Re: [PATCH] media: uvcvideo: fix output terminal type check for ID namespace

[Laurent Pinchart <laurent.pinchart@ideasonboard.com>]

On Mon, Aug 10, 2026 at 05:16:24PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> Commit 3d9f32e02c2e ("media: uvcvideo: Create an ID namespace for
> streaming output terminals") added a separate internal ID namespace for
> streaming output terminals.  The namespace is only valid for those
> terminals because their descriptor IDs are used by streaming interface
> bTerminalLink fields, and uvc_stream_for_terminal() intentionally masks
> the internal namespace bit when matching that link.
> 
> The parser currently decides whether to use the namespace with
> `type & UVC_TT_STREAMING`.  Terminal types are values, not bitmasks.
> Since UVC_TT_STREAMING is 0x0101, standard non-streaming output terminal
> types such as UVC_OTT_VENDOR_SPECIFIC, UVC_OTT_DISPLAY and
> UVC_OTT_MEDIA_TRANSPORT_OUTPUT also make the test true through their
> 0x0100 bits.
> 
> Those terminals can then receive an internal ID that differs from their
> descriptor ID even though normal UVC descriptor references still use the
> 8-bit descriptor ID.  This can make later entity lookups fail or hide an
> entity ID collision that should be handled as a regular UVC descriptor
> collision.
> 
> Use an equality check so that only UVC_TT_STREAMING output terminals
> enter the separate namespace.  The issue was easy to miss because real
> streaming output terminals make both the bitwise and equality tests true,
> so the devices targeted by the original change keep working.

That's a long commit message, and a large part of it is quite
irrelevant. Is this patch missing an Assisted-by tag ?

> Fixes: 3d9f32e02c2e ("media: uvcvideo: Create an ID namespace for streaming output terminals")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xu Rao <raoxu@uniontech.com>
> ---
>  drivers/media/usb/uvc/uvc_driver.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
> index e289cc71ba98..acfc5797a1c2 100644
> --- a/drivers/media/usb/uvc/uvc_driver.c
> +++ b/drivers/media/usb/uvc/uvc_driver.c
> @@ -1130,7 +1130,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
>  		 * so limit usage of this separate namespace to streaming output
>  		 * terminals.
>  		 */
> -		if (type & UVC_TT_STREAMING)
> +		if (type == UVC_TT_STREAMING)
>  			id |= UVC_TERM_OUTPUT;
> 
>  		term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT,

-- 
Regards,

Laurent Pinchart