2885 			       struct binder_transaction_data *tr, int reply,  in binder_transaction()  argument
2909 	e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);  in binder_transaction()
2912 	e->target_handle = tr->target.handle;  in binder_transaction()
2913 	e->data_size = tr->data_size;  in binder_transaction()
2914 	e->offsets_size = tr->offsets_size;  in binder_transaction()
2971 		if (tr->target.handle) {  in binder_transaction()
2982 			ref = binder_get_ref_olocked(proc, tr->target.handle,  in binder_transaction()
3022 		if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {  in binder_transaction()
3088 			     (u64)tr->data.ptr.buffer,  in binder_transaction()
3089 			     (u64)tr->data.ptr.offsets,  in binder_transaction()
3090 			     (u64)tr->data_size, (u64)tr->offsets_size,  in binder_transaction()
3097 			     (u64)tr->data.ptr.buffer,  in binder_transaction()
3098 			     (u64)tr->data.ptr.offsets,  in binder_transaction()
3099 			     (u64)tr->data_size, (u64)tr->offsets_size,  in binder_transaction()
3102 	if (!reply && !(tr->flags & TF_ONE_WAY))  in binder_transaction()
3109 	t->code = tr->code;  in binder_transaction()
3110 	t->flags = tr->flags;  in binder_transaction()
3123 	t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,  in binder_transaction()
3124 		tr->offsets_size, extra_buffers_size,  in binder_transaction()
3143 				      ALIGN(tr->data_size, sizeof(void *)));  in binder_transaction()
3147 			   tr->data.ptr.buffer, tr->data_size)) {  in binder_transaction()
3156 			   tr->data.ptr.offsets, tr->offsets_size)) {  in binder_transaction()
3164 	if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) {  in binder_transaction()
3166 				proc->pid, thread->pid, (u64)tr->offsets_size);  in binder_transaction()
3181 	off_end = (void *)off_start + tr->offsets_size;  in binder_transaction()
3430 		     (u64)tr->data_size, (u64)tr->offsets_size,  in binder_transaction()
3680 			struct binder_transaction_data_sg tr;  in binder_thread_write()  local
3682 			if (copy_from_user(&tr, ptr, sizeof(tr)))  in binder_thread_write()
3684 			ptr += sizeof(tr);  in binder_thread_write()
3685 			binder_transaction(proc, thread, &tr.transaction_data,  in binder_thread_write()
3686 					   cmd == BC_REPLY_SG, tr.buffers_size);  in binder_thread_write()
3691 			struct binder_transaction_data tr;  in binder_thread_write()  local
3693 			if (copy_from_user(&tr, ptr, sizeof(tr)))  in binder_thread_write()
3695 			ptr += sizeof(tr);  in binder_thread_write()
3696 			binder_transaction(proc, thread, &tr,  in binder_thread_write()
4050 		struct binder_transaction_data tr;  in binder_thread_read()  local
4071 		if (end - ptr < sizeof(tr) + 4) {  in binder_thread_read()
4249 			tr.target.ptr = target_node->ptr;  in binder_thread_read()
4250 			tr.cookie =  target_node->cookie;  in binder_thread_read()
4257 			tr.target.ptr = 0;  in binder_thread_read()
4258 			tr.cookie = 0;  in binder_thread_read()
4261 		tr.code = t->code;  in binder_thread_read()
4262 		tr.flags = t->flags;  in binder_thread_read()
4263 		tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid);  in binder_thread_read()
4269 			tr.sender_pid = task_tgid_nr_ns(sender,  in binder_thread_read()
4272 			tr.sender_pid = 0;  in binder_thread_read()
4275 		tr.data_size = t->buffer->data_size;  in binder_thread_read()
4276 		tr.offsets_size = t->buffer->offsets_size;  in binder_thread_read()
4277 		tr.data.ptr.buffer = (binder_uintptr_t)  in binder_thread_read()
4280 		tr.data.ptr.offsets = tr.data.ptr.buffer +  in binder_thread_read()
4294 		if (copy_to_user(ptr, &tr, sizeof(tr))) {  in binder_thread_read()
4303 		ptr += sizeof(tr);  in binder_thread_read()
4315 			     (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets);  in binder_thread_read()