Avoid freeing then accessing driver backend format and usage combinations

Due to USB flakiness issues, sometimes udl devices suddenly disconnect
then reconnect. In such cases, we see that drv_create runs before drv_destroy
can destroy the driver belonging to the disconnected udl device. Once
drv_destroy runs, it frees structs frequently used by the newly created
driver, most importantly drv->backend->combos->data which stores
format and usage combinations for creating BOs.

By nature, drv_destroy should not destroy data belonging to backend. Further,
BO format and usage combinations are hardcoded in driver _init, so there is
no point in it being freed in drv_destroy.

This fix moves the combos array to struct drv so a new combos array can be
created and destroyed in drv_create and drv_destroy. This eliminates the
race condition by avoiding using the shared resource.

BUG=crbug.com/766831
TEST=Boot up CfM, make sure ui and chrome logs are not complaining
about scanout and framebuffer failures. Play around with Mimo touchscreen
to make sure the display is not flickering.

Change-Id: I53d57693574daeb5486cd5daca71f660ada635ef
Reviewed-on: https://chromium-review.googlesource.com/674528
Commit-Ready: Ege Mihmanli <egemih@google.com>
Tested-by: Ege Mihmanli <egemih@google.com>
Reviewed-by: Gurchetan Singh <gurchetansingh@chromium.org>

1 files changed, 10 insertions, 10 deletions

diff --git a/drv_priv.h b/drv_priv.h
index 5547b78..fed6c19 100644
--- a/drv_priv.h
+++ b/drv_priv.h
@@ -31,15 +31,6 @@ struct bo {
 	void *priv;
 };
 
-struct driver {
-	int fd;
-	struct backend *backend;
-	void *priv;
-	void *buffer_table;
-	void *map_table;
-	pthread_mutex_t driver_lock;
-};
-
 struct kms_item {
 	uint32_t format;
 	uint64_t modifier;
@@ -64,6 +55,16 @@ struct combinations {
 	uint32_t allocations;
 };
 
+struct driver {
+	int fd;
+	struct backend *backend;
+	void *priv;
+	void *buffer_table;
+	void *map_table;
+	struct combinations combos;
+	pthread_mutex_t driver_lock;
+};
+
 struct backend {
 	char *name;
 	int (*init)(struct driver *drv);
@@ -77,7 +78,6 @@ struct backend {
 	void *(*bo_map)(struct bo *bo, struct map_info *data, size_t plane, int prot);
 	int (*bo_unmap)(struct bo *bo, struct map_info *data);
 	uint32_t (*resolve_format)(uint32_t format, uint64_t usage);
-	struct combinations combos;
 };
 
 // clang-format off