diff --git a/drivers/platform/msm/sps/sps.c b/drivers/platform/msm/sps/sps.c
index b0026576a08..c2a4b6a4855 100644
--- a/drivers/platform/msm/sps/sps.c
+++ b/drivers/platform/msm/sps/sps.c
@@ -1203,11 +1203,11 @@ exit_err:
 	mutex_unlock(&sps->lock);
 
 	if (result) {
-		if (virt_addr != NULL)
-			iounmap(bam->props.virt_addr);
-
-		if (bam != NULL)
+		if (bam != NULL) {
+			if (virt_addr != NULL)
+				iounmap(bam->props.virt_addr);
 			kfree(bam);
+		}
 
 		return result;
 	}
diff --git a/drivers/platform/msm/sps/sps_bam.c b/drivers/platform/msm/sps/sps_bam.c
index edd789ea074..cb5a0eeee86 100644
--- a/drivers/platform/msm/sps/sps_bam.c
+++ b/drivers/platform/msm/sps/sps_bam.c
@@ -634,9 +634,16 @@ void sps_bam_pipe_free(struct sps_bam *dev, u32 pipe_index)
 		SPS_ERR("Disconnect BAM 0x%x pipe %d with events pending",
 			BAM_ID(dev), pipe_index);
 
-		list_for_each_entry(sps_event, &pipe->sys.events_q, list) {
+		sps_event = list_entry((&pipe->sys.events_q)->next,
+				typeof(*sps_event), list);
+
+		while (&sps_event->list != (&pipe->sys.events_q)) {
+			struct sps_q_event *sps_event_delete = sps_event;
+
 			list_del(&sps_event->list);
-			kfree(sps_event);
+			sps_event = list_entry(sps_event->list.next,
+					typeof(*sps_event), list);
+			kfree(sps_event_delete);
 		}
 	}
 
@@ -1086,11 +1093,17 @@ int sps_bam_pipe_reg_event(struct sps_bam *dev,
 			continue;	/* No */
 
 		index = SPS_EVENT_INDEX(opt_event_table[n].event_id);
-		event_reg = &pipe->sys.event_regs[index];
-		event_reg->xfer_done = reg->xfer_done;
-		event_reg->callback = reg->callback;
-		event_reg->mode = reg->mode;
-		event_reg->user = reg->user;
+		if (index < 0)
+			SPS_ERR("Negative event index: "
+			"BAM 0x%x pipe %d mode %d",
+			BAM_ID(dev), pipe_index, reg->mode);
+		else {
+			event_reg = &pipe->sys.event_regs[index];
+			event_reg->xfer_done = reg->xfer_done;
+			event_reg->callback = reg->callback;
+			event_reg->mode = reg->mode;
+			event_reg->user = reg->user;
+		}
 	}
 
 	return 0;
diff --git a/drivers/platform/msm/sps/sps_dma.c b/drivers/platform/msm/sps/sps_dma.c
index b65009848ee..48c7ffd841c 100644
--- a/drivers/platform/msm/sps/sps_dma.c
+++ b/drivers/platform/msm/sps/sps_dma.c
@@ -291,6 +291,11 @@ int sps_dma_device_init(u32 h)
 	dev->h = h;
 	dev->bam = sps_h2bam(h);
 
+	if (dev->bam == NULL) {
+		SPS_ERR("BAM-DMA BAM device is not found from the handle.");
+		goto exit_err;
+	}
+
 	/* Map the BAM DMA device into virtual space, if necessary */
 	props = &dev->bam->props;
 	dev->phys_addr = props->periph_phys_addr;
diff --git a/drivers/platform/msm/sps/sps_mem.c b/drivers/platform/msm/sps/sps_mem.c
index 31c1314b4ec..358dbd3084f 100644
--- a/drivers/platform/msm/sps/sps_mem.c
+++ b/drivers/platform/msm/sps/sps_mem.c
@@ -131,6 +131,12 @@ int sps_mem_init(u32 pipemem_phys_base, u32 pipemem_size)
 #endif
 
 	pool = gen_pool_create(min_alloc_order, nid);
+
+	if (!pool) {
+		SPS_ERR("sps:Failed to create a new memory pool.\n");
+		return -ENOMEM;
+	}
+
 #ifndef CONFIG_SPS_SUPPORT_NDP_BAM
 	res = gen_pool_add(pool, (u32) iomem_virt, iomem_size, nid);
 	if (res)