diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
index 94d12a3d7..2c2850c63 100644
--- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
+++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c
@@ -2408,6 +2408,7 @@ static int gk20a_channel_wait(struct channel_gk20a *ch,
 	u32 offset;
 	unsigned long timeout;
 	int remain, ret = 0;
+	u64 end;
 
 	gk20a_dbg_fn("");
 
@@ -2423,6 +2424,7 @@ static int gk20a_channel_wait(struct channel_gk20a *ch,
 	case NVGPU_WAIT_TYPE_NOTIFIER:
 		id = args->condition.notifier.dmabuf_fd;
 		offset = args->condition.notifier.offset;
+		end = offset + sizeof(struct notification);
 
 		dmabuf = dma_buf_get(id);
 		if (IS_ERR(dmabuf)) {
@@ -2431,6 +2433,12 @@ static int gk20a_channel_wait(struct channel_gk20a *ch,
 			return -EINVAL;
 		}
 
+		if (end > dmabuf->size || end < sizeof(struct notification)) {
+			dma_buf_put(dmabuf);
+			gk20a_err(d, "invalid notifier offset\n");
+			return -EINVAL;
+		}
+
 		notif = dma_buf_vmap(dmabuf);
 		if (!notif) {
 			gk20a_err(d, "failed to map notifier memory");