1872 	binder_size_t object_offset;  in binder_validate_ptr()  local
1879 	if (binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,  in binder_validate_ptr()
1881 					  sizeof(object_offset)))  in binder_validate_ptr()
1883 	object_size = binder_get_object(proc, NULL, b, object_offset, object);  in binder_validate_ptr()
1887 		*object_offsetp = object_offset;  in binder_validate_ptr()
2059 		binder_size_t object_offset;  in binder_transaction_buffer_release()  local
2061 		if (!binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,  in binder_transaction_buffer_release()
2063 						   sizeof(object_offset)))  in binder_transaction_buffer_release()
2065 							object_offset, &object);  in binder_transaction_buffer_release()
2068 			       debug_id, (u64)object_offset, buffer->data_size);  in binder_transaction_buffer_release()
3380 		binder_size_t object_offset;  in binder_transaction()  local
3384 						  &object_offset,  in binder_transaction()
3387 						  sizeof(object_offset))) {  in binder_transaction()
3398 		copy_size = object_offset - user_offset;  in binder_transaction()
3399 		if (copy_size && (user_offset > object_offset ||  in binder_transaction()
3413 				t->buffer, object_offset, &object);  in binder_transaction()
3414 		if (object_size == 0 || object_offset < off_min) {  in binder_transaction()
3417 					  (u64)object_offset,  in binder_transaction()
3429 		user_offset = object_offset + object_size;  in binder_transaction()
3432 		off_min = object_offset + object_size;  in binder_transaction()
3444 							object_offset,  in binder_transaction()
3461 							object_offset,  in binder_transaction()
3472 			binder_size_t fd_offset = object_offset +  in binder_transaction()
3481 							object_offset,  in binder_transaction()
3549 								  object_offset,  in binder_transaction()
3600 							object_offset,  in binder_transaction()
3607 			last_fixup_obj_off = object_offset;  in binder_transaction()