------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 4858 Comm: syz.0.377 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
 ra : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
epc : ffffffff80c81874 ra : ffffffff80c81874 sp : ffff8f800a006fe0
 gp : ffffffff8a4a7c60 tp : ffffaf801abe5040 t0 : ffff8f800a007598
 t1 : fffff5ef0288dc09 t2 : ffffffff80a99cc0 s0 : ffff8f800a007060
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c81874 a4 : ffff8f8005f47f30
 a5 : 0000000000028f30 a6 : 0000000000000003 a7 : ffffaf801446e04b
 s2 : 00000000000c1600 s3 : 0000000000000000 s4 : ffffaf801446e000
 s5 : 0000000000000200 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : ffffffff88c5a580 s9 : 0000000000007fff s10: 0000000000000000
 s11: ffffffff8a5c6ce0 t3 : 0000000000000001 t4 : fffff5ef0288dc09
 t5 : fffff5ef0288dc0a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c81874 cause: 0000000000000003
[<ffffffff80c81874>] page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
[<ffffffff80c81fe4>] __page_table_check_ptes_set+0x264/0x47c mm/page_table_check.c:212
[<ffffffff80c0a63e>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80c0a63e>] set_ptes arch/riscv/include/asm/pgtable.h:645 [inline]
[<ffffffff80c0a63e>] __split_huge_pmd_locked mm/huge_memory.c:3300 [inline]
[<ffffffff80c0a63e>] split_huge_pmd_locked+0x1eb2/0x23f0 mm/huge_memory.c:3318
[<ffffffff80c0ae26>] __split_huge_pmd+0x2aa/0x3d4 mm/huge_memory.c:3332
[<ffffffff80c0d4a4>] split_huge_pmd_address mm/huge_memory.c:3345 [inline]
[<ffffffff80c0d4a4>] split_huge_pmd_if_needed mm/huge_memory.c:3357 [inline]
[<ffffffff80c0d4a4>] split_huge_pmd_if_needed mm/huge_memory.c:3348 [inline]
[<ffffffff80c0d4a4>] vma_adjust_trans_huge+0x272/0x4b2 mm/huge_memory.c:3369
[<ffffffff80ad89a2>] __split_vma+0x978/0xf0e mm/vma.c:557
[<ffffffff80adaf82>] split_vma mm/vma.c:599 [inline]
[<ffffffff80adaf82>] vma_modify+0xa40/0x1df0 mm/vma.c:1691
[<ffffffff80ae2ac6>] vma_modify_flags+0x220/0x328 mm/vma.c:1719
[<ffffffff80a5be5a>] mlock_fixup+0x36a/0x8de mm/mlock.c:486
[<ffffffff80a5c610>] apply_vma_lock_flags+0x242/0x378 mm/mlock.c:557
[<ffffffff80a5cd06>] do_mlock+0x23a/0x81c mm/mlock.c:653
[<ffffffff80a656c6>] __do_sys_mlock mm/mlock.c:667 [inline]
[<ffffffff80a656c6>] __se_sys_mlock mm/mlock.c:665 [inline]
[<ffffffff80a656c6>] __riscv_sys_mlock+0x54/0x74 mm/mlock.c:665
[<ffffffff80078f30>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8651fb84>] do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:345
[<ffffffff8654beb0>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: c097 ff8a 80e7 f460 82e3 e404 c097 ff8a 80e7 4440 (9002) c097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff8ac097          	auipc	ra,0xff8ac
   4:	f46080e7          	jalr	-186(ra) # 0xff8abf46
   8:	e40482e3          	beqz	s1,0xfffffffffffffe4c
   c:	ff8ac097          	auipc	ra,0xff8ac
  10:	444080e7          	jalr	1092(ra) # 0xff8ac450
* 14:	9002                	ebreak <-- trapping instruction
  16:	97c0                	.short	0xc097