mm: validate vseg before using it

Reported-by: syzbot+da9595a72d0762aaa48d@syzkaller.appspotmail.com
PiperOrigin-RevId: 698826152

pkg/sentry/mm/syscalls.go

@@ -1270,6 +1270,7 @@ func (mm *MemoryManager) madviseMutateVMAs(addr hostarch.Addr, length uint64, f
 			return err
 		}
 		if ar.End <= vseg.End() {
+			mm.vmas.MergeNext(vseg)
 			break
 		}
 		vgap := vseg.NextGap()
@@ -1277,8 +1278,11 @@ func (mm *MemoryManager) madviseMutateVMAs(addr hostarch.Addr, length uint64, f
 			hadvgap = true
 		}
 		vseg = vgap.NextSegment()
+		if !vseg.Ok() {
+			// No VMA reaching to the end of ar.
+			return linuxerr.ENOMEM
+		}
 	}
-	mm.vmas.MergePrev(vseg)
 	if hadvgap {
 		return linuxerr.ENOMEM
 	}