kmsdrm: Fix order of GBM and EGL teardown

All locked front buffers must be released prior to destroying
the EGL surface to avoid causing a UAF in libnvidia-egl-gbm.so.

(cherry picked from commit 9cc2f248f5)

src/video/kmsdrm/SDL_kmsdrmvideo.c

@@ -1113,17 +1113,6 @@ static void KMSDRM_DestroySurfaces(_THIS, SDL_Window *window)
         SDL_LogError(SDL_LOG_CATEGORY_VIDEO, "Could not restore CRTC");
     }
 
-    /***************************/
-    /* Destroy the EGL surface */
-    /***************************/
-
-    SDL_EGL_MakeCurrent(_this, EGL_NO_SURFACE, EGL_NO_CONTEXT);
-
-    if (windata->egl_surface != EGL_NO_SURFACE) {
-        SDL_EGL_DestroySurface(_this, windata->egl_surface);
-        windata->egl_surface = EGL_NO_SURFACE;
-    }
-
     /***************************/
     /* Destroy the GBM buffers */
     /***************************/
@@ -1138,6 +1127,17 @@ static void KMSDRM_DestroySurfaces(_THIS, SDL_Window *window)
         windata->next_bo = NULL;
     }
 
+    /***************************/
+    /* Destroy the EGL surface */
+    /***************************/
+
+    SDL_EGL_MakeCurrent(_this, EGL_NO_SURFACE, EGL_NO_CONTEXT);
+
+    if (windata->egl_surface != EGL_NO_SURFACE) {
+        SDL_EGL_DestroySurface(_this, windata->egl_surface);
+        windata->egl_surface = EGL_NO_SURFACE;
+    }
+
     /***************************/
     /* Destroy the GBM surface */
     /***************************/