------------[ cut here ]------------
kernel BUG at drivers/android/binder.c:1173!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 UID: 0 PID: 4193 Comm: syz.0.227 Not tainted 6.11.0-rc2-syzkaller-00239-g34ac1e82e5a7 #0
Hardware name: linux,dummy-virt (DT)
pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : binder_get_ref_for_node_olocked drivers/android/binder.c:1173 [inline]
pc : binder_inc_ref_for_node+0x504/0x548 drivers/android/binder.c:1476
lr : binder_get_ref_for_node_olocked drivers/android/binder.c:1160 [inline]
lr : binder_inc_ref_for_node+0x1dc/0x548 drivers/android/binder.c:1476
sp : ffff80008abe3b50
x29: ffff80008abe3b50 x28: f5f000000b939400 x27: 0000000000000000
x26: f3f0000007d3e930 x25: fdf0000007f4f400 x24: f5f000000b939634
x23: 0000000000000000 x22: ffff80008abe3c90 x21: ffff800081d75c30
x20: ffff8000824072c0 x19: f3f0000007d3e928 x18: ffffffffffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200003c0
x14: ffff80008abe3d88 x13: ffff80008abe3d4a x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000078 x9 : ffff8000828bf000
x8 : f1f0000006fd36c0 x7 : f9f000000332dddc x6 : 0000000000000001
x5 : 0000000000000001 x4 : f1f0000007f4f7a8 x3 : f3f0000007d3e920
x2 : f1f0000007f4f780 x1 : 0000000000000000 x0 : f3f0000007d3e910
Call trace:
 binder_get_ref_for_node_olocked drivers/android/binder.c:1163 [inline]
 binder_inc_ref_for_node+0x504/0x548 drivers/android/binder.c:1476
 binder_thread_write+0x3cc/0x14fc drivers/android/binder.c:3944
 binder_ioctl_write_read drivers/android/binder.c:5161 [inline]
 binder_ioctl+0xd7c/0x12c0 drivers/android/binder.c:5447
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __arm64_sys_ioctl+0xac/0xf0 fs/ioctl.c:893
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
 el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: 97bb9580 17ffff01 f9403be3 17ffff46 (d4210000) 
---[ end trace 0000000000000000 ]---