Bug 2387 - libbe.so:beCopy() frees nvlist variables before using them
: libbe.so:beCopy() frees nvlist variables before using them
Status: RESOLVED FIXINBUILD
Product: installer
library
: unspecified
: ANY/Generic OpenSolaris
: P2 minor (vote)
: in-preview
Assigned To: Tim Knitter
:
:
:
:
:
:
  Show dependency treegraph
 
Reported: 2008-07-03 08:36 UTC by Tim Knitter
Modified: 2008-11-24 12:56 UTC (History)
3 users (show)

See Also:


Attachments


Note

You need to log in before you can comment on or make changes to this bug.


Description Tim Knitter 2008-07-03 08:36:15 UTC
This bug is seen when doing a 'pkg image-update' on build 90. pkg produces the
error:

# pkg image-update
pkg: attempt to mount opensolaris-1 failed.
pkg: image-update cannot be done on live image 

The cause is that libbe_pymod/libbe.c:beCopy() is freeing nvlist variables
before returning them to the caller. Here's the snippet:

               if (nvlist_lookup_string(beAttrs, BE_ATTR_NEW_BE_NAME,
                   &trgtBeName) != 0) {
                       goto cleanupFailure;
               }
               if (nvlist_lookup_string(beAttrs, BE_ATTR_SNAP_NAME,
                   &trgtSnapName) != 0) {
                       goto cleanupFailure;
               }

               nvlist_free(beAttrs);

               return (Py_BuildValue("[iss]", 0, trgtBeName, trgtSnapName)); 

Calling nvlist_free(beAttrs) before building python values and returning them
results in deallocated references for trgtBeName and trgtSnapName resulting in
junk being returned to the caller.

Thanks to Ethan for root causing this one.
Comment 1 Tim Knitter 2008-07-03 11:24:11 UTC
Fixed in changeset 172:6a0ad6662c90
Comment 2 Ethan Quach 2008-07-23 15:18:43 UTC
The workaround for this bug is:

     $ pfexec beadm create opensolaris-<N+1>
     $ pfexec beadm mount opensolaris-<N+1> /mnt
     $ pfexec pkg -R /mnt image-update
     $ pfexec beadm unmount opensolaris-<N+1>
     $ pfexec beadm activate opensolaris-<N+1>
Comment 3 Ethan Quach 2008-11-11 13:41:21 UTC
*** Bug 3539 has been marked as a duplicate of this bug. ***