1864 	binder_size_t object_offset;  in binder_validate_ptr()  local
1871 	if (binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,  in binder_validate_ptr()
1873 					  sizeof(object_offset)))  in binder_validate_ptr()
1875 	object_size = binder_get_object(proc, NULL, b, object_offset, object);  in binder_validate_ptr()
1879 		*object_offsetp = object_offset;  in binder_validate_ptr()
2052 		binder_size_t object_offset;  in binder_transaction_buffer_release()  local
2054 		if (!binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,  in binder_transaction_buffer_release()
2056 						   sizeof(object_offset)))  in binder_transaction_buffer_release()
2058 							object_offset, &object);  in binder_transaction_buffer_release()
2061 			       debug_id, (u64)object_offset, buffer->data_size);  in binder_transaction_buffer_release()
3460 		binder_size_t object_offset;  in binder_transaction()  local
3464 						  &object_offset,  in binder_transaction()
3467 						  sizeof(object_offset))) {  in binder_transaction()
3480 		copy_size = object_offset - user_offset;  in binder_transaction()
3481 		if (copy_size && (user_offset > object_offset ||  in binder_transaction()
3482 				object_offset > tr->data_size ||  in binder_transaction()
3496 				t->buffer, object_offset, &object);  in binder_transaction()
3497 		if (object_size == 0 || object_offset < off_min) {  in binder_transaction()
3500 					  (u64)object_offset,  in binder_transaction()
3512 		user_offset = object_offset + object_size;  in binder_transaction()
3515 		off_min = object_offset + object_size;  in binder_transaction()
3527 							object_offset,  in binder_transaction()
3546 							object_offset,  in binder_transaction()
3559 			binder_size_t fd_offset = object_offset +  in binder_transaction()
3568 							object_offset,  in binder_transaction()
3638 								  object_offset,  in binder_transaction()
3692 							object_offset,  in binder_transaction()
3701 			last_fixup_obj_off = object_offset;  in binder_transaction()