Don't leak VDSO mappings.

PiperOrigin-RevId: 336822021

pkg/sentry/kernel/kernel.go

@@ -1744,12 +1744,14 @@ func (k *Kernel) SocketMount() *vfs.Mount {
 // Precondition: This should only be called after the kernel is fully
 // initialized, e.g. after k.Start() has been called.
 func (k *Kernel) Release() {
+	ctx := k.SupervisorContext()
 	if VFS2Enabled {
-		ctx := k.SupervisorContext()
 		k.hostMount.DecRef(ctx)
 		k.pipeMount.DecRef(ctx)
 		k.shmMount.DecRef(ctx)
 		k.socketMount.DecRef(ctx)
 		k.vfs.Release(ctx)
 	}
+	k.timekeeper.Destroy()
+	k.vdso.Release(ctx)
 }

pkg/sentry/loader/vdso.go

@@ -380,3 +380,9 @@ func loadVDSO(ctx context.Context, m *mm.MemoryManager, v *VDSO, bin loadedELF)
 
 	return vdsoAddr, nil
 }
+
+// Release drops references on mappings held by v.
+func (v *VDSO) Release(ctx context.Context) {
+	v.ParamPage.DecRef(ctx)
+	v.vdso.DecRef(ctx)
+}