drm: integer overflow in drm_mode_dirtyfb_ioctl()