drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()