[SRU][J][PATCH 0/1] CVE-2022-49178

[Cengiz Can]

https://ubuntu.com/security/CVE-2022-49178

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

memstick/mspro_block: fix handling of read-only devices

Use set_disk_ro to propagate the read-only state to the block layer instead of
checking for it in ->open and leaking a reference in case of a read-only
device.

The mspro_block driver checked for the read-only state in its ->open
handler and returned early without releasing the reference it had taken,
leaking a device reference each time a read-only Memory Stick Pro card was
opened. Repeated opens can exhaust references and interfere with proper
device teardown.

[ Fix ]

jammy/linux: backported from 6dab421bfe06

The fix uses set_disk_ro() to communicate the read-only state to the block
layer at disk registration time, removing the flawed check and reference
leak in ->open. This tree keeps its existing void-style device_add_disk()
call, as the additional error-handling context from upstream is not present
here and is unrelated to this change.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A bad fix would only affect systems using Memory Stick Pro (MS Pro) media
through the memstick/mspro_block driver, most notably workflows that mount
or read write-protected (read-only) MS Pro cards. Systems without such
hardware, or that never load the mspro_block driver, are not affected.

[ Other Info ]

Kybele flow-v11-21-g0f091652. Reference: 7a7bc36d/v1