------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 4933 Comm: syz.1.381 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
epc : ffffffff80cbe304 ra : ffffffff80cbe304 sp : ffff8f8003897380
 gp : ffffffff8a6d9c00 tp : ffffaf80132e5040 t0 : ffff8f8003897320
 t1 : fffff5ef0283ac09 t2 : ffffffff9191b3a0 s0 : ffff8f80038973f0
 s1 : ffffaf80141d6048 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000000002 a3 : ffffffff80cbe304 a4 : 0000000000000000
 a5 : ffffaf80132e6040 a6 : 0000000000000003 a7 : ffffaf80141d604b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf80141d6000
 s5 : dfffffff00000000 s6 : 0000000000000200 s7 : 00000000000bde00
 s8 : ffffffff88e6d260 s9 : 0000000000007fff s10: fffffffef14ff3ac
 s11: ffffffff8a7f9d60 t3 : 00000000000000c8 t4 : fffff5ef0283ac09
 t5 : fffff5ef0283ac0a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80cbe304 cause: 0000000000000003
[<ffffffff80cbe304>] __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
[<ffffffff80b37444>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80b37444>] __free_pages_prepare mm/page_alloc.c:1419 [inline]
[<ffffffff80b37444>] free_unref_folios+0xb6a/0x1c5c mm/page_alloc.c:3022
[<ffffffff8095aff0>] folios_put_refs+0x46c/0x7c6 mm/folio.c:1034
[<ffffffff80b88c84>] free_pages_and_swap_cache+0x278/0x3be mm/swap_state.c:595
[<ffffffff80aa1930>] __tlb_batch_free_encoded_pages+0xe2/0x25a mm/mmu_gather.c:138
[<ffffffff80aa4496>] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
[<ffffffff80aa4496>] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline]
[<ffffffff80aa4496>] tlb_flush_mmu mm/mmu_gather.c:424 [inline]
[<ffffffff80aa4496>] tlb_finish_mmu+0x188/0x822 mm/mmu_gather.c:549
[<ffffffff80a9e032>] exit_mmap+0x414/0xc9e mm/mmap.c:1328
[<ffffffff8014db66>] __mmput+0x106/0x3d0 kernel/fork.c:1193
[<ffffffff8014dea4>] mmput+0x74/0x88 kernel/fork.c:1216
[<ffffffff80170ab6>] exit_mm kernel/exit.c:617 [inline]
[<ffffffff80170ab6>] do_exit+0x80c/0x297c kernel/exit.c:999
[<ffffffff8017307e>] __do_sys_exit kernel/exit.c:1121 [inline]
[<ffffffff8017307e>] __se_sys_exit kernel/exit.c:1119 [inline]
[<ffffffff8017307e>] __riscv_sys_exit+0x48/0x52 kernel/exit.c:1119
[<ffffffff8007bd88>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8660e902>] do_trap_ecall_u+0x4ca/0x658 arch/riscv/kernel/traps.c:341
[<ffffffff8663b218>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: e0a0 854a c0ef ff6f 8a2a bf9d 2097 ff88 80e7 df80 (9002) 2097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e0a0                	fsw	fs0,64(s1)
   2:	854a                	mv	a0,s2
   4:	ff6fc0ef          	jal	0xffffffffffffc7fa
   8:	8a2a                	mv	s4,a0
   a:	bf9d                	j	0xffffffffffffff80
   c:	ff882097          	auipc	ra,0xff882
  10:	df8080e7          	jalr	-520(ra) # 0xff881e04
* 14:	9002                	ebreak <-- trapping instruction
  16:	9720                	.short	0x2097