[PATCH] media: uvcvideo: fix output terminal type check for ID namespace

[raoxu]

From: Xu Rao <raoxu@xxxxxxxxxxxxx>

Commit 3d9f32e02c2e ("media: uvcvideo: Create an ID namespace for
streaming output terminals") added a separate internal ID namespace for
streaming output terminals.  The namespace is only valid for those
terminals because their descriptor IDs are used by streaming interface
bTerminalLink fields, and uvc_stream_for_terminal() intentionally masks
the internal namespace bit when matching that link.

The parser currently decides whether to use the namespace with
`type & UVC_TT_STREAMING`.  Terminal types are values, not bitmasks.
Since UVC_TT_STREAMING is 0x0101, standard non-streaming output terminal
types such as UVC_OTT_VENDOR_SPECIFIC, UVC_OTT_DISPLAY and
UVC_OTT_MEDIA_TRANSPORT_OUTPUT also make the test true through their
0x0100 bits.

Those terminals can then receive an internal ID that differs from their
descriptor ID even though normal UVC descriptor references still use the
8-bit descriptor ID.  This can make later entity lookups fail or hide an
entity ID collision that should be handled as a regular UVC descriptor
collision.

Use an equality check so that only UVC_TT_STREAMING output terminals
enter the separate namespace.  The issue was easy to miss because real
streaming output terminals make both the bitwise and equality tests true,
so the devices targeted by the original change keep working.

Fixes: 3d9f32e02c2e ("media: uvcvideo: Create an ID namespace for streaming output terminals")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Xu Rao <raoxu@xxxxxxxxxxxxx>
---
 drivers/media/usb/uvc/uvc_driver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index e289cc71ba98..acfc5797a1c2 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -1130,7 +1130,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
 		 * so limit usage of this separate namespace to streaming output
 		 * terminals.
 		 */
-		if (type & UVC_TT_STREAMING)
+		if (type == UVC_TT_STREAMING)
 			id |= UVC_TERM_OUTPUT;

 		term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT,
--
2.50.1