Backtrace

BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: 0000 [#3] PREEMPT SMP PTI
CPU: 3 PID: 2161 Comm: Xwayland Tainted: G      D W    L    5.17.5-300.fc36.x86_64 #1
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
RIP: 0010:drm_gem_object_free+0xc/0x20
Code: 44 00 00 48 8b bf e0 05 00 00 e9 3f fe 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 48 8b 87 40 01 00 00 <48> 8b 00 48 85 c0 74 06 e9 f7 26 79 00 cc 0f 0b c3 cc 66 90 0f 1f
RSP: 0018:ffffb95c8405bd10 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffb95c8405bd30 RCX: 0000000000000001
RDX: ffff907aa43a2878 RSI: ffff907a5d75dff2 RDI: ffff907aac799800
RBP: ffff907a4459b248 R08: ffff907a5d75e060 R09: ffff907a463f1a50
R10: 0000000000000000 R11: ffff907a5d75dff0 R12: ffff907aa40f5ba0
R13: ffffb95c8405be18 R14: ffff907a9a23b000 R15: ffff907a9a23b000
FS:  00007f9533deee80(0000) GS:ffff907b04980000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000534e8003 CR4: 00000000000706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 vmw_user_surface_base_release+0x5d/0x70 [vmwgfx]
 ttm_prime_refcount_release+0x2f/0x40 [vmwgfx]
 ttm_release_base+0x74/0xa0 [vmwgfx]
 ttm_ref_object_release+0xa2/0xb0 [vmwgfx]
 ttm_ref_object_base_unref+0x68/0x90 [vmwgfx]
 ? vmw_surface_dirty_range_add+0x450/0x450 [vmwgfx]
 drm_ioctl_kernel+0x9e/0x140
 drm_ioctl+0x21c/0x410
 ? vmw_surface_dirty_range_add+0x450/0x450 [vmwgfx]
 ? ioctl_has_perm.constprop.0.isra.0+0xaa/0xf0
 ? __schedule+0x28b/0x1230
 ? drm_ioctl_kernel+0x140/0x140
 vmw_generic_ioctl+0x8f/0xf0 [vmwgfx]
 __x64_sys_ioctl+0x8d/0xc0
 do_syscall_64+0x3a/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f9534a6da3f
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffc111c2db0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9534a6da3f
RDX: 00007ffc111c2e50 RSI: 000000004008644a RDI: 000000000000000c
RBP: 00007ffc111c2e50 R08: 0000563b6b629c50 R09: 0000000000000000
R10: 00000000ffffff9d R11: 0000000000000246 R12: 000000004008644a
R13: 000000000000000c R14: 0000563b6b62b490 R15: 0000563b6b62b040
 </TASK>
Modules linked in: tls uinput snd_seq_dummy snd_hrtimer nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set rfkill nf_tables nfnetlink qrtr sunrpc intel_rapl_msr intel_rapl_common rapl joydev snd_intel8x0 snd_ac97_codec ac97_bus snd_seq snd_seq_device pcspkr snd_pcm snd_timer snd e1000 vboxguest soundcore i2c_piix4 zram crct10dif_pclmul crc32_pclmul crc32c_intel vmwgfx ghash_clmulni_intel drm_ttm_helper serio_raw ttm ata_generic pata_acpi video ip6_tables ip_tables ipmi_devintf ipmi_msghandler fuse
CR2: 0000000000000000