daxfs_mem_ptr() bounds only the start offset, not the span the caller reads

[congwang-mk]

daxfs_mem_ptr() (daxfs/dax_mem.c:110) takes no length:

void *daxfs_mem_ptr(struct daxfs_info *info, u64 offset)
{
        if (offset >= info->size)
                return NULL;
        return info->mem + offset;
}

Callers then read a structure or an array through the returned pointer, so only the first byte is known to be inside the mapping.

Two instances have been fixed at the call site: the base image data run in daxfs_base_file_data() (#15) and the overlay/pcache header and array spans (#18). The helper itself is unchanged, and the remaining callers still rely on the start-only check, including the superblock read in daxfs_fill_super() and the symlink target in daxfs_iget().

Suggested fix: add a length-taking variant and convert the callers, so the bound travels with the pointer rather than being re-derived correctly at each site.

void *daxfs_mem_ptr_len(struct daxfs_info *info, u64 offset, size_t len);

daxfs_valid_offset() in daxfs/daxfs.h already implements the arithmetic, including the overflow guard.

Found during the review in #14.