diff --git a/sys/dev/drm/radeon/radeon_cs.c b/sys/dev/drm/radeon/radeon_cs.c
--- a/sys/dev/drm/radeon/radeon_cs.c
+++ b/sys/dev/drm/radeon/radeon_cs.c
@@ -638,6 +638,11 @@
 	}
 	ib_chunk = parser->chunk_ib;
 
+	if (!(parser->cs_flags & RADEON_CS_USE_VM) &&
+	    ib_chunk->length_dw > RADEON_IB_VM_MAX_SIZE) {
+		DRM_ERROR("cs IB too big (no VM): %d\n", ib_chunk->length_dw);
+		return -EINVAL;
+	}
 	r =  radeon_ib_get(rdev, parser->ring, &parser->ib,
 			   vm, ib_chunk->length_dw * 4);
 	if (r) {