binder_add_fixup(9)

🎀 binder_add_fixup(9) — Kernel API Manual 🎀

🌸 NAME 🌸

okay so the whole name vibe, bestie: binder_add_fixup — queue a fixup to be applied to sg copy. literally that. 💖

✨ SYNOPSIS ✨

here's the exact signature, no cap:

int binder_add_fixup (struct list_head *pf_head , binder_size_t offset ,
binder_uintptr_t fixup , size_t skip_size );

🎀 ARGUMENTS 🎀

• pf_head — list_head of binder ptr fixup list. (the list, bestie 🫶)
• offset — binder buffer offset in target process.
• fixup — bytes to be copied for fixup.
• skip_size — bytes to skip when copying (fixup will be applied later).

🦋 DESCRIPTION 🦋

okay so what it does: it adds the specified fixup to a list ordered by offset. When copying the scatter-gather buffers, the fixup will be copied instead of data from the source buffer. For BINDER_TYPE_FDA fixups, the fixup will be applied later (in target process context), so we just skip the bytes specified by skip_size. If skip_size is 0, we copy the value in fixup. 💅

This function is called mostly in offset order, but there are exceptions. Since out-of-order inserts are relatively uncommon, we insert the new element by searching backward from the tail of the list. lowkey clever. 🫶

🔥 RETURN 🔥

0=success, else -errno

that's the whole return deal, periodt. 👑

🌈 SEE ALSO 🌈

Kernel file: ./drivers/android/binder.c

• binder_proc_lock(9)
• binder_proc_unlock(9)
• binder_inner_proc_lock(9)
• binder_inner_proc_unlock(9)
• binder_node_lock(9)
• binder_node_unlock(9)
• binder_node_inner_lock(9)
• binder_node_inner_unlock(9)
• binder_worklist_empty(9)
• binder_enqueue_work_ilocked(9)
• binder_enqueue_deferred_thread_work_ilocked(9)
• binder_enqueue_thread_work_ilocked(9)
• binder_enqueue_thread_work(9)
• binder_dequeue_work(9)
• binder_select_thread_ilocked(9)
• binder_wakeup_thread_ilocked(9)
• binder_inc_node_tmpref(9)
• binder_dec_node_tmpref(9)
• binder_get_ref_for_node_olocked(9)
• binder_inc_ref_olocked(9)
• binder_dec_ref_olocked(9)
• binder_get_node_from_ref(9)
• binder_free_ref(9)
• binder_update_ref_for_handle(9)
• binder_dec_ref_for_handle(9)
• binder_inc_ref_for_node(9)
• binder_thread_dec_tmpref(9)
• binder_proc_dec_tmpref(9)
• binder_get_txn_from(9)
• binder_get_txn_from_and_acq_inner(9)
• binder_free_txn_fixups(9)
• binder_cleanup_transaction(9)
• binder_get_object(9)
• binder_validate_ptr(9)
• binder_validate_fixup(9)
• struct binder_task_work_cb(9)
• binder_do_fd_close(9)
• binder_deferred_fd_close(9)
• struct binder_ptr_fixup(9)
• struct binder_sg_copy(9)
• binder_do_deferred_txn_copies(9)
• binder_cleanup_deferred_txn_lists(9)
• binder_defer_copy(9)
• binder_can_update_transaction(9)
• binder_find_outdated_transaction_ilocked(9)
• binder_proc_transaction(9)
• binder_get_node_refs_for_txn(9)
• binder_netlink_report(9)
• binder_free_buf(9)
• binder_apply_fd_fixups(9)
• print_next_binder_node_ilocked(9)

---

mwah 💋 — source/version ./drivers/android, date October 2026, page binder_add_fixup(9). periodt. 🎀