CVE-2025-38410 drm/msm: Fix a fence leak in submit error path