diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 9ffc80d0a51b..7ee4f7b9e299 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -197,7 +197,6 @@ static void mfill_put_vma(struct mfill_state *state)
 	if (!state->vma)
 		return;
 
-	up_read(&state->ctx->map_changing_lock);
 	uffd_mfill_unlock(state->vma);
 	state->vma = NULL;
 }
@@ -261,7 +260,9 @@ static int mfill_get_vma(struct mfill_state *state)
 	return 0;
 
 out_unlock:
-	mfill_put_vma(state);
+	up_read(&state->ctx->map_changing_lock);
+	mmap_read_unlock(dst_vma->vm_mm);
+	state->vma = NULL;
 	return err;
 }