Lines Matching refs:offp
1244 binder_size_t *offp, *off_end; in binder_transaction_buffer_release() local
1255 offp = (binder_size_t *)(buffer->data + in binder_transaction_buffer_release()
1260 off_end = (void *)offp + buffer->offsets_size; in binder_transaction_buffer_release()
1261 for (; offp < off_end; offp++) { in binder_transaction_buffer_release()
1264 if (*offp > buffer->data_size - sizeof(*fp) || in binder_transaction_buffer_release()
1266 !IS_ALIGNED(*offp, sizeof(u32))) { in binder_transaction_buffer_release()
1268 debug_id, (u64)*offp, buffer->data_size); in binder_transaction_buffer_release()
1271 fp = (struct flat_binder_object *)(buffer->data + *offp); in binder_transaction_buffer_release()
1323 binder_size_t *offp, *off_end; in binder_transaction() local
1501 offp = (binder_size_t *)(t->buffer->data + in binder_transaction()
1511 if (copy_from_user(offp, (const void __user *)(uintptr_t) in binder_transaction()
1524 off_end = (void *)offp + tr->offsets_size; in binder_transaction()
1525 for (; offp < off_end; offp++) { in binder_transaction()
1528 if (*offp > t->buffer->data_size - sizeof(*fp) || in binder_transaction()
1530 !IS_ALIGNED(*offp, sizeof(u32))) { in binder_transaction()
1532 proc->pid, thread->pid, (u64)*offp); in binder_transaction()
1536 fp = (struct flat_binder_object *)(t->buffer->data + *offp); in binder_transaction()
1720 binder_transaction_buffer_release(target_proc, t->buffer, offp); in binder_transaction()