------------[ cut here ]------------
kernel BUG at drivers/android/binder_alloc.c:897!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 UID: 0 PID: 25 Comm: kworker/1:0 Not tainted 6.11.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events binder_deferred_func
RIP: 0010:binder_alloc_deferred_release+0x248/0x260 drivers/android/binder_alloc.c:897
Code: 5b 45 89 e0 44 89 e9 48 c7 c6 f0 fe 24 83 8b 95 90 00 00 00 48 c7 c7 80 a2 ad 83 5d 41 5c 41 5d 41 5e 41 5f e9 89 b9 b9 fe 90 <0f> 0b e8 c1 89 b0 fe eb 8c 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f
RSP: 0018:ffffc900000dbd68 EFLAGS: 00010286
RAX: ffff888101af21c0 RBX: ffff888105754c00 RCX: 000000002854ec8c
RDX: 0000000000000001 RSI: ffffffff83897be1 RDI: ffff888105754df0
RBP: ffff888105754df0 R08: 0000000000000000 R09: ffff888101af2c10
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888105754c00
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2bc5ffff CR3: 0000000003e4a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 binder_free_proc drivers/android/binder.c:5008 [inline]
 binder_proc_dec_tmpref drivers/android/binder.c:1558 [inline]
 binder_proc_dec_tmpref+0x118/0x220 drivers/android/binder.c:1551
 binder_deferred_release drivers/android/binder.c:5994 [inline]
 binder_deferred_func+0x6fe/0x7e0 drivers/android/binder.c:6021
 process_one_work+0x249/0x770 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x175/0x310 kernel/workqueue.c:3389
 kthread+0xda/0x110 kernel/kthread.c:389
 ret_from_fork+0x2c/0x50 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:binder_alloc_deferred_release+0x248/0x260 drivers/android/binder_alloc.c:897
Code: 5b 45 89 e0 44 89 e9 48 c7 c6 f0 fe 24 83 8b 95 90 00 00 00 48 c7 c7 80 a2 ad 83 5d 41 5c 41 5d 41 5e 41 5f e9 89 b9 b9 fe 90 <0f> 0b e8 c1 89 b0 fe eb 8c 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f
RSP: 0018:ffffc900000dbd68 EFLAGS: 00010286

RAX: ffff888101af21c0 RBX: ffff888105754c00 RCX: 000000002854ec8c
RDX: 0000000000000001 RSI: ffffffff83897be1 RDI: ffff888105754df0
RBP: ffff888105754df0 R08: 0000000000000000 R09: ffff888101af2c10
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888105754c00
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2bc5ffff CR3: 0000000003e4a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400