------------[ cut here ]------------ kernel BUG at [] mm/page_table_check.c:118! Kernel BUG [#1] Modules linked in: CPU: 0 UID: 0 PID: 5103 Comm: syz.2.183 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: riscv-virtio,qemu (DT) epc : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118 ra : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118 epc : ffffffff80cbd16e ra : ffffffff80cbd16e sp : ffff8f8003ff6160 gp : ffffffff8a6d9c00 tp : ffffaf801baa9ac0 t0 : 0000000000000000 t1 : fffff5ef027c2409 t2 : ffffffff9191b3a0 s0 : ffff8f8003ff61e0 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000 a2 : 0000000000080000 a3 : ffffffff80cbd16e a4 : ffff8f800a4c9d50 a5 : 00000000000a0d50 a6 : 0000000000000003 a7 : ffffaf8013e1204b s2 : 00000000000b6a00 s3 : 0000000000000000 s4 : ffffaf8013e12000 s5 : 0000000000000001 s6 : 0000000000000001 s7 : dfffffff00000000 s8 : ffffffff88e6d260 s9 : 0000000000007fff s10: 0000000000000000 s11: ffffffff8a7f9d60 t3 : 00000000000000c8 t4 : fffff5ef027c2409 t5 : fffff5ef027c240a t6 : 0000000000000002 ssp : 0000000000000000 status: 0000000200000120 badaddr: ffffffff80cbd16e cause: 0000000000000003 [] page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118 [] __page_table_check_ptes_set+0x23c/0x4a4 mm/page_table_check.c:223 [] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline] [] set_ptes arch/riscv/include/asm/pgtable.h:642 [inline] [] remove_migration_pte+0xef6/0x22e4 mm/migrate.c:448 [] rmap_walk_anon+0x3b2/0x7aa mm/rmap.c:3053 [] rmap_walk_locked+0xa6/0xca mm/rmap.c:3169 [] remove_migration_ptes+0x18a/0x1bc mm/migrate.c:483 [] remap_page mm/huge_memory.c:3598 [inline] [] __folio_split+0x1502/0x1e70 mm/huge_memory.c:4247 [] __split_huge_page_to_list_to_order mm/huge_memory.c:4393 [inline] [] split_huge_page_to_list_to_order include/linux/huge_mm.h:416 [inline] [] split_folio_to_list+0x4c/0x5e mm/huge_memory.c:4457 [] shrink_folio_list+0x213a/0x4b18 mm/vmscan.c:1286 [] reclaim_folio_list+0x13c/0x8fa mm/vmscan.c:2168 [] reclaim_pages+0x33e/0x4b8 mm/vmscan.c:2205 [] madvise_cold_or_pageout_pte_range+0x1b6c/0x23a8 mm/madvise.c:452 [] walk_pmd_range mm/pagewalk.c:147 [inline] [] walk_pud_range mm/pagewalk.c:237 [inline] [] walk_p4d_range mm/pagewalk.c:278 [inline] [] walk_pgd_range+0xcca/0x1df8 mm/pagewalk.c:319 [] __walk_page_range+0x138/0x7a8 mm/pagewalk.c:427 [] walk_page_range_vma_unsafe+0x1ec/0x82c mm/pagewalk.c:737 [] walk_page_range_vma+0x5a/0x84 mm/pagewalk.c:747 [] madvise_pageout_page_range mm/madvise.c:630 [inline] [] madvise_pageout+0x26c/0x7c4 mm/madvise.c:655 [] madvise_vma_behavior+0x71e/0x1e92 mm/madvise.c:1366 [] madvise_walk_vmas+0x244/0xa04 mm/madvise.c:1721 [] madvise_do_behavior+0x1ea/0x5be mm/madvise.c:1916 [] do_madvise+0x23a/0x294 mm/madvise.c:2014 [] __do_sys_madvise mm/madvise.c:2023 [inline] [] __se_sys_madvise mm/madvise.c:2021 [inline] [] __riscv_sys_madvise+0x88/0xdc mm/madvise.c:2021 [] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112 [] do_trap_ecall_u+0x4ca/0x658 arch/riscv/kernel/traps.c:341 [] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237 Code: 3097 ff88 80e7 a900 82e3 e404 3097 ff88 80e7 f8e0 (9002) 3097 ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: ff883097 auipc ra,0xff883 4: a90080e7 jalr -1392(ra) # 0xff882a90 8: e40482e3 beqz s1,0xfffffffffffffe4c c: ff883097 auipc ra,0xff883 10: f8e080e7 jalr -114(ra) # 0xff882f9a * 14: 9002 ebreak <-- trapping instruction 16: 9730 .short 0x3097