f2fs: fix race in concurrent f2fs_stop_gc_thread

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix race in concurrent f2fs_stop_gc_thread

In my test case, concurrent calls to f2fs shutdown report the following

stack trace:

Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI

CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85

Call Trace:

<TASK>

? show_regs+0x8b/0xa0

? __die_body+0x26/0xa0

? die_addr+0x54/0x90

? exc_general_protection+0x24b/0x5c0

? asm_exc_general_protection+0x26/0x30

? kthread_stop+0x46/0x390

f2fs_stop_gc_thread+0x6c/0x110

f2fs_do_shutdown+0x309/0x3a0

f2fs_ioc_shutdown+0x150/0x1c0

__f2fs_ioctl+0xffd/0x2ac0

f2fs_ioctl+0x76/0xe0

vfs_ioctl+0x23/0x60

__x64_sys_ioctl+0xce/0xf0

x64_sys_call+0x2b1b/0x4540

do_syscall_64+0xa7/0x240

entry_SYSCALL_64_after_hwframe+0x76/0x7e

The root cause is a race condition in f2fs_stop_gc_thread() called from

different f2fs shutdown paths:

[CPU0] [CPU1]

---------------------- -----------------------

f2fs_stop_gc_thread f2fs_stop_gc_thread

gc_th = sbi->gc_thread

gc_th = sbi->gc_thread

kfree(gc_th)

sbi->gc_thread = NULL

< gc_th != NULL >

kthread_stop(gc_th->f2fs_gc_task) //UAF

The commit c7f114d864ac ("f2fs: fix to avoid use-after-free in

f2fs_stop_gc_thread()") attempted to fix this issue by using a read

semaphore to prevent races between shutdown and remount threads, but

it fails to prevent all race conditions.

Fix it by converting to write lock of s_umount in f2fs_do_shutdown().