On Mon, Nov 26, 2018 at 05:13:53PM +0800, Chao Yu wrote: > Hi Pan, > > On 2018/11/22 18:58, Pan Bian wrote: > > The function truncate_node frees the page with f2fs_put_page. However, > > the page index is read after that. So, the patch reads the index before > > freeing the page. > > I notice that you found another use-after-free bug in ext4, out of > curiosity, I'd like to ask how do you find those bugs? by tool or code review?
I found such bugs by the aid of a tool I wrote recently. I designed a method to automatically find paired alloc/free functions. With such functions, I wrote two checkers, one to check mismatched alloc/free bugs, the other to check use-after-free and double-free bugs. Best regards, Pan Bian _______________________________________________ Linux-f2fs-devel mailing list Linux-f2fs-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
