drm/msm/mdp5: fix for crash in disable path

drm/msm/mdp5: fix for crash in disable path

Seems like disable can race with complete_flip() in process of disabling
a crtc, leading to:

[   49.065364] Call trace:
[   49.071441] [<ffffffc00041d5a0>] mdp5_ctl_blend+0x20/0x1c0
[   49.073788] [<ffffffc00041ebcc>] mdp5_crtc_disable+0x3c/0xa8
[   49.079348] [<ffffffc0003e7854>] disable_outputs.isra.4+0x11c/0x220
[   49.085164] [<ffffffc0003e7afc>] drm_atomic_helper_commit_modeset_disables+0x14/0x38
[   49.091155] [<ffffffc000425c80>] complete_commit+0x40/0xb8
[   49.099136] [<ffffffc0004260ac>] msm_atomic_commit+0x364/0x398
[   49.104430] [<ffffffc00040a614>] drm_atomic_commit+0x3c/0x70
[   49.110249] [<ffffffc0003e67b8>] drm_atomic_helper_set_config+0x1b0/0x3e0
[   49.116065] [<ffffffc0003f99bc>] drm_mode_set_config_internal+0x64/0xf8
[   49.122746] [<ffffffc0003fa624>] drm_framebuffer_remove+0xe4/0x128
[   49.129171] [<ffffffc0003feaf8>] drm_mode_rmfb+0xc0/0x100
[   49.135420] [<ffffffc0003efba8>] drm_ioctl+0x258/0x4d0
[   49.140889] [<ffffffc0001b0388>] do_vfs_ioctl+0x338/0x5d0
[   49.145921] [<ffffffc0001b06a8>] SyS_ioctl+0x88/0xa0

It makes no sense to free the ctl without disabling all stages, so lets
just move them together to avoid the crash.

Signed-off-by: Rob Clark <robdclark@gmail.com>