nouveau: use saved fence pointer, not head of unsignalled list

It's possible for the unsignalled list head to change during fence_flush.
Fixes valgrind complaint exposed by a previous commit.

src/gallium/winsys/dri/nouveau/nouveau_fence.c

@@ -172,14 +172,13 @@ nouveau_fence_flush(struct nouveau_channel *chan)
 		nvfence = nouveau_fence(nvchan->fence_head);
 		if (nvfence->sequence > sequence)
 			break;
-
 		nouveau_fence_del_unsignalled(&nvfence->base);
 		nvfence->signalled = 1;
 
 		if (nvfence->signal_cb) {
 			struct nouveau_fence *fence = NULL;
 
-			nouveau_fence_ref(nvchan->fence_head, &fence);
+			nouveau_fence_ref(&nvfence->base, &fence);
 
 			while (nvfence->signal_cb) {
 				struct nouveau_fence_cb *cb;