tcp_v4_send_ack() constructs standalone IPv4 TCP ACK replies on the stack
for SYN-RECV and TIME-WAIT paths.  It currently zeroes only the TCP
header, not the accompanying option buffer.

TCP-AO options may have actual lengths that are not 4-byte aligned, while
the transmitted TCP header length is correctly rounded up to a 4-byte
boundary.  tcp_ao_hash_hdr() writes only the MAC bytes, leaving the
TCP-AO option alignment padding in rep.opt uninitialized.  With stack
auto-initialization disabled, those padding bytes can be copied into the
network packet and sent to the peer.

Zero the whole reply structure before writing options, so the alignment
padding bytes are initialized.

Fixes: decde2586b34 ("net/tcp: Add TCP-AO sign to twsk")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <redacted>
Reported-by: Yuxiang Yang <redacted>
Reported-by: Ao Wang <redacted>
Reported-by: Xuewei Feng <redacted>
Reported-by: Qi Li <redacted>
Reported-by: Ke Xu <redacted>
Assisted-by: Claude-Code:GLM-5.2-special
Signed-off-by: Yizhou Zhao <redacted>
---

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index ec09f97..327ee96 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c

@@ -922,7 +922,7 @@ static void tcp_v4_send_ack(const struct sock *sk,
 	struct sock *ctl_sk;
 	u64 transmit_time;
 
-	memset(&rep.th, 0, sizeof(struct tcphdr));
+	memset(&rep, 0, sizeof(rep));
 	memset(&arg, 0, sizeof(arg));
 
 	arg.iov[0].iov_base = (unsigned char *)&rep;

--

2.47.3