sna: Only couple up a proxy->rq when inserting into the request->buffers list

Otherwise, we may never decouple it again afterwards leading to a
dangling pointer dereference.

Bugzilla: https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/1289923
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

src/sna/kgem.c

@@ -5841,11 +5841,13 @@ struct kgem_bo *kgem_create_proxy(struct kgem *kgem,
 	bo->proxy = kgem_bo_reference(target);
 	bo->delta = offset;
 
+	/* Proxies are only tracked for busyness on the current rq */
 	if (target->exec && !bo->io) {
+		assert(RQ(target->rq) == kgem->next_request);
 		list_move_tail(&bo->request, &kgem->next_request->buffers);
 		bo->exec = &_kgem_dummy_exec;
+		bo->rq = target->rq;
 	}
-	bo->rq = target->rq;
 
 	return bo;
 }

src/sna/kgem.h

@@ -630,6 +630,8 @@ static inline void __kgem_bo_mark_dirty(struct kgem_bo *bo)
 	     bo->handle, bo->proxy != NULL));
 
 	assert(bo->refcnt);
+	assert(bo->exec);
+	assert(bo->rq);
 
 	bo->exec->flags |= LOCAL_EXEC_OBJECT_WRITE;
 	bo->needs_flush = bo->gpu_dirty = true;