diff --git a/drivers/platform/msm/ipa/rmnet_ipa.c b/drivers/platform/msm/ipa/rmnet_ipa.c
index bedf69a6317399f7a40355b79a4ae367953d6b70..a149a9eb4f7b331e44cb08de3fa0c0336b1c634f 100644
--- a/drivers/platform/msm/ipa/rmnet_ipa.c
+++ b/drivers/platform/msm/ipa/rmnet_ipa.c
@@ -1242,6 +1242,11 @@ static int ipa_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 					rmnet_mux_val.mux_id);
 				return rc;
 			}
+			if (rmnet_index >= MAX_NUM_OF_MUX_CHANNEL) {
+				IPAWANERR("Exceed mux_channel limit(%d)\n",
+				rmnet_index);
+				return -EFAULT;
+			}
 			IPAWANDBG("ADD_MUX_CHANNEL(%d, name: %s)\n",
 			extend_ioctl_data.u.rmnet_mux_val.mux_id,
 			extend_ioctl_data.u.rmnet_mux_val.vchannel_name);
diff --git a/drivers/thermal/msm_thermal-dev.c b/drivers/thermal/msm_thermal-dev.c
index de38d969da4edd914d1f53a8e4f91c27f9258946..33fd59856c53582dc8659ddb837ebf5a7c8a5240 100644
--- a/drivers/thermal/msm_thermal-dev.c
+++ b/drivers/thermal/msm_thermal-dev.c
@@ -99,6 +99,16 @@ static long validate_and_copy(unsigned int *cmd, unsigned long *arg,
 			goto validate_exit;
 		}
 		break;
+	case MSM_THERMAL_GET_CLUSTER_FREQUENCY_PLAN:
+		if (query->clock_freq.cluster_num >= NR_CPUS) {
+			ret = -EINVAL;
+			goto validate_exit;
+		}
+	case MSM_THERMAL_GET_CLUSTER_VOLTAGE_PLAN:
+		if (query->voltage.cluster_num >= NR_CPUS) {
+			ret = -EINVAL;
+			goto validate_exit;
+		}
 	default:
 		break;
 	}