Commit 9981b70ce7 for qemu.org

commit 9981b70ce799f24db94ccca2175217ecb3936a53
Author: Bernhard Beschow <shentey@gmail.com>
Date:   Mon Jul 27 10:28:46 2026 +0100

    hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_write()

    Calculate mailbox indices from the `mbs[]` array layout instead of the
    oversized raw `mb[]` view. This prevents accessing mailbox entries beyond
    the valid array range and fixes Coverity CID 1662974.

    Reported-by: Peter Maydell <peter.maydell@linaro.org>
    Signed-off-by: Bernhard Beschow <shentey@gmail.com>
    Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
    Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
    Message-id: 20260723070059.6332-5-shentey@gmail.com
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index dd92a38337..651904fa37 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -1151,6 +1151,8 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
                               unsigned size)
 {
     FlexcanState *s = opaque;
+    const int mbid = (addr - offsetof(FlexcanRegs, mbs)) /
+        sizeof(s->regs.mbs[0]);
     uint32_t write_mask = ((const uint32_t *)
         &flexcan_regs_write_mask)[addr / 4];
     uint32_t old_value = s->regs_raw[addr / 4];
@@ -1208,11 +1210,8 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
     default:
         s->regs_raw[addr / 4] = (val & write_mask) | (old_value & ~write_mask);

-        if (addr >= offsetof(FlexcanRegs, mb) &&
-            addr < offsetof(FlexcanRegs, _reserved4)) {
+        if (0 <= mbid && mbid < ARRAY_SIZE(s->regs.mbs)) {
             /* access to mailbox */
-            int mbid = (addr - offsetof(FlexcanRegs, mb)) /
-                            sizeof(FlexcanRegsMessageBuffer);

             if (s->locked_mbidx == mbid) {
                 flexcan_mb_unlock(s);