Commit 4ac969571b for qemu.org

commit 4ac969571b01c0de9d677dfe93647a5f78d44967
Author: Bernhard Beschow <shentey@gmail.com>
Date:   Mon Jul 27 10:28:46 2026 +0100

    hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx()

    Require `last_not_free_to_receive_mbid >= 0` before indexing `mbs[]`.
    This prevents a possible `-1` array index and fixes Coverity CID
    1662790.

    Reported-by: Peter Maydell <peter.maydell@linaro.org>
    Signed-off-by: Bernhard Beschow <shentey@gmail.com>
    Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
    Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
    Message-id: 20260723070059.6332-4-shentey@gmail.com
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index 3a97edf7a4..dd92a38337 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -1075,7 +1075,7 @@ static enum FlexcanRx flexcan_mb_rx(FlexcanState *s, const qemu_can_frame *buf)
         }
     }

-    if (last_not_free_to_receive_mbid >= -1) {
+    if (last_not_free_to_receive_mbid >= 0) {
         if (last_not_free_to_receive_locked) {
             /*
              * copy to temporary mailbox (SMB)