tcp_v4_send_ack() constructs standalone IPv4 TCP ACK replies on the stack
for SYN-RECV and TIME-WAIT paths.  It currently zeroes only the TCP
header, not the accompanying option buffer.

TCP-AO options may have actual lengths that are not 4-byte aligned, while
the transmitted TCP header length is correctly rounded up to a 4-byte
boundary.  tcp_ao_hash_hdr() writes only the MAC bytes, leaving the
TCP-AO option alignment padding in rep.opt uninitialized.  With stack
auto-initialization disabled, those padding bytes can be copied into the
network packet and sent to the peer.

Zero the whole reply structure before writing options, so the alignment
padding bytes are initialized.

Fixes: decde2586b34 ("net/tcp: Add TCP-AO sign to twsk")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude-Code:GLM-5.2-special
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
---
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index ec09f97..327ee96 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -922,7 +922,7 @@ static void tcp_v4_send_ack(const struct sock *sk,
 	struct sock *ctl_sk;
 	u64 transmit_time;
 
-	memset(&rep.th, 0, sizeof(struct tcphdr));
+	memset(&rep, 0, sizeof(rep));
 	memset(&arg, 0, sizeof(arg));
 
 	arg.iov[0].iov_base = (unsigned char *)&rep;

--
2.47.3

On Mon, Jul 13, 2026 at 10:18 AM Yizhou Zhao
<zhaoyz24@mails.tsinghua.edu.cn> wrote:
>
> tcp_v4_send_ack() constructs standalone IPv4 TCP ACK replies on the stack
> for SYN-RECV and TIME-WAIT paths.  It currently zeroes only the TCP
> header, not the accompanying option buffer.
>
> TCP-AO options may have actual lengths that are not 4-byte aligned, while
> the transmitted TCP header length is correctly rounded up to a 4-byte
> boundary.  tcp_ao_hash_hdr() writes only the MAC bytes, leaving the
> TCP-AO option alignment padding in rep.opt uninitialized.  With stack
> auto-initialization disabled, those padding bytes can be copied into the
> network packet and sent to the peer.
>
> Zero the whole reply structure before writing options, so the alignment
> padding bytes are initialized.

Please fix TCP-AO instead of slowing down TCP (almost no TCP flow is using AO)

Thanks for your review.

> On Jul 13, 2026, at 16:48, Eric Dumazet <edumazet@google.com> wrote:
> 
> On Mon, Jul 13, 2026 at 10:18 AM Yizhou Zhao
> <zhaoyz24@mails.tsinghua.edu.cn> wrote:
>> 
>> tcp_v4_send_ack() constructs standalone IPv4 TCP ACK replies on the stack
>> for SYN-RECV and TIME-WAIT paths.  It currently zeroes only the TCP
>> header, not the accompanying option buffer.
>> 
>> TCP-AO options may have actual lengths that are not 4-byte aligned, while
>> the transmitted TCP header length is correctly rounded up to a 4-byte
>> boundary.  tcp_ao_hash_hdr() writes only the MAC bytes, leaving the
>> TCP-AO option alignment padding in rep.opt uninitialized.  With stack
>> auto-initialization disabled, those padding bytes can be copied into the
>> network packet and sent to the peer.
>> 
>> Zero the whole reply structure before writing options, so the alignment
>> padding bytes are initialized.
> 
> Please fix TCP-AO instead of slowing down TCP (almost no TCP flow is using AO)

We have posted a v2 patch following your suggestions:
https://lore.kernel.org/netdev/20260713105631.8616-1-zhaoyz24@mails.tsinghua.edu.cn/

Regards,
Yizhou