[PATCH v2 net] wireguard: use DEV_STATS_INC()

[PATCH v2 net] wireguard: use DEV_STATS_INC()

[Eric Dumazet]

wg_xmit() can be called concurrently, KCSAN reported [1]
some device stats updates can be lost.

Use DEV_STATS_INC() for this unlikely case.

[1]
BUG: KCSAN: data-race in wg_xmit / wg_xmit

read-write to 0xffff888104239160 of 8 bytes by task 1375 on cpu 0:
wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231
__netdev_start_xmit include/linux/netdevice.h:4918 [inline]
netdev_start_xmit include/linux/netdevice.h:4932 [inline]
xmit_one net/core/dev.c:3543 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559
...

read-write to 0xffff888104239160 of 8 bytes by task 1378 on cpu 1:
wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231
__netdev_start_xmit include/linux/netdevice.h:4918 [inline]
netdev_start_xmit include/linux/netdevice.h:4932 [inline]
xmit_one net/core/dev.c:3543 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559
...

v2: also change wg_packet_consume_data_done() (Hangbin Liu)
    and wg_packet_purge_staged_packets()

Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Hangbin Liu <liuhangbin@gmail.com>
---
 drivers/net/wireguard/device.c  |  4 ++--
 drivers/net/wireguard/receive.c | 12 ++++++------
 drivers/net/wireguard/send.c    |  3 ++-
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c
index 258dcc1039216f311a223fd348295d4b5e03a3ed..deb9636b0ecf8f47e832a0b07e9e049ba19bdf16 100644
--- a/drivers/net/wireguard/device.c
+++ b/drivers/net/wireguard/device.c
@@ -210,7 +210,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
 	 */
 	while (skb_queue_len(&peer->staged_packet_queue) > MAX_STAGED_PACKETS) {
 		dev_kfree_skb(__skb_dequeue(&peer->staged_packet_queue));
-		++dev->stats.tx_dropped;
+		DEV_STATS_INC(dev, tx_dropped);
 	}
 	skb_queue_splice_tail(&packets, &peer->staged_packet_queue);
 	spin_unlock_bh(&peer->staged_packet_queue.lock);
@@ -228,7 +228,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
 	else if (skb->protocol == htons(ETH_P_IPV6))
 		icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
 err:
-	++dev->stats.tx_errors;
+	DEV_STATS_INC(dev, tx_errors);
 	kfree_skb(skb);
 	return ret;
 }
diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c
index 0b3f0c843550957ee1fe3bed7185a7d990246c2b..a176653c88616b1bc871fe52fcea778b5e189f69 100644
--- a/drivers/net/wireguard/receive.c
+++ b/drivers/net/wireguard/receive.c
@@ -416,20 +416,20 @@ static void wg_packet_consume_data_done(struct wg_peer *peer,
 	net_dbg_skb_ratelimited("%s: Packet has unallowed src IP (%pISc) from peer %llu (%pISpfsc)\n",
 				dev->name, skb, peer->internal_id,
 				&peer->endpoint.addr);
-	++dev->stats.rx_errors;
-	++dev->stats.rx_frame_errors;
+	DEV_STATS_INC(dev, rx_errors);
+	DEV_STATS_INC(dev, rx_frame_errors);
 	goto packet_processed;
 dishonest_packet_type:
 	net_dbg_ratelimited("%s: Packet is neither ipv4 nor ipv6 from peer %llu (%pISpfsc)\n",
 			    dev->name, peer->internal_id, &peer->endpoint.addr);
-	++dev->stats.rx_errors;
-	++dev->stats.rx_frame_errors;
+	DEV_STATS_INC(dev, rx_errors);
+	DEV_STATS_INC(dev, rx_frame_errors);
 	goto packet_processed;
 dishonest_packet_size:
 	net_dbg_ratelimited("%s: Packet has incorrect size from peer %llu (%pISpfsc)\n",
 			    dev->name, peer->internal_id, &peer->endpoint.addr);
-	++dev->stats.rx_errors;
-	++dev->stats.rx_length_errors;
+	DEV_STATS_INC(dev, rx_errors);
+	DEV_STATS_INC(dev, rx_length_errors);
 	goto packet_processed;
 packet_processed:
 	dev_kfree_skb(skb);
diff --git a/drivers/net/wireguard/send.c b/drivers/net/wireguard/send.c
index 95c853b59e1dae1df8b4e5cbf4e3541e35806b82..0d48e0f4a1ba3e1f11825136a65de0867b204496 100644
--- a/drivers/net/wireguard/send.c
+++ b/drivers/net/wireguard/send.c
@@ -333,7 +333,8 @@ static void wg_packet_create_data(struct wg_peer *peer, struct sk_buff *first)
 void wg_packet_purge_staged_packets(struct wg_peer *peer)
 {
 	spin_lock_bh(&peer->staged_packet_queue.lock);
-	peer->device->dev->stats.tx_dropped += peer->staged_packet_queue.qlen;
+	DEV_STATS_ADD(peer->device->dev, tx_dropped,
+		      peer->staged_packet_queue.qlen);
 	__skb_queue_purge(&peer->staged_packet_queue);
 	spin_unlock_bh(&peer->staged_packet_queue.lock);
 }
-- 
2.43.0.rc0.421.g78406f8d94-goog

Re: [PATCH v2 net] wireguard: use DEV_STATS_INC()

[Jason A. Donenfeld]

Hi Eric,

On Fri, Nov 17, 2023 at 3:17 PM Eric Dumazet <edumazet@google.com> wrote:
>
> wg_xmit() can be called concurrently, KCSAN reported [1]
> some device stats updates can be lost.
>
> Use DEV_STATS_INC() for this unlikely case.
>
> [1]
> BUG: KCSAN: data-race in wg_xmit / wg_xmit
>
> read-write to 0xffff888104239160 of 8 bytes by task 1375 on cpu 0:
> wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231
> __netdev_start_xmit include/linux/netdevice.h:4918 [inline]
> netdev_start_xmit include/linux/netdevice.h:4932 [inline]
> xmit_one net/core/dev.c:3543 [inline]
> dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559
> ...
>
> read-write to 0xffff888104239160 of 8 bytes by task 1378 on cpu 1:
> wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231
> __netdev_start_xmit include/linux/netdevice.h:4918 [inline]
> netdev_start_xmit include/linux/netdevice.h:4932 [inline]
> xmit_one net/core/dev.c:3543 [inline]
> dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559
> ...
>
> v2: also change wg_packet_consume_data_done() (Hangbin Liu)
>     and wg_packet_purge_staged_packets()
>
> Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Jason A. Donenfeld <Jason@zx2c4.com>
> Cc: Hangbin Liu <liuhangbin@gmail.com>
> ---
>  drivers/net/wireguard/device.c  |  4 ++--
>  drivers/net/wireguard/receive.c | 12 ++++++------
>  drivers/net/wireguard/send.c    |  3 ++-
>  3 files changed, 10 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c
> index 258dcc1039216f311a223fd348295d4b5e03a3ed..deb9636b0ecf8f47e832a0b07e9e049ba19bdf16 100644
> --- a/drivers/net/wireguard/device.c
> +++ b/drivers/net/wireguard/device.c
> @@ -210,7 +210,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
>          */
>         while (skb_queue_len(&peer->staged_packet_queue) > MAX_STAGED_PACKETS) {
>                 dev_kfree_skb(__skb_dequeue(&peer->staged_packet_queue));
> -               ++dev->stats.tx_dropped;
> +               DEV_STATS_INC(dev, tx_dropped);
>         }
>         skb_queue_splice_tail(&packets, &peer->staged_packet_queue);
>         spin_unlock_bh(&peer->staged_packet_queue.lock);
> @@ -228,7 +228,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
>         else if (skb->protocol == htons(ETH_P_IPV6))
>                 icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
>  err:
> -       ++dev->stats.tx_errors;
> +       DEV_STATS_INC(dev, tx_errors);
>         kfree_skb(skb);
>         return ret;
>  }
> diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c
> index 0b3f0c843550957ee1fe3bed7185a7d990246c2b..a176653c88616b1bc871fe52fcea778b5e189f69 100644
> --- a/drivers/net/wireguard/receive.c
> +++ b/drivers/net/wireguard/receive.c
> @@ -416,20 +416,20 @@ static void wg_packet_consume_data_done(struct wg_peer *peer,
>         net_dbg_skb_ratelimited("%s: Packet has unallowed src IP (%pISc) from peer %llu (%pISpfsc)\n",
>                                 dev->name, skb, peer->internal_id,
>                                 &peer->endpoint.addr);
> -       ++dev->stats.rx_errors;
> -       ++dev->stats.rx_frame_errors;
> +       DEV_STATS_INC(dev, rx_errors);
> +       DEV_STATS_INC(dev, rx_frame_errors);
>         goto packet_processed;
>  dishonest_packet_type:
>         net_dbg_ratelimited("%s: Packet is neither ipv4 nor ipv6 from peer %llu (%pISpfsc)\n",
>                             dev->name, peer->internal_id, &peer->endpoint.addr);
> -       ++dev->stats.rx_errors;
> -       ++dev->stats.rx_frame_errors;
> +       DEV_STATS_INC(dev, rx_errors);
> +       DEV_STATS_INC(dev, rx_frame_errors);
>         goto packet_processed;
>  dishonest_packet_size:
>         net_dbg_ratelimited("%s: Packet has incorrect size from peer %llu (%pISpfsc)\n",
>                             dev->name, peer->internal_id, &peer->endpoint.addr);
> -       ++dev->stats.rx_errors;
> -       ++dev->stats.rx_length_errors;
> +       DEV_STATS_INC(dev, rx_errors);
> +       DEV_STATS_INC(dev, rx_length_errors);
>         goto packet_processed;
>  packet_processed:
>         dev_kfree_skb(skb);
> diff --git a/drivers/net/wireguard/send.c b/drivers/net/wireguard/send.c
> index 95c853b59e1dae1df8b4e5cbf4e3541e35806b82..0d48e0f4a1ba3e1f11825136a65de0867b204496 100644
> --- a/drivers/net/wireguard/send.c
> +++ b/drivers/net/wireguard/send.c
> @@ -333,7 +333,8 @@ static void wg_packet_create_data(struct wg_peer *peer, struct sk_buff *first)
>  void wg_packet_purge_staged_packets(struct wg_peer *peer)
>  {
>         spin_lock_bh(&peer->staged_packet_queue.lock);
> -       peer->device->dev->stats.tx_dropped += peer->staged_packet_queue.qlen;
> +       DEV_STATS_ADD(peer->device->dev, tx_dropped,
> +                     peer->staged_packet_queue.qlen);
>         __skb_queue_purge(&peer->staged_packet_queue);
>         spin_unlock_bh(&peer->staged_packet_queue.lock);
>  }

This is probably fine if you want to do it and feel strongly about it,
and you can take this directly into net/net-next with my:

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

However, I recall evaluating the races here long ago and deliberately
deciding not to do anything about it. Sure KCSAN will complain, but
these stats being pixel perfect isn't really _that_ important and it
really doesn't seem worth it to have the performance hit of several
atomics on every packet. There's also peer->{r,t}x_bytes that should
probably be adjusted if you're going to change these. But again - is
it really worth it to do that? It just seems like such an unnecessary
performance hit.

So I think I'd prefer to _not_ fix this. But if you feel really
strongly about it, I'll be okay deferring to your judgement.

Jason

Re: [PATCH v2 net] wireguard: use DEV_STATS_INC()

[Hangbin Liu]

On Fri, Nov 17, 2023 at 02:17:33PM +0000, Eric Dumazet wrote:
> wg_xmit() can be called concurrently, KCSAN reported [1]
> some device stats updates can be lost.
> 
> Use DEV_STATS_INC() for this unlikely case.
> 
> [1]
> BUG: KCSAN: data-race in wg_xmit / wg_xmit
> 
> read-write to 0xffff888104239160 of 8 bytes by task 1375 on cpu 0:
> wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231
> __netdev_start_xmit include/linux/netdevice.h:4918 [inline]
> netdev_start_xmit include/linux/netdevice.h:4932 [inline]
> xmit_one net/core/dev.c:3543 [inline]
> dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559
> ...
> 
> read-write to 0xffff888104239160 of 8 bytes by task 1378 on cpu 1:
> wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231
> __netdev_start_xmit include/linux/netdevice.h:4918 [inline]
> netdev_start_xmit include/linux/netdevice.h:4932 [inline]
> xmit_one net/core/dev.c:3543 [inline]
> dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559
> ...
> 
> v2: also change wg_packet_consume_data_done() (Hangbin Liu)
>     and wg_packet_purge_staged_packets()
> 
> Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Jason A. Donenfeld <Jason@zx2c4.com>
> Cc: Hangbin Liu <liuhangbin@gmail.com>
> ---

I respect Jason's comments.

Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>

Re: [PATCH v2 net] wireguard: use DEV_STATS_INC()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:

On Fri, 17 Nov 2023 14:17:33 +0000 you wrote:
> wg_xmit() can be called concurrently, KCSAN reported [1]
> some device stats updates can be lost.
> 
> Use DEV_STATS_INC() for this unlikely case.
> 
> [1]
> BUG: KCSAN: data-race in wg_xmit / wg_xmit
> 
> [...]

Here is the summary with links:
  - [v2,net] wireguard: use DEV_STATS_INC()
    https://git.kernel.org/netdev/net/c/93da8d75a665

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH v2 net] wireguard: use DEV_STATS_INC()

[Jason A. Donenfeld]

Hi,

On Sun, Nov 19, 2023 at 8:50 PM <patchwork-bot+netdevbpf@kernel.org> wrote:
>
> Hello:
>
> This patch was applied to netdev/net.git (main)
> by David S. Miller <davem@davemloft.net>:
>
> On Fri, 17 Nov 2023 14:17:33 +0000 you wrote:
> > wg_xmit() can be called concurrently, KCSAN reported [1]
> > some device stats updates can be lost.
> >
> > Use DEV_STATS_INC() for this unlikely case.
> >
> > [1]
> > BUG: KCSAN: data-race in wg_xmit / wg_xmit
> >
> > [...]
>
> Here is the summary with links:
>   - [v2,net] wireguard: use DEV_STATS_INC()
>     https://git.kernel.org/netdev/net/c/93da8d75a665
>
> You are awesome, thank you!

I thought that, given my concerns, if this was to be committed, at
least Eric (or you?) would expand on the rationale in the context of
my concerns while (or before) doing so, rather than just applying this
without further discussion. As I mentioned, this is fine with me if
you feel strongly about it, but I would appreciate some expanded
explanation, just for my own understanding of the matter.

Jason

Re: [PATCH v2 net] wireguard: use DEV_STATS_INC()

[Eric Dumazet]

On Mon, Nov 20, 2023 at 1:11 AM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
>
> Hi,
>
> On Sun, Nov 19, 2023 at 8:50 PM <patchwork-bot+netdevbpf@kernel.org> wrote:
> >
> > Hello:
> >
> > This patch was applied to netdev/net.git (main)
> > by David S. Miller <davem@davemloft.net>:
> >
> > On Fri, 17 Nov 2023 14:17:33 +0000 you wrote:
> > > wg_xmit() can be called concurrently, KCSAN reported [1]
> > > some device stats updates can be lost.
> > >
> > > Use DEV_STATS_INC() for this unlikely case.
> > >
> > > [1]
> > > BUG: KCSAN: data-race in wg_xmit / wg_xmit
> > >
> > > [...]
> >
> > Here is the summary with links:
> >   - [v2,net] wireguard: use DEV_STATS_INC()
> >     https://git.kernel.org/netdev/net/c/93da8d75a665
> >
> > You are awesome, thank you!
>
> I thought that, given my concerns, if this was to be committed, at
> least Eric (or you?) would expand on the rationale in the context of
> my concerns while (or before) doing so, rather than just applying this
> without further discussion. As I mentioned, this is fine with me if
> you feel strongly about it, but I would appreciate some expanded
> explanation, just for my own understanding of the matter.
>
> Jason

Jason, I was in week end mode, so could not reply to your message.

This fix is rather obvious to me. I do not want to spend too much time on it,
and you gave an ACK if I am not mistaken.

If you prefer not letting syzbot find other bugs in wireguard (because
hitting this issue first),
this is fine by me. We can ask syzbot team to not include wireguard in
their kernels.

Re: [PATCH v2 net] wireguard: use DEV_STATS_INC()

[Eric Dumazet]

On Mon, Nov 20, 2023 at 8:56 AM Eric Dumazet <edumazet@google.com> wrote:
>

> Jason, I was in week end mode, so could not reply to your message.
>
> This fix is rather obvious to me. I do not want to spend too much time on it,
> and you gave an ACK if I am not mistaken.
>
> If you prefer not letting syzbot find other bugs in wireguard (because
> hitting this issue first),
> this is fine by me. We can ask syzbot team to not include wireguard in
> their kernels.

BTW, while cooking the patch I found that wireguard was incorrectly
using dev_kfree_skb() instead of kfree_skb().

dev_kfree_skb() is really a consume_skb(), which gives different drop
monitor signals

(perf record -a -e skb:kfree_skb)  vs (perf record -a -e skb:consume_skb)

I would suggest you take a look.

Ideally, using kfree_skb_reason(skb, reason) (for net-next tree) would
help future diagnostics.

For net tree I would suggest

diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c
index 258dcc1039216f311a223fd348295d4b5e03a3ed..0b0e2a9fd14d14fb3c77004074e2b088364d332a
100644
--- a/drivers/net/wireguard/device.c
+++ b/drivers/net/wireguard/device.c
@@ -209,7 +209,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb,
struct net_device *dev)
         * we don't remove GSO segments that are in excess.
         */
        while (skb_queue_len(&peer->staged_packet_queue) > MAX_STAGED_PACKETS) {
-               dev_kfree_skb(__skb_dequeue(&peer->staged_packet_queue));
+               kfree_skb(__skb_dequeue(&peer->staged_packet_queue));
                ++dev->stats.tx_dropped;
        }
        skb_queue_splice_tail(&packets, &peer->staged_packet_queue);
diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c
index 0b3f0c843550957ee1fe3bed7185a7d990246c2b..a9e76722b22cad65bda91f306fad11cdb6acff09
100644
--- a/drivers/net/wireguard/receive.c
+++ b/drivers/net/wireguard/receive.c
@@ -432,7 +432,7 @@ static void wg_packet_consume_data_done(struct
wg_peer *peer,
        ++dev->stats.rx_length_errors;
        goto packet_processed;
 packet_processed:
-       dev_kfree_skb(skb);
+       kfree_skb(skb);
 }

 int wg_packet_rx_poll(struct napi_struct *napi, int budget)
@@ -478,7 +478,7 @@ int wg_packet_rx_poll(struct napi_struct *napi, int budget)
                wg_noise_keypair_put(keypair, false);
                wg_peer_put(peer);
                if (unlikely(free))
-                       dev_kfree_skb(skb);
+                       kfree_skb(skb);

                if (++work_done >= budget)
                        break;
@@ -536,7 +536,7 @@ static void wg_packet_consume_data(struct
wg_device *wg, struct sk_buff *skb)
 err_keypair:
        rcu_read_unlock_bh();
        wg_peer_put(peer);
-       dev_kfree_skb(skb);
+       kfree_skb(skb);
 }

 void wg_packet_receive(struct wg_device *wg, struct sk_buff *skb)
@@ -582,5 +582,5 @@ void wg_packet_receive(struct wg_device *wg,
struct sk_buff *skb)
        return;

 err:
-       dev_kfree_skb(skb);
+       kfree_skb(skb);
 }
diff --git a/drivers/net/wireguard/socket.c b/drivers/net/wireguard/socket.c
index 0414d7a6ce74141cd2ca365bfd1da727691e27ec..7e773a2c8a8532caef06205f53e6b505dbe9ff57
100644
--- a/drivers/net/wireguard/socket.c
+++ b/drivers/net/wireguard/socket.c
@@ -178,7 +178,7 @@ int wg_socket_send_skb_to_peer(struct wg_peer
*peer, struct sk_buff *skb, u8 ds)
                ret = send6(peer->device, skb, &peer->endpoint, ds,
                            &peer->endpoint_cache);
        else
-               dev_kfree_skb(skb);
+               kfree_skb(skb);
        if (likely(!ret))
                peer->tx_bytes += skb_len;
        read_unlock_bh(&peer->endpoint_lock);

Re: [PATCH v2 net] wireguard: use DEV_STATS_INC()

[Hangbin Liu]

On Mon, Nov 20, 2023 at 08:56:02AM +0100, Eric Dumazet wrote:
> > I thought that, given my concerns, if this was to be committed, at
> > least Eric (or you?) would expand on the rationale in the context of
> > my concerns while (or before) doing so, rather than just applying this
> > without further discussion. As I mentioned, this is fine with me if
> > you feel strongly about it, but I would appreciate some expanded
> > explanation, just for my own understanding of the matter.
> >
> > Jason
> 
> Jason, I was in week end mode, so could not reply to your message.
> 
> This fix is rather obvious to me. I do not want to spend too much time on it,
> and you gave an ACK if I am not mistaken.
> 
> If you prefer not letting syzbot find other bugs in wireguard (because
> hitting this issue first),
> this is fine by me. We can ask syzbot team to not include wireguard in
> their kernels.

Some performance test data may helps.

As I don't have good and same configure test machines. I just did a rough test.

Client: RHEL9.2, CPU  Intel E5-2620, Memory 4096 MB, NIC I350
Server: 6.7.0-rc1, CPU Intel Xeon Silver 4216, 196608 MB, NIC I350

Before patch:
=== 4in4 TCP_STREAM: 901.05 Mbits/sec ===
=== 4in4 MPTCP_STREAM: 885.22 Mbits/sec ===
=== 4in4 UDP_STREAM: 919.91 Mbits/sec ===
=== 4in4 SCTP_STREAM: 903.12 Mbits/sec ===

After patch:
=== 4in4 TCP_STREAM: 901.07 Mbits/sec ===
=== 4in4 MPTCP_STREAM: 885.24 Mbits/sec ===
=== 4in4 UDP_STREAM: 919.91 Mbits/sec ===
=== 4in4 SCTP_STREAM: 903.14 Mbits/sec ===

Exchange the client/server role:

Before patch:
=== 4in4 TCP_STREAM: 901.08 Mbits/sec ===
=== 4in4 MPTCP_STREAM: 885.12 Mbits/sec ===
=== 4in4 UDP_STREAM: 919.94 Mbits/sec ===
=== 4in4 SCTP_STREAM: 903.09 Mbits/sec ===

After patch:
=== 4in4 TCP_STREAM: 901.04 Mbits/sec ===
=== 4in4 MPTCP_STREAM: 885.24 Mbits/sec ===
=== 4in4 UDP_STREAM: 919.91 Mbits/sec ===
=== 4in4 SCTP_STREAM: 903.11 Mbits/sec ===

The result looks good to me.

Thanks
Hangbin