diff -u openafs-1.4.7.dfsg1/debian/changelog openafs-1.4.7.dfsg1/debian/changelog
--- openafs-1.4.7.dfsg1/debian/changelog
+++ openafs-1.4.7.dfsg1/debian/changelog
@@ -1,3 +1,11 @@
+openafs (1.4.7.dfsg1-6+ubuntu0.2) intrepid-proposed; urgency=low
+
+  * Apply upstream deltas shutdown-vcache-avoid-null-deref-20090324 and
+    cbr-free-what-you-alloc-20090325 to fix oops and hang at shutdown.
+    (LP: #333197)
+
+ -- Evan Broder <broder@mit.edu>  Tue, 21 Apr 2009 12:18:57 -0400
+
 openafs (1.4.7.dfsg1-6+ubuntu0.1) intrepid-security; urgency=low
 
   * Apply upstream security patches from 1.4.9 (LP: #356861):
only in patch2:
unchanged:
--- openafs-1.4.7.dfsg1.orig/src/afs/afs_vcache.c
+++ openafs-1.4.7.dfsg1/src/afs/afs_vcache.c
@@ -313,6 +313,8 @@
  * held, so we don't have to worry about blocking in osi_Alloc.
  */
 static struct afs_cbr *afs_cbrSpace = 0;
+/* if alloc limit below changes, fix me! */
+static struct afs_cbr *afs_cbrHeads[2];
 struct afs_cbr *
 afs_AllocCBR(void)
 {
@@ -334,6 +336,7 @@
 	    }
 	    tsp[AFS_NCBRS - 1].next = 0;
 	    afs_cbrSpace = tsp;
+           afs_cbrHeads[afs_stats_cmperf.CallBackAlloced] = tsp;
 	    afs_stats_cmperf.CallBackAlloced++;
 	}
     }
@@ -3003,7 +3006,7 @@
      */
 
     {
-	register struct afs_q *tq, *uq;
+	register struct afs_q *tq, *uq = NULL;
 	register struct vcache *tvc;
 	for (tq = VLRU.prev; tq != &VLRU; tq = uq) {
 	    tvc = QTOV(tq);
@@ -3058,7 +3061,8 @@
 		    tvc->linkData = 0;
 		}
 
-		afs_FreeAllAxs(&(tvc->Access));
+		if (tvc->Access)
+		    afs_FreeAllAxs(&(tvc->Access));
 	    }
 	    afs_vhashT[i] = 0;
 	}
@@ -3066,8 +3070,9 @@
     /*
      * Free any leftover callback queue
      */
-    for (tsp = afs_cbrSpace; tsp; tsp = nsp) {
-	nsp = tsp->next;
+    for (i = 0; i < afs_stats_cmperf.CallBackAlloced; i++) {
+       tsp = afs_cbrHeads[i];
+       afs_cbrHeads[i] = 0;
 	afs_osi_Free((char *)tsp, AFS_NCBRS * sizeof(struct afs_cbr));
     }
     afs_cbrSpace = 0;