[PATCH 0/3] Continue iovec api clean up

[PATCH 0/3] Continue iovec api clean up

[Gabriel Krisman Bertazi]

I found the first patch in an old branch and took the opportunity to
find another (i think the last) case where the same pattern of directly
copying the iov existed.

Tested with liburing.

Gabriel Krisman Bertazi (3):
  io_uring/rw: Drop custom iov copy in io_iov_buffer_select_prep
  io_uring/net: Drop custom iov copy in io_msg_copy_hdr
  io_uring/net: Drop ddir argument from io_msg_copy_hdr

 io_uring/net.c | 75 +++++++++++++++-----------------------------------
 io_uring/rw.c  | 24 ++++------------
 2 files changed, 27 insertions(+), 72 deletions(-)

-- 
2.55.0

[PATCH 1/3] io_uring/rw: Drop custom iov copy in io_iov_buffer_select_prep

[Gabriel Krisman Bertazi]

Similar to commit f4eaf8eda89e ("io_uring/rsrc: Drop io_copy_iov in
favor of iovec API"), avoid custom copy and just rely on the iovec api.

Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
---
 io_uring/rw.c | 24 +++++-------------------
 1 file changed, 5 insertions(+), 19 deletions(-)

diff --git a/io_uring/rw.c b/io_uring/rw.c
index 95038cfda615..95106dd1d7eb 100644
--- a/io_uring/rw.c
+++ b/io_uring/rw.c
@@ -9,7 +9,6 @@
 #include <linux/fsnotify.h>
 #include <linux/poll.h>
 #include <linux/nospec.h>
-#include <linux/compat.h>
 #include <linux/io_uring/cmd.h>
 #include <linux/indirect_call_wrapper.h>
 
@@ -50,33 +49,20 @@ static bool io_file_supports_nowait(struct io_kiocb *req, __poll_t mask)
 	return false;
 }
 
-static int io_iov_compat_buffer_select_prep(struct io_rw *rw)
-{
-	struct compat_iovec __user *uiov = u64_to_user_ptr(rw->addr);
-	struct compat_iovec iov;
-
-	if (copy_from_user(&iov, uiov, sizeof(iov)))
-		return -EFAULT;
-	rw->len = iov.iov_len;
-	return 0;
-}
-
 static int io_iov_buffer_select_prep(struct io_kiocb *req)
 {
 	struct iovec __user *uiov;
-	struct iovec iov;
+	struct iovec fast_iov, *iov;
 	struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw);
 
 	if (rw->len != 1)
 		return -EINVAL;
 
-	if (io_is_compat(req->ctx))
-		return io_iov_compat_buffer_select_prep(rw);
-
 	uiov = u64_to_user_ptr(rw->addr);
-	if (copy_from_user(&iov, uiov, sizeof(*uiov)))
-		return -EFAULT;
-	rw->len = iov.iov_len;
+	iov = iovec_from_user(uiov, 1, 1, &fast_iov, io_is_compat(req->ctx));
+	if (IS_ERR(iov))
+		return PTR_ERR(iov);
+	rw->len = iov->iov_len;
 	return 0;
 }
 
-- 
2.55.0

[PATCH 2/3] io_uring/net: Drop custom iov copy in io_msg_copy_hdr

[Gabriel Krisman Bertazi]

Similar to commit f4eaf8eda89e ("io_uring/rsrc: Drop io_copy_iov in
favor of iovec API"), avoid the custom copy of a single iovec and just
rely on the iovec api.  This lets the compat and native paths share the
buffer-select length lookup

Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
---
 io_uring/net.c | 69 ++++++++++++++------------------------------------
 1 file changed, 19 insertions(+), 50 deletions(-)

diff --git a/io_uring/net.c b/io_uring/net.c
index a74d15f7b7d2..f476399e1d63 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -236,39 +236,6 @@ static int io_net_import_vec(struct io_kiocb *req, struct io_async_msghdr *iomsg
 	return 0;
 }
 
-static int io_compat_msg_copy_hdr(struct io_kiocb *req,
-				  struct io_async_msghdr *iomsg,
-				  struct compat_msghdr *msg, int ddir,
-				  struct sockaddr __user **save_addr)
-{
-	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
-	struct compat_iovec __user *uiov;
-	int ret;
-
-	if (copy_from_user(msg, sr->umsg_compat, sizeof(*msg)))
-		return -EFAULT;
-
-	ret = __get_compat_msghdr(&iomsg->msg, msg, save_addr);
-	if (ret)
-		return ret;
-
-	uiov = compat_ptr(msg->msg_iov);
-	if (req->flags & REQ_F_BUFFER_SELECT) {
-		if (msg->msg_iovlen == 0) {
-			sr->len = 0;
-		} else if (msg->msg_iovlen > 1) {
-			return -EINVAL;
-		} else {
-			struct compat_iovec tmp_iov;
-
-			if (copy_from_user(&tmp_iov, uiov, sizeof(tmp_iov)))
-				return -EFAULT;
-			sr->len = tmp_iov.iov_len;
-		}
-	}
-	return 0;
-}
-
 static int io_copy_msghdr_from_user(struct user_msghdr *msg,
 				    struct user_msghdr __user *umsg)
 {
@@ -292,7 +259,6 @@ static int io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg,
 			   struct sockaddr __user **save_addr)
 {
 	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
-	struct user_msghdr __user *umsg = sr->umsg;
 	int ret;
 
 	iomsg->msg.msg_name = &iomsg->addr;
@@ -301,7 +267,10 @@ static int io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg,
 	if (io_is_compat(req->ctx)) {
 		struct compat_msghdr cmsg;
 
-		ret = io_compat_msg_copy_hdr(req, iomsg, &cmsg, ddir, save_addr);
+		if (copy_from_user(&cmsg, sr->umsg_compat, sizeof(cmsg)))
+			return -EFAULT;
+
+		ret = __get_compat_msghdr(&iomsg->msg, &cmsg, save_addr);
 		if (ret)
 			return ret;
 
@@ -310,18 +279,17 @@ static int io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg,
 		msg->msg_controllen = cmsg.msg_controllen;
 		msg->msg_iov = compat_ptr(cmsg.msg_iov);
 		msg->msg_iovlen = cmsg.msg_iovlen;
-		return 0;
-	}
-
-	ret = io_copy_msghdr_from_user(msg, umsg);
-	if (unlikely(ret))
-		return ret;
+	} else {
+		ret = io_copy_msghdr_from_user(msg, sr->umsg);
+		if (unlikely(ret))
+			return ret;
 
-	msg->msg_flags = 0;
+		msg->msg_flags = 0;
 
-	ret = __copy_msghdr(&iomsg->msg, msg, save_addr);
-	if (ret)
-		return ret;
+		ret = __copy_msghdr(&iomsg->msg, msg, save_addr);
+		if (ret)
+			return ret;
+	}
 
 	if (req->flags & REQ_F_BUFFER_SELECT) {
 		if (msg->msg_iovlen == 0) {
@@ -329,12 +297,13 @@ static int io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg,
 		} else if (msg->msg_iovlen > 1) {
 			return -EINVAL;
 		} else {
-			struct iovec __user *uiov = msg->msg_iov;
-			struct iovec tmp_iov;
+			struct iovec fast_iov, *iov;
 
-			if (copy_from_user(&tmp_iov, uiov, sizeof(tmp_iov)))
-				return -EFAULT;
-			sr->len = tmp_iov.iov_len;
+			iov = iovec_from_user(msg->msg_iov, 1, 1, &fast_iov,
+					      io_is_compat(req->ctx));
+			if (IS_ERR(iov))
+				return PTR_ERR(iov);
+			sr->len = iov->iov_len;
 		}
 	}
 	return 0;
-- 
2.55.0

[PATCH 3/3] io_uring/net: Drop ddir argument from io_msg_copy_hdr

[Gabriel Krisman Bertazi]

ddir was only ever forwarded to io_compat_msg_copy_hdr, which
never looked at it.  Drop it.

Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
---
 io_uring/net.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/io_uring/net.c b/io_uring/net.c
index f476399e1d63..3f04aa1054c6 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -255,7 +255,7 @@ static int io_copy_msghdr_from_user(struct user_msghdr *msg,
 }
 
 static int io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg,
-			   struct user_msghdr *msg, int ddir,
+			   struct user_msghdr *msg,
 			   struct sockaddr __user **save_addr)
 {
 	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
@@ -371,7 +371,7 @@ static int io_sendmsg_setup(struct io_kiocb *req, const struct io_uring_sqe *sqe
 
 	sr->flags |= IORING_SEND_VECTORIZED;
 	sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr));
-	ret = io_msg_copy_hdr(req, kmsg, &msg, ITER_SOURCE, NULL);
+	ret = io_msg_copy_hdr(req, kmsg, &msg, NULL);
 	if (unlikely(ret))
 		return ret;
 	/* save msg_control as sys_sendmsg() overwrites it */
@@ -730,7 +730,7 @@ static int io_recvmsg_copy_hdr(struct io_kiocb *req,
 	struct user_msghdr msg;
 	int ret;
 
-	ret = io_msg_copy_hdr(req, iomsg, &msg, ITER_DEST, &iomsg->uaddr);
+	ret = io_msg_copy_hdr(req, iomsg, &msg, &iomsg->uaddr);
 	if (unlikely(ret))
 		return ret;
 
-- 
2.55.0

Re: [PATCH 0/3] Continue iovec api clean up

[Jens Axboe]

On Wed, 12 Aug 2026 20:40:19 -0400, Gabriel Krisman Bertazi wrote:
> I found the first patch in an old branch and took the opportunity to
> find another (i think the last) case where the same pattern of directly
> copying the iov existed.
> 
> Tested with liburing.
> 
> Gabriel Krisman Bertazi (3):
>   io_uring/rw: Drop custom iov copy in io_iov_buffer_select_prep
>   io_uring/net: Drop custom iov copy in io_msg_copy_hdr
>   io_uring/net: Drop ddir argument from io_msg_copy_hdr
> 
> [...]

Applied, thanks!

[1/3] io_uring/rw: Drop custom iov copy in io_iov_buffer_select_prep
      commit: 0ca89205857c43e02cea3ee2a342e7d3c0c8a421
[2/3] io_uring/net: Drop custom iov copy in io_msg_copy_hdr
      commit: 5ec4f12a0b01597f9a55e01618849e3a8ac46cc2
[3/3] io_uring/net: Drop ddir argument from io_msg_copy_hdr
      commit: b76d6b068e693a1bea1df9cc5af16893c39b5bd5

Best regards,
-- 
Jens Axboe