In the function vvp_mmap_locks, we down this semaphore:
down_read(&mm->mmap_sem);

Before entering a while loop. After the loop is complete, the semaphore is upped. However, there is an exit case in the loop:
if (result < 0)
RETURN(result);

Which does not up the semaphore.

Recently, Cray IO stress testing has been seeing a number of threads stuck waiting on this semaphore, with out any other threads obviously involved.

It's not clear why this has been showing up lately, as Jay added the code in 2012:
5eb306e7 (Jinshan Xiong 2012-04-13 15:21:49 0700 267) down_read(&mm>mmap_sem);

I'll make a patch available shortly.