------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 37 Comm: khugepaged Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
epc : ffffffff80ca2cf4 ra : ffffffff80ca2cf4 sp : ffff8f80002b7360
 gp : ffffffff8a4c0280 tp : ffffaf8015e94f80 t0 : ffff8f80002b7300
 t1 : fffff5ef0280c809 t2 : ffffffff91898ba0 s0 : ffff8f80002b73d0
 s1 : ffffaf8014064048 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000000002 a3 : ffffffff80ca2cf4 a4 : 0000000000000000
 a5 : ffffaf8015e95f80 a6 : 0000000000000003 a7 : ffffaf801406404b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf8014064000
 s5 : dfffffff00000000 s6 : 0000000000000200 s7 : 00000000000b9400
 s8 : ffffffff88c66940 s9 : 0000000000007fff s10: fffffffef14bbfa4
 s11: ffffffff8a5dfd20 t3 : 0000000000000001 t4 : fffff5ef0280c809
 t5 : fffff5ef0280c80a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80ca2cf4 cause: 0000000000000003
[<ffffffff80ca2cf4>] __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
[<ffffffff80b16dc2>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80b16dc2>] __free_pages_prepare mm/page_alloc.c:1407 [inline]
[<ffffffff80b16dc2>] __free_frozen_pages+0x6ee/0x136e mm/page_alloc.c:2950
[<ffffffff80b1f49c>] free_frozen_pages+0xe/0x16 mm/page_alloc.c:2988
[<ffffffff8094ccee>] __folio_put+0x29a/0x454 mm/swap.c:112
[<ffffffff80993cbc>] folio_put include/linux/mm.h:2124 [inline]
[<ffffffff80993cbc>] folio_putback_lru+0xb8/0xde mm/vmscan.c:821
[<ffffffff80c49eae>] __collapse_huge_page_copy_succeeded mm/khugepaged.c:891 [inline]
[<ffffffff80c49eae>] __collapse_huge_page_copy mm/khugepaged.c:963 [inline]
[<ffffffff80c49eae>] collapse_huge_page+0x2dd4/0x4684 mm/khugepaged.c:1412
[<ffffffff80c503cc>] mthp_collapse mm/khugepaged.c:1523 [inline]
[<ffffffff80c503cc>] collapse_scan_pmd mm/khugepaged.c:1785 [inline]
[<ffffffff80c503cc>] collapse_single_pmd+0x3960/0x4b64 mm/khugepaged.c:2798
[<ffffffff80c52664>] collapse_scan_mm_slot mm/khugepaged.c:2913 [inline]
[<ffffffff80c52664>] khugepaged_do_scan mm/khugepaged.c:2993 [inline]
[<ffffffff80c52664>] khugepaged+0x1094/0x1786 mm/khugepaged.c:3048
[<ffffffff801f6df4>] kthread+0x312/0x438 kernel/kthread.c:436
[<ffffffff8006c352>] ret_from_fork_kernel+0x94/0xe74 arch/riscv/kernel/process.c:230
[<ffffffff865c0e42>] ret_from_fork_kernel_asm+0x16/0x18 arch/riscv/kernel/entry.S:368
Code: 0ba0 854a c0ef ff6f 8a2a bf9d 2097 ff89 80e7 0a80 (9002) 2097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	0ba0                	addi	s0,sp,472
   2:	854a                	mv	a0,s2
   4:	ff6fc0ef          	jal	0xffffffffffffc7fa
   8:	8a2a                	mv	s4,a0
   a:	bf9d                	j	0xffffffffffffff80
   c:	ff892097          	auipc	ra,0xff892
  10:	0a8080e7          	jalr	168(ra) # 0xff8920b4
* 14:	9002                	ebreak <-- trapping instruction
  16:	9720                	.short	0x2097