linux-4.10-enforce-ro.patch

--- linux-master/block/blk-core.c	2016-12-16 22:23:34.000000000 +0300
+++ linux-master-patched/block/blk-core.c	2016-12-18 15:12:54.837220465 +0300
@@ -1903,6 +1903,19 @@ generic_make_request_checks(struct bio *
 		}
 	}
 
+	/*
+	 * Block write, discard, erase, flush, zone reset commands going to a
+	 * read-only device. We do this because kernel drivers often lack
+	 * necessary checks and send these commands to read-only block devices.
+	 */
+	if (unlikely((bio_op(bio) != REQ_OP_READ)
+			&& (bio_op(bio) != REQ_OP_ZONE_REPORT)
+			&& bdev_read_only(bio->bi_bdev))) {
+		pr_warn("unexpected write command to %s blocked\n",
+			bdevname(bio->bi_bdev, b));
+		goto end_io;
+	}
+
 	switch (bio_op(bio)) {
 	case REQ_OP_DISCARD:
 		if (!blk_queue_discard(q))