mtd_read_oob() can reject an invalid OOB range before initializing ops->stats. mtdchar_read_ioctl() nevertheless accumulates the per-read statistics before checking the return code and copies the accumulated values back to userspace, even when the ioctl returns an error. Initialize the local statistics on every loop iteration so a rejected read contributes zero counters and preserves statistics from any earlier completed reads. Fixes: 095bb6e44eb1 ("mtdchar: add MEMREAD ioctl") Cc: stable@vger.kernel.org Signed-off-by: James Hilliard --- drivers/mtd/mtdchar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index bf01e6ac7293..cbc7114686b9 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -750,7 +750,7 @@ mtdchar_read_ioctl(struct mtd_info *mtd, struct mtd_read_req __user *argp) } while (req.len > 0 || (!usr_data && req.ooblen > 0)) { - struct mtd_req_stats stats; + struct mtd_req_stats stats = {}; struct mtd_oob_ops ops = { .mode = req.mode, .len = min_t(size_t, req.len, datbuf_len), --- base-commit: 1c1a342aceec79528b3ba51f376eca2be5928fe7 change-id: 20261106-submit-mtdchar-read-stats-v1-af3ea2996288 Best regards, -- James Hilliard