Documented in 1 files:
Defined in 1 files as a prototype:
Defined in 1 files as a function:
Referenced in 3 files:
- drivers/android/binder.c
- drivers/android/binder_alloc.c
- drivers/android/tests/binder_alloc_kunit.c, line 191
Smatch caller information:
drivers/android/tests/binder_alloc_kunit.c binder_alloc_test_free_buf() -> binder_alloc_free_buf()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | alloc | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->allocated_buffers.rb_node | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->free_buffers.rb_node | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->mm->async_put_work.entry.next->prev | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->mm->mmap_lock.first_waiter->handoff_set | 0-1 |
| PARAM_VALUE | 0 | alloc->mm->mmap_lock.first_waiter->type | 0-1 |
| PARAM_VALUE | 0 | alloc->pages_high | 1-u64max |
| PARAM_VALUE | 0 | *alloc->pages | 1-u64max |
| DATA_SOURCE | 0 | alloc | $1 |
| NOCHECK_CALL |
drivers/android/binder.c binder_free_buf() -> binder_alloc_free_buf()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | alloc | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node | 0,4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->dead_node->next->pprev | 1-u64max |
| PARAM_VALUE | 1 | buffer->target_node->lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 1 | buffer->target_node->proc->inner_lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 1 | buffer->target_node->proc->nodes.rb_node | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->proc->todo.prev | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->proc->todo.prev->next | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->proc->todo.prev->next->next | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->work.entry.next->next | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->work.entry.next->prev | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->work.entry.prev->next | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->work.entry.prev->prev | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction | 0 |
| CAPPED_DATA | 1 | buffer->target_node | 1 |
| DATA_SOURCE | 1 | buffer | $2 |
| TASK_NOT_RUNNING | |||
| NOCHECK_CALL | |||
| USER_DATA | 1 | buffer->user_data | 0-u64max[c] |
drivers/android/binder.c binder_proc_transaction() -> binder_alloc_free_buf()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | alloc | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node | 0,4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->dead_node->next->pprev | 1-u64max |
| PARAM_VALUE | 1 | buffer->target_node->lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 1 | buffer->target_node->proc->inner_lock.rlock.dep_map->name | 0-255 |
| PARAM_VALUE | 1 | buffer->target_node->proc->nodes.rb_node | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->proc->todo.prev | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->proc->todo.prev->next | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->proc->todo.prev->next->next | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->work.entry.next->next | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->work.entry.next->prev | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->work.entry.prev->next | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->target_node->work.entry.prev->prev | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->transaction | 0 |
| CAPPED_DATA | 1 | buffer->pid | 1 |
| CAPPED_DATA | 1 | buffer->target_node | 1 |
| NOCHECK_CALL |
drivers/android/binder_alloc.c binder_alloc_new_buf() -> binder_alloc_free_buf()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | alloc | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->allocated_buffers.rb_node | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->free_async_space | 1-9223372036854775799 |
| PARAM_VALUE | 0 | alloc->free_buffers.rb_node | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->mapped | 1 |
| PARAM_VALUE | 0 | alloc->mm->async_put_work.entry.next->prev | 4096-ptr_max |
| PARAM_VALUE | 0 | alloc->mm->mmap_lock.first_waiter->handoff_set | 0-1 |
| PARAM_VALUE | 0 | alloc->mm->mmap_lock.first_waiter->type | 0-1 |
| PARAM_VALUE | 0 | alloc->mutex.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | alloc->mutex.first_waiter | 0,4096-ptr_max |
| PARAM_VALUE | 0 | alloc->mutex.first_waiter->list.prev->next | 5159360019465732096 |
| PARAM_VALUE | 0 | alloc->mutex.first_waiter->task->blocked_lock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | alloc->mutex.first_waiter->task->blocked_lock.owner | (-1) |
| PARAM_VALUE | 0 | alloc->mutex.first_waiter->task->blocked_lock.owner_cpu | 4294967295 |
| PARAM_VALUE | 0 | alloc->mutex.first_waiter->task->blocked_lock.raw_lock.val.counter | s32min-s32max |
| PARAM_VALUE | 0 | alloc->mutex.first_waiter->task->usage.refs.counter | s32min-s32max |
| PARAM_VALUE | 0 | alloc->mutex.osq.tail.counter | 0-s32max |
| PARAM_VALUE | 0 | alloc->mutex.wait_lock.dep_map->name | 0-255 |
| PARAM_VALUE | 0 | alloc->pages_high | 1-u64max |
| PARAM_VALUE | 0 | *alloc->pages | 1-u64max |
| PARAM_VALUE | 1 | buffer | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->allow_user_free | 0 |
| PARAM_VALUE | 1 | buffer->free | 0 |
| PARAM_VALUE | 1 | buffer->rb_node.__rb_parent_color | 1 |
| PARAM_VALUE | 1 | buffer->rb_node.rb_left | 4096-ptr_max |
| PARAM_VALUE | 1 | buffer->rb_node.rb_right | 4096-ptr_max |
| CAPPED_DATA | 0 | &alloc->mutex | 1 |
| CAPPED_DATA | 1 | buffer->data_size | 1 |
| CAPPED_DATA | 1 | buffer->extra_buffers_size | 1 |
| CAPPED_DATA | 1 | buffer->offsets_size | 1 |
| DATA_SOURCE | 0 | alloc | $0 |
| DATA_SOURCE | 1 | buffer | r binder_alloc_new_buf_locked |
| NOCHECK_CALL | |||
| USER_DATA | 0 | alloc->free_async_space | 1-9223372036854775798[c][u] |
| USER_DATA | 1 | buffer->async_transaction | 0-1 |
| USER_DATA | 1 | buffer->data_size | 0-u64max[c] |
| USER_DATA | 1 | buffer->extra_buffers_size | 0-u64max[c] |
| USER_DATA | 1 | buffer->offsets_size | 0-u64max[c] |