drm: Remove two leaks of vblank reference count in error paths.

If the failing paths were hit, the vblank IRQ would never get turned off
again.
Signed-off-by: NEric Anholt <eric@anholt.net>
Acked-by: NKeith Packard <keithp@keithp.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

drivers/gpu/drm/drm_irq.c

@@ -594,11 +594,14 @@ int drm_wait_vblank(struct drm_device *dev, void *data,
 			goto done;
 		}
 
+		/* Get a refcount on the vblank, which will be released by
+		 * drm_vbl_send_signals().
+		 */
 		ret = drm_vblank_get(dev, crtc);
 		if (ret) {
 			drm_free(vbl_sig, sizeof(struct drm_vbl_sig),
 				 DRM_MEM_DRIVER);
-			return ret;
+			goto done;
 		}
 
 		atomic_inc(&dev->vbl_signal_pending);

drivers/gpu/drm/i915/i915_irq.c

@@ -771,6 +771,7 @@ int i915_vblank_swap(struct drm_device *dev, void *data,
 		    vbl_swap->plane == plane &&
 		    vbl_swap->sequence == swap->sequence) {
 			spin_unlock_irqrestore(&dev_priv->swaps_lock, irqflags);
+			drm_vblank_put(dev, pipe);
 			DRM_DEBUG("Already scheduled\n");
 			return 0;
 		}