------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 1 UID: 0 PID: 5330 Comm: syz.1.569 Tainted: G        W    L      syzkaller #0 PREEMPT 
Tainted: [W]=WARN, [L]=SOFTLOCKUP
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0x9ba/0xc5c mm/page_table_check.c:118
 ra : page_table_check_set+0x9ba/0xc5c mm/page_table_check.c:118
epc : ffffffff80c6ce0e ra : ffffffff80c6ce0e sp : ffff8f8009b56150
 gp : ffffffff8a24a9a0 tp : ffffaf801c431ac0 t0 : 0000000000000000
 t1 : fffff5ef02738409 t2 : ffffffff91623ec8 s0 : ffff8f8009b561d0
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c6ce0e a4 : ffff8f8004d8b3d0
 a5 : 00000000000b03d0 a6 : 0000000000000003 a7 : ffffaf80139c204b
 s2 : 00000000000b5a00 s3 : 0000000000000000 s4 : ffffaf80139c2000
 s5 : 0000000000000001 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : 0000000000007fff s9 : ffffffff88a50480 s10: 0000000000000000
 s11: ffffffff8a367ca0 t3 : 0000000000000001 t4 : fffff5ef02738409
 t5 : fffff5ef0273840a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c6ce0e cause: 0000000000000003
[<ffffffff80c6ce0e>] page_table_check_set+0x9ba/0xc5c mm/page_table_check.c:118
[<ffffffff80c6d578>] __page_table_check_ptes_set+0x264/0x47c mm/page_table_check.c:212
[<ffffffff80bceb9c>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80bceb9c>] set_ptes arch/riscv/include/asm/pgtable.h:625 [inline]
[<ffffffff80bceb9c>] remove_migration_pte+0x1038/0x2148 mm/migrate.c:436
[<ffffffff80a7f51e>] rmap_walk_anon+0x30e/0x690 mm/rmap.c:2999
[<ffffffff80a984ba>] rmap_walk_locked+0xa6/0xcc mm/rmap.c:3115
[<ffffffff80bd93d2>] remove_migration_ptes+0x18a/0x1bc mm/migrate.c:471
[<ffffffff80bfd284>] remap_page mm/huge_memory.c:3540 [inline]
[<ffffffff80bfd284>] __folio_split+0xce8/0x1410 mm/huge_memory.c:4180
[<ffffffff80c0138c>] __split_huge_page_to_list_to_order mm/huge_memory.c:4311 [inline]
[<ffffffff80c0138c>] split_huge_page_to_list_to_order include/linux/huge_mm.h:385 [inline]
[<ffffffff80c0138c>] split_folio_to_list+0x4c/0x60 mm/huge_memory.c:4375
[<ffffffff809495ae>] shrink_folio_list+0x23f6/0x4e10 mm/vmscan.c:1287
[<ffffffff8094c0ce>] reclaim_folio_list+0x106/0x8d8 mm/vmscan.c:2171
[<ffffffff8095c7ba>] reclaim_pages+0x33e/0x4b8 mm/vmscan.c:2208
[<ffffffff80b25210>] madvise_cold_or_pageout_pte_range+0x1b4c/0x2378 mm/madvise.c:444
[<ffffffff80a751d8>] walk_pmd_range mm/pagewalk.c:148 [inline]
[<ffffffff80a751d8>] walk_pud_range mm/pagewalk.c:239 [inline]
[<ffffffff80a751d8>] walk_p4d_range mm/pagewalk.c:280 [inline]
[<ffffffff80a751d8>] walk_pgd_range+0xd14/0x1fa4 mm/pagewalk.c:321
[<ffffffff80a765a0>] __walk_page_range+0x138/0x7a8 mm/pagewalk.c:429
[<ffffffff80a77dd4>] walk_page_range_vma_unsafe+0x1ec/0x82c mm/pagewalk.c:733
[<ffffffff80a7846e>] walk_page_range_vma+0x5a/0x84 mm/pagewalk.c:743
[<ffffffff80b1f43e>] madvise_pageout_page_range mm/madvise.c:622 [inline]
[<ffffffff80b1f43e>] madvise_pageout+0x236/0x794 mm/madvise.c:647
[<ffffffff80b26d9e>] madvise_vma_behavior+0x726/0x1ecc mm/madvise.c:1358
[<ffffffff80b2877e>] madvise_walk_vmas+0x23a/0x978 mm/madvise.c:1713
[<ffffffff80b290a6>] madvise_do_behavior+0x1ea/0x5c0 mm/madvise.c:1929
[<ffffffff80b2a1ee>] do_madvise+0x18a/0x22c mm/madvise.c:2022
[<ffffffff80b2a318>] __do_sys_madvise mm/madvise.c:2031 [inline]
[<ffffffff80b2a318>] __se_sys_madvise mm/madvise.c:2029 [inline]
[<ffffffff80b2a318>] __riscv_sys_madvise+0x88/0xdc mm/madvise.c:2029
[<ffffffff80078f0a>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8648ebf0>] do_trap_ecall_u+0x3dc/0x61c arch/riscv/kernel/traps.c:342
[<ffffffff864b9f62>] handle_exception+0x15e/0x16a arch/riscv/kernel/entry.S:232
Code: 5097 ff8c 80e7 2720 81e3 e004 5097 ff8c 80e7 7460 (9002) 5097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff8c5097          	auipc	ra,0xff8c5
   4:	272080e7          	jalr	626(ra) # 0xff8c5272
   8:	e00481e3          	beqz	s1,0xfffffffffffffe0a
   c:	ff8c5097          	auipc	ra,0xff8c5
  10:	746080e7          	jalr	1862(ra) # 0xff8c5752
* 14:	9002                	ebreak <-- trapping instruction
  16:	9750                	.short	0x5097