Re: [PATCH] memstick: ms_block: Fix memcmp() size in msb_resume card validation

[Ulf Hansson]

On Fri, Aug 28, 2026 at 5:44 AM Haotian Zhang <vulab@xxxxxxxxxxx> wrote:
>
> In msb_resume(), the LBA-to-PBA table comparison passes
> the entry count msb->logical_block_count directly to memcmp().
> Since msb->lba_to_pba_table is an array of u16, only half
> of the table is compared, so a replaced or changed card whose
> mapping differs only in the latter entries can be wrongly
> treated as the same card, keeping stale cache/FTL state.
>
> Change the memcmp() size argument to msb->logical_block_count *
> sizeof(*msb->lba_to_pba_table) so that the full table
> is compared.

I don't have the sony memory stick spec at hand, but could it be that
the comparison deliberately is done like it is?

Kind regards
Uffe

>
> Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
> Signed-off-by: Haotian Zhang <vulab@xxxxxxxxxxx>
> ---
>  drivers/memstick/core/ms_block.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
> index 1af157ce0a63..589ee2eb1a60 100644
> --- a/drivers/memstick/core/ms_block.c
> +++ b/drivers/memstick/core/ms_block.c
> @@ -2246,7 +2246,7 @@ static int msb_resume(struct memstick_dev *card)
>
>         if (msb->logical_block_count != new_msb->logical_block_count ||
>                 memcmp(msb->lba_to_pba_table, new_msb->lba_to_pba_table,
> -                                               msb->logical_block_count))
> +                       msb->logical_block_count * sizeof(*msb->lba_to_pba_table)))
>                 goto out;
>
>         if (msb->block_count != new_msb->block_count ||
> --
> 2.43.0