mtd: fis: fix buffer overflow from negative memset size

mtd: fis: fix buffer overflow from negative memset size

In fis_remap(), when desc < last, the memset size is computed as
'tmp - end'. Since tmp is calculated as 'end - positive_value', tmp is
always less than end, making 'tmp - end' negative. When cast to size_t,
this wraps to a very large value, causing a massive buffer overflow.

Fix by swapping the operands to 'end - tmp' which correctly computes the
number of bytes to clear.

Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23550
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>