MFC 288452,289719:

288452:
Most error cases in i915_gem_do_execbuffer() jump to one of two labels to
release resources (such as unholding pages) when errors occur. Some
recently added error checks return immediately instead of jumping to a
label resulting in leaks. Fix these to jump to a label to do cleanup
instead.

Note that stable/9 does not have the "recently added" error checks, but
it does have some older error checks (that were are no longer present
in stable/10 and head) that have the same bug and this fixes those
instead.

289719:
i915_gem_do_execbuffer() holds the pages backing each relocation region for
various reasons while executing user commands. After these commands are
completed, the pages backing the relocation regions are unheld.

Since relocation regions do not have to be page aligned, the code in
validate_exec_list() allocates 2 extra page pointers in the array of
held pages populated by vm_fault_quick_hold_pages(). However, the cleanup
code that unheld the pages always assumed that only the buffer size /
PAGE_SIZE pages were used. This meant that non-page aligned buffers would
not unheld the last 1 or 2 pages in the list. Fix this by saving the
number of held pages returned by vm_fault_quick_hold_pages() for each
relocation region and using this count during cleanup.