------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 5817 Comm: syz.0.666 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
 ra : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
epc : ffffffff80ca1b5e ra : ffffffff80ca1b5e sp : ffff8f80037b6ff0
 gp : ffffffff8a4c0280 tp : ffffaf801d26b500 t0 : ffff8f80037b7598
 t1 : fffff5ef02801409 t2 : ffffffff80ab9300 s0 : ffff8f80037b7070
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80ca1b5e a4 : ffff8f8004f16048
 a5 : 000000000002b048 a6 : 0000000000000003 a7 : ffffaf801400a04b
 s2 : 00000000000b8200 s3 : 0000000000000000 s4 : ffffaf801400a000
 s5 : 0000000000000200 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : ffffffff88c66940 s9 : 0000000000007fff s10: 0000000000000000
 s11: ffffffff8a5dfd20 t3 : 0000000000000001 t4 : fffff5ef02801409
 t5 : fffff5ef0280140a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80ca1b5e cause: 0000000000000003
[<ffffffff80ca1b5e>] page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
[<ffffffff80ca22a6>] __page_table_check_ptes_set+0x23c/0x4a4 mm/page_table_check.c:223
[<ffffffff80c29f9a>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80c29f9a>] set_ptes arch/riscv/include/asm/pgtable.h:645 [inline]
[<ffffffff80c29f9a>] __split_huge_pmd_locked mm/huge_memory.c:3343 [inline]
[<ffffffff80c29f9a>] split_huge_pmd_locked+0x1eb2/0x23f0 mm/huge_memory.c:3361
[<ffffffff80c2a782>] __split_huge_pmd+0x2aa/0x3d4 mm/huge_memory.c:3375
[<ffffffff80c2ce00>] split_huge_pmd_address mm/huge_memory.c:3388 [inline]
[<ffffffff80c2ce00>] split_huge_pmd_if_needed mm/huge_memory.c:3400 [inline]
[<ffffffff80c2ce00>] split_huge_pmd_if_needed mm/huge_memory.c:3391 [inline]
[<ffffffff80c2ce00>] vma_adjust_trans_huge+0x272/0x4b2 mm/huge_memory.c:3412
[<ffffffff80af82e6>] __split_vma+0x978/0xf0e mm/vma.c:557
[<ffffffff80afa8c6>] split_vma mm/vma.c:599 [inline]
[<ffffffff80afa8c6>] vma_modify+0xa40/0x1df0 mm/vma.c:1691
[<ffffffff80b0240a>] vma_modify_flags+0x220/0x328 mm/vma.c:1719
[<ffffffff80a7b546>] mlock_fixup+0x36a/0x8de mm/mlock.c:486
[<ffffffff80a7bcfc>] apply_vma_lock_flags+0x242/0x378 mm/mlock.c:557
[<ffffffff80a7c3f2>] do_mlock+0x23a/0x81c mm/mlock.c:653
[<ffffffff80a84db2>] __do_sys_mlock mm/mlock.c:667 [inline]
[<ffffffff80a84db2>] __se_sys_mlock mm/mlock.c:665 [inline]
[<ffffffff80a84db2>] __riscv_sys_mlock+0x54/0x74 mm/mlock.c:665
[<ffffffff8007af94>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff86594576>] do_trap_ecall_u+0x4ca/0x658 arch/riscv/kernel/traps.c:341
[<ffffffff865c0d08>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 3097 ff89 80e7 d400 82e3 e404 3097 ff89 80e7 23e0 (9002) 3097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff893097          	auipc	ra,0xff893
   4:	d40080e7          	jalr	-704(ra) # 0xff892d40
   8:	e40482e3          	beqz	s1,0xfffffffffffffe4c
   c:	ff893097          	auipc	ra,0xff893
  10:	23e080e7          	jalr	574(ra) # 0xff89324a
* 14:	9002                	ebreak <-- trapping instruction
  16:	9730                	.short	0x3097