Open Menu /

Documented in 1 files:

Defined in 1 files as a function:

Referenced in 1 files:

Smatch caller information:

drivers/android/binder.c binder_fixup_parent() -> binder_validate_fixup()

Type Parameter Key Value
PARAM_VALUE 1 b->data_size 24-u64max
PARAM_VALUE 1 b->free 0
DATA_SOURCE 2 objects_start_offset $4
DATA_SOURCE 5 last_obj_offset $6
DATA_SOURCE 6 last_min_offset $7
UNITS 0 proc unit_byte
UNITS 4 fixup_offset unit_byte

drivers/android/binder.c binder_transaction() -> binder_validate_fixup()

Type Parameter Key Value
PARAM_VALUE 0 proc 4096-ptr_max
PARAM_VALUE 0 proc->alloc->pages 1-u64max
PARAM_VALUE 0 proc->alloc.allocated_buffers.rb_node 4096-ptr_max
PARAM_VALUE 0 proc->alloc.free_async_space 1-9223372036854775799
PARAM_VALUE 0 proc->alloc.free_buffers.rb_node 4096-ptr_max
PARAM_VALUE 0 proc->alloc.mapped 1
PARAM_VALUE 0 proc->alloc.mm->async_put_work.entry.next->prev 4096-ptr_max
PARAM_VALUE 0 proc->alloc.mm->mmap_lock.first_waiter->handoff_set 0-1
PARAM_VALUE 0 proc->alloc.mm->mmap_lock.first_waiter->type 0-1
PARAM_VALUE 0 proc->alloc.pages_high 1-u64max
PARAM_VALUE 1 b 4096-ptr_max
PARAM_VALUE 1 b->allow_user_free 0
PARAM_VALUE 1 b->data_size 24-u64max
PARAM_VALUE 1 b->free 0
PARAM_VALUE 1 b->rb_node.__rb_parent_color 1
PARAM_VALUE 1 b->rb_node.rb_left 4096-ptr_max
PARAM_VALUE 1 b->rb_node.rb_right 4096-ptr_max
PARAM_VALUE 1 b->target_node 0,4096-ptr_max
PARAM_VALUE 1 b->target_node->proc 4096-ptr_max
PARAM_VALUE 1 b->transaction 4096-ptr_max
PARAM_VALUE 1 b->transaction->buffer 4096-ptr_max
PARAM_VALUE 1 b->transaction->fd_fixups.next 4096-ptr_max
PARAM_VALUE 1 b->transaction->fd_fixups.prev 4096-ptr_max
PARAM_VALUE 1 b->transaction->priority s32min-s32max
PARAM_VALUE 1 b->transaction->to_proc 4096-ptr_max
PARAM_VALUE 1 b->transaction->work.type 1
PARAM_VALUE 2 objects_start_offset 0,8-u64max
PARAM_VALUE 5 last_obj_offset 0
PARAM_VALUE 6 last_min_offset 0
BUF_SIZE 1 b->transaction 232
CAPPED_DATA 0 proc 1
CAPPED_DATA 1 b->data_size 1
CAPPED_DATA 1 b->extra_buffers_size 1
CAPPED_DATA 1 b->offsets_size 1
CAPPED_DATA 2 objects_start_offset 1
CAPPED_DATA 2 objects_start_offset 1
DATA_SOURCE 1 b r binder_alloc_new_buf
BIT_INFO 2 objects_start_offset 0x0,0xfffffffffffffff8
BIT_INFO 2 objects_start_offset 0x0,0xfffffffffffffff8
NOSPEC 1 b->data_size
NOSPEC 2 objects_start_offset
USER_DATA 0 proc->alloc.free_async_space 1-9223372036854775798[c][u]
USER_DATA 1 b->async_transaction 0-1
USER_DATA 1 b->clear_on_free 0-1
USER_DATA 1 b->data_size 24-u64max[c]
USER_DATA 1 b->extra_buffers_size 0-u64max[c]
USER_DATA 1 b->offsets_size 0-u64max[c]
USER_DATA 1 b->transaction->code 0-u32max
USER_DATA 1 b->transaction->flags 0-u32max
USER_DATA 1 b->transaction->is_async 0-1
USER_DATA 1 b->transaction->security_ctx 0-u64max[c]
USER_DATA 2 objects_start_offset 0,8-u64max[c]
UNITS 0 proc unit_byte
UNITS 2 objects_start_offset unit_byte
UNITS 4 fixup_offset unit_byte