Commit 8f8f86306f for qemu.org

commit 8f8f86306fea9e8995207801f0a8efc959115e78
Author: Bernhard Beschow <shentey@gmail.com>
Date:   Mon Jul 27 10:28:46 2026 +0100

    hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_read()

    Calculate mailbox indices from the `mbs[]` array layout instead of the
    oversized raw `mb[]` view. This prevents accessing mailbox entries beyond
    the valid array range and fixes Coverity CID 1662974.

    Reported-by: Peter Maydell <peter.maydell@linaro.org>
    Signed-off-by: Bernhard Beschow <shentey@gmail.com>
    Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
    Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
    Message-id: 20260723070059.6332-6-shentey@gmail.com
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index 651904fa37..8d680f1832 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -1239,14 +1239,12 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
 static uint64_t flexcan_mem_read(void *opqaue, hwaddr addr, unsigned size)
 {
     FlexcanState *s = opqaue;
+    const int mbid = (addr - offsetof(FlexcanRegs, mbs)) /
+        sizeof(s->regs.mbs[0]);
     uint32_t rv = s->regs_raw[addr >> 2];

-    if (addr >= offsetof(FlexcanRegs, mb) &&
-        addr < offsetof(FlexcanRegs, _reserved4)) {
+    if (0 <= mbid && mbid < ARRAY_SIZE(s->regs.mbs)) {
         /* reading from mailbox */
-        hwaddr offset = addr - offsetof(FlexcanRegs, mb);
-        int mbid = offset / sizeof(FlexcanRegsMessageBuffer);
-
         if (addr % 16 == 0 && s->locked_mbidx != mbid) {
             /* reading control word locks the mailbox */
             flexcan_mb_unlock(s);