drm/i915: Unwind vma pinning for intel_pin_and_fence_fb_obj error path

If we fail to acquire a fence when we must, we must unwind before
reporting the error. Otherwise, we lose tracking of the vma pinning and
eventually hit a bug like

<3>[   46.163202] i915_vma_unpin:333 GEM_BUG_ON(!i915_vma_is_pinned(vma))
<4>[   46.163424] ------------[ cut here ]------------
<2>[   46.163429] kernel BUG at drivers/gpu/drm/i915/i915_vma.h:333!
<4>[   46.163444] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
<0>[   46.163451] Dumping ftrace buffer:
<0>[   46.163457] ---------------------------------
<0>[   46.163630]    <...>-84      1.... 46260767us : i915_gem_object_unpin_from_display_plane: i915_vma_unpin:333 GEM_BUG_ON(!i915_vma_is_pinned(vma))
<0>[   46.163635] ---------------------------------
<4>[   46.163638] Modules linked in: vgem i915 snd_hda_codec_analog snd_hda_codec_generic coretemp snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm lpc_ich mei_me e1000e mei prime_numbers
<4>[   46.163667] CPU: 1 PID: 84 Comm: kworker/u16:1 Tainted: G     U           4.16.0-rc3-gc07ef2c77d14-kasan_18+ #1
<4>[   46.163671] Hardware name: Dell Inc. OptiPlex 755                 /0PU052, BIOS A08 02/19/2008
<4>[   46.163743] Workqueue: events_unbound intel_atomic_commit_work [i915]
<4>[   46.163809] RIP: 0010:i915_gem_object_unpin_from_display_plane+0x253/0x2f0 [i915]
<4>[   46.163813] RSP: 0018:ffff8800624cfb48 EFLAGS: 00010286
<4>[   46.163818] RAX: 000000000000000c RBX: ffff880064446c40 RCX: ffff8800653135b8
<4>[   46.163822] RDX: dffffc0000000000 RSI: 0000000000000054 RDI: ffff8800651e30d0
<4>[   46.163825] RBP: 00000000000003d0 R08: 0000000000000001 R09: ffff8800651e3158
<4>[   46.163829] R10: 0000000000000000 R11: ffff8800651e30f0 R12: 0000000000000001
<4>[   46.163832] R13: ffff880054c58620 R14: 0000000000000000 R15: dffffc0000000000
<4>[   46.163836] FS:  0000000000000000(0000) GS:ffff880066040000(0000) knlGS:0000000000000000
<4>[   46.163840] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[   46.163843] CR2: 00007f1fc6fb0000 CR3: 00000000526fe000 CR4: 00000000000006e0
<4>[   46.163846] Call Trace:
<4>[   46.163918]  intel_unpin_fb_vma+0xbd/0x300 [i915]
<4>[   46.163990]  intel_cleanup_plane_fb+0x99/0xc0 [i915]
<4>[   46.163998]  drm_atomic_helper_cleanup_planes+0x166/0x280
<4>[   46.164071]  intel_atomic_commit_tail+0x1594/0x33a0 [i915]
<4>[   46.164081]  ? process_one_work+0x66e/0x1460
<4>[   46.164151]  ? skl_update_crtcs+0x9c0/0x9c0 [i915]
<4>[   46.164157]  ? lock_acquire+0x13d/0x390
<4>[   46.164161]  ? lock_acquire+0x13d/0x390
<4>[   46.164169]  process_one_work+0x71a/0x1460
<4>[   46.164175]  ? __schedule+0x838/0x1e50
<4>[   46.164182]  ? pwq_dec_nr_in_flight+0x2b0/0x2b0
<4>[   46.164188]  ? _raw_spin_lock_irq+0xa/0x40
<4>[   46.164194]  worker_thread+0xdf/0xf60
<4>[   46.164204]  ? process_one_work+0x1460/0x1460
<4>[   46.164209]  kthread+0x2cf/0x3c0
<4>[   46.164213]  ? _kthread_create_on_node+0xa0/0xa0
<4>[   46.164218]  ret_from_fork+0x3a/0x50
<4>[   46.164227] Code: e8 78 d9 cd e8 48 8b 35 cc 9e 47 00 49 c7 c0 c0 31 84 c0 b9 4d 01 00 00 48 c7 c2 e0 80 84 c0 48 c7 c7 0e bb 57 c0 e8 5d 4b df e8 <0f> 0b 48 c7 c1 c0 30 84 c0 ba 4e 01 00 00 48 c7 c6 e0 80 84 c0
<1>[   46.164368] RIP: i915_gem_object_unpin_from_display_plane+0x253/0x2f0 [i915] RSP: ffff8800624cfb48

Fixes: 85798ac9 ("drm/i915: Fail if we can't get a fence for gen2/3 tiled scanout")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180305103312.29492-1-chris@chris-wilson.co.uk

drivers/gpu/drm/i915/intel_display.c

@@ -2152,6 +2152,7 @@ intel_pin_and_fence_fb_obj(struct drm_framebuffer *fb,
 		 */
 		ret = i915_vma_pin_fence(vma);
 		if (ret != 0 && INTEL_GEN(dev_priv) < 4) {
+			i915_gem_object_unpin_from_display_plane(vma);
 			vma = ERR_PTR(ret);
 			goto err;
 		}