intel_fb: fix framebuffer freeup

drm_framebuffer_remove takes care of references to CRTC pointers before
freeing up framebuffer object. Directly calling the destroy function may cause
dangling CRTC pointers pointing inside the framebuffer object.

Fixes #2140

repos/dde_linux/patches/intel_fb_drm_remove.patch

@@ -0,0 +1,13 @@
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -13567,6 +13568,10 @@
+ 	intel_crtc = to_intel_crtc(crtc);
+ 
+ 	plane->fb = fb;
++
++	if (!crtc)
++		return;
++
+ 	crtc->x = src->x1 >> 16;
+ 	crtc->y = src->y1 >> 16;
+ 

repos/dde_linux/ports/dde_linux.hash

@@ -1 +1 @@
-a94822e34f6074f3bb84c5300925c72502066eb0
+01af4e74fb2b25133f181d1b73d673b9683c330b

repos/dde_linux/ports/dde_linux.port

@@ -193,5 +193,6 @@ PATCH_OPT(patches/usb_usbnet.patch)      := $(USB_OPT)
 
 # INTEL FB
 PATCH_OPT(patches/intel_fb_export_api.patch) := -p1 -d$(SRC_DIR_INTEL_FB)
+PATCH_OPT(patches/intel_fb_drm_remove.patch) := -p1 -d$(SRC_DIR_INTEL_FB)
 
 # vi: set ft=make :

repos/dde_linux/src/drivers/framebuffer/intel/lx_emul.cc

@@ -188,7 +188,8 @@ void Framebuffer::Driver::update_mode()
 	}
 
 	if (old._lx.addr)  Lx::iounmap(old._lx.addr);
-	if (old._lx.lx_fb) old._lx.lx_fb->funcs->destroy(old._lx.lx_fb);
+	/* drm_crtc.h in drm_framebuffer_funcs definition: use drm_fb_remove */
+	if (old._lx.lx_fb) drm_framebuffer_remove(old._lx.lx_fb);
 }