------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 1 UID: 0 PID: 3879 Comm: syz.0.9 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
epc : ffffffff80c81dd0 ra : ffffffff80c81dd0 sp : ffff8f800a006b60
 gp : ffffffff8a49f880 tp : ffffaf801ae2b580 t0 : ffffffff80b3f2e0
 t1 : fffff5ef027a1c13 t2 : ffffffff80c1255c s0 : ffff8f800a006bd0
 s1 : ffffaf8013d0e098 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c81dd0 a4 : ffff8f8004f8c000
 a5 : 0000000000080000 a6 : 0000000000000003 a7 : ffffaf8013d0e09b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf8013d0e050
 s5 : dfffffff00000000 s6 : 0000000000000001 s7 : 00000000000b3601
 s8 : ffffffff88c5a580 s9 : 0000000000007fff s10: fffffffef14b7b9c
 s11: ffffffff8a5bdce0 t3 : 0000000000000001 t4 : fffff5ef027a1c13
 t5 : fffff5ef027a1c14 t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c81dd0 cause: 0000000000000003
[<ffffffff80c81dd0>] __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
[<ffffffff80af68de>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80af68de>] __free_pages_prepare mm/page_alloc.c:1407 [inline]
[<ffffffff80af68de>] __free_frozen_pages+0x6ec/0x136c mm/page_alloc.c:2950
[<ffffffff80afefb8>] free_frozen_pages+0xe/0x16 mm/page_alloc.c:2988
[<ffffffff8092ca0a>] __folio_put+0x29a/0x454 mm/swap.c:112
[<ffffffff80b4fd72>] folio_put include/linux/mm.h:2124 [inline]
[<ffffffff80b4fd72>] free_folio_and_swap_cache+0x100/0x13c mm/swap_state.c:563
[<ffffffff80c0e92e>] __folio_split+0xec2/0x140e mm/huge_memory.c:4128
[<ffffffff80c1255c>] __split_huge_page_to_list_to_order mm/huge_memory.c:4240 [inline]
[<ffffffff80c1255c>] split_huge_page_to_list_to_order include/linux/huge_mm.h:415 [inline]
[<ffffffff80c1255c>] split_folio_to_list+0x4c/0x5e mm/huge_memory.c:4304
[<ffffffff80b3ba84>] madvise_cold_or_pageout_pte_range+0x1870/0x23ac mm/madvise.c:411
[<ffffffff80a8a4e6>] walk_pmd_range mm/pagewalk.c:148 [inline]
[<ffffffff80a8a4e6>] walk_pud_range mm/pagewalk.c:239 [inline]
[<ffffffff80a8a4e6>] walk_p4d_range mm/pagewalk.c:280 [inline]
[<ffffffff80a8a4e6>] walk_pgd_range+0xd12/0x1eca mm/pagewalk.c:321
[<ffffffff80a8b7d6>] __walk_page_range+0x138/0x7a8 mm/pagewalk.c:429
[<ffffffff80a8d006>] walk_page_range_vma_unsafe+0x1ec/0x82c mm/pagewalk.c:733
[<ffffffff80a8d6a0>] walk_page_range_vma+0x5a/0x84 mm/pagewalk.c:743
[<ffffffff80b34c7e>] madvise_cold_page_range mm/madvise.c:585 [inline]
[<ffffffff80b34c7e>] madvise_cold+0x1a4/0x5e0 mm/madvise.c:605
[<ffffffff80b3d93a>] madvise_vma_behavior+0x740/0x1eac mm/madvise.c:1355
[<ffffffff80b3f2e0>] madvise_walk_vmas+0x23a/0x976 mm/madvise.c:1712
[<ffffffff80b3fc06>] madvise_do_behavior+0x1ea/0x5be mm/madvise.c:1907
[<ffffffff80b40ee4>] do_madvise+0x23a/0x294 mm/madvise.c:2005
[<ffffffff80b40fc6>] __do_sys_madvise mm/madvise.c:2014 [inline]
[<ffffffff80b40fc6>] __se_sys_madvise mm/madvise.c:2012 [inline]
[<ffffffff80b40fc6>] __riscv_sys_madvise+0x88/0xdc mm/madvise.c:2012
[<ffffffff80078f0c>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff864f5770>] do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:342
[<ffffffff8652196c>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: dca0 854a d0ef 872f 8a2a bf9d c097 ff8a 80e7 db80 (9002) c097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	dca0                	sw	s0,120(s1)
   2:	854a                	mv	a0,s2
   4:	872fd0ef          	jal	0xffffffffffffd076
   8:	8a2a                	mv	s4,a0
   a:	bf9d                	j	0xffffffffffffff80
   c:	ff8ac097          	auipc	ra,0xff8ac
  10:	db8080e7          	jalr	-584(ra) # 0xff8abdc4
* 14:	9002                	ebreak <-- trapping instruction
  16:	97c0                	.short	0xc097