Re: [PATCH RFC] wifi: zd1211rw: reject secondary interfaces to prevent conflicts

On lip 20, 2026 11:46, 'syzbot' via syzkaller-upstream-moderation wrote:
> The zd1211rw driver is designed for single-function Wi-Fi dongles and
> hardcodes its USB endpoints. When a malformed USB device exposes multiple
> interfaces that match the driver's device ID, the driver blindly binds to
> all of them. This leads to two critical issues.
> 
> First, multiple driver instances attempt to submit URBs to the exact same
> hardcoded endpoints concurrently. This overloads the endpoint's periodic
> bandwidth or queue limits, resulting in -EAGAIN (-11) errors during I/O
> operations.

I'm a bit lost here. Can you explain why we see -EAGAIN error in logs?

Maybe the -EAGAIN error is caused because we do not have real true device? If this is the case, I
would not add this paragraph to the commit message.

> Second, during probe(), the driver calls usb_reset_device(), which iterates
> over all interfaces and invokes the pre_reset() callback for each bound
> interface. Since multiple interfaces are bound to zd1211rw, pre_reset() is
> called sequentially for each instance, acquiring their respective
> &mac->chip.mutex. Because all instances initialize their mutexes with the
> same lock class, lockdep detects a task acquiring a lock of the same class
> it already holds and flags it as a possible recursive deadlock:
> 
> ============================================

Please remove this line with only =.

> WARNING: possible recursive locking detected
> ...
> kworker/0:0/4961 is trying to acquire lock:
> ffff888105315de0 (&chip->mutex){+.+.}-{4:4}, at:
> zd_chip_disable_rxtx+0x20/0x50
> drivers/net/wireless/zydas/zd1211rw/zd_chip.c:1465
> 
> but task is already holding lock:
> ffff8881129cdde0 (&chip->mutex){+.+.}-{4:4}, at: pre_reset+0x28c/0x380
> drivers/net/wireless/zydas/zd1211rw/zd_usb.c:1505
> 
> Fix this by explicitly rejecting secondary interfaces (bInterfaceNumber !=
> 0) during probe(). This ensures that only a single instance of the driver
> binds to the device, eliminating both the endpoint conflicts and the
> recursive locking scenario.
> 
> Fixes: e85d0918b54f ("[PATCH] ZyDAS ZD1211 USB-WLAN driver")
> Assisted-by: Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=0ec3d1a6cf1fbe79c153
> Link: https://syzkaller.appspot.com/ai_job?id=31453070-c764-4248-98b8-5f0a8f8393c3
> To: <[email protected]>
> To: "Daniel Drake" <[email protected]>
> Cc: "Bjorn Helgaas" <[email protected]>
> Cc: "Johannes Berg" <[email protected]>
> Cc: "Kees Cook" <[email protected]>
> Cc: <[email protected]>
> Cc: "Abdun Nihaal" <[email protected]>
> 
> ---
> diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
> index 966d8ccb0..2bb2df12c 100644
> --- a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
> +++ b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
> @@ -1353,6 +1353,13 @@ static int probe(struct usb_interface *intf, const struct usb_device_id *id)
>  	struct zd_usb *usb;
>  	struct ieee80211_hw *hw = NULL;
>  
> +	/* ZD1211 devices are single-function. Reject secondary interfaces
> +	 * to prevent multiple instances from conflicting on hardcoded endpoints
> +	 * and triggering recursive locking warnings.
> +	 */
> +	if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
> +		return -ENODEV;
> +
>  	print_id(udev);
>  
>  	if (id->driver_info & DEVICE_INSTALLER)
> 
> 
> base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f

-- 
Slawomir Stepien