From owner-freebsd-acpi@FreeBSD.ORG  Mon Nov 26 09:29:59 2012
Return-Path: <owner-freebsd-acpi@FreeBSD.ORG>
Delivered-To: freebsd-acpi@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
 by hub.freebsd.org (Postfix) with ESMTP id 5A3BC62B;
 Mon, 26 Nov 2012 09:29:59 +0000 (UTC) (envelope-from avg@FreeBSD.org)
Received: from citadel.icyb.net.ua (citadel.icyb.net.ua [212.40.38.140])
 by mx1.freebsd.org (Postfix) with ESMTP id 7367E8FC0C;
 Mon, 26 Nov 2012 09:29:58 +0000 (UTC)
Received: from porto.starpoint.kiev.ua (porto-e.starpoint.kiev.ua
 [212.40.38.100])
 by citadel.icyb.net.ua (8.8.8p3/ICyb-2.3exp) with ESMTP id LAA28261;
 Mon, 26 Nov 2012 11:29:56 +0200 (EET) (envelope-from avg@FreeBSD.org)
Received: from localhost ([127.0.0.1])
 by porto.starpoint.kiev.ua with esmtp (Exim 4.34 (FreeBSD))
 id 1Tcv0m-000Lgs-JJ; Mon, 26 Nov 2012 11:29:56 +0200
Message-ID: <50B33693.2060000@FreeBSD.org>
Date: Mon, 26 Nov 2012 11:29:55 +0200
From: Andriy Gapon <avg@FreeBSD.org>
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64;
 rv:17.0) Gecko/17.0 Thunderbird/17.0
MIME-Version: 1.0
To: Stefan Farfeleder <stefanf@FreeBSD.org>
Subject: Re: ACPI panic
References: <20121120103522.GB2012@mole.fafoe.narf.at>
 <50AC0A68.8070906@FreeBSD.org> <20121121104840.GA1468@mole.fafoe.narf.at>
 <20121122081831.GA1483@mole.fafoe.narf.at> <50ADFD75.10709@FreeBSD.org>
 <50ADFFB2.1000108@FreeBSD.org> <50AE057D.8060808@FreeBSD.org>
 <20121125140008.GA1497@mole.fafoe.narf.at> <50B244A1.1040800@FreeBSD.org>
 <20121126091101.GA1469@mole.fafoe.narf.at>
In-Reply-To: <20121126091101.GA1469@mole.fafoe.narf.at>
X-Enigmail-Version: 1.4.6
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: freebsd-acpi@FreeBSD.org
X-BeenThere: freebsd-acpi@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: ACPI and power management development <freebsd-acpi.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-acpi>,
 <mailto:freebsd-acpi-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-acpi>
List-Post: <mailto:freebsd-acpi@freebsd.org>
List-Help: <mailto:freebsd-acpi-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-acpi>,
 <mailto:freebsd-acpi-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 26 Nov 2012 09:29:59 -0000

on 26/11/2012 11:11 Stefan Farfeleder said the following:
> On Sun, Nov 25, 2012 at 06:17:37PM +0200, Andriy Gapon wrote:
>> @@ -238,6 +240,10 @@ AcpiOsReleaseObject (
>>          if (Object == Curr) {
>>              panic("freeing a free object %p", Object);
>>          }
>> +        Depth--;
>> +        if (Depth < 0) {
>> +            panic("cycle in a cache list");
>> +        }
>>      }
>>      (void) AcpiUtReleaseMutex (ACPI_MTX_CACHES);
> 
> I can easily trigger this panic. At the time of the panic, the cache
> list has ~30 entries and somewhere in the middle there's a 2-item cycle
> A -> B -> A. I don't think release is called twice on A as your patch
> checks that and the cycle is not at the beginning of the loop. So this
> means "someone" changes the next pointer while the object is in the
> cache.

Very interesting, thank you.
Are you able to get a crash dump?

-- 
Andriy Gapon