------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 5177 Comm: syz.3.219 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x396/0x544 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x396/0x544 mm/page_table_check.c:142
epc : ffffffff80c4e452 ra : ffffffff80c4e452 sp : ffff8f8009756f60
 gp : ffffffff8a22a0c0 tp : ffffaf80143e3500 t0 : 0000000000000000
 t1 : fffff5ef027c1009 t2 : ffffffff91601820 s0 : ffff8f8009756fd0
 s1 : ffffaf8013e08048 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000000002 a3 : ffffffff80c4e452 a4 : 0000000000000000
 a5 : ffffaf80143e4500 a6 : 0000000000000003 a7 : ffffaf8013e0804b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf8013e08000
 s5 : dfffffff00000000 s6 : 00000000000be800 s7 : 0000000000000200
 s8 : 0000000000000009 s9 : 0000000000007fff s10: fffffffef1468fb0
 s11: ffffffff8a347d80 t3 : 0000000000000001 t4 : fffff5ef027c1009
 t5 : fffff5ef027c100a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c4e452 cause: 0000000000000003
[<ffffffff80c4e452>] __page_table_check_zero+0x396/0x544 mm/page_table_check.c:142
[<ffffffff80ac124c>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80ac124c>] __free_pages_prepare mm/page_alloc.c:1434 [inline]
[<ffffffff80ac124c>] free_unref_folios+0xa58/0x1ef4 mm/page_alloc.c:3040
[<ffffffff808e5128>] folios_put_refs+0x41c/0x61c mm/swap.c:1002
[<ffffffff80b0d918>] free_pages_and_swap_cache+0x29c/0x480 mm/swap_state.c:426
[<ffffffff80a2d8d0>] __tlb_batch_free_encoded_pages+0xe4/0x25c mm/mmu_gather.c:138
[<ffffffff80a30434>] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
[<ffffffff80a30434>] tlb_flush_mmu_free mm/mmu_gather.c:398 [inline]
[<ffffffff80a30434>] tlb_flush_mmu mm/mmu_gather.c:405 [inline]
[<ffffffff80a30434>] tlb_finish_mmu+0x188/0x824 mm/mmu_gather.c:530
[<ffffffff80a29f9a>] exit_mmap+0x416/0xccc mm/mmap.c:1315
[<ffffffff8013fbaa>] __mmput+0x106/0x3d0 kernel/fork.c:1175
[<ffffffff8013fee8>] mmput+0x74/0x88 kernel/fork.c:1198
[<ffffffff80160356>] exit_mm kernel/exit.c:581 [inline]
[<ffffffff80160356>] do_exit+0x802/0x2ac4 kernel/exit.c:964
[<ffffffff80162b42>] do_group_exit+0xca/0x258 kernel/exit.c:1118
[<ffffffff8019c472>] get_signal+0x1f7e/0x224c kernel/signal.c:3034
[<ffffffff800724dc>] arch_do_signal_or_restart+0xca0/0x1ddc arch/riscv/kernel/signal.c:534
[<ffffffff803d0a7e>] __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
[<ffffffff803d0a7e>] exit_to_user_mode_loop+0x8e/0x878 kernel/entry/common.c:98
[<ffffffff8642fe9c>] __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
[<ffffffff8642fe9c>] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
[<ffffffff8642fe9c>] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
[<ffffffff8642fe9c>] do_trap_ecall_u+0x4e0/0x680 arch/riscv/kernel/traps.c:357
[<ffffffff8645a152>] handle_exception+0x15e/0x16a arch/riscv/kernel/entry.S:232
Code: 4b00 8526 c0ef e7bf 8a2a b791 d097 ff8c 80e7 49e0 (9002) d097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	4b00                	lw	s0,16(a4)
   2:	8526                	mv	a0,s1
   4:	e7bfc0ef          	jal	0xffffffffffffce7e
   8:	8a2a                	mv	s4,a0
   a:	b791                	j	0xffffffffffffff4e
   c:	ff8cd097          	auipc	ra,0xff8cd
  10:	49e080e7          	jalr	1182(ra) # 0xff8cd4aa
* 14:	9002                	ebreak <-- trapping instruction
  16:	97d0                	.short	0xd097