Re: [syzbot] [mm?] possible deadlock in mfill_get_vma

Edward Adam Davis
2026-03-16T01:49:32Z

#syz test

diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 9ffc80d0a51b..7ee4f7b9e299 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -197,7 +197,6 @@ static void mfill_put_vma(struct mfill_state *state)
if (!state->vma)
return;

- up_read(&state->ctx->map_changing_lock);
uffd_mfill_unlock(state->vma);
state->vma = NULL;
}
@@ -261,7 +260,9 @@ static int mfill_get_vma(struct mfill_state *state)
return 0;

out_unlock:
- mfill_put_vma(state);
+ up_read(&state->ctx->map_changing_lock);
+ mmap_read_unlock(dst_vma->vm_mm);
+ state->vma = NULL;
return err;
}