diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gm20b.c b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gm20b.c
index 1dcaba4..e08cf95 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gm20b.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gm20b.c
@@ -1613,6 +1613,9 @@
 	int tstate, throt_cur_tstate, edp_cur_tstate;
 	unsigned long freq, cur_freq = ULONG_MAX;
 
+	if (cur_state > bthrot_ins->throt_tab_size)
+		return -EINVAL;
+
 	if (bthrot_ins->cur_state == cur_state)
 		return 0;
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk20a.c b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk20a.c
index a18e4c9..1243d21 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk20a.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk20a.c
@@ -314,6 +314,9 @@
 	struct gk20a_volt_priv *priv = (struct gk20a_volt_priv *)cdev->devdata;
 	struct nvkm_volt *volt = &priv->base;
 
+	if (cur_state >= MAX_THERMAL_LIMITS)
+		return -EINVAL;
+
 	mutex_lock(&volt->therm_lock);
 
 	if (priv->therm_idx == cur_state)
diff --git a/drivers/soc/tegra/tegra-dvfs.c b/drivers/soc/tegra/tegra-dvfs.c
index 5c0af3b..990cd61 100644
--- a/drivers/soc/tegra/tegra-dvfs.c
+++ b/drivers/soc/tegra/tegra-dvfs.c
@@ -1068,6 +1068,14 @@
 	if (IS_ERR_OR_NULL(tegra_core_rail) || !tegra_core_rail->is_ready)
 		return -EINVAL;
 
+	if (type == TEGRA_DVFS_CORE_THERMAL_FLOOR) {
+		if (new_idx >= rail->therm_floors_size)
+			return -EINVAL;
+	} else if (type == TEGRA_DVFS_CORE_THERMAL_CAP) {
+		if (new_idx > rail->therm_caps_size)
+			return -EINVAL;
+	}
+
 	mutex_lock(&dvfs_lock);
 	if (type == TEGRA_DVFS_CORE_THERMAL_FLOOR) {
 		if (rail->therm_floor_idx != new_idx) {
diff --git a/drivers/thermal/tegra/tegra_throttle.c b/drivers/thermal/tegra/tegra_throttle.c
index 39a913e..e9991db 100644
--- a/drivers/thermal/tegra/tegra_throttle.c
+++ b/drivers/thermal/tegra/tegra_throttle.c
@@ -198,6 +198,9 @@
 	if (bthrot->cpu_freq_table == NULL)
 		return 0;
 
+	if (cur_state > bthrot_ins->throt_tab_size)
+		return -EINVAL;
+
 	if (bthrot_ins->cur_state == cur_state)
 		return 0;