------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 8661 Comm: syz.0.1007 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0xa74/0xd30 mm/page_table_check.c:118
 ra : page_table_check_set+0xa74/0xd30 mm/page_table_check.c:118
epc : ffffffff80c4d300 ra : ffffffff80c4d300 sp : ffff8f80028460c0
 gp : ffffffff8a22a0c0 tp : ffffaf801ad8b500 t0 : ffff8f8002846d80
 t1 : fffff5ef028306f5 t2 : 1ffff1f000508d4c s0 : ffff8f8002846140
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c4d300 a4 : ffff8f80058bb000
 a5 : 0000000000080000 a6 : 0000000000000003 a7 : ffffaf80141837ab
 s2 : 00000000000c4d7e s3 : 0000000000000000 s4 : ffffaf8014183760
 s5 : 0000000000000001 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : 0000000000007fff s9 : ffffffff88a44e80 s10: 0000000000000000
 s11: ffffffff8a347d80 t3 : 0000000000000001 t4 : fffff5ef028306f5
 t5 : fffff5ef028306f6 t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c4d300 cause: 0000000000000003
[<ffffffff80c4d300>] page_table_check_set+0xa74/0xd30 mm/page_table_check.c:118
[<ffffffff80c4da84>] __page_table_check_ptes_set+0x264/0x47c mm/page_table_check.c:215
[<ffffffff80baa208>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80baa208>] set_ptes arch/riscv/include/asm/pgtable.h:625 [inline]
[<ffffffff80baa208>] remove_migration_pte+0x1034/0x25bc mm/migrate.c:436
[<ffffffff80a51676>] rmap_walk_anon+0x30e/0x690 mm/rmap.c:2986
[<ffffffff80a6ddca>] rmap_walk_locked+0xa6/0xcc mm/rmap.c:3102
[<ffffffff80bb52ee>] remove_migration_ptes+0x18a/0x1bc mm/migrate.c:471
[<ffffffff80bdc988>] remap_page mm/huge_memory.c:3438 [inline]
[<ffffffff80bdc988>] __folio_split+0xeb4/0x16f8 mm/huge_memory.c:4078
[<ffffffff80bdd6aa>] __split_huge_page_to_list_to_order+0x7e/0x140 mm/huge_memory.c:4209
[<ffffffff80be110e>] split_huge_page_to_list_to_order include/linux/huge_mm.h:385 [inline]
[<ffffffff80be110e>] split_folio_to_list+0x22/0x30 mm/huge_memory.c:4273
[<ffffffff80915392>] shrink_folio_list+0x2346/0x4d78 mm/vmscan.c:1312
[<ffffffff80917eca>] reclaim_folio_list+0x106/0x8ec mm/vmscan.c:2205
[<ffffffff80928482>] reclaim_pages+0x33e/0x4b8 mm/vmscan.c:2242
[<ffffffff80afc2fa>] madvise_cold_or_pageout_pte_range+0x16de/0x2408 mm/madvise.c:442
[<ffffffff80a46f56>] walk_pmd_range mm/pagewalk.c:130 [inline]
[<ffffffff80a46f56>] walk_pud_range mm/pagewalk.c:224 [inline]
[<ffffffff80a46f56>] walk_p4d_range mm/pagewalk.c:262 [inline]
[<ffffffff80a46f56>] walk_pgd_range+0xcc6/0x1f84 mm/pagewalk.c:303
[<ffffffff80a4834c>] __walk_page_range+0x138/0x7a8 mm/pagewalk.c:411
[<ffffffff80a49b80>] walk_page_range_vma_unsafe+0x1ec/0x82c mm/pagewalk.c:715
[<ffffffff80a4a21a>] walk_page_range_vma+0x5a/0x84 mm/pagewalk.c:725
[<ffffffff80af6872>] madvise_pageout_page_range mm/madvise.c:620 [inline]
[<ffffffff80af6872>] madvise_pageout+0x236/0x794 mm/madvise.c:645
[<ffffffff80afdf6a>] madvise_vma_behavior+0xeb2/0x2ae4 mm/madvise.c:1364
[<ffffffff80affdd6>] madvise_walk_vmas+0x23a/0x978 mm/madvise.c:1719
[<ffffffff80b006fe>] madvise_do_behavior+0x1ea/0x5c0 mm/madvise.c:1935
[<ffffffff80b01846>] do_madvise+0x18a/0x22c mm/madvise.c:2028
[<ffffffff80b01970>] __do_sys_madvise mm/madvise.c:2037 [inline]
[<ffffffff80b01970>] __se_sys_madvise mm/madvise.c:2035 [inline]
[<ffffffff80b01970>] __riscv_sys_madvise+0x88/0xdc mm/madvise.c:2035
[<ffffffff80077f1e>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8642fdbe>] do_trap_ecall_u+0x402/0x680 arch/riscv/kernel/traps.c:342
[<ffffffff8645a152>] handle_exception+0x15e/0x16a arch/riscv/kernel/entry.S:232
Code: e097 ff8c 80e7 11c0 81e3 e004 e097 ff8c 80e7 5f00 (9002) e097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff8ce097          	auipc	ra,0xff8ce
   4:	11c080e7          	jalr	284(ra) # 0xff8ce11c
   8:	e00481e3          	beqz	s1,0xfffffffffffffe0a
   c:	ff8ce097          	auipc	ra,0xff8ce
  10:	5f0080e7          	jalr	1520(ra) # 0xff8ce5fc
* 14:	9002                	ebreak <-- trapping instruction
  16:	97e0                	.short	0xe097