{"id":2745,"date":"2026-04-14T14:55:52","date_gmt":"2026-04-14T20:55:52","guid":{"rendered":"https:\/\/embeddedor.com\/blog\/?p=2745"},"modified":"2026-04-23T11:00:36","modified_gmt":"2026-04-23T17:00:36","slug":"100-wflex-array-member-not-at-end-issues-in-linux-next","status":"publish","type":"post","link":"https:\/\/embeddedor.com\/blog\/2026\/04\/14\/100-wflex-array-member-not-at-end-issues-in-linux-next\/","title":{"rendered":"100 -Wflex-array-member-not-at-end issues in linux-next"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"254\" src=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-33-54-1-700x254.png\" alt=\"\" class=\"wp-image-2777\" srcset=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-33-54-1-700x254.png 700w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-33-54-1-300x109.png 300w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-33-54-1-768x279.png 768w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-33-54-1-1536x558.png 1536w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-33-54-1-2048x744.png 2048w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-33-54-1-800x291.png 800w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Today I woke up to the great news that we now have &#8220;only&#8221; 100 <code>-Wflex-array-member-not-at-end<\/code> issues left to be addressed in <code>linux-next.<\/code> I started fixing these issues a couple of years ago after running into a memory corruption bug<sup data-fn=\"95c0aff3-8e50-455b-bd97-b347e63c2edb\" class=\"fn\"><a href=\"#95c0aff3-8e50-455b-bd97-b347e63c2edb\" id=\"95c0aff3-8e50-455b-bd97-b347e63c2edb-link\">1<\/a><\/sup> caused by a flexible-array member in the middle of a structure.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"660\" src=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-14-45-07-700x660.png\" alt=\"\" class=\"wp-image-2817\" srcset=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-14-45-07-700x660.png 700w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-14-45-07-300x283.png 300w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-14-45-07-768x724.png 768w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-14-45-07-800x754.png 800w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-14-45-07.png 1400w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>I discovered this bug while reviewing my slides a couple of days before presenting at Kernel Recipes 2023 in Paris &#x1f1eb;&#x1f1f7;. Naturally, I didn&#8217;t miss the opportunity to share the story during my presentation<sup data-fn=\"8debcea9-2f9f-4e45-b4ec-6b53c90c95a4\" class=\"fn\"><a href=\"#8debcea9-2f9f-4e45-b4ec-6b53c90c95a4\" id=\"8debcea9-2f9f-4e45-b4ec-6b53c90c95a4-link\">2<\/a><\/sup> and talk about my plans to enable this compiler option upstream.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"396\" src=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-55-19-700x396.png\" alt=\"\" class=\"wp-image-2787\" srcset=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-55-19-700x396.png 700w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-55-19-300x170.png 300w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-55-19-768x434.png 768w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-55-19-1536x868.png 1536w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-55-19-2048x1158.png 2048w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-55-19-800x452.png 800w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>A few months before Kernel Recipes that year, I had experimented a bit with the, at the time, under-development version of <code>-Wflex-array-member-not-at-end.<\/code> Honestly, given the number of warnings and issues reported by the compiler, I didn&#8217;t pay much attention to it at the time. However, I knew it would eventually become one of the next great challenges to tackle in the Linux Kernel Self-Protection Project<sup data-fn=\"85bacea2-207c-4e88-9fee-4b2ddcbbabeb\" class=\"fn\"><a href=\"#85bacea2-207c-4e88-9fee-4b2ddcbbabeb\" id=\"85bacea2-207c-4e88-9fee-4b2ddcbbabeb-link\">3<\/a><\/sup>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"396\" src=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-16-700x396.png\" alt=\"\" class=\"wp-image-2783\" srcset=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-16-700x396.png 700w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-16-300x170.png 300w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-16-768x434.png 768w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-16-1536x868.png 1536w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-16-2048x1158.png 2048w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-16-800x452.png 800w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>It wasn&#8217;t until I confirmed that the bug I had incidentally found while reviewing my slides was also reported by <code>-Wflex-array-member-not-at-end<\/code> that I began actively addressing these issues and thinking about how to solve the problem as a whole.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"396\" src=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-59-700x396.png\" alt=\"\" class=\"wp-image-2784\" srcset=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-59-700x396.png 700w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-59-300x170.png 300w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-59-768x434.png 768w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-59-1536x868.png 1536w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-59-2048x1158.png 2048w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/Screenshot-From-2026-04-14-13-52-59-800x452.png 800w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>In a future post, I&#8217;ll dive deeper into the effort and innovations behind this work, but for now I&#8217;ll just say that <strong>I&#8217;m really happy that about 85% of it is complete<\/strong>. As shown in a slide above, we started with 650 unique issues (accounting for roughly 60,000 warnings in total), and after a lot of effort, we&#8217;re now in the final phase before we can finally enable this compiler option in mainline Linux. \ud83d\ude42<\/p>\n\n\n\n<p>I&#8217;ve talked about this work at multiple conferences. Below are a couple of presentations for those who want to learn more.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/embeddedor.com\/blog\/presentations\/#Upstream_Kernel_Hardening_Progress_on_enabling_-Wflex-array-member-not-at-end_OSSJP2025\" target=\"_blank\" rel=\"noreferrer noopener\">Upstream Kernel Hardening: Progress on enabling -Wflex-array-member-not-at-end (OSSJP2025)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/embeddedor.com\/blog\/presentations\/#Enhancing_spatial_safety_Fixing_thousands_of_-Wflex-array-member-not-at-end_warnings_LPCEU\" target=\"_blank\" rel=\"noreferrer noopener\">Enhancing spatial safety: Fixing thousands of -Wflex-array-member-not-at-end warnings (LPCEU2024)<\/a><\/li>\n<\/ul>\n\n\n\n<p>Lastly, a shoutout to Qing Zhao<sup data-fn=\"8e0276cf-20da-4b63-905f-5c5af2e4da12\" class=\"fn\"><a href=\"#8e0276cf-20da-4b63-905f-5c5af2e4da12\" id=\"8e0276cf-20da-4b63-905f-5c5af2e4da12-link\">4<\/a><\/sup>, who developed this compiler option and other hardening features in GCC<sup data-fn=\"68a8e36c-6477-4908-a349-f33b8c3bae23\" class=\"fn\"><a href=\"#68a8e36c-6477-4908-a349-f33b8c3bae23\" id=\"68a8e36c-6477-4908-a349-f33b8c3bae23-link\">5<\/a><\/sup> that we use extensively to harden the Linux kernel. Qing retired this year, and all of us in the Linux Kernel Self-Protection Project are glad we had the opportunity to meet and work with her. All the best, Qing.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"888\" src=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/QingZhao-700x888.jpg\" alt=\"\" class=\"wp-image-2799\" srcset=\"https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/QingZhao-700x888.jpg 700w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/QingZhao-236x300.jpg 236w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/QingZhao-768x974.jpg 768w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/QingZhao-800x1015.jpg 800w, https:\/\/embeddedor.com\/blog\/wp-content\/uploads\/2026\/04\/QingZhao.jpg 960w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Thank you!&#x1f642;&#x1f427;&#x1f6e1;&#x2694;&#xfe0f;<\/p>\n\n\n\n<p>P.S. The slides shown in this post are from the following presentation.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/embeddedor.com\/blog\/presentations\/#Gaining_bounds-checking_on_trailing_arrays_in_the_Linux_Kernel_KR\" target=\"_blank\" rel=\"noreferrer noopener\">Gaining bounds-checking on trailing arrays in the Linux Kernel<\/a><\/li>\n<\/ul>\n\n\n\n<p>List of patches addressing <code>-Wflex-array-member-not-at-end<\/code> issues in <code>linux-next<\/code>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/git.kernel.org\/pub\/scm\/linux\/kernel\/git\/next\/linux-next.git\/log\/?qt=grep&amp;q=-Wflex-array-member-not-at-end\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/git.kernel.org\/pub\/scm\/linux\/kernel\/git\/next\/linux-next.git\/log\/?qt=grep&amp;q=-Wflex-array-member-not-at-end<\/a><\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n<ol class=\"wp-block-footnotes\"><li id=\"95c0aff3-8e50-455b-bd97-b347e63c2edb\"><a href=\"https:\/\/git.kernel.org\/linus\/eea03d18af9c4423\" target=\"_blank\" rel=\"noreferrer noopener\">qed\/red_ll2: Fix undefined behavior bug in struct qed_ll2_info<\/a> <a href=\"#95c0aff3-8e50-455b-bd97-b347e63c2edb-link\" aria-label=\"Jump to footnote reference 1\">\u21a9\ufe0e<\/a><\/li><li id=\"8debcea9-2f9f-4e45-b4ec-6b53c90c95a4\"><a href=\"https:\/\/embeddedor.com\/blog\/presentations\/#Gaining_bounds-checking_on_trailing_arrays_in_the_Linux_Kernel_KR\" target=\"_blank\" rel=\"noreferrer noopener\">Gaining bounds-checking on trailing arrays in the Linux Kernel<\/a> <a href=\"#8debcea9-2f9f-4e45-b4ec-6b53c90c95a4-link\" aria-label=\"Jump to footnote reference 2\">\u21a9\ufe0e<\/a><\/li><li id=\"85bacea2-207c-4e88-9fee-4b2ddcbbabeb\"><a href=\"https:\/\/kspp.github.io\/\"><a href=\"https:\/\/kspp.github.io\/\">Linux Kernel Self-Protection Project<\/a><\/a> <a href=\"#85bacea2-207c-4e88-9fee-4b2ddcbbabeb-link\" aria-label=\"Jump to footnote reference 3\">\u21a9\ufe0e<\/a><\/li><li id=\"8e0276cf-20da-4b63-905f-5c5af2e4da12\"><a href=\"https:\/\/www.linkedin.com\/in\/qing-zhao-62770120\/\">https:\/\/www.linkedin.com\/in\/qing-zhao-62770120\/<\/a> <a href=\"#8e0276cf-20da-4b63-905f-5c5af2e4da12-link\" aria-label=\"Jump to footnote reference 4\">\u21a9\ufe0e<\/a><\/li><li id=\"68a8e36c-6477-4908-a349-f33b8c3bae23\"><a href=\"https:\/\/lwn.net\/Articles\/946041\/\">GCC features to help harden the kernel<\/a> <a href=\"#68a8e36c-6477-4908-a349-f33b8c3bae23-link\" aria-label=\"Jump to footnote reference 5\">\u21a9\ufe0e<\/a><\/li><\/ol>\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Today I woke up to the great news that we now have &#8220;only&#8221; 100 -Wflex-array-member-not-at-end issues left to be addressed in linux-next. I started fixing these issues a couple of years ago after running into a memory corruption bug caused by a flexible-array member in the middle of a structure. I discovered this bug while&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":"[{\"content\":\"<a href=\\\"https:\/\/git.kernel.org\/linus\/eea03d18af9c4423\\\" target=\\\"_blank\\\" rel=\\\"noreferrer noopener\\\">qed\/red_ll2: Fix undefined behavior bug in struct qed_ll2_info<\/a>\",\"id\":\"95c0aff3-8e50-455b-bd97-b347e63c2edb\"},{\"content\":\"<a href=\\\"https:\/\/embeddedor.com\/blog\/presentations\/#Gaining_bounds-checking_on_trailing_arrays_in_the_Linux_Kernel_KR\\\" target=\\\"_blank\\\" rel=\\\"noreferrer noopener\\\">Gaining bounds-checking on trailing arrays in the Linux Kernel<\/a>\",\"id\":\"8debcea9-2f9f-4e45-b4ec-6b53c90c95a4\"},{\"content\":\"<a href=\\\"https:\/\/kspp.github.io\/\\\"><a href=\\\"https:\/\/kspp.github.io\/\\\">Linux Kernel Self-Protection Project<\/a><\/a>\",\"id\":\"85bacea2-207c-4e88-9fee-4b2ddcbbabeb\"},{\"content\":\"<a href=\\\"https:\/\/www.linkedin.com\/in\/qing-zhao-62770120\/\\\">https:\/\/www.linkedin.com\/in\/qing-zhao-62770120\/<\/a>\",\"id\":\"8e0276cf-20da-4b63-905f-5c5af2e4da12\"},{\"content\":\"<a href=\\\"https:\/\/lwn.net\/Articles\/946041\/\\\">GCC features to help harden the kernel<\/a>\",\"id\":\"68a8e36c-6477-4908-a349-f33b8c3bae23\"}]"},"categories":[31,13,18,9],"tags":[],"class_list":["post-2745","post","type-post","status-publish","format-standard","hentry","category-wfamnae","category-kernel-self-protection-project","category-linux-kernel-bugs","category-linux-kernel-hardening"],"_links":{"self":[{"href":"https:\/\/embeddedor.com\/blog\/wp-json\/wp\/v2\/posts\/2745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/embeddedor.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/embeddedor.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/embeddedor.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/embeddedor.com\/blog\/wp-json\/wp\/v2\/comments?post=2745"}],"version-history":[{"count":71,"href":"https:\/\/embeddedor.com\/blog\/wp-json\/wp\/v2\/posts\/2745\/revisions"}],"predecessor-version":[{"id":3217,"href":"https:\/\/embeddedor.com\/blog\/wp-json\/wp\/v2\/posts\/2745\/revisions\/3217"}],"wp:attachment":[{"href":"https:\/\/embeddedor.com\/blog\/wp-json\/wp\/v2\/media?parent=2745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/embeddedor.com\/blog\/wp-json\/wp\/v2\/categories?post=2745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/embeddedor.com\/blog\/wp-json\/wp\/v2\/tags?post=2745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}