------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 1 UID: 0 PID: 4617 Comm: syz.0.103 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
epc : ffffffff80cbe304 ra : ffffffff80cbe304 sp : ffff8f8009e06ff0
 gp : ffffffff8a6d9c00 tp : ffffaf801b173580 t0 : ffffffff80d24352
 t1 : fffff5ef027a3013 t2 : ffffffff80c4a2aa s0 : ffff8f8009e07060
 s1 : ffffaf8013d18098 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80cbe304 a4 : ffff8f8004779000
 a5 : 0000000000080000 a6 : 0000000000000003 a7 : ffffaf8013d1809b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf8013d18050
 s5 : dfffffff00000000 s6 : 0000000000000001 s7 : 00000000000b3801
 s8 : ffffffff88e6d260 s9 : 0000000000007fff s10: fffffffef14ff3ac
 s11: ffffffff8a7f9d60 t3 : 00000000000000c8 t4 : fffff5ef027a3013
 t5 : fffff5ef027a3014 t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80cbe304 cause: 0000000000000003
[<ffffffff80cbe304>] __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
[<ffffffff80b2dfe6>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80b2dfe6>] __free_pages_prepare mm/page_alloc.c:1419 [inline]
[<ffffffff80b2dfe6>] __free_frozen_pages+0x6e4/0x13a2 mm/page_alloc.c:2962
[<ffffffff80b368bc>] free_frozen_pages+0xe/0x16 mm/page_alloc.c:2999
[<ffffffff80958c82>] __folio_put+0x29c/0x456 mm/folio.c:105
[<ffffffff80b889d0>] folio_put include/linux/mm.h:2160 [inline]
[<ffffffff80b889d0>] free_folio_and_swap_cache+0x100/0x13c mm/swap_state.c:569
[<ffffffff80c49754>] __folio_split+0x1780/0x1e70 mm/huge_memory.c:4277
[<ffffffff80c4a2aa>] __split_huge_page_to_list_to_order mm/huge_memory.c:4393 [inline]
[<ffffffff80c4a2aa>] split_huge_page_to_list_to_order include/linux/huge_mm.h:416 [inline]
[<ffffffff80c4a2aa>] split_folio_to_list mm/huge_memory.c:4457 [inline]
[<ffffffff80c4a2aa>] deferred_split_scan+0x466/0xc04 mm/huge_memory.c:4645
[<ffffffff809b6d36>] do_shrink_slab+0x3f0/0x17da mm/shrinker.c:443
[<ffffffff809b9638>] shrink_slab_memcg mm/shrinker.c:560 [inline]
[<ffffffff809b9638>] shrink_slab+0xa56/0x167e mm/shrinker.c:638
[<ffffffff80999f4e>] drop_slab_node mm/vmscan.c:416 [inline]
[<ffffffff80999f4e>] drop_slab+0x104/0x3c4 mm/vmscan.c:434
[<ffffffff80f4c54e>] drop_caches_sysctl_handler fs/drop_caches.c:68 [inline]
[<ffffffff80f4c54e>] drop_caches_sysctl_handler+0x1f4/0x396 fs/drop_caches.c:51
[<ffffffff80fdddde>] proc_sys_call_handler+0x3d0/0x59c fs/proc/proc_sysctl.c:600
[<ffffffff80fddfcc>] proc_sys_write+0x22/0x2e fs/proc/proc_sysctl.c:626
[<ffffffff80d20944>] do_iter_readv_writev+0x668/0x812 fs/read_write.c:828
[<ffffffff80d24352>] vfs_writev+0x308/0xbc8 fs/read_write.c:1058
[<ffffffff80d24d44>] do_writev+0x132/0x334 fs/read_write.c:1104
[<ffffffff80d2ae7e>] __do_sys_writev fs/read_write.c:1172 [inline]
[<ffffffff80d2ae7e>] __se_sys_writev fs/read_write.c:1169 [inline]
[<ffffffff80d2ae7e>] __riscv_sys_writev+0x6e/0xa0 fs/read_write.c:1169
[<ffffffff8007bd88>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8660e902>] do_trap_ecall_u+0x4ca/0x658 arch/riscv/kernel/traps.c:341
[<ffffffff8663b218>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: e0a0 854a c0ef ff6f 8a2a bf9d 2097 ff88 80e7 df80 (9002) 2097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e0a0                	fsw	fs0,64(s1)
   2:	854a                	mv	a0,s2
   4:	ff6fc0ef          	jal	0xffffffffffffc7fa
   8:	8a2a                	mv	s4,a0
   a:	bf9d                	j	0xffffffffffffff80
   c:	ff882097          	auipc	ra,0xff882
  10:	df8080e7          	jalr	-520(ra) # 0xff881e04
* 14:	9002                	ebreak <-- trapping instruction
  16:	9720                	.short	0x2097