Open Menu /

Documented in 1 files:

Defined in 1 files as a function:

Referenced in 1 files:

Smatch caller information:

drivers/android/binder.c binder_fixup_parent() -> binder_validate_ptr()

Type Parameter Key Value
PARAM_VALUE 2 object 8262723056086933504
PARAM_VALUE 5 object_offsetp 9207792810259165184
DATA_SOURCE 4 start_offset $4
DATA_SOURCE 6 num_valid $5
UNITS 0 proc unit_byte

drivers/android/binder.c binder_transaction() -> binder_validate_ptr()

Type Parameter Key Value
PARAM_VALUE 0 proc 4096-ptr_max
PARAM_VALUE 0 proc->alloc->pages 1-u64max
PARAM_VALUE 0 proc->alloc.allocated_buffers.rb_node 4096-ptr_max
PARAM_VALUE 0 proc->alloc.free_async_space 1-9223372036854775799
PARAM_VALUE 0 proc->alloc.free_buffers.rb_node 4096-ptr_max
PARAM_VALUE 0 proc->alloc.mapped 1
PARAM_VALUE 0 proc->alloc.mm->async_put_work.entry.next->prev 4096-ptr_max
PARAM_VALUE 0 proc->alloc.mm->mmap_lock.first_waiter->handoff_set 0-1
PARAM_VALUE 0 proc->alloc.mm->mmap_lock.first_waiter->type 0-1
PARAM_VALUE 0 proc->alloc.pages_high 1-u64max
PARAM_VALUE 1 b 4096-ptr_max
PARAM_VALUE 1 b->allow_user_free 0
PARAM_VALUE 1 b->data_size 24-u64max
PARAM_VALUE 1 b->free 0
PARAM_VALUE 1 b->rb_node.__rb_parent_color 1
PARAM_VALUE 1 b->rb_node.rb_left 4096-ptr_max
PARAM_VALUE 1 b->rb_node.rb_right 4096-ptr_max
PARAM_VALUE 1 b->target_node 0,4096-ptr_max
PARAM_VALUE 1 b->target_node->proc 4096-ptr_max
PARAM_VALUE 1 b->transaction 4096-ptr_max
PARAM_VALUE 1 b->transaction->buffer 4096-ptr_max
PARAM_VALUE 1 b->transaction->fd_fixups.next 4096-ptr_max
PARAM_VALUE 1 b->transaction->fd_fixups.prev 4096-ptr_max
PARAM_VALUE 1 b->transaction->priority s32min-s32max
PARAM_VALUE 1 b->transaction->to_proc 4096-ptr_max
PARAM_VALUE 1 b->transaction->work.type 1
PARAM_VALUE 2 object 8049513855744712704
PARAM_VALUE 4 start_offset 0,8-u64max
PARAM_VALUE 5 object_offsetp 6817233537322627072
BUF_SIZE 1 b->transaction 232
CAPPED_DATA 0 proc 1
CAPPED_DATA 1 b->data_size 1
CAPPED_DATA 1 b->extra_buffers_size 1
CAPPED_DATA 1 b->offsets_size 1
CAPPED_DATA 4 start_offset 1
CAPPED_DATA 4 start_offset 1
CAPPED_DATA 6 num_valid 1
CAPPED_DATA 6 num_valid 1
DATA_SOURCE 1 b r binder_alloc_new_buf
BIT_INFO 4 start_offset 0x0,0xfffffffffffffff8
BIT_INFO 4 start_offset 0x0,0xfffffffffffffff8
NOSPEC 1 b->data_size
NOSPEC 4 start_offset
USER_DATA 0 proc->alloc.free_async_space 1-9223372036854775798[c][u]
USER_DATA 1 b->async_transaction 0-1
USER_DATA 1 b->clear_on_free 0-1
USER_DATA 1 b->data_size 24-u64max[c]
USER_DATA 1 b->extra_buffers_size 0-u64max[c]
USER_DATA 1 b->offsets_size 0-u64max[c]
USER_DATA 1 b->transaction->code 0-u32max
USER_DATA 1 b->transaction->flags 0-u32max
USER_DATA 1 b->transaction->is_async 0-1
USER_DATA 1 b->transaction->security_ctx 0-u64max[c]
USER_DATA 4 start_offset 0,8-u64max[c]
UNITS 0 proc unit_byte
UNITS 4 start_offset unit_byte

drivers/android/binder.c binder_transaction_buffer_release() -> binder_validate_ptr()

Type Parameter Key Value
PARAM_VALUE 0 proc 4096-ptr_max
PARAM_VALUE 0 proc->inner_lock.rlock.dep_map->name 0-255
PARAM_VALUE 1 b 4096-ptr_max
PARAM_VALUE 1 b->data_size 24-u64max
PARAM_VALUE 1 b->free 0
PARAM_VALUE 1 b->target_node 0,4096-ptr_max
PARAM_VALUE 1 b->target_node->dead_node->next->pprev 1-u64max
PARAM_VALUE 1 b->target_node->lock.rlock.dep_map->name 0-255
PARAM_VALUE 1 b->target_node->proc->inner_lock.rlock.dep_map->name 0-255
PARAM_VALUE 1 b->target_node->proc->nodes.rb_node 4096-ptr_max
PARAM_VALUE 1 b->target_node->proc->todo.prev 4096-ptr_max
PARAM_VALUE 1 b->target_node->proc->todo.prev->next 4096-ptr_max
PARAM_VALUE 1 b->target_node->proc->todo.prev->next->next 4096-ptr_max
PARAM_VALUE 1 b->target_node->work.entry.next->next 4096-ptr_max
PARAM_VALUE 1 b->target_node->work.entry.next->prev 4096-ptr_max
PARAM_VALUE 1 b->target_node->work.entry.prev->next 4096-ptr_max
PARAM_VALUE 1 b->target_node->work.entry.prev->prev 4096-ptr_max
PARAM_VALUE 1 b->transaction 0
PARAM_VALUE 2 object 8011661200560672768
PARAM_VALUE 4 start_offset 0,8-u64max
PARAM_VALUE 5 object_offsetp 0
BUF_SIZE 0 proc s32min-(-1),1-s32max
BUF_SIZE 0 proc s32min-(-1),1-s32max
CAPPED_DATA 0 proc 1
CAPPED_DATA 1 b->target_node 1
DATA_SOURCE 0 proc $0
DATA_SOURCE 1 b $2
BIT_INFO 4 start_offset 0x0,0xfffffffffffffff8
BIT_INFO 4 start_offset 0x0,0xfffffffffffffff8
TASK_NOT_RUNNING
USER_DATA 1 b->user_data 0-u64max[c]
UNITS 0 proc unit_byte