hw/net/can/flexcan: Use mbs[] array for FIFO pop
Implement FIFO entry shifting using the underlying `mbs[]` array instead of the overlapping `fifo` union view. This makes it explicit that the operation copies within a contiguous mailbox array and avoids Coverity CID 1662971. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Message-id: 20260723070059.6332-2-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow committed
Jul 27, 2026 at 10:28 UTC
c4e23476936a96404f92a4b46cb3a7d8ad7dee4f
1 file changed
+5
-5
hw/net/can/flexcan.c
+5
-5
@@ -879,22 +879,22 @@ static bool flexcan_can_receive(CanBusClientState *client)
879
*/
880
static void flexcan_fifo_pop(FlexcanState *s)
881
{
882
- if (s->regs.fifo.mb_back.can_ctrl != 0) {
882
+ if (s->regs.mbs[0].can_ctrl != 0) {
883
/* move queue elements forward */
884
- memmove(&s->regs.fifo.mb_back, &s->regs.fifo.mbs_queue[0],
885
- sizeof(s->regs.fifo.mbs_queue));
884
+ memmove(&s->regs.mbs[0], &s->regs.mbs[1],
885
+ sizeof(s->regs.mbs[0]) * (FLEXCAN_FIFO_DEPTH - 1));
886
887
/* clear the first-in slot */
888
memset(&s->regs.mbs[FLEXCAN_FIFO_DEPTH - 1], 0,
889
sizeof(FlexcanRegsMessageBuffer));
890
891
trace_flexcan_fifo_pop(DEVICE(s)->canonical_path, 1,
892
- s->regs.fifo.mb_back.can_ctrl != 0);
892
+ s->regs.mbs[0].can_ctrl != 0);
893
} else {
894
trace_flexcan_fifo_pop(DEVICE(s)->canonical_path, 0, 0);
895
}
896
897
- if (s->regs.fifo.mb_back.can_ctrl != 0) {
897
+ if (s->regs.mbs[0].can_ctrl != 0) {
898
flexcan_irq_iflag_set(s, I_FIFO_AVAILABLE);
899
} else {
900
flexcan_irq_iflag_clear(s, I_FIFO_AVAILABLE);