================================================================== BUG: KCSAN: data-race in mas_wmb_replace / mtree_range_walk write to 0xffff888121a20400 of 8 bytes by task 29448 on cpu 0: mas_set_parent lib/maple_tree.c:495 [inline] mas_adopt_children lib/maple_tree.c:1549 [inline] mas_topiary_replace lib/maple_tree.c:1842 [inline] mas_wmb_replace+0x908/0x1770 lib/maple_tree.c:2083 mas_wr_store_entry+0x54a7/0x5a90 lib/maple_tree.c:-1 mas_store_prealloc+0x421/0x670 lib/maple_tree.c:4936 vma_iter_store_overwrite mm/vma.h:616 [inline] vma_iter_store_new mm/vma.h:623 [inline] vma_complete+0x3c7/0x850 mm/vma.c:359 __split_vma+0x5da/0x640 mm/vma.c:569 split_vma mm/vma.c:599 [inline] vma_modify+0xbcc/0xc80 mm/vma.c:1699 vma_modify_flags+0x182/0x210 mm/vma.c:1719 mprotect_fixup+0x3a2/0x680 mm/mprotect.c:789 do_mprotect_pkey+0x69e/0x950 mm/mprotect.c:967 __do_sys_mprotect mm/mprotect.c:988 [inline] __se_sys_mprotect mm/mprotect.c:985 [inline] __x64_sys_mprotect+0x48/0x60 mm/mprotect.c:985 x64_sys_call+0x2768/0x3020 arch/x86/include/generated/asm/syscalls_64.h:11 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff888121a20400 of 8 bytes by task 29449 on cpu 1: ma_dead_node lib/maple_tree.c:544 [inline] mtree_range_walk+0x35a/0x480 lib/maple_tree.c:2051 mas_state_walk lib/maple_tree.c:2952 [inline] mas_walk+0x1ac/0x340 lib/maple_tree.c:4366 lock_vma_under_rcu+0xc9/0x210 mm/mmap_lock.c:304 do_user_addr_fault+0x237/0x1060 arch/x86/mm/fault.c:1334 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 value changed: 0xffff88811341a616 -> 0xffff888129ffa116 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 29449 Comm: syz.4.8361 Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 ================================================================== loop4: detected capacity change from 0 to 512