401 	struct binder_ref_death *death;  member
1532 	if (ref->death) {  in binder_cleanup_ref_olocked()
1537 		binder_dequeue_work(ref->proc, &ref->death->work);  in binder_cleanup_ref_olocked()
1666 	kfree(ref->death);  in binder_free_ref()
3857 			struct binder_ref_death *death = NULL;  in binder_thread_write()  local
3870 				death = kzalloc(sizeof(*death), GFP_KERNEL);  in binder_thread_write()
3871 				if (death == NULL) {  in binder_thread_write()
3895 				kfree(death);  in binder_thread_write()
3911 				if (ref->death) {  in binder_thread_write()
3916 					kfree(death);  in binder_thread_write()
3920 				INIT_LIST_HEAD(&death->work.entry);  in binder_thread_write()
3921 				death->cookie = cookie;  in binder_thread_write()
3922 				ref->death = death;  in binder_thread_write()
3924 					ref->death->work.type = BINDER_WORK_DEAD_BINDER;  in binder_thread_write()
3928 						&ref->death->work, &proc->todo);  in binder_thread_write()
3933 				if (ref->death == NULL) {  in binder_thread_write()
3940 				death = ref->death;  in binder_thread_write()
3941 				if (death->cookie != cookie) {  in binder_thread_write()
3944 						(u64)death->cookie,  in binder_thread_write()
3950 				ref->death = NULL;  in binder_thread_write()
3952 				if (list_empty(&death->work.entry)) {  in binder_thread_write()
3953 					death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;  in binder_thread_write()
3959 								&death->work);  in binder_thread_write()
3962 								&death->work,  in binder_thread_write()
3968 					BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER);  in binder_thread_write()
3969 					death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR;  in binder_thread_write()
3979 			struct binder_ref_death *death = NULL;  in binder_thread_write()  local
3994 					death = tmp_death;  in binder_thread_write()
4001 				     death);  in binder_thread_write()
4002 			if (death == NULL) {  in binder_thread_write()
4008 			binder_dequeue_work_ilocked(&death->work);  in binder_thread_write()
4009 			if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) {  in binder_thread_write()
4010 				death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;  in binder_thread_write()
4015 						thread, &death->work);  in binder_thread_write()
4018 							&death->work,  in binder_thread_write()
4382 			struct binder_ref_death *death;  in binder_thread_read()  local
4386 			death = container_of(w, struct binder_ref_death, work);  in binder_thread_read()
4391 			cookie = death->cookie;  in binder_thread_read()
4402 				kfree(death);  in binder_thread_read()
4612 			struct binder_ref_death *death;  in binder_release_work()  local
4614 			death = container_of(w, struct binder_ref_death, work);  in binder_release_work()
4617 				(u64)death->cookie);  in binder_release_work()
4618 			kfree(death);  in binder_release_work()
5344 	int death = 0;  in binder_node_release()  local
5382 		if (!ref->death) {  in binder_node_release()
5387 		death++;  in binder_node_release()
5389 		BUG_ON(!list_empty(&ref->death->work.entry));  in binder_node_release()
5390 		ref->death->work.type = BINDER_WORK_DEAD_BINDER;  in binder_node_release()
5391 		binder_enqueue_work_ilocked(&ref->death->work,  in binder_node_release()
5399 		     node->debug_id, refs, death);  in binder_node_release()
5693 		   ref->data.weak, ref->death);  in print_binder_ref_olocked()