drm/msm/mdp5: fix for crash in disable path

Seems like disable can race with complete_flip() in process of disabling
a crtc, leading to:

[   49.065364] Call trace:
[   49.071441] [<ffffffc00041d5a0>] mdp5_ctl_blend+0x20/0x1c0
[   49.073788] [<ffffffc00041ebcc>] mdp5_crtc_disable+0x3c/0xa8
[   49.079348] [<ffffffc0003e7854>] disable_outputs.isra.4+0x11c/0x220
[   49.085164] [<ffffffc0003e7afc>] drm_atomic_helper_commit_modeset_disables+0x14/0x38
[   49.091155] [<ffffffc000425c80>] complete_commit+0x40/0xb8
[   49.099136] [<ffffffc0004260ac>] msm_atomic_commit+0x364/0x398
[   49.104430] [<ffffffc00040a614>] drm_atomic_commit+0x3c/0x70
[   49.110249] [<ffffffc0003e67b8>] drm_atomic_helper_set_config+0x1b0/0x3e0
[   49.116065] [<ffffffc0003f99bc>] drm_mode_set_config_internal+0x64/0xf8
[   49.122746] [<ffffffc0003fa624>] drm_framebuffer_remove+0xe4/0x128
[   49.129171] [<ffffffc0003feaf8>] drm_mode_rmfb+0xc0/0x100
[   49.135420] [<ffffffc0003efba8>] drm_ioctl+0x258/0x4d0
[   49.140889] [<ffffffc0001b0388>] do_vfs_ioctl+0x338/0x5d0
[   49.145921] [<ffffffc0001b06a8>] SyS_ioctl+0x88/0xa0

It makes no sense to free the ctl without disabling all stages, so lets
just move them together to avoid the crash.
Signed-off-by: Rob Clark <robdclark@gmail.com>

drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c

@@ -143,6 +143,8 @@ static void complete_flip(struct drm_crtc *crtc, struct drm_file *file)
 	}
 
 	if (mdp5_crtc->ctl && !crtc->state->enable) {
+		/* set STAGE_UNUSED for all layers */
+		mdp5_ctl_blend(mdp5_crtc->ctl, mdp5_crtc->lm, 0x00000000);
 		mdp5_ctl_release(mdp5_crtc->ctl);
 		mdp5_crtc->ctl = NULL;
 	}
@@ -274,9 +276,6 @@ static void mdp5_crtc_disable(struct drm_crtc *crtc)
 	if (WARN_ON(!mdp5_crtc->enabled))
 		return;
 
-	/* set STAGE_UNUSED for all layers */
-	mdp5_ctl_blend(mdp5_crtc->ctl, mdp5_crtc->lm, 0x00000000);
-
 	mdp_irq_unregister(&mdp5_kms->base, &mdp5_crtc->err);
 	mdp5_disable(mdp5_kms);