binder: validate alloc->mm in ->mmap() handler