The reply length is supplied by the USB device as a 32-bit unsigned integer, but ar5523_read_reply() stores it in an int. Values with bit 31 set become negative and bypass the existing signed upper-bound check. memcpy() then converts the value to size_t and overruns the command's small stack output buffer. BUG: KASAN: out-of-bounds in ar5523_cmd_rx_cb Read of size 18446744071562067968 Call Trace: __asan_memcpy ar5523_cmd_rx_cb __usb_hcd_giveback_urb usb_hcd_giveback_urb dummy_timer Kernel panic - not syncing: Fatal exception in interrupt Reject negative lengths through the existing overflow error path. Cc: stable@vger.kernel.org Fixes: b7d572e1871d ("ar5523: Add new driver") Reported-by: co+a27ae3497f0074da@bugs.sh Closes: https://lore.kernel.org/all/K9HvthWDvq4gyjBVMeGsnsvA26mYMZ9v4gW7%40bugs.sh/ Assisted-by: Claude:gpt-5 Signed-off-by: Weiming Shi --- drivers/net/wireless/ath/ar5523/ar5523.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c index 66ac396858a5..176e5de6a64e 100644 --- a/drivers/net/wireless/ath/ar5523/ar5523.c +++ b/drivers/net/wireless/ath/ar5523/ar5523.c @@ -73,7 +73,7 @@ static void ar5523_read_reply(struct ar5523 *ar, struct ar5523_cmd_hdr *hdr, olen = 0; if (cmd->odata) { - if (cmd->olen < olen) { + if (olen < 0 || cmd->olen < olen) { ar5523_err(ar, "olen too small %d < %d\n", cmd->olen, olen); cmd->olen = 0; -- 2.55.0