sna: Release the reference on the rq->bo during forced cleanup

Since the switch to preallocating the batch buffer, the request owns its
reference to the rq->bo. However, dropping that reference was missed
during the cleanup.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

src/sna/kgem.c

@@ -3594,6 +3594,9 @@ static void kgem_cleanup(struct kgem *kgem)
 					kgem_bo_free(kgem, bo);
 			}
 
+			if (--rq->bo->refcnt == 0)
+				kgem_bo_free(kgem, rq->bo);
+
 			__kgem_request_free(rq);
 		}
 	}