Backtrace

WARNING: CPU: 0 PID: 1555 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110
Modules linked in: tls uinput isofs snd_seq_dummy snd_hrtimer nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 snd_seq_midi snd_seq_midi_event rfkill ip_set nf_tables nfnetlink qrtr vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock snd_ens1371 intel_rapl_msr snd_ac97_codec intel_rapl_common snd_rawmidi rapl gameport ac97_bus vmw_balloon snd_seq snd_seq_device snd_pcm pcspkr joydev sunrpc snd_timer snd soundcore i2c_piix4 vmw_vmci binfmt_misc loop zram crct10dif_pclmul crc32_pclmul crc32c_intel polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 serio_raw vmwgfx e1000 mptspi scsi_transport_spi drm_ttm_helper mptscsih ttm mptbase ata_generic pata_acpi ip6_tables ip_tables fuse
CPU: 0 PID: 1555 Comm: Xwayland Tainted: G S                 6.1.18-200.fc37.x86_64 #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019
RIP: 0010:refcount_warn_saturate+0xba/0x110
Code: 01 01 e8 e9 ab 9f ff 0f 0b c3 cc cc cc cc 80 3d 91 d4 bd 01 00 75 85 48 c7 c7 68 40 76 a4 c6 05 81 d4 bd 01 01 e8 c6 ab 9f ff <0f> 0b c3 cc cc cc cc 80 3d 6c d4 bd 01 00 0f 85 5e ff ff ff 48 c7
RSP: 0018:ffffb9b884427c88 EFLAGS: 00010296
RAX: 0000000000000026 RBX: ffffb9b884427ca8 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffffa474aa5b RDI: 00000000ffffffff
RBP: ffff9e554fc40008 R08: 0000000000000000 R09: ffffb9b884427b10
R10: 0000000000000003 R11: ffffffffa5147448 R12: ffff9e554971e300
R13: ffff9e564aad0000 R14: ffff9e554fce6ad0 R15: dead000000000100
FS:  0000000000000000(0000) GS:ffff9e567bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557f86118c28 CR3: 00000000352a8003 CR4: 00000000001706f0
Call Trace:
 <TASK>
 vmw_user_surface_base_release+0x5e/0x70 [vmwgfx]
 ttm_prime_refcount_release+0x2c/0x40 [vmwgfx]
 ttm_release_base+0x72/0xa0 [vmwgfx]
 ttm_ref_object_release+0xb6/0xd0 [vmwgfx]
 ttm_object_file_release+0x39/0x90 [vmwgfx]
 vmw_postclose+0x15/0x20 [vmwgfx]
 drm_file_free.part.0+0x204/0x250
 drm_release+0x64/0xd0
 __fput+0x8e/0x250
 task_work_run+0x56/0x90
 do_exit+0x347/0xb20
 ? __handle_mm_fault+0x92c/0xe40
 do_group_exit+0x2d/0x80
 __x64_sys_exit_group+0x14/0x20
 do_syscall_64+0x58/0x80
 ? handle_mm_fault+0xdb/0x2d0
 ? preempt_count_add+0x47/0xa0
 ? up_read+0x37/0x70
 ? do_user_addr_fault+0x1ef/0x690
 ? exc_page_fault+0x70/0x170
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f6b5bc42d81
Code: Unable to access opcode bytes at 0x7f6b5bc42d57.
RSP: 002b:00007ffd23df5168 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f6b5bd3ba00 RCX: 00007f6b5bc42d81
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 0000000000000001 R08: fffffffffffffd18 R09: 0000000000000000
R10: 00007ffd23df4bf0 R11: 0000000000000246 R12: 00007f6b5bd3ba00
R13: 0000000000000000 R14: 00007f6b5bd412e8 R15: 00007f6b5bd41300
 </TASK>