------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:118!
Kernel BUG [#1]
Modules linked in:
CPU: 1 UID: 0 PID: 4581 Comm: syz.1.202 Tainted: G        W    L      syzkaller #0 PREEMPT 
Tainted: [W]=WARN, [L]=SOFTLOCKUP
Hardware name: riscv-virtio,qemu (DT)
epc : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
 ra : page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
epc : ffffffff80c81304 ra : ffffffff80c81304 sp : ffff8f8009897120
 gp : ffffffff8a49fe80 tp : ffffaf8014320000 t0 : ffff8f80098976d8
 t1 : fffff5ef027abc09 t2 : ffffffff80a99754 s0 : ffff8f80098971a0
 s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c81304 a4 : ffff8f8004ebd4e0
 a5 : 00000000000614e0 a6 : 0000000000000003 a7 : ffffaf8013d5e04b
 s2 : 00000000000b4600 s3 : 0000000000000000 s4 : ffffaf8013d5e000
 s5 : 0000000000000200 s6 : 0000000000000001 s7 : dfffffff00000000
 s8 : ffffffff88c5a680 s9 : 0000000000007fff s10: 0000000000000000
 s11: ffffffff8a5bece0 t3 : 0000000000000001 t4 : fffff5ef027abc09
 t5 : fffff5ef027abc0a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c81304 cause: 0000000000000003
[<ffffffff80c81304>] page_table_check_set+0x9ca/0xc72 mm/page_table_check.c:118
[<ffffffff80c81a74>] __page_table_check_ptes_set+0x264/0x47c mm/page_table_check.c:212
[<ffffffff80c0a116>] page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
[<ffffffff80c0a116>] set_ptes arch/riscv/include/asm/pgtable.h:645 [inline]
[<ffffffff80c0a116>] __split_huge_pmd_locked mm/huge_memory.c:3300 [inline]
[<ffffffff80c0a116>] split_huge_pmd_locked+0x1eb2/0x23f0 mm/huge_memory.c:3318
[<ffffffff80c0a8fe>] __split_huge_pmd+0x2aa/0x3d4 mm/huge_memory.c:3332
[<ffffffff80c0cf7c>] split_huge_pmd_address mm/huge_memory.c:3345 [inline]
[<ffffffff80c0cf7c>] split_huge_pmd_if_needed mm/huge_memory.c:3357 [inline]
[<ffffffff80c0cf7c>] split_huge_pmd_if_needed mm/huge_memory.c:3348 [inline]
[<ffffffff80c0cf7c>] vma_adjust_trans_huge+0x272/0x4b2 mm/huge_memory.c:3369
[<ffffffff80ad8436>] __split_vma+0x978/0xf0e mm/vma.c:557
[<ffffffff80adb05a>] split_vma mm/vma.c:599 [inline]
[<ffffffff80adb05a>] vma_modify+0x1084/0x1df0 mm/vma.c:1699
[<ffffffff80ae2adc>] vma_modify_policy+0x202/0x27e mm/vma.c:1754
[<ffffffff80bb066c>] mbind_range+0x15a/0x4a4 mm/mempolicy.c:1058
[<ffffffff80bb18c4>] do_mbind+0x754/0xe12 mm/mempolicy.c:1560
[<ffffffff80bb228e>] kernel_mbind mm/mempolicy.c:1757 [inline]
[<ffffffff80bb228e>] __do_sys_mbind mm/mempolicy.c:1831 [inline]
[<ffffffff80bb228e>] __se_sys_mbind mm/mempolicy.c:1827 [inline]
[<ffffffff80bb228e>] __riscv_sys_mbind+0x30c/0x39e mm/mempolicy.c:1827
[<ffffffff80078f0c>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff864f9938>] do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:342
[<ffffffff86525b34>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: c097 ff8a 80e7 37a0 82e3 e404 d097 ff8a 80e7 8780 (9002) d097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	ff8ac097          	auipc	ra,0xff8ac
   4:	37a080e7          	jalr	890(ra) # 0xff8ac37a
   8:	e40482e3          	beqz	s1,0xfffffffffffffe4c
   c:	ff8ad097          	auipc	ra,0xff8ad
  10:	878080e7          	jalr	-1928(ra) # 0xff8ac884
* 14:	9002                	ebreak <-- trapping instruction
  16:	97d0                	.short	0xd097