ASoC: msm: audio-effects: fix stack overread and heap overwrite

Fix overwrite of updt_params allocated in heap, and stack overread
where param pointer is passed from user space.

Bug: 27555224
Change-Id: Ida8bdb7da2fcb97023dce3b6eafe4b899a51cb66
Signed-off-by: Ravi Kumar Alamanda <arkumar@codeaurora.org>
diff --git a/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c
index 2fc4949..173582e 100644
--- a/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -16,19 +16,38 @@
 #include <sound/compress_params.h>
 #include "msm-audio-effects-q6-v2.h"
 
+#define GET_NEXT(ptr, upper_limit, rc)                                  \
+({                                                                      \
+	if (((ptr) + 1) > (upper_limit)) {                              \
+		pr_err("%s: param list out of boundary\n", __func__);   \
+		(rc) = -EINVAL;                                         \
+	}                                                               \
+	((rc) == 0) ? *(ptr)++ :  -EINVAL;                              \
+})
+
+#define CHECK_PARAM_LEN(len, max_len, tag, rc)                          \
+do {                                                                    \
+	if ((len) > (max_len)) {                                        \
+		pr_err("%s: params length overflows\n", (tag));         \
+		(rc) = -EINVAL;                                         \
+	}                                                               \
+} while (0)
+
+
 int msm_audio_effects_virtualizer_handler(struct audio_client *ac,
 				struct virtualizer_params *virtualizer,
 				long *values)
 {
-	int devices = *values++;
-	int num_commands = *values++;
-	char *params;
+	long *param_max_offset = values + MAX_PP_PARAMS_SZ - 1;
+	char *params = NULL;
+	int rc = 0;
+	int devices = GET_NEXT(values, param_max_offset, rc);
+	int num_commands = GET_NEXT(values, param_max_offset, rc);
 	int *updt_params, i, prev_enable_flag;
 	uint32_t params_length = (MAX_INBAND_PARAM_SZ);
-	int rc = 0;
 
 	pr_debug("%s\n", __func__);
-	if (!ac) {
+	if (!ac || (devices == -EINVAL) || (num_commands == -EINVAL)) {
 		pr_err("%s: cannot set audio effects\n", __func__);
 		return -EINVAL;
 	}
@@ -41,83 +60,126 @@
 	updt_params = (int *)params;
 	params_length = 0;
 	for (i = 0; i < num_commands; i++) {
-		uint32_t command_id = *values++;
-		uint32_t command_config_state = *values++;
-		uint32_t index_offset = *values++;
-		uint32_t length = *values++;
+		uint32_t command_id =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t command_config_state =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t index_offset =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t length =
+			GET_NEXT(values, param_max_offset, rc);
 		switch (command_id) {
 		case VIRTUALIZER_ENABLE:
-			pr_debug("%s: VIRTUALIZER_ENABLE\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("VIRT ENABLE:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
 			prev_enable_flag = virtualizer->enable_flag;
-			virtualizer->enable_flag = *values++;
+			virtualizer->enable_flag =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s:VIRT ENABLE prev:%d, new:%d\n", __func__,
+				prev_enable_flag, virtualizer->enable_flag);
 			if (prev_enable_flag != virtualizer->enable_flag) {
-				*updt_params++ = AUDPROC_MODULE_ID_VIRTUALIZER;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_VIRTUALIZER_ENABLE;
-				*updt_params++ = VIRTUALIZER_ENABLE_PARAM_SZ;
-				*updt_params++ = virtualizer->enable_flag;
 				params_length += COMMAND_PAYLOAD_SZ +
 					VIRTUALIZER_ENABLE_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"VIRT ENABLE", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+				AUDPROC_MODULE_ID_VIRTUALIZER;
+				*updt_params++ =
+				AUDPROC_PARAM_ID_VIRTUALIZER_ENABLE;
+				*updt_params++ =
+				VIRTUALIZER_ENABLE_PARAM_SZ;
+				*updt_params++ =
+				virtualizer->enable_flag;
 			}
 			break;
 		case VIRTUALIZER_STRENGTH:
-			pr_debug("%s: VIRTUALIZER_STRENGTH\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("VIRT STRENGTH:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			virtualizer->strength = *values++;
+			virtualizer->strength =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: VIRT STRENGTH val: %d\n",
+					__func__, virtualizer->strength);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_VIRTUALIZER;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_VIRTUALIZER_STRENGTH;
-				*updt_params++ = VIRTUALIZER_STRENGTH_PARAM_SZ;
-				*updt_params++ = virtualizer->strength;
 				params_length += COMMAND_PAYLOAD_SZ +
 					VIRTUALIZER_STRENGTH_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"VIRT STRENGTH", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_VIRTUALIZER;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_VIRTUALIZER_STRENGTH;
+				*updt_params++ =
+					VIRTUALIZER_STRENGTH_PARAM_SZ;
+				*updt_params++ =
+					virtualizer->strength;
 			}
 			break;
 		case VIRTUALIZER_OUT_TYPE:
-			pr_debug("%s: VIRTUALIZER_OUT_TYPE\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("VIRT OUT_TYPE:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			virtualizer->out_type = *values++;
+			virtualizer->out_type =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: VIRT OUT_TYPE val:%d\n",
+				__func__, virtualizer->out_type);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_VIRTUALIZER;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_VIRTUALIZER_OUT_TYPE;
-				*updt_params++ = VIRTUALIZER_OUT_TYPE_PARAM_SZ;
-				*updt_params++ = virtualizer->out_type;
 				params_length += COMMAND_PAYLOAD_SZ +
 					VIRTUALIZER_OUT_TYPE_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"VIRT OUT_TYPE", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_VIRTUALIZER;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_VIRTUALIZER_OUT_TYPE;
+				*updt_params++ =
+					VIRTUALIZER_OUT_TYPE_PARAM_SZ;
+				*updt_params++ =
+					virtualizer->out_type;
 			}
 			break;
 		case VIRTUALIZER_GAIN_ADJUST:
-			pr_debug("%s: VIRTUALIZER_GAIN_ADJUST\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("VIRT GAIN_ADJUST: invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			virtualizer->gain_adjust = *values++;
+			virtualizer->gain_adjust =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: VIRT GAIN_ADJUST val:%d\n",
+				__func__, virtualizer->gain_adjust);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_VIRTUALIZER;
-				*updt_params++ =
-				       AUDPROC_PARAM_ID_VIRTUALIZER_GAIN_ADJUST;
-				*updt_params++ =
-					VIRTUALIZER_GAIN_ADJUST_PARAM_SZ;
-				*updt_params++ = virtualizer->gain_adjust;
 				params_length += COMMAND_PAYLOAD_SZ +
 					VIRTUALIZER_GAIN_ADJUST_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"VIRT GAIN_ADJUST", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+				AUDPROC_MODULE_ID_VIRTUALIZER;
+				*updt_params++ =
+				AUDPROC_PARAM_ID_VIRTUALIZER_GAIN_ADJUST;
+				*updt_params++ =
+				VIRTUALIZER_GAIN_ADJUST_PARAM_SZ;
+				*updt_params++ =
+				virtualizer->gain_adjust;
 			}
 			break;
 		default:
@@ -125,9 +187,11 @@
 			break;
 		}
 	}
-	if (params_length)
+	if (params_length && (rc == 0))
 		q6asm_send_audio_effects_params(ac, params,
 						params_length);
+	else
+		pr_debug("%s: did not send pp params\n", __func__);
 invalid_config:
 	kfree(params);
 	return rc;
@@ -137,15 +201,16 @@
 				     struct reverb_params *reverb,
 				     long *values)
 {
-	int devices = *values++;
-	int num_commands = *values++;
-	char *params;
+	long *param_max_offset = values + MAX_PP_PARAMS_SZ - 1;
+	char *params = NULL;
+	int rc = 0;
+	int devices = GET_NEXT(values, param_max_offset, rc);
+	int num_commands = GET_NEXT(values, param_max_offset, rc);
 	int *updt_params, i, prev_enable_flag;
 	uint32_t params_length = (MAX_INBAND_PARAM_SZ);
-	int rc = 0;
 
 	pr_debug("%s\n", __func__);
-	if (!ac) {
+	if (!ac || (devices == -EINVAL) || (num_commands == -EINVAL)) {
 		pr_err("%s: cannot set audio effects\n", __func__);
 		return -EINVAL;
 	}
@@ -158,277 +223,434 @@
 	updt_params = (int *)params;
 	params_length = 0;
 	for (i = 0; i < num_commands; i++) {
-		uint32_t command_id = *values++;
-		uint32_t command_config_state = *values++;
-		uint32_t index_offset = *values++;
-		uint32_t length = *values++;
+		uint32_t command_id =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t command_config_state =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t index_offset =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t length =
+			GET_NEXT(values, param_max_offset, rc);
 		switch (command_id) {
 		case REVERB_ENABLE:
-			pr_debug("%s: REVERB_ENABLE\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_ENABLE:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
 			prev_enable_flag = reverb->enable_flag;
-			reverb->enable_flag = *values++;
+			reverb->enable_flag =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s:REVERB_ENABLE prev:%d,new:%d\n", __func__,
+					prev_enable_flag, reverb->enable_flag);
 			if (prev_enable_flag != reverb->enable_flag) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ = AUDPROC_PARAM_ID_REVERB_ENABLE;
-				*updt_params++ = REVERB_ENABLE_PARAM_SZ;
-				*updt_params++ = reverb->enable_flag;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_ENABLE_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_ENABLE", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_ENABLE;
+				*updt_params++ =
+					REVERB_ENABLE_PARAM_SZ;
+				*updt_params++ =
+					reverb->enable_flag;
 			}
 			break;
 		case REVERB_MODE:
-			pr_debug("%s: REVERB_MODE\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_MODE:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->mode = *values++;
+			reverb->mode =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_MODE val:%d\n",
+				__func__, reverb->mode);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ = AUDPROC_PARAM_ID_REVERB_MODE;
-				*updt_params++ = REVERB_MODE_PARAM_SZ;
-				*updt_params++ = reverb->mode;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_MODE_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_MODE", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_MODE;
+				*updt_params++ =
+					REVERB_MODE_PARAM_SZ;
+				*updt_params++ =
+					reverb->mode;
 			}
 			break;
 		case REVERB_PRESET:
-			pr_debug("%s: REVERB_PRESET\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_PRESET:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->preset = *values++;
+			reverb->preset =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_PRESET val:%d\n",
+					__func__, reverb->preset);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ = AUDPROC_PARAM_ID_REVERB_PRESET;
-				*updt_params++ = REVERB_PRESET_PARAM_SZ;
-				*updt_params++ = reverb->preset;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_PRESET_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_PRESET", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_PRESET;
+				*updt_params++ =
+					REVERB_PRESET_PARAM_SZ;
+				*updt_params++ =
+					reverb->preset;
 			}
 			break;
 		case REVERB_WET_MIX:
-			pr_debug("%s: REVERB_WET_MIX\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_WET_MIX:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->wet_mix = *values++;
+			reverb->wet_mix =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_WET_MIX val:%d\n",
+				__func__, reverb->wet_mix);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_REVERB_WET_MIX;
-				*updt_params++ = REVERB_WET_MIX_PARAM_SZ;
-				*updt_params++ = reverb->wet_mix;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_WET_MIX_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_WET_MIX", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_WET_MIX;
+				*updt_params++ =
+					REVERB_WET_MIX_PARAM_SZ;
+				*updt_params++ =
+					reverb->wet_mix;
 			}
 			break;
 		case REVERB_GAIN_ADJUST:
-			pr_debug("%s: REVERB_GAIN_ADJUST\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_GAIN_ADJUST:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->gain_adjust = *values++;
+			reverb->gain_adjust =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_GAIN_ADJUST val:%d\n",
+					__func__, reverb->gain_adjust);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_REVERB_GAIN_ADJUST;
-				*updt_params++ = REVERB_GAIN_ADJUST_PARAM_SZ;
-				*updt_params++ = reverb->gain_adjust;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_GAIN_ADJUST_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_GAIN_ADJUST", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_GAIN_ADJUST;
+				*updt_params++ =
+					REVERB_GAIN_ADJUST_PARAM_SZ;
+				*updt_params++ =
+					reverb->gain_adjust;
 			}
 			break;
 		case REVERB_ROOM_LEVEL:
-			pr_debug("%s: REVERB_ROOM_LEVEL\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_ROOM_LEVEL:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->room_level = *values++;
+			reverb->room_level =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_ROOM_LEVEL val:%d\n",
+				__func__, reverb->room_level);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_REVERB_ROOM_LEVEL;
-				*updt_params++ = REVERB_ROOM_LEVEL_PARAM_SZ;
-				*updt_params++ = reverb->room_level;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_ROOM_LEVEL_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_ROOM_LEVEL", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_ROOM_LEVEL;
+				*updt_params++ =
+					REVERB_ROOM_LEVEL_PARAM_SZ;
+				*updt_params++ =
+					reverb->room_level;
 			}
 			break;
 		case REVERB_ROOM_HF_LEVEL:
-			pr_debug("%s: REVERB_ROOM_HF_LEVEL\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_ROOM_HF_LEVEL:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->room_hf_level = *values++;
+			reverb->room_hf_level =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_ROOM_HF_LEVEL val%d\n",
+				__func__, reverb->room_hf_level);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_REVERB_ROOM_HF_LEVEL;
-				*updt_params++ = REVERB_ROOM_HF_LEVEL_PARAM_SZ;
-				*updt_params++ = reverb->room_hf_level;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_ROOM_HF_LEVEL_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_ROOM_HF_LEVEL", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_ROOM_HF_LEVEL;
+				*updt_params++ =
+					REVERB_ROOM_HF_LEVEL_PARAM_SZ;
+				*updt_params++ =
+					reverb->room_hf_level;
 			}
 			break;
 		case REVERB_DECAY_TIME:
-			pr_debug("%s: REVERB_DECAY_TIME\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_DECAY_TIME:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->decay_time = *values++;
+			reverb->decay_time =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_DECAY_TIME val:%d\n",
+				__func__, reverb->decay_time);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_REVERB_DECAY_TIME;
-				*updt_params++ = REVERB_DECAY_TIME_PARAM_SZ;
-				*updt_params++ = reverb->decay_time;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_DECAY_TIME_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_DECAY_TIME", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_DECAY_TIME;
+				*updt_params++ =
+					REVERB_DECAY_TIME_PARAM_SZ;
+				*updt_params++ =
+					reverb->decay_time;
 			}
 			break;
 		case REVERB_DECAY_HF_RATIO:
-			pr_debug("%s: REVERB_DECAY_HF_RATIO\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_DECAY_HF_RATIOinvalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->decay_hf_ratio = *values++;
+			reverb->decay_hf_ratio =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_DECAY_HF_RATIO val%d\n",
+				__func__, reverb->decay_hf_ratio);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_REVERB_DECAY_HF_RATIO;
-				*updt_params++ = REVERB_DECAY_HF_RATIO_PARAM_SZ;
-				*updt_params++ = reverb->decay_hf_ratio;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_DECAY_HF_RATIO_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_DECAY_HF_RATIO", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_DECAY_HF_RATIO;
+				*updt_params++ =
+					REVERB_DECAY_HF_RATIO_PARAM_SZ;
+				*updt_params++ =
+					reverb->decay_hf_ratio;
 			}
 			break;
 		case REVERB_REFLECTIONS_LEVEL:
-			pr_debug("%s: REVERB_REFLECTIONS_LEVEL\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_REFLECTION_LVLinvalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->reflections_level = *values++;
+			reverb->reflections_level =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_REFLECTIONS_LEVEL val:%d\n",
+				__func__, reverb->reflections_level);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ =
-				      AUDPROC_PARAM_ID_REVERB_REFLECTIONS_LEVEL;
-				*updt_params++ =
-					REVERB_REFLECTIONS_LEVEL_PARAM_SZ;
-				*updt_params++ = reverb->reflections_level;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_REFLECTIONS_LEVEL_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_REFLECTIONS_LEVEL", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+				AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+				AUDPROC_PARAM_ID_REVERB_REFLECTIONS_LEVEL;
+				*updt_params++ =
+				REVERB_REFLECTIONS_LEVEL_PARAM_SZ;
+				*updt_params++ =
+				reverb->reflections_level;
 			}
 			break;
 		case REVERB_REFLECTIONS_DELAY:
-			pr_debug("%s: REVERB_REFLECTIONS_DELAY\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_REFLECTION_DLYinvalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->reflections_delay = *values++;
+			reverb->reflections_delay =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_REFLECTIONS_DELAY val:%d\n",
+				__func__, reverb->reflections_delay);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ =
-				      AUDPROC_PARAM_ID_REVERB_REFLECTIONS_DELAY;
-				*updt_params++ =
-					REVERB_REFLECTIONS_DELAY_PARAM_SZ;
-				*updt_params++ = reverb->reflections_delay;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_REFLECTIONS_DELAY_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_REFLECTIONS_DELAY", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+				AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+				AUDPROC_PARAM_ID_REVERB_REFLECTIONS_DELAY;
+				*updt_params++ =
+				REVERB_REFLECTIONS_DELAY_PARAM_SZ;
+				*updt_params++ =
+				reverb->reflections_delay;
 			}
 			break;
 		case REVERB_LEVEL:
-			pr_debug("%s: REVERB_LEVEL\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_LEVEL:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->level = *values++;
+			reverb->level =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_LEVEL val:%d\n",
+				__func__, reverb->level);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ = AUDPROC_PARAM_ID_REVERB_LEVEL;
-				*updt_params++ = REVERB_LEVEL_PARAM_SZ;
-				*updt_params++ = reverb->level;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_LEVEL_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_LEVEL", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_LEVEL;
+				*updt_params++ =
+					REVERB_LEVEL_PARAM_SZ;
+				*updt_params++ =
+					reverb->level;
 			}
 			break;
 		case REVERB_DELAY:
-			pr_debug("%s: REVERB_DELAY\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_DELAY:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->delay = *values++;
+			reverb->delay =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s:REVERB_DELAY val:%d\n",
+					__func__, reverb->delay);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ = AUDPROC_PARAM_ID_REVERB_DELAY;
-				*updt_params++ = REVERB_DELAY_PARAM_SZ;
-				*updt_params++ = reverb->delay;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_DELAY_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_DELAY", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_DELAY;
+				*updt_params++ =
+					REVERB_DELAY_PARAM_SZ;
+				*updt_params++ =
+					reverb->delay;
 			}
 			break;
 		case REVERB_DIFFUSION:
-			pr_debug("%s: REVERB_DIFFUSION\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_DIFFUSION:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->diffusion = *values++;
+			reverb->diffusion =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_DIFFUSION val:%d\n",
+				__func__, reverb->diffusion);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_REVERB_DIFFUSION;
-				*updt_params++ = REVERB_DIFFUSION_PARAM_SZ;
-				*updt_params++ = reverb->diffusion;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_DIFFUSION_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_DIFFUSION", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_DIFFUSION;
+				*updt_params++ =
+					REVERB_DIFFUSION_PARAM_SZ;
+				*updt_params++ =
+					reverb->diffusion;
 			}
 			break;
 		case REVERB_DENSITY:
-			pr_debug("%s: REVERB_DENSITY\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("REVERB_DENSITY:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			reverb->density = *values++;
+			reverb->density =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: REVERB_DENSITY val:%d\n",
+				__func__, reverb->density);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_REVERB;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_REVERB_DENSITY;
-				*updt_params++ = REVERB_DENSITY_PARAM_SZ;
-				*updt_params++ = reverb->density;
 				params_length += COMMAND_PAYLOAD_SZ +
 					REVERB_DENSITY_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"REVERB_DENSITY", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_REVERB;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_REVERB_DENSITY;
+				*updt_params++ =
+					REVERB_DENSITY_PARAM_SZ;
+				*updt_params++ =
+					reverb->density;
 			}
 			break;
 		default:
@@ -436,9 +658,11 @@
 			break;
 		}
 	}
-	if (params_length)
+	if (params_length && (rc == 0))
 		q6asm_send_audio_effects_params(ac, params,
 						params_length);
+	else
+		pr_debug("%s: did not send pp params\n", __func__);
 invalid_config:
 	kfree(params);
 	return rc;
@@ -448,15 +672,16 @@
 					struct bass_boost_params *bass_boost,
 					long *values)
 {
-	int devices = *values++;
-	int num_commands = *values++;
-	char *params;
+	long *param_max_offset = values + MAX_PP_PARAMS_SZ - 1;
+	char *params = NULL;
+	int rc = 0;
+	int devices = GET_NEXT(values, param_max_offset, rc);
+	int num_commands = GET_NEXT(values, param_max_offset, rc);
 	int *updt_params, i, prev_enable_flag;
 	uint32_t params_length = (MAX_INBAND_PARAM_SZ);
-	int rc = 0;
 
 	pr_debug("%s\n", __func__);
-	if (!ac) {
+	if (!ac || (devices == -EINVAL) || (num_commands == -EINVAL)) {
 		pr_err("%s: cannot set audio effects\n", __func__);
 		return -EINVAL;
 	}
@@ -469,64 +694,99 @@
 	updt_params = (int *)params;
 	params_length = 0;
 	for (i = 0; i < num_commands; i++) {
-		uint32_t command_id = *values++;
-		uint32_t command_config_state = *values++;
-		uint32_t index_offset = *values++;
-		uint32_t length = *values++;
+		uint32_t command_id =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t command_config_state =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t index_offset =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t length =
+			GET_NEXT(values, param_max_offset, rc);
 		switch (command_id) {
 		case BASS_BOOST_ENABLE:
-			pr_debug("%s: BASS_BOOST_ENABLE\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("BASS_BOOST_ENABLE:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
 			prev_enable_flag = bass_boost->enable_flag;
-			bass_boost->enable_flag = *values++;
+			bass_boost->enable_flag =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: BASS_BOOST_ENABLE prev:%d new:%d\n",
+				__func__, prev_enable_flag,
+				bass_boost->enable_flag);
 			if (prev_enable_flag != bass_boost->enable_flag) {
-				*updt_params++ = AUDPROC_MODULE_ID_BASS_BOOST;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_BASS_BOOST_ENABLE;
-				*updt_params++ = BASS_BOOST_ENABLE_PARAM_SZ;
-				*updt_params++ = bass_boost->enable_flag;
 				params_length += COMMAND_PAYLOAD_SZ +
 					BASS_BOOST_ENABLE_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"BASS_BOOST_ENABLE", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_BASS_BOOST;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_BASS_BOOST_ENABLE;
+				*updt_params++ =
+					BASS_BOOST_ENABLE_PARAM_SZ;
+				*updt_params++ =
+					bass_boost->enable_flag;
 			}
 			break;
 		case BASS_BOOST_MODE:
-			pr_debug("%s: BASS_BOOST_MODE\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("BASS_BOOST_MODE:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			bass_boost->mode = *values++;
+			bass_boost->mode =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: BASS_BOOST_MODE val:%d\n",
+				__func__, bass_boost->mode);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_BASS_BOOST;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_BASS_BOOST_MODE;
-				*updt_params++ = BASS_BOOST_MODE_PARAM_SZ;
-				*updt_params++ = bass_boost->mode;
 				params_length += COMMAND_PAYLOAD_SZ +
 					BASS_BOOST_MODE_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"BASS_BOOST_MODE", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_BASS_BOOST;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_BASS_BOOST_MODE;
+				*updt_params++ =
+					BASS_BOOST_MODE_PARAM_SZ;
+				*updt_params++ =
+					bass_boost->mode;
 			}
 			break;
 		case BASS_BOOST_STRENGTH:
-			pr_debug("%s: BASS_BOOST_STRENGTH\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("BASS_BOOST_STRENGTH:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			bass_boost->strength = *values++;
+			bass_boost->strength =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: BASS_BOOST_STRENGTH val:%d\n",
+				__func__, bass_boost->strength);
 			if (command_config_state == CONFIG_SET) {
-				*updt_params++ = AUDPROC_MODULE_ID_BASS_BOOST;
-				*updt_params++ =
-					AUDPROC_PARAM_ID_BASS_BOOST_STRENGTH;
-				*updt_params++ = BASS_BOOST_STRENGTH_PARAM_SZ;
-				*updt_params++ = bass_boost->strength;
 				params_length += COMMAND_PAYLOAD_SZ +
 					BASS_BOOST_STRENGTH_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"BASS_BOOST_STRENGTH", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_BASS_BOOST;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_BASS_BOOST_STRENGTH;
+				*updt_params++ =
+					BASS_BOOST_STRENGTH_PARAM_SZ;
+				*updt_params++ =
+					bass_boost->strength;
 			}
 			break;
 		default:
@@ -534,9 +794,11 @@
 			break;
 		}
 	}
-	if (params_length)
+	if (params_length && (rc == 0))
 		q6asm_send_audio_effects_params(ac, params,
 						params_length);
+	else
+		pr_debug("%s: did not send pp params\n", __func__);
 invalid_config:
 	kfree(params);
 	return rc;
@@ -546,15 +808,16 @@
 					 struct eq_params *eq,
 					 long *values)
 {
-	int devices = *values++;
-	int num_commands = *values++;
-	char *params;
+	long *param_max_offset = values + MAX_PP_PARAMS_SZ - 1;
+	char *params = NULL;
+	int rc = 0;
+	int devices = GET_NEXT(values, param_max_offset, rc);
+	int num_commands = GET_NEXT(values, param_max_offset, rc);
 	int *updt_params, i, prev_enable_flag;
 	uint32_t params_length = (MAX_INBAND_PARAM_SZ);
-	int rc = 0;
 
 	pr_debug("%s\n", __func__);
-	if (!ac) {
+	if (!ac || (devices == -EINVAL) || (num_commands == -EINVAL)) {
 		pr_err("%s: cannot set audio effects\n", __func__);
 		return -EINVAL;
 	}
@@ -567,47 +830,65 @@
 	updt_params = (int *)params;
 	params_length = 0;
 	for (i = 0; i < num_commands; i++) {
-		uint32_t command_id = *values++;
-		uint32_t command_config_state = *values++;
-		uint32_t index_offset = *values++;
-		uint32_t length = *values++;
-		int idx, j;
+		uint32_t command_id =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t command_config_state =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t index_offset =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t length =
+			GET_NEXT(values, param_max_offset, rc);
+		uint32_t idx;
+		int j;
 		switch (command_id) {
 		case EQ_ENABLE:
-			pr_debug("%s: EQ_ENABLE\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("EQ_ENABLE:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
 			prev_enable_flag = eq->enable_flag;
-			eq->enable_flag = *values++;
-			pr_debug("%s: prev_enable_flag : %d, eq.enable_flag : %d",
-				__func__, prev_enable_flag, eq->enable_flag);
+			eq->enable_flag =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: EQ_ENABLE prev:%d new:%d\n", __func__,
+				prev_enable_flag, eq->enable_flag);
 			if (prev_enable_flag != eq->enable_flag) {
-				*updt_params++ =
-					AUDPROC_MODULE_ID_POPLESS_EQUALIZER;
-				*updt_params++ = AUDPROC_PARAM_ID_EQ_ENABLE;
-				*updt_params++ = EQ_ENABLE_PARAM_SZ;
-				*updt_params++ = eq->enable_flag;
 				params_length += COMMAND_PAYLOAD_SZ +
 					EQ_ENABLE_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"EQ_ENABLE", rc);
+				if (rc != 0)
+					break;
+				*updt_params++ =
+					AUDPROC_MODULE_ID_POPLESS_EQUALIZER;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_EQ_ENABLE;
+				*updt_params++ =
+					EQ_ENABLE_PARAM_SZ;
+				*updt_params++ =
+					eq->enable_flag;
 			}
 			break;
 		case EQ_CONFIG:
-			pr_debug("%s: EQ_CONFIG\n", __func__);
 			if (length < EQ_CONFIG_PARAM_LEN || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("EQ_CONFIG:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
+			pr_debug("%s: EQ_CONFIG bands:%d, pgain:%d, pset:%d\n",
+				 __func__, eq->config.num_bands,
+				eq->config.eq_pregain, eq->config.preset_id);
 			for (idx = 0; idx < MAX_EQ_BANDS; idx++)
 				eq->per_band_cfg[idx].band_idx = -1;
-			eq->config.eq_pregain = *values++;
-			eq->config.preset_id = *values++;
-			eq->config.num_bands = *values++;
+			eq->config.eq_pregain =
+				GET_NEXT(values, param_max_offset, rc);
+			eq->config.preset_id =
+				GET_NEXT(values, param_max_offset, rc);
+			eq->config.num_bands =
+				GET_NEXT(values, param_max_offset, rc);
 			if (eq->config.num_bands > MAX_EQ_BANDS) {
-				pr_err("invalid num of bands\n");
+				pr_err("EQ_CONFIG:invalid num of bands\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
@@ -615,101 +896,129 @@
 			    (((length - EQ_CONFIG_PARAM_LEN)/
 				EQ_CONFIG_PER_BAND_PARAM_LEN)
 				!= eq->config.num_bands)) {
-				pr_err("invalid length to set config per band\n");
+				pr_err("EQ_CONFIG:invalid length per band\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
 			for (j = 0; j < eq->config.num_bands; j++) {
-				idx = *values++;
+				idx = GET_NEXT(values, param_max_offset, rc);
 				if (idx >= MAX_EQ_BANDS) {
 					pr_err("EQ_CONFIG:invalid band index\n");
 					rc = -EINVAL;
 					goto invalid_config;
 				}
 				eq->per_band_cfg[idx].band_idx = idx;
-				eq->per_band_cfg[idx].filter_type = *values++;
+				eq->per_band_cfg[idx].filter_type =
+					GET_NEXT(values, param_max_offset, rc);
 				eq->per_band_cfg[idx].freq_millihertz =
-								*values++;
+					GET_NEXT(values, param_max_offset, rc);
 				eq->per_band_cfg[idx].gain_millibels =
-								*values++;
+					GET_NEXT(values, param_max_offset, rc);
 				eq->per_band_cfg[idx].quality_factor =
-								*values++;
+					GET_NEXT(values, param_max_offset, rc);
 			}
 			if (command_config_state == CONFIG_SET) {
 				int config_param_length = EQ_CONFIG_PARAM_SZ +
 					(EQ_CONFIG_PER_BAND_PARAM_SZ*
 					 eq->config.num_bands);
+				params_length += COMMAND_PAYLOAD_SZ +
+						config_param_length;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"EQ_CONFIG", rc);
+				if (rc != 0)
+					break;
 				*updt_params++ =
 					AUDPROC_MODULE_ID_POPLESS_EQUALIZER;
-				*updt_params++ = AUDPROC_PARAM_ID_EQ_CONFIG;
-				*updt_params++ = config_param_length;
-				*updt_params++ = eq->config.eq_pregain;
-				*updt_params++ = eq->config.preset_id;
-				*updt_params++ = eq->config.num_bands;
+				*updt_params++ =
+					AUDPROC_PARAM_ID_EQ_CONFIG;
+				*updt_params++ =
+					config_param_length;
+				*updt_params++ =
+					eq->config.eq_pregain;
+				*updt_params++ =
+					eq->config.preset_id;
+				*updt_params++ =
+					eq->config.num_bands;
 				for (idx = 0; idx < MAX_EQ_BANDS; idx++) {
 					if (eq->per_band_cfg[idx].band_idx < 0)
 						continue;
 					*updt_params++ =
-					  eq->per_band_cfg[idx].filter_type;
+					eq->per_band_cfg[idx].filter_type;
 					*updt_params++ =
-					  eq->per_band_cfg[idx].freq_millihertz;
+					eq->per_band_cfg[idx].freq_millihertz;
 					*updt_params++ =
-					  eq->per_band_cfg[idx].gain_millibels;
+					eq->per_band_cfg[idx].gain_millibels;
 					*updt_params++ =
-					  eq->per_band_cfg[idx].quality_factor;
+					eq->per_band_cfg[idx].quality_factor;
 					*updt_params++ =
-					  eq->per_band_cfg[idx].band_idx;
+					eq->per_band_cfg[idx].band_idx;
 				}
-				params_length += COMMAND_PAYLOAD_SZ +
-						config_param_length;
 			}
 			break;
 		case EQ_BAND_INDEX:
-			pr_debug("%s: EQ_BAND_INDEX\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("EQ_BAND_INDEX:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
-			idx = *values++;
+			idx = GET_NEXT(values, param_max_offset, rc);
 			if (idx > MAX_EQ_BANDS) {
-				pr_err("invalid band index\n");
+				pr_err("EQ_BAND_INDEX:invalid band index\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
 			eq->band_index = idx;
+			pr_debug("%s: EQ_BAND_INDEX val:%d\n",
+				__func__, eq->band_index);
 			if (command_config_state == CONFIG_SET) {
+				params_length += COMMAND_PAYLOAD_SZ +
+					EQ_BAND_INDEX_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"EQ_BAND_INDEX", rc);
+				if (rc != 0)
+					break;
 				*updt_params++ =
 					AUDPROC_MODULE_ID_POPLESS_EQUALIZER;
 				*updt_params++ =
 					AUDPROC_PARAM_ID_EQ_BAND_INDEX;
-				*updt_params++ = EQ_BAND_INDEX_PARAM_SZ;
-				*updt_params++ = eq->band_index;
-				params_length += COMMAND_PAYLOAD_SZ +
+				*updt_params++ =
 					EQ_BAND_INDEX_PARAM_SZ;
+				*updt_params++ =
+					eq->band_index;
 			}
 			break;
 		case EQ_SINGLE_BAND_FREQ:
-			pr_debug("%s: EQ_SINGLE_BAND_FREQ\n", __func__);
 			if (length != 1 || index_offset != 0) {
-				pr_err("no valid params\n");
+				pr_err("EQ_SINGLE_BAND_FREQ:invalid params\n");
 				rc = -EINVAL;
 				goto invalid_config;
 			}
 			if (eq->band_index > MAX_EQ_BANDS) {
-				pr_err("invalid band index to set frequency\n");
+				pr_err("EQ_SINGLE_BAND_FREQ:invalid index\n");
 				break;
 			}
-			eq->freq_millihertz = *values++;
+			eq->freq_millihertz =
+				GET_NEXT(values, param_max_offset, rc);
+			pr_debug("%s: EQ_SINGLE_BAND_FREQ idx:%d, val:%d\n",
+				__func__, eq->band_index, eq->freq_millihertz);
 			if (command_config_state == CONFIG_SET) {
+				params_length += COMMAND_PAYLOAD_SZ +
+					EQ_SINGLE_BAND_FREQ_PARAM_SZ;
+				CHECK_PARAM_LEN(params_length,
+						MAX_INBAND_PARAM_SZ,
+						"EQ_SINGLE_BAND_FREQ", rc);
+				if (rc != 0)
+					break;
 				*updt_params++ =
 					AUDPROC_MODULE_ID_POPLESS_EQUALIZER;
 				*updt_params++ =
 					AUDPROC_PARAM_ID_EQ_SINGLE_BAND_FREQ;
-				*updt_params++ = EQ_SINGLE_BAND_FREQ_PARAM_SZ;
-				*updt_params++ = eq->freq_millihertz;
-				params_length += COMMAND_PAYLOAD_SZ +
+				*updt_params++ =
 					EQ_SINGLE_BAND_FREQ_PARAM_SZ;
+				*updt_params++ =
+					eq->freq_millihertz;
 			}
 			break;
 		default:
@@ -717,9 +1026,11 @@
 			break;
 		}
 	}
-	if (params_length)
+	if (params_length && (rc == 0))
 		q6asm_send_audio_effects_params(ac, params,
 						params_length);
+	else
+		pr_debug("%s: did not send pp params\n", __func__);
 invalid_config:
 	kfree(params);
 	return rc;
diff --git a/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.h b/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.h
index 3d2e6d4..2fb5083 100644
--- a/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.h
+++ b/sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -16,6 +16,8 @@
 
 #include <sound/audio_effects.h>
 
+#define MAX_PP_PARAMS_SZ   128
+
 int msm_audio_effects_reverb_handler(struct audio_client *ac,
 				     struct reverb_params *reverb,
 				     long *values);
diff --git a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c
index 92e252c..9c07688 100755
--- a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c
@@ -1939,7 +1939,7 @@
 					       struct snd_ctl_elem_info *uinfo)
 {
 	uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
-	uinfo->count = 128;
+	uinfo->count = MAX_PP_PARAMS_SZ;
 	uinfo->value.integer.min = 0;
 	uinfo->value.integer.max = 0xFFFFFFFF;
 	return 0;