1864 	binder_size_t object_offset;  in binder_validate_ptr()  local
1871 	if (binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,  in binder_validate_ptr()
1873 					  sizeof(object_offset)))  in binder_validate_ptr()
1875 	object_size = binder_get_object(proc, NULL, b, object_offset, object);  in binder_validate_ptr()
1879 		*object_offsetp = object_offset;  in binder_validate_ptr()
2052 		binder_size_t object_offset;  in binder_transaction_buffer_release()  local
2054 		if (!binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,  in binder_transaction_buffer_release()
2056 						   sizeof(object_offset)))  in binder_transaction_buffer_release()
2058 							object_offset, &object);  in binder_transaction_buffer_release()
2061 			       debug_id, (u64)object_offset, buffer->data_size);  in binder_transaction_buffer_release()
3464 		binder_size_t object_offset;  in binder_transaction()  local
3468 						  &object_offset,  in binder_transaction()
3471 						  sizeof(object_offset))) {  in binder_transaction()
3484 		copy_size = object_offset - user_offset;  in binder_transaction()
3485 		if (copy_size && (user_offset > object_offset ||  in binder_transaction()
3486 				object_offset > tr->data_size ||  in binder_transaction()
3500 				t->buffer, object_offset, &object);  in binder_transaction()
3501 		if (object_size == 0 || object_offset < off_min) {  in binder_transaction()
3504 					  (u64)object_offset,  in binder_transaction()
3516 		user_offset = object_offset + object_size;  in binder_transaction()
3519 		off_min = object_offset + object_size;  in binder_transaction()
3531 							object_offset,  in binder_transaction()
3550 							object_offset,  in binder_transaction()
3563 			binder_size_t fd_offset = object_offset +  in binder_transaction()
3572 							object_offset,  in binder_transaction()
3642 								  object_offset,  in binder_transaction()
3696 							object_offset,  in binder_transaction()
3705 			last_fixup_obj_off = object_offset;  in binder_transaction()