On Wed, 21 Mar 2018, Laurent Dufour wrote:

I found the root cause of this lockdep warning.

In mmap_region(), unmap_region() may be called while vma_link() has not been
called. This happens during the error path if call_mmap() failed.

The only to fix that particular case is to call
seqcount_init(&vma->vm_sequence) when initializing the vma in mmap_region().

Ack, although that would require a fixup to dup_mmap() as well.