nouveau leaks a runtime pm ref if at least one CRTC is enabled on
unload. The ref is taken by nouveau_crtc_set_config() and held as long
as a CRTC is in use.

nv04_display_destroy() should solve this by turning off all CRTCs, but

(1) nv50_display_destroy() doesn't do the same and

(2) it's broken since commit d6bf2f37 ("drm/nouveau: run mode_config
    destructor before destroying internal display state") because the
    crtc structs are torn down by drm_mode_config_cleanup() before being
    turned off. Also, there's no locking.

Move the code to turn off all CRTCs from nv04_display_destroy() to
nouveau_display_destroy() so that it's called for both nv04 and nv50
and before drm_mode_config_cleanup(). Use drm_crtc_force_disable_all()
helper to save on code and have proper locking.

Cc: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/66daa161322444bbde05d83cb0210b90a66988a4.1465392124.git.lukas@wunner.de