bpf_test_finish()

[David Miller]

It dereferences a user pointer:

static int bpf_test_finish(union bpf_attr __user *uattr, const void *data,
                           u32 size, u32 retval, u32 duration)
{
        void __user *data_out = u64_to_user_ptr(uattr->test.data_out);
                                                ^^^^^^^^^^^^^^^^^^^^
Which of course doesn't work so well :-)

I really wish that didn't silently work on x86/x86_64.

You're going to have to do a "get_user(&uattr->test.data_out)"