2031 			struct binder_fd_array_object *fda;  in binder_transaction_buffer_release()  local
2049 			fda = to_binder_fd_array_object(hdr);  in binder_transaction_buffer_release()
2051 						     fda->parent,  in binder_transaction_buffer_release()
2060 			fd_buf_size = sizeof(u32) * fda->num_fds;  in binder_transaction_buffer_release()
2061 			if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {  in binder_transaction_buffer_release()
2063 				       debug_id, (u64)fda->num_fds);  in binder_transaction_buffer_release()
2067 			    fda->parent_offset > parent->length - fd_buf_size) {  in binder_transaction_buffer_release()
2070 				       debug_id, (u64)fda->num_fds);  in binder_transaction_buffer_release()
2082 			    fda->parent_offset;  in binder_transaction_buffer_release()
2083 			for (fd_index = 0; fd_index < fda->num_fds;  in binder_transaction_buffer_release()
2563 				     struct binder_fd_array_object *fda,  in binder_translate_fd_array()  argument
2577 	if (fda->num_fds == 0)  in binder_translate_fd_array()
2580 	fd_buf_size = sizeof(u32) * fda->num_fds;  in binder_translate_fd_array()
2581 	if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {  in binder_translate_fd_array()
2583 				  proc->pid, thread->pid, (u64)fda->num_fds);  in binder_translate_fd_array()
2587 	    fda->parent_offset > parent->length - fd_buf_size) {  in binder_translate_fd_array()
2590 				  proc->pid, thread->pid, (u64)fda->num_fds);  in binder_translate_fd_array()
2601 		fda->parent_offset;  in binder_translate_fd_array()
2603 				fda->parent_offset;  in binder_translate_fd_array()
2611 	ret = binder_add_fixup(pf_head, fda_offset, 0, fda->num_fds * sizeof(u32));  in binder_translate_fd_array()
2615 	for (fdi = 0; fdi < fda->num_fds; fdi++) {  in binder_translate_fd_array()
3435 			struct binder_fd_array_object *fda =  in binder_transaction()  local
3441 						    &ptr_object, fda->parent,  in binder_transaction()
3456 						   fda->parent_offset,  in binder_transaction()
3483 			ret = binder_translate_fd_array(&pf_head, fda,  in binder_transaction()
3491 								  fda, sizeof(*fda));  in binder_transaction()
3502 				fda->parent_offset + sizeof(u32) * fda->num_fds;  in binder_transaction()