drivers/android/binder.c

1163 	if (ref->death) {
1165 			     "%d delete ref %d desc %d has death notification\n",
1168 		binder_dequeue_work(ref->proc, &ref->death->work);
1291  * (if non-NULL) and the binder_ref_death indicated by ref->death.
1297 	kfree(ref->death);
4080 			struct binder_ref_death *death = NULL;
4090 				 * Allocate memory for death notification
4093 				death = kzalloc(sizeof(*death), GFP_KERNEL);
4094 				if (death == NULL) {
4118 				kfree(death);
4134 				if (ref->death) {
4135 					binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n",
4139 					kfree(death);
4143 				INIT_LIST_HEAD(&death->work.entry);
4144 				death->cookie = cookie;
4145 				ref->death = death;
4147 					ref->death->work.type = BINDER_WORK_DEAD_BINDER;
4151 						&ref->death->work, &proc->todo);
4156 				if (ref->death == NULL) {
4157 					binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n",
4163 				death = ref->death;
4164 				if (death->cookie != cookie) {
4165 					binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n",
4167 						(u64)death->cookie,
4173 				ref->death = NULL;
4175 				if (list_empty(&death->work.entry)) {
4176 					death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
4182 								&death->work);
4185 								&death->work,
4191 					BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER);
4192 					death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR;
4202 			struct binder_ref_death *death = NULL;
4217 					death = tmp_death;
4224 				     death);
4225 			if (death == NULL) {
4231 			binder_dequeue_work_ilocked(&death->work);
4232 			if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) {
4233 				death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
4238 						thread, &death->work);
4241 							&death->work,
4600 			struct binder_ref_death *death;
4604 			death = container_of(w, struct binder_ref_death, work);
4609 			cookie = death->cookie;
4620 				kfree(death);
4836 			struct binder_ref_death *death;
4838 			death = container_of(w, struct binder_ref_death, work);
4840 				"undelivered death notification, %016llx\n",
4841 				(u64)death->cookie);
4842 			kfree(death);
5767 	int death = 0;
5802 		 * death notifications.
5805 		if (!ref->death) {
5810 		death++;
5812 		BUG_ON(!list_empty(&ref->death->work.entry));
5813 		ref->death->work.type = BINDER_WORK_DEAD_BINDER;
5814 		binder_enqueue_work_ilocked(&ref->death->work,
5821 		     "node %d now dead, refs %d, death %d\n",
5822 		     node->debug_id, refs, death);
6038 		seq_printf(m, "%shas cleared death notification\n", prefix);
6119 		   ref->data.weak, ref->death);
6242 	"death",