------------[ cut here ]------------
kernel BUG at drivers/android/binder.c:1173!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 UID: 0 PID: 3805 Comm: syz.0.149 Not tainted 6.11.0-rc2-syzkaller-00239-g34ac1e82e5a7 #0
Hardware name: linux,dummy-virt (DT)
pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : binder_get_ref_for_node_olocked drivers/android/binder.c:1173 [inline]
pc : binder_inc_ref_for_node+0x504/0x548 drivers/android/binder.c:1476
lr : binder_get_ref_for_node_olocked drivers/android/binder.c:1160 [inline]
lr : binder_inc_ref_for_node+0x1dc/0x548 drivers/android/binder.c:1476
sp : ffff80008a5ebb50
x29: ffff80008a5ebb50 x28: f6f000000cad0400 x27: 0000000000000000
x26: fdf000000c8f36b8 x25: f6f000000c8f3580 x24: f6f000000cad0634
x23: 0000000000000000 x22: ffff80008a5ebc90 x21: ffff800081d75c30
x20: ffff8000824072c0 x19: fdf000000c8f36a8 x18: ffffffffffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200003c0
x14: ffff80008a5ebd88 x13: 0000000000000165 x12: ffff8000826c0078
x11: 0000000000000001 x10: faa63ba1dd1c10bf x9 : ffff8000828bf000
x8 : f1f00000052336c0 x7 : f1f00000042b243c x6 : 0000000000000001
x5 : 0000000000000001 x4 : f8f000000c85bfa8 x3 : fdf000000c8f36a0
x2 : f8f000000c85bf80 x1 : 0000000000000000 x0 : fdf000000c8f3690
Call trace:
 binder_get_ref_for_node_olocked drivers/android/binder.c:1163 [inline]
 binder_inc_ref_for_node+0x504/0x548 drivers/android/binder.c:1476
 binder_thread_write+0x3cc/0x14fc drivers/android/binder.c:3944
 binder_ioctl_write_read drivers/android/binder.c:5161 [inline]
 binder_ioctl+0xd7c/0x12c0 drivers/android/binder.c:5447
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __arm64_sys_ioctl+0xac/0xf0 fs/ioctl.c:893
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
 el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: 97bb9580 17ffff01 f9403be3 17ffff46 (d4210000) 
---[ end trace 0000000000000000 ]---