------------[ cut here ]------------
kernel BUG at [] mm/page_table_check.c:142!
Kernel BUG [#1]
Modules linked in:
CPU: 0 UID: 0 PID: 4253 Comm: syz.1.85 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: riscv-virtio,qemu (DT)
epc : __page_table_check_zero+0x386/0x534 mm/page_table_check.c:142
 ra : __page_table_check_zero+0x386/0x534 mm/page_table_check.c:142
epc : ffffffff80c83132 ra : ffffffff80c83132 sp : ffff8f8003dd67d0
 gp : ffffffff8a49d240 tp : ffffaf801ad00000 t0 : ffffffff80b40eb2
 t1 : fffff5ef027be809 t2 : ffffffff80977a1e s0 : ffff8f8003dd6840
 s1 : ffffaf8013df4048 a0 : 0000000000000005 a1 : 0000000000000000
 a2 : 0000000000080000 a3 : ffffffff80c83132 a4 : ffff8f8004a3a000
 a5 : 0000000000080000 a6 : 0000000000000003 a7 : ffffaf8013df404b
 s2 : 0000000000000001 s3 : 0000000000000000 s4 : ffffaf8013df4000
 s5 : dfffffff00000000 s6 : 00000000000b6400 s7 : 0000000000000001
 s8 : 0000000000000000 s9 : 0000000000007fff s10: fffffffef14b7794
 s11: ffffffff8a5bbca0 t3 : 0000000000000001 t4 : fffff5ef027be809
 t5 : fffff5ef027be80a t6 : 0000000000000002 ssp : 0000000000000000
status: 0000000200000120 badaddr: ffffffff80c83132 cause: 0000000000000003
[<ffffffff80c83132>] __page_table_check_zero+0x386/0x534 mm/page_table_check.c:142
[<ffffffff80b017f0>] page_table_check_free include/linux/page_table_check.h:46 [inline]
[<ffffffff80b017f0>] __free_pages_prepare mm/page_alloc.c:1407 [inline]
[<ffffffff80b017f0>] free_unref_folios+0xb74/0x1b84 mm/page_alloc.c:3011
[<ffffffff80931bb8>] folio_batch_move_lru+0x644/0x7e8 mm/swap.c:211
[<ffffffff8093338a>] __folio_batch_add_and_move+0x2ce/0xb64 mm/swap.c:231
[<ffffffff8093791e>] folio_add_lru+0x19a/0x320 mm/swap.c:562
[<ffffffff8096854a>] folio_putback_lru mm/vmscan.c:820 [inline]
[<ffffffff8096854a>] reclaim_folio_list+0x23e/0x8f0 mm/vmscan.c:2175
[<ffffffff80977a1e>] reclaim_pages+0x33e/0x4b8 mm/vmscan.c:2208
[<ffffffff80b3d960>] madvise_cold_or_pageout_pte_range+0x1b40/0x236c mm/madvise.c:444
[<ffffffff80a8cbf2>] walk_pmd_range mm/pagewalk.c:148 [inline]
[<ffffffff80a8cbf2>] walk_pud_range mm/pagewalk.c:239 [inline]
[<ffffffff80a8cbf2>] walk_p4d_range mm/pagewalk.c:280 [inline]
[<ffffffff80a8cbf2>] walk_pgd_range+0xd12/0x1ecc mm/pagewalk.c:321
[<ffffffff80a8dee4>] __walk_page_range+0x138/0x7a8 mm/pagewalk.c:429
[<ffffffff80a8f718>] walk_page_range_vma_unsafe+0x1ec/0x82c mm/pagewalk.c:733
[<ffffffff80a8fdb2>] walk_page_range_vma+0x5a/0x84 mm/pagewalk.c:743
[<ffffffff80b37afa>] madvise_pageout_page_range mm/madvise.c:622 [inline]
[<ffffffff80b37afa>] madvise_pageout+0x236/0x780 mm/madvise.c:647
[<ffffffff80b3f4f4>] madvise_vma_behavior+0x72c/0x1eb0 mm/madvise.c:1358
[<ffffffff80b40eb2>] madvise_walk_vmas+0x23a/0x978 mm/madvise.c:1713
[<ffffffff80b417da>] madvise_do_behavior+0x1ea/0x5c0 mm/madvise.c:1908
[<ffffffff80b42aba>] do_madvise+0x23a/0x294 mm/madvise.c:2006
[<ffffffff80b42b9c>] __do_sys_madvise mm/madvise.c:2015 [inline]
[<ffffffff80b42b9c>] __se_sys_madvise mm/madvise.c:2013 [inline]
[<ffffffff80b42b9c>] __riscv_sys_madvise+0x88/0xdc mm/madvise.c:2013
[<ffffffff80078f96>] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112
[<ffffffff864f95a4>] do_trap_ecall_u+0x3e4/0x638 arch/riscv/kernel/traps.c:342
[<ffffffff86525518>] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237
Code: 8dc0 8526 d0ef 88af 8a2a b7a1 d097 ff8a 80e7 8ca0 (9002) d097 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	8dc0                	.insn	2, 0x8dc0
   2:	8526                	mv	a0,s1
   4:	88afd0ef          	jal	0xffffffffffffd08e
   8:	8a2a                	mv	s4,a0
   a:	b7a1                	j	0xffffffffffffff52
   c:	ff8ad097          	auipc	ra,0xff8ad
  10:	8ca080e7          	jalr	-1846(ra) # 0xff8ac8d6
* 14:	9002                	ebreak <-- trapping instruction
  16:	97d0                	.short	0xd097