==================================================================
BUG: KCSAN: data-race in mas_state_walk / mas_wr_store_entry

write to 0xffff88813ec6d100 of 8 bytes by task 26775 on cpu 0:
 mte_set_node_dead lib/maple_tree.c:334 [inline]
 mas_put_in_tree lib/maple_tree.c:1565 [inline]
 mas_replace_node lib/maple_tree.c:1580 [inline]
 mas_wr_node_store lib/maple_tree.c:3553 [inline]
 mas_wr_store_entry+0x20c5/0x2e70 lib/maple_tree.c:3764
 mas_store_prealloc+0x72e/0xa60 lib/maple_tree.c:5169
 vma_iter_store_overwrite mm/vma.h:544 [inline]
 vma_iter_store_new mm/vma.h:551 [inline]
 vma_complete+0x3f7/0x820 mm/vma.c:353
 __split_vma+0x5e3/0x660 mm/vma.c:566
 vms_gather_munmap_vmas+0x2b2/0x7b0 mm/vma.c:1423
 __mmap_setup mm/vma.c:2405 [inline]
 __mmap_region mm/vma.c:2734 [inline]
 mmap_region+0x723/0x1d20 mm/vma.c:2830
 do_mmap+0x9b2/0xbd0 mm/mmap.c:558
 vm_mmap_pgoff+0x183/0x2d0 mm/util.c:581
 ksys_mmap_pgoff+0xc1/0x310 mm/mmap.c:604
 x64_sys_call+0x16bb/0x3000 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88813ec6d100 of 8 bytes by task 26774 on cpu 1:
 ma_dead_node lib/maple_tree.c:572 [inline]
 mtree_range_walk lib/maple_tree.c:2580 [inline]
 mas_state_walk+0x485/0x650 lib/maple_tree.c:3298
 mas_walk+0x60/0x150 lib/maple_tree.c:4599
 lock_vma_under_rcu+0xc9/0x210 mm/mmap_lock.c:253
 do_user_addr_fault+0x232/0x1050 arch/x86/mm/fault.c:1325
 handle_page_fault arch/x86/mm/fault.c:1474 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1527
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

value changed: 0xffff888104d03306 -> 0xffff88813ec6d100

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 26774 Comm: syz.9.6823 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
==================================================================
bond0: (slave syz_tun): Releasing backup interface