fbdev: efifb: Fix a use-after-free due early fb_info cleanup

Commit d258d00fb9c7 ("fbdev: efifb: Cleanup fb_info in .fb_destroy rather
than .remove") attempted to fix a use-after-free error due driver freeing
the fb_info in the .remove handler instead of doing it in .fb_destroy.

But ironically that change introduced yet another use-after-free since the
fb_info was still used after the free.

This should fix for good by freeing the fb_info at the end of the handler.

Fixes: d258d00fb9c7 ("fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove")
Reported-by: Ville Syrjälä <[e-mail]>
Reported-by: Andrzej Hajda <[e-mail]>
Signed-off-by: Javier Martinez Canillas <[e-mail]>
Reviewed-by: Andi Shyti <[e-mail]>
Reviewed-by: Andrzej Hajda <[e-mail]>
Reviewed-by: Thomas Zimmermann <[e-mail]>
Signed-off-by: Lucas De Marchi <[e-mail]>
Link: https://patchwork.freedesktop.org/patch/msgid/[e-mail]

drivers/video/fbdev/efifb.c

···
 			memunmap(info->screen_base);
 	}
 
-	framebuffer_release(info);
-
 	if (request_mem_succeeded)
 		release_mem_region(info->apertures->ranges[0].base,
 				   info->apertures->ranges[0].size);
 	fb_dealloc_cmap(&info->cmap);
+
+	framebuffer_release(info);
 }
 
 static const struct fb_ops efifb_ops = {