Re: [syzbot] [mm?] possible deadlock in mfill_get_vma

Edward Adam Davis
2026-03-16T02:22:22Z

#syz test

diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 9ffc80d0a51b..a3333d5c6454 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -218,6 +218,7 @@ static int mfill_get_vma(struct mfill_state *state)
if (IS_ERR(dst_vma))
return PTR_ERR(dst_vma);

+ state->vma = dst_vma;
/*
* If memory mappings are changing because of non-cooperative
* operation (e.g. mremap) running in parallel, bail out and
@@ -257,7 +258,6 @@ static int mfill_get_vma(struct mfill_state *state)
goto out_unlock;

out:
- state->vma = dst_vma;
return 0;