src/lib/kernel/list.c

@@ -170,6 +170,9 @@ list_insert (struct list_elem *before, struct list_elem *elem)
 {
   ASSERT (is_interior (before) || is_tail (before));
   ASSERT (elem != NULL);
+  // Sanity checks to prevent (some) loop lists
+  ASSERT (before != elem);
+  ASSERT (before->prev != elem);
 
   elem->prev = before->prev;
   elem->next = before;

src/threads/synch.c

@@ -341,6 +341,7 @@ lock_release (struct lock *lock)
      released, transfer the remaining orphaned donors to its donor list. */
   if (max_donor != NULL)
     {
+      list_remove (&max_donor->donor_elem);
       while (!list_empty (&orphan_list))
         list_push_back (&max_donor->donors_list, list_pop_front (&orphan_list));
     }

src/userprog/process.c

@@ -262,11 +262,12 @@ process_exit (void)
          struct process_result *, and may be waiting so call sema_up */
       else
         {
-          lock_release (&cur->result->lock);
           sema_up (&cur->result->sema);
+          lock_release (&cur->result->lock);
         }
     }
 
+  /* Free child process results or signal parent's death. */
   struct list_elem *e;
   for (e = list_begin (&cur->child_results);
        e != list_end (&cur->child_results); e = list_next (e))
@@ -283,8 +284,8 @@ process_exit (void)
       /* Child is still alive, signal via sema that parent has died. */
       else
         {
-          lock_release (&result->lock);
           sema_up (&result->sema);
+          lock_release (&result->lock);
         }
     }