The vma start address should be substracted from the buffer's user data
address and not the other way around.

Cc: Tiffany Y. Yang <ynaffit@google.com>
Cc: stable@vger.kernel.org
Fixes: 162c79731448 ("binder: avoid user addresses in debug logs")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
---
 drivers/android/binder.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 76052006bd87..5fc2c8ee61b1 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -6373,7 +6373,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
 		seq_printf(m, " node %d", buffer->target_node->debug_id);
 	seq_printf(m, " size %zd:%zd offset %lx\n",
 		   buffer->data_size, buffer->offsets_size,
-		   proc->alloc.vm_start - buffer->user_data);
+		   buffer->user_data - proc->alloc.vm_start);
 }
 
 static void print_binder_work_ilocked(struct seq_file *m,
-- 
2.49.0.395.g12beb8f557-goog

Carlos Llamas <cmllamas@google.com> writes:

> The vma start address should be substracted from the buffer's user data
> address and not the other way around.
>
> Cc: Tiffany Y. Yang <ynaffit@google.com>
> Cc: stable@vger.kernel.org
> Fixes: 162c79731448 ("binder: avoid user addresses in debug logs")
> Signed-off-by: Carlos Llamas <cmllamas@google.com>

Reviewed-by: Tiffany Y. Yang <ynaffit@google.com>

> ---
>  drivers/android/binder.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 76052006bd87..5fc2c8ee61b1 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -6373,7 +6373,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
>  		seq_printf(m, " node %d", buffer->target_node->debug_id);
>  	seq_printf(m, " size %zd:%zd offset %lx\n",
>  		   buffer->data_size, buffer->offsets_size,
> -		   proc->alloc.vm_start - buffer->user_data);
> +		   buffer->user_data - proc->alloc.vm_start);
>  }
>  
>  static void print_binder_work_ilocked(struct seq_file *m,