drm/i915: use after free on error path

i915_gem_vma_destroy() frees its argument so we have to move the drm_mm_remove_node() call up a few lines.

Signed-off-by Dan Carpenter <[email protected]>

drivers/gpu/drm/i915/i915_gem.c +1 -1

index 9a9a77a..f347ad5 100644
@@ -3161,9 +3161,9 @@ search_free:
 	return 0;
 
 err_out:
+	drm_mm_remove_node(&vma->node);
 	i915_gem_vma_destroy(vma);
 	i915_gem_object_unpin_pages(obj);
-	drm_mm_remove_node(&vma->node);
 	return ret;
 }