Documented in 1 files:
Defined in 1 files as a prototype:
Defined in 1 files as a function:
Referenced in 1 files:
Smatch caller information:
drivers/android/binder.c binder_do_deferred_txn_copies() -> binder_alloc_copy_user_to_buffer()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 3 | from | 4096-ptr_max |
| PARAM_VALUE | 4 | bytes | 1-u64max |
| CAPPED_DATA | 4 | bytes | 1 |
| CAPPED_DATA | 4 | bytes | 1 |
| DATA_SOURCE | 0 | alloc | $0 |
| DATA_SOURCE | 1 | buffer | $1 |
| UNITS | 2 | buffer_offset | unit_byte |
| UNITS | 3 | from | unit_byte |
| UNITS | 4 | bytes | unit_byte |
drivers/android/binder.c binder_transaction() -> binder_alloc_copy_user_to_buffer()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | alloc | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->allocated_buffers.rb_node | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->free_async_space | 1-9223372036854775799 |
| PARAM_VALUE | 0 | alloc->free_buffers.rb_node | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->mapped | 1 |
| PARAM_VALUE | 0 | alloc->pages_high | 1-u64max |
| PARAM_VALUE | 1 | buffer | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->allow_user_free | 0 |
| PARAM_VALUE | 1 | buffer->free | 0 |
| PARAM_VALUE | 1 | buffer->rb_node.__rb_parent_color | 1 |
| PARAM_VALUE | 1 | buffer->rb_node.rb_left | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->rb_node.rb_right | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node | 0,4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->proc | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction->buffer | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction->fd_fixups.next | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction->fd_fixups.prev | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction->priority | s32min-s32max |
| PARAM_VALUE | 1 | buffer->transaction->to_proc | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction->work.type | 1 |
| PARAM_VALUE | 2 | buffer_offset | 0,8-u64max |
| BUF_SIZE | 1 | buffer->transaction | 232 |
| CAPPED_DATA | 1 | buffer->data_size | 1 |
| CAPPED_DATA | 1 | buffer->extra_buffers_size | 1 |
| CAPPED_DATA | 1 | buffer->offsets_size | 1 |
| CAPPED_DATA | 2 | buffer_offset | 1 |
| CAPPED_DATA | 4 | bytes | 1 |
| CAPPED_DATA | 4 | bytes | 1 |
| DATA_SOURCE | 1 | buffer | r binder_alloc_new_buf |
| BIT_INFO | 2 | buffer_offset | 0x0,0xfffffffffffffff8 |
| NOSPEC | 1 | buffer->data_size | |
| USER_DATA | 0 | alloc->free_async_space | 1-9223372036854775798[c][u] |
| USER_DATA | 1 | buffer->async_transaction | 0-1 |
| USER_DATA | 1 | buffer->clear_on_free | 0-1 |
| USER_DATA | 1 | buffer->data_size | 0-u64max[c] |
| USER_DATA | 1 | buffer->extra_buffers_size | 0-u64max[c] |
| USER_DATA | 1 | buffer->offsets_size | 0-u64max[c] |
| USER_DATA | 1 | buffer->transaction->code | 0-u32max |
| USER_DATA | 1 | buffer->transaction->flags | 0-u32max |
| USER_DATA | 1 | buffer->transaction->is_async | 0-1 |
| USER_DATA | 1 | buffer->transaction->security_ctx | 0-u64max[c] |
| USER_DATA | 2 | buffer_offset | 0,8-u64max[c] |
| USER_DATA | 4 | bytes | 0-u64max[c] |
| UNITS | 4 | bytes | unit_byte |
drivers/android/binder.c binder_transaction() -> binder_alloc_copy_user_to_buffer()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | alloc | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->allocated_buffers.rb_node | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->free_async_space | 1-9223372036854775799 |
| PARAM_VALUE | 0 | alloc->free_buffers.rb_node | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->mapped | 1 |
| PARAM_VALUE | 0 | alloc->pages_high | 1-u64max |
| PARAM_VALUE | 1 | buffer | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->allow_user_free | 0 |
| PARAM_VALUE | 1 | buffer->free | 0 |
| PARAM_VALUE | 1 | buffer->rb_node.__rb_parent_color | 1 |
| PARAM_VALUE | 1 | buffer->rb_node.rb_left | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->rb_node.rb_right | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node | 0,4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->proc | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction->buffer | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction->fd_fixups.next | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction->fd_fixups.prev | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction->priority | s32min-s32max |
| PARAM_VALUE | 1 | buffer->transaction->to_proc | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction->work.type | 1 |
| PARAM_VALUE | 2 | buffer_offset | 0 |
| PARAM_VALUE | 4 | bytes | 1-u64max |
| BUF_SIZE | 1 | buffer->transaction | 232 |
| CAPPED_DATA | 1 | buffer->data_size | 1 |
| CAPPED_DATA | 1 | buffer->extra_buffers_size | 1 |
| CAPPED_DATA | 1 | buffer->offsets_size | 1 |
| DATA_SOURCE | 1 | buffer | r binder_alloc_new_buf |
| NOSPEC | 1 | buffer->data_size | |
| USER_DATA | 0 | alloc->free_async_space | 1-9223372036854775798[c][u] |
| USER_DATA | 1 | buffer->async_transaction | 0-1 |
| USER_DATA | 1 | buffer->clear_on_free | 0-1 |
| USER_DATA | 1 | buffer->data_size | 0-u64max[c] |
| USER_DATA | 1 | buffer->extra_buffers_size | 0-u64max[c] |
| USER_DATA | 1 | buffer->offsets_size | 0-u64max[c] |
| USER_DATA | 1 | buffer->transaction->code | 0-u32max |
| USER_DATA | 1 | buffer->transaction->flags | 0-u32max |
| USER_DATA | 1 | buffer->transaction->is_async | 0-1 |
| USER_DATA | 1 | buffer->transaction->security_ctx | 0-u64max[c] |
| UNITS | 4 | bytes | unit_byte |