ipc/shm: fix shmat() nil address after round-down when remapping