Backtrace

BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 0 PID: 2125 Comm: Xwayland Not tainted 5.17.5-200.fc35.x86_64 #1
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
RIP: 0010:drm_gem_object_free+0xc/0x20 [drm]
Code: 44 00 00 48 8b bf e0 05 00 00 e9 ff fe 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 48 8b 87 40 01 00 00 <48> 8b 00 48 85 c0 74 06 e9 c7 0b db d3 cc 0f 0b c3 cc 66 90 0f 1f
RSP: 0018:ffffa821039dbd10 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffa821039dbd30 RCX: 0000000000000001
RDX: ffff8d8412219878 RSI: ffff8d83e4494922 RDI: ffff8d83d596f000
RBP: ffff8d83c7e8f540 R08: ffff8d8412219800 R09: ffff8d83c7e8f5d0
R10: 0000000000000000 R11: ffff8d83e4494920 R12: ffff8d83c61574e0
R13: ffffa821039dbe18 R14: ffff8d83fee9da00 R15: ffff8d83fee9da00
FS:  00007f490eb3aa00(0000) GS:ffff8d843dc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000003a96e002 CR4: 00000000000706f0
Call Trace:
 <TASK>
 vmw_user_surface_base_release+0x5d/0x70 [vmwgfx]
 ttm_prime_refcount_release+0x2f/0x40 [vmwgfx]
 ttm_release_base+0x74/0xa0 [vmwgfx]
 ttm_ref_object_release+0xa2/0xb0 [vmwgfx]
 ttm_ref_object_base_unref+0x6a/0xa0 [vmwgfx]
 ? vmw_surface_dirty_range_add+0x480/0x480 [vmwgfx]
 drm_ioctl_kernel+0x8e/0x120 [drm]
 drm_ioctl+0x221/0x3e0 [drm]
 ? vmw_surface_dirty_range_add+0x480/0x480 [vmwgfx]
 ? ioctl_has_perm.constprop.0.isra.0+0xaa/0xf0
 ? __schedule+0x23b/0x11c0
 ? ktime_get+0x38/0x90
 ? drm_ioctl_kernel+0x120/0x120 [drm]
 vmw_generic_ioctl+0x8e/0x100 [vmwgfx]
 __x64_sys_ioctl+0x83/0xc0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f490f6becdb
Code: 73 01 c3 48 8b 0d 45 81 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 15 81 1b 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe6e739ed8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffe6e739f20 RCX: 00007f490f6becdb
RDX: 00007ffe6e739f20 RSI: 000000004008644a RDI: 000000000000000c
RBP: 000000004008644a R08: 000055c4f4eba2c0 R09: 0000000000000000
R10: 00000000ffffff38 R11: 0000000000000246 R12: 000055c4f4eb9ca0
R13: 000000000000000c R14: 000055c4f4eba2b0 R15: 000055c4f4e7e274
 </TASK>
Modules linked in: squashfs loop uinput snd_seq_dummy snd_hrtimer vboxvideo drm_vram_helper nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set rfkill nf_tables nfnetlink qrtr vboxsf sunrpc snd_intel8x0 snd_ac97_codec ac97_bus snd_seq snd_seq_device snd_pcm snd_timer snd soundcore intel_rapl_msr intel_rapl_common rapl iTCO_wdt intel_pmc_bxt iTCO_vendor_support joydev lpc_ich pcspkr i2c_piix4 vboxguest zram ip_tables vmwgfx drm_ttm_helper ttm drm_kms_helper cec crct10dif_pclmul e1000 drm crc32_pclmul crc32c_intel ghash_clmulni_intel serio_raw video ata_generic pata_acpi ipmi_devintf ipmi_msghandler fuse
CR2: 0000000000000000