[DF4740] module loaded: sysctl hw.df4740.test=1 (recovery UAF) or =2 (fini/TDR UAF)
[DF4740] test1 attempt 1: setup
[DF4740] attempt 1: benign interleave (finish_work won the lock); retrying
[DF4740] test1 attempt 2: setup
[DF4740] attempt 2: benign interleave (finish_work won the lock); retrying
[DF4740] test1 attempt 3: setup
[DF4740] attempt 3: benign interleave (finish_work won the lock); retrying
[DF4740] test1 attempt 4: setup
[DF4740] attempt 4: benign interleave (finish_work won the lock); retrying
[DF4740] test1 attempt 5: setup
[DF4740] attempt 5: benign interleave (finish_work won the lock); retrying
[DF4740] test1 attempt 6: setup
[DF4740] attempt 6: benign interleave (finish_work won the lock); retrying
[DF4740] test1 attempt 7: setup
[DF4740] attempt 7: benign interleave (finish_work won the lock); retrying
[DF4740] test1 attempt 8: setup
[DF4740] attempt 8: benign interleave (finish_work won the lock); retrying
[DF4740] test1 attempt 9: setup
[DF4740] attempt 9: benign interleave (finish_work won the lock); retrying
[DF4740] test1 attempt 10: setup
[DF4740] attempt 10: benign interleave (finish_work won the lock); retrying
[DF4740] FAILED to catch the race in 10 attempts
[DF4740] free_job(victim) job=0xfffff8008f8ed100 s_fence=0xfffff8008d3ce200 - victim job FREED while recovery(B) sits inside run_job()
[DF4740] stagehand: opening gate - recovery resumes into freed/reclaimed s_fence memory
[DF4741] test2: scheduler with 1s TDR, hung job, drm_sched_fini(), then kfree(sched) as amdgpu does for struct amdgpu_ring after amdgpu_fence_driver_fini()
[DF4741] job 0xfffff8008f8ed000 in flight, work_tdr armed (timeout=200 ticks); calling drm_sched_fini()
[DF4741] drm_sched_fini() returned WITHOUT cancelling work_tdr or draining ring_mirror_list; freeing scheduler 0xfffff8008f7deac0 and reclaiming the block with zeroed memory (as any kzalloc consumer would)
[DF4741] reclaim block 0 at 0xfffff8008f7deac0 (zeroed)
[DF4741] reclaim block 1 at 0xfffff8008f7dc040 (zeroed)
[DF4741] reclaim block 2 at 0xfffff8008f7de5c0 (zeroed)
[DF4741] reclaim block 3 at 0xfffff8008f7dca40 (zeroed)
[DF4741] waiting for the armed work_tdr callout to fire on freed memory (~1-2s)...