==================================================================
BUG: KCSAN: data-race in mas_replace_node / mtree_range_walk

write to 0xffff88811444b500 of 8 bytes by task 10665 on cpu 0:
 mte_set_node_dead lib/maple_tree.c:337 [inline]
 mas_put_in_tree lib/maple_tree.c:1739 [inline]
 mas_replace_node+0x1b8/0x430 lib/maple_tree.c:1753
 mas_wr_node_store lib/maple_tree.c:3878 [inline]
 mas_wr_store_entry+0x1fbf/0x2d10 lib/maple_tree.c:4098
 mas_store_prealloc+0x6bf/0x960 lib/maple_tree.c:5519
 vma_iter_store mm/vma.h:387 [inline]
 vma_complete+0x3a7/0x760 mm/vma.c:277
 __split_vma+0x5d6/0x6a0 mm/vma.c:480
 split_vma mm/vma.c:510 [inline]
 vma_modify+0xd3/0x1e0 mm/vma.c:1520
 vma_modify_flags+0xf1/0x120 mm/vma.c:1546
 mprotect_fixup+0x31a/0x5e0 mm/mprotect.c:666
 do_mprotect_pkey+0x653/0x960 mm/mprotect.c:840
 __do_sys_mprotect mm/mprotect.c:861 [inline]
 __se_sys_mprotect mm/mprotect.c:858 [inline]
 __x64_sys_mprotect+0x48/0x60 mm/mprotect.c:858
 x64_sys_call+0x2770/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:11
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811444b500 of 8 bytes by task 10666 on cpu 1:
 ma_dead_node lib/maple_tree.c:575 [inline]
 mtree_range_walk+0x33d/0x460 lib/maple_tree.c:2803
 mas_state_walk lib/maple_tree.c:3620 [inline]
 mas_walk+0x16e/0x320 lib/maple_tree.c:4946
 lock_vma_under_rcu+0x95/0x260 mm/memory.c:6274
 do_user_addr_fault arch/x86/mm/fault.c:1329 [inline]
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x150/0x650 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0xffff88811443730e -> 0xffff88811444b500

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 10666 Comm: syz.8.2472 Not tainted 6.13.0-rc3-syzkaller-00136-g8faabc041a00 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
==================================================================
loop8: detected capacity change from 0 to 512
EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode
EXT4-fs (loop8): 1 orphan inode deleted
EXT4-fs (loop8): 1 truncate cleaned up
EXT4-fs error (device loop8): empty_inline_dir:1850: inode #12: block 7: comm syz.8.2472: bad entry in directory: directory entry overrun - offset=4, inode=13, rec_len=784, size=60 fake=0
EXT4-fs warning (device loop8): empty_inline_dir:1857: bad inline directory (dir #12) - inode 13, rec_len 784, name_len 5inline size 60