------------[ cut here ]------------ kernel BUG at drivers/android/binder_alloc.c:820! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 23 Comm: kworker/1:0 Not tainted 5.19.0-rc2-next-20220615-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events binder_deferred_func RIP: 0010:binder_alloc_deferred_release+0x602/0x780 drivers/android/binder_alloc.c:820 Code: c6 80 16 c7 8a 48 c7 c7 80 b6 48 8d e8 57 86 05 fd 31 ff 89 c5 89 c6 e8 fc ba 5b fa 85 ed 74 c6 e9 78 57 55 02 e8 9e be 5b fa <0f> 0b c7 44 24 20 00 00 00 00 e9 27 ff ff ff e8 8a be 5b fa 48 89 RSP: 0018:ffffc900001d7bc8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88801f3d49e0 RCX: 0000000000000000 RDX: ffff888011a857c0 RSI: ffffffff871f04b2 RDI: ffff88801f3d4a70 RBP: ffff88801f3d4800 R08: 0000000000000000 R09: ffffffff8dbcac17 R10: fffffbfff1b79582 R11: 0000000000000001 R12: ffff88801b789c60 R13: ffff88801f3d4ad8 R14: ffff88801b789d10 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2d922000 CR3: 00000000215b5000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: binder_free_proc drivers/android/binder.c:4766 [inline] binder_proc_dec_tmpref drivers/android/binder.c:1433 [inline] binder_proc_dec_tmpref+0x2aa/0x530 drivers/android/binder.c:1426 binder_deferred_release drivers/android/binder.c:5761 [inline] binder_deferred_func+0xe2a/0x1150 drivers/android/binder.c:5788 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:binder_alloc_deferred_release+0x602/0x780 drivers/android/binder_alloc.c:820 Code: c6 80 16 c7 8a 48 c7 c7 80 b6 48 8d e8 57 86 05 fd 31 ff 89 c5 89 c6 e8 fc ba 5b fa 85 ed 74 c6 e9 78 57 55 02 e8 9e be 5b fa <0f> 0b c7 44 24 20 00 00 00 00 e9 27 ff ff ff e8 8a be 5b fa 48 89 RSP: 0018:ffffc900001d7bc8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88801f3d49e0 RCX: 0000000000000000 RDX: ffff888011a857c0 RSI: ffffffff871f04b2 RDI: ffff88801f3d4a70 RBP: ffff88801f3d4800 R08: 0000000000000000 R09: ffffffff8dbcac17 R10: fffffbfff1b79582 R11: 0000000000000001 R12: ffff88801b789c60 R13: ffff88801f3d4ad8 R14: ffff88801b789d10 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0522bdd718 CR3: 0000000061373000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400