x86/mpx, mm/core: Fix recursive munmap() corruption