drm/msm: Fix potential buffer overflow issue

In function submit_create, if nr_cmds or nr_bos is assigned with
negative value, the allocated buffer may be small than intended.
Using this buffer will lead to buffer overflow issue.

Change-Id: I0b61cccffd836e2dd3c859446470af4b6451b9ed
Signed-off-by: Kasin Li <donglil@codeaurora.org>