Messages in this thread | | | Date | Mon, 26 Nov 2018 18:28:41 +0800 | From | PanBian <> | Subject | Re: [PATCH] f2fs: read page index before freeing |
| |
On Mon, Nov 26, 2018 at 05:13:53PM +0800, Chao Yu wrote: > Hi Pan, > > On 2018/11/22 18:58, Pan Bian wrote: > > The function truncate_node frees the page with f2fs_put_page. However, > > the page index is read after that. So, the patch reads the index before > > freeing the page. > > I notice that you found another use-after-free bug in ext4, out of > curiosity, I'd like to ask how do you find those bugs? by tool or code review?
I found such bugs by the aid of a tool I wrote recently. I designed a method to automatically find paired alloc/free functions. With such functions, I wrote two checkers, one to check mismatched alloc/free bugs, the other to check use-after-free and double-free bugs.
Best regards, Pan Bian
| |