Question: why current_ptr = *(unsigned long *)(page_buffer + 0xe8);

[ecular]

I know 0xe8 = 14 * sizeof(struct iovec) + 8.
But why task_struct * is stored at &task_list + 0xe8 ?

[ecular]

I have got the answer.

[novitoll]

@ecular , could you please explain?

[novitoll]

Got it as well. This is the offset from waitqueue->*next pointer to struct task_struct *task in struct binder_thread object.