------------[ cut here ]------------
kernel BUG at drivers/android/binder_alloc.c:820!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 27 Comm: kworker/1:1 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events binder_deferred_func
RIP: 0010:binder_alloc_deferred_release+0x602/0x780 drivers/android/binder_alloc.c:820
Code: c6 80 2e c7 8a 48 c7 c7 40 db 48 8d e8 d7 5c 05 fd 31 ff 89 c5 89 c6 e8 dc b3 5c fa 85 ed 74 c6 e9 a2 68 56 02 e8 7e b7 5c fa <0f> 0b c7 44 24 20 00 00 00 00 e9 27 ff ff ff e8 6a b7 5c fa 48 89
RSP: 0018:ffffc90000a2fbc8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888079ef89e0 RCX: 0000000000000000
RDX: ffff888011bf3a80 RSI: ffffffff871e05d2 RDI: ffff888079ef8a70
RBP: ffff888079ef8800 R08: 0000000000000000 R09: ffffffff8dbd3c97
R10: fffffbfff1b7a792 R11: 0000000000000001 R12: ffff888147392c60
R13: ffff888079ef8ad8 R14: ffff888147392d10 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcea76df458 CR3: 000000002053c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 binder_free_proc drivers/android/binder.c:4766 [inline]
 binder_proc_dec_tmpref drivers/android/binder.c:1433 [inline]
 binder_proc_dec_tmpref+0x2aa/0x530 drivers/android/binder.c:1426
 binder_deferred_release drivers/android/binder.c:5761 [inline]
 binder_deferred_func+0xe2a/0x1150 drivers/android/binder.c:5788
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:binder_alloc_deferred_release+0x602/0x780 drivers/android/binder_alloc.c:820
Code: c6 80 2e c7 8a 48 c7 c7 40 db 48 8d e8 d7 5c 05 fd 31 ff 89 c5 89 c6 e8 dc b3 5c fa 85 ed 74 c6 e9 a2 68 56 02 e8 7e b7 5c fa <0f> 0b c7 44 24 20 00 00 00 00 e9 27 ff ff ff e8 6a b7 5c fa 48 89
RSP: 0018:ffffc90000a2fbc8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888079ef89e0 RCX: 0000000000000000
RDX: ffff888011bf3a80 RSI: ffffffff871e05d2 RDI: ffff888079ef8a70
RBP: ffff888079ef8800 R08: 0000000000000000 R09: ffffffff8dbd3c97
R10: fffffbfff1b7a792 R11: 0000000000000001 R12: ffff888147392c60
R13: ffff888079ef8ad8 R14: ffff888147392d10 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcea76df458 CR3: 0000000016926000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400