Documented in 1 files:
Defined in 1 files as a function:
Referenced in 1 files:
Smatch caller information:
drivers/android/binder.c binder_free_transaction() -> binder_thread_dec_tmpref()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | thread | 4096-ptr_max |
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL | |||
| UNITS | 0 | thread | unit_byte |
drivers/android/binder.c binder_get_txn_from_and_acq_inner() -> binder_thread_dec_tmpref()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | thread | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->proc | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->proc->inner_lock.rlock.dep_map->name | 0-255 |
| DATA_SOURCE | 0 | thread | r binder_get_txn_from |
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL |
drivers/android/binder.c binder_send_failed_reply() -> binder_thread_dec_tmpref()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | thread | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->proc | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->proc->inner_lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | thread->reply_error.cmd | 0-29184,29186-u32max |
| CAPPED_DATA | 0 | thread | 1 |
| DATA_SOURCE | 0 | thread | r binder_get_txn_from_and_acq_inner |
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL | |||
| HALF_LOCKED2 | &t->lock |
drivers/android/binder.c binder_set_txn_from_error() -> binder_thread_dec_tmpref()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | thread | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->proc | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->proc->inner_lock.rlock.dep_map->name | 0-255 |
| CAPPED_DATA | 0 | thread | 1 |
| DATA_SOURCE | 0 | thread | r binder_get_txn_from_and_acq_inner |
| NOCHECK_CALL |
drivers/android/binder.c binder_thread_read() -> binder_thread_dec_tmpref()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | thread | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->proc | 4096-ptr_max |
| DATA_SOURCE | 0 | thread | r binder_get_txn_from |
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL |
drivers/android/binder.c binder_thread_read() -> binder_thread_dec_tmpref()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | thread | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->proc | 4096-ptr_max |
| DATA_SOURCE | 0 | thread | r binder_get_txn_from |
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL |
drivers/android/binder.c binder_thread_read() -> binder_thread_dec_tmpref()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | thread | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->proc | 4096-ptr_max |
| DATA_SOURCE | 0 | thread | r binder_get_txn_from |
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL |
drivers/android/binder.c binder_thread_read() -> binder_thread_dec_tmpref()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | thread | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->proc | 4096-ptr_max |
| DATA_SOURCE | 0 | thread | r binder_get_txn_from |
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL |
drivers/android/binder.c binder_thread_release() -> binder_thread_dec_tmpref()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | thread | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->is_dead | 1 |
| PARAM_VALUE | 0 | thread->proc | 4096-ptr_max |
| PARAM_VALUE | 0 | thread->proc->inner_lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | thread->rb_node.rb_left | 0,4096-ptr_max |
| PARAM_VALUE | 0 | thread->rb_node.rb_right | 0,4096-ptr_max |
| PARAM_VALUE | 0 | thread->transaction_stack | 0,4096-ptr_max |
| PARAM_VALUE | 0 | thread->transaction_stack->lock.rlock.dep_map->name | 0-255 |
| BUF_SIZE | 0 | thread | (-1),520 |
| BUF_SIZE | 0 | thread | (-1),520 |
| CAPPED_DATA | 0 | thread | 1 |
| CAPPED_DATA | 0 | &thread->rb_node | 1 |
| DATA_SOURCE | 0 | thread | $1 |
| NOCHECK_CALL | |||
| UNITS | 0 | thread | unit_byte |
| HALF_LOCKED2 | &t->lock |