Commit c4e2347693 for qemu.org

commit c4e23476936a96404f92a4b46cb3a7d8ad7dee4f
Author: Bernhard Beschow <shentey@gmail.com>
Date:   Mon Jul 27 10:28:46 2026 +0100

    hw/net/can/flexcan: Use mbs[] array for FIFO pop

    Implement FIFO entry shifting using the underlying `mbs[]` array instead
    of the overlapping `fifo` union view. This makes it explicit that the
    operation copies within a contiguous mailbox array and avoids Coverity
    CID 1662971.

    Reported-by: Peter Maydell <peter.maydell@linaro.org>
    Signed-off-by: Bernhard Beschow <shentey@gmail.com>
    Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Message-id: 20260723070059.6332-2-shentey@gmail.com
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c
index da36d10bd3..3a97edf7a4 100644
--- a/hw/net/can/flexcan.c
+++ b/hw/net/can/flexcan.c
@@ -879,22 +879,22 @@ static bool flexcan_can_receive(CanBusClientState *client)
  */
 static void flexcan_fifo_pop(FlexcanState *s)
 {
-    if (s->regs.fifo.mb_back.can_ctrl != 0) {
+    if (s->regs.mbs[0].can_ctrl != 0) {
         /* move queue elements forward */
-        memmove(&s->regs.fifo.mb_back, &s->regs.fifo.mbs_queue[0],
-                sizeof(s->regs.fifo.mbs_queue));
+        memmove(&s->regs.mbs[0], &s->regs.mbs[1],
+                sizeof(s->regs.mbs[0]) * (FLEXCAN_FIFO_DEPTH - 1));

         /* clear the first-in slot */
         memset(&s->regs.mbs[FLEXCAN_FIFO_DEPTH - 1], 0,
                sizeof(FlexcanRegsMessageBuffer));

         trace_flexcan_fifo_pop(DEVICE(s)->canonical_path, 1,
-                               s->regs.fifo.mb_back.can_ctrl != 0);
+                               s->regs.mbs[0].can_ctrl != 0);
     } else {
         trace_flexcan_fifo_pop(DEVICE(s)->canonical_path, 0, 0);
     }

-    if (s->regs.fifo.mb_back.can_ctrl != 0) {
+    if (s->regs.mbs[0].can_ctrl != 0) {
         flexcan_irq_iflag_set(s, I_FIFO_AVAILABLE);
     } else {
         flexcan_irq_iflag_clear(s, I_FIFO_AVAILABLE);