4    1 0xffffffff82600000   bbe000 drm.ko
debug.selffree: 0 -> 0
SELFFREE: loaded; use sysctl debug.selffree=1
SELFFREE: struct work_struct size=32 worker=16 on_queue=24 running=25 canceled=26; selffree size=96
SELFFREE[0]: freed+reclaimed @0xfffff8004f1ae100; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[1]: freed+reclaimed @0xfffff8004f1ae160; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[2]: freed+reclaimed @0xfffff8004f1ae1c0; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[3]: freed+reclaimed @0xfffff8004f1ae220; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[4]: freed+reclaimed @0xfffff8004f1ae280; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[5]: freed+reclaimed @0xfffff8004f1ae2e0; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[6]: freed+reclaimed @0xfffff8004f1ae340; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[7]: freed+reclaimed @0xfffff8004f1ae3a0; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE: SUMMARY freed=8 reclaimed=8 uaf_running_write=8 uaf_worker_null_write=8
SELFFREE: VERDICT UAF-WRITE REPRODUCED - process_all_work touched the freed work item after func() returned (see linux_workqueue.c:92-98)