syzbot

------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 6833 Comm: syz.1.682 Tainted: G        W    L      syzkaller #0 PREEMPT 
Tainted: [W]=WARN, [L]=SOFTLOCKUP
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x386/0x534 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x386/0x534 mm/page_table_check.c:142
epc : ffffffff80c83132 ra : ffffffff80c83132 sp : ffff8f8002d77010
 gp : ffffffff8a49d240 tp : ffffaf8030f90000 t0 : ffffffff80ce3418
 t1 : fffff5ef027b7013 t2 : ffffffff80c108ee s0 : ffff8f8002d77080
 s1 : ffffaf8013db8098 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c83132 a4 : ffff8f800479a000
 a5 : 0000000000080000 a6 : 0000000000000003 a7 : ffffaf8013db809b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf8013db8050
 s5 : dfffffff00000000 s6 : 00000000000b5801 s7 : 0000000000000001
 s8 : 0000000000000000 s9 : 0000000000007fff s10: fffffffef14b7794
 s11: ffffffff8a5bbca0 t3 : 0000000000000001 t4 : fffff5ef027b7013
 t5 : fffff5ef027b7014 t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c83132 cause: 0000000000000003
[<ffffffff80c83132>] __page_table_check_zero+0x386/0x534 mm/page_table_check.c:142
[<ffffffff80af855a>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80af855a>] __free_pages_prepare mm/page_alloc.c:1407 [inline]
[<ffffffff80af855a>] __free_frozen_pages+0x6ee/0x1370 mm/page_alloc.c:2950
[<ffffffff80b00c5a>] free_frozen_pages+0xe/0x18 mm/page_alloc.c:2988
[<ffffffff8092f7ca>] __folio_put+0x29a/0x454 mm/swap.c:112
[<ffffffff80b51964>] folio_put include/linux/mm.h:2124 [inline]
[<ffffffff80b51964>] free_folio_and_swap_cache+0x100/0x13c mm/swap_state.c:563
[<ffffffff80c0ff3a>] __folio_split+0xec2/0x1410 mm/huge_memory.c:4128
[<ffffffff80c108ee>] __split_huge_page_to_list_to_order mm/huge_memory.c:4240 [inline]
[<ffffffff80c108ee>] split_huge_page_to_list_to_order include/linux/huge_mm.h:415 [inline]
[<ffffffff80c108ee>] split_folio_to_list mm/huge_memory.c:4304 [inline]
[<ffffffff80c108ee>] deferred_split_scan+0x466/0xc04 mm/huge_memory.c:4492
[<ffffffff8098c5ba>] do_shrink_slab+0x3f2/0x17d8 mm/shrinker.c:434
[<ffffffff8098f200>] shrink_slab_memcg mm/shrinker.c:551 [inline]
[<ffffffff8098f200>] shrink_slab+0xa40/0x1604 mm/shrinker.c:629
[<ffffffff8096fc98>] drop_slab_node mm/vmscan.c:413 [inline]
[<ffffffff8096fc98>] drop_slab+0x104/0x3c4 mm/vmscan.c:431
[<ffffffff80eff378>] drop_caches_sysctl_handler fs/drop_caches.c:68 [inline]
[<ffffffff80eff378>] drop_caches_sysctl_handler+0x1f4/0x398 fs/drop_caches.c:51
[<ffffffff80f8ee4a>] proc_sys_call_handler+0x3ce/0x59c fs/proc/proc_sysctl.c:600
[<ffffffff80f8f03a>] proc_sys_write+0x22/0x30 fs/proc/proc_sysctl.c:626
[<ffffffff80cdfa00>] do_iter_readv_writev+0x668/0x814 fs/read_write.c:828
[<ffffffff80ce3418>] vfs_writev+0x308/0xbc8 fs/read_write.c:1058
[<ffffffff80ce3e0a>] do_writev+0x132/0x334 fs/read_write.c:1104
[<ffffffff80ce9f56>] __do_sys_writev fs/read_write.c:1172 [inline]
[<ffffffff80ce9f56>] __se_sys_writev fs/read_write.c:1169 [inline]
[<ffffffff80ce9f56>] __riscv_sys_writev+0x6e/0xa0 fs/read_write.c:1169
[<ffffffff80078f96>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff864f95a4>] do_trap_ecall_u+0x3e4/0x638 arch/riscv/kernel/traps.c:342
[<ffffffff86525518>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 8dc0 8526 d0ef 88af 8a2a b7a1 d097 ff8a 80e7 8ca0 (9002) d097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	8dc0                	.insn	2, 0x8dc0
   2:	8526                	mv	a0,s1
   4:	88afd0ef          	jal	0xffffffffffffd08e
   8:	8a2a                	mv	s4,a0
   a:	b7a1                	j	0xffffffffffffff52
   c:	ff8ad097          	auipc	ra,0xff8ad
  10:	8ca080e7          	jalr	-1846(ra) # 0xff8ac8d6
* 14:	9002                	ebreak <-- trapping instruction
  16:	97d0                	.short	0xd097