Are you sure you need to copy from user here? Check the whole trace from the recvmsg syscall and see if there are no "promotions" to kernel space already.

Another thing, this is a scatter/gather array which means the buffer might not be non-linear, your code is too optimistic about it.

It seems that the function will decrypt the data into user space msg directly and the previous code will gather the splitted received data and decrypt into msg(I didn't find the next pointer like skb structure.)

Magically I could read the address without copy in Ubuntu but failed in Arch

It seems we can use process_rx_list to make zero copy, see slack.