==================================================================
BUG: KCSAN: data-race in mas_replace_node / mas_state_walk

write to 0xffff88813a2acd00 of 8 bytes by task 20575 on cpu 1:
 mte_set_node_dead lib/maple_tree.c:320 [inline]
 mas_put_in_tree lib/maple_tree.c:1746 [inline]
 mas_replace_node+0x1b5/0x430 lib/maple_tree.c:1760
 mas_wr_node_store lib/maple_tree.c:3995 [inline]
 mas_wr_modify+0x287c/0x37d0 lib/maple_tree.c:4229
 mas_wr_store_entry+0x235/0x350 lib/maple_tree.c:4269
 mas_store_prealloc+0x155/0x2b0 lib/maple_tree.c:5460
 vma_iter_store mm/internal.h:1198 [inline]
 vma_complete+0x2a0/0x650 mm/mmap.c:532
 __split_vma+0x550/0x5d0 mm/mmap.c:2411
 split_vma mm/mmap.c:2437 [inline]
 vma_modify+0x152/0x240 mm/mmap.c:2472
 vma_modify_flags include/linux/mm.h:3271 [inline]
 mprotect_fixup+0x324/0x5c0 mm/mprotect.c:635
 do_mprotect_pkey+0x641/0x920 mm/mprotect.c:809
 __do_sys_mprotect mm/mprotect.c:830 [inline]
 __se_sys_mprotect mm/mprotect.c:827 [inline]
 __x64_sys_mprotect+0x48/0x50 mm/mprotect.c:827
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

read to 0xffff88813a2acd00 of 8 bytes by task 20582 on cpu 0:
 ma_dead_node lib/maple_tree.c:555 [inline]
 mtree_range_walk lib/maple_tree.c:2828 [inline]
 mas_state_walk+0x43d/0x5d0 lib/maple_tree.c:3712
 mas_walk+0x31/0x120 lib/maple_tree.c:4888
 lock_vma_under_rcu+0x8d/0x2a0 mm/memory.c:5497
 do_user_addr_fault arch/x86/mm/fault.c:1356 [inline]
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x164/0x6c0 arch/x86/mm/fault.c:1561
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570

value changed: 0xffff88813a2ac406 -> 0xffff88813a2acd00

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 20582 Comm: syz-executor.3 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
==================================================================
loop3: detected capacity change from 0 to 128