Re: [PATCH] media: uvcvideo: fix output terminal type check for ID namespace

[Ricardo Ribalda]

Hi Xu

Good catch :)

On Mon, 10 Aug 2026 at 11:21, raoxu <raoxu@xxxxxxxxxxxxx> wrote:
>
> From: Xu Rao <raoxu@xxxxxxxxxxxxx>
>
> Commit 3d9f32e02c2e ("media: uvcvideo: Create an ID namespace for
> streaming output terminals") added a separate internal ID namespace for
> streaming output terminals.  The namespace is only valid for those
> terminals because their descriptor IDs are used by streaming interface
> bTerminalLink fields, and uvc_stream_for_terminal() intentionally masks
> the internal namespace bit when matching that link.
>
> The parser currently decides whether to use the namespace with
> `type & UVC_TT_STREAMING`.  Terminal types are values, not bitmasks.
> Since UVC_TT_STREAMING is 0x0101, standard non-streaming output terminal
> types such as UVC_OTT_VENDOR_SPECIFIC, UVC_OTT_DISPLAY and
> UVC_OTT_MEDIA_TRANSPORT_OUTPUT also make the test true through their
> 0x0100 bits.
>
> Those terminals can then receive an internal ID that differs from their
> descriptor ID even though normal UVC descriptor references still use the
> 8-bit descriptor ID.  This can make later entity lookups fail or hide an
> entity ID collision that should be handled as a regular UVC descriptor
> collision.
>
> Use an equality check so that only UVC_TT_STREAMING output terminals
> enter the separate namespace.  The issue was easy to miss because real
> streaming output terminals make both the bitwise and equality tests true,
> so the devices targeted by the original change keep working.
>
> Fixes: 3d9f32e02c2e ("media: uvcvideo: Create an ID namespace for streaming output terminals")
> Cc: stable@xxxxxxxxxxxxxxx
Reviewed-by: Ricardo Ribalda <ribalda@xxxxxxxxxxxx>
> Signed-off-by: Xu Rao <raoxu@xxxxxxxxxxxxx>
> ---
>  drivers/media/usb/uvc/uvc_driver.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
> index e289cc71ba98..acfc5797a1c2 100644
> --- a/drivers/media/usb/uvc/uvc_driver.c
> +++ b/drivers/media/usb/uvc/uvc_driver.c
> @@ -1130,7 +1130,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
>                  * so limit usage of this separate namespace to streaming output
>                  * terminals.
>                  */
> -               if (type & UVC_TT_STREAMING)
> +               if (type == UVC_TT_STREAMING)
>                         id |= UVC_TERM_OUTPUT;
>
>                 term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT,
> --
> 2.50.1
>
>


-- 
Ricardo Ribalda