------------[ cut here ]------------
pte_uffd_wp(pte) && pte_write(pte)
WARNING: mm/page_table_check.c:191 at page_table_check_pte_flags mm/page_table_check.c:191 [inline], CPU#1: syz.1.6901/32115
WARNING: mm/page_table_check.c:191 at __page_table_check_ptes_set+0x111/0x320 mm/page_table_check.c:207, CPU#1: syz.1.6901/32115
Modules linked in:
CPU: 1 UID: 0 PID: 32115 Comm: syz.1.6901 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:page_table_check_pte_flags mm/page_table_check.c:191 [inline]
RIP: 0010:__page_table_check_ptes_set+0x111/0x320 mm/page_table_check.c:207
Code: 4c 89 ee 48 81 e6 9e fe ff ff 41 0f 95 c7 31 ff e8 04 ba 8b ff 44 84 fb 75 15 e8 1a b5 8b ff e9 84 00 00 00 e8 10 b5 8b ff 90 <0f> 0b 90 eb 79 4c 89 e8 48 d1 e8 49 bf 00 00 00 00 00 00 00 7c 49
RSP: 0000:ffffc9000de5f9d0 EFLAGS: 00010283
RAX: ffffffff8238c240 RBX: ffff888032edbd40 RCX: 0000000000080000
RDX: ffffc90013231000 RSI: 00000000000013b8 RDI: 00000000000013b9
RBP: 0000000000000001 R08: ffffea0001101687 R09: 1ffffd40002202d0
R10: dffffc0000000000 R11: fffff940002202d1 R12: 0000000000000000
R13: 000000004405ac67 R14: ffff8880567aeff0 R15: ffff888032edbd40
FS:  0000000000000000(0000) GS:ffff8881257f5000(0063) knlGS:00000000f5436b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000080ffe000 CR3: 0000000031dcc000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 page_table_check_ptes_set include/linux/page_table_check.h:76 [inline]
 set_ptes include/linux/pgtable.h:292 [inline]
 do_swap_page+0x55db/0x5e10 mm/memory.c:5013
 handle_pte_fault mm/memory.c:6279 [inline]
 __handle_mm_fault mm/memory.c:6414 [inline]
 handle_mm_fault+0x12d2/0x32a0 mm/memory.c:6583
 do_user_addr_fault+0xa73/0x1360 arch/x86/mm/fault.c:1334
 handle_page_fault arch/x86/mm/fault.c:1474 [inline]
 exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1527
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0023:0xf7060360
Code: 50 6a 00 e8 32 74 14 00 8b 5c 24 2c 8b 4c 24 28 83 c4 20 8b 55 40 89 03 03 11 85 f6 74 18 31 c0 2e 8d b4 26 00 00 00 00 66 90 <89> 02 83 c0 01 83 c2 04 39 c6 75 f4 83 c4 1c 89 f8 5b 5e 5f 5d c3
RSP: 002b:00000000f54364f0 EFLAGS: 00010202
RAX: 0000000000000800 RBX: 0000000080000280 RCX: 0000000080000000
RDX: 0000000080ffdfff RSI: 0000000000000efe RDI: 00000000ffffffff
RBP: 0000000080000140 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	50                   	push   %rax
   1:	6a 00                	push   $0x0
   3:	e8 32 74 14 00       	call   0x14743a
   8:	8b 5c 24 2c          	mov    0x2c(%rsp),%ebx
   c:	8b 4c 24 28          	mov    0x28(%rsp),%ecx
  10:	83 c4 20             	add    $0x20,%esp
  13:	8b 55 40             	mov    0x40(%rbp),%edx
  16:	89 03                	mov    %eax,(%rbx)
  18:	03 11                	add    (%rcx),%edx
  1a:	85 f6                	test   %esi,%esi
  1c:	74 18                	je     0x36
  1e:	31 c0                	xor    %eax,%eax
  20:	2e 8d b4 26 00 00 00 	cs lea 0x0(%rsi,%riz,1),%esi
  27:	00
  28:	66 90                	xchg   %ax,%ax
* 2a:	89 02                	mov    %eax,(%rdx) <-- trapping instruction
  2c:	83 c0 01             	add    $0x1,%eax
  2f:	83 c2 04             	add    $0x4,%edx
  32:	39 c6                	cmp    %eax,%esi
  34:	75 f4                	jne    0x2a
  36:	83 c4 1c             	add    $0x1c,%esp
  39:	89 f8                	mov    %edi,%eax
  3b:	5b                   	pop    %rbx
  3c:	5e                   	pop    %rsi
  3d:	5f                   	pop    %rdi
  3e:	5d                   	pop    %rbp
  3f:	c3                   	ret