------------[ cut here ]------------
kernel BUG at [] mm/filemap.c:858!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 4181 Comm: syz.1.102 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: riscv-virtio,qemu (DT)
epc : __filemap_add_folio+0xf68/0x1348 mm/filemap.c:858
 ra : __filemap_add_folio+0xf68/0x1348 mm/filemap.c:858
epc : ffffffff808ed8bc ra : ffffffff808ed8bc sp : ffff8f800aa970e0
 gp : ffffffff8a49d240 tp : ffffaf801d2bd040 t0 : 0000000000000000
 t1 : ffffffff8007bd0c t2 : ffffffff91874220 s0 : ffff8f800aa972a0
 s1 : 0000000000112cc0 a0 : ffffaf801d2bd504 a1 : ffffffff8820ee18
 a2 : 0000000000080000 a3 : ffffffff80a0f29c a4 : ffff8f80054326a8
 a5 : 00000000002766a8 a6 : 0000000000000003 a7 : 0000000041b58ab3
 s2 : 0000000000000000 s3 : 1ffff1f001552e30 s4 : 0000000000000004
 s5 : ffff8d8000838940 s6 : 0000000000000000 s7 : 0000000000000000
 s8 : ffffaf801650e4c8 s9 : ffff8f800aa972e0 s10: 0000000000000000
 s11: ffff8f800aa97220 t3 : ffffffff88095048 t4 : fffffffef1140d43
 t5 : fffffffef1140d44 t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff808ed8bc cause: 0000000000000003
[<ffffffff808ed8bc>] __filemap_add_folio+0xf68/0x1348 mm/filemap.c:858
[<ffffffff808ede52>] filemap_add_folio+0x1b6/0xb34 mm/filemap.c:966
[<ffffffff80925af6>] ra_alloc_folio mm/readahead.c:470 [inline]
[<ffffffff80925af6>] page_cache_ra_order+0x5fe/0x13dc mm/readahead.c:535
[<ffffffff808f5d6e>] do_sync_mmap_readahead mm/filemap.c:3428 [inline]
[<ffffffff808f5d6e>] filemap_fault+0x17f6/0x2e40 mm/filemap.c:3582
[<ffffffff80a30732>] __do_fault+0xee/0x6fc mm/memory.c:5425
[<ffffffff80a45260>] do_read_fault mm/memory.c:5860 [inline]
[<ffffffff80a45260>] do_fault+0xbf4/0x14d8 mm/memory.c:5994
[<ffffffff80a5944e>] do_pte_missing mm/memory.c:4566 [inline]
[<ffffffff80a5944e>] handle_pte_fault mm/memory.c:6379 [inline]
[<ffffffff80a5944e>] __handle_mm_fault+0x1016/0x1498 mm/memory.c:6517
[<ffffffff80a59b2c>] handle_mm_fault+0x25c/0x8c0 mm/memory.c:6686
[<ffffffff80a175fa>] faultin_page mm/gup.c:1126 [inline]
[<ffffffff80a175fa>] __get_user_pages+0xcb6/0x20b4 mm/gup.c:1428
[<ffffffff80a1ef84>] populate_vma_page_range+0x244/0x3d0 mm/gup.c:1860
[<ffffffff80a1fb5e>] __mm_populate+0x10e/0x3b0 mm/gup.c:1963
[<ffffffff809b32b4>] mm_populate include/linux/mm.h:4171 [inline]
[<ffffffff809b32b4>] vm_mmap_pgoff+0x34c/0x418 mm/util.c:586
[<ffffffff80a6b334>] ksys_mmap_pgoff+0x2c4/0x708 mm/mmap.c:606
[<ffffffff80074898>] riscv_sys_mmap arch/riscv/kernel/sys_riscv.c:29 [inline]
[<ffffffff80074898>] __do_sys_mmap arch/riscv/kernel/sys_riscv.c:38 [inline]
[<ffffffff80074898>] __se_sys_mmap arch/riscv/kernel/sys_riscv.c:34 [inline]
[<ffffffff80074898>] __riscv_sys_mmap+0x11c/0x18c arch/riscv/kernel/sys_riscv.c:34
[<ffffffff80078f96>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff864f95a4>] do_trap_ecall_u+0x3e4/0x638 arch/riscv/kernel/traps.c:342
[<ffffffff86525518>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 1520 8556 9597 0624 8593 f545 2097 0012 80e7 9740 (9002) 2097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	1520                	addi	s0,sp,680
   2:	8556                	mv	a0,s5
   4:	06249597          	auipc	a1,0x6249
   8:	f5458593          	addi	a1,a1,-172 # 0x6248f58
   c:	00122097          	auipc	ra,0x122
  10:	974080e7          	jalr	-1676(ra) # 0x121980
* 14:	9002                	ebreak <-- trapping instruction
  16:	9720                	.short	0x2097