------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 3877 Comm: syz.0.6 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
epc : ffffffff80c81dd0 ra : ffffffff80c81dd0 sp : ffff8f800aab67d0
 gp : ffffffff8a49f880 tp : ffffaf8015355040 t0 : ffffffff80b3f2e0
 t1 : fffff5ef027a6c09 t2 : ffffffff80974b7e s0 : ffff8f800aab6840
 s1 : ffffaf8013d36048 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c81dd0 a4 : ffff8f80046b9000
 a5 : 0000000000080000 a6 : 0000000000000003 a7 : ffffaf8013d3604b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf8013d36000
 s5 : dfffffff00000000 s6 : 0000000000000001 s7 : 00000000000b3e00
 s8 : ffffffff88c5a580 s9 : 0000000000007fff s10: fffffffef14b7b9c
 s11: ffffffff8a5bdce0 t3 : 0000000000000001 t4 : fffff5ef027a6c09
 t5 : fffff5ef027a6c0a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c81dd0 cause: 0000000000000003
[<ffffffff80c81dd0>] __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
[<ffffffff80affb48>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80affb48>] __free_pages_prepare mm/page_alloc.c:1407 [inline]
[<ffffffff80affb48>] free_unref_folios+0xb72/0x1b80 mm/page_alloc.c:3011
[<ffffffff8092edf4>] folio_batch_move_lru+0x642/0x7e4 mm/swap.c:211
[<ffffffff809305c4>] __folio_batch_add_and_move+0x2ce/0xb64 mm/swap.c:231
[<ffffffff80934b56>] folio_add_lru+0x19a/0x320 mm/swap.c:562
[<ffffffff809656be>] folio_putback_lru mm/vmscan.c:820 [inline]
[<ffffffff809656be>] reclaim_folio_list+0x23e/0x8ee mm/vmscan.c:2175
[<ffffffff80974b7e>] reclaim_pages+0x33e/0x4b8 mm/vmscan.c:2208
[<ffffffff80b3bd86>] madvise_cold_or_pageout_pte_range+0x1b72/0x23ac mm/madvise.c:443
[<ffffffff80a8a4e6>] walk_pmd_range mm/pagewalk.c:148 [inline]
[<ffffffff80a8a4e6>] walk_pud_range mm/pagewalk.c:239 [inline]
[<ffffffff80a8a4e6>] walk_p4d_range mm/pagewalk.c:280 [inline]
[<ffffffff80a8a4e6>] walk_pgd_range+0xd12/0x1eca mm/pagewalk.c:321
[<ffffffff80a8b7d6>] __walk_page_range+0x138/0x7a8 mm/pagewalk.c:429
[<ffffffff80a8d006>] walk_page_range_vma_unsafe+0x1ec/0x82c mm/pagewalk.c:733
[<ffffffff80a8d6a0>] walk_page_range_vma+0x5a/0x84 mm/pagewalk.c:743
[<ffffffff80b35d56>] madvise_pageout_page_range mm/madvise.c:621 [inline]
[<ffffffff80b35d56>] madvise_pageout+0x26c/0x7c4 mm/madvise.c:646
[<ffffffff80b3d926>] madvise_vma_behavior+0x72c/0x1eac mm/madvise.c:1357
[<ffffffff80b3f2e0>] madvise_walk_vmas+0x23a/0x976 mm/madvise.c:1712
[<ffffffff80b3fc06>] madvise_do_behavior+0x1ea/0x5be mm/madvise.c:1907
[<ffffffff80b40ee4>] do_madvise+0x23a/0x294 mm/madvise.c:2005
[<ffffffff80b40fc6>] __do_sys_madvise mm/madvise.c:2014 [inline]
[<ffffffff80b40fc6>] __se_sys_madvise mm/madvise.c:2012 [inline]
[<ffffffff80b40fc6>] __riscv_sys_madvise+0x88/0xdc mm/madvise.c:2012
[<ffffffff80078f0c>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff864f5770>] do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:342
[<ffffffff8652196c>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: dca0 854a d0ef 872f 8a2a bf9d c097 ff8a 80e7 db80 (9002) c097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	dca0                	sw	s0,120(s1)
   2:	854a                	mv	a0,s2
   4:	872fd0ef          	jal	0xffffffffffffd076
   8:	8a2a                	mv	s4,a0
   a:	bf9d                	j	0xffffffffffffff80
   c:	ff8ac097          	auipc	ra,0xff8ac
  10:	db8080e7          	jalr	-584(ra) # 0xff8abdc4
* 14:	9002                	ebreak <-- trapping instruction
  16:	97c0                	.short	0xc097