ion: WARN when the handle kmap_cnt is going to wrap around

There are certain client bugs (double unmap, for example) that can cause
the handle->kmap_cnt (an unsigned int) to wrap around from zero. This
causes problems when the handle is destroyed because we have:

        while (handle->kmap_cnt)
                ion_handle_kmap_put(handle);

which takes a long time to complete when kmap_cnt starts at ~0 and can
result in a watchdog timeout.

WARN and bail when kmap_cnt is about to wrap around from zero.

Change-Id: I19493ab2daf9a7bafad1a4610b69bee572d02974
ion: fix remaining instances of sg_dma_len

Recently, [ec6c8a8f443: "ion: convert sg_dma_len(sg) to sg->length"]
moved Ion away from using sg_dma_len. However, a few instances were left
over from MSM-specific code. Fix these instances so that we're using
sg->length everywhere.

Change-Id: I5b4e7637a81c59900d2a0e66234c59b41572cd6e