Thanks for your review.

On Jul 13, 2026, at 16:48, Eric Dumazet [off-list ref] wrote:

On Mon, Jul 13, 2026 at 10:18 AM Yizhou Zhao
[off-list ref] wrote:

quoted

tcp_v4_send_ack() constructs standalone IPv4 TCP ACK replies on the stack
for SYN-RECV and TIME-WAIT paths.  It currently zeroes only the TCP
header, not the accompanying option buffer.

TCP-AO options may have actual lengths that are not 4-byte aligned, while
the transmitted TCP header length is correctly rounded up to a 4-byte
boundary.  tcp_ao_hash_hdr() writes only the MAC bytes, leaving the
TCP-AO option alignment padding in rep.opt uninitialized.  With stack
auto-initialization disabled, those padding bytes can be copied into the
network packet and sent to the peer.

Zero the whole reply structure before writing options, so the alignment
padding bytes are initialized.

Please fix TCP-AO instead of slowing down TCP (almost no TCP flow is using AO)

We have posted a v2 patch following your suggestions:
https://lore.kernel.org/netdev/20260713105631.8616-1-zhaoyz24@mails.tsinghua.edu.cn/ (local)

Regards,
Yizhou