------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 1 UID: 0 PID: 6883 Comm: syz.2.722 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
 ra : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
epc : ffffffff80cbd16e ra : ffffffff80cbd16e sp : ffff8f80045361a0
 gp : ffffffff8a6d9c00 tp : ffffaf801c761ac0 t0 : 0000000000000000
 t1 : fffff5ef027c8809 t2 : ffffffff9191b3a8 s0 : ffff8f8004536220
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80cbd16e a4 : ffff8f800ad09000
 a5 : 0000000000080000 a6 : 0000000000000003 a7 : ffffaf8013e4404b
 s2 : 00000000000b7400 s3 : 0000000000000000 s4 : ffffaf8013e44000
 s5 : 0000000000000001 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : ffffffff88e6d260 s9 : 0000000000007fff s10: 0000000000000000
 s11: ffffffff8a7f9d60 t3 : 00000000000000c8 t4 : fffff5ef027c8809
 t5 : fffff5ef027c880a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80cbd16e cause: 0000000000000003
[<ffffffff80cbd16e>] page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
[<ffffffff80cbd8b6>] __page_table_check_ptes_set+0x23c/0x4a4 mm/page_table_check.c:223
[<ffffffff80c260b2>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80c260b2>] set_ptes arch/riscv/include/asm/pgtable.h:642 [inline]
[<ffffffff80c260b2>] remove_migration_pte+0xef6/0x22e4 mm/migrate.c:448
[<ffffffff80ac5520>] rmap_walk_anon+0x3b2/0x7aa mm/rmap.c:3053
[<ffffffff80adf2d8>] rmap_walk_locked+0xa6/0xca mm/rmap.c:3169
[<ffffffff80c28aba>] remove_migration_ptes+0x18a/0x1bc mm/migrate.c:483
[<ffffffff80c494d6>] remap_page mm/huge_memory.c:3598 [inline]
[<ffffffff80c494d6>] __folio_split+0x1502/0x1e70 mm/huge_memory.c:4247
[<ffffffff80c4d528>] __split_huge_page_to_list_to_order mm/huge_memory.c:4393 [inline]
[<ffffffff80c4d528>] split_huge_page_to_list_to_order include/linux/huge_mm.h:416 [inline]
[<ffffffff80c4d528>] split_folio_to_list+0x4c/0x5e mm/huge_memory.c:4457
[<ffffffff8098ae86>] shrink_folio_list+0x213a/0x4b18 mm/vmscan.c:1286
[<ffffffff8099b3ce>] evict_folios+0x2fa/0x11a0 mm/vmscan.c:4910
[<ffffffff8099d9e6>] try_to_shrink_lruvec+0x3ea/0x76c mm/vmscan.c:5076
[<ffffffff8099e72a>] lru_gen_shrink_lruvec mm/vmscan.c:5221 [inline]
[<ffffffff8099e72a>] shrink_lruvec+0x29c/0x1e5c mm/vmscan.c:5981
[<ffffffff809a87fa>] shrink_node_memcgs mm/vmscan.c:6220 [inline]
[<ffffffff809a87fa>] shrink_node+0x778/0x3ca2 mm/vmscan.c:6264
[<ffffffff809b0a14>] shrink_zones mm/vmscan.c:6503 [inline]
[<ffffffff809b0a14>] do_try_to_free_pages+0x330/0x14d6 mm/vmscan.c:6565
[<ffffffff809b1f2a>] try_to_free_mem_cgroup_pages+0x370/0xe72 mm/vmscan.c:6887
[<ffffffff80c72e98>] mem_cgroup_resize_max+0x164/0x25e mm/memcontrol-v1.c:1816
[<ffffffff80c7311c>] mem_cgroup_write+0x18a/0x2de mm/memcontrol-v1.c:2024
[<ffffffff804bb658>] cgroup_file_write+0x190/0x70e kernel/cgroup/cgroup.c:4412
[<ffffffff80ff6bba>] kernfs_fop_write_iter+0x37c/0x530 fs/kernfs/file.c:345
[<ffffffff80d29342>] new_sync_write fs/read_write.c:595 [inline]
[<ffffffff80d29342>] vfs_write+0x81a/0x1020 fs/read_write.c:687
[<ffffffff80d29f52>] ksys_write+0x126/0x244 fs/read_write.c:739
[<ffffffff80d2a0de>] __do_sys_write fs/read_write.c:750 [inline]
[<ffffffff80d2a0de>] __se_sys_write fs/read_write.c:747 [inline]
[<ffffffff80d2a0de>] __riscv_sys_write+0x6e/0xa0 fs/read_write.c:747
[<ffffffff8007bd88>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8660e902>] do_trap_ecall_u+0x4ca/0x658 arch/riscv/kernel/traps.c:341
[<ffffffff8663b218>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 3097 ff88 80e7 a900 82e3 e404 3097 ff88 80e7 f8e0 (9002) 3097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff883097          	auipc	ra,0xff883
   4:	a90080e7          	jalr	-1392(ra) # 0xff882a90
   8:	e40482e3          	beqz	s1,0xfffffffffffffe4c
   c:	ff883097          	auipc	ra,0xff883
  10:	f8e080e7          	jalr	-114(ra) # 0xff882f9a
* 14:	9002                	ebreak <-- trapping instruction
  16:	9730                	.short	0x3097