The reply length is supplied by the USB device as a 32-bit unsigned
integer, but ar5523_read_reply() stores it in an int.  Values with bit 31
set become negative and bypass the existing signed upper-bound check.
memcpy() then converts the value to size_t and overruns the command's small
stack output buffer.

  BUG: KASAN: out-of-bounds in ar5523_cmd_rx_cb
  Read of size 18446744071562067968
  Call Trace:
   __asan_memcpy
   ar5523_cmd_rx_cb
   __usb_hcd_giveback_urb
   usb_hcd_giveback_urb
   dummy_timer
  Kernel panic - not syncing: Fatal exception in interrupt

Reject negative lengths through the existing overflow error path.

Cc: stable@vger.kernel.org
Fixes: b7d572e1871d ("ar5523: Add new driver")
Reported-by: co+a27ae3497f0074da@bugs.sh
Closes: https://lore.kernel.org/all/K9HvthWDvq4gyjBVMeGsnsvA26mYMZ9v4gW7%40bugs.sh/
Assisted-by: Claude:gpt-5
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 drivers/net/wireless/ath/ar5523/ar5523.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 66ac396858a5..176e5de6a64e 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -73,7 +73,7 @@ static void ar5523_read_reply(struct ar5523 *ar, struct ar5523_cmd_hdr *hdr,
 		olen = 0;
 
 	if (cmd->odata) {
-		if (cmd->olen < olen) {
+		if (olen < 0 || cmd->olen < olen) {
 			ar5523_err(ar, "olen too small %d < %d\n",
 				   cmd->olen, olen);
 			cmd->olen = 0;
-- 
2.55.0