2116 	binder_size_t *offp;  in binder_validate_ptr()  local
2121 	offp = start + index;  in binder_validate_ptr()
2122 	buffer_obj = (struct binder_buffer_object *)(b->data + *offp);  in binder_validate_ptr()
2197 	binder_size_t *offp, *off_start, *off_end;  in binder_transaction_buffer_release()  local
2214 	for (offp = off_start; offp < off_end; offp++) {  in binder_transaction_buffer_release()
2216 		size_t object_size = binder_validate_object(buffer, *offp);  in binder_transaction_buffer_release()
2220 			       debug_id, (u64)*offp, buffer->data_size);  in binder_transaction_buffer_release()
2223 		hdr = (struct binder_object_header *)(buffer->data + *offp);  in binder_transaction_buffer_release()
2289 						     offp - off_start);  in binder_transaction_buffer_release()
2727 	binder_size_t *offp, *off_end, *off_start;  in binder_transaction()  local
2981 	offp = off_start;  in binder_transaction()
2992 	if (copy_from_user(offp, (const void __user *)(uintptr_t)  in binder_transaction()
3022 	for (; offp < off_end; offp++) {  in binder_transaction()
3024 		size_t object_size = binder_validate_object(t->buffer, *offp);  in binder_transaction()
3026 		if (object_size == 0 || *offp < off_min) {  in binder_transaction()
3028 					  proc->pid, thread->pid, (u64)*offp,  in binder_transaction()
3037 		hdr = (struct binder_object_header *)(t->buffer->data + *offp);  in binder_transaction()
3038 		off_min = *offp + object_size;  in binder_transaction()
3087 						    offp - off_start);  in binder_transaction()
3149 						  offp - off_start,  in binder_transaction()
3237 	binder_transaction_buffer_release(target_proc, t->buffer, offp);  in binder_transaction()