drm/msm: protect against faults from copy_from_user() in submit ioctl