1869 	binder_size_t object_offset;  in binder_validate_ptr()  local
1876 	if (binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,  in binder_validate_ptr()
1878 					  sizeof(object_offset)))  in binder_validate_ptr()
1880 	object_size = binder_get_object(proc, NULL, b, object_offset, object);  in binder_validate_ptr()
1884 		*object_offsetp = object_offset;  in binder_validate_ptr()
2057 		binder_size_t object_offset;  in binder_transaction_buffer_release()  local
2059 		if (!binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,  in binder_transaction_buffer_release()
2061 						   sizeof(object_offset)))  in binder_transaction_buffer_release()
2063 							object_offset, &object);  in binder_transaction_buffer_release()
2066 			       debug_id, (u64)object_offset, buffer->data_size);  in binder_transaction_buffer_release()
3409 		binder_size_t object_offset;  in binder_transaction()  local
3413 						  &object_offset,  in binder_transaction()
3416 						  sizeof(object_offset))) {  in binder_transaction()
3429 		copy_size = object_offset - user_offset;  in binder_transaction()
3430 		if (copy_size && (user_offset > object_offset ||  in binder_transaction()
3431 				object_offset > tr->data_size ||  in binder_transaction()
3445 				t->buffer, object_offset, &object);  in binder_transaction()
3446 		if (object_size == 0 || object_offset < off_min) {  in binder_transaction()
3449 					  (u64)object_offset,  in binder_transaction()
3461 		user_offset = object_offset + object_size;  in binder_transaction()
3464 		off_min = object_offset + object_size;  in binder_transaction()
3476 							object_offset,  in binder_transaction()
3495 							object_offset,  in binder_transaction()
3508 			binder_size_t fd_offset = object_offset +  in binder_transaction()
3517 							object_offset,  in binder_transaction()
3587 								  object_offset,  in binder_transaction()
3641 							object_offset,  in binder_transaction()
3650 			last_fixup_obj_off = object_offset;  in binder_transaction()