------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 1 UID: 0 PID: 4858 Comm: syz.1.250 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
epc : ffffffff80c8241c ra : ffffffff80c8241c sp : ffff8f8003a36ab0
 gp : ffffffff8a49fe80 tp : ffffaf801bf09ac0 t0 : ffff8f8003a36a60
 t1 : fffff5ef027b0c09 t2 : ffff8f8003a36da0 s0 : ffff8f8003a36b20
 s1 : ffffaf8013d86048 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000000002 a3 : ffffffff80c8241c a4 : 0000000000000000
 a5 : ffffaf801bf0aac0 a6 : 0000000000000003 a7 : ffffaf8013d8604b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf8013d86000
 s5 : dfffffff00000000 s6 : 0000000000000200 s7 : 00000000000b4e00
 s8 : ffffffff88c5a680 s9 : 0000000000007fff s10: fffffffef14b7d9c
 s11: ffffffff8a5bece0 t3 : 0000000000000001 t4 : fffff5ef027b0c09
 t5 : fffff5ef027b0c0a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c8241c cause: 0000000000000003
[<ffffffff80c8241c>] __page_table_check_zero+0x370/0x532 mm/page_table_check.c:142
[<ffffffff80b00194>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80b00194>] __free_pages_prepare mm/page_alloc.c:1407 [inline]
[<ffffffff80b00194>] free_unref_folios+0xb72/0x1b80 mm/page_alloc.c:3011
[<ffffffff8092e6d8>] folios_put_refs+0x46c/0x7c6 mm/swap.c:1057
[<ffffffff80b50672>] free_pages_and_swap_cache+0x278/0x3be mm/swap_state.c:589
[<ffffffff80a722d4>] __tlb_batch_free_encoded_pages+0xe2/0x25a mm/mmu_gather.c:138
[<ffffffff80a73d04>] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
[<ffffffff80a73d04>] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline]
[<ffffffff80a73d04>] tlb_flush_mmu+0xdc/0x5f8 mm/mmu_gather.c:424
[<ffffffff80a3591c>] zap_pte_range mm/memory.c:1973 [inline]
[<ffffffff80a3591c>] zap_pmd_range mm/memory.c:2020 [inline]
[<ffffffff80a3591c>] zap_pud_range mm/memory.c:2048 [inline]
[<ffffffff80a3591c>] zap_p4d_range mm/memory.c:2069 [inline]
[<ffffffff80a3591c>] __zap_vma_range+0x147c/0x44ca mm/memory.c:2109
[<ffffffff80a39f56>] unmap_vmas+0x244/0x518 mm/memory.c:2178
[<ffffffff80a6e662>] exit_mmap+0x1f8/0xc9e mm/mmap.c:1300
[<ffffffff80143776>] __mmput+0x106/0x3d0 kernel/fork.c:1187
[<ffffffff80143ab4>] mmput+0x74/0x88 kernel/fork.c:1210
[<ffffffff80165d72>] exit_mm kernel/exit.c:615 [inline]
[<ffffffff80165d72>] do_exit+0x80a/0x297a kernel/exit.c:997
[<ffffffff8016840e>] do_group_exit+0xca/0x258 kernel/exit.c:1152
[<ffffffff801a21ae>] get_signal+0x1f58/0x2224 kernel/signal.c:3046
[<ffffffff80072e56>] arch_do_signal_or_restart+0x648/0x1e06 arch/riscv/kernel/signal.c:534
[<ffffffff803d87ca>] __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
[<ffffffff803d87ca>] exit_to_user_mode_loop+0x9e/0xcd4 kernel/entry/common.c:101
[<ffffffff864f9a50>] __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
[<ffffffff864f9a50>] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
[<ffffffff864f9a50>] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
[<ffffffff864f9a50>] do_trap_ecall_u+0x4fc/0x636 arch/riscv/kernel/traps.c:345
[<ffffffff86525b34>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 7720 854a d0ef 872f 8a2a bf9d b097 ff8a 80e7 7600 (9002) b097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	7720                	flw	fs0,104(a4)
   2:	854a                	mv	a0,s2
   4:	872fd0ef          	jal	0xffffffffffffd076
   8:	8a2a                	mv	s4,a0
   a:	bf9d                	j	0xffffffffffffff80
   c:	ff8ab097          	auipc	ra,0xff8ab
  10:	760080e7          	jalr	1888(ra) # 0xff8ab76c
* 14:	9002                	ebreak <-- trapping instruction
  16:	97b0                	.short	0xb097