[PATCH BlueZ v2 1/4] sdp-xml: Use a queue to collect sequence members

[PATCH BlueZ v2 1/4] sdp-xml: Use a queue to collect sequence members

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Appending a member to a sequence with sdp_seq_append() walks the
single-linked list to find its tail, so building a sequence is O(n^2).

This was previously worked around by caching the tail of the sequence in
struct sdp_xml_data, which required the caller to pick between appending
to the cached tail and initialising val.dataseq, and to keep the cache in
sync on every append.

Collect the members in a struct queue instead, which tracks its own tail,
and link them into val.dataseq once the element is closed. Appending is a
plain queue_push_tail(), and the queue is destroyed along with the rest
of the element so members that were never linked, such as on malformed
input, are still freed.

The sequence_on_squared() test stays at less than 0.1 seconds.

Assisted-by: Claude:claude-opus-5
---
 Makefile.tools |  4 +++-
 src/sdp-xml.c  | 60 ++++++++++++++++++++++++++++++++++++--------------
 2 files changed, 46 insertions(+), 18 deletions(-)

diff --git a/Makefile.tools b/Makefile.tools
index 1a4e5660813b..b3ef4ae1c3df 100644
--- a/Makefile.tools
+++ b/Makefile.tools
@@ -437,7 +437,9 @@ tools_hciconfig_LDADD = lib/libbluetooth-internal.la
 tools_hcitool_SOURCES = tools/hcitool.c src/oui.h src/oui.c
 tools_hcitool_LDADD = lib/libbluetooth-internal.la $(UDEV_LIBS)
 
-tools_sdptool_SOURCES = tools/sdptool.c src/sdp-xml.h src/sdp-xml.c
+tools_sdptool_SOURCES = tools/sdptool.c src/sdp-xml.h src/sdp-xml.c \
+			src/shared/queue.h src/shared/queue.c \
+			src/shared/util.h src/shared/util.c
 tools_sdptool_LDADD = lib/libbluetooth-internal.la $(GLIB_LIBS)
 
 tools_ciptool_LDADD = lib/libbluetooth-internal.la
diff --git a/src/sdp-xml.c b/src/sdp-xml.c
index 5b448fe83410..bad9e289344f 100644
--- a/src/sdp-xml.c
+++ b/src/sdp-xml.c
@@ -25,6 +25,8 @@
 #include "bluetooth/sdp.h"
 #include "bluetooth/sdp_lib.h"
 
+#include "shared/queue.h"
+
 #include "sdp-xml.h"
 
 #define DBG(...) (void)(0)
@@ -44,7 +46,7 @@ struct sdp_xml_data {
 	char type;			/* 0 = Text or Hexadecimal */
 	char *name;			/* Name, optional in the dtd */
 	/* TODO: What is it used for? */
-	sdp_data_t *tail;		/* Tail for O(1) dataseq append */
+	struct queue *seq;		/* Members of a dataseq, if any */
 };
 
 struct context_data {
@@ -510,8 +512,37 @@ static void element_start(GMarkupParseContext *context,
 	}
 }
 
+/*
+ * Link the members collected in elem->seq into elem->data->val.dataseq.
+ *
+ * Members are collected in a queue so that appending is O(1), sdp_seq_append()
+ * would otherwise have to walk to the tail of the sequence on every append.
+ */
+static void sdp_xml_data_flush_seq(struct sdp_xml_data *elem)
+{
+	const struct queue_entry *entry;
+	sdp_data_t *tail = NULL;
+
+	if (!elem->seq)
+		return;
+
+	for (entry = queue_get_entries(elem->seq); entry; entry = entry->next) {
+		if (tail)
+			sdp_seq_append(tail, entry->data);
+		else
+			elem->data->val.dataseq = sdp_seq_append(NULL,
+								entry->data);
+		tail = entry->data;
+	}
+
+	queue_destroy(elem->seq, NULL);
+	elem->seq = NULL;
+}
+
 static void sdp_xml_data_free(struct sdp_xml_data *elem)
 {
+	queue_destroy(elem->seq, (queue_destroy_func_t) sdp_data_free);
+
 	if (elem->data)
 		sdp_data_free(elem->data);
 
@@ -568,6 +599,8 @@ static void element_end(GMarkupParseContext *context,
 		return;
 	}
 
+	sdp_xml_data_flush_seq(ctx_data->stack_head);
+
 	if (!strcmp(element_name, "sequence")) {
 		if (!SDP_IS_SEQ(ctx_data->stack_head->data->dtd)) {
 			g_set_error(err, G_MARKUP_ERROR,
@@ -610,28 +643,21 @@ static void element_end(GMarkupParseContext *context,
 
 	if (ctx_data->stack_head->next && ctx_data->stack_head->data &&
 					ctx_data->stack_head->next->data) {
-		sdp_data_t *tail;
-		switch (ctx_data->stack_head->next->data->dtd) {
+		struct sdp_xml_data *parent = ctx_data->stack_head->next;
+
+		switch (parent->data->dtd) {
 		case SDP_SEQ8:
 		case SDP_SEQ16:
 		case SDP_SEQ32:
 		case SDP_ALT8:
 		case SDP_ALT16:
 		case SDP_ALT32:
-			tail = ctx_data->stack_head->next->data->val.dataseq ?
-				ctx_data->stack_head->next->tail : NULL;
-			if (tail) {
-				sdp_seq_append(tail,
-					ctx_data->stack_head->data);
-			} else {
-				ctx_data->stack_head->next->data->val.dataseq =
-					sdp_seq_append(NULL,
-						ctx_data->stack_head->data);
-			}
-			ctx_data->stack_head->next->tail =
-					ctx_data->stack_head->data;
-			ctx_data->stack_head->data = NULL;
-			ctx_data->stack_head->tail = NULL;
+			if (!parent->seq)
+				parent->seq = queue_new();
+
+			if (queue_push_tail(parent->seq,
+						ctx_data->stack_head->data))
+				ctx_data->stack_head->data = NULL;
 			break;
 		}
 
-- 
2.54.0

[PATCH BlueZ v2 2/4] sdp-xml: Fix leaking the parse stack on malformed input

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

sdp_xml_parse_record() frees its context but never the elements left on
ctx_data->stack_head.

element_end() returns early without popping the stack when it rejects a
document, for instance on a mismatched </sequence> close, so a malformed
record leaves its elements behind and they are never freed.

Free the remaining stack elements before returning. Found with the
compute-seq-size-type-confusion.xml test:

56 (direct) + 1,072 (indirect) bytes in 1 blocks are definitely lost
   at calloc (vg_replace_malloc.c:1678)
   by sdp_xml_data_alloc (sdp-xml.c:73)
   by element_start (sdp-xml.c:473)
   by g_markup_parse_context_parse (gmarkup.c:1369)
   by sdp_xml_parse_record (sdp-xml.c:696)

Assisted-by: Claude:claude-opus-5
---
 src/sdp-xml.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/sdp-xml.c b/src/sdp-xml.c
index bad9e289344f..bcd5785f87ca 100644
--- a/src/sdp-xml.c
+++ b/src/sdp-xml.c
@@ -551,6 +551,17 @@ static void sdp_xml_data_free(struct sdp_xml_data *elem)
 	free(elem);
 }
 
+/* Free the elements left on the stack, e.g. by a document that is malformed */
+static void sdp_xml_data_free_stack(struct sdp_xml_data *elem)
+{
+	while (elem) {
+		struct sdp_xml_data *next = elem->next;
+
+		sdp_xml_data_free(elem);
+		elem = next;
+	}
+}
+
 static void element_end(GMarkupParseContext *context,
 		const char *element_name, gpointer user_data, GError **err)
 {
@@ -696,6 +707,7 @@ sdp_record_t *sdp_xml_parse_record(const char *data, int size)
 	if (g_markup_parse_context_parse(ctx, data, size, NULL) == FALSE) {
 		error("XML parsing error");
 		g_markup_parse_context_free(ctx);
+		sdp_xml_data_free_stack(ctx_data->stack_head);
 		sdp_record_free(record);
 		free(ctx_data);
 		return NULL;
@@ -703,6 +715,8 @@ sdp_record_t *sdp_xml_parse_record(const char *data, int size)
 
 	g_markup_parse_context_free(ctx);
 
+	sdp_xml_data_free_stack(ctx_data->stack_head);
+
 	free(ctx_data);
 
 	return record;
-- 
2.54.0

[PATCH BlueZ v2 3/4] sdp: Fix memory leak when freeing alternates

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

sdp_data_alloc_with_length() stores the members of SDP_ALT8, SDP_ALT16
and SDP_ALT32 in val.dataseq, exactly like it does for the SDP_SEQ8,
SDP_SEQ16 and SDP_SEQ32 sequences.

sdp_data_free() only calls data_seq_free() for the sequences though, so
freeing an alternate frees the alternate itself and leaks every one of
its members, along with anything they own in turn:

209 (48 direct, 161 indirect) bytes in 1 blocks are definitely lost
   at calloc (vg_replace_malloc.c:1678)
   by sdp_data_alloc_with_length (sdp.c:350)
   by sdp_data_alloc (sdp.c:486)
   by sdp_xml_parse_int (sdp-xml.c:243)
   by sdp_xml_parse_datatype (sdp-xml.c:421)
   by element_start (sdp-xml.c:507)

Free the members of alternates as well.

Assisted-by: Claude:claude-opus-5
---
 lib/bluetooth/sdp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/bluetooth/sdp.c b/lib/bluetooth/sdp.c
index 8c0865398519..1e027f9ebe6d 100644
--- a/lib/bluetooth/sdp.c
+++ b/lib/bluetooth/sdp.c
@@ -972,6 +972,9 @@ void sdp_data_free(sdp_data_t *d)
 	case SDP_SEQ8:
 	case SDP_SEQ16:
 	case SDP_SEQ32:
+	case SDP_ALT8:
+	case SDP_ALT16:
+	case SDP_ALT32:
 		data_seq_free(d);
 		break;
 	case SDP_URL_STR8:
-- 
2.54.0

[PATCH BlueZ v2 4/4] unit/test-sdp-xml: Add a test parsing alternates

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

None of the existing records contain an <alternate>, so nothing covered
the SDP_ALT8, SDP_ALT16 and SDP_ALT32 handling.

Add a record with an alternate holding an integer, a string and a nested
sequence, which leaks its members under valgrind without the previous
sdp_data_free() fix.

Assisted-by: Claude:claude-opus-5
---
 Makefile.am                |  1 +
 unit/sdp-xml/alternate.xml | 12 ++++++++++++
 unit/test-sdp-xml.c        |  1 +
 3 files changed, 14 insertions(+)
 create mode 100644 unit/sdp-xml/alternate.xml

diff --git a/Makefile.am b/Makefile.am
index 3c6cf92ab403..2754e1b7f2da 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -648,6 +648,7 @@ unit_test_sdp_xml_CFLAGS = $(AM_CFLAGS) $(GLIB_CFLAGS) -DTOP_SRCDIR=\""$(srcdir)
 unit_test_sdp_xml_CPPFLAGS = -I$(srcdir)/lib
 
 EXTRA_DIST += unit/sdp-xml/Bluetooth_HID-sdp_record.xml		\
+	unit/sdp-xml/alternate.xml				\
 	unit/sdp-xml/compute-seq-size-type-confusion.xml	\
 	unit/sdp-xml/duplicate-attribute.xml			\
 	unit/sdp-xml/qt-SerialPortSDPRecord.xml
diff --git a/unit/sdp-xml/alternate.xml b/unit/sdp-xml/alternate.xml
new file mode 100644
index 000000000000..a35ebccbc71f
--- /dev/null
+++ b/unit/sdp-xml/alternate.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<record>
+	<attribute id="0x0004">
+		<alternate>
+			<uint32 value="0x11223344" />
+			<text value="alternate-member" />
+			<sequence>
+				<uint16 value="0x0100" />
+			</sequence>
+		</alternate>
+	</attribute>
+</record>
diff --git a/unit/test-sdp-xml.c b/unit/test-sdp-xml.c
index b338788aa295..cb5b91717fca 100644
--- a/unit/test-sdp-xml.c
+++ b/unit/test-sdp-xml.c
@@ -133,6 +133,7 @@ int main(int argc, char *argv[])
 	DEFINE_TEST("compute-seq-size-type-confusion.xml", FALSE);
 	/* From https://github.com/bluez/bluez/security/advisories/GHSA-75v6-6q44-57hc */
 	DEFINE_TEST("duplicate-attribute.xml", TRUE);
+	DEFINE_TEST("alternate.xml", TRUE);
 
 	tester_add("/sequence_on_squared", &data,
 		   sequence_on_squared_setup,
-- 
2.54.0

RE: [BlueZ,v2,1/4] sdp-xml: Use a queue to collect sequence members

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 4634 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1147412

---Test result---

Test Summary:
CheckPatch                    FAIL      1.43 seconds
GitLint                       PASS      0.96 seconds
BuildEll                      PASS      20.76 seconds
BluezMake                     PASS      611.79 seconds
MakeCheck                     PASS      19.04 seconds
MakeDistcheck                 PASS      159.66 seconds
CheckValgrind                 PASS      231.94 seconds
CheckSmatch                   PASS      315.81 seconds
bluezmakeextell               PASS      103.59 seconds
IncrementalBuild              PASS      645.38 seconds
ScanBuild                     PASS      991.07 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ,v2,1/4] sdp-xml: Use a queue to collect sequence members
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#113: 
Assisted-by: Claude:claude-opus-5

ERROR:BAD_SIGN_OFF: Unrecognized email address: 'Claude:claude-opus-5'
#113: 
Assisted-by: Claude:claude-opus-5

/github/workspace/src/patch/14754210.patch total: 1 errors, 1 warnings, 108 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14754210.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


[BlueZ,v2,2/4] sdp-xml: Fix leaking the parse stack on malformed input
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#119: 
Assisted-by: Claude:claude-opus-5

ERROR:BAD_SIGN_OFF: Unrecognized email address: 'Claude:claude-opus-5'
#119: 
Assisted-by: Claude:claude-opus-5

/github/workspace/src/patch/14754211.patch total: 1 errors, 1 warnings, 32 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14754211.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


[BlueZ,v2,3/4] sdp: Fix memory leak when freeing alternates
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#119: 
Assisted-by: Claude:claude-opus-5

ERROR:BAD_SIGN_OFF: Unrecognized email address: 'Claude:claude-opus-5'
#119: 
Assisted-by: Claude:claude-opus-5

/github/workspace/src/patch/14754212.patch total: 1 errors, 1 warnings, 9 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14754212.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


[BlueZ,v2,4/4] unit/test-sdp-xml: Add a test parsing alternates
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#108: 
Assisted-by: Claude:claude-opus-5

ERROR:BAD_SIGN_OFF: Unrecognized email address: 'Claude:claude-opus-5'
#108: 
Assisted-by: Claude:claude-opus-5

/github/workspace/src/patch/14754213.patch total: 1 errors, 1 warnings, 26 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14754213.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.




https://github.com/bluez/bluez/pull/2410

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ v2 1/4] sdp-xml: Use a queue to collect sequence members

[Bastien Nocera]

Patchset looks good to me, thanks.

On Mon, 2026-08-17 at 17:00 -0400, Luiz Augusto von Dentz wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> Appending a member to a sequence with sdp_seq_append() walks the
> single-linked list to find its tail, so building a sequence is
> O(n^2).
> 
> This was previously worked around by caching the tail of the sequence
> in
> struct sdp_xml_data, which required the caller to pick between
> appending
> to the cached tail and initialising val.dataseq, and to keep the
> cache in
> sync on every append.
> 
> Collect the members in a struct queue instead, which tracks its own
> tail,
> and link them into val.dataseq once the element is closed. Appending
> is a
> plain queue_push_tail(), and the queue is destroyed along with the
> rest
> of the element so members that were never linked, such as on
> malformed
> input, are still freed.
> 
> The sequence_on_squared() test stays at less than 0.1 seconds.
> 
> Assisted-by: Claude:claude-opus-5
> ---
>  Makefile.tools |  4 +++-
>  src/sdp-xml.c  | 60 ++++++++++++++++++++++++++++++++++++------------
> --
>  2 files changed, 46 insertions(+), 18 deletions(-)
> 
> diff --git a/Makefile.tools b/Makefile.tools
> index 1a4e5660813b..b3ef4ae1c3df 100644
> --- a/Makefile.tools
> +++ b/Makefile.tools
> @@ -437,7 +437,9 @@ tools_hciconfig_LDADD = lib/libbluetooth-
> internal.la
>  tools_hcitool_SOURCES = tools/hcitool.c src/oui.h src/oui.c
>  tools_hcitool_LDADD = lib/libbluetooth-internal.la $(UDEV_LIBS)
>  
> -tools_sdptool_SOURCES = tools/sdptool.c src/sdp-xml.h src/sdp-xml.c
> +tools_sdptool_SOURCES = tools/sdptool.c src/sdp-xml.h src/sdp-xml.c
> \
> +			src/shared/queue.h src/shared/queue.c \
> +			src/shared/util.h src/shared/util.c
>  tools_sdptool_LDADD = lib/libbluetooth-internal.la $(GLIB_LIBS)
>  
>  tools_ciptool_LDADD = lib/libbluetooth-internal.la
> diff --git a/src/sdp-xml.c b/src/sdp-xml.c
> index 5b448fe83410..bad9e289344f 100644
> --- a/src/sdp-xml.c
> +++ b/src/sdp-xml.c
> @@ -25,6 +25,8 @@
>  #include "bluetooth/sdp.h"
>  #include "bluetooth/sdp_lib.h"
>  
> +#include "shared/queue.h"
> +
>  #include "sdp-xml.h"
>  
>  #define DBG(...) (void)(0)
> @@ -44,7 +46,7 @@ struct sdp_xml_data {
>  	char type;			/* 0 = Text or Hexadecimal
> */
>  	char *name;			/* Name, optional in the dtd
> */
>  	/* TODO: What is it used for? */
> -	sdp_data_t *tail;		/* Tail for O(1) dataseq
> append */
> +	struct queue *seq;		/* Members of a dataseq, if
> any */
>  };
>  
>  struct context_data {
> @@ -510,8 +512,37 @@ static void element_start(GMarkupParseContext
> *context,
>  	}
>  }
>  
> +/*
> + * Link the members collected in elem->seq into elem->data-
> >val.dataseq.
> + *
> + * Members are collected in a queue so that appending is O(1),
> sdp_seq_append()
> + * would otherwise have to walk to the tail of the sequence on every
> append.
> + */
> +static void sdp_xml_data_flush_seq(struct sdp_xml_data *elem)
> +{
> +	const struct queue_entry *entry;
> +	sdp_data_t *tail = NULL;
> +
> +	if (!elem->seq)
> +		return;
> +
> +	for (entry = queue_get_entries(elem->seq); entry; entry =
> entry->next) {
> +		if (tail)
> +			sdp_seq_append(tail, entry->data);
> +		else
> +			elem->data->val.dataseq =
> sdp_seq_append(NULL,
> +								entr
> y->data);
> +		tail = entry->data;
> +	}
> +
> +	queue_destroy(elem->seq, NULL);
> +	elem->seq = NULL;
> +}
> +
>  static void sdp_xml_data_free(struct sdp_xml_data *elem)
>  {
> +	queue_destroy(elem->seq, (queue_destroy_func_t)
> sdp_data_free);
> +
>  	if (elem->data)
>  		sdp_data_free(elem->data);
>  
> @@ -568,6 +599,8 @@ static void element_end(GMarkupParseContext
> *context,
>  		return;
>  	}
>  
> +	sdp_xml_data_flush_seq(ctx_data->stack_head);
> +
>  	if (!strcmp(element_name, "sequence")) {
>  		if (!SDP_IS_SEQ(ctx_data->stack_head->data->dtd)) {
>  			g_set_error(err, G_MARKUP_ERROR,
> @@ -610,28 +643,21 @@ static void element_end(GMarkupParseContext
> *context,
>  
>  	if (ctx_data->stack_head->next && ctx_data->stack_head->data
> &&
>  					ctx_data->stack_head->next-
> >data) {
> -		sdp_data_t *tail;
> -		switch (ctx_data->stack_head->next->data->dtd) {
> +		struct sdp_xml_data *parent = ctx_data->stack_head-
> >next;
> +
> +		switch (parent->data->dtd) {
>  		case SDP_SEQ8:
>  		case SDP_SEQ16:
>  		case SDP_SEQ32:
>  		case SDP_ALT8:
>  		case SDP_ALT16:
>  		case SDP_ALT32:
> -			tail = ctx_data->stack_head->next->data-
> >val.dataseq ?
> -				ctx_data->stack_head->next->tail :
> NULL;
> -			if (tail) {
> -				sdp_seq_append(tail,
> -					ctx_data->stack_head->data);
> -			} else {
> -				ctx_data->stack_head->next->data-
> >val.dataseq =
> -					sdp_seq_append(NULL,
> -						ctx_data-
> >stack_head->data);
> -			}
> -			ctx_data->stack_head->next->tail =
> -					ctx_data->stack_head->data;
> -			ctx_data->stack_head->data = NULL;
> -			ctx_data->stack_head->tail = NULL;
> +			if (!parent->seq)
> +				parent->seq = queue_new();
> +
> +			if (queue_push_tail(parent->seq,
> +						ctx_data-
> >stack_head->data))
> +				ctx_data->stack_head->data = NULL;
>  			break;
>  		}
>  

Re: [PATCH BlueZ v2 1/4] sdp-xml: Use a queue to collect sequence members

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 17 Aug 2026 17:00:35 -0400 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> Appending a member to a sequence with sdp_seq_append() walks the
> single-linked list to find its tail, so building a sequence is O(n^2).
> 
> This was previously worked around by caching the tail of the sequence in
> struct sdp_xml_data, which required the caller to pick between appending
> to the cached tail and initialising val.dataseq, and to keep the cache in
> sync on every append.
> 
> [...]

Here is the summary with links:
  - [BlueZ,v2,1/4] sdp-xml: Use a queue to collect sequence members
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=b21edc49b2c3
  - [BlueZ,v2,2/4] sdp-xml: Fix leaking the parse stack on malformed input
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=97521ab4dd79
  - [BlueZ,v2,3/4] sdp: Fix memory leak when freeing alternates
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=078ef10a4531
  - [BlueZ,v2,4/4] unit/test-sdp-xml: Add a test parsing alternates
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=5abc0045b84a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html