On Thu, 23 Jul 2026 at 08:01, Bernhard Beschow <[email protected]> wrote: > > Calculate mailbox indices from the `mbs[]` array layout instead of the > oversized raw `mb[]` view. This prevents accessing mailbox entries beyond > the valid array range and fixes Coverity CID 1662974. > > Reported-by: Peter Maydell <[email protected]> > Signed-off-by: Bernhard Beschow <[email protected]> > --- > hw/net/can/flexcan.c | 8 +++----- > 1 file changed, 3 insertions(+), 5 deletions(-) > > diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c > index 651904fa37..8d680f1832 100644 > --- a/hw/net/can/flexcan.c > +++ b/hw/net/can/flexcan.c > @@ -1239,14 +1239,12 @@ static void flexcan_mem_write(void *opaque, hwaddr > addr, uint64_t val, > static uint64_t flexcan_mem_read(void *opqaue, hwaddr addr, unsigned size) > { > FlexcanState *s = opqaue; > + const int mbid = (addr - offsetof(FlexcanRegs, mbs)) / > + sizeof(s->regs.mbs[0]); > uint32_t rv = s->regs_raw[addr >> 2]; > > - if (addr >= offsetof(FlexcanRegs, mb) && > - addr < offsetof(FlexcanRegs, _reserved4)) { > + if (0 <= mbid && mbid < ARRAY_SIZE(s->regs.mbs)) { > /* reading from mailbox */ > - hwaddr offset = addr - offsetof(FlexcanRegs, mb); > - int mbid = offset / sizeof(FlexcanRegsMessageBuffer); > - > if (addr % 16 == 0 && s->locked_mbidx != mbid) { > /* reading control word locks the mailbox */ > flexcan_mb_unlock(s);
Reviewed-by: Peter Maydell <[email protected]> thanks -- PMM
