binder_alloc_copy_from_buffer identifier - Linux source code next-20260811

Projects

linux

Versions

FIXME
- FIXME
  - next-20260811

Defined in 1 files as a prototype:

drivers/android/binder_alloc.h, line 176 (as a prototype)

Defined in 1 files as a function:

drivers/android/binder_alloc.c, line 1401 (as a function)

Referenced in 1 files:

drivers/android/binder.c

Smatch caller information:

drivers/android/binder.c binder_get_object() -> binder_alloc_copy_from_buffer()

Type	Parameter	Key	Value
PARAM_VALUE	0	alloc	4096-ptr_max
PARAM_VALUE	1	dest	1222858552098054144,3938605042311122944,8011661200560672768,8262723056086933504,9106220478677114880
PARAM_VALUE	2	buffer	4096-ptr_max
PARAM_VALUE	2	buffer->free	0
PARAM_VALUE	4	bytes	4-40
BUF_SIZE	2	buffer->transaction	(-1),232
CAPPED_DATA	3	buffer_offset	1
CAPPED_DATA	3	buffer_offset	1
CAPPED_DATA	4	bytes	1
CAPPED_DATA	4	bytes	1
DATA_SOURCE	1	dest	$4
DATA_SOURCE	2	buffer	$2
DATA_SOURCE	3	buffer_offset	$3
PARAM_COMPARE	2	buffer->data_size	>= $3
PARAM_COMPARE	2	buffer->data_size	>= $4
PARAM_COMPARE	3	buffer_offset	<= $2->data_size
PARAM_COMPARE	4	bytes	<= $2->data_size
BIT_INFO	3	buffer_offset	0x0,0xfffffffffffffffc
BIT_INFO	3	buffer_offset	0x0,0xfffffffffffffffc
NOSPEC	2	buffer->data_size
TASK_NOT_RUNNING
USER_DATA	0	alloc->free_async_space	1-9223372036854775798[c][u]
USER_DATA	2	buffer->async_transaction	0-1
USER_DATA	2	buffer->clear_on_free	0-1
USER_DATA	2	buffer->data_size	0-u64max[c]
USER_DATA	2	buffer->extra_buffers_size	0-u64max[c]
USER_DATA	2	buffer->offsets_size	0-u64max[c]
USER_DATA	2	buffer->transaction->code	0-u32max
USER_DATA	2	buffer->transaction->flags	0-u32max
USER_DATA	2	buffer->transaction->is_async	0-1
USER_DATA	2	buffer->transaction->security_ctx	0-u64max[c]
USER_DATA	2	buffer->user_data	0-u64max[c]
UNITS	3	buffer_offset	unit_byte
UNITS	4	bytes	unit_byte

drivers/android/binder.c binder_transaction() -> binder_alloc_copy_from_buffer()

Type	Parameter	Key	Value
PARAM_VALUE	0	alloc	4096-ptr_max
PARAM_VALUE	0	alloc->allocated_buffers.rb_node	4096-ptr_max
PARAM_VALUE	0	alloc->free_async_space	1-9223372036854775799
PARAM_VALUE	0	alloc->free_buffers.rb_node	4096-ptr_max
PARAM_VALUE	0	alloc->mapped	1
PARAM_VALUE	0	alloc->pages_high	1-u64max
PARAM_VALUE	1	dest	279958840783736832
PARAM_VALUE	2	buffer	4096-ptr_max
PARAM_VALUE	2	buffer->allow_user_free	0
PARAM_VALUE	2	buffer->free	0
PARAM_VALUE	2	buffer->rb_node.__rb_parent_color	1
PARAM_VALUE	2	buffer->rb_node.rb_left	4096-ptr_max
PARAM_VALUE	2	buffer->rb_node.rb_right	4096-ptr_max
PARAM_VALUE	2	buffer->target_node	0,4096-ptr_max
PARAM_VALUE	2	buffer->target_node->proc	4096-ptr_max
PARAM_VALUE	2	buffer->transaction	4096-ptr_max
PARAM_VALUE	2	buffer->transaction->buffer	4096-ptr_max
PARAM_VALUE	2	buffer->transaction->fd_fixups.next	4096-ptr_max
PARAM_VALUE	2	buffer->transaction->fd_fixups.prev	4096-ptr_max
PARAM_VALUE	2	buffer->transaction->priority	s32min-s32max
PARAM_VALUE	2	buffer->transaction->to_proc	4096-ptr_max
PARAM_VALUE	2	buffer->transaction->work.type	1
PARAM_VALUE	3	buffer_offset	0,8-18446744073709551614
PARAM_VALUE	4	bytes	8
BUF_SIZE	1	dest	8
BUF_SIZE	2	buffer->transaction	232
CAPPED_DATA	2	buffer->data_size	1
CAPPED_DATA	2	buffer->extra_buffers_size	1
CAPPED_DATA	2	buffer->offsets_size	1
CAPPED_DATA	3	buffer_offset	1
CAPPED_DATA	3	buffer_offset	1
DATA_SOURCE	2	buffer	r binder_alloc_new_buf
NOSPEC	2	buffer->data_size
NOSPEC	3	buffer_offset
USER_DATA	0	alloc->free_async_space	1-9223372036854775798[c][u]
USER_DATA	2	buffer->async_transaction	0-1
USER_DATA	2	buffer->clear_on_free	0-1
USER_DATA	2	buffer->data_size	0-u64max[c]
USER_DATA	2	buffer->extra_buffers_size	0-u64max[c]
USER_DATA	2	buffer->offsets_size	0-u64max[c]
USER_DATA	2	buffer->transaction->code	0-u32max
USER_DATA	2	buffer->transaction->flags	0-u32max
USER_DATA	2	buffer->transaction->is_async	0-1
USER_DATA	2	buffer->transaction->security_ctx	0-u64max[c]
USER_DATA	3	buffer_offset	0,8-18446744073709551614[c]
UNITS	3	buffer_offset	unit_byte
UNITS	4	bytes	unit_byte

drivers/android/binder.c binder_transaction_buffer_release() -> binder_alloc_copy_from_buffer()

Type	Parameter	Key	Value
PARAM_VALUE	0	alloc	4096-ptr_max
PARAM_VALUE	1	dest	2990993748813107200
PARAM_VALUE	2	buffer	4096-ptr_max
PARAM_VALUE	2	buffer->target_node	0,4096-ptr_max
PARAM_VALUE	2	buffer->target_node->dead_node->next->pprev	1-u64max
PARAM_VALUE	2	buffer->target_node->lock.rlock.dep_map->name	0-255
PARAM_VALUE	2	buffer->target_node->proc->inner_lock.rlock.dep_map->name	0-255
PARAM_VALUE	2	buffer->target_node->proc->nodes.rb_node	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->proc->todo.prev	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->proc->todo.prev->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->proc->todo.prev->next->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.next->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.next->prev	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.prev->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.prev->prev	4096-ptr_max
PARAM_VALUE	2	buffer->transaction	0
PARAM_VALUE	3	buffer_offset	0,8-18446744073709551614
PARAM_VALUE	4	bytes	8
BUF_SIZE	1	dest	8
CAPPED_DATA	2	buffer->target_node	1
CAPPED_DATA	3	buffer_offset	1
CAPPED_DATA	3	buffer_offset	1
DATA_SOURCE	2	buffer	$2
TASK_NOT_RUNNING
USER_DATA	2	buffer->user_data	0-u64max[c]
UNITS	4	bytes	unit_byte

drivers/android/binder.c binder_transaction_buffer_release() -> binder_alloc_copy_from_buffer()

Type	Parameter	Key	Value
PARAM_VALUE	0	alloc	4096-ptr_max
PARAM_VALUE	1	dest	3498718503602651136
PARAM_VALUE	2	buffer	4096-ptr_max
PARAM_VALUE	2	buffer->data_size	24-u64max
PARAM_VALUE	2	buffer->free	0
PARAM_VALUE	2	buffer->target_node	0,4096-ptr_max
PARAM_VALUE	2	buffer->target_node->dead_node->next->pprev	1-u64max
PARAM_VALUE	2	buffer->target_node->lock.rlock.dep_map->name	0-255
PARAM_VALUE	2	buffer->target_node->proc->inner_lock.rlock.dep_map->name	0-255
PARAM_VALUE	2	buffer->target_node->proc->nodes.rb_node	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->proc->todo.prev	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->proc->todo.prev->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->proc->todo.prev->next->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.next->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.next->prev	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.prev->next	4096-ptr_max
PARAM_VALUE	2	buffer->target_node->work.entry.prev->prev	4096-ptr_max
PARAM_VALUE	2	buffer->transaction	0
PARAM_VALUE	4	bytes	4
BUF_SIZE	1	dest	4
CAPPED_DATA	2	buffer->target_node	1
DATA_SOURCE	2	buffer	$2
TASK_NOT_RUNNING
USER_DATA	2	buffer->user_data	0-u64max[c]
UNITS	3	buffer_offset	unit_byte
UNITS	4	bytes	unit_byte

drivers/android/binder.c binder_validate_fixup() -> binder_alloc_copy_from_buffer()

Type	Parameter	Key	Value
PARAM_VALUE	0	alloc	4096-ptr_max
PARAM_VALUE	2	buffer	4096-ptr_max
PARAM_VALUE	2	buffer->data_size	24-u64max
PARAM_VALUE	2	buffer->free	0
PARAM_VALUE	4	bytes	8
BUF_SIZE	1	dest	8
CAPPED_DATA	2	buffer->data_size	1
DATA_SOURCE	2	buffer	$1
UNITS	4	bytes	unit_byte

drivers/android/binder.c binder_validate_ptr() -> binder_alloc_copy_from_buffer()

Type	Parameter	Key	Value
PARAM_VALUE	0	alloc	4096-ptr_max
PARAM_VALUE	1	dest	6299876463318687744
PARAM_VALUE	4	bytes	8
BUF_SIZE	1	dest	8
BUF_SIZE	2	buffer->transaction	(-1),232
DATA_SOURCE	2	buffer	$1
NOSPEC	2	buffer->data_size
TASK_NOT_RUNNING
USER_DATA	0	alloc->free_async_space	1-9223372036854775798[c][u]
USER_DATA	2	buffer->async_transaction	0-1
USER_DATA	2	buffer->clear_on_free	0-1
USER_DATA	2	buffer->data_size	24-u64max[c]
USER_DATA	2	buffer->extra_buffers_size	0-u64max[c]
USER_DATA	2	buffer->offsets_size	0-u64max[c]
USER_DATA	2	buffer->transaction->code	0-u32max
USER_DATA	2	buffer->transaction->flags	0-u32max
USER_DATA	2	buffer->transaction->is_async	0-1
USER_DATA	2	buffer->transaction->security_ctx	0-u64max[c]
USER_DATA	2	buffer->user_data	0-u64max[c]
USER_DATA	3	buffer_offset	0-u64max[c]
UNITS	3	buffer_offset	unit_byte
UNITS	4	bytes	unit_byte