Upstream Kernel Hardening: Progress on Enabling -Wflex-array-member-not-at-end
Talkat Open Source Summit Japan + AI_dev: Open Source GenAI & ML Summit + Automotive Linux Summit 2025 · 2025-12-08..12-10·
summary
GCC 14’s -Wflex-array-member-not-at-end flags flexible-array instances-in-the-middle, initially spitting ~64k warnings but ~650 unique problems; fixes cluster into removal, splitting headers, using str_group + container_of, DEFINE/DECLARE_FLEX for stack, and a new trailing_overlap helper. About 70 patches are merged, ~20 under review (≈100 total), and unique warnings drop from ~650 to ~135 (~80% addressed). Concrete commits and static_assert checks handle subtle trailing-padding and alignment bugs; the approach proves practical and reviewable.
AI-written summary · about
chapters (21)
- 0:00Kernel hardening introduction
- 1:25Flexible array members
- 3:53-Wflex-array-member-not-at-end
- 5:37Flexible arrays in the middle
- 7:4660,000+ warnings discovered
- 10:38Four strategies to fix false positives
- 12:26Removing unused flexible arrays
- 13:51Header vs flexible array separation
- 16:20Strgroup to isolate flexible arrays
- 19:31Implicit unions case
- 21:41Trailing padding alignment
- 23:31Alignment fix with strgroup
- 26:23Accessing flexible arrays
- 27:26Stack-based flexible arrays
- 29:14declare_flex helper
- 31:00declare_flex limitations
- 32:24trailing_overlap helper
- 34:54Choosing strategies
- 36:41Approach evolution
- 38:06Current progress
- 39:10Summary next steps
related talks
40mUpstream Kernel Hardening: Progress on Enabling -Wflex-array-member-not-at-end
35mUpstream Kernel Hardening: Recent Progress and Challenges
46mProgress On Bounds Checking in C and the Linux Kernel
54mSecurity Features status update
47mChallenges and Innovations Towards Spatial Safety in the Linux Kernel
44mWhere are we on security features?
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
21mSecurity Features status update