------------[ cut here ]------------
kernel BUG at drivers/android/binder.c:1173!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 UID: 0 PID: 6855 Comm: syz.1.923 Not tainted 6.11.0-rc2-syzkaller-00257-g5189dafa4cf9 #0
Hardware name: linux,dummy-virt (DT)
pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : binder_get_ref_for_node_olocked drivers/android/binder.c:1173 [inline]
pc : binder_inc_ref_for_node+0x504/0x548 drivers/android/binder.c:1476
lr : binder_get_ref_for_node_olocked drivers/android/binder.c:1160 [inline]
lr : binder_inc_ref_for_node+0x1dc/0x548 drivers/android/binder.c:1476
sp : ffff800088f0bb50
x29: ffff800088f0bb50 x28: fdf000000d3b7800 x27: 0000000000000000
x26: f4f00000087a6130 x25: f7f00000087a6a00 x24: fdf000000d3b7a34
x23: 0000000000000000 x22: ffff800088f0bc90 x21: ffff800081d75c30
x20: ffff8000824072c0 x19: f4f00000087a6128 x18: ffffffffffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200003c0
x14: ffff800088f0bd88 x13: ffff800088f0bd4a x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000078 x9 : ffff8000828bf000
x8 : f0f00000060b36c0 x7 : f7f0000004c1fb9c x6 : 0000000000000001
x5 : 0000000000000001 x4 : fcf00000087a6e28 x3 : f4f00000087a6120
x2 : fcf00000087a6e00 x1 : 0000000000000000 x0 : f4f00000087a6110
Call trace:
 binder_get_ref_for_node_olocked drivers/android/binder.c:1163 [inline]
 binder_inc_ref_for_node+0x504/0x548 drivers/android/binder.c:1476
 binder_thread_write+0x3cc/0x14fc drivers/android/binder.c:3944
 binder_ioctl_write_read drivers/android/binder.c:5161 [inline]
 binder_ioctl+0xd7c/0x12c0 drivers/android/binder.c:5447
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __arm64_sys_ioctl+0xac/0xf0 fs/ioctl.c:893
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
 el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: 97bb9580 17ffff01 f9403be3 17ffff46 (d4210000) 
---[ end trace 0000000000000000 ]---