diff --git a/asoc/codecs/wcd934x/wcd934x.c b/asoc/codecs/wcd934x/wcd934x.c
index bd98a054572c..baaa769bb1a9 100644
--- a/asoc/codecs/wcd934x/wcd934x.c
+++ b/asoc/codecs/wcd934x/wcd934x.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2015-2020, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/module.h>
 #include <linux/init.h>
@@ -153,6 +153,8 @@ static const struct snd_kcontrol_new name##_mux = \
 
 #define WCD934X_DIG_CORE_COLLAPSE_TIMER_MS  (5 * 1000)
 
+#define ENABLE_FIFO_OVERRUN_AUTO_RECOVERY_BIT	0x1
+
 enum {
 	POWER_COLLAPSE,
 	POWER_RESUME,
@@ -1561,6 +1563,14 @@ static void tavil_codec_enable_slim_port_intr(
 				val = wcd9xxx_interface_reg_read(
 					tavil_p->wcd9xxx, reg);
 			}
+			/* Enable auto recovery from slim port overflow on port_num */
+			reg = WCD934X_SLIM_PGD_PORT_TX_OR_UR_CFG_0 + port_num;
+			val = wcd9xxx_interface_reg_read(tavil_p->wcd9xxx, reg);
+			if(!(val & (1 << ENABLE_FIFO_OVERRUN_AUTO_RECOVERY_BIT))) {
+				val = val | (1 << ENABLE_FIFO_OVERRUN_AUTO_RECOVERY_BIT);
+				wcd9xxx_interface_reg_write(tavil_p->wcd9xxx, reg, val);
+				val = wcd9xxx_interface_reg_read(tavil_p->wcd9xxx, reg);
+			}
 		}
 	}
 }
@@ -10018,6 +10028,15 @@ static irqreturn_t tavil_slimbus_irq(int irq, void *data)
 			WARN(!cleared,
 			     "Couldn't find slimbus %s port %d for closing\n",
 			     (tx ? "TX" : "RX"), port_id);
+
+			/* Enable auto recovery from slim port overflow on port_num */
+			reg = WCD934X_SLIM_PGD_PORT_TX_OR_UR_CFG_0 + port_id;
+			val = wcd9xxx_interface_reg_read(tavil->wcd9xxx, reg);
+			if((val & (1 << ENABLE_FIFO_OVERRUN_AUTO_RECOVERY_BIT))) {
+				val = val ^ (1 << ENABLE_FIFO_OVERRUN_AUTO_RECOVERY_BIT);
+				wcd9xxx_interface_reg_write(tavil->wcd9xxx, reg, val);
+				val = wcd9xxx_interface_reg_read(tavil->wcd9xxx, reg);
+			}
 		}
 		wcd9xxx_interface_reg_write(tavil->wcd9xxx,
 					    WCD934X_SLIM_PGD_PORT_INT_CLR_RX_0 +
diff --git a/asoc/msm-lsm-client.c b/asoc/msm-lsm-client.c
index 9b82d8c49a51..bd9b73571263 100644
--- a/asoc/msm-lsm-client.c
+++ b/asoc/msm-lsm-client.c
@@ -830,6 +830,13 @@ static int msm_lsm_reg_model(struct snd_pcm_substream *substream,
 
 		q6lsm_sm_set_param_data(client, p_info, &offset, sm);
 
+		if ((sm->size - offset) < p_info->param_size) {
+			dev_err(rtd->dev, "%s: user buff size is greater than expected\n",
+				__func__);
+			rc = -EINVAL;
+			goto err_copy;
+		}
+
 		/*
 		 * For set_param, advance the sound model data with the
 		 * number of bytes required by param_data.
diff --git a/asoc/qcs405.c b/asoc/qcs405.c
index 8b012c6c7ccd..0cdc7268a9d7 100644
--- a/asoc/qcs405.c
+++ b/asoc/qcs405.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022,2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/clk.h>
 #include <linux/delay.h>
@@ -7376,7 +7376,7 @@ static void msm_meta_mi2s_snd_shutdown(struct snd_pcm_substream *substream)
 
 	pr_debug("%s(): substream = %s  stream = %d\n", __func__,
 		 substream->name, substream->stream);
-	if (index < PRIM_MI2S || index >= MI2S_MAX) {
+	if (index < PRIM_MI2S || index >= META_MI2S_MAX) {
 		pr_err("%s:invalid MI2S DAI(%d)\n", __func__, index);
 		return;
 	}
diff --git a/dsp/q6voice.c b/dsp/q6voice.c
index 23bc780a6932..03e27b3978a2 100644
--- a/dsp/q6voice.c
+++ b/dsp/q6voice.c
@@ -3322,6 +3322,13 @@ static int voice_send_cvp_register_cal_cmd(struct voice_data *v)
 		 voc_get_session_name(v->session_id), v->dev_tx.dev_id,
 		 v->dev_rx.dev_id);
 
+	if (col_data->cal_data.size >= MAX_COL_INFO_SIZE) {
+		pr_err("%s: Invalid cal data size %d!\n",
+			__func__, col_data->cal_data.size);
+		ret = -EINVAL;
+		goto unlock;
+	}
+
 	memcpy(&cvp_reg_cal_cmd.cvp_cal_data.column_info[0],
 	       (void *) &((struct audio_cal_info_voc_col *)
 	       col_data->cal_info)->data,
@@ -3519,6 +3526,13 @@ static int voice_send_cvp_register_vol_cal_cmd(struct voice_data *v)
 		goto unlock;
 	}
 
+	if (col_data->cal_data.size >= MAX_COL_INFO_SIZE) {
+		pr_err("%s: Invalid cal data size %d!\n",
+			__func__, col_data->cal_data.size);
+		ret = -EINVAL;
+		goto unlock;
+	}
+
 	memcpy(&cvp_reg_vol_cal_cmd.cvp_vol_cal_data.column_info[0],
 	       (void *) &((struct audio_cal_info_voc_col *)
 	       col_data->cal_info)->data,
diff --git a/include/asoc/wcd934x_registers.h b/include/asoc/wcd934x_registers.h
index e529f6415650..eb32595e7e0b 100644
--- a/include/asoc/wcd934x_registers.h
+++ b/include/asoc/wcd934x_registers.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
  * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef _WCD934X_REGISTERS_H
@@ -1836,5 +1837,6 @@ enum {
 #define WCD934X_SLIM_PGD_PORT_INT_CLR_TX_1                   (0x3B)
 #define WCD934X_SLIM_PGD_PORT_INT_RX_SOURCE0                 (0x60)
 #define WCD934X_SLIM_PGD_PORT_INT_TX_SOURCE0                 (0x70)
+#define WCD934X_SLIM_PGD_PORT_TX_OR_UR_CFG_0                 (0x1F0)
 
 #endif