diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 7a44566..51ad74a 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -1021,7 +1021,7 @@ static int evergreen_cs_packet_parse(struct radeon_cs_parser *p,
 			      unsigned idx)
 {
 	struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx];
-	uint32_t header;
+	uint32_t header, i, npages;
 
 	if (idx >= ib_chunk->length_dw) {
 		DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
@@ -1052,6 +1052,11 @@ static int evergreen_cs_packet_parse(struct radeon_cs_parser *p,
 			  pkt->idx, pkt->type, pkt->count, ib_chunk->length_dw);
 		return -EINVAL;
 	}
+	/* make sure we copied packet fully from userspace */
+	npages = ((idx + pkt->count + 1) >> 10) - (idx >> 10);
+	for (i = 1; i <= npages; i++) {
+		radeon_get_ib_value(p, (idx & 0xfffffc00) + i * 0x400);
+	}
 	return 0;
 }
 
@@ -2909,12 +2914,16 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 				return -EINVAL;
 			}
 			if (tiled) {
+				/* make sure we copied packet fully from userspace */
+				radeon_get_ib_value(p, idx + 6);
 				dst_offset = ib[idx+1];
 				dst_offset <<= 8;
 
 				ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
 				p->idx += count + 7;
 			} else {
+				/* make sure we copied packet fully from userspace */
+				radeon_get_ib_value(p, idx + 2);
 				dst_offset = ib[idx+1];
 				dst_offset |= ((u64)(ib[idx+2] & 0xff)) << 32;
 
@@ -2945,6 +2954,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 					switch (misc) {
 					case 0:
 						/* L2T, frame to fields */
+						/* make sure we copied packet fully from userspace */
+						radeon_get_ib_value(p, idx + 9);
 						if (idx_value & (1 << 31)) {
 							DRM_ERROR("bad L2T, frame to fields DMA_PACKET_COPY\n");
 							return -EINVAL;
@@ -2983,6 +2994,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 						break;
 					case 1:
 						/* L2T, T2L partial */
+						/* make sure we copied packet fully from userspace */
+						radeon_get_ib_value(p, idx + 11);
 						if (p->family < CHIP_CAYMAN) {
 							DRM_ERROR("L2T, T2L Partial is cayman only !\n");
 							return -EINVAL;
@@ -3005,6 +3018,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 						break;
 					case 3:
 						/* L2T, broadcast */
+						/* make sure we copied packet fully from userspace */
+						radeon_get_ib_value(p, idx + 9);
 						if (idx_value & (1 << 31)) {
 							DRM_ERROR("bad L2T, broadcast DMA_PACKET_COPY\n");
 							return -EINVAL;
@@ -3043,6 +3058,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 						break;
 					case 4:
 						/* L2T, T2L */
+						/* make sure we copied packet fully from userspace */
+						radeon_get_ib_value(p, idx + 8);
 						/* detile bit */
 						if (idx_value & (1 << 31)) {
 							/* tiled src, linear dst */
@@ -3079,6 +3096,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 						break;
 					case 5:
 						/* T2T partial */
+						/* make sure we copied packet fully from userspace */
+						radeon_get_ib_value(p, idx + 12);
 						if (p->family < CHIP_CAYMAN) {
 							DRM_ERROR("L2T, T2L Partial is cayman only !\n");
 							return -EINVAL;
@@ -3089,6 +3108,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 						break;
 					case 7:
 						/* L2T, broadcast */
+						/* make sure we copied packet fully from userspace */
+						radeon_get_ib_value(p, idx + 9);
 						if (idx_value & (1 << 31)) {
 							DRM_ERROR("bad L2T, broadcast DMA_PACKET_COPY\n");
 							return -EINVAL;
@@ -3132,6 +3153,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 				} else {
 					switch (misc) {
 					case 0:
+						/* make sure we copied packet fully from userspace */
+						radeon_get_ib_value(p, idx + 8);
 						/* detile bit */
 						if (idx_value & (1 << 31)) {
 							/* tiled src, linear dst */
@@ -3176,6 +3199,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 					switch (misc) {
 					case 0:
 						/* L2L, byte */
+						/* make sure we copied packet fully from userspace */
+						radeon_get_ib_value(p, idx + 4);
 						src_offset = ib[idx+2];
 						src_offset |= ((u64)(ib[idx+4] & 0xff)) << 32;
 						dst_offset = ib[idx+1];
@@ -3198,6 +3223,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 						break;
 					case 1:
 						/* L2L, partial */
+						/* make sure we copied packet fully from userspace */
+						radeon_get_ib_value(p, idx + 8);
 						if (p->family < CHIP_CAYMAN) {
 							DRM_ERROR("L2L Partial is cayman only !\n");
 							return -EINVAL;
@@ -3211,6 +3238,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 						break;
 					case 4:
 						/* L2L, dw, broadcast */
+						/* make sure we copied packet fully from userspace */
+						radeon_get_ib_value(p, idx + 6);
 						r = r600_dma_cs_next_reloc(p, &dst2_reloc);
 						if (r) {
 							DRM_ERROR("bad L2L, dw, broadcast DMA_PACKET_COPY\n");
@@ -3251,6 +3280,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 					}
 				} else {
 					/* L2L, dw */
+					/* make sure we copied packet fully from userspace */
+					radeon_get_ib_value(p, idx + 4);
 					src_offset = ib[idx+2];
 					src_offset |= ((u64)(ib[idx+4] & 0xff)) << 32;
 					dst_offset = ib[idx+1];
@@ -3274,6 +3305,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
 			}
 			break;
 		case DMA_PACKET_CONSTANT_FILL:
+			/* make sure we copied packet fully from userspace */
+			radeon_get_ib_value(p, idx + 3);
 			r = r600_dma_cs_next_reloc(p, &dst_reloc);
 			if (r) {
 				DRM_ERROR("bad DMA_PACKET_CONSTANT_FILL\n");
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 69ec24a..d36f9e6 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -796,7 +796,7 @@ static int r600_cs_packet_parse(struct radeon_cs_parser *p,
 			unsigned idx)
 {
 	struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx];
-	uint32_t header;
+	uint32_t header, i, npages;
 
 	if (idx >= ib_chunk->length_dw) {
 		DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
@@ -827,6 +827,11 @@ static int r600_cs_packet_parse(struct radeon_cs_parser *p,
 			  pkt->idx, pkt->type, pkt->count, ib_chunk->length_dw);
 		return -EINVAL;
 	}
+	/* make sure we copied packet fully from userspace */
+	npages = ((idx + pkt->count + 1) >> 10) - (idx >> 10);
+	for (i = 1; i <= npages; i++) {
+		radeon_get_ib_value(p, (idx & 0xfffffc00) + i * 0x400);
+	}
 	return 0;
 }
 
@@ -2623,12 +2628,16 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
 				return -EINVAL;
 			}
 			if (tiled) {
+				/* make sure we copied packet fully from userspace */
+				radeon_get_ib_value(p, idx + 4);
 				dst_offset = ib[idx+1];
 				dst_offset <<= 8;
 
 				ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
 				p->idx += count + 5;
 			} else {
+				/* make sure we copied packet fully from userspace */
+				radeon_get_ib_value(p, idx + 2);
 				dst_offset = ib[idx+1];
 				dst_offset |= ((u64)(ib[idx+2] & 0xff)) << 32;
 
@@ -2654,6 +2663,8 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
 				return -EINVAL;
 			}
 			if (tiled) {
+				/* make sure we copied packet fully from userspace */
+				radeon_get_ib_value(p, idx + 6);
 				idx_value = radeon_get_ib_value(p, idx + 2);
 				/* detile bit */
 				if (idx_value & (1 << 31)) {
@@ -2680,6 +2691,8 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
 				p->idx += 7;
 			} else {
 				if (p->family >= CHIP_RV770) {
+					/* make sure we copied packet fully from userspace */
+					radeon_get_ib_value(p, idx + 4);
 					src_offset = ib[idx+2];
 					src_offset |= ((u64)(ib[idx+4] & 0xff)) << 32;
 					dst_offset = ib[idx+1];
@@ -2691,6 +2704,8 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
 					ib[idx+4] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
 					p->idx += 5;
 				} else {
+					/* make sure we copied packet fully from userspace */
+					radeon_get_ib_value(p, idx + 3);
 					src_offset = ib[idx+2];
 					src_offset |= ((u64)(ib[idx+3] & 0xff)) << 32;
 					dst_offset = ib[idx+1];
@@ -2715,6 +2730,8 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
 			}
 			break;
 		case DMA_PACKET_CONSTANT_FILL:
+			/* make sure we copied packet fully from userspace */
+			radeon_get_ib_value(p, idx + 3);
 			if (p->family < CHIP_RV770) {
 				DRM_ERROR("Constant Fill is 7xx only !\n");
 				return -EINVAL;
