When there are 16 or more logical CPUs, we request for `IWL_MAX_RX_HW_QUEUES` (16) IRQs only, but later on create `num_irqs+1` RX queues, which could end up more than `IWL_MAX_RX_HW_QUEUES` if the OS does return us 16 IRQs. This wreaks lots of havoc elsewhere later on due to code that uses `num_rx_queues` to calculate array sizes. Limit to IWL_MAX_RX_HW_QUEUES - 1 IRQs so num_rx_queues is never more than IWL_MAX_RX_HW_QUEUES. --- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c index 6e9a9ecfb11c..f5c12924c836 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c @@ -1607,7 +1607,7 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev, goto enable_msi; nr_online_cpus = num_online_cpus(); - max_irqs = min_t(u32, nr_online_cpus + 2, IWL_MAX_RX_HW_QUEUES); + max_irqs = min_t(u32, nr_online_cpus + 2, IWL_MAX_RX_HW_QUEUES - 1); for (i = 0; i < max_irqs; i++) trans_pcie->msix_entries[i].entry = i; -- 2.17.0
