Close races in vm object chain traversal for unlock

[rlibby]

Summary

We were unlocking the vm object before reading the backing_object field.
In the meantime, the object could be freed and reused. This could cause
us to go off the rails in the object chain traversal, failing to unlock
the rest of the objects in the original chain and corrupting the lock
state of the victim chain.

MFC after: 3 days
Sponsored by: Dell EMC Isilon

Test Plan

procstat -av

mount -t procfs proc /proc
cat /proc/*/map

[rlibby]

This can be done without introducing another object pointer (nobj) by resetting lobj and following the pattern elsewhere, but I found the approach with nobj to be more readable.

[markj]

I looked for other occurrences of this but didn't find any.