Any behaviour which results in changes to the vma->vm_flags needs to take mmap_sem for writing. Others, which simply traverse vmas, need to only take it for reading.