vmwgfx: integer overflow in vmw_kms_update_layout_ioctl()