------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 11408 Comm: syz.6.1477 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
 ra : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
epc : ffffffff80ca1b5e ra : ffffffff80ca1b5e sp : ffff8f8000c661a0
 gp : ffffffff8a4c0280 tp : ffffaf801d019a80 t0 : 0000000000000000
 t1 : fffff5ef028b0c09 t2 : ffffffff91898ba0 s0 : ffff8f8000c66220
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80ca1b5e a4 : ffff8f80099d04a0
 a5 : 00000000002204a0 a6 : 0000000000000003 a7 : ffffaf801458604b
 s2 : 00000000000c4e00 s3 : 0000000000000000 s4 : ffffaf8014586000
 s5 : 0000000000000001 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : ffffffff88c66940 s9 : 0000000000007fff s10: 0000000000000000
 s11: ffffffff8a5dfd20 t3 : 0000000000000001 t4 : fffff5ef028b0c09
 t5 : fffff5ef028b0c0a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80ca1b5e cause: 0000000000000003
[<ffffffff80ca1b5e>] page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
[<ffffffff80ca22a6>] __page_table_check_ptes_set+0x23c/0x4a4 mm/page_table_check.c:223
[<ffffffff80c05f90>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80c05f90>] set_ptes arch/riscv/include/asm/pgtable.h:645 [inline]
[<ffffffff80c05f90>] remove_migration_pte+0x10e2/0x2256 mm/migrate.c:436
[<ffffffff80ab4920>] rmap_walk_anon+0x30e/0x690 mm/rmap.c:3001
[<ffffffff80acd60c>] rmap_walk_locked+0xa6/0xca mm/rmap.c:3117
[<ffffffff80c0fac0>] remove_migration_ptes+0x18a/0x1bc mm/migrate.c:471
[<ffffffff80c2ec7a>] remap_page mm/huge_memory.c:3525 [inline]
[<ffffffff80c2ec7a>] __folio_split+0xd3e/0x14ac mm/huge_memory.c:4159
[<ffffffff80c32ac8>] __split_huge_page_to_list_to_order mm/huge_memory.c:4301 [inline]
[<ffffffff80c32ac8>] split_huge_page_to_list_to_order include/linux/huge_mm.h:415 [inline]
[<ffffffff80c32ac8>] split_folio_to_list+0x4c/0x5e mm/huge_memory.c:4365
[<ffffffff80983154>] shrink_folio_list+0x21d8/0x4d90 mm/vmscan.c:1284
[<ffffffff8098e936>] evict_folios+0x2ee/0x12fa mm/vmscan.c:4834
[<ffffffff80991022>] try_to_shrink_lruvec+0x35a/0x606 mm/vmscan.c:4983
[<ffffffff80991c86>] lru_gen_shrink_lruvec mm/vmscan.c:5128 [inline]
[<ffffffff80991c86>] shrink_lruvec+0x294/0x1eb6 mm/vmscan.c:5888
[<ffffffff8099bd86>] shrink_node_memcgs mm/vmscan.c:6127 [inline]
[<ffffffff8099bd86>] shrink_node+0x774/0x3a2e mm/vmscan.c:6171
[<ffffffff809a2de2>] shrink_zones mm/vmscan.c:6410 [inline]
[<ffffffff809a2de2>] do_try_to_free_pages+0x330/0x14d8 mm/vmscan.c:6472
[<ffffffff809a42fa>] try_to_free_mem_cgroup_pages+0x370/0xe72 mm/vmscan.c:6794
[<ffffffff80c57bf6>] mem_cgroup_resize_max+0xe6/0x218 mm/memcontrol-v1.c:1522
[<ffffffff80c57ef6>] mem_cgroup_write+0x1ce/0x33e mm/memcontrol-v1.c:1704
[<ffffffff804b0884>] cgroup_file_write+0x190/0x70e kernel/cgroup/cgroup.c:4412
[<ffffffff80fd5f72>] kernfs_fop_write_iter+0x37c/0x530 fs/kernfs/file.c:345
[<ffffffff80d094fa>] new_sync_write fs/read_write.c:595 [inline]
[<ffffffff80d094fa>] vfs_write+0x81a/0x1020 fs/read_write.c:687
[<ffffffff80d0a10a>] ksys_write+0x126/0x244 fs/read_write.c:739
[<ffffffff80d0a296>] __do_sys_write fs/read_write.c:750 [inline]
[<ffffffff80d0a296>] __se_sys_write fs/read_write.c:747 [inline]
[<ffffffff80d0a296>] __riscv_sys_write+0x6e/0xa0 fs/read_write.c:747
[<ffffffff8007af94>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff86594576>] do_trap_ecall_u+0x4ca/0x658 arch/riscv/kernel/traps.c:341
[<ffffffff865c0d08>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 3097 ff89 80e7 d400 82e3 e404 3097 ff89 80e7 23e0 (9002) 3097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff893097          	auipc	ra,0xff893
   4:	d40080e7          	jalr	-704(ra) # 0xff892d40
   8:	e40482e3          	beqz	s1,0xfffffffffffffe4c
   c:	ff893097          	auipc	ra,0xff893
  10:	23e080e7          	jalr	574(ra) # 0xff89324a
* 14:	9002                	ebreak <-- trapping instruction
  16:	9730                	.short	0x3097