------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 3928 Comm: syz.1.10 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x318/0x4d2 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x318/0x4d2 mm/page_table_check.c:142
epc : ffffffff80ca0692 ra : ffffffff80ca0692 sp : ffff8f800a586af0
 gp : ffffffff8b127580 tp : ffffaf801bd6b580 t0 : ffffffff80b63be0
 t1 : fffff5ef02939813 t2 : ffffffff80c33f62 s0 : ffff8f800a586b60
 s1 : ffffaf80149cc098 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80ca0692 a4 : ffff8f8004d8a000
 a5 : 0000000000080000 a6 : 0000000000000003 a7 : ffffaf80149cc09b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf80149cc050
 s5 : dfffffff00000000 s6 : 0000000000000001 s7 : 00000000000b5c01
 s8 : ffffffff8986e0c0 s9 : 0000000000007fff s10: fffffffef164906c
 s11: ffffffff8b248360 t3 : 00000000000000c8 t4 : fffff5ef02939813
 t5 : fffff5ef02939814 t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80ca0692 cause: 0000000000000003
[<ffffffff80ca0692>] __page_table_check_zero+0x318/0x4d2 mm/page_table_check.c:142
[<ffffffff80b1d166>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80b1d166>] __free_pages_prepare mm/page_alloc.c:1419 [inline]
[<ffffffff80b1d166>] __free_frozen_pages+0x6ac/0x128c mm/page_alloc.c:2962
[<ffffffff80b24bbe>] free_frozen_pages+0xe/0x16 mm/page_alloc.c:2999
[<ffffffff80959986>] __folio_put+0x29c/0x456 mm/folio.c:106
[<ffffffff80b7409c>] folio_put include/linux/mm.h:2160 [inline]
[<ffffffff80b7409c>] free_folio_and_swap_cache+0x100/0x13c mm/swap_state.c:569
[<ffffffff80c30176>] __folio_split+0x1780/0x1e70 mm/huge_memory.c:4319
[<ffffffff80c33f62>] __split_huge_page_to_list_to_order mm/huge_memory.c:4435 [inline]
[<ffffffff80c33f62>] split_huge_page_to_list_to_order include/linux/huge_mm.h:416 [inline]
[<ffffffff80c33f62>] split_folio_to_list+0x4c/0x5e mm/huge_memory.c:4499
[<ffffffff80b5fd90>] madvise_cold_or_pageout_pte_range+0x1228/0x2332 mm/madvise.c:420
[<ffffffff80ab16ce>] walk_pmd_range mm/pagewalk.c:147 [inline]
[<ffffffff80ab16ce>] walk_pud_range mm/pagewalk.c:237 [inline]
[<ffffffff80ab16ce>] walk_p4d_range mm/pagewalk.c:278 [inline]
[<ffffffff80ab16ce>] walk_pgd_range+0x932/0x18e4 mm/pagewalk.c:319
[<ffffffff80ab27b8>] __walk_page_range+0x138/0x7a8 mm/pagewalk.c:427
[<ffffffff80ab3f3c>] walk_page_range_vma_unsafe+0x1ec/0x82c mm/pagewalk.c:737
[<ffffffff80ab45d6>] walk_page_range_vma+0x5a/0x84 mm/pagewalk.c:747
[<ffffffff80b59e70>] madvise_cold_page_range mm/madvise.c:594 [inline]
[<ffffffff80b59e70>] madvise_cold+0x1a4/0x304 mm/madvise.c:614
[<ffffffff80b62242>] madvise_vma_behavior+0x732/0x1e8c mm/madvise.c:1364
[<ffffffff80b63be0>] madvise_walk_vmas+0x244/0xa04 mm/madvise.c:1721
[<ffffffff80b6458a>] madvise_do_behavior+0x1ea/0x5be mm/madvise.c:1916
[<ffffffff80b65868>] do_madvise+0x23a/0x294 mm/madvise.c:2014
[<ffffffff80b6594a>] __do_sys_madvise mm/madvise.c:2023 [inline]
[<ffffffff80b6594a>] __se_sys_madvise mm/madvise.c:2021 [inline]
[<ffffffff80b6594a>] __riscv_sys_madvise+0x88/0xdc mm/madvise.c:2021
[<ffffffff8007dc50>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff8663070a>] do_trap_ecall_u+0x4ca/0x658 arch/riscv/kernel/traps.c:341
[<ffffffff8665d064>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 6b00 0013 0000 4905 1936 bb45 7097 ff89 80e7 69e0 (9002) 7097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	6b00                	flw	fs0,16(a4)
   2:	00000013          	nop
   6:	4905                	li	s2,1
   8:	1936                	slli	s2,s2,0x2d
   a:	bb45                	j	0xfffffffffffffdba
   c:	ff897097          	auipc	ra,0xff897
  10:	69e080e7          	jalr	1694(ra) # 0xff8976aa
* 14:	9002                	ebreak <-- trapping instruction
  16:	9770                	.short	0x7097