mm: fix crashes from mbind() merging vmas