2279 			struct binder_fd_array_object *fda;  in binder_transaction_buffer_release()  local
2286 			fda = to_binder_fd_array_object(hdr);  in binder_transaction_buffer_release()
2287 			parent = binder_validate_ptr(buffer, fda->parent,  in binder_transaction_buffer_release()
2303 			fd_buf_size = sizeof(u32) * fda->num_fds;  in binder_transaction_buffer_release()
2304 			if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {  in binder_transaction_buffer_release()
2306 				       debug_id, (u64)fda->num_fds);  in binder_transaction_buffer_release()
2310 			    fda->parent_offset > parent->length - fd_buf_size) {  in binder_transaction_buffer_release()
2313 				       debug_id, (u64)fda->num_fds);  in binder_transaction_buffer_release()
2316 			fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);  in binder_transaction_buffer_release()
2317 			for (fd_index = 0; fd_index < fda->num_fds; fd_index++)  in binder_transaction_buffer_release()
2508 static int binder_translate_fd_array(struct binder_fd_array_object *fda,  in binder_translate_fd_array()  argument
2521 	fd_buf_size = sizeof(u32) * fda->num_fds;  in binder_translate_fd_array()
2522 	if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {  in binder_translate_fd_array()
2524 				  proc->pid, thread->pid, (u64)fda->num_fds);  in binder_translate_fd_array()
2528 	    fda->parent_offset > parent->length - fd_buf_size) {  in binder_translate_fd_array()
2531 				  proc->pid, thread->pid, (u64)fda->num_fds);  in binder_translate_fd_array()
2540 	fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);  in binder_translate_fd_array()
2546 	for (fdi = 0; fdi < fda->num_fds; fdi++) {  in binder_translate_fd_array()
3082 			struct binder_fd_array_object *fda =  in binder_transaction()  local
3085 				binder_validate_ptr(t->buffer, fda->parent,  in binder_transaction()
3097 						   parent, fda->parent_offset,  in binder_transaction()
3107 			ret = binder_translate_fd_array(fda, parent, t, thread,  in binder_transaction()
3117 				fda->parent_offset + sizeof(u32) * fda->num_fds;  in binder_transaction()