@@ -1139,6 +1139,24 @@ static inline bool io_is_timeout_noseq(struct io_kiocb *req)
 	return !req->timeout.off;
 }
 
+static long io_get_cqring_size(struct io_uring_params *p, unsigned entries)
+{
+	/*
+	 * If IORING_SETUP_CQSIZE is set, we do the same roundup
+	 * to a power-of-two, if it isn't already. We do NOT impose
+	 * any cq vs sq ring sizing.
+	 */
+	if (!entries)
+		return -EINVAL;
+	if (entries > IORING_MAX_CQ_ENTRIES) {
+		if (!(p->flags & IORING_SETUP_CLAMP))
+			return -EINVAL;
+		entries = IORING_MAX_CQ_ENTRIES;
+	}
+	entries = roundup_pow_of_two(entries);
+	return entries;
+}
+
 static struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p)
 {
 	struct io_ring_ctx *ctx;

@@ -9625,21 +9643,13 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p,
 	 */
 	p->sq_entries = roundup_pow_of_two(entries);
 	if (p->flags & IORING_SETUP_CQSIZE) {
-		/*
-		 * If IORING_SETUP_CQSIZE is set, we do the same roundup
-		 * to a power-of-two, if it isn't already. We do NOT impose
-		 * any cq vs sq ring sizing.
-		 */
-		if (!p->cq_entries)
-			return -EINVAL;
-		if (p->cq_entries > IORING_MAX_CQ_ENTRIES) {
-			if (!(p->flags & IORING_SETUP_CLAMP))
-				return -EINVAL;
-			p->cq_entries = IORING_MAX_CQ_ENTRIES;
-		}
-		p->cq_entries = roundup_pow_of_two(p->cq_entries);
-		if (p->cq_entries < p->sq_entries)
+		long cq_entries = io_get_cqring_size(p, p->cq_entries);
+
+		if (cq_entries < 0)
+			return cq_entries;
+		if (cq_entries < p->sq_entries)
 			return -EINVAL;
+		p->cq_entries = cq_entries;
 	} else {
 		p->cq_entries = 2 * p->sq_entries;
 	}