mm/vmalloc.c: fix an overflow bug in alloc_vmap_area()