diff --git a/kernel/aster-nix/src/process/signal/mod.rs b/kernel/aster-nix/src/process/signal/mod.rs
index 7a811c27c..aba58e03a 100644
--- a/kernel/aster-nix/src/process/signal/mod.rs
+++ b/kernel/aster-nix/src/process/signal/mod.rs
@@ -195,7 +195,7 @@ pub fn handle_user_signal(
         ];
         stack_pointer -= TRAMPOLINE.len() as u64;
         let trampoline_rip = stack_pointer;
-        write_bytes_to_user(stack_pointer as Vaddr, TRAMPOLINE)?;
+        write_bytes_to_user(stack_pointer as Vaddr, &mut VmReader::from(TRAMPOLINE))?;
         stack_pointer = write_u64_to_user_stack(stack_pointer, trampoline_rip)?;
     }
 
diff --git a/kernel/aster-nix/src/syscall/getcwd.rs b/kernel/aster-nix/src/syscall/getcwd.rs
index ecf15971e..2ee5ab03e 100644
--- a/kernel/aster-nix/src/syscall/getcwd.rs
+++ b/kernel/aster-nix/src/syscall/getcwd.rs
@@ -8,6 +8,6 @@ pub fn sys_getcwd(buf: Vaddr, len: usize) -> Result<SyscallReturn> {
     let fake_cwd = CString::new("/")?;
     let bytes = fake_cwd.as_bytes_with_nul();
     let write_len = len.min(bytes.len());
-    write_bytes_to_user(buf, &bytes[..write_len])?;
+    write_bytes_to_user(buf, &mut VmReader::from(&bytes[..write_len]))?;
     Ok(SyscallReturn::Return(write_len as _))
 }
diff --git a/kernel/aster-nix/src/syscall/getdents64.rs b/kernel/aster-nix/src/syscall/getdents64.rs
index b0879c461..3b87d2d5d 100644
--- a/kernel/aster-nix/src/syscall/getdents64.rs
+++ b/kernel/aster-nix/src/syscall/getdents64.rs
@@ -36,7 +36,7 @@ pub fn sys_getdents(fd: FileDesc, buf_addr: Vaddr, buf_len: usize) -> Result<Sys
     let mut reader = DirentBufferReader::<Dirent>::new(&mut buffer); // Use the non-64-bit reader
     let _ = inode_handle.readdir(&mut reader)?;
     let read_len = reader.read_len();
-    write_bytes_to_user(buf_addr, &buffer[..read_len])?;
+    write_bytes_to_user(buf_addr, &mut VmReader::from(&buffer[..read_len]))?;
     Ok(SyscallReturn::Return(read_len as _))
 }
 
@@ -61,7 +61,7 @@ pub fn sys_getdents64(fd: FileDesc, buf_addr: Vaddr, buf_len: usize) -> Result<S
     let mut reader = DirentBufferReader::<Dirent64>::new(&mut buffer);
     let _ = inode_handle.readdir(&mut reader)?;
     let read_len = reader.read_len();
-    write_bytes_to_user(buf_addr, &buffer[..read_len])?;
+    write_bytes_to_user(buf_addr, &mut VmReader::from(&buffer[..read_len]))?;
     Ok(SyscallReturn::Return(read_len as _))
 }
 
diff --git a/kernel/aster-nix/src/syscall/getrandom.rs b/kernel/aster-nix/src/syscall/getrandom.rs
index 5c878fbd4..ece25df24 100644
--- a/kernel/aster-nix/src/syscall/getrandom.rs
+++ b/kernel/aster-nix/src/syscall/getrandom.rs
@@ -17,7 +17,7 @@ pub fn sys_getrandom(buf: Vaddr, count: usize, flags: u32) -> Result<SyscallRetu
     } else {
         device::Urandom::getrandom(&mut buffer)?
     };
-    write_bytes_to_user(buf, &buffer)?;
+    write_bytes_to_user(buf, &mut VmReader::from(buffer.as_slice()))?;
     Ok(SyscallReturn::Return(read_len as isize))
 }
 
diff --git a/kernel/aster-nix/src/syscall/madvise.rs b/kernel/aster-nix/src/syscall/madvise.rs
index c6ad77c1f..8254a1e95 100644
--- a/kernel/aster-nix/src/syscall/madvise.rs
+++ b/kernel/aster-nix/src/syscall/madvise.rs
@@ -15,7 +15,7 @@ pub fn sys_madvise(start: Vaddr, len: usize, behavior: i32) -> Result<SyscallRet
         | MadviseBehavior::MADV_WILLNEED => {
             // perform a read at first
             let mut buffer = vec![0u8; len];
-            read_bytes_from_user(start, &mut buffer)?;
+            read_bytes_from_user(start, &mut VmWriter::from(buffer.as_mut_slice()))?;
         }
         MadviseBehavior::MADV_DONTNEED => madv_dontneed(start, len)?,
         _ => todo!(),
diff --git a/kernel/aster-nix/src/syscall/prctl.rs b/kernel/aster-nix/src/syscall/prctl.rs
index f76c7ef15..cea9b22be 100644
--- a/kernel/aster-nix/src/syscall/prctl.rs
+++ b/kernel/aster-nix/src/syscall/prctl.rs
@@ -39,7 +39,10 @@ pub fn sys_prctl(option: i32, arg2: u64, arg3: u64, arg4: u64, arg5: u64) -> Res
             let thread_name = posix_thread.thread_name().lock();
             if let Some(thread_name) = &*thread_name {
                 if let Some(thread_name) = thread_name.name()? {
-                    write_bytes_to_user(write_to_addr, thread_name.to_bytes_with_nul())?;
+                    write_bytes_to_user(
+                        write_to_addr,
+                        &mut VmReader::from(thread_name.to_bytes_with_nul()),
+                    )?;
                 }
             }
         }
diff --git a/kernel/aster-nix/src/syscall/pread64.rs b/kernel/aster-nix/src/syscall/pread64.rs
index c2500d4e2..31490a86b 100644
--- a/kernel/aster-nix/src/syscall/pread64.rs
+++ b/kernel/aster-nix/src/syscall/pread64.rs
@@ -33,7 +33,7 @@ pub fn sys_pread64(
     let read_len = {
         let mut buffer = vec![0u8; user_buf_len];
         let read_len = file.read_at(offset as usize, &mut buffer)?;
-        write_bytes_to_user(user_buf_ptr, &buffer)?;
+        write_bytes_to_user(user_buf_ptr, &mut VmReader::from(buffer.as_slice()))?;
         read_len
     };
 
diff --git a/kernel/aster-nix/src/syscall/pwrite64.rs b/kernel/aster-nix/src/syscall/pwrite64.rs
index d71cd0adb..bf795ebf4 100644
--- a/kernel/aster-nix/src/syscall/pwrite64.rs
+++ b/kernel/aster-nix/src/syscall/pwrite64.rs
@@ -30,7 +30,7 @@ pub fn sys_pwrite64(
     }
 
     let mut buffer = vec![0u8; user_buf_len];
-    read_bytes_from_user(user_buf_ptr, &mut buffer)?;
+    read_bytes_from_user(user_buf_ptr, &mut VmWriter::from(buffer.as_mut_slice()))?;
     let write_len = file.write_at(offset as _, &buffer)?;
     Ok(SyscallReturn::Return(write_len as _))
 }
diff --git a/kernel/aster-nix/src/syscall/read.rs b/kernel/aster-nix/src/syscall/read.rs
index 382292b37..807937865 100644
--- a/kernel/aster-nix/src/syscall/read.rs
+++ b/kernel/aster-nix/src/syscall/read.rs
@@ -17,6 +17,6 @@ pub fn sys_read(fd: FileDesc, user_buf_addr: Vaddr, buf_len: usize) -> Result<Sy
 
     let mut read_buf = vec![0u8; buf_len];
     let read_len = file.read(&mut read_buf)?;
-    write_bytes_to_user(user_buf_addr, &read_buf)?;
+    write_bytes_to_user(user_buf_addr, &mut VmReader::from(read_buf.as_slice()))?;
     Ok(SyscallReturn::Return(read_len as _))
 }
diff --git a/kernel/aster-nix/src/syscall/readlink.rs b/kernel/aster-nix/src/syscall/readlink.rs
index aaf5b9ccf..c94ebdbb3 100644
--- a/kernel/aster-nix/src/syscall/readlink.rs
+++ b/kernel/aster-nix/src/syscall/readlink.rs
@@ -35,7 +35,7 @@ pub fn sys_readlinkat(
     let linkpath = dentry.inode().read_link()?;
     let bytes = linkpath.as_bytes();
     let write_len = bytes.len().min(usr_buf_len);
-    write_bytes_to_user(usr_buf_addr, &bytes[..write_len])?;
+    write_bytes_to_user(usr_buf_addr, &mut VmReader::from(&bytes[..write_len]))?;
     Ok(SyscallReturn::Return(write_len as _))
 }
 
diff --git a/kernel/aster-nix/src/syscall/write.rs b/kernel/aster-nix/src/syscall/write.rs
index bd1ab4cac..f302a0765 100644
--- a/kernel/aster-nix/src/syscall/write.rs
+++ b/kernel/aster-nix/src/syscall/write.rs
@@ -25,7 +25,7 @@ pub fn sys_write(fd: FileDesc, user_buf_ptr: Vaddr, user_buf_len: usize) -> Resu
     }
 
     let mut buffer = vec![0u8; user_buf_len];
-    read_bytes_from_user(user_buf_ptr, &mut buffer)?;
+    read_bytes_from_user(user_buf_ptr, &mut VmWriter::from(buffer.as_mut_slice()))?;
     debug!("write content = {:?}", buffer);
     let write_len = file.write(&buffer)?;
     Ok(SyscallReturn::Return(write_len as _))
diff --git a/kernel/aster-nix/src/util/iovec.rs b/kernel/aster-nix/src/util/iovec.rs
index 068efd967..3b3d90b4e 100644
--- a/kernel/aster-nix/src/util/iovec.rs
+++ b/kernel/aster-nix/src/util/iovec.rs
@@ -75,7 +75,7 @@ impl IoVec {
         assert_eq!(dst.len(), self.len);
         assert!(!self.is_empty());
 
-        read_bytes_from_user(self.base, dst)
+        read_bytes_from_user(self.base, &mut VmWriter::from(dst))
     }
 
     /// Writes bytes from the `src` buffer
@@ -92,7 +92,7 @@ impl IoVec {
         assert_eq!(src.len(), self.len);
         assert!(!self.is_empty());
 
-        write_bytes_to_user(self.base, src)
+        write_bytes_to_user(self.base, &mut VmReader::from(src))
     }
 
     /// Reads bytes to the `dst` buffer
@@ -101,7 +101,7 @@ impl IoVec {
     /// If successful, returns the length of actually read bytes.
     pub fn read_from_user(&self, dst: &mut [u8]) -> Result<usize> {
         let len = self.len.min(dst.len());
-        read_bytes_from_user(self.base, &mut dst[..len])?;
+        read_bytes_from_user(self.base, &mut VmWriter::from(&mut dst[..len]))?;
         Ok(len)
     }
 
@@ -111,7 +111,7 @@ impl IoVec {
     /// If successful, returns the length of actually written bytes.
     pub fn write_to_user(&self, src: &[u8]) -> Result<usize> {
         let len = self.len.min(src.len());
-        write_bytes_to_user(self.base, &src[..len])?;
+        write_bytes_to_user(self.base, &mut VmReader::from(&src[..len]))?;
         Ok(len)
     }
 }
diff --git a/kernel/aster-nix/src/util/net/addr.rs b/kernel/aster-nix/src/util/net/addr.rs
index 869e04a99..416fe78f1 100644
--- a/kernel/aster-nix/src/util/net/addr.rs
+++ b/kernel/aster-nix/src/util/net/addr.rs
@@ -27,7 +27,10 @@ pub fn read_socket_addr_from_user(addr: Vaddr, addr_len: usize) -> Result<Socket
             let bytes = {
                 let bytes_len = addr_len - core::mem::size_of::<u16>();
                 let mut bytes = vec![0u8; bytes_len];
-                read_bytes_from_user(addr + core::mem::size_of::<u16>(), &mut bytes)?;
+                read_bytes_from_user(
+                    addr + core::mem::size_of::<u16>(),
+                    &mut VmWriter::from(bytes.as_mut_slice()),
+                )?;
                 bytes
             };
 
diff --git a/ostd/src/task/processor.rs b/ostd/src/task/processor.rs
index 1ca6693e5..d89983327 100644
--- a/ostd/src/task/processor.rs
+++ b/ostd/src/task/processor.rs
@@ -178,7 +178,7 @@ impl PreemptInfo {
         }
     }
 
-    fn incease_num_locks(&self) {
+    fn increase_num_locks(&self) {
         self.num_locks.fetch_add(1, Relaxed);
     }
 
@@ -205,7 +205,7 @@ impl !Send for DisablePreemptGuard {}
 
 impl DisablePreemptGuard {
     fn new() -> Self {
-        PREEMPT_COUNT.incease_num_locks();
+        PREEMPT_COUNT.increase_num_locks();
         Self { private: () }
     }