------------[ cut here ]------------
kernel BUG at mm/page_table_check.c:157!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 1783 Comm: syz.0.12495 Not tainted 6.10.0-syzkaller-11185-g2c9b3512402e #0
Hardware name: linux,dummy-virt (DT)
pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __page_table_check_zero+0x1a8/0x1f0 mm/page_table_check.c:157
lr : instrument_atomic_read include/linux/instrumented.h:68 [inline]
lr : atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
lr : __page_table_check_zero+0x11c/0x1f0 mm/page_table_check.c:157
sp : ffff80008e0d77b0
x29: ffff80008e0d77b0 x28: dfff800000000000 x27: ffff00000a117ca4
x26: ffff7000112cd628 x25: 0000000000000004 x24: ffff80008966b140
x23: dfff800000000000 x22: 0000000000000002 x21: 0000000000000000
x20: ffff00000a117ca0 x19: ffff00000a117ca0 x18: 00000000019e58c6
x17: 0000000000000000 x16: 0000000000000000 x15: ffff000013272880
x14: 1fffe0000264e50f x13: 1fffe0000264e519 x12: ffff600001422f95
x11: 1fffe00001422f94 x10: ffff600001422f94 x9 : dfff800000000000
x8 : ffff00000a117ca7 x7 : 0000000000000001 x6 : ffff600001422f94
x5 : ffff00000a117ca4 x4 : ffff600001422f95 x3 : ffff80008098d870
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001
Call trace:
 __page_table_check_zero+0x1a8/0x1f0 mm/page_table_check.c:156
 page_table_check_free include/linux/page_table_check.h:41 [inline]
 free_pages_prepare mm/page_alloc.c:1094 [inline]
 free_unref_page+0x724/0xd24 mm/page_alloc.c:2588
 __free_pages+0x12c/0x1d8 mm/page_alloc.c:4770
 free_pages.part.0+0xc0/0x100 mm/page_alloc.c:4783
 free_pages+0x14/0x24 mm/page_alloc.c:4780
 hcd_buffer_free_pages+0xac/0x160 drivers/usb/core/buffer.c:210
 dec_usb_memory_use_count+0x20c/0x358 drivers/usb/core/devio.c:198
 usbdev_vm_close+0x38/0x50 drivers/usb/core/devio.c:222
 mmap_region+0x5a4/0x18e4 mm/mmap.c:3005
 do_mmap+0x69c/0xa34 mm/mmap.c:1397
 vm_mmap_pgoff+0x170/0x2a8 mm/util.c:588
 ksys_mmap_pgoff+0x1fc/0x634 mm/mmap.c:1443
 __do_compat_sys_aarch32_mmap2 arch/arm64/kernel/sys32.c:59 [inline]
 __se_compat_sys_aarch32_mmap2 arch/arm64/kernel/sys32.c:50 [inline]
 __arm64_compat_sys_aarch32_mmap2+0xc0/0x130 arch/arm64/kernel/sys32.c:50
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x6c/0x258 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xa4/0x234 arch/arm64/kernel/syscall.c:132
 do_el0_svc_compat+0x44/0x68 arch/arm64/kernel/syscall.c:157
 el0_svc_compat+0x4c/0x17c arch/arm64/kernel/entry-common.c:852
 el0t_32_sync_handler+0x98/0x13c arch/arm64/kernel/entry-common.c:862
 el0t_32_sync+0x194/0x198 arch/arm64/kernel/entry.S:603
Code: a8c67bfd d50323bf d65f03c0 d4210000 (d4210000) 
---[ end trace 0000000000000000 ]---