1171 				   struct binder_transaction *t)  in binder_pop_transaction()  argument
1174 		BUG_ON(target_thread->transaction_stack != t);  in binder_pop_transaction()
1178 		t->from = NULL;  in binder_pop_transaction()
1180 	t->need_reply = 0;  in binder_pop_transaction()
1181 	if (t->buffer)  in binder_pop_transaction()
1182 		t->buffer->transaction = NULL;  in binder_pop_transaction()
1183 	kfree(t);  in binder_pop_transaction()
1187 static void binder_send_failed_reply(struct binder_transaction *t,  in binder_send_failed_reply()  argument
1193 	BUG_ON(t->flags & TF_ONE_WAY);  in binder_send_failed_reply()
1195 		target_thread = t->from;  in binder_send_failed_reply()
1206 					      t->debug_id,  in binder_send_failed_reply()
1210 				binder_pop_transaction(target_thread, t);  in binder_send_failed_reply()
1221 		next = t->from_parent;  in binder_send_failed_reply()
1225 			     t->debug_id);  in binder_send_failed_reply()
1227 		binder_pop_transaction(target_thread, t);  in binder_send_failed_reply()
1233 		t = next;  in binder_send_failed_reply()
1236 			      t->debug_id);  in binder_send_failed_reply()
1321 	struct binder_transaction *t;  in binder_transaction()  local
1440 	t = kzalloc(sizeof(*t), GFP_KERNEL);  in binder_transaction()
1441 	if (t == NULL) {  in binder_transaction()
1454 	t->debug_id = ++binder_last_id;  in binder_transaction()
1455 	e->debug_id = t->debug_id;  in binder_transaction()
1460 			     proc->pid, thread->pid, t->debug_id,  in binder_transaction()
1468 			     proc->pid, thread->pid, t->debug_id,  in binder_transaction()
1475 		t->from = thread;  in binder_transaction()
1477 		t->from = NULL;  in binder_transaction()
1478 	t->sender_euid = task_euid(proc->tsk);  in binder_transaction()
1479 	t->to_proc = target_proc;  in binder_transaction()
1480 	t->to_thread = target_thread;  in binder_transaction()
1481 	t->code = tr->code;  in binder_transaction()
1482 	t->flags = tr->flags;  in binder_transaction()
1483 	t->priority = task_nice(current);  in binder_transaction()
1485 	trace_binder_transaction(reply, t, target_node);  in binder_transaction()
1487 	t->buffer = binder_alloc_buf(target_proc, tr->data_size,  in binder_transaction()
1488 		tr->offsets_size, !reply && (t->flags & TF_ONE_WAY));  in binder_transaction()
1489 	if (t->buffer == NULL) {  in binder_transaction()
1493 	t->buffer->allow_user_free = 0;  in binder_transaction()
1494 	t->buffer->debug_id = t->debug_id;  in binder_transaction()
1495 	t->buffer->transaction = t;  in binder_transaction()
1496 	t->buffer->target_node = target_node;  in binder_transaction()
1497 	trace_binder_transaction_alloc_buf(t->buffer);  in binder_transaction()
1501 	offp = (binder_size_t *)(t->buffer->data +  in binder_transaction()
1504 	if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t)  in binder_transaction()
1528 		if (*offp > t->buffer->data_size - sizeof(*fp) ||  in binder_transaction()
1529 		    t->buffer->data_size < sizeof(*fp) ||  in binder_transaction()
1536 		fp = (struct flat_binder_object *)(t->buffer->data + *offp);  in binder_transaction()
1578 			trace_binder_transaction_node_to_ref(t, node, ref);  in binder_transaction()
1608 				trace_binder_transaction_ref_to_node(t, ref);  in binder_transaction()
1623 				trace_binder_transaction_ref_to_ref(t, ref,  in binder_transaction()
1671 			trace_binder_transaction_fd(t, fp->handle, target_fd);  in binder_transaction()
1686 		BUG_ON(t->buffer->async_transaction != 0);  in binder_transaction()
1688 	} else if (!(t->flags & TF_ONE_WAY)) {  in binder_transaction()
1689 		BUG_ON(t->buffer->async_transaction != 0);  in binder_transaction()
1690 		t->need_reply = 1;  in binder_transaction()
1691 		t->from_parent = thread->transaction_stack;  in binder_transaction()
1692 		thread->transaction_stack = t;  in binder_transaction()
1695 		BUG_ON(t->buffer->async_transaction != 1);  in binder_transaction()
1702 	t->work.type = BINDER_WORK_TRANSACTION;  in binder_transaction()
1703 	list_add_tail(&t->work.entry, target_list);  in binder_transaction()
1719 	trace_binder_transaction_failed_buffer_release(t->buffer);  in binder_transaction()
1720 	binder_transaction_buffer_release(target_proc, t->buffer, offp);  in binder_transaction()
1721 	t->buffer->transaction = NULL;  in binder_transaction()
1722 	binder_free_buf(target_proc, t->buffer);  in binder_transaction()
1727 	kfree(t);  in binder_transaction()
2227 		struct binder_transaction *t = NULL;  in binder_thread_read()  local
2248 			t = container_of(w, struct binder_transaction, work);  in binder_thread_read()
2372 		if (!t)  in binder_thread_read()
2375 		BUG_ON(t->buffer == NULL);  in binder_thread_read()
2376 		if (t->buffer->target_node) {  in binder_thread_read()
2377 			struct binder_node *target_node = t->buffer->target_node;  in binder_thread_read()
2381 			t->saved_priority = task_nice(current);  in binder_thread_read()
2382 			if (t->priority < target_node->min_priority &&  in binder_thread_read()
2383 			    !(t->flags & TF_ONE_WAY))  in binder_thread_read()
2384 				binder_set_nice(t->priority);  in binder_thread_read()
2385 			else if (!(t->flags & TF_ONE_WAY) ||  in binder_thread_read()
2386 				 t->saved_priority > target_node->min_priority)  in binder_thread_read()
2394 		tr.code = t->code;  in binder_thread_read()
2395 		tr.flags = t->flags;  in binder_thread_read()
2396 		tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid);  in binder_thread_read()
2398 		if (t->from) {  in binder_thread_read()
2399 			struct task_struct *sender = t->from->proc->tsk;  in binder_thread_read()
2407 		tr.data_size = t->buffer->data_size;  in binder_thread_read()
2408 		tr.offsets_size = t->buffer->offsets_size;  in binder_thread_read()
2410 					(uintptr_t)t->buffer->data +  in binder_thread_read()
2413 					ALIGN(t->buffer->data_size,  in binder_thread_read()
2423 		trace_binder_transaction_received(t);  in binder_thread_read()
2430 			     t->debug_id, t->from ? t->from->proc->pid : 0,  in binder_thread_read()
2431 			     t->from ? t->from->pid : 0, cmd,  in binder_thread_read()
2432 			     t->buffer->data_size, t->buffer->offsets_size,  in binder_thread_read()
2435 		list_del(&t->work.entry);  in binder_thread_read()
2436 		t->buffer->allow_user_free = 1;  in binder_thread_read()
2437 		if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) {  in binder_thread_read()
2438 			t->to_parent = thread->transaction_stack;  in binder_thread_read()
2439 			t->to_thread = thread;  in binder_thread_read()
2440 			thread->transaction_stack = t;  in binder_thread_read()
2442 			t->buffer->transaction = NULL;  in binder_thread_read()
2443 			kfree(t);  in binder_thread_read()
2477 			struct binder_transaction *t;  in binder_release_work()  local
2479 			t = container_of(w, struct binder_transaction, work);  in binder_release_work()
2480 			if (t->buffer->target_node &&  in binder_release_work()
2481 			    !(t->flags & TF_ONE_WAY)) {  in binder_release_work()
2482 				binder_send_failed_reply(t, BR_DEAD_REPLY);  in binder_release_work()
2486 					t->debug_id);  in binder_release_work()
2487 				t->buffer->transaction = NULL;  in binder_release_work()
2488 				kfree(t);  in binder_release_work()
2556 	struct binder_transaction *t;  in binder_free_thread()  local
2561 	t = thread->transaction_stack;  in binder_free_thread()
2562 	if (t && t->to_thread == thread)  in binder_free_thread()
2563 		send_reply = t;  in binder_free_thread()
2564 	while (t) {  in binder_free_thread()
2569 			     t->debug_id,  in binder_free_thread()
2570 			     (t->to_thread == thread) ? "in" : "out");  in binder_free_thread()
2572 		if (t->to_thread == thread) {  in binder_free_thread()
2573 			t->to_proc = NULL;  in binder_free_thread()
2574 			t->to_thread = NULL;  in binder_free_thread()
2575 			if (t->buffer) {  in binder_free_thread()
2576 				t->buffer->transaction = NULL;  in binder_free_thread()
2577 				t->buffer = NULL;  in binder_free_thread()
2579 			t = t->to_parent;  in binder_free_thread()
2580 		} else if (t->from == thread) {  in binder_free_thread()
2581 			t->from = NULL;  in binder_free_thread()
2582 			t = t->from_parent;  in binder_free_thread()
3065 	struct binder_transaction *t;  in binder_deferred_release()  local
3121 		t = buffer->transaction;  in binder_deferred_release()
3122 		if (t) {  in binder_deferred_release()
3123 			t->buffer = NULL;  in binder_deferred_release()
3126 			       proc->pid, t->debug_id);  in binder_deferred_release()
3224 				     struct binder_transaction *t)  in print_binder_transaction()  argument
3228 		   prefix, t->debug_id, t,  in print_binder_transaction()
3229 		   t->from ? t->from->proc->pid : 0,  in print_binder_transaction()
3230 		   t->from ? t->from->pid : 0,  in print_binder_transaction()
3231 		   t->to_proc ? t->to_proc->pid : 0,  in print_binder_transaction()
3232 		   t->to_thread ? t->to_thread->pid : 0,  in print_binder_transaction()
3233 		   t->code, t->flags, t->priority, t->need_reply);  in print_binder_transaction()
3234 	if (t->buffer == NULL) {  in print_binder_transaction()
3238 	if (t->buffer->target_node)  in print_binder_transaction()
3240 			   t->buffer->target_node->debug_id);  in print_binder_transaction()
3242 		   t->buffer->data_size, t->buffer->offsets_size,  in print_binder_transaction()
3243 		   t->buffer->data);  in print_binder_transaction()
3260 	struct binder_transaction *t;  in print_binder_work()  local
3264 		t = container_of(w, struct binder_transaction, work);  in print_binder_work()
3265 		print_binder_transaction(m, transaction_prefix, t);  in print_binder_work()
3295 	struct binder_transaction *t;  in print_binder_thread()  local
3302 	t = thread->transaction_stack;  in print_binder_thread()
3303 	while (t) {  in print_binder_thread()
3304 		if (t->from == thread) {  in print_binder_thread()
3306 						 "    outgoing transaction", t);  in print_binder_thread()
3307 			t = t->from_parent;  in print_binder_thread()
3308 		} else if (t->to_thread == thread) {  in print_binder_thread()
3310 						 "    incoming transaction", t);  in print_binder_thread()
3311 			t = t->to_parent;  in print_binder_thread()
3313 			print_binder_transaction(m, "    bad transaction", t);  in print_binder_thread()
3314 			t = NULL;  in print_binder_thread()