kernel: watch_queue: copy user-array safely