kernel: privileged instruction fault trap, code=0

kernel: privileged instruction fault trap, code=0
Status: auto-closed as invalid on 2020/04/16 01:44
Reported-by: syzbot+9dae454cfe7fea54463b@syzkaller.appspotmail.com
First crash: 407d, last: 407d
similar bugs (1):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
openbsd	kernel: privileged instruction fault trap, code=0 (2)				1	303d	303d	0/3	auto-closed as invalid on 2020/07/29 08:00
Sample crash report:
login: kernel: privileged instruction fault trap, code=0
Stopped at      vmptrld+0xb:    rdrand  0(%rdi)
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> trace
vmptrld() at vmptrld+0xb
vm_create(ffff800000a61000,ffff800020aa0780) at vm_create+0x304 vcpu_init sys/arch/amd64/amd64/vmm.c:3292 [inline]
vm_create(ffff800000a61000,ffff800020aa0780) at vm_create+0x304 sys/arch/amd64/amd64/vmm.c:1193
VOP_IOCTL(fffffd806e13bea0,c5005601,ffff800000a61000,1,fffffd807f7be900,ffff800020aa0780) at VOP_IOCTL+0x88 sys/kern/vfs_vops.c:291
vn_ioctl(fffffd8066a970b8,c5005601,ffff800000a61000,ffff800020aa0780) at vn_ioctl+0xb7 sys/kern/vfs_vnops.c:533
sys_ioctl(ffff800020aa0780,ffff800023be0f58,ffff800023be0fa0) at sys_ioctl+0x498
syscall(ffff800023be1020) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
syscall(ffff800023be1020) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x97b846d1820, count: -7
ddb{0}> show registers
rdi               0xffff800023bcb1d0
rsi                              0x1
rbp               0xffff800023be0c10
rbx               0xffff800023bcae80
rdx                            0xf07
rcx                       0x11e57ed0    __kernel_end_phys+0xf657ed0
rax               0xfffffd8065a34000
r8                                 0
r9                                 0
r10                              0x4
r11               0x707049055b20b185
r12                              0x1
r13                                0
r14               0xffff800023bcae80
r15               0xffff800023bcb1d0
rip               0xffffffff81024c41    vmptrld+0xb
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff800023be0bd8
ss                              0x10
vmptrld+0xb:    rdrand  0(%rdi)
ddb{0}> show proc
PROC (syz-executor.1) pid=242590 stat=onproc
    flags process=1000<SINGLEEXIT> proc=4080000<SUSPSINGLE,THREAD>
    pri=32, usrpri=62, nice=20
    forw=0xffffffffffffffff, list=0xffff800020aa0290,0xffff800020aa0a08
    process=0xffff800020af4380 user=0xffff800023bdc000, vmspace=0xfffffd807f0005c0
    estcpu=12, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 51853  238817  35936      0  2           0                syz-executor.0
 51853  156658  35936      0  3   0x4000080  fsleep        syz-executor.0
 51853  145355  35936      0  3   0x4000080  fsleep        syz-executor.0
 77543  149440  82544      0  3      0x3000  suspend       syz-executor.1
*77543  242590  82544      0  7   0x4081000                syz-executor.1
 64094  369551      0      0  3     0x14200  acct          acct
 82544  232916  40125      0  3        0x82  nanosleep     syz-executor.1
 35936   95152  40125      0  3        0x82  nanosleep     syz-executor.0
 40125  131514    887      0  3        0x82  thrsleep      syz-fuzzer
 40125   50997    887      0  3   0x4000082  thrsleep      syz-fuzzer
 40125  388289    887      0  3   0x4000082  thrsleep      syz-fuzzer
 40125  468508    887      0  3   0x4000082  thrsleep      syz-fuzzer
 40125  169330    887      0  3   0x4000082  thrsleep      syz-fuzzer
 40125  442145    887      0  3   0x4000082  thrsleep      syz-fuzzer
 40125  342653    887      0  3   0x4000082  thrsleep      syz-fuzzer
 40125  360688    887      0  3   0x4000082  thrsleep      syz-fuzzer
 40125  493347    887      0  3   0x4000082  kqread        syz-fuzzer
 40125  332138    887      0  3   0x4000082  thrsleep      syz-fuzzer
   887   65795  70521      0  3    0x10008a  pause         ksh
 70521  521673  26381      0  3        0x92  select        sshd
 98274  167333      1      0  3    0x100083  ttyin         getty
 26381  314602      1      0  3        0x80  select        sshd
 78464   65479  85135     74  3    0x100092  bpf           pflogd
 85135  213497      1      0  3        0x80  netio         pflogd
 78345  380889  64496     73  3    0x100090  kqread        syslogd
 64496  394297      1      0  3    0x100082  netio         syslogd
 50752   68937      1     77  3    0x100090  poll          dhclient
 74025  399931      1      0  3        0x80  poll          dhclient
 82585  377088      0      0  2     0x14200                zerothread
 56656  174629      0      0  3     0x14200  aiodoned      aiodoned
 92759  508307      0      0  3     0x14200  syncer        update
 74226  498576      0      0  3     0x14200  cleaner       cleaner
 16784  176284      0      0  7     0x14200                reaper
 56987  360756      0      0  3     0x14200  pgdaemon      pagedaemon
 50215  307249      0      0  3     0x14200  bored         crynlk
 88373   37621      0      0  3     0x14200  bored         crypto
 67843   59246      0      0  3  0x40014200  acpi0         acpi0
 66061  416568      0      0  3  0x40014200                idle1
 43298  438775      0      0  3     0x14200  bored         softnet
 60302   14949      0      0  3     0x14200  bored         systqmp
  4238  142678      0      0  3     0x14200  bored         systq
 45410  401178      0      0  3  0x40014200  bored         softclock
  6082  137982      0      0  3  0x40014200                idle0
 88329  457037      0      0  3     0x14200  bored         smr
     1  480651      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 77543 (syz-executor.1) thread 0xffff800020aa0780 (242590)
exclusive rwlock vmlistlock r = 0 (0xffff800000678878)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  rw_enter+0x453 sys/kern/kern_rwlock.c:309
#2  vm_create+0x130 vm_impl_init sys/arch/amd64/amd64/vmm.c:1353 [inline]
#2  vm_create+0x130 sys/arch/amd64/amd64/vmm.c:1174
#3  VOP_IOCTL+0x88 sys/kern/vfs_vops.c:291
#4  vn_ioctl+0xb7 sys/kern/vfs_vnops.c:533
#5  sys_ioctl+0x498
#6  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#6  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#7  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82626628)
#0  witness_lock+0x52e sys/kern/subr_witness.c:1163
#1  __mp_acquire_count+0x51 sys/kern/kern_lock.c:227
#2  mi_switch+0x392 sys/kern/sched_bsd.c:434
#3  sleep_finish+0x113 sys/kern/kern_synch.c:405
#4  rw_enter+0x3d6 sys/kern/kern_rwlock.c:285
#5  vm_create+0x130 vm_impl_init sys/arch/amd64/amd64/vmm.c:1353 [inline]
#5  vm_create+0x130 sys/arch/amd64/amd64/vmm.c:1174
#6  VOP_IOCTL+0x88 sys/kern/vfs_vops.c:291
#7  vn_ioctl+0xb7 sys/kern/vfs_vnops.c:533
#8  sys_ioctl+0x498
#9  syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:92 [inline]
#9  syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
#10 Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf  9473   6398K    6850K  78643K     10698        0
            pcb    16      8K       8K  78643K        49        0
         rtable   116      4K       4K  78643K       246        0
         ifaddr    47     11K      12K  78643K        63        0
       counters    39     33K      33K  78643K        39        0
       ioctlops     1      2K       4K  78643K      1471        0
            iov     0      0K      16K  78643K         6        0
          mount     1      1K       1K  78643K         1        0
         vnodes  1218     77K      77K  78643K      1274        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       1K  78643K         2        0
         VM map     2      1K       1K  78643K         2        0
            sem     6      0K       0K  78643K         8        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1809    196K     290K  78643K     12766        0
      file desc     6     17K      25K  78643K        80        0
          sigio     0      0K       0K  78643K         9        0
           proc    59     63K      95K  78643K       454        0
        subproc    32      2K       2K  78643K        34        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
       in_multi    40      2K       2K  78643K        40        0
    ether_multi     1      0K       0K  78643K         1        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    43    201K     201K  78643K        43        0
           exec     0      0K       1K  78643K       213        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   110     37K      37K  78643K      1182        0
       UVM aobj     2      2K       2K  78643K         2        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K         2        0
            NDP     6      0K       0K  78643K        13        0
           temp    86   3012K    3076K  78643K      3632        0
         kqueue     3      4K      12K  78643K         7        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64        7    0        0     1     0     1     1     0     8    0
plcache    128       20    0        0     1     0     1     1     0     8    0
rtpcb       80       25    0       23     1     0     1     1     0     8    0
rtentry    112       51    0        3     2     0     2     2     0     8    0
unpcb      120       65    0       55     1     0     1     1     0     8    0
syncache   264        4    0        4     1     1     0     1     0     8    0
tcpqe       32       56    0       56     1     0     1     1     0     8    1
tcpcb      544       33    0       29     1     0     1     1     0     8    0
inpcb      280       98    0       88     1     0     1     1     0     8    0
nd6         48        4    0        0     1     0     1     1     0     8    0
pkpcb       40        2    0        2     1     0     1     1     0     8    1
ppxss      1128       1    0        1     1     0     1     1     0     8    1
pfosfp      40      846    0      423     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       14    0        1     1     0     1     1     0     8    0
pfstkey    112       14    0        1     1     0     1     1     0     8    0
pfstate    328       14    0        0     2     0     2     2     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      234    0        5    15     0    15    15     0     8    0
art_table   32      236    0        5     2     0     2     2     0     8    0
art_node    16       50    0        6     1     0     1     1     0     8    0
sysvmsgpl   40       51    0       27     1     0     1     1     0     8    0
semupl     112        1    0        1     1     0     1     1     0     8    1
semapl     112        4    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128     1507    0       99    46     0    46    46     0     8    0
ffsino     272     1507    0       99    95     0    95    95     0     8    0
nchpl      144     1794    0      175    61     0    61    61     0     8    0
uvmvnodes   72     1587    0        0    29     0    29    29     0     8    0
vnodes     208     1587    0        0    84     0    84    84     0     8    0
namei      1024    4851    0     4851     1     0     1     1     0     8    1
percpumem   16       30    0        0     1     0     1     1     0     8    0
vcpupl     1984       2    0        1     1     0     1     1     0     8    0
vmpool     560        2    0        1     1     0     1     1     0     8    0
scxspl     192     4814    0     4814     2     1     1     2     0     8    1
plimitpl   152       19    0       11     1     0     1     1     0     8    0
sigapl     432      279    0      263     3     0     3     3     0     8    1
futexpl     56     1036    0     1034     1     0     1     1     0     8    0
knotepl    112       57    0       38     1     0     1     1     0     8    0
kqueuepl   104       14    0       12     1     0     1     1     0     8    0
pipelkpl    48       84    0       74     1     0     1     1     0     8    0
pipepl     120      168    0      149     1     0     1     1     0     8    0
fdescpl    496      280    0      263     3     0     3     3     0     8    0
filepl     152     1640    0     1531     7     1     6     6     0     8    1
lockfpl    104       11    0        8     1     0     1     1     0     8    0
lockfspl    48        5    0        3     1     0     1     1     0     8    0
sessionpl  112       18    0        7     1     0     1     1     0     8    0
pgrppl      48       18    0        7     1     0     1     1     0     8    0
ucredpl     96      185    0      176     1     0     1     1     0     8    0
zombiepl   144      264    0      263     1     0     1     1     0     8    0
processpl  896      296    0      263     4     0     4     4     0     8    0
procpl     632      422    0      376     5     0     5     5     0     8    1
sockpl     400      190    0      168     4     0     4     4     0     8    1
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl16k     16384      3    0        0     1     0     1     1     0     8    0
mcl12k     12288      2    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       5    0        0     1     0     1     1     0     8    0
mcl4k      4096       2    0        0     1     0     1     1     0     8    0
mcl2k      2048     155    0        0    19     0    19    19     0     8    0
mtagpl      80        8    0        0     1     0     1     1     0     8    0
mbufpl     256      222    0        0    14     0    14    14     0     8    0
bufpl      280     6318    0     1340   356     0   356   356     0     8    0
anonpl      16    44168    0    29376    77     1    76    76     0   125   16
amapchunkpl 152    1326    0     1187     8     0     8     8     0   158    2
amappl16   192     1260    0      468    52     4    48    52     0     8    8
amappl15   184      111    0      102     1     0     1     1     0     8    0
amappl14   176       30    0       28     1     0     1     1     0     8    0
amappl13   168        1    0        1     1     1     0     1     0     8    0
amappl12   160        4    0        4     1     1     0     1     0     8    0
amappl11   152       53    0       38     1     0     1     1     0     8    0
amappl10   144       36    0       31     1     0     1     1     0     8    0
amappl9    136      603    0      599     1     0     1     1     0     8    0
amappl8    128      119    0       96     1     0     1     1     0     8    0
amappl7    120      131    0      119     1     0     1     1     0     8    0
amappl6    112       58    0       49     1     0     1     1     0     8    0
amappl5    104      136    0      122     1     0     1     1     0     8    0
amappl4     96      539    0      502     2     1     1     2     0     8    0
amappl3     88      122    0      115     1     0     1     1     0     8    0
amappl2     80     1359    0     1271     3     1     2     3     0     8    0
amappl1     72    16248    0    15764    26    15    11    21     0     8    1
amappl      80      670    0      622     2     0     2     2     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      64        1    0        0     1     0     1     1     0     8    0
uaddrrnd    24      282    0      264     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      282    0      264     1     0     1     1     0     8    0
vmmpekpl   168     6111    0     6077     2     0     2     2     0     8    0
vmmpepl    168    41872    0    39771   116     5   111   111     0   357   19
vmsppl     368      281    0      264     2     0     2     2     0     8    0
pdppl      4096     571    0      529     6     0     6     6     0     8    0
pvpl        32   145410    0   127256   184     1   183   183     0   265   36
pmappl     232      281    0      264     2     0     2     2     0     8    0
extentpl    40       46    0       29     1     0     1     1     0     8    0
phpool     112      170    0        3     5     0     5     5     0     8    0
Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-openbsd-multicore	2020/01/17 01:43	openbsd	70e79057	3de7aabb	.config	log	report