But Jason pointed me to the right piece of code. See this comment in in mmap_region():
/* ->mmap() can change vma->vm_file, but must guarantee that * vma_link() below can deny write-access if VM_DENYWRITE is set * and map writably if VM_SHARED is set. This usually means the * new file must not have been exposed to user-space, yet. */ vma->vm_file = get_file(file); error = call_mmap(file, vma);
So changing vma->vm_file is allowed at least under certain circumstances.
Only the "file must not have been exposed to user-space, yet" part still needs double checking. Currently working on that.