------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 5103 Comm: syz.2.183 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
 ra : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
epc : ffffffff80cbd16e ra : ffffffff80cbd16e sp : ffff8f8003ff6160
 gp : ffffffff8a6d9c00 tp : ffffaf801baa9ac0 t0 : 0000000000000000
 t1 : fffff5ef027c2409 t2 : ffffffff9191b3a0 s0 : ffff8f8003ff61e0
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80cbd16e a4 : ffff8f800a4c9d50
 a5 : 00000000000a0d50 a6 : 0000000000000003 a7 : ffffaf8013e1204b
 s2 : 00000000000b6a00 s3 : 0000000000000000 s4 : ffffaf8013e12000
 s5 : 0000000000000001 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : ffffffff88e6d260 s9 : 0000000000007fff s10: 0000000000000000
 s11: ffffffff8a7f9d60 t3 : 00000000000000c8 t4 : fffff5ef027c2409
 t5 : fffff5ef027c240a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80cbd16e cause: 0000000000000003
[<ffffffff80cbd16e>] page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
[<ffffffff80cbd8b6>] __page_table_check_ptes_set+0x23c/0x4a4 mm/page_table_check.c:223
[<ffffffff80c260b2>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80c260b2>] set_ptes arch/riscv/include/asm/pgtable.h:642 [inline]
[<ffffffff80c260b2>] remove_migration_pte+0xef6/0x22e4 mm/migrate.c:448
[<ffffffff80ac5520>] rmap_walk_anon+0x3b2/0x7aa mm/rmap.c:3053
[<ffffffff80adf2d8>] rmap_walk_locked+0xa6/0xca mm/rmap.c:3169
[<ffffffff80c28aba>] remove_migration_ptes+0x18a/0x1bc mm/migrate.c:483
[<ffffffff80c494d6>] remap_page mm/huge_memory.c:3598 [inline]
[<ffffffff80c494d6>] __folio_split+0x1502/0x1e70 mm/huge_memory.c:4247
[<ffffffff80c4d528>] __split_huge_page_to_list_to_order mm/huge_memory.c:4393 [inline]
[<ffffffff80c4d528>] split_huge_page_to_list_to_order include/linux/huge_mm.h:416 [inline]
[<ffffffff80c4d528>] split_folio_to_list+0x4c/0x5e mm/huge_memory.c:4457
[<ffffffff8098ae86>] shrink_folio_list+0x213a/0x4b18 mm/vmscan.c:1286
[<ffffffff8098d9a0>] reclaim_folio_list+0x13c/0x8fa mm/vmscan.c:2168
[<ffffffff809a1a94>] reclaim_pages+0x33e/0x4b8 mm/vmscan.c:2205
[<ffffffff80b74938>] madvise_cold_or_pageout_pte_range+0x1b6c/0x23a8 mm/madvise.c:452
[<ffffffff80abb20e>] walk_pmd_range mm/pagewalk.c:147 [inline]
[<ffffffff80abb20e>] walk_pud_range mm/pagewalk.c:237 [inline]
[<ffffffff80abb20e>] walk_p4d_range mm/pagewalk.c:278 [inline]
[<ffffffff80abb20e>] walk_pgd_range+0xcca/0x1df8 mm/pagewalk.c:319
[<ffffffff80abc474>] __walk_page_range+0x138/0x7a8 mm/pagewalk.c:427
[<ffffffff80abdbf8>] walk_page_range_vma_unsafe+0x1ec/0x82c mm/pagewalk.c:737
[<ffffffff80abe292>] walk_page_range_vma+0x5a/0x84 mm/pagewalk.c:747
[<ffffffff80b6e872>] madvise_pageout_page_range mm/madvise.c:630 [inline]
[<ffffffff80b6e872>] madvise_pageout+0x26c/0x7c4 mm/madvise.c:655
[<ffffffff80b76508>] madvise_vma_behavior+0x71e/0x1e92 mm/madvise.c:1366
[<ffffffff80b77ec0>] madvise_walk_vmas+0x244/0xa04 mm/madvise.c:1721
[<ffffffff80b7886a>] madvise_do_behavior+0x1ea/0x5be mm/madvise.c:1916
[<ffffffff80b79b48>] do_madvise+0x23a/0x294 mm/madvise.c:2014
[<ffffffff80b79c2a>] __do_sys_madvise mm/madvise.c:2023 [inline]
[<ffffffff80b79c2a>] __se_sys_madvise mm/madvise.c:2021 [inline]
[<ffffffff80b79c2a>] __riscv_sys_madvise+0x88/0xdc mm/madvise.c:2021
[<ffffffff8007bd88>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8660e902>] do_trap_ecall_u+0x4ca/0x658 arch/riscv/kernel/traps.c:341
[<ffffffff8663b218>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 3097 ff88 80e7 a900 82e3 e404 3097 ff88 80e7 f8e0 (9002) 3097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff883097          	auipc	ra,0xff883
   4:	a90080e7          	jalr	-1392(ra) # 0xff882a90
   8:	e40482e3          	beqz	s1,0xfffffffffffffe4c
   c:	ff883097          	auipc	ra,0xff883
  10:	f8e080e7          	jalr	-114(ra) # 0xff882f9a
* 14:	9002                	ebreak <-- trapping instruction
  16:	9730                	.short	0x3097