ion: fix remaining instances of sg_dma_len

Recently, [ec6c8a8f: "ion: convert sg_dma_len(sg) to sg->length"]
moved Ion away from using sg_dma_len. However, a few instances were left
over from MSM-specific code. Fix these instances so that we're using
sg->length everywhere.

Change-Id: I76b07f5589ba3867e1584b129a0ccd9f3ef00ad7
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>