------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 1 UID: 0 PID: 3996 Comm: syz.0.22 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0x912/0xb98 mm/page_table_check.c:118
 ra : page_table_check_set+0x912/0xb98 mm/page_table_check.c:118
epc : ffffffff80c9f576 ra : ffffffff80c9f576 sp : ffff8f800a4f6df0
 gp : ffffffff8b127580 tp : ffffaf801e4cb580 t0 : ffff8f800a4f7378
 t1 : fffff5ef02937009 t2 : ffffffff80ac01ec s0 : ffff8f800a4f6e70
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c9f576 a4 : ffff8f8005cef438
 a5 : 0000000000031438 a6 : 0000000000000003 a7 : ffffaf80149b804b
 s2 : 00000000000b5800 s3 : 0000000000000000 s4 : ffffaf80149b8000
 s5 : 0000000000000200 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : ffffffff8986e0c0 s9 : 0000000000007fff s10: 0000000000000000
 s11: ffffffff8b248360 t3 : 00000000000000c8 t4 : fffff5ef02937009
 t5 : fffff5ef0293700a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c9f576 cause: 0000000000000003
[<ffffffff80c9f576>] page_table_check_set+0x912/0xb98 mm/page_table_check.c:118
[<ffffffff80c9fc9c>] __page_table_check_ptes_set+0x23c/0x4a4 mm/page_table_check.c:223
[<ffffffff80c2ab8a>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80c2ab8a>] set_ptes arch/riscv/include/asm/pgtable.h:642 [inline]
[<ffffffff80c2ab8a>] __split_huge_pmd_locked mm/huge_memory.c:3458 [inline]
[<ffffffff80c2ab8a>] split_huge_pmd_locked+0x1e96/0x22e0 mm/huge_memory.c:3476
[<ffffffff80c2b178>] __split_huge_pmd+0x1a4/0x2aa mm/huge_memory.c:3490
[<ffffffff80c2d9e0>] split_huge_pmd_address mm/huge_memory.c:3503 [inline]
[<ffffffff80c2d9e0>] split_huge_pmd_if_needed mm/huge_memory.c:3515 [inline]
[<ffffffff80c2d9e0>] split_huge_pmd_if_needed mm/huge_memory.c:3506 [inline]
[<ffffffff80c2d9e0>] vma_adjust_trans_huge+0x272/0x4b2 mm/huge_memory.c:3527
[<ffffffff80afbfdc>] __split_vma+0xbc2/0x1db8 mm/vma.c:601
[<ffffffff80afd3ae>] vms_gather_munmap_vmas+0x1dc/0x14c2 mm/vma.c:1507
[<ffffffff80b06886>] do_vmi_align_munmap+0x240/0x6d6 mm/vma.c:1675
[<ffffffff80b06e66>] do_vmi_munmap+0x14a/0x2c6 mm/vma.c:1732
[<ffffffff80a94c8e>] do_munmap+0xd4/0x10a mm/mmap.c:1082
[<ffffffff80aaadae>] mremap_to+0x28c/0x474 mm/mremap.c:1469
[<ffffffff80aab63a>] remap_move mm/mremap.c:1963 [inline]
[<ffffffff80aab63a>] do_mremap mm/mremap.c:2011 [inline]
[<ffffffff80aab63a>] __do_sys_mremap+0x6a4/0x138a mm/mremap.c:2075
[<ffffffff80aac3c0>] __se_sys_mremap mm/mremap.c:2043 [inline]
[<ffffffff80aac3c0>] __riscv_sys_mremap+0xa0/0x1c8 mm/mremap.c:2043
[<ffffffff8007dc50>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8663070a>] do_trap_ecall_u+0x4ca/0x658 arch/riscv/kernel/traps.c:341
[<ffffffff8665d064>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 8097 ff89 80e7 2bc0 8ce3 bc04 8097 ff89 80e7 7ba0 (9002) 8097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff898097          	auipc	ra,0xff898
   4:	2bc080e7          	jalr	700(ra) # 0xff8982bc
   8:	bc048ce3          	beqz	s1,0xfffffffffffffbe0
   c:	ff898097          	auipc	ra,0xff898
  10:	7ba080e7          	jalr	1978(ra) # 0xff8987c6
* 14:	9002                	ebreak <-- trapping instruction
  16:	9780                	.short	0x8097