/0x50
[69912.291951]  ? arch_exit_to_user_mode_prepare.isra.0+0x16/0xa0
[69912.291957]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[69912.291963] RIP: 0033:0x7f6d41b3e62a
[69912.291967] Code: 48 8b 0d e1 27 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 af 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ae 27 0d 00 f7 d8 64 89 01 48
[69912.291971] RSP: 002b:00007ffcb5a6da68 EFLAGS: 00000246 ORIG_RAX: 00000000000000af
[69912.291976] RAX: ffffffffffffffda RBX: 000055d52634aa00 RCX: 00007f6d41b3e62a
[69912.291979] RDX: 000055d50a4f76d7 RSI: 0000000000006105 RDI: 000055d526352490
[69912.291982] RBP: 000055d50a4f76d7 R08: 0000000000020370 R09: 00007f6d41d4c76a
[69912.291985] R10: 00007f6d41b3a757 R11: 0000000000000246 R12: 0000000000000000
[69912.291987] R13: 000055d52634ab30 R14: 0000000000000000 R15: 000055d526352490
[69912.291992]  </TASK>
[69912.291994] Modules linked in: luasyscall(OE+) luaprobe(OE+) luadata(OE) luafib(OE) luathread(OE) luarcu(OE) luasocket(OE) luanotifier(OE) lualinux(OE) luadevice(OE) lunatik(OE) tls rfcomm snd_seq_dummy snd_hrtimer ctr ccm cmac algif_hash algif_skcipher af_alg bnep nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tcp_bbr sch_fq ext4 mbcache jbd2 nls_iso8859_1 nls_cp437 vfat fat dm_crypt encrypted_keys trusted asn1_encoder tee hid_multitouch iTCO_wdt intel_pmc_bxt iTCO_vendor_support joydev hid_microsoft ff_memless mei_hdcp intel_rapl_msr mei_pxp snd_sof_pci_intel_tgl x86_pkg_temp_thermal snd_sof_pci_intel_cnl snd_sof_intel_hda_generic soundwire_intel soundwire_cadence snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_soc_acpi_intel_match intel_powerclamp soundwire_generic_allocation snd_soc_acpi coretemp soundwire_bus snd_soc_avs kvm_intel snd_soc_hda_codec snd_hda_ext_core snd_soc_core kvm uvcvideo
[69912.292081]  snd_hda_codec_hdmi snd_compress videobuf2_vmalloc uvc snd_hda_codec_realtek iwlmvm irqbypass ac97_bus snd_hda_codec_generic videobuf2_memops rapl intel_cstate snd_hda_scodec_component intel_uncore snd_pcm_dmaengine mac80211 videobuf2_v4l2 snd_hda_intel videobuf2_common snd_intel_dspcfg spi_intel_pci snd_intel_sdw_acpi input_leds pcspkr snd_hda_codec libarc4 wmi_bmof spi_intel videodev hid_sensor_prox btusb snd_hda_core iwlwifi hid_sensor_trigger btrtl mc industrialio_triggered_buffer btintel i2c_i801 snd_hwdep btbcm kfifo_buf i2c_designware_platform processor_thermal_device_pci i2c_smbus usbhid snd_pcm processor_thermal_device i2c_mux i2c_designware_core btmtk processor_thermal_wt_hint hid_sensor_iio_common cfg80211 ccp processor_thermal_rfim processor_thermal_rapl industrialio intel_rapl_common mei_me processor_thermal_wt_req mei processor_thermal_power_floor processor_thermal_mbox tpm_crb thermal tpm_tis tpm_tis_core int3403_thermal fan intel_pmc_core int340x_thermal_zone tpm intel_vsec evdev libaescfb
[69912.292164]  int3400_thermal intel_hid pmt_telemetry mac_hid rng_core acpi_pad pmt_class sparse_keymap acpi_tad acpi_thermal_rel ac tiny_power_button vboxnetflt(OE) vboxnetadp(OE) vboxdrv(OE) i2c_dev snd_seq snd_seq_device snd_timer snd soundcore vhost_vsock vmw_vsock_virtio_transport_common vsock vhost_net vhost vhost_iotlb tap hci_vhci bluetooth rfkill ecdh_generic ecc crc16 vfio_iommu_type1 vfio iommufd uhid uinput userio ppp_generic slhc tun loop nvram cuse fuse xe drm_gpuvm drm_exec gpu_sched drm_suballoc_helper drm_ttm_helper hid_sensor_custom hid_sensor_hub hid_generic intel_ishtp_hid i915 intel_gtt drm_buddy i2c_algo_bit drm_display_helper cec spi_pxa2xx_platform rc_core dw_dmac dw_dmac_core ttm spi_pxa2xx_core crct10dif_pclmul crc32_pclmul agpgart polyval_clmulni ahci polyval_generic ghash_clmulni_intel libahci sha512_ssse3 sha256_ssse3 libata sha1_ssse3 aesni_intel gf128mul xhci_pci crypto_simd i2c_hid_acpi scsi_mod cryptd drm_kms_helper i2c_hid sdhci_pci xhci_hcd hid cqhci sdhci serio_raw mmc_core usbcore
[69912.292271]  intel_lpss_pci intel_ish_ipc scsi_common intel_lpss usb_common drm idma64 intel_ishtp virt_dma video battery wmi pinctrl_alderlake button dm_mirror dm_region_hash dm_log dm_mod btrfs blake2b_generic xor raid6_pq libcrc32c crc32c_generic crc32c_intel
[69912.292304] ---[ end trace 0000000000000000 ]---
[69912.292308] RIP: 0010:exc_control_protection+0x29f/0x2b0
[69912.292315] Code: d8 b9 09 00 00 00 48 8b 93 80 00 00 00 be 80 00 00 00 48 c7 c7 26 35 55 a2 e8 ad 11 3d ff 80 a3 8a 00 00 00 fb e9 38 fe ff ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[69912.292319] RSP: 0018:ffffb9864c0b3bd8 EFLAGS: 00010002
[69912.292323] RAX: 000000000000002c RBX: ffffb9864c0b3c08 RCX: 0000000000000000
[69912.292326] RDX: 0000000000000000 RSI: ffffffffa255df65 RDI: 00000000ffffffff
[69912.292329] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb9864c0b3a78
[69912.292332] R10: ffffffffa2dbaf08 R11: 0000000000000003 R12: 0000000000000003
[69912.292335] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[69912.292338] FS:  00007f6d41a35080(0000) GS:ffffa015f7b80000(0000) knlGS:0000000000000000
[69912.292342] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[69912.292345] CR2: 000055d526357000 CR3: 00000001c0a0e000 CR4: 0000000000f50ef0
[69912.292349] PKRU: 55555554
[69912.292351] note: modprobe[147529] exited with irqs disabled
[69912.304101] missing module BTF, cannot register kfunc
[69954.228357] missing module BTF, cannot register kfunc

Booting the kernel with parameter ibt=off fixes the issue and allows modules to load correctly.

[lneto]

@Jipok I'm not familiar with IBT, but perhaps we cannot use kprobes (or have some restriction)? Could you try to disable luaprobe? Then, we can add ifdefs accordingly.

BTW, do you need luaprobe + ibt=on?

[lneto]

yeah.. it looks that we shouldn't be able to use luaprobe along with IBT..

https://stackoverflow.com/questions/76170020/calling-kallsyms-lookup-name-found-in-a-module-causes-a-segementation-fault

I believe ifndef CONFIG_X86_KERNEL_IBT should be enough..

[lneto]

more info here: https://lwn.net/Articles/889475/

[Jipok]

I'm packaging lunatik for Void Linux. Since generic distro kernels seems usually enable IBT by default on supported hardware, shipping the package as-is is dangerous because it can crash the kernel.

I'm not a kernel developer, so I can't implement workarounds, but I am happy to test a fix.

If disabling luaprobe saves the rest of lunatik from crashing on modern Intel CPUs, that sounds like a reasonable compromise for now.

[lneto]

I'm packaging lunatik for Void Linux. Since generic distro kernels seems usually enable IBT by default on supported hardware, shipping the package as-is is dangerous because it can crash the kernel.

It's weird that we didn't catch this before. We have been running on distros like Ubuntu, Debian and Arch.

I'm not a kernel developer, so I can't implement workarounds, but I am happy to test a fix.

If disabling luaprobe saves the rest of lunatik from crashing on modern Intel CPUs, that sounds like a reasonable compromise for now.

can you try this branch? So, we can isolate it and make sure it only affects luaprobe and luasyscall.

can you also check this two configs: CONFIG_KALLSYMS and CONFIG_KALLSYMS_ALL?

thanks!

[sheharyaar]

It's weird that we didn't catch this before. We have been running on distros like Ubuntu, Debian and Arch.

I have been using AMD, probably that's why I too didn't face this yet.

[Jipok]

Details

[*] Configuring unpacked packages
lunatik-dkms-2025.12.27.4fff41b_7: configuring ...
Added DKMS module 'lunatik-2025.12.27.4fff41b'.
Skipping kernel-6.1.71_1. kernel-headers package not installed...
Building DKMS module 'lunatik-2025.12.27.4fff41b' for kernel-6.12.63_1... done.
Installing DKMS module 'lunatik-2025.12.27.4fff41b' for kernel-6.12.63_1... done.
Building DKMS module 'lunatik-2025.12.27.4fff41b' for kernel-6.18.2_1... done.
Installing DKMS module 'lunatik-2025.12.27.4fff41b' for kernel-6.18.2_1... done.
Building DKMS module 'lunatik-2025.12.27.4fff41b' for kernel-6.18.2_1000... done.
Installing DKMS module 'lunatik-2025.12.27.4fff41b' for kernel-6.18.2_1000... done.
Skipping kernel-6.3.13_2. kernel-headers package not installed...
Skipping kernel-6.5.13_1. kernel-headers package not installed...
Building DKMS module 'lunatik-2025.12.27.4fff41b' for kernel-6.6.54_1... done.
Installing DKMS module 'lunatik-2025.12.27.4fff41b' for kernel-6.6.54_1... done.
Skipping kernel-6.6.68_1. kernel-headers package not installed...
Skipping kernel-lua. kernel-headers package not installed...
lunatik-dkms-2025.12.27.4fff41b_7: installed successfully.

1 downloaded, 1 installed, 0 updated, 1 configured, 0 removed, 0 on hold.
~ $ dkms status
amneziawg/1.0.20251104, 6.12.63_1, x86_64: installed
amneziawg/1.0.20251104, 6.18.2_1, x86_64: installed
amneziawg/1.0.20251104, 6.18.2_1000, x86_64: installed
amneziawg/1.0.20251104, 6.6.54_1, x86_64: installed
lunatik/2025.12.27.4fff41b, 6.12.63_1, x86_64: installed (Original modules exist)
lunatik/2025.12.27.4fff41b, 6.18.2_1, x86_64: installed (Original modules exist)
lunatik/2025.12.27.4fff41b, 6.18.2_1000, x86_64: installed (Original modules exist)
lunatik/2025.12.27.4fff41b, 6.6.54_1, x86_64: installed (Original modules exist)
virtualbox-ose/7.2.4, 6.12.63_1, x86_64: installed
virtualbox-ose/7.2.4, 6.18.2_1, x86_64: installed
virtualbox-ose/7.2.4, 6.18.2_1000, x86_64: installed
virtualbox-ose/7.2.4, 6.6.54_1, x86_64: installed
wireguard/1.0.20220627: added

~ $ sudo lunatik
Lunatik 3.7  Copyright (C) 2023-2025 ring-0 Ltda.
> return 42
42
> ^C/usr/bin/lua5.4: interrupted!
stack traceback:
	[C]: in ?
	[C]: in for iterator 'for iterator'
	/usr/bin/lunatik:133: in main chunk
	[C]: in ?

~ $ sudo lunatik status
lunatik is loaded
luadevice is loaded
lualinux is loaded
luanotifier is loaded
luasocket is loaded
luarcu is loaded
luathread is loaded
luafib is loaded
luadata is loaded
luaprobe is not loaded
luasyscall is not loaded
luaxdp is not loaded
luafifo is not loaded
luaxtable is not loaded
luanetfilter is not loaded
luacompletion is not loaded
luacrypto_shash is not loaded
luacrypto_skcipher is not loaded
luacrypto_aead is not loaded
luacrypto_rng is not loaded
luacrypto_comp is not loaded
luacpu is not loaded
luahid is not loaded
lunatik_run is loaded

~ $ sudo lunatik run examples/systrack
error loading module 'probe' from file 'probe':
	luaopen_probe not found in kernel symbol table

~ $ sudo nano /usr/lib/modules/lua/examples/passwd.lua

~ $ sudo lunatik run examples/passwd

~ $ head -c 10 /dev/passwd
1R\&8,3swU

~ $ cat /usr/lib/modules/lua/examples/passwd.lua
   local device = require("device")
   local linux  = require("linux")
   local function nop() end
   local s = linux.stat
   local driver = {name = "passwd", open = nop, release = nop, mode = s.IRUGO}

   function driver:read()
       return string.char(linux.random(32, 126))
   end

   device.new(driver)

~ $ sudo lunatik list
examples/passwd

~ $ grep CONFIG_KALLSYMS /boot/config-$(uname -r)
CONFIG_KALLSYMS=y
# CONFIG_KALLSYMS_SELFTEST is not set
CONFIG_KALLSYMS_ALL=y

The branch lneto_ibt builds fine and works as expected. The kernel crash is gone and the system is stable with IBT enabled.
Although I don't quite understand what to do with dkms. I had to manually edit my dkms.conf to exclude those modules. Do you have a solution? I'm new to this.

[lneto]

(...) Although I don't quite understand what to do with dkms. I had to manually edit my dkms.conf to exclude those modules. Do you have a solution? I'm new to this.

I'm not that familiar with dkms; is this conf autogenerated then you need to remove the modules manually? Do you know if it's based on the Kbuild file itself? if so, we can try to condition luaprobe build to CONFIG_X86_KERNEL_IBT=no. We can also use the same approach we use on luaxdp, by commenting out luaprobe implementation if CONFIG_X86_KERNEL_IBT=no and raise runtime errors if it's used.. can you share how are you generating your dkms.conf? I will figure it out something =)..

btw, do you have a particular use case for lunatik on void linux or it's just general purpose?