binder_get_object identifier - Linux source code next-20260811

Projects

linux

Versions

FIXME
- FIXME
  - next-20260811

Documented in 1 files:

drivers/android/binder.c, line 1781

Defined in 1 files as a function:

drivers/android/binder.c, line 1797 (as a function)

Referenced in 1 files:

drivers/android/binder.c

Smatch caller information:

drivers/android/binder.c binder_transaction() -> binder_get_object()

Type	Parameter	Key	Value
PARAM_VALUE	0	proc	4096-ptr_max
PARAM_VALUE	0	proc->alloc->pages	1-u64max
PARAM_VALUE	0	proc->alloc.allocated_buffers.rb_node	4096-ptr_max
PARAM_VALUE	0	proc->alloc.free_async_space	1-9223372036854775799
PARAM_VALUE	0	proc->alloc.free_buffers.rb_node	4096-ptr_max
PARAM_VALUE	0	proc->alloc.mapped	1
PARAM_VALUE	0	proc->alloc.mm->async_put_work.entry.next->prev	4096-ptr_max
PARAM_VALUE	0	proc->alloc.mm->mmap_lock.first_waiter->handoff_set	0-1
PARAM_VALUE	0	proc->alloc.mm->mmap_lock.first_waiter->type	0-1
PARAM_VALUE	0	proc->alloc.pages_high	1-u64max
PARAM_VALUE	2	buffer	4096-ptr_max
PARAM_VALUE	2	buffer->allow_user_free	0
PARAM_VALUE	2	buffer->free	0
PARAM_VALUE	2	buffer->rb_node.__rb_parent_color	1
PARAM_VALUE	2	buffer->rb_node.rb_left	4096-ptr_max
PARAM_VALUE	2	buffer->rb_node.rb_right	4096-ptr_max
PARAM_VALUE	2	buffer->target_node	0,4096-ptr_max
PARAM_VALUE	2	buffer->target_node->proc	4096-ptr_max
PARAM_VALUE	2	buffer->transaction	4096-ptr_max
PARAM_VALUE	2	buffer->transaction->buffer	4096-ptr_max
PARAM_VALUE	2	buffer->transaction->fd_fixups.next	4096-ptr_max
PARAM_VALUE	2	buffer->transaction->fd_fixups.prev	4096-ptr_max
PARAM_VALUE	2	buffer->transaction->priority	s32min-s32max
PARAM_VALUE	2	buffer->transaction->to_proc	4096-ptr_max
PARAM_VALUE	2	buffer->transaction->work.type	1
PARAM_VALUE	4	object	9106220478677114880
BUF_SIZE	2	buffer->transaction	232
CAPPED_DATA	0	proc	1
CAPPED_DATA	2	buffer->data_size	1
CAPPED_DATA	2	buffer->extra_buffers_size	1
CAPPED_DATA	2	buffer->offsets_size	1
DATA_SOURCE	2	buffer	r binder_alloc_new_buf
NOSPEC	2	buffer->data_size
USER_DATA	0	proc->alloc.free_async_space	1-9223372036854775798[c][u]
USER_DATA	2	buffer->async_transaction	0-1
USER_DATA	2	buffer->clear_on_free	0-1
USER_DATA	2	buffer->data_size	0-u64max[c]
USER_DATA	2	buffer->extra_buffers_size	0-u64max[c]
USER_DATA	2	buffer->offsets_size	0-u64max[c]
USER_DATA	2	buffer->transaction->code	0-u32max
USER_DATA	2	buffer->transaction->flags	0-u32max
USER_DATA	2	buffer->transaction->is_async	0-1
USER_DATA	2	buffer->transaction->security_ctx	0-u64max[c]
UNITS	0	proc	unit_byte
UNITS	3	offset	unit_byte

drivers/android/binder.c binder_transaction_buffer_release() -> binder_get_object()

Type	Parameter	Key	Value
PARAM_VALUE	0	proc	4096-ptr_max
PARAM_VALUE	0	proc->inner_lock.rlock.dep_map->name	0-255
PARAM_VALUE	1	u	0
PARAM_VALUE	2	buffer	4096-ptr_max
PARAM_VALUE	2	buffer->free	0
PARAM_VALUE	2	buffer->target_node	0,4096-ptr_max
PARAM_VALUE	2	buffer->target_node->dead_node->next->pprev	1-u64max
PARAM_VALUE	2	buffer->target_node->lock.rlock.dep_map->name	0-255
PARAM_VALUE	2	buffer->target_node->proc->inner_lock.rlock.dep_map->name	0-255
PARAM_VALUE	2	buffer->target_node->proc->nodes.rb_node	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->proc->todo.prev	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->proc->todo.prev->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->proc->todo.prev->next->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.next->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.next->prev	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.prev->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.prev->prev	4096-ptr_max
PARAM_VALUE	2	buffer->transaction	0
PARAM_VALUE	4	object	3938605042311122944
BUF_SIZE	0	proc	s32min-(-1),1-s32max
BUF_SIZE	0	proc	s32min-(-1),1-s32max
CAPPED_DATA	0	proc	1
CAPPED_DATA	2	buffer->target_node	1
DATA_SOURCE	0	proc	$0
DATA_SOURCE	2	buffer	$2
TASK_NOT_RUNNING
USER_DATA	2	buffer->user_data	0-u64max[c]
UNITS	0	proc	unit_byte

drivers/android/binder.c binder_validate_fixup() -> binder_get_object()

Type	Parameter	Key	Value
PARAM_VALUE	0	proc->alloc.mm->mmap_lock.first_waiter->handoff_set	0-1
PARAM_VALUE	0	proc->alloc.mm->mmap_lock.first_waiter->type	0-1
PARAM_VALUE	1	u	0
PARAM_VALUE	2	buffer->data_size	24-u64max
PARAM_VALUE	2	buffer->free	0
PARAM_VALUE	4	object	1222858552098054144
CAPPED_DATA	2	buffer->data_size	1
DATA_SOURCE	0	proc	$0
DATA_SOURCE	2	buffer	$1
DATA_SOURCE	3	offset	$5 [m]
UNITS	0	proc	unit_byte

drivers/android/binder.c binder_validate_ptr() -> binder_get_object()

Type	Parameter	Key	Value
PARAM_VALUE	0	proc->alloc.mm->mmap_lock.first_waiter->handoff_set	0-1
PARAM_VALUE	0	proc->alloc.mm->mmap_lock.first_waiter->type	0-1
PARAM_VALUE	1	u	0
PARAM_VALUE	2	buffer	4096-ptr_max
PARAM_VALUE	2	buffer->free	0
PARAM_VALUE	4	object	8011661200560672768,8049513855744712704,8262723056086933504
BUF_SIZE	0	proc	s32min-(-1),1-s32max
BUF_SIZE	0	proc	s32min-(-1),1-s32max
BUF_SIZE	2	buffer->transaction	(-1),232
DATA_SOURCE	0	proc	$0
DATA_SOURCE	2	buffer	$1
DATA_SOURCE	4	object	$2
NOSPEC	2	buffer->data_size
TASK_NOT_RUNNING
USER_DATA	0	proc->alloc.free_async_space	1-9223372036854775798[c][u]
USER_DATA	2	buffer->async_transaction	0-1
USER_DATA	2	buffer->clear_on_free	0-1
USER_DATA	2	buffer->data_size	24-u64max[c]
USER_DATA	2	buffer->extra_buffers_size	0-u64max[c]
USER_DATA	2	buffer->offsets_size	0-u64max[c]
USER_DATA	2	buffer->transaction->code	0-u32max
USER_DATA	2	buffer->transaction->flags	0-u32max
USER_DATA	2	buffer->transaction->is_async	0-1
USER_DATA	2	buffer->transaction->security_ctx	0-u64max[c]
USER_DATA	2	buffer->user_data	0-u64max[c]
UNITS	0	proc	unit_byte