>Number:         3447
>Category:       kern
>Synopsis:       recent changes to specfs cause panics
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Apr  3 14:05:02 1997
>Last-Modified:
>Originator:     Tom Yu
>Organization:
	Kernel Hackers `R` Us
>Release:        current (970402 sup)
>Environment:
	
System: NetBSD chaos-in-motion 1.2D NetBSD 1.2D (CHAOS) #4: Thu Apr 3 16:41:01 EST 1997 root@chaos-in-motion:/usr/pcmcia-src/sys/arch/i386/compile/CHAOS i386


>Description:
	The addition of specfs_advlock() seems to corrupt some data
structures in such a way that calling exit() from a program can induce
a panic in lf_findoverlap(), which gets passed a bogus address
(0xdeadbeef) somehow from lf_clearlock().

>How-To-Repeat:
	The specific case was running an Athena local version of CNS
kinit with a kernel compiled from the 970402 sup.  Upon program exit,
the kernel panics.

>Fix:
	The workaround is to remove the specfs_advlock() function.  I
don't know what the real fix is, since I don't know too much about the
internal workings of lf_advlock(), and I don't really have time to
look into them at the moment.
>Audit-Trail:
>Unformatted: