------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 3952 Comm: syz.0.37 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
 ra : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
epc : ffffffff80c81160 ra : ffffffff80c81160 sp : ffff8f800a0c61d0
 gp : ffffffff8a4a0660 tp : ffffaf801afe3580 t0 : 0000000000000000
 t1 : fffff5ef0279f409 t2 : ffffffff918772e0 s0 : ffff8f800a0c6250
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c81160 a4 : ffff8f8005242438
 a5 : 00000000000a5438 a6 : 0000000000000003 a7 : ffffaf8013cfa04b
 s2 : 00000000000b3200 s3 : 0000000000000000 s4 : ffffaf8013cfa000
 s5 : 0000000000000001 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : ffffffff88c5a280 s9 : 0000000000007fff s10: 0000000000000000
 s11: ffffffff8a5bece0 t3 : 0000000000000001 t4 : fffff5ef0279f409
 t5 : fffff5ef0279f40a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c81160 cause: 0000000000000003
[<ffffffff80c81160>] page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
[<ffffffff80c818d0>] __page_table_check_ptes_set+0x264/0x47c mm/page_table_check.c:212
[<ffffffff80be5ed0>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80be5ed0>] set_ptes arch/riscv/include/asm/pgtable.h:645 [inline]
[<ffffffff80be5ed0>] remove_migration_pte+0x10e2/0x2256 mm/migrate.c:436
[<ffffffff80a94d84>] rmap_walk_anon+0x30e/0x690 mm/rmap.c:3001
[<ffffffff80aada70>] rmap_walk_locked+0xa6/0xca mm/rmap.c:3117
[<ffffffff80bef9ac>] remove_migration_ptes+0x18a/0x1bc mm/migrate.c:471
[<ffffffff80c0ebfc>] remap_page mm/huge_memory.c:3482 [inline]
[<ffffffff80c0ebfc>] __folio_split+0xce8/0x140e mm/huge_memory.c:4114
[<ffffffff80c12a04>] __split_huge_page_to_list_to_order mm/huge_memory.c:4244 [inline]
[<ffffffff80c12a04>] split_huge_page_to_list_to_order include/linux/huge_mm.h:415 [inline]
[<ffffffff80c12a04>] split_folio_to_list+0x4c/0x5e mm/huge_memory.c:4308
[<ffffffff80962da0>] shrink_folio_list+0x21d8/0x4d90 mm/vmscan.c:1284
[<ffffffff80965a8c>] reclaim_folio_list+0x134/0x8ee mm/vmscan.c:2171
[<ffffffff80975056>] reclaim_pages+0x33e/0x4b8 mm/vmscan.c:2208
[<ffffffff80b3c22e>] madvise_cold_or_pageout_pte_range+0x1b72/0x23ac mm/madvise.c:443
[<ffffffff80a8ab42>] walk_pmd_range mm/pagewalk.c:148 [inline]
[<ffffffff80a8ab42>] walk_pud_range mm/pagewalk.c:239 [inline]
[<ffffffff80a8ab42>] walk_p4d_range mm/pagewalk.c:280 [inline]
[<ffffffff80a8ab42>] walk_pgd_range+0xd12/0x1eca mm/pagewalk.c:321
[<ffffffff80a8be32>] __walk_page_range+0x138/0x7a8 mm/pagewalk.c:429
[<ffffffff80a8d662>] walk_page_range_vma_unsafe+0x1ec/0x82c mm/pagewalk.c:733
[<ffffffff80a8dcfc>] walk_page_range_vma+0x5a/0x84 mm/pagewalk.c:743
[<ffffffff80b361fe>] madvise_pageout_page_range mm/madvise.c:621 [inline]
[<ffffffff80b361fe>] madvise_pageout+0x26c/0x7c4 mm/madvise.c:646
[<ffffffff80b3ddce>] madvise_vma_behavior+0x72c/0x1eac mm/madvise.c:1357
[<ffffffff80b3f788>] madvise_walk_vmas+0x23a/0x976 mm/madvise.c:1712
[<ffffffff80b400ae>] madvise_do_behavior+0x1ea/0x5be mm/madvise.c:1907
[<ffffffff80b4138c>] do_madvise+0x23a/0x294 mm/madvise.c:2005
[<ffffffff80b4146e>] __do_sys_madvise mm/madvise.c:2014 [inline]
[<ffffffff80b4146e>] __se_sys_madvise mm/madvise.c:2012 [inline]
[<ffffffff80b4146e>] __riscv_sys_madvise+0x88/0xdc mm/madvise.c:2012
[<ffffffff80078bb4>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff864fed78>] do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:342
[<ffffffff8652af74>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: c097 ff8a 80e7 3560 82e3 e404 d097 ff8a 80e7 8540 (9002) d097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff8ac097          	auipc	ra,0xff8ac
   4:	356080e7          	jalr	854(ra) # 0xff8ac356
   8:	e40482e3          	beqz	s1,0xfffffffffffffe4c
   c:	ff8ad097          	auipc	ra,0xff8ad
  10:	854080e7          	jalr	-1964(ra) # 0xff8ac860
* 14:	9002                	ebreak <-- trapping instruction
  16:	97d0                	.short	0xd097