diff --git a/sys/dev/drm/amd/amdgpu/amdgpu_cs.c b/sys/dev/drm/amd/amdgpu/amdgpu_cs.c
--- a/sys/dev/drm/amd/amdgpu/amdgpu_cs.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_cs.c
@@ -180,6 +180,11 @@
 
 		switch (p->chunks[i].chunk_id) {
 		case AMDGPU_CHUNK_ID_IB:
+			if (p->chunks[i].length_dw * sizeof(uint32_t) <
+			    sizeof(struct drm_amdgpu_cs_chunk_ib)) {
+				ret = -EINVAL;
+				goto free_partial_kdata;
+			}
 			++num_ibs;
 			break;