In msb_resume(), the LBA-to-PBA table comparison passes
the entry count msb->logical_block_count directly to memcmp().
Since msb->lba_to_pba_table is an array of u16, only half
of the table is compared, so a replaced or changed card whose
mapping differs only in the latter entries can be wrongly
treated as the same card, keeping stale cache/FTL state.

Change the memcmp() size argument to msb->logical_block_count *
sizeof(*msb->lba_to_pba_table) so that the full table
is compared.

Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/memstick/core/ms_block.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index 1af157ce0a63..589ee2eb1a60 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -2246,7 +2246,7 @@ static int msb_resume(struct memstick_dev *card)
 
 	if (msb->logical_block_count != new_msb->logical_block_count ||
 		memcmp(msb->lba_to_pba_table, new_msb->lba_to_pba_table,
-						msb->logical_block_count))
+			msb->logical_block_count * sizeof(*msb->lba_to_pba_table)))
 		goto out;
 
 	if (msb->block_count != new_msb->block_count ||
-- 
2.43.0

On Fri, Aug 28, 2026 at 5:44 AM Haotian Zhang <vulab@iscas.ac.cn> wrote:
>
> In msb_resume(), the LBA-to-PBA table comparison passes
> the entry count msb->logical_block_count directly to memcmp().
> Since msb->lba_to_pba_table is an array of u16, only half
> of the table is compared, so a replaced or changed card whose
> mapping differs only in the latter entries can be wrongly
> treated as the same card, keeping stale cache/FTL state.
>
> Change the memcmp() size argument to msb->logical_block_count *
> sizeof(*msb->lba_to_pba_table) so that the full table
> is compared.

I don't have the sony memory stick spec at hand, but could it be that
the comparison deliberately is done like it is?

Kind regards
Uffe

>
> Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
> ---
>  drivers/memstick/core/ms_block.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
> index 1af157ce0a63..589ee2eb1a60 100644
> --- a/drivers/memstick/core/ms_block.c
> +++ b/drivers/memstick/core/ms_block.c
> @@ -2246,7 +2246,7 @@ static int msb_resume(struct memstick_dev *card)
>
>         if (msb->logical_block_count != new_msb->logical_block_count ||
>                 memcmp(msb->lba_to_pba_table, new_msb->lba_to_pba_table,
> -                                               msb->logical_block_count))
> +                       msb->logical_block_count * sizeof(*msb->lba_to_pba_table)))
>                 goto out;
>
>         if (msb->block_count != new_msb->block_count ||
> --
> 2.43.0