------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 6907 Comm: syz.1.694 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0xa74/0xd30 mm/page_table_check.c:118
 ra : page_table_check_set+0xa74/0xd30 mm/page_table_check.c:118
epc : ffffffff80c4d300 ra : ffffffff80c4d300 sp : ffff8f8000ba6d10
 gp : ffffffff8a22a0c0 tp : ffffaf801a77cf80 t0 : ffff8f8000ba7298
 t1 : fffff5ef027a0809 t2 : ffffffff86a069b0 s0 : ffff8f8000ba6d90
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c4d300 a4 : ffff8f800459f6e0
 a5 : 000000000002c6e0 a6 : 0000000000000003 a7 : ffffaf8013d0404b
 s2 : 00000000000bb400 s3 : 0000000000000000 s4 : ffffaf8013d04000
 s5 : 0000000000000200 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : 0000000000007fff s9 : ffffffff88a44e80 s10: 0000000000000000
 s11: ffffffff8a347d80 t3 : 0000000000000001 t4 : fffff5ef027a0809
 t5 : fffff5ef027a080a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c4d300 cause: 0000000000000003
[<ffffffff80c4d300>] page_table_check_set+0xa74/0xd30 mm/page_table_check.c:118
[<ffffffff80c4da84>] __page_table_check_ptes_set+0x264/0x47c mm/page_table_check.c:215
[<ffffffff80bd6c5c>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80bd6c5c>] set_ptes arch/riscv/include/asm/pgtable.h:625 [inline]
[<ffffffff80bd6c5c>] __split_huge_pmd_locked mm/huge_memory.c:3256 [inline]
[<ffffffff80bd6c5c>] split_huge_pmd_locked+0x2b08/0x3268 mm/huge_memory.c:3274
[<ffffffff80bd7676>] __split_huge_pmd+0x2ba/0x3e4 mm/huge_memory.c:3288
[<ffffffff80bda896>] split_huge_pmd_address mm/huge_memory.c:3301 [inline]
[<ffffffff80bda896>] split_huge_pmd_if_needed mm/huge_memory.c:3313 [inline]
[<ffffffff80bda896>] split_huge_pmd_if_needed mm/huge_memory.c:3304 [inline]
[<ffffffff80bda896>] vma_adjust_trans_huge+0x15a/0x49c mm/huge_memory.c:3325
[<ffffffff80a97d30>] __split_vma+0x978/0xf10 mm/vma.c:554
[<ffffffff80a9865e>] vms_gather_munmap_vmas+0x396/0x143c mm/vma.c:1429
[<ffffffff80a9e0a4>] __mmap_setup mm/vma.c:2411 [inline]
[<ffffffff80a9e0a4>] __mmap_region+0x37c/0x22a0 mm/vma.c:2741
[<ffffffff80aa48d0>] mmap_region+0x138/0x2b8 mm/vma.c:2837
[<ffffffff80a2817e>] do_mmap+0xaea/0x1090 mm/mmap.c:559
[<ffffffff80962544>] vm_mmap_pgoff+0x27c/0x418 mm/util.c:581
[<ffffffff80a2488a>] ksys_mmap_pgoff+0x2c2/0x718 mm/mmap.c:605
[<ffffffff80073820>] riscv_sys_mmap arch/riscv/kernel/sys_riscv.c:29 [inline]
[<ffffffff80073820>] __do_sys_mmap arch/riscv/kernel/sys_riscv.c:38 [inline]
[<ffffffff80073820>] __se_sys_mmap arch/riscv/kernel/sys_riscv.c:34 [inline]
[<ffffffff80073820>] __riscv_sys_mmap+0x11c/0x18c arch/riscv/kernel/sys_riscv.c:34
[<ffffffff80077f1e>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8642fdbe>] do_trap_ecall_u+0x402/0x680 arch/riscv/kernel/traps.c:342
[<ffffffff8645a152>] handle_exception+0x15e/0x16a arch/riscv/kernel/entry.S:232
Code: e097 ff8c 80e7 11c0 81e3 e004 e097 ff8c 80e7 5f00 (9002) e097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff8ce097          	auipc	ra,0xff8ce
   4:	11c080e7          	jalr	284(ra) # 0xff8ce11c
   8:	e00481e3          	beqz	s1,0xfffffffffffffe0a
   c:	ff8ce097          	auipc	ra,0xff8ce
  10:	5f0080e7          	jalr	1520(ra) # 0xff8ce5fc
* 14:	9002                	ebreak <-- trapping instruction
  16:	97e0                	.short	0xe097