------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 3897 Comm: syz.1.19 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
 ra : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
epc : ffffffff80c80cb8 ra : ffffffff80c80cb8 sp : ffff8f800a1c6b90
 gp : ffffffff8a49f880 tp : ffffaf8031a91ac0 t0 : ffff8f800a1c7138
 t1 : fffff5ef027a0809 t2 : ffffffff918762a0 s0 : ffff8f800a1c6c10
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c80cb8 a4 : ffff8f80043b7c08
 a5 : 000000000002ec08 a6 : 0000000000000003 a7 : ffffaf8013d0404b
 s2 : 00000000000b3400 s3 : 0000000000000000 s4 : ffffaf8013d04000
 s5 : 0000000000000200 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : ffffffff88c5a580 s9 : 0000000000007fff s10: 0000000000000000
 s11: ffffffff8a5bdce0 t3 : 0000000000000001 t4 : fffff5ef027a0809
 t5 : fffff5ef027a080a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c80cb8 cause: 0000000000000003
[<ffffffff80c80cb8>] page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
[<ffffffff80c81428>] __page_table_check_ptes_set+0x264/0x47c mm/page_table_check.c:212
[<ffffffff80c09aca>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80c09aca>] set_ptes arch/riscv/include/asm/pgtable.h:645 [inline]
[<ffffffff80c09aca>] __split_huge_pmd_locked mm/huge_memory.c:3300 [inline]
[<ffffffff80c09aca>] split_huge_pmd_locked+0x1eb2/0x23f0 mm/huge_memory.c:3318
[<ffffffff80c0a2b2>] __split_huge_pmd+0x2aa/0x3d4 mm/huge_memory.c:3332
[<ffffffff80c0c930>] split_huge_pmd_address mm/huge_memory.c:3345 [inline]
[<ffffffff80c0c930>] split_huge_pmd_if_needed mm/huge_memory.c:3357 [inline]
[<ffffffff80c0c930>] split_huge_pmd_if_needed mm/huge_memory.c:3348 [inline]
[<ffffffff80c0c930>] vma_adjust_trans_huge+0x272/0x4b2 mm/huge_memory.c:3369
[<ffffffff80ad7dea>] __split_vma+0x978/0xf0e mm/vma.c:557
[<ffffffff80ad855c>] vms_gather_munmap_vmas+0x1dc/0x160a mm/vma.c:1427
[<ffffffff80ade326>] __mmap_setup mm/vma.c:2439 [inline]
[<ffffffff80ade326>] __mmap_region+0x3d4/0x283c mm/vma.c:2756
[<ffffffff80ae4c92>] mmap_region+0x30c/0x4ec mm/vma.c:2860
[<ffffffff80a6bec4>] do_mmap+0xaea/0x108e mm/mmap.c:560
[<ffffffff809b0334>] vm_mmap_pgoff+0x27c/0x416 mm/util.c:581
[<ffffffff80a68904>] ksys_mmap_pgoff+0x74/0x706 mm/mmap.c:606
[<ffffffff80074818>] riscv_sys_mmap arch/riscv/kernel/sys_riscv.c:29 [inline]
[<ffffffff80074818>] __do_sys_mmap arch/riscv/kernel/sys_riscv.c:38 [inline]
[<ffffffff80074818>] __se_sys_mmap arch/riscv/kernel/sys_riscv.c:34 [inline]
[<ffffffff80074818>] __riscv_sys_mmap+0x11c/0x18c arch/riscv/kernel/sys_riscv.c:34
[<ffffffff80078f0c>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff864f5770>] do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:342
[<ffffffff8652196c>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: d097 ff8a 80e7 9d20 82e3 e404 d097 ff8a 80e7 ed00 (9002) d097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff8ad097          	auipc	ra,0xff8ad
   4:	9d2080e7          	jalr	-1582(ra) # 0xff8ac9d2
   8:	e40482e3          	beqz	s1,0xfffffffffffffe4c
   c:	ff8ad097          	auipc	ra,0xff8ad
  10:	ed0080e7          	jalr	-304(ra) # 0xff8acedc
* 14:	9002                	ebreak <-- trapping instruction
  16:	97d0                	.short	0xd097