------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 1 UID: 0 PID: 4105 Comm: syz.1.86 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x318/0x4d2 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x318/0x4d2 mm/page_table_check.c:142
epc : ffffffff80c9e67a ra : ffffffff80c9e67a sp : ffff8f800b096b10
 gp : ffffffff8aedd320 tp : ffffaf801c94b580 t0 : ffff8f800b096ac0
 t1 : fffff5ef028c3809 t2 : fffffffff2000000 s0 : ffff8f800b096b80
 s1 : ffffaf801461c048 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000000002 a3 : ffffffff80c9e67a a4 : 0000000000000000
 a5 : ffffaf801c94c580 a6 : 0000000000000003 a7 : ffffaf801461c04b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf801461c000
 s5 : dfffffff00000000 s6 : 0000000000000200 s7 : 00000000000b6c00
 s8 : ffffffff8966e0c0 s9 : 0000000000007fff s10: fffffffef15ff874
 s11: ffffffff8affc3a0 t3 : 00000000000000c8 t4 : fffff5ef028c3809
 t5 : fffff5ef028c380a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c9e67a cause: 0000000000000003
[<ffffffff80c9e67a>] __page_table_check_zero+0x318/0x4d2 mm/page_table_check.c:142
[<ffffffff80b234e4>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80b234e4>] __free_pages_prepare mm/page_alloc.c:1419 [inline]
[<ffffffff80b234e4>] free_unref_folios+0x920/0x19a6 mm/page_alloc.c:3022
[<ffffffff80959cdc>] folios_put_refs+0x46c/0x7c6 mm/folio.c:1036
[<ffffffff80b722ee>] free_pages_and_swap_cache+0x22e/0x3be mm/swap_state.c:592
[<ffffffff80a97b9c>] __tlb_batch_free_encoded_pages+0xe2/0x25a mm/mmu_gather.c:138
[<ffffffff80a99106>] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
[<ffffffff80a99106>] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline]
[<ffffffff80a99106>] tlb_flush_mmu+0xda/0x250 mm/mmu_gather.c:424
[<ffffffff80a57aa2>] zap_pte_range mm/memory.c:2104 [inline]
[<ffffffff80a57aa2>] zap_pmd_range mm/memory.c:2151 [inline]
[<ffffffff80a57aa2>] zap_pud_range mm/memory.c:2179 [inline]
[<ffffffff80a57aa2>] zap_p4d_range mm/memory.c:2200 [inline]
[<ffffffff80a57aa2>] __zap_vma_range+0x1298/0x35dc mm/memory.c:2240
[<ffffffff80a61c7a>] unmap_vmas+0x244/0x518 mm/memory.c:2309
[<ffffffff80a94062>] exit_mmap+0x1f8/0xc9e mm/mmap.c:1315
[<ffffffff80149b22>] __mmput+0x106/0x3d0 kernel/fork.c:1193
[<ffffffff80149e60>] mmput+0x74/0x88 kernel/fork.c:1216
[<ffffffff8016c7ae>] exit_mm kernel/exit.c:592 [inline]
[<ffffffff8016c7ae>] do_exit+0x80a/0x297a kernel/exit.c:974
[<ffffffff8016ee4a>] do_group_exit+0xca/0x258 kernel/exit.c:1129
[<ffffffff801a7a26>] get_signal+0x1f56/0x2222 kernel/signal.c:3112
[<ffffffff800760c4>] arch_do_signal_or_restart+0x552/0x1cec arch/riscv/kernel/signal.c:534
[<ffffffff803dff4a>] __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
[<ffffffff803dff4a>] exit_to_user_mode_loop+0x136/0xc3a kernel/entry/common.c:101
[<ffffffff865931e4>] __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
[<ffffffff865931e4>] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
[<ffffffff865931e4>] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
[<ffffffff865931e4>] do_trap_ecall_u+0x52c/0x658 arch/riscv/kernel/traps.c:344
[<ffffffff865bfadc>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 6b00 0013 0000 4905 1936 bb45 7097 ff89 80e7 69e0 (9002) 7097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	6b00                	flw	fs0,16(a4)
   2:	00000013          	nop
   6:	4905                	li	s2,1
   8:	1936                	slli	s2,s2,0x2d
   a:	bb45                	j	0xfffffffffffffdba
   c:	ff897097          	auipc	ra,0xff897
  10:	69e080e7          	jalr	1694(ra) # 0xff8976aa
* 14:	9002                	ebreak <-- trapping instruction
  16:	9770                	.short	0x7097