hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_read()
Calculate mailbox indices from the `mbs[]` array layout instead of the oversized raw `mb[]` view. This prevents accessing mailbox entries beyond the valid array range and fixes Coverity CID 1662974. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20260723070059.6332-6-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow committed
Jul 27, 2026 at 10:28 UTC
8f8f86306fea9e8995207801f0a8efc959115e78
1 file changed
+3
-5
hw/net/can/flexcan.c
+3
-5
@@ -1239,14 +1239,12 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
1239
static uint64_t flexcan_mem_read(void *opqaue, hwaddr addr, unsigned size)
1240
{
1241
FlexcanState *s = opqaue;
1242
+ const int mbid = (addr - offsetof(FlexcanRegs, mbs)) /
1243
+ sizeof(s->regs.mbs[0]);
1244
uint32_t rv = s->regs_raw[addr >> 2];
1245
1244
- if (addr >= offsetof(FlexcanRegs, mb) &&
1245
- addr < offsetof(FlexcanRegs, _reserved4)) {
1246
+ if (0 <= mbid && mbid < ARRAY_SIZE(s->regs.mbs)) {
1247
/* reading from mailbox */
1247
- hwaddr offset = addr - offsetof(FlexcanRegs, mb);
1248
- int mbid = offset / sizeof(FlexcanRegsMessageBuffer);
1249
-
1248
if (addr % 16 == 0 && s->locked_mbidx != mbid) {
1249
/* reading control word locks the mailbox */
1250
flexcan_mb_unlock(s);