------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 6863 Comm: syz.1.868 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
 ra : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
epc : ffffffff80cbd16e ra : ffffffff80cbd16e sp : ffff8f8003526da0
 gp : ffffffff8a6d9c00 tp : ffffaf8032550000 t0 : ffff8f8003527358
 t1 : fffff5ef02644c09 t2 : ffffffff80acb032 s0 : ffff8f8003526e20
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80cbd16e a4 : ffff8f800545c2c8
 a5 : 00000000000702c8 a6 : 0000000000000003 a7 : ffffaf801322604b
 s2 : 000000000009ee00 s3 : 0000000000000000 s4 : ffffaf8013226000
 s5 : 0000000000000200 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : ffffffff88e6d260 s9 : 0000000000007fff s10: 0000000000000000
 s11: ffffffff8a7f9d60 t3 : 00000000000000c8 t4 : fffff5ef02644c09
 t5 : fffff5ef02644c0a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80cbd16e cause: 0000000000000003
[<ffffffff80cbd16e>] page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
[<ffffffff80cbd8b6>] __page_table_check_ptes_set+0x23c/0x4a4 mm/page_table_check.c:223
[<ffffffff80c43f64>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80c43f64>] set_ptes arch/riscv/include/asm/pgtable.h:642 [inline]
[<ffffffff80c43f64>] __split_huge_pmd_locked mm/huge_memory.c:3416 [inline]
[<ffffffff80c43f64>] split_huge_pmd_locked+0x1f00/0x241e mm/huge_memory.c:3434
[<ffffffff80c4472c>] __split_huge_pmd+0x2aa/0x3d4 mm/huge_memory.c:3448
[<ffffffff80c46e98>] split_huge_pmd_address mm/huge_memory.c:3461 [inline]
[<ffffffff80c46e98>] split_huge_pmd_if_needed mm/huge_memory.c:3473 [inline]
[<ffffffff80c46e98>] split_huge_pmd_if_needed mm/huge_memory.c:3464 [inline]
[<ffffffff80c46e98>] vma_adjust_trans_huge+0x272/0x4b2 mm/huge_memory.c:3485
[<ffffffff80b0bb64>] __split_vma+0xbce/0x1f38 mm/vma.c:601
[<ffffffff80b0d0aa>] vms_gather_munmap_vmas+0x1dc/0x160a mm/vma.c:1507
[<ffffffff80b16a7c>] do_vmi_align_munmap+0x240/0x6d6 mm/vma.c:1675
[<ffffffff80b170e0>] do_vmi_munmap+0x1ce/0x3bc mm/vma.c:1732
[<ffffffff80aacaf4>] shrink_vma+0x1a2/0x324 mm/mremap.c:1433
[<ffffffff80ab444a>] mremap_to+0x344/0x474 mm/mremap.c:1487
[<ffffffff80ab4fd0>] do_mremap mm/mremap.c:2020 [inline]
[<ffffffff80ab4fd0>] __do_sys_mremap+0xa56/0x1490 mm/mremap.c:2076
[<ffffffff80ab5aaa>] __se_sys_mremap mm/mremap.c:2044 [inline]
[<ffffffff80ab5aaa>] __riscv_sys_mremap+0xa0/0x15a mm/mremap.c:2044
[<ffffffff8007bd88>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8660e902>] do_trap_ecall_u+0x4ca/0x658 arch/riscv/kernel/traps.c:341
[<ffffffff8663b218>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 3097 ff88 80e7 a900 82e3 e404 3097 ff88 80e7 f8e0 (9002) 3097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff883097          	auipc	ra,0xff883
   4:	a90080e7          	jalr	-1392(ra) # 0xff882a90
   8:	e40482e3          	beqz	s1,0xfffffffffffffe4c
   c:	ff883097          	auipc	ra,0xff883
  10:	f8e080e7          	jalr	-114(ra) # 0xff882f9a
* 14:	9002                	ebreak <-- trapping instruction
  16:	9730                	.short	0x3097