drm: Restore lost drm_framebuffer_unreference in drm_mode_page_flip_ioctl

Commit 43968d7b806d ("drm: Extract drm_plane.[hc]") was not the simple
cut'n'paste we presumed, somehow it introduced a leak of the page flip
target's framebuffer.

Fixes: 43968d7b806d ("drm: Extract drm_plane.[hc]")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20160928222500.11827-1-chris@chris-wilson.co.uk
Signed-off-by: Dave Airlie <airlied@redhat.com>

drivers/gpu/drm/drm_plane.c

@@ -898,6 +898,8 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
 out:
 	if (ret && crtc->funcs->page_flip_target)
 		drm_crtc_vblank_put(crtc);
+	if (fb)
+		drm_framebuffer_unreference(fb);
 	if (crtc->primary->old_fb)
 		drm_framebuffer_unreference(crtc->primary->old_fb);
 	crtc->primary->old_fb = NULL;