On Tue, Mar 3, 2026, at 11:29 AM, Chuck Lever wrote:
> From: Chuck Lever <[email protected]>
>
> Profiling NFSD under an iozone workload showed that hardened
> usercopy checks consume roughly 1.3% of CPU in the TCP receive
> path. The runtime check in check_object_size() validates that
> copy buffers reside in expected slab regions, which is
> meaningful when data crosses the user/kernel boundary but adds
> no value when both source and destination are kernel addresses.
>
> Split check_copy_size() so that copy_to_iter() can bypass the
> runtime check_object_size() call for kernel-only iterators
> (ITER_BVEC, ITER_KVEC). Existing callers of check_copy_size()
> are unaffected; user-backed iterators still receive the full
> usercopy validation.
>
> This benefits all kernel consumers of copy_to_iter(), including
> the TCP receive path used by the NFS client and server,
> NVMe-TCP, and any other subsystem that uses ITER_BVEC or
> ITER_KVEC receive buffers.
>
> Signed-off-by: Chuck Lever <[email protected]>
> ---
> include/linux/ucopysize.h | 10 +++++++++-
> include/linux/uio.h | 9 +++++++--
> 2 files changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/include/linux/ucopysize.h b/include/linux/ucopysize.h
> index 41c2d9720466..b3eacb4869a8 100644
> --- a/include/linux/ucopysize.h
> +++ b/include/linux/ucopysize.h
> @@ -42,7 +42,7 @@ static inline void copy_overflow(int size, unsigned
> long count)
> }
>
> static __always_inline __must_check bool
> -check_copy_size(const void *addr, size_t bytes, bool is_source)
> +check_copy_size_nosec(const void *addr, size_t bytes, bool is_source)
> {
> int sz = __builtin_object_size(addr, 0);
> if (unlikely(sz >= 0 && sz < bytes)) {
> @@ -56,6 +56,14 @@ check_copy_size(const void *addr, size_t bytes, bool
> is_source)
> }
> if (WARN_ON_ONCE(bytes > INT_MAX))
> return false;
> + return true;
> +}
> +
> +static __always_inline __must_check bool
> +check_copy_size(const void *addr, size_t bytes, bool is_source)
> +{
> + if (!check_copy_size_nosec(addr, bytes, is_source))
> + return false;
> check_object_size(addr, bytes, is_source);
> return true;
> }
> diff --git a/include/linux/uio.h b/include/linux/uio.h
> index a9bc5b3067e3..f860529abfbe 100644
> --- a/include/linux/uio.h
> +++ b/include/linux/uio.h
> @@ -216,8 +216,13 @@ size_t copy_page_to_iter_nofault(struct page
> *page, unsigned offset,
> static __always_inline __must_check
> size_t copy_to_iter(const void *addr, size_t bytes, struct iov_iter *i)
> {
> - if (check_copy_size(addr, bytes, true))
> - return _copy_to_iter(addr, bytes, i);
> + if (user_backed_iter(i)) {
> + if (check_copy_size(addr, bytes, true))
> + return _copy_to_iter(addr, bytes, i);
> + } else {
> + if (check_copy_size_nosec(addr, bytes, true))
> + return _copy_to_iter(addr, bytes, i);
> + }
> return 0;
> }
>
> --
> 2.53.0
Ping: Any further thoughts on this? Al, Kees, Gustavo?
--
Chuck Lever
