Backtrace

BUG: Bad rss-counter state mm:000000006f161af3 type:MM_ANONPAGES val:-1
BUG: Bad rss-counter state mm:000000006f161af3 type:MM_SHMEMPAGES val:1
soffice.bin[64236]: segfault at 6a5605d4 ip 000000006a5605d4 sp 00007ffc13723f48 error 14 in soffice.bin[5621ac46d000+1000]
Code: Unable to access opcode bytes at RIP 0x6a5605aa.
------------[ cut here ]------------
WARNING: CPU: 11 PID: 64236 at mm/gup.c:172 try_grab_page+0xaa/0xc0
Modules linked in: binfmt_misc snd_usb_audio snd_usbmidi_lib snd_rawmidi mc tls rfcomm snd_seq_dummy snd_hrtimer rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs nvidia_drm(POE) nvidia_modeset(POE) nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nvidia_uvm(POE) nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables nfnetlink qrtr bnep sunrpc nvidia(POE) vfat fat iwlmvm intel_rapl_msr intel_rapl_common mac80211 snd_hda_codec_hdmi snd_hda_intel libarc4 edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi btusb kvm_amd btrtl snd_hda_codec iwlwifi btbcm kvm snd_hda_core iwlmei btintel snd_hwdep irqbypass rapl snd_seq btmtk snd_seq_device pcspkr wmi_bmof k10temp i2c_piix4 bluetooth cfg80211 snd_pcm snd_timer ecdh_generic snd joydev mei soundcore rfkill gpio_amdpt gpio_generic acpi_cpufreq zram hid_logitech_hidpp
 hid_logitech_dj crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel ccp r8169 nvme sp5100_tco nvme_core wmi ip6_tables ip_tables ipmi_devintf ipmi_msghandler fuse
CPU: 11 PID: 64236 Comm: soffice.bin Tainted: P      D W  OE     5.18.9-200.fc36.x86_64 #1
Hardware name: Micro-Star International Co., Ltd. MS-7C91/MPG B550 GAMING EDGE WIFI (MS-7C91), BIOS 1.A0 05/25/2022
RIP: 0010:try_grab_page+0xaa/0xc0
Code: 00 be 23 00 00 00 48 c1 e8 36 48 8b 3c c5 e0 40 19 98 e8 09 c6 fe ff b8 01 00 00 00 c3 cc f0 83 47 34 01 f0 83 47 58 01 eb cf <0f> 0b 31 c0 c3 cc 0f 0b e9 6e ff ff ff 48 8d 78 ff e9 53 ff ff ff
RSP: 0018:ffffadfa5691b970 EFLAGS: 00010246
RAX: 0000000000000000 RBX: fffff7c918e663e8 RCX: 0000000000000000
RDX: 800000033f495867 RSI: 000000000000001c RDI: fffff7c90cfd2540
RBP: ffff9fc0b998f490 R08: ffff9fbc46e42af0 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 000000000000001c
R13: ffff9fbc46e42af0 R14: 0000000000000000 R15: fffff7c90cfd2540
FS:  00007f19188b50c0(0000) GS:ffff9fc27cac0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000006a5605aa CR3: 000000063ba30000 CR4: 0000000000750ee0
PKRU: 55555554
Call Trace:
 <TASK>
 follow_page_pte+0x26b/0x420
 __get_user_pages+0x173/0x650
 get_dump_page+0xa2/0x2d0
 dump_user_range+0x88/0x130
 elf_core_dump+0xb89/0xe70
 ? 0xffffffffff600000
 do_coredump+0x1017/0x15f0
 get_signal+0x8f3/0x950
 arch_do_signal_or_restart+0x30/0x740
 ? force_sig_fault+0x5f/0x80
 ? __bad_area_nosemaphore+0x11b/0x190
 exit_to_user_mode_prepare+0x114/0x1f0
 ? asm_exc_page_fault+0x8/0x30
 irqentry_exit_to_user_mode+0x5/0x20
 asm_exc_page_fault+0x1e/0x30
RIP: 0033:0x6a5605d4
Code: Unable to access opcode bytes at RIP 0x6a5605aa.
RSP: 002b:00007ffc13723f48 EFLAGS: 00010206
RAX: 000000006a5605d4 RBX: 0000000000000000 RCX: 00007f1921526c90
RDX: 00005621b14919e0 RSI: 00000005621b1491 RDI: 0000000000000000
RBP: 00005621b1492340 R08: 00005621b14919d0 R09: 0000000000000000
R10: 00005621bd1b6770 R11: 895607a18eaa273b R12: 00005621b148f650
R13: 00007f19203c4100 R14: 00007f1921527ee8 R15: 00005621af751b20
 </TASK>