[{"id":3675526,"web_url":"http://patchwork.ozlabs.org/comment/3675526/","msgid":"<96b116e4-d91d-456a-9a08-fb3de4822a62@embeddedor.com>","list_archive_url":null,"date":"2026-04-09T22:09:21","subject":"Re: [PATCH v2][next] netfilter: x_tables: Avoid a couple\n -Wflex-array-member-not-at-end warnings","submitter":{"id":72003,"url":"http://patchwork.ozlabs.org/api/people/72003/","name":"Gustavo A. R. Silva","email":"gustavo@embeddedor.com"},"content":"BTW folks,\n\nWe can use the TRAILING_OVERLAP() helper and address these warnings with\nthe following patch instead:\n\ndiff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c\nindex b39017c80548..9dd5957d9ed4 100644\n--- a/net/netfilter/x_tables.c\n+++ b/net/netfilter/x_tables.c\n@@ -819,13 +819,15 @@ EXPORT_SYMBOL_GPL(xt_compat_match_to_user);\n\n /* non-compat version may have padding after verdict */\n struct compat_xt_standard_target {\n- struct compat_xt_entry_target t;\n- compat_uint_t verdict;\n+ TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,\n+ compat_uint_t verdict;\n+ );\n };\n\n struct compat_xt_error_target {\n- struct compat_xt_entry_target t;\n- char errorname[XT_FUNCTION_MAXNAMELEN];\n+ TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,\n+ char errorname[XT_FUNCTION_MAXNAMELEN];\n+ );\n };\n\n\nThis helper creates a union between a flexible-array member (FAM)\nand a set of members that would otherwise follow it. This overlays\nthe trailing members onto the FAM while preserving the original\nmemory layout. It was created to address exactly these sorts of\nissues where flexible-array members end up embedded in the middle\nof structs.\n\nYou tell me what you prefer.\n\nThanks\n-Gustavo\n\nOn 4/9/26 14:28, Gustavo A. R. Silva wrote:\n> -Wflex-array-member-not-at-end was introduced in GCC-14, and we are\n> getting ready to enable it, globally.\n> \n> struct compat_xt_standard_target and struct compat_xt_error_target are\n> only used in xt_compat_check_entry_offsets(). Remove these structs and\n> instead define the same memory layout on the stack via flexible struct\n> compat_xt_entry_target and DEFINE_RAW_FLEX(). Adjust the rest of the\n> code accordingly.\n> \n> With these changes, fix the following warnings:\n> \n> 1 net/netfilter/x_tables.c:816:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]\n> 1 net/netfilter/x_tables.c:811:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]\n> \n> Signed-off-by: Gustavo A. R. Silva \n> ---\n> Changes in v2:\n> - Update verdict after (compat_uint_t *)st->data;\n> \n> v1:\n> - Link: https://lore.kernel.org/linux-hardening/adbIKC0cZcK7VcCF@kspp/\n> \n> net/netfilter/x_tables.c | 31 ++++++++++++++-----------------\n> 1 file changed, 14 insertions(+), 17 deletions(-)\n> \n> diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c\n> index b39017c80548..746012196d83 100644\n> --- a/net/netfilter/x_tables.c\n> +++ b/net/netfilter/x_tables.c\n> @@ -817,17 +817,6 @@ int xt_compat_match_to_user(const struct xt_entry_match *m,\n> }\n> EXPORT_SYMBOL_GPL(xt_compat_match_to_user);\n> \n> -/* non-compat version may have padding after verdict */\n> -struct compat_xt_standard_target {\n> -\tstruct compat_xt_entry_target t;\n> -\tcompat_uint_t verdict;\n> -};\n> -\n> -struct compat_xt_error_target {\n> -\tstruct compat_xt_entry_target t;\n> -\tchar errorname[XT_FUNCTION_MAXNAMELEN];\n> -};\n> -\n> int xt_compat_check_entry_offsets(const void *base, const char *elems,\n> \t\t\t\t unsigned int target_offset,\n> \t\t\t\t unsigned int next_offset)\n> @@ -850,18 +839,26 @@ int xt_compat_check_entry_offsets(const void *base, const char *elems,\n> \t\treturn -EINVAL;\n> \n> \tif (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0) {\n> -\t\tconst struct compat_xt_standard_target *st = (const void *)t;\n> +\t\tDEFINE_RAW_FLEX(const struct compat_xt_entry_target, st, data,\n> +\t\t\t\tsizeof(compat_uint_t));\n> +\t\tcompat_uint_t *verdict;\n> \n> -\t\tif (COMPAT_XT_ALIGN(target_offset + sizeof(*st)) != next_offset)\n> +\t\tst = (const void *)t;\n> +\t\tverdict = (compat_uint_t *)st->data;\n> +\n> +\t\tif (COMPAT_XT_ALIGN(target_offset + __struct_size(st)) !=\n> +\t\t\t\tnext_offset)\n> \t\t\treturn -EINVAL;\n> \n> -\t\tif (!verdict_ok(st->verdict))\n> +\t\tif (!verdict_ok(*verdict))\n> \t\t\treturn -EINVAL;\n> \t} else if (strcmp(t->u.user.name, XT_ERROR_TARGET) == 0) {\n> -\t\tconst struct compat_xt_error_target *et = (const void *)t;\n> +\t\tDEFINE_RAW_FLEX(const struct compat_xt_entry_target, et, data,\n> +\t\t\t\tXT_FUNCTION_MAXNAMELEN);\n> +\t\tet = (const void *)t;\n> \n> -\t\tif (!error_tg_ok(t->u.target_size, sizeof(*et),\n> -\t\t\t\t et->errorname, sizeof(et->errorname)))\n> +\t\tif (!error_tg_ok(t->u.target_size, __struct_size(et),\n> +\t\t\t\t et->data, __member_size(et->data)))\n> \t\t\treturn -EINVAL;\n> \t}\n>","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=embeddedor.com header.i=@embeddedor.com\n header.a=rsa-sha256 header.s=default header.b=OD2OYFr0;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.234.253.10; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11780-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key)\n header.d=embeddedor.com header.i=@embeddedor.com header.b=\"OD2OYFr0\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=35.89.44.37","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=embeddedor.com","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=embeddedor.com"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org [172.234.253.10])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fsDh75MnCz1xtJ\n\tfor ; Fri, 10 Apr 2026 08:12:39 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 2915030151F4\n\tfor ; Thu, 9 Apr 2026 22:12:12 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 9AF3F387361;\n\tThu, 9 Apr 2026 22:12:11 +0000 (UTC)","from omta38.uswest2.a.cloudfilter.net\n (omta38.uswest2.a.cloudfilter.net [35.89.44.37])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D3DA352F9D\n\tfor ; Thu, 9 Apr 2026 22:12:10 +0000 (UTC)","from eig-obgw-5007b.ext.cloudfilter.net ([10.0.29.167])\n\tby cmsmtp with ESMTPS\n\tid AvXnwdhRqjw8YAxa6wSu14; Thu, 09 Apr 2026 22:10:34 +0000","from gator4166.hostgator.com ([108.167.133.22])\n\tby cmsmtp with ESMTPS\n\tid Axa5wHHKBxUZ2Axa6wDqOD; Thu, 09 Apr 2026 22:10:34 +0000","from [177.238.18.219] (port=33830 helo=[192.168.0.104])\n\tby gator4166.hostgator.com with esmtpsa (TLS1.2) tls\n TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\n\t(Exim 4.99.1)\n\t(envelope-from )\n\tid 1wAxa4-00000003KKH-30tW;\n\tThu, 09 Apr 2026 17:10:32 -0500"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775772731; cv=none;\n b=UVqK9X7XbcTIIvsM0BDKAr+V9HyahiogGOzpPJzY3evInKvIPld9YGN4WYJK0K103aOLmGEjAxO/nrTYkfgQNhy5bQxebSWQ19PjYD7H1hBoLDhFbBKxTr4mYwuukq7bVcLAHXFrxAiVjMQtXox6LE/5s0S162B3Am+ZDUZB1IY=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775772731; c=relaxed/simple;\n\tbh=wo6Ox7iCVjKYu5cSTs6fnMoWweBLD66PN67ebOZ9Rlg=;\n\th=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From:\n\t In-Reply-To:Content-Type;\n b=HF6C5OOP+C3Nt02km6cyqntAOfWyCO0zdQkMNjNotoaD7fLU9C7qOoh2RvVd/cCBGlSytCpSYiKOt+e0slA8M06pNOzztyxO/awCoei67qo3ifLU02jhe/rA8ZwzbUD0hxMlXYFLfqmEoANrhhW9VHCgZ9KUXSNRlvrydFXATxo=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=embeddedor.com;\n spf=pass smtp.mailfrom=embeddedor.com;\n dkim=pass (2048-bit key) header.d=embeddedor.com header.i=@embeddedor.com\n header.b=OD2OYFr0; arc=none smtp.client-ip=35.89.44.37","X-Authority-Analysis":"v=2.4 cv=HJHDFptv c=1 sm=1 tr=0 ts=69d823da\n a=1YbLdUo/zbTtOZ3uB5T3HA==:117 a=chC0KcwHAXg1M6QkddG+Hg==:17\n a=IkcTkHD0fZMA:10 a=A5OVakUREuEA:10 a=7T7KSl7uo7wA:10 a=VwQbUJbxAAAA:8\n a=QSUYj3f-MeYbdhfgnocA:9 a=QEXdDO2ut3YA:10 a=2aFnImwKRvkU0tJ3nQRT:22","DKIM-Signature":"v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;\n\td=embeddedor.com; s=default; h=Content-Transfer-Encoding:Content-Type:\n\tIn-Reply-To:From:References:Cc:To:Subject:MIME-Version:Date:Message-ID:Sender\n\t:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:\n\tResent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:\n\tList-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;\n\tbh=wpf1yAGrWWdCI706JaYjI24hP31WYUmdkcxek4LzYwI=; b=OD2OYFr0F2IVAr8xatAm2K4sjj\n\tWFHM4NVQEne4vc54doaNgD1aSgnW0LbwTnaQp4BBXuxotMVvGIASDxK4y6APSOcNLrEpfyIw+VJKa\n\tjC0U7+4q52sGkjLIbL1rwR70ByeRCik1Q9o68lcp/dqfQ+5y4/yzlHyGrTFjN11gJlfZYTJSam2cY\n\tLVC7FSh1jd+9E2R+8M5F+use96KrCp2pRi8xxSCpicwBdZPVZjFggpLzQjMljyKu+qMM1rNL8puPX\n\txVJF9yPyx8RbS8WezciZP8QzFz4gQ60ziuEbmVm8yzph9aPWfIlniluha1p/cI+DbCGHzTouDCFue\n\tMwANqgbQ==;","Message-ID":"<96b116e4-d91d-456a-9a08-fb3de4822a62@embeddedor.com>","Date":"Thu, 9 Apr 2026 16:09:21 -0600","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH v2][next] netfilter: x_tables: Avoid a couple\n -Wflex-array-member-not-at-end warnings","To":"\"Gustavo A. R. Silva\" ,\n Pablo Neira Ayuso , Florian Westphal ,\n Phil Sutter , \"David S. Miller\" ,\n Eric Dumazet , Jakub Kicinski ,\n Paolo Abeni , Simon Horman ,\n Kees Cook ","Cc":"netfilter-devel@vger.kernel.org, coreteam@netfilter.org,\n netdev@vger.kernel.org, linux-kernel@vger.kernel.org,\n linux-hardening@vger.kernel.org","References":"","Content-Language":"en-US","From":"\"Gustavo A. R. Silva\" ","In-Reply-To":"","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"7bit","X-AntiAbuse":["This header was added to track abuse,\n please include it with any abuse report","Primary Hostname - gator4166.hostgator.com","Original Domain - vger.kernel.org","Originator/Caller UID/GID - [47 12] / [47 12]","Sender Address Domain - embeddedor.com"],"X-BWhitelist":"no","X-Source-IP":"177.238.18.219","X-Source-L":"No","X-Exim-ID":"1wAxa4-00000003KKH-30tW","X-Source":"","X-Source-Args":"","X-Source-Dir":"","X-Source-Sender":"([192.168.0.104]) [177.238.18.219]:33830","X-Source-Auth":"gustavo@embeddedor.com","X-Email-Count":"5","X-Org":"HG=hgshared;ORG=hostgator;","X-Source-Cap":"Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20=","X-Local-Domain":"yes","X-CMAE-Envelope":"\n MS4xfGL09omnuMwgKdoDrGlciPwhYaL1H5LHDdPF3mze3l7QSMCqg+whOSFl9x56a72NagP13RfE/B8VWghrpI95OW7bXnK+ahpc3OIqQOHkQzsGvFNcOxnt\n n4o7U4ch5UHqEgtGu9ul0Ww9Gn2Q2/d758V8VHE0oeguQIvKz+zetjS2by4Or16d4YscOVL8PNahaHujID7AyBdKzjCtLQoDrJjMj9s+4McO6Gow/mt1nWK0"}},{"id":3675534,"web_url":"http://patchwork.ozlabs.org/comment/3675534/","msgid":"","list_archive_url":null,"date":"2026-04-09T22:18:22","subject":"Re: [PATCH v2][next] netfilter: x_tables: Avoid a couple\n -Wflex-array-member-not-at-end warnings","submitter":{"id":1025,"url":"http://patchwork.ozlabs.org/api/people/1025/","name":"Florian Westphal","email":"fw@strlen.de"},"content":"Gustavo A. R. Silva wrote:\n> diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c\n> index b39017c80548..9dd5957d9ed4 100644\n> --- a/net/netfilter/x_tables.c\n> +++ b/net/netfilter/x_tables.c\n> @@ -819,13 +819,15 @@ EXPORT_SYMBOL_GPL(xt_compat_match_to_user);\n> \n> /* non-compat version may have padding after verdict */\n> struct compat_xt_standard_target {\n> - struct compat_xt_entry_target t;\n> - compat_uint_t verdict;\n> + TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,\n> + compat_uint_t verdict;\n> + );\n> };\n> \n> struct compat_xt_error_target {\n> - struct compat_xt_entry_target t;\n> - char errorname[XT_FUNCTION_MAXNAMELEN];\n> + TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,\n> + char errorname[XT_FUNCTION_MAXNAMELEN];\n> + );\n> };\n> \n> You tell me what you prefer.\n\nI have no strong opinion. This compat code is needed to run 32bit\niptables binaries on a 64 bit host, not many users these days I think.\nI still hope we can remove this eventually.\n\nBut as the above diff is smaller I would prefer it.","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.234.253.10; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11781-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=91.216.245.30","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=strlen.de"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org [172.234.253.10])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fsDqn29NCz1y05\n\tfor ; Fri, 10 Apr 2026 08:19:17 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id CC4E330398AB\n\tfor ; Thu, 9 Apr 2026 22:18:28 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id B2B07389443;\n\tThu, 9 Apr 2026 22:18:27 +0000 (UTC)","from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc\n [91.216.245.30])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 4647A3876D7;\n\tThu, 9 Apr 2026 22:18:25 +0000 (UTC)","by Chamillionaire.breakpoint.cc (Postfix, from userid 1003)\n\tid B6F5760636; Fri, 10 Apr 2026 00:18:22 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775773107; cv=none;\n b=XExTRLLCo3Aj3fwSueam9YbrsNVhKyp9LAwfaRJN+3JmZInzpcxnu87Ymg42lm2r02uFy5whd8EtOXb8cthPv77ihNpShIvnanRN9DoFKYk9MjldEskxwsVyKxYSeNIoNBLKgYIIYIQDQUDQmknfUXhNtSV25ByoS0VKBlKa7fs=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775773107; c=relaxed/simple;\n\tbh=7NHXqhYlaXYZT42HGjbijLVE6ckdTGpyV5UAritebGE=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=BXJi2la9mybDtnJnbFMlSi12BteqQCGgrIJVGkAVOKPKk4TKLBuVclxppP93zmtcFpOrUP4u3Jy5qhBh3am9xLvc1aqGQdnAi4n8FGXjUX89+SDYRd9RV1Edxhmo8U4HkLAg4zxoS1TRZjs82oRlMhStNlyIx18EbpXOTeEje1E=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de;\n spf=pass smtp.mailfrom=strlen.de; arc=none smtp.client-ip=91.216.245.30","Date":"Fri, 10 Apr 2026 00:18:22 +0200","From":"Florian Westphal ","To":"\"Gustavo A. R. Silva\" ","Cc":"\"Gustavo A. R. Silva\" ,\n\tPablo Neira Ayuso , Phil Sutter ,\n\t\"David S. Miller\" ,\n\tEric Dumazet ,\n\tJakub Kicinski , Paolo Abeni ,\n\tSimon Horman , Kees Cook ,\n\tnetfilter-devel@vger.kernel.org, coreteam@netfilter.org,\n\tnetdev@vger.kernel.org, linux-kernel@vger.kernel.org,\n\tlinux-hardening@vger.kernel.org","Subject":"Re: [PATCH v2][next] netfilter: x_tables: Avoid a couple\n -Wflex-array-member-not-at-end warnings","Message-ID":"","References":"\n <96b116e4-d91d-456a-9a08-fb3de4822a62@embeddedor.com>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"<96b116e4-d91d-456a-9a08-fb3de4822a62@embeddedor.com>"}},{"id":3675538,"web_url":"http://patchwork.ozlabs.org/comment/3675538/","msgid":"<3d07eb02-1a18-4de1-9683-5c05b80600e2@embeddedor.com>","list_archive_url":null,"date":"2026-04-09T22:23:59","subject":"Re: [PATCH v2][next] netfilter: x_tables: Avoid a couple\n -Wflex-array-member-not-at-end warnings","submitter":{"id":72003,"url":"http://patchwork.ozlabs.org/api/people/72003/","name":"Gustavo A. R. Silva","email":"gustavo@embeddedor.com"},"content":"On 4/9/26 16:18, Florian Westphal wrote:\n> Gustavo A. R. Silva wrote:\n>> diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c\n>> index b39017c80548..9dd5957d9ed4 100644\n>> --- a/net/netfilter/x_tables.c\n>> +++ b/net/netfilter/x_tables.c\n>> @@ -819,13 +819,15 @@ EXPORT_SYMBOL_GPL(xt_compat_match_to_user);\n>>\n>> /* non-compat version may have padding after verdict */\n>> struct compat_xt_standard_target {\n>> - struct compat_xt_entry_target t;\n>> - compat_uint_t verdict;\n>> + TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,\n>> + compat_uint_t verdict;\n>> + );\n>> };\n>>\n>> struct compat_xt_error_target {\n>> - struct compat_xt_entry_target t;\n>> - char errorname[XT_FUNCTION_MAXNAMELEN];\n>> + TRAILING_OVERLAP(struct compat_xt_entry_target, t, data,\n>> + char errorname[XT_FUNCTION_MAXNAMELEN];\n>> + );\n>> };\n>>\n>> You tell me what you prefer.\n> \n> I have no strong opinion. This compat code is needed to run 32bit\n> iptables binaries on a 64 bit host, not many users these days I think.\n> I still hope we can remove this eventually.\n> \n> But as the above diff is smaller I would prefer it.\n\nOkay; I'll submit this as v3 then.\n\nThanks for the feedback,\n-Gustavo","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=embeddedor.com header.i=@embeddedor.com\n header.a=rsa-sha256 header.s=default header.b=w6MEW9XH;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11782-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key)\n header.d=embeddedor.com header.i=@embeddedor.com header.b=\"w6MEW9XH\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=44.202.169.37","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=embeddedor.com","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=embeddedor.com"],"Received":["from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fsF071m1Jz1xtJ\n\tfor ; Fri, 10 Apr 2026 08:26:31 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id 06A7330538B2\n\tfor ; Thu, 9 Apr 2026 22:25:26 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 7075238F929;\n\tThu, 9 Apr 2026 22:25:22 +0000 (UTC)","from omta038.useast.a.cloudfilter.net\n (omta038.useast.a.cloudfilter.net [44.202.169.37])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id CDB9238F92E\n\tfor ; Thu, 9 Apr 2026 22:25:20 +0000 (UTC)","from eig-obgw-6005b.ext.cloudfilter.net ([10.0.30.162])\n\tby cmsmtp with ESMTPS\n\tid AoF4wCYtzc9KCAxoNwFBlw; Thu, 09 Apr 2026 22:25:20 +0000","from gator4166.hostgator.com ([108.167.133.22])\n\tby cmsmtp with ESMTPS\n\tid AxoIwzlzwFeDMAxoIw78gD; Thu, 09 Apr 2026 22:25:14 +0000","from [177.238.18.219] (port=45456 helo=[192.168.0.104])\n\tby gator4166.hostgator.com with esmtpsa (TLS1.2) tls\n TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\n\t(Exim 4.99.1)\n\t(envelope-from )\n\tid 1wAxoG-00000003aQj-0zkt;\n\tThu, 09 Apr 2026 17:25:12 -0500"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775773522; cv=none;\n b=arXOjROI2/DoRKS7L2WZY/PWMyzkefdX7EZJAyLB9a91g2481xRScYja2uvuZqXLjNYboG6OL+LBL0M7Ci1lp++VEnbvMyree10XK6+5vTvOgEyqEyyOhQy0oFMlG1f7dp1GsyBLGoPI1fG/GjrmNL4YLYjd/p/tt1RzJAoTFf0=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775773522; c=relaxed/simple;\n\tbh=AbJbBW6X9LmrirWXz3KRksKCyyWsSci1hJLqJfBEgC8=;\n\th=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From:\n\t In-Reply-To:Content-Type;\n b=KhrYOiFZ78VHpNuC6w7UHFQL2ev+nPt0xAt9HeCW8J7ZYpVX/4xY02co+Q2l8yZVtjHF+AtJJy0z7VTNwR6sLOcOLf70/NxpUISfFmNBtgoxya7SJfGKorYqPihf2D1Or354AV4tbrqpzG/LBRRrdSUi5KccPqrPU0ZCB3xp+y4=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=embeddedor.com;\n spf=pass smtp.mailfrom=embeddedor.com;\n dkim=pass (2048-bit key) header.d=embeddedor.com header.i=@embeddedor.com\n header.b=w6MEW9XH; arc=none smtp.client-ip=44.202.169.37","X-Authority-Analysis":"v=2.4 cv=aq2yCTZV c=1 sm=1 tr=0 ts=69d8274f\n a=1YbLdUo/zbTtOZ3uB5T3HA==:117 a=chC0KcwHAXg1M6QkddG+Hg==:17\n a=IkcTkHD0fZMA:10 a=A5OVakUREuEA:10 a=7T7KSl7uo7wA:10 a=_Wotqz80AAAA:8\n a=q7JyIVeMSE5i464zDnEA:9 a=QEXdDO2ut3YA:10 a=buJP51TR1BpY-zbLSsyS:22\n a=2aFnImwKRvkU0tJ3nQRT:22","DKIM-Signature":"v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;\n\td=embeddedor.com; s=default; h=Content-Transfer-Encoding:Content-Type:\n\tIn-Reply-To:From:References:Cc:To:Subject:MIME-Version:Date:Message-ID:Sender\n\t:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:\n\tResent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:\n\tList-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;\n\tbh=4BBlkBrjrnSTWHBfnhpyKI7M2eVDU51iIMYacZS4Q/0=; b=w6MEW9XHtJeoU3e8FoHDHf8K3/\n\tivR3cFvN7s2LInyuaPqW9dcyLaYXkkDM5MpKvf3aEFCuMK2vFJf/2muGzJPrwuYm9GY7bfO/49a3z\n\tcnBSWDCM47on+tX1INjqvFb14khL7P8XSgxUORsdk5RxpjYtWBd4RPWTOtCfKrq5n3T5uabX/pzIe\n\tTrJDVueDCobFbUKfLcxProglFvYrYmSJNiwFtYDBklxwAPyJUsw8i8FfIUN4NIlXBv3/aZgF2w7ew\n\tAqoX0SjMheEX1J+m1ZSmmm1WqPtmHIMaCMekzg1lNQAlZM5L+KnoWStWJcrAQQbfGG0Ucof8CutUS\n\tJSdjFgKw==;","Message-ID":"<3d07eb02-1a18-4de1-9683-5c05b80600e2@embeddedor.com>","Date":"Thu, 9 Apr 2026 16:23:59 -0600","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH v2][next] netfilter: x_tables: Avoid a couple\n -Wflex-array-member-not-at-end warnings","To":"Florian Westphal ","Cc":"\"Gustavo A. R. Silva\" ,\n Pablo Neira Ayuso , Phil Sutter ,\n \"David S. Miller\" , Eric Dumazet ,\n Jakub Kicinski , Paolo Abeni ,\n Simon Horman , Kees Cook ,\n netfilter-devel@vger.kernel.org, coreteam@netfilter.org,\n netdev@vger.kernel.org, linux-kernel@vger.kernel.org,\n linux-hardening@vger.kernel.org","References":"\n <96b116e4-d91d-456a-9a08-fb3de4822a62@embeddedor.com>\n ","Content-Language":"en-US","From":"\"Gustavo A. R. Silva\" ","In-Reply-To":"","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"7bit","X-AntiAbuse":["This header was added to track abuse,\n please include it with any abuse report","Primary Hostname - gator4166.hostgator.com","Original Domain - vger.kernel.org","Originator/Caller UID/GID - [47 12] / [47 12]","Sender Address Domain - embeddedor.com"],"X-BWhitelist":"no","X-Source-IP":"177.238.18.219","X-Source-L":"No","X-Exim-ID":"1wAxoG-00000003aQj-0zkt","X-Source":"","X-Source-Args":"","X-Source-Dir":"","X-Source-Sender":"([192.168.0.104]) [177.238.18.219]:45456","X-Source-Auth":"gustavo@embeddedor.com","X-Email-Count":"20","X-Org":"HG=hgshared;ORG=hostgator;","X-Source-Cap":"Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20=","X-Local-Domain":"yes","X-CMAE-Envelope":"\n MS4xfOsvKXZemnFW/V0068K1GQGWYkvZE+MNWlGEMfiaF9BsWOmmQqh0Yx8oGzZ3v9/z42kVYSe87J4jDiUpSz9iLxXzyzJzWN25OrUPw4eO+85bMNgNCC9M\n pkSHD5y9opJpxRRHrrfHFuQcuYcrYxkCVTPsXyKjx5ama0hKSgBwV66tKACcWplErr2esNRP78eCfzXazkkJRLCReihPCqtOLxdPJ4xg1gZ7GnaI+4Y/F8Rp"}}]