binder_defer_copy(9)

💖 binder_defer_copy(9) — Kernel API Manual, but make it group chat 💖

okay bestie, welcome to the Kernel API Manual ✨ this page is literally called binder_defer_copy(9) and it's here to explain queueing a scatter-gather buffer for copy. no cap, let's get into it 🫶

🌸 NAME 🌸

binder_defer_copy — queue a scatter-gather buffer for copy. periodt 💅

✨ SYNOPSIS ✨

int binder_defer_copy (struct list_head *sgc_head , binder_size_t offset
, const void __user *sender_uaddr , size_t length );

That's the whole signature, bestie — keep it exactly like that.

🎀 ARGUMENTS 🎀

• sgc_head — the list_head of the scatter-gather copy list. it's giving "head of the list" energy 👑
• offset — binder buffer offset in target process. yes, target process, not source.
• sender_uaddr — user address in source process. source process bestie 💖
• length — bytes to copy. the amount, the size, the length. slay.

🦋 DESCRIPTION 🦋

So you use this to specify a scatter-gather block to be copied. The actual copy must be deferred until all the needed fixups are identified and queued. Then the copy and fixups are done together so un-translated values from the source are never visible in the target buffer. literally iconic behavior — no half-translated leaks in the target buffer 🙈

And here's the cute guarantee: repeated calls to this function will have monotonically increasing offset values, so the list will naturally be ordered. the list is ordering itself, we love to see it ✨

💅 RETURN 💅

0=success, else -errno — that's the whole return vibe. success is 0, otherwise you get -errno 😭

🌈 SEE ALSO 🌈

okay this SEE ALSO list is giving full binder cinematic universe 🫶 and I am not dropping a single name. here's the whole squad, exactly:

Kernel file ./drivers/android/binder.c binder_proc_lock(9),
binder_proc_unlock(9), binder_inner_proc_lock(9),
binder_inner_proc_unlock(9), binder_node_lock(9), binder_node_unlock(9),
binder_node_inner_lock(9), binder_node_inner_unlock(9),
binder_worklist_empty(9), binder_enqueue_work_ilocked(9),
binder_enqueue_deferred_thread_work_ilocked(9),
binder_enqueue_thread_work_ilocked(9), binder_enqueue_thread_work(9),
binder_dequeue_work(9), binder_select_thread_ilocked(9),
binder_wakeup_thread_ilocked(9), binder_inc_node_tmpref(9),
binder_dec_node_tmpref(9), binder_get_ref_for_node_olocked(9),
binder_inc_ref_olocked(9), binder_dec_ref_olocked(9),
binder_get_node_from_ref(9), binder_free_ref(9),
binder_update_ref_for_handle(9), binder_dec_ref_for_handle(9),
binder_inc_ref_for_node(9), binder_thread_dec_tmpref(9),
binder_proc_dec_tmpref(9), binder_get_txn_from(9),
binder_get_txn_from_and_acq_inner(9), binder_free_txn_fixups(9),
binder_cleanup_transaction(9), binder_get_object(9),
binder_validate_ptr(9), binder_validate_fixup(9), struct
binder_task_work_cb(9), binder_do_fd_close(9),
binder_deferred_fd_close(9), struct binder_ptr_fixup(9), struct
binder_sg_copy(9), binder_do_deferred_txn_copies(9),
binder_cleanup_deferred_txn_lists(9), binder_add_fixup(9),
binder_can_update_transaction(9),
binder_find_outdated_transaction_ilocked(9), binder_proc_transaction(9),
binder_get_node_refs_for_txn(9), binder_netlink_report(9),
binder_free_buf(9), binder_apply_fd_fixups(9),
print_next_binder_node_ilocked(9)

---

okay that's the whole page, bestie 🫶 signing off from source ./drivers/android, dated October 2026, and yeah — this is binder_defer_copy(9) from the Kernel API Manual. mwah 💋✨