diff --git a/fs/io_uring.c b/fs/io_uring.c
index 8b6cdb913958931eab1c91c24755331342f3ddf4..bad0255f7d5dedd8670ae04758ac446c0e447414 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2454,10 +2454,11 @@ static int io_sq_offload_start(struct io_ring_ctx *ctx,
 			ctx->sq_thread_idle = HZ;
 
 		if (p->flags & IORING_SETUP_SQ_AFF) {
-			int cpu = array_index_nospec(p->sq_thread_cpu,
-							nr_cpu_ids);
+			int cpu = p->sq_thread_cpu;
 
 			ret = -EINVAL;
+			if (cpu >= nr_cpu_ids)
+				goto err;
 			if (!cpu_online(cpu))
 				goto err;