------------[ cut here ]------------
kernel BUG at mm/page_table_check.c:146!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 12289 Comm: syz-executor.0 Not tainted 6.9.0-rc4-syzkaller-00031-g96fca68c4fbf #0
Hardware name: linux,dummy-virt (DT)
pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __page_table_check_zero+0x190/0x228 mm/page_table_check.c:146
lr : instrument_atomic_read include/linux/instrumented.h:68 [inline]
lr : atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
lr : __page_table_check_zero+0x12c/0x228 mm/page_table_check.c:146
sp : ffff80008a387780
x29: ffff80008a387780 x28: fffffdffc0406030 x27: ffff000009cc0c04
x26: ffff70001126b398 x25: 0000000000000004 x24: ffff800089359cc0
x23: dfff800000000000 x22: 0000000000000002 x21: 0000000000000000
x20: ffff000009cc0c00 x19: ffff000009cc0c00 x18: ffff00000bfca870
x17: 0000000000000000 x16: 0000000000000006 x15: 1fffe000017f950d
x14: 1fffe000017f9517 x13: 1fffe000017f950a x12: ffff600001398181
x11: 1fffe00001398180 x10: ffff600001398180 x9 : dfff800000000000
x8 : ffff000009cc0c07 x7 : 0000000000000001 x6 : ffff600001398180
x5 : ffff000009cc0c04 x4 : ffff600001398181 x3 : ffff8000809691bc
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001
Call trace:
 __page_table_check_zero+0x190/0x228 mm/page_table_check.c:145
 page_table_check_free include/linux/page_table_check.h:41 [inline]
 free_pages_prepare mm/page_alloc.c:1142 [inline]
 free_unref_page_prepare+0x550/0x990 mm/page_alloc.c:2347
 free_unref_page+0x64/0x40c mm/page_alloc.c:2487
 free_the_page mm/page_alloc.c:564 [inline]
 __free_pages+0x1b4/0x20c mm/page_alloc.c:4661
 free_pages.part.0+0xc0/0x100 mm/page_alloc.c:4672
 free_pages+0x14/0x24 mm/page_alloc.c:4669
 hcd_buffer_free_pages+0xac/0x160 drivers/usb/core/buffer.c:210
 dec_usb_memory_use_count+0x20c/0x358 drivers/usb/core/devio.c:198
 usbdev_vm_close+0x38/0x50 drivers/usb/core/devio.c:222
 mmap_region+0x50c/0x18bc mm/mmap.c:2939
 do_mmap+0x5cc/0x978 mm/mmap.c:1385
 vm_mmap_pgoff+0x16c/0x2e8 mm/util.c:573
 ksys_mmap_pgoff+0x2b4/0x620 mm/mmap.c:1431
 __do_compat_sys_aarch32_mmap2 arch/arm64/kernel/sys32.c:64 [inline]
 __se_compat_sys_aarch32_mmap2 arch/arm64/kernel/sys32.c:55 [inline]
 __arm64_compat_sys_aarch32_mmap2+0xc0/0x130 arch/arm64/kernel/sys32.c:55
 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
 invoke_syscall+0x6c/0x25c arch/arm64/kernel/syscall.c:48
 el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:133
 do_el0_svc_compat+0x40/0x64 arch/arm64/kernel/syscall.c:158
 el0_svc_compat+0x4c/0x17c arch/arm64/kernel/entry-common.c:852
 el0t_32_sync_handler+0x98/0x13c arch/arm64/kernel/entry-common.c:862
 el0t_32_sync+0x194/0x198 arch/arm64/kernel/entry.S:603
Code: 942e09bd 17ffffd4 d4210000 d4210000 (d4210000) 
---[ end trace 0000000000000000 ]---