syzbot

rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	0-...!: (10499 ticks this GP) idle=8ce/1/0x4000000000000000 softirq=164765/164765 fqs=10 
	(t=10500 jiffies g=283621 q=115)
rcu: rcu_preempt kthread starved for 10479 jiffies! g283621 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:29096 pid:   10 ppid:     2 flags:0x00004000
Call Trace:
 context_switch kernel/sched/core.c:3778 [inline]
 __schedule+0xec9/0x2280 kernel/sched/core.c:4527
 schedule+0xd0/0x2a0 kernel/sched/core.c:4602
 schedule_timeout+0x148/0x250 kernel/time/timer.c:1879
 rcu_gp_fqs_loop kernel/rcu/tree.c:1890 [inline]
 rcu_gp_kthread+0xb2c/0x1ca0 kernel/rcu/tree.c:2060
 kthread+0x3b5/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
NMI backtrace for cpu 0
CPU: 0 PID: 3580 Comm: ion_system_heap Not tainted 5.9.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x198/0x1fd lib/dump_stack.c:118
 nmi_cpu_backtrace.cold+0x70/0xb1 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1b3/0x223 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_dump_cpu_stacks+0x1e3/0x21e kernel/rcu/tree_stall.h:318
 print_cpu_stall kernel/rcu/tree_stall.h:551 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:625 [inline]
 rcu_pending kernel/rcu/tree.c:3639 [inline]
 rcu_sched_clock_irq.cold+0x4db/0xdfd kernel/rcu/tree.c:2521
 update_process_times+0x25/0xa0 kernel/time/timer.c:1710
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:176
 tick_sched_timer+0x1d1/0x2a0 kernel/time/tick-sched.c:1328
 __run_hrtimer kernel/time/hrtimer.c:1524 [inline]
 __hrtimer_run_queues+0x1d5/0xfc0 kernel/time/hrtimer.c:1588
 hrtimer_interrupt+0x334/0x940 kernel/time/hrtimer.c:1650
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1080 [inline]
 __sysvec_apic_timer_interrupt+0x147/0x5f0 arch/x86/kernel/apic/apic.c:1097
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:706
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 sysvec_apic_timer_interrupt+0xb2/0xf0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581
RIP: 0010:__sanitizer_cov_trace_cmp8+0x4/0x20 kernel/kcov.c:263
Code: 84 00 00 00 00 00 48 8b 0c 24 89 f2 89 fe bf 04 00 00 00 e9 2e ff ff ff 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 48 8b 0c 24 <48> 89 f2 48 89 fe bf 06 00 00 00 e9 0c ff ff ff 66 90 66 2e 0f 1f
RSP: 0018:ffffc9000624f918 EFLAGS: 00000286
RAX: 0000000000000000 RBX: ffff8880a884bc70 RCX: ffffffff81ac94c2
RDX: ffff88809a216180 RSI: ffffc90016962000 RDI: ffffc90016941000
RBP: ffffc90016941000 R08: 0000000000000001 R09: 0000000000000003
R10: ffffc90000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffffc90016941000 R14: ffffc90016962000 R15: ffffc90000000000
 is_within_this_va mm/vmalloc.c:844 [inline]
 find_vmap_lowest_match mm/vmalloc.c:897 [inline]
 __alloc_vmap_area mm/vmalloc.c:1097 [inline]
 alloc_vmap_area+0x4d2/0x1e00 mm/vmalloc.c:1216
 __get_vm_area_node+0x17b/0x3b0 mm/vmalloc.c:2082
 get_vm_area_caller mm/vmalloc.c:2124 [inline]
 vmap+0x105/0x240 mm/vmalloc.c:2396
 ion_heap_clear_pages+0x23/0x70 drivers/staging/android/ion/ion_heap.c:85
 ion_heap_sglist_zero.isra.0+0x1f8/0x260 drivers/staging/android/ion/ion_heap.c:105
 ion_system_heap_free+0x39b/0x470 drivers/staging/android/ion/ion_system_heap.c:163
 ion_buffer_destroy+0x14d/0x2b0 drivers/staging/android/ion/ion.c:93
 ion_heap_deferred_free+0x256/0x560 drivers/staging/android/ion/ion_heap.c:212
 kthread+0x3b5/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294