diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index b0aff3974f24f6..3d4e2232e353e4 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -33,6 +33,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/dma-buf.h>
 #include <linux/errno.h>
+#include <linux/fdtable.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
@@ -1200,8 +1201,10 @@ static int vc_sm_cma_ioctl_alloc(struct vc_sm_privdata_t *private,
 	buffer->alloc.sg_table = sgt;
 
 	fd = dma_buf_fd(dmabuf, O_CLOEXEC);
-	if (fd < 0)
+	if (fd < 0) {
+		ret = fd;
 		goto error;
+	}
 
 	vc_sm_add_resource(private, buffer);
 
@@ -1276,9 +1279,9 @@ static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
 		if (!ret &&
 		    (copy_to_user((void *)arg, &ioparam,
 				  sizeof(ioparam)) != 0)) {
-			/* FIXME: Release allocation */
 			pr_err("[%s]: failed to copy-to-user for cmd %x\n",
 			       __func__, cmdnr);
+			close_fd(ioparam.handle);
 			ret = -EFAULT;
 		}
 		break;
@@ -1312,11 +1315,12 @@ static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
 			ioparam.vc_handle = buf->vc_handle;
 			ioparam.dma_addr = buf->dma_addr;
 
-			if (ioparam.handle < 0 ||
-			    (copy_to_user((void *)arg, &ioparam,
-					  sizeof(ioparam)) != 0)) {
+			if (ioparam.handle < 0) {
 				dma_buf_put(new_dmabuf);
-				/* FIXME: Release allocation */
+				ret = -EFAULT;
+			} else if (copy_to_user((void *)arg, &ioparam,
+						sizeof(ioparam)) != 0) {
+				close_fd(ioparam.handle);
 				ret = -EFAULT;
 			}
 		}
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index ec42af0ed45a0f..245cfec3ef3700 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -1349,6 +1349,9 @@ static int port_parameter_set(struct vchiq_mmal_instance *instance,
 	struct mmal_msg *rmsg;
 	struct vchiq_header *rmsg_handle;
 
+	if (value_size > sizeof(m.u.port_parameter_set.value))
+		return -EINVAL;
+
 	m.h.type = MMAL_MSG_TYPE_PORT_PARAMETER_SET;
 
 	m.u.port_parameter_set.component_handle = port->component->handle;
@@ -1390,6 +1393,9 @@ static int port_parameter_get(struct vchiq_mmal_instance *instance,
 	struct mmal_msg *rmsg;
 	struct vchiq_header *rmsg_handle;
 
+	if (*value_size > sizeof(rmsg->u.port_parameter_get_reply.value))
+		return -EINVAL;
+
 	m.h.type = MMAL_MSG_TYPE_PORT_PARAMETER_GET;
 
 	m.u.port_parameter_get.component_handle = port->component->handle;