diff --git a/asoc/msm-lsm-client.c b/asoc/msm-lsm-client.c
index 443f62e84d01..9b82d8c49a51 100644
--- a/asoc/msm-lsm-client.c
+++ b/asoc/msm-lsm-client.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/init.h>
 #include <linux/err.h>
@@ -879,6 +879,13 @@ static int msm_lsm_dereg_model(struct snd_pcm_substream *substream,
 
 	if (p_info->model_id != 0 &&
 		p_info->param_type == LSM_DEREG_MULTI_SND_MODEL) {
+
+		if(list_empty(&client->stage_cfg[p_info->stage_idx].sound_models)) {
+				 pr_err("%s: sound_models list is empty \n",
+                                 __func__);
+				 return -EINVAL;
+		}
+
 		list_for_each_entry(sm,
 				   &client->stage_cfg[p_info->stage_idx].sound_models,
 				   list) {
diff --git a/asoc/msm-pcm-q6-v2.c b/asoc/msm-pcm-q6-v2.c
index 2ef5e4c92158..ac78ef98229a 100644
--- a/asoc/msm-pcm-q6-v2.c
+++ b/asoc/msm-pcm-q6-v2.c
@@ -1329,7 +1329,7 @@ static int msm_pcm_capture_copy(struct snd_pcm_substream *substream,
 		offset = prtd->in_frame_info[idx].offset;
 		pr_debug("Offset value = %d\n", offset);
 
-		if (offset >= size) {
+		if (size && offset >= size) {
 			pr_err("%s: Invalid dsp buf offset\n", __func__);
 			ret = -EFAULT;
 			q6asm_cpu_buf_release(OUT, prtd->audio_client);
diff --git a/dsp/q6adm.c b/dsp/q6adm.c
index 32a5b29d3a1c..7455252e2f08 100644
--- a/dsp/q6adm.c
+++ b/dsp/q6adm.c
@@ -1713,16 +1713,11 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv)
 		if (data->opcode == APR_BASIC_RSP_RESULT) {
 			pr_debug("%s: APR_BASIC_RSP_RESULT id 0x%x\n",
 				__func__, payload[0]);
-
-			if (!((client_id != ADM_CLIENT_ID_SOURCE_TRACKING) &&
-			     ((payload[0] == ADM_CMD_SET_PP_PARAMS_V5) ||
-			      (payload[0] == ADM_CMD_SET_PP_PARAMS_V6)))) {
-				if (data->payload_size <
-						(2 * sizeof(uint32_t))) {
-					pr_err("%s: Invalid payload size %d\n",
-						__func__, data->payload_size);
-					return 0;
-				}
+			if (data->payload_size <
+					(2 * sizeof(uint32_t))) {
+				pr_err("%s: Invalid payload size %d\n",
+					__func__, data->payload_size);
+				return 0;
 			}
 
 			if (payload[1] != 0) {
diff --git a/dsp/q6asm.c b/dsp/q6asm.c
index 5ba45f3c775d..3016cf5ff05b 100644
--- a/dsp/q6asm.c
+++ b/dsp/q6asm.c
@@ -8843,6 +8843,8 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
 	}
 	mmap_regions = (struct avs_cmd_shared_mem_map_regions *)
 							mmap_region_cmd;
+
+	mutex_lock(&ac->cmd_lock);
 	q6asm_add_mmaphdr(ac, &mmap_regions->hdr, cmd_size, dir);
 	atomic_set(&ac->mem_state, -1);
 	pr_debug("%s: mmap_region=0x%pK token=0x%x\n", __func__,
@@ -8900,7 +8902,6 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
 		buffer_node = NULL;
 		goto fail_cmd;
 	}
-	mutex_lock(&ac->cmd_lock);
 
 	for (i = 0; i < bufcnt; i++) {
 		ab = &port->buf[i];
@@ -8913,9 +8914,9 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
 			buffer_node[i].mmap_hdl);
 	}
 	ac->port[dir].tmp_hdl = 0;
-	mutex_unlock(&ac->cmd_lock);
 	rc = 0;
 fail_cmd:
+	mutex_unlock(&ac->cmd_lock);
 	kfree(mmap_region_cmd);
 	mmap_region_cmd = NULL;
 	return rc;
diff --git a/dsp/q6lsm.c b/dsp/q6lsm.c
index e1aad637d8be..175c8fcb1a7e 100644
--- a/dsp/q6lsm.c
+++ b/dsp/q6lsm.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2013-2021, Linux Foundation. All rights reserved.
- * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/fs.h>
 #include <linux/mutex.h>
@@ -2130,6 +2130,12 @@ static int q6lsm_mmapcallback(struct apr_client_data *data, void *priv)
 		return 0;
 	}
 
+	if (data->payload_size < (2 * sizeof(uint32_t))) {
+		pr_err("%s: payload has invalid size[%d]\n", __func__,
+			data->payload_size);
+		return -EINVAL;
+	}
+
 	command = payload[0];
 	retcode = payload[1];
 	sid = (data->token >> 8) & 0x0F;
@@ -2454,6 +2460,12 @@ int q6lsm_set_one_param(struct lsm_client *client,
 				       sizeof(struct param_hdr_v2);
 
 		if (param_type == LSM_REG_MULTI_SND_MODEL) {
+			if(list_empty(&client->stage_cfg[p_info->stage_idx].sound_models)) {
+				 pr_err("%s: sound_models list is empty \n",
+                                 __func__);
+				 return -EINVAL;
+			}
+
 			list_for_each_entry(sm,
 					    &client->stage_cfg[p_info->stage_idx].sound_models,
 					    list) {