kmsdrm: Fix order of GBM and EGL teardown

All locked front buffers must be released prior to destroying
the EGL surface to avoid causing a UAF in libnvidia-egl-gbm.so.

(cherry picked from commit 463b6be13342b0d58bf1cc8674fcee4fc4bcc9c0)

src/video/kmsdrm/SDL_kmsdrmvideo.c

@@ -1696,17 +1696,6 @@ static void KMSDRM_DestroySurfaces(SDL_VideoDevice *_this, SDL_Window *window)
         SDL_LogError(SDL_LOG_CATEGORY_VIDEO, "Could not restore CRTC");
     }
 
-    /***************************/
-    // Destroy the EGL surface
-    /***************************/
-
-    SDL_EGL_MakeCurrent(_this, EGL_NO_SURFACE, EGL_NO_CONTEXT);
-
-    if (windata->egl_surface != EGL_NO_SURFACE) {
-        SDL_EGL_DestroySurface(_this, windata->egl_surface);
-        windata->egl_surface = EGL_NO_SURFACE;
-    }
-
     /***************************/
     // Destroy the GBM buffers
     /***************************/
@@ -1723,6 +1712,17 @@ static void KMSDRM_DestroySurfaces(SDL_VideoDevice *_this, SDL_Window *window)
         windata->next_bo = NULL;
     }
 
+    /***************************/
+    // Destroy the EGL surface
+    /***************************/
+
+    SDL_EGL_MakeCurrent(_this, EGL_NO_SURFACE, EGL_NO_CONTEXT);
+
+    if (windata->egl_surface != EGL_NO_SURFACE) {
+        SDL_EGL_DestroySurface(_this, windata->egl_surface);
+        windata->egl_surface = EGL_NO_SURFACE;
+    }
+
     /***************************/
     // Destroy the GBM surface
     /***************************/