Most error cases in i915_gem_do_execbuffer() jump to one of two labels to
release resources (such as unholding pages) when errors occur. Some
recently added error checks return immediately instead of jumping to a
label resulting in leaks.
More background: the last two days I've gotten a panic on my laptop
running HEAD from vm_page_unhold() claiming that there is a negative
hold count on a page. In the one core I looked at, the page in question
has a hold count of 0. However, subsequent pages have hold counts of
1554, 17470, 1468, 20744, 42994, etc. These all seem rather high to me,
so my guess is that the hold count is overflowing (hold_count is a
uint16_t).