hw/net/can/flexcan: Fix mailbox index calculation in flexcan_mem_write()
Calculate mailbox indices from the `mbs[]` array layout instead of the oversized raw `mb[]` view. This prevents accessing mailbox entries beyond the valid array range and fixes Coverity CID 1662974. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20260723070059.6332-5-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow committed
Jul 27, 2026 at 10:28 UTC
9981b70ce799f24db94ccca2175217ecb3936a53
1 file changed
+3
-4
hw/net/can/flexcan.c
+3
-4
@@ -1151,6 +1151,8 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
1151
unsigned size)
1152
{
1153
FlexcanState *s = opaque;
1154
+ const int mbid = (addr - offsetof(FlexcanRegs, mbs)) /
1155
+ sizeof(s->regs.mbs[0]);
1156
uint32_t write_mask = ((const uint32_t *)
1157
&flexcan_regs_write_mask)[addr / 4];
1158
uint32_t old_value = s->regs_raw[addr / 4];
@@ -1208,11 +1210,8 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val,
1210
default:
1211
s->regs_raw[addr / 4] = (val & write_mask) | (old_value & ~write_mask);
1212
1211
- if (addr >= offsetof(FlexcanRegs, mb) &&
1212
- addr < offsetof(FlexcanRegs, _reserved4)) {
1213
+ if (0 <= mbid && mbid < ARRAY_SIZE(s->regs.mbs)) {
1214
/* access to mailbox */
1214
- int mbid = (addr - offsetof(FlexcanRegs, mb)) /
1215
- sizeof(FlexcanRegsMessageBuffer);
1215
1216
if (s->locked_mbidx == mbid) {
1217
flexcan_mb_unlock(s);