xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()