------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 1 UID: 0 PID: 4089 Comm: syz.1.53 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x318/0x4d2 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x318/0x4d2 mm/page_table_check.c:142
epc : ffffffff80c9e67a ra : ffffffff80c9e67a sp : ffff8f800b066fe0
 gp : ffffffff8aedd320 tp : ffffaf80152a1ac0 t0 : ffffffff86593768
 t1 : fffff5ef028a9409 t2 : ffffffff80a9427e s0 : ffff8f800b067050
 s1 : ffffaf801454a048 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000000002 a3 : ffffffff80c9e67a a4 : 0000000000000000
 a5 : ffffaf80152a2ac0 a6 : 0000000000000003 a7 : ffffaf801454a04b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf801454a000
 s5 : dfffffff00000000 s6 : 0000000000000200 s7 : 00000000000b4200
 s8 : ffffffff8966e0c0 s9 : 0000000000007fff s10: fffffffef15ff874
 s11: ffffffff8affc3a0 t3 : 00000000000000c8 t4 : fffff5ef028a9409
 t5 : fffff5ef028a940a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c9e67a cause: 0000000000000003
[<ffffffff80c9e67a>] __page_table_check_zero+0x318/0x4d2 mm/page_table_check.c:142
[<ffffffff80b234e4>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80b234e4>] __free_pages_prepare mm/page_alloc.c:1419 [inline]
[<ffffffff80b234e4>] free_unref_folios+0x920/0x19a6 mm/page_alloc.c:3022
[<ffffffff80959cdc>] folios_put_refs+0x46c/0x7c6 mm/folio.c:1036
[<ffffffff80b722ee>] free_pages_and_swap_cache+0x22e/0x3be mm/swap_state.c:592
[<ffffffff80a97b9c>] __tlb_batch_free_encoded_pages+0xe2/0x25a mm/mmu_gather.c:138
[<ffffffff80a99cbc>] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
[<ffffffff80a99cbc>] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline]
[<ffffffff80a99cbc>] tlb_flush_mmu mm/mmu_gather.c:424 [inline]
[<ffffffff80a99cbc>] tlb_finish_mmu+0x186/0x462 mm/mmu_gather.c:549
[<ffffffff80a9427e>] exit_mmap+0x414/0xc9e mm/mmap.c:1328
[<ffffffff80149b22>] __mmput+0x106/0x3d0 kernel/fork.c:1193
[<ffffffff80149e60>] mmput+0x74/0x88 kernel/fork.c:1216
[<ffffffff8016c7ae>] exit_mm kernel/exit.c:592 [inline]
[<ffffffff8016c7ae>] do_exit+0x80a/0x297a kernel/exit.c:974
[<ffffffff8016ee4a>] do_group_exit+0xca/0x258 kernel/exit.c:1129
[<ffffffff801a7a26>] get_signal+0x1f56/0x2222 kernel/signal.c:3112
[<ffffffff80075c66>] arch_do_signal_or_restart+0xf4/0x1cec arch/riscv/kernel/signal.c:534
[<ffffffff86594c50>] __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
[<ffffffff86594c50>] exit_to_user_mode_loop kernel/entry/common.c:101 [inline]
[<ffffffff86594c50>] __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
[<ffffffff86594c50>] irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
[<ffffffff86594c50>] irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
[<ffffffff86594c50>] irqentry_exit+0x536/0x11a2 kernel/entry/common.c:165
[<ffffffff86593768>] do_page_fault+0x3e/0x56 arch/riscv/kernel/traps.c:419
[<ffffffff865bfadc>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 6b00 0013 0000 4905 1936 bb45 7097 ff89 80e7 69e0 (9002) 7097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	6b00                	flw	fs0,16(a4)
   2:	00000013          	nop
   6:	4905                	li	s2,1
   8:	1936                	slli	s2,s2,0x2d
   a:	bb45                	j	0xfffffffffffffdba
   c:	ff897097          	auipc	ra,0xff897
  10:	69e080e7          	jalr	1694(ra) # 0xff8976aa
* 14:	9002                	ebreak <-- trapping instruction
  16:	9770                	.short	0x7097