diff --git a/apps/lms/src/sample_usr_lms.c b/apps/lms/src/sample_usr_lms.c
old mode 100755
new mode 100644
index 208efb2f..8ecadc87
--- a/apps/lms/src/sample_usr_lms.c
+++ b/apps/lms/src/sample_usr_lms.c
@@ -50,14 +50,14 @@ static void BufReadTest(void *buf, int start, int end)
 
 static void LmsMallocTest(void)
 {
+#define TEST_SIZE 16
     printf("\n-------- LmsMallocTest Start --------\n");
-    char *buf = (char *)malloc(16);
-    printf("[LmsMallocTest] malloc addr:%p    size:%d\n", buf, 16);
+    char *buf = (char *)malloc(TEST_SIZE);
 
-    printf("[LmsMallocTest] read overflow & underflow error should be triggered, read range[-1,16]\n");
-    BufReadTest(buf, -1, 16);
-    printf("[LmsMallocTest] write overflow error should be triggered, write range[0,16]\n");
-    BufWriteTest(buf, 0, 16);
+    printf("[LmsMallocTest] read overflow & underflow error should be triggered, read range[-1, TEST_SIZE]\n");
+    BufReadTest(buf, -1, TEST_SIZE);
+    printf("[LmsMallocTest] write overflow error should be triggered, write range[0, TEST_SIZE]\n");
+    BufWriteTest(buf, 0, TEST_SIZE);
 
     free(buf);
     printf("\n-------- LmsMallocTest End --------\n");
@@ -65,46 +65,52 @@ static void LmsMallocTest(void)
 
 static void LmsReallocTest(void)
 {
+#define TEST_SIZE     64
+#define TEST_SIZE_MIN 32
     printf("\n-------- LmsReallocTest Start --------\n");
-    char *buf = (char *)malloc(64);
-    printf("[LmsReallocTest] malloc addr:%p size:%d\n", buf, 64);
-    printf("[LmsReallocTest] read overflow & underflow error should be triggered, read range[-1,64]\n");
-    BufReadTest(buf, -1, 64);
-    buf = (char *)realloc(buf, 32);
-    printf("[LmsReallocTest] realloc addr:%p size:%d\n", buf, 32);
-    printf("[LmsReallocTest] read overflow & underflow error should be triggered, read range[-1,32]\n");
-    BufReadTest(buf, -1, 32);
-    free(buf);
+    char *buf = (char *)malloc(TEST_SIZE);
+    printf("[LmsReallocTest] read overflow & underflow error should be triggered, read range[-1, TEST_SIZE]\n");
+    BufReadTest(buf, -1, TEST_SIZE);
+    char *buf1 = (char *)realloc(buf, TEST_SIZE_MIN);
+    if (buf1 == NULL) {
+        free(buf);
+        return;
+    }
+    buf = NULL;
+    printf("[LmsReallocTest] read overflow & underflow error should be triggered, read range[-1, TEST_SIZE_MIN]\n");
+    BufReadTest(buf1, -1, TEST_SIZE_MIN);
+    free(buf1);
     printf("\n-------- LmsReallocTest End --------\n");
 }
 
 static void LmsCallocTest(void)
 {
+#define TEST_SIZE 16
     printf("\n-------- LmsCallocTest Start --------\n");
-    char *buf = (char *)calloc(4, 4);
-    printf("[LmsCallocTest] calloc addr:%p size:%d\n", buf, 16);
-    printf("[LmsCallocTest] read overflow & underflow error should be triggered, read range[-1,16]\n");
-    BufReadTest(buf, -1, 16);
+    char *buf = (char *)calloc(4, 4); /* 4: test size */
+    printf("[LmsCallocTest] read overflow & underflow error should be triggered, read range[-1, TEST_SIZE]\n");
+    BufReadTest(buf, -1, TEST_SIZE);
     free(buf);
     printf("\n-------- LmsCallocTest End --------\n");
 }
 
 static void LmsVallocTest(void)
 {
+#define TEST_SIZE 4096
     printf("\n-------- LmsVallocTest Start --------\n");
-    char *buf = (char *)valloc(4096);
-    printf("[LmsVallocTest] valloc addr:%p size:%d\n", buf, 4096);
-    printf("[LmsVallocTest] read overflow & underflow error should be triggered, read range[-1,4096]\n");
-    BufReadTest(buf, -1, 4096);
+    char *buf = (char *)valloc(TEST_SIZE);
+    printf("[LmsVallocTest] read overflow & underflow error should be triggered, read range[-1, TEST_SIZE]\n");
+    BufReadTest(buf, -1, TEST_SIZE);
     free(buf);
     printf("\n-------- LmsVallocTest End --------\n");
 }
 
 static void LmsAlignedAllocTest(void)
 {
+#define TEST_ALIGN_SIZE 64
+#define TEST_SIZE       128
     printf("\n-------- LmsAlignedAllocTest Start --------\n");
-    char *buf = (char *)aligned_alloc(64, 128);
-    printf("[LmsAlignedAllocTest] aligned_alloc boundsize:%d addr:%p size:%d\n", 64, buf, 128);
+    char *buf = (char *)aligned_alloc(TEST_ALIGN_SIZE, TEST_SIZE);
     printf("[LmsAlignedAllocTest] read overflow & underflow error should be triggered, read range[-1,128]\n");
     BufReadTest(buf, -1, 128);
     free(buf);
@@ -113,44 +119,43 @@ static void LmsAlignedAllocTest(void)
 
 static void LmsMemsetTest(void)
 {
+#define TEST_SIZE 32
     printf("\n-------- LmsMemsetTest Start --------\n");
-    char *buf = (char *)malloc(32);
-    printf("[LmsMemsetTest] malloc addr:%p size:%d\n", buf, 32);
-    printf("[LmsMemsetTest] memset overflow & underflow error should be triggered, memset size:%d\n", 33);
-    memset(buf, 0, 33);
+    char *buf = (char *)malloc(TEST_SIZE);
+    printf("[LmsMemsetTest] memset overflow & underflow error should be triggered, memset size:%d\n", TEST_SIZE + 1);
+    memset(buf, 0, TEST_SIZE + 1);
     free(buf);
     printf("\n-------- LmsMemsetTest End --------\n");
 }
 
 static void LmsMemcpyTest(void)
 {
+#define TEST_SIZE 20
     printf("\n-------- LmsMemcpyTest Start --------\n");
-    char *buf = (char *)malloc(20);
-    printf("[LmsMemcpyTest] malloc addr:%p size:%d\n", buf, 20);
-    char localBuf[32] = {0};
-    printf("[LmsMemcpyTest] memcpy overflow error should be triggered, memcpy size:%d\n", 21);
-    memcpy(buf, localBuf, 21);
+    char *buf = (char *)malloc(TEST_SIZE);
+    char localBuf[32] = {0}; /* 32: test size */
+    printf("[LmsMemcpyTest] memcpy overflow error should be triggered, memcpy size:%d\n", TEST_SIZE + 1);
+    memcpy(buf, localBuf, TEST_SIZE + 1);
     free(buf);
     printf("\n-------- LmsMemcpyTest End --------\n");
 }
 
 static void LmsMemmoveTest(void)
 {
+#define TEST_SIZE 20
     printf("\n-------- LmsMemmoveTest Start --------\n");
-    char *buf = (char *)malloc(20);
-    printf("[LmsMemmoveTest] malloc addr:%p size:%d\n", buf, 20);
-    printf("[LmsMemmoveTest] memmove overflow error should be triggered, dest addr:%p src addr:%p size:%d\n", buf + 12,
-        buf, 10);
-    memmove(buf + 12, buf, 10);
+    char *buf = (char *)malloc(TEST_SIZE);
+    printf("[LmsMemmoveTest] memmove overflow error should be triggered\n");
+    memmove(buf + 12, buf, 10); /* 12 and 10: test size */
     free(buf);
     printf("\n-------- LmsMemmoveTest End --------\n");
 }
 
 static void LmsStrcpyTest(void)
 {
+#define TEST_SIZE 16
     printf("\n-------- LmsStrcpyTest Start --------\n");
-    char *buf = (char *)malloc(16);
-    printf("[LmsStrcpyTest] malloc addr:%p size:%d\n", buf, 16);
+    char *buf = (char *)malloc(TEST_SIZE);
     char *testStr = "bbbbbbbbbbbbbbbbb";
     printf("[LmsStrcpyTest] strcpy overflow error should be triggered, src string buf size:%d\n", strlen(testStr) + 1);
     strcpy(buf, testStr);
@@ -160,9 +165,9 @@ static void LmsStrcpyTest(void)
 
 static void LmsStrcatTest(void)
 {
+#define TEST_SIZE 16
     printf("\n-------- LmsStrcatTest Start --------\n");
-    char *buf = (char *)malloc(16);
-    printf("[LmsStrcatTest] malloc addr:%p size:%d\n", buf, 16);
+    char *buf = (char *)malloc(TEST_SIZE);
     buf[0] = 'a';
     buf[1] = 'b';
     buf[2] = 0;
@@ -177,22 +182,24 @@ static void LmsStrcatTest(void)
 
 static void LmsFreeTest(void)
 {
+#define TEST_SIZE 16
     printf("\n-------- LmsFreeTest Start --------\n");
-    char *buf = (char *)malloc(16);
-    printf("[LmsFreeTest] malloc addr:%p size:%d\n", buf, 16);
-    printf("[LmsFreeTest] free addr:%p\n", buf, 16);
+    char *buf = (char *)malloc(TEST_SIZE);
+    printf("[LmsFreeTest] free size:%d\n", TEST_SIZE);
     free(buf);
-    printf("[LmsFreeTest] Use after free error should be triggered, read addr:%p range[1,1]\n", buf);
+    printf("[LmsFreeTest] Use after free error should be triggered, read range[1,1]\n");
     BufReadTest(buf, 1, 1);
-    printf("[LmsFreeTest] double free error should be triggered, free addr:%p\n", buf);
+    printf("[LmsFreeTest] double free error should be triggered\n");
     free(buf);
     printf("\n-------- LmsFreeTest End --------\n");
 }
 
-int main(int argc, char * const * argv)
+int main(int argc, char * const *argv)
 {
+    (void)argc;
+    (void)argv;
     printf("\n############### Lms Test start ###############\n");
-    char *tmp = (char *)malloc(5000);
+    char *tmp = (char *)malloc(5000); /* 5000: test mem size */
     LmsMallocTest();
     LmsReallocTest();
     LmsCallocTest();
@@ -204,5 +211,6 @@ int main(int argc, char * const * argv)
     LmsStrcpyTest();
     LmsStrcatTest();
     LmsFreeTest();
+    free(tmp);
     printf("\n############### Lms Test End ###############\n");
-}
\ No newline at end of file
+}
diff --git a/apps/perf/src/main.c b/apps/perf/src/main.c
index 1093a60d..8fb841fa 100644
--- a/apps/perf/src/main.c
+++ b/apps/perf/src/main.c
@@ -62,10 +62,17 @@ int main(int argc, char **argv)
         PerfStop(fd);
     } else if ((argc == THREE_ARGS) && strcmp(argv[1], "read") == 0) {
         size_t size = strtoul(argv[THREE_ARGS - 1], NULL, 0);
+        if (size <= 0) {
+            goto EXIT:
+        }
+
         char *buf = (char *)malloc(size);
-        int len = PerfRead(fd, buf, size);
-        PerfPrintBuffer(buf, len);
-        free(buf);
+        if (buf != NULL) {
+            int len = PerfRead(fd, buf, size);
+            PerfPrintBuffer(buf, len);
+            free(buf);
+            buf = NULL;
+        }
     } else if ((argc == TWO_ARGS) && strcmp(argv[1], "list") == 0) {
         PerfList();
     } else if ((argc >= THREE_ARGS) && strcmp(argv[1], "stat") == 0) {
@@ -77,6 +84,7 @@ int main(int argc, char **argv)
         PerfUsage();
     }
 
+EXIT:
     close(fd);
     return 0;
 }
diff --git a/apps/perf/src/perf_record.c b/apps/perf/src/perf_record.c
index 28421001..98a64155 100644
--- a/apps/perf/src/perf_record.c
+++ b/apps/perf/src/perf_record.c
@@ -113,7 +113,6 @@ ssize_t PerfWriteFile(const char *filePath, const char *buf, ssize_t bufSize)
     ssize_t totalWrite = 0;
 
     if (filePath == NULL || buf == NULL || bufSize == 0) {
-        printf("filePath: %p, buf: %p, bufSize: %u!\n", filePath, buf, bufSize);
         return -1;
     }
 
diff --git a/apps/shell/src/main.c b/apps/shell/src/main.c
index d1a465f5..3cdfc803 100644
--- a/apps/shell/src/main.c
+++ b/apps/shell/src/main.c
@@ -108,11 +108,15 @@ static int DoShellExec(char **argv)
     if (!cmdLine) {
         return ret;
     }
-    memset_s(cmdLine, len, 0, len);
+    errno_t ret1 = memset_s(cmdLine, len, 0, len);
+    if (ret1 != EOK) {
+        free(cmdLine);
+        return ret1;
+    }
 
     for (j = 0; j < i; j++) {
-        strcat_s(cmdLine, len,  argv[j]);
-        strcat_s(cmdLine, len, " ");
+        (void)strcat_s(cmdLine, len,  argv[j]);
+        (void)strcat_s(cmdLine, len, " ");
     }
 
     cmdLine[len - 2] = '\0'; /* 2, (len - 2) is the end of cmdline buf */
diff --git a/apps/trace/src/trace.c b/apps/trace/src/trace.c
index 1b1f4b07..ddcb5553 100644
--- a/apps/trace/src/trace.c
+++ b/apps/trace/src/trace.c
@@ -70,6 +70,10 @@ static void TraceRead(int fd, size_t size)
 {
     ssize_t i;
     ssize_t len;
+    if (size <= 0) {
+        return;
+    }
+
     char *buffer = (char *)malloc(size);
     if (buffer == NULL) {
         printf("Read buffer malloc failed.\n");
diff --git a/arch/arm/gic/gic_v2.c b/arch/arm/gic/gic_v2.c
index 7e7a61d6..14aa69af 100644
--- a/arch/arm/gic/gic_v2.c
+++ b/arch/arm/gic/gic_v2.c
@@ -49,7 +49,7 @@ STATIC UINT32 g_curIrqNum = 0;
  */
 STATIC VOID GicWriteSgi(UINT32 vector, UINT32 cpuMask, UINT32 filter)
 {
-    UINT32 val = ((filter & 0x3) << 24) | ((cpuMask & 0xFF) << 16) |
+    UINT32 val = ((filter & 0x3) << 24) | ((cpuMask & 0xFF) << 16) | /* 24, 16: Register bit offset */
                  (vector & 0xF);
 
     GIC_REG_32(GICD_SGIR) = val;
@@ -62,7 +62,7 @@ VOID HalIrqSendIpi(UINT32 target, UINT32 ipi)
 
 VOID HalIrqSetAffinity(UINT32 vector, UINT32 cpuMask)
 {
-    UINT32 offset = vector / 4;
+    UINT32 offset = vector / 4; /* 4: Interrupt bit width */
     UINT32 index = vector & 0x3;
 
     GIC_REG_8(GICD_ITARGETSR(offset) + index) = cpuMask;
@@ -80,7 +80,7 @@ VOID HalIrqMask(UINT32 vector)
         return;
     }
 
-    GIC_REG_32(GICD_ICENABLER(vector / 32)) = 1U << (vector % 32);
+    GIC_REG_32(GICD_ICENABLER(vector / 32)) = 1U << (vector % 32); /* 32: Interrupt bit width */
 }
 
 VOID HalIrqUnmask(UINT32 vector)
@@ -89,7 +89,7 @@ VOID HalIrqUnmask(UINT32 vector)
         return;
     }
 
-    GIC_REG_32(GICD_ISENABLER(vector >> 5)) = 1U << (vector % 32);
+    GIC_REG_32(GICD_ISENABLER(vector >> 5)) = 1U << (vector % 32); /* 5, 32: Register bit offset */
 }
 
 VOID HalIrqPending(UINT32 vector)
@@ -98,7 +98,7 @@ VOID HalIrqPending(UINT32 vector)
         return;
     }
 
-    GIC_REG_32(GICD_ISPENDR(vector >> 5)) = 1U << (vector % 32);
+    GIC_REG_32(GICD_ISPENDR(vector >> 5)) = 1U << (vector % 32); /* 5, 32: Register bit offset */
 }
 
 VOID HalIrqClear(UINT32 vector)
@@ -120,23 +120,23 @@ VOID HalIrqInit(VOID)
     UINT32 i;
 
     /* set external interrupts to be level triggered, active low. */
-    for (i = 32; i < OS_HWI_MAX_NUM; i += 16) {
-        GIC_REG_32(GICD_ICFGR(i / 16)) = 0;
+    for (i = 32; i < OS_HWI_MAX_NUM; i += 16) { /* 32: Start interrupt number, 16: Interrupt bit width */
+        GIC_REG_32(GICD_ICFGR(i / 16)) = 0; /* 16: Register bit offset */
     }
 
     /* set external interrupts to CPU 0 */
-    for (i = 32; i < OS_HWI_MAX_NUM; i += 4) {
+    for (i = 32; i < OS_HWI_MAX_NUM; i += 4) { /* 32: Start interrupt number, 4: Interrupt bit width */
         GIC_REG_32(GICD_ITARGETSR(i / 4)) = 0x01010101;
     }
 
     /* set priority on all interrupts */
-    for (i = 0; i < OS_HWI_MAX_NUM; i += 4) {
+    for (i = 0; i < OS_HWI_MAX_NUM; i += 4) { /* 4: Interrupt bit width */
         GIC_REG_32(GICD_IPRIORITYR(i / 4)) = GICD_INT_DEF_PRI_X4;
     }
 
     /* disable all interrupts. */
-    for (i = 0; i < OS_HWI_MAX_NUM; i += 32) {
-        GIC_REG_32(GICD_ICENABLER(i / 32)) = ~0;
+    for (i = 0; i < OS_HWI_MAX_NUM; i += 32) { /* 32: Interrupt bit width */
+        GIC_REG_32(GICD_ICENABLER(i / 32)) = ~0; /* 32: Interrupt bit width */
     }
 
     HalIrqInitPercpu();
diff --git a/arch/arm/gic/gic_v3.c b/arch/arm/gic/gic_v3.c
index bbb83012..50039776 100644
--- a/arch/arm/gic/gic_v3.c
+++ b/arch/arm/gic/gic_v3.c
@@ -42,9 +42,9 @@ STATIC UINT32 g_curIrqNum = 0;
 
 STATIC INLINE UINT64 MpidrToAffinity(UINT64 mpidr)
 {
-    return ((MPIDR_AFF_LEVEL(mpidr, 3) << 32) |
-            (MPIDR_AFF_LEVEL(mpidr, 2) << 16) |
-            (MPIDR_AFF_LEVEL(mpidr, 1) << 8)  |
+    return ((MPIDR_AFF_LEVEL(mpidr, 3) << 32) | /* 3: Serial number, 32: Register bit offset */
+            (MPIDR_AFF_LEVEL(mpidr, 2) << 16) | /* 2: Serial number, 16: Register bit offset */
+            (MPIDR_AFF_LEVEL(mpidr, 1) << 8)  | /* 1: Serial number, 8: Register bit offset */
             (MPIDR_AFF_LEVEL(mpidr, 0)));
 }
 
@@ -106,10 +106,10 @@ STATIC VOID GicSgi(UINT32 irq, UINT32 cpuMask)
             tList = GicTargetList(&cpu, cpuMask, cluster);
 
             /* Generates a Group 1 interrupt for the current security state */
-            val = ((MPIDR_AFF_LEVEL(cluster, 3) << 48) |
-                   (MPIDR_AFF_LEVEL(cluster, 2) << 32) |
-                   (MPIDR_AFF_LEVEL(cluster, 1) << 16) |
-                   (irq << 24) | tList);
+            val = ((MPIDR_AFF_LEVEL(cluster, 3) << 48) | /* 3: Serial number, 48: Register bit offset */
+                   (MPIDR_AFF_LEVEL(cluster, 2) << 32) | /* 2: Serial number, 32: Register bit offset */
+                   (MPIDR_AFF_LEVEL(cluster, 1) << 16) | /* 1: Serial number, 16: Register bit offset */
+                   (irq << 24) | tList); /* 24: Register bit offset */
 
             GiccSetSgi1r(val);
         }
@@ -150,9 +150,9 @@ STATIC INLINE VOID GicdSetGroup(UINT32 irq)
 {
     /* configure spi as group 0 on secure mode and group 1 on unsecure mode */
 #ifdef LOSCFG_ARCH_SECURE_MONITOR_MODE
-    GIC_REG_32(GICD_IGROUPR(irq / 32)) = 0;
+    GIC_REG_32(GICD_IGROUPR(irq / 32)) = 0; /* 32: Interrupt bit width */
 #else
-    GIC_REG_32(GICD_IGROUPR(irq / 32)) = 0xffffffff;
+    GIC_REG_32(GICD_IGROUPR(irq / 32)) = 0xffffffff; /* 32: Interrupt bit width */
 #endif
 }
 
@@ -248,13 +248,13 @@ UINT32 HalCurIrqGet(VOID)
 VOID HalIrqMask(UINT32 vector)
 {
     INT32 i;
-    const UINT32 mask = 1U << (vector % 32);
+    const UINT32 mask = 1U << (vector % 32); /* 32: Interrupt bit width */
 
     if ((vector > OS_USER_HWI_MAX) || (vector < OS_USER_HWI_MIN)) {
         return;
     }
 
-    if (vector < 32) {
+    if (vector < 32) { /* 32: Interrupt bit width */
         for (i = 0; i < LOSCFG_KERNEL_CORE_NUM; i++) {
             GIC_REG_32(GICR_ICENABLER0(i)) = mask;
             GicWaitForRwp(GICR_CTLR(i));
@@ -268,19 +268,19 @@ VOID HalIrqMask(UINT32 vector)
 VOID HalIrqUnmask(UINT32 vector)
 {
     INT32 i;
-    const UINT32 mask = 1U << (vector % 32);
+    const UINT32 mask = 1U << (vector % 32); /* 32: Interrupt bit width */
 
     if ((vector > OS_USER_HWI_MAX) || (vector < OS_USER_HWI_MIN)) {
         return;
     }
 
-    if (vector < 32) {
+    if (vector < 32) { /* 32: Interrupt bit width */
         for (i = 0; i < LOSCFG_KERNEL_CORE_NUM; i++) {
             GIC_REG_32(GICR_ISENABLER0(i)) = mask;
             GicWaitForRwp(GICR_CTLR(i));
         }
     } else {
-        GIC_REG_32(GICD_ISENABLER(vector >> 5)) = mask;
+        GIC_REG_32(GICD_ISENABLER(vector >> 5)) = mask; /* 5: Register bit offset */
         GicWaitForRwp(GICD_CTLR);
     }
 }
@@ -291,7 +291,7 @@ VOID HalIrqPending(UINT32 vector)
         return;
     }
 
-    GIC_REG_32(GICD_ISPENDR(vector >> 5)) = 1U << (vector % 32);
+    GIC_REG_32(GICD_ISPENDR(vector >> 5)) = 1U << (vector % 32); /* 5: Register bit offset, 32: Interrupt bit width */
 }
 
 VOID HalIrqClear(UINT32 vector)
@@ -363,29 +363,29 @@ VOID HalIrqInit(VOID)
     ISB;
 
     /* set external interrupts to be level triggered, active low. */
-    for (i = 32; i < OS_HWI_MAX_NUM; i += 16) {
+    for (i = 32; i < OS_HWI_MAX_NUM; i += 16) { /* 32: Start interrupt number, 16: Interrupt bit width */
         GIC_REG_32(GICD_ICFGR(i / 16)) = 0;
     }
 
     /* config distributer, mask and clear all spis, set group x */
-    for (i = 32; i < OS_HWI_MAX_NUM; i += 32) {
-        GIC_REG_32(GICD_ICENABLER(i / 32)) = 0xffffffff;
-        GIC_REG_32(GICD_ICPENDR(i / 32)) = 0xffffffff;
-        GIC_REG_32(GICD_IGRPMODR(i / 32)) = 0;
+    for (i = 32; i < OS_HWI_MAX_NUM; i += 32) { /* 32: Start interrupt number, 32: Interrupt bit width */
+        GIC_REG_32(GICD_ICENABLER(i / 32)) = 0xffffffff; /* 32: Interrupt bit width */
+        GIC_REG_32(GICD_ICPENDR(i / 32)) = 0xffffffff; /* 32: Interrupt bit width */
+        GIC_REG_32(GICD_IGRPMODR(i / 32)) = 0; /* 32: Interrupt bit width */
 
         GicdSetGroup(i);
     }
 
     /* set spi priority as default */
-    for (i = 32; i < OS_HWI_MAX_NUM; i++) {
+    for (i = 32; i < OS_HWI_MAX_NUM; i++) { /* 32: Start interrupt number */
         GicdSetPmr(i, MIN_INTERRUPT_PRIORITY);
     }
 
     GicWaitForRwp(GICD_CTLR);
 
     /* disable all interrupts. */
-    for (i = 0; i < OS_HWI_MAX_NUM; i += 32) {
-        GIC_REG_32(GICD_ICENABLER(i / 32)) = 0xffffffff;
+    for (i = 0; i < OS_HWI_MAX_NUM; i += 32) { /* 32: Interrupt bit width */
+        GIC_REG_32(GICD_ICENABLER(i / 32)) = 0xffffffff; /* 32: Interrupt bit width */
     }
 
     /* enable distributor with ARE, group 1 enabled */
@@ -393,7 +393,7 @@ VOID HalIrqInit(VOID)
 
     /* set spi to boot cpu only. ARE must be enabled */
     affinity = MpidrToAffinity(AARCH64_SYSREG_READ(mpidr_el1));
-    for (i = 32; i < OS_HWI_MAX_NUM; i++) {
+    for (i = 32; i < OS_HWI_MAX_NUM; i++) { /* 32: Start interrupt number */
         GIC_REG_64(GICD_IROUTER(i)) = affinity;
     }
 
diff --git a/fs/vfs/epoll/fs_epoll.c b/fs/vfs/epoll/fs_epoll.c
old mode 100755
new mode 100644
index 1eeec53a..8591d612
--- a/fs/vfs/epoll/fs_epoll.c
+++ b/fs/vfs/epoll/fs_epoll.c
@@ -242,6 +242,11 @@ int epoll_ctl(int epfd, int op, int fd, struct epoll_event *ev)
         return ret;
     }
 
+    if (ev == NULL) {
+        set_errno(EINVAL);
+        return -1;
+    }
+
     switch (op) {
         case EPOLL_CTL_ADD:
             ret = CheckFdExist(epHead, fd);
@@ -304,7 +309,7 @@ int epoll_wait(int epfd, FAR struct epoll_event *evs, int maxevents, int timeout
         return -1;
     }
 
-    if (maxevents <= 0) {
+    if ((maxevents <= 0) || (evs == NULL)) {
         set_errno(EINVAL);
         return -1;
     }
diff --git a/fs/vfs/vnode.c b/fs/vfs/vnode.c
index c85665ac..534eca27 100644
--- a/fs/vfs/vnode.c
+++ b/fs/vfs/vnode.c
@@ -198,7 +198,7 @@ int VnodeFree(struct Vnode *vnode)
         g_totalVnodeSize--;
     } else {
         /* for normal vnode, reclaim it to g_VnodeFreeList */
-        memset_s(vnode, sizeof(struct Vnode), 0, sizeof(struct Vnode));
+        (void)memset_s(vnode, sizeof(struct Vnode), 0, sizeof(struct Vnode));
         LOS_ListAdd(&g_vnodeFreeList, &vnode->actFreeEntry);
         g_freeVnodeSize++;
     }
@@ -380,6 +380,11 @@ int VnodeLookupAt(const char *path, struct Vnode **result, uint32_t flags, struc
     if (orgVnode != NULL) {
         startVnode = orgVnode;
         normalizedPath = strdup(path);
+        if (normalizedPath == NULL) {
+            PRINT_ERR("[VFS]lookup failed, strdup err\n");
+            ret = -EINVAL;
+            goto OUT_FREE_PATH;
+        }
     } else {
         ret = PreProcess(path, &startVnode, &normalizedPath);
         if (ret != LOS_OK) {
diff --git a/kernel/base/core/los_swtmr.c b/kernel/base/core/los_swtmr.c
index 1c7b6bfb..5378633e 100644
--- a/kernel/base/core/los_swtmr.c
+++ b/kernel/base/core/los_swtmr.c
@@ -168,6 +168,10 @@ LITE_OS_SEC_TEXT_INIT UINT32 OsSwtmrInit(VOID)
     return LOS_OK;
 
 ERROR:
+    (VOID)LOS_MemFree(m_aucSysMem0, g_swtmrCBArray);
+    g_swtmrCBArray = NULL;
+    (VOID)LOS_MemFree(m_aucSysMem1, g_swtmrHandlerPool);
+    g_swtmrHandlerPool = NULL;
     PRINT_ERR("OsSwtmrInit error! ret = %u\n", ret);
     return ret;
 }
diff --git a/kernel/base/core/los_task.c b/kernel/base/core/los_task.c
index 47566f14..c8c0cf85 100644
--- a/kernel/base/core/los_task.c
+++ b/kernel/base/core/los_task.c
@@ -279,7 +279,7 @@ STATIC INLINE UINT32 OsTaskSyncWait(const LosTaskCB *taskCB)
      * triggered right at the timeout has reached, we set the timeout as double
      * of the gc period.
      */
-    if (LOS_SemPend(taskCB->syncSignal, OS_MP_GC_PERIOD * 2) != LOS_OK) {
+    if (LOS_SemPend(taskCB->syncSignal, OS_MP_GC_PERIOD * 2) != LOS_OK) { /* 2: Wait 200 ms */
         ret = LOS_ERRNO_TSK_MP_SYNC_FAILED;
     }
 
diff --git a/kernel/base/include/los_memory_pri.h b/kernel/base/include/los_memory_pri.h
index b9fc707f..11632870 100644
--- a/kernel/base/include/los_memory_pri.h
+++ b/kernel/base/include/los_memory_pri.h
@@ -54,7 +54,7 @@ extern BOOL OsMemIsHeapNode(const VOID *ptr);
 extern UINT32 OsShellCmdMemCheck(INT32 argc, const CHAR *argv[]);
 
 /* memory expand size at least 1/8 of pool size if we can */
-#define MEM_EXPAND_SIZE(poolSize)     (poolSize >> 3)
+#define MEM_EXPAND_SIZE(poolSize)     ((poolSize) >> 3)
 
 #ifdef __cplusplus
 #if __cplusplus
diff --git a/kernel/base/include/los_vm_phys.h b/kernel/base/include/los_vm_phys.h
index f367abef..75bcab08 100644
--- a/kernel/base/include/los_vm_phys.h
+++ b/kernel/base/include/los_vm_phys.h
@@ -50,7 +50,7 @@ extern "C" {
 #define min(x, y) ((x) < (y) ? (x) : (y))
 #endif
 
-#define VM_PAGE_TO_PHYS(page)    (page->physAddr)
+#define VM_PAGE_TO_PHYS(page)    ((page)->physAddr)
 #define VM_ORDER_TO_PAGES(order) (1 << (order))
 #define VM_ORDER_TO_PHYS(order)  (1 << (PAGE_SHIFT + (order)))
 #define VM_PHYS_TO_ORDER(phys)   (min(LOS_LowBitGet((phys) >> PAGE_SHIFT), VM_LIST_ORDER_MAX - 1))
diff --git a/kernel/base/include/los_vm_zone.h b/kernel/base/include/los_vm_zone.h
index e69cf774..3e3a9938 100644
--- a/kernel/base/include/los_vm_zone.h
+++ b/kernel/base/include/los_vm_zone.h
@@ -86,18 +86,18 @@ extern "C" {
 #define PERIPH_UNCACHED_SIZE    U32_C(PERIPH_PMM_SIZE)
 #endif
 
-#define IO_DEVICE_ADDR(paddr)        (paddr - PERIPH_PMM_BASE + PERIPH_DEVICE_BASE)
-#define IO_CACHED_ADDR(paddr)        (paddr - PERIPH_PMM_BASE + PERIPH_CACHED_BASE)
-#define IO_UNCACHED_ADDR(paddr)      (paddr - PERIPH_PMM_BASE + PERIPH_UNCACHED_BASE)
+#define IO_DEVICE_ADDR(paddr)        ((paddr) - PERIPH_PMM_BASE + PERIPH_DEVICE_BASE)
+#define IO_CACHED_ADDR(paddr)        ((paddr) - PERIPH_PMM_BASE + PERIPH_CACHED_BASE)
+#define IO_UNCACHED_ADDR(paddr)      ((paddr) - PERIPH_PMM_BASE + PERIPH_UNCACHED_BASE)
 
-#define MEM_CACHED_ADDR(paddr)       (paddr - DDR_MEM_ADDR + KERNEL_VMM_BASE)
-#define MEM_UNCACHED_ADDR(paddr)     (paddr - DDR_MEM_ADDR + UNCACHED_VMM_BASE)
+#define MEM_CACHED_ADDR(paddr)       ((paddr) - DDR_MEM_ADDR + KERNEL_VMM_BASE)
+#define MEM_UNCACHED_ADDR(paddr)     ((paddr) - DDR_MEM_ADDR + UNCACHED_VMM_BASE)
 
-#define VMM_TO_UNCACHED_ADDR(vaddr)  (vaddr - KERNEL_VMM_BASE + UNCACHED_VMM_BASE)
-#define UNCACHED_TO_VMM_ADDR(vaddr)  (vaddr - UNCACHED_VMM_BASE + KERNEL_VMM_BASE)
+#define VMM_TO_UNCACHED_ADDR(vaddr)  ((vaddr) - KERNEL_VMM_BASE + UNCACHED_VMM_BASE)
+#define UNCACHED_TO_VMM_ADDR(vaddr)  ((vaddr) - UNCACHED_VMM_BASE + KERNEL_VMM_BASE)
 
-#define VMM_TO_DMA_ADDR(vaddr)  (vaddr - KERNEL_VMM_BASE + SYS_MEM_BASE)
-#define DMA_TO_VMM_ADDR(vaddr)  (vaddr - SYS_MEM_BASE + KERNEL_VMM_BASE)
+#define VMM_TO_DMA_ADDR(vaddr)  ((vaddr) - KERNEL_VMM_BASE + SYS_MEM_BASE)
+#define DMA_TO_VMM_ADDR(vaddr)  ((vaddr) - SYS_MEM_BASE + KERNEL_VMM_BASE)
 
 #if (PERIPH_UNCACHED_BASE >= (0xFFFFFFFFU - PERIPH_UNCACHED_SIZE))
 #error "Kernel virtual memory space has overflowed!"
diff --git a/kernel/base/mem/tlsf/los_memory.c b/kernel/base/mem/tlsf/los_memory.c
index 7f6ea21a..92e19659 100644
--- a/kernel/base/mem/tlsf/los_memory.c
+++ b/kernel/base/mem/tlsf/los_memory.c
@@ -636,7 +636,7 @@ STATIC INLINE UINT32 OsMemFreeListIndexGet(UINT32 size)
 }
 
 STATIC INLINE struct OsMemFreeNodeHead *OsMemFindCurSuitableBlock(struct OsMemPoolHead *poolHead,
-                                        UINT32 index, UINT32 size)
+                                                                  UINT32 index, UINT32 size)
 {
     struct OsMemFreeNodeHead *node = NULL;
 
@@ -649,9 +649,12 @@ STATIC INLINE struct OsMemFreeNodeHead *OsMemFindCurSuitableBlock(struct OsMemPo
     return NULL;
 }
 
+#define BITMAP_INDEX(index) ((index) >> 5)
 STATIC INLINE UINT32 OsMemNotEmptyIndexGet(struct OsMemPoolHead *poolHead, UINT32 index)
 {
-    UINT32 mask = poolHead->freeListBitmap[index >> 5]; /* 5: Divide by 32 to calculate the index of the bitmap array. */
+    UINT32 mask;
+
+    mask = poolHead->freeListBitmap[BITMAP_INDEX(index)];
     mask &= ~((1 << (index & OS_MEM_BITMAP_MASK)) - 1);
     if (mask != 0) {
         index = OsMemFFS(mask) + (index & ~OS_MEM_BITMAP_MASK);
@@ -685,8 +688,8 @@ STATIC INLINE struct OsMemFreeNodeHead *OsMemFindNextSuitableBlock(VOID *pool, U
             goto DONE;
         }
 
-        for (index = LOS_Align(index + 1, 32); index < OS_MEM_FREE_LIST_COUNT; index += 32) {
-            mask = poolHead->freeListBitmap[index >> 5]; /* 5: Divide by 32 to calculate the index of the bitmap array. */
+        for (index = LOS_Align(index + 1, 32); index < OS_MEM_FREE_LIST_COUNT; index += 32) { /* 32: align size */
+            mask = poolHead->freeListBitmap[BITMAP_INDEX(index)];
             if (mask != 0) {
                 index = OsMemFFS(mask) + index;
                 goto DONE;
@@ -707,12 +710,12 @@ DONE:
 
 STATIC INLINE VOID OsMemSetFreeListBit(struct OsMemPoolHead *head, UINT32 index)
 {
-    head->freeListBitmap[index >> 5] |= 1U << (index & 0x1f); /* 5: Divide by 32 to calculate the index of the bitmap array. */
+    head->freeListBitmap[BITMAP_INDEX(index)] |= 1U << (index & 0x1f);
 }
 
 STATIC INLINE VOID OsMemClearFreeListBit(struct OsMemPoolHead *head, UINT32 index)
 {
-    head->freeListBitmap[index >> 5] &= ~(1U << (index & 0x1f)); /* 5: Divide by 32 to calculate the index of the bitmap array. */
+    head->freeListBitmap[BITMAP_INDEX(index)] &= ~(1U << (index & 0x1f));
 }
 
 STATIC INLINE VOID OsMemListAdd(struct OsMemPoolHead *pool, UINT32 listIndex, struct OsMemFreeNodeHead *node)
@@ -1183,42 +1186,45 @@ STATIC INLINE BOOL OsMemIsNodeValid(const struct OsMemNodeHead *node, const stru
     return TRUE;
 }
 
+STATIC  BOOL MemCheckUsedNode(const struct OsMemPoolHead *pool, const struct OsMemNodeHead *node,
+                              const struct OsMemNodeHead *startNode, const struct OsMemNodeHead *endNode)
+{
+    if (!OsMemIsNodeValid(node, startNode, endNode, pool)) {
+        return FALSE;
+    }
+
+    if (!OS_MEM_NODE_GET_USED_FLAG(node->sizeAndFlag)) {
+        return FALSE;
+    }
+
+    const struct OsMemNodeHead *nextNode = OS_MEM_NEXT_NODE(node);
+    if (!OsMemIsNodeValid(nextNode, startNode, endNode, pool)) {
+        return FALSE;
+    }
+
+    if (!OS_MEM_NODE_GET_LAST_FLAG(nextNode->sizeAndFlag)) {
+        if (nextNode->ptr.prev != node) {
+            return FALSE;
+        }
+    }
+
+    if ((node != startNode) &&
+        ((!OsMemIsNodeValid(node->ptr.prev, startNode, endNode, pool)) ||
+        (OS_MEM_NEXT_NODE(node->ptr.prev) != node))) {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
 STATIC UINT32 OsMemCheckUsedNode(const struct OsMemPoolHead *pool, const struct OsMemNodeHead *node)
 {
     struct OsMemNodeHead *startNode = (struct OsMemNodeHead *)OS_MEM_FIRST_NODE(pool);
     struct OsMemNodeHead *endNode = (struct OsMemNodeHead *)OS_MEM_END_NODE(pool, pool->info.totalSize);
-    struct OsMemNodeHead *nextNode = NULL;
     BOOL doneFlag = FALSE;
 
     do {
-        do {
-            if (!OsMemIsNodeValid(node, startNode, endNode, pool)) {
-                break;
-            }
-
-            if (!OS_MEM_NODE_GET_USED_FLAG(node->sizeAndFlag)) {
-                break;
-            }
-
-            nextNode = OS_MEM_NEXT_NODE(node);
-            if (!OsMemIsNodeValid(nextNode, startNode, endNode, pool)) {
-                break;
-            }
-
-            if (!OS_MEM_NODE_GET_LAST_FLAG(nextNode->sizeAndFlag)) {
-                if (nextNode->ptr.prev != node) {
-                    break;
-                }
-            }
-
-            if ((node != startNode) &&
-                ((!OsMemIsNodeValid(node->ptr.prev, startNode, endNode, pool)) ||
-                (OS_MEM_NEXT_NODE(node->ptr.prev) != node))) {
-                break;
-            }
-            doneFlag = TRUE;
-        } while (0);
-
+        doneFlag = MemCheckUsedNode(pool, node, startNode, endNode);
         if (!doneFlag) {
 #if OS_MEM_EXPAND_ENABLE
             if (OsMemIsLastSentinelNode(endNode) == FALSE) {
@@ -1291,16 +1297,17 @@ STATIC INLINE UINT32 OsMemFree(struct OsMemPoolHead *pool, struct OsMemNodeHead
 
 UINT32 LOS_MemFree(VOID *pool, VOID *ptr)
 {
+    UINT32 intSave;
+    UINT32 ret = LOS_NOK;
+
     if ((pool == NULL) || (ptr == NULL) || !OS_MEM_IS_ALIGNED(pool, sizeof(VOID *)) ||
         !OS_MEM_IS_ALIGNED(ptr, sizeof(VOID *))) {
-        return LOS_NOK;
+        return ret;
     }
     OsHookCall(LOS_HOOK_TYPE_MEM_FREE, pool, ptr);
 
-    UINT32 ret = LOS_NOK;
     struct OsMemPoolHead *poolHead = (struct OsMemPoolHead *)pool;
     struct OsMemNodeHead *node = NULL;
-    UINT32 intSave;
 
     do {
         UINT32 gapSize = *(UINT32 *)((UINTPTR)ptr - sizeof(UINT32));
@@ -1397,7 +1404,7 @@ STATIC INLINE VOID *OsGetRealPtr(const VOID *pool, VOID *ptr)
 }
 
 STATIC INLINE VOID *OsMemRealloc(struct OsMemPoolHead *pool, const VOID *ptr,
-                struct OsMemNodeHead *node, UINT32 size, UINT32 intSave)
+                                 struct OsMemNodeHead *node, UINT32 size, UINT32 intSave)
 {
     struct OsMemNodeHead *nextNode = NULL;
     UINT32 allocSize = OS_MEM_ALIGN(size + OS_MEM_NODE_HEAD_SIZE, OS_MEM_ALIGN_SIZE);
@@ -1619,7 +1626,7 @@ STATIC UINT32 OsMemAddrValidCheckPrint(const VOID *pool, struct OsMemFreeNodeHea
 }
 
 STATIC UINT32 OsMemIntegrityCheckSub(struct OsMemNodeHead **tmpNode, const VOID *pool,
-                const struct OsMemNodeHead *endNode)
+                                     const struct OsMemNodeHead *endNode)
 {
     if (!OS_MEM_MAGIC_VALID(*tmpNode)) {
         OsMemMagicCheckPrint(tmpNode);
@@ -1635,7 +1642,7 @@ STATIC UINT32 OsMemIntegrityCheckSub(struct OsMemNodeHead **tmpNode, const VOID
 }
 
 STATIC UINT32 OsMemFreeListNodeCheck(const struct OsMemPoolHead *pool,
-                const struct OsMemFreeNodeHead *node)
+                                     const struct OsMemFreeNodeHead *node)
 {
     if (!OsMemAddrValidCheck(pool, node) ||
         !OsMemAddrValidCheck(pool, node->prev) ||
@@ -1698,7 +1705,7 @@ OUT:
 }
 
 STATIC UINT32 OsMemIntegrityCheck(const struct OsMemPoolHead *pool, struct OsMemNodeHead **tmpNode,
-                struct OsMemNodeHead **preNode)
+                                  struct OsMemNodeHead **preNode)
 {
     struct OsMemNodeHead *endNode = OS_MEM_END_NODE(pool, pool->info.totalSize);
 
@@ -1846,7 +1853,7 @@ ERROR_OUT:
 }
 
 STATIC INLINE VOID OsMemInfoGet(struct OsMemPoolHead *poolInfo, struct OsMemNodeHead *node,
-                LOS_MEM_POOL_STATUS *poolStatus)
+                                LOS_MEM_POOL_STATUS *poolStatus)
 {
     UINT32 totalUsedSize = 0;
     UINT32 totalFreeSize = 0;
@@ -1994,8 +2001,10 @@ UINT32 LOS_MemFreeNodeShow(VOID *pool)
         } else {
             UINT32 val = 1 << (((index - OS_MEM_SMALL_BUCKET_COUNT) >> OS_MEM_SLI) + OS_MEM_LARGE_START_BUCKET);
             UINT32 offset = val >> OS_MEM_SLI;
-            PRINTK("size: [%#x, %#x], num: %u\n", (offset * ((index - OS_MEM_SMALL_BUCKET_COUNT) % (1 << OS_MEM_SLI))) + val,
-                    ((offset * (((index - OS_MEM_SMALL_BUCKET_COUNT) % (1 << OS_MEM_SLI)) + 1)) + val - 1), countNum[index]);
+            PRINTK("size: [%#x, %#x], num: %u\n",
+                   (offset * ((index - OS_MEM_SMALL_BUCKET_COUNT) % (1 << OS_MEM_SLI))) + val,
+                   ((offset * (((index - OS_MEM_SMALL_BUCKET_COUNT) % (1 << OS_MEM_SLI)) + 1)) + val - 1),
+                   countNum[index]);
         }
     }
     PRINTK("\n   ********************************************************************\n\n");
diff --git a/kernel/base/sched/sched_sq/los_sched.c b/kernel/base/sched/sched_sq/los_sched.c
index c0a47100..e4f78d91 100644
--- a/kernel/base/sched/sched_sq/los_sched.c
+++ b/kernel/base/sched/sched_sq/los_sched.c
@@ -169,6 +169,29 @@ UINT32 OsShellShowTickRespo(VOID)
 #endif
 
 #ifdef LOSCFG_SCHED_DEBUG
+STATIC VOID SchedDataGet(LosTaskCB *taskCB, UINT64 *runTime, UINT64 *timeSlice, UINT64 *pendTime, UINT64 *schedWait)
+{
+    if (taskCB->schedStat.switchCount >= 1) {
+        UINT64 averRunTime = taskCB->schedStat.runTime / taskCB->schedStat.switchCount;
+        *runTime = (averRunTime * OS_NS_PER_CYCLE) / OS_SYS_NS_PER_US;
+    }
+
+    if (taskCB->schedStat.timeSliceCount > 1) {
+        UINT64 averTimeSlice = taskCB->schedStat.timeSliceTime / (taskCB->schedStat.timeSliceCount - 1);
+        *timeSlice = (averTimeSlice * OS_NS_PER_CYCLE) / OS_SYS_NS_PER_US;
+    }
+
+    if (taskCB->schedStat.pendCount > 1) {
+        UINT64 averPendTime = taskCB->schedStat.pendTime / taskCB->schedStat.pendCount;
+        *pendTime = (averPendTime * OS_NS_PER_CYCLE) / OS_SYS_NS_PER_US;
+    }
+
+    if (taskCB->schedStat.waitSchedCount > 0) {
+        UINT64 averSchedWait = taskCB->schedStat.waitSchedTime / taskCB->schedStat.waitSchedCount;
+        *schedWait = (averSchedWait * OS_NS_PER_CYCLE) / OS_SYS_NS_PER_US;
+    }
+}
+
 UINT32 OsShellShowSchedParam(VOID)
 {
     UINT64 averRunTime;
@@ -198,25 +221,7 @@ UINT32 OsShellShowSchedParam(VOID)
         averPendTime = 0;
         averSchedWait = 0;
 
-        if (taskCB->schedStat.switchCount >= 1) {
-            averRunTime = taskCB->schedStat.runTime / taskCB->schedStat.switchCount;
-            averRunTime = (averRunTime * OS_NS_PER_CYCLE) / OS_SYS_NS_PER_US;
-        }
-
-        if (taskCB->schedStat.timeSliceCount > 1) {
-            averTimeSlice = taskCB->schedStat.timeSliceTime / (taskCB->schedStat.timeSliceCount - 1);
-            averTimeSlice = (averTimeSlice * OS_NS_PER_CYCLE) / OS_SYS_NS_PER_US;
-        }
-
-        if (taskCB->schedStat.pendCount > 1) {
-            averPendTime = taskCB->schedStat.pendTime / taskCB->schedStat.pendCount;
-            averPendTime = (averPendTime * OS_NS_PER_CYCLE) / OS_SYS_NS_PER_US;
-        }
-
-        if (taskCB->schedStat.waitSchedCount > 0) {
-            averSchedWait = taskCB->schedStat.waitSchedTime / taskCB->schedStat.waitSchedCount;
-            averSchedWait = (averSchedWait * OS_NS_PER_CYCLE) / OS_SYS_NS_PER_US;
-        }
+        SchedDataGet(taskCB, &averRunTime, &averTimeSlice, &averPendTime, &averSchedWait);
 
         PRINTK("%5u%19llu%15llu%19llu%18llu%19llu%18llu  %-32s\n", taskCB->taskID,
                averRunTime, taskCB->schedStat.switchCount,
@@ -578,7 +583,7 @@ BOOL OsSchedModifyTaskSchedParam(LosTaskCB *taskCB, UINT16 policy, UINT16 priori
     }
 
     taskCB->priority = priority;
-    OsHookCall(LOS_HOOK_TYPE_TASK_PRIMODIFY, taskCB, taskCB->priority); 
+    OsHookCall(LOS_HOOK_TYPE_TASK_PRIMODIFY, taskCB, taskCB->priority);
     if (taskCB->taskStatus & OS_TASK_STATUS_INIT) {
         OsSchedTaskEnQueue(taskCB);
         return TRUE;
@@ -771,7 +776,9 @@ BOOL OsSchedSwtmrTimeListFind(SCHED_TL_FIND_FUNC checkFunc, UINTPTR arg)
     for (UINT16 cpuid = 0; cpuid < LOSCFG_KERNEL_CORE_NUM; cpuid++) {
         SchedRunQue *rq = OsSchedRunQueByID(cpuid);
         SortLinkAttribute *swtmrSortLink = &rq->swtmrSortLink;
-        return SchedSwtmrRunQueFind(swtmrSortLink, checkFunc, arg);
+        if (SchedSwtmrRunQueFind(swtmrSortLink, checkFunc, arg)) {
+            return TRUE;
+        }
     }
     return FALSE;
 }
diff --git a/kernel/extended/trace/pipeline/trace_pipeline.c b/kernel/extended/trace/pipeline/trace_pipeline.c
index b28d97f9..6ec57213 100644
--- a/kernel/extended/trace/pipeline/trace_pipeline.c
+++ b/kernel/extended/trace/pipeline/trace_pipeline.c
@@ -132,7 +132,7 @@ VOID OsTraceDataSend(UINT8 type, UINT16 len, UINT8 *data)
     UINT32 intSave;
     UINT8 outBuf[LOSCFG_TRACE_TLV_BUF_SIZE] = {0};
 
-    if ((type > TRACE_MSG_MAX) || (len > LOSCFG_TRACE_TLV_BUF_SIZE)) {
+    if ((type >= TRACE_MSG_MAX) || (len > LOSCFG_TRACE_TLV_BUF_SIZE)) {
         return;
     }
 
diff --git a/net/lwip-2.1/porting/src/sockets.c b/net/lwip-2.1/porting/src/sockets.c
index ae3be4f5..cd7cd8a5 100644
--- a/net/lwip-2.1/porting/src/sockets.c
+++ b/net/lwip-2.1/porting/src/sockets.c
@@ -1506,7 +1506,7 @@ static int do_ioctl_SIOCGIFCONF(int sockfd, long cmd, void *argp)
         return -1;
     }
     nbytes = ifc.ifc_len;
-    if (nbytes < 0) {
+    if (nbytes <= 0) {
         set_errno(EINVAL);
         return -1;
     }
diff --git a/shell/full/include/shell_lk.h b/shell/full/include/shell_lk.h
index 4dd13833..6bf90828 100644
--- a/shell/full/include/shell_lk.h
+++ b/shell/full/include/shell_lk.h
@@ -62,7 +62,7 @@ extern "C" {
  * @param  level    [IN] print level.
  * @param  func     [IN] means which func calls print func.
  * @param  line     [IN] means which line calls print func.
- * @param  fmt      [IN] other infomation by user define.
+ * @param  fmt      [IN] other information by user define.
  * @param  ap       [IN] the para list.
  *
  * @retval None.
@@ -85,7 +85,7 @@ typedef VOID (*LK_FUNC)(INT32 level, const CHAR *func, INT32 line, const CHAR *f
  * @param  level    [IN] print level.
  * @param  func     [IN] means which func calls print func.
  * @param  line     [IN] means which line calls print func.
- * @param  fmt      [IN] other infomation by user define
+ * @param  fmt      [IN] other information by user define
  *
  * @retval NONE
  * @par Dependency:
diff --git a/shell/full/src/base/shcmd.c b/shell/full/src/base/shcmd.c
index db836925..9e6e7894 100644
--- a/shell/full/src/base/shcmd.c
+++ b/shell/full/src/base/shcmd.c
@@ -424,7 +424,7 @@ STATIC INT32 OsTabMatchFile(CHAR *cmdKey, UINT32 *len)
  * Description: Pass in the string and clear useless space, which include:
  *                1) The overmatch space which is not be marked by Quote's area
  *                   Squeeze the overmatch space into one space
- *                2) Clear all space before first valid charatctor
+ *                2) Clear all space before first valid character
  * Input:       cmdKey : Pass in the buff string, which is ready to be operated
  *              cmdOut : Pass out the buffer string ,which has already been operated
  *              size : cmdKey length
@@ -452,17 +452,17 @@ LITE_OS_SEC_TEXT_MINOR UINT32 OsCmdKeyShift(const CHAR *cmdKey, CHAR *cmdOut, UI
     }
     /* Backup the 'output' start address */
     outputBak = output;
-    /* Scan each charactor in 'cmdKey',and squeeze the overmuch space and ignore invalid charactor */
+    /* Scan each character in 'cmdKey',and squeeze the overmuch space and ignore invalid character */
     for (; *cmdKey != '\0'; cmdKey++) {
         /* Detected a Double Quotes, switch the matching status */
         if (*(cmdKey) == '\"') {
             SWITCH_QUOTES_STATUS(quotes);
         }
-        /* Ignore the current charactor in following situation */
+        /* Ignore the current character in following situation */
         /* 1) Quotes matching status is FALSE (which said that the space is not been marked by double quotes) */
-        /* 2) Current charactor is a space */
-        /* 3) Next charactor is a space too, or the string is been seeked to the end already(\0) */
-        /* 4) Invalid charactor, such as single quotes */
+        /* 2) Current character is a space */
+        /* 3) Next character is a space too, or the string is been seeked to the end already(\0) */
+        /* 4) Invalid character, such as single quotes */
         if ((*cmdKey == ' ') && ((*(cmdKey + 1) == ' ') || (*(cmdKey + 1) == '\0')) && QUOTES_STATUS_CLOSE(quotes)) {
             continue;
         }
@@ -476,7 +476,7 @@ LITE_OS_SEC_TEXT_MINOR UINT32 OsCmdKeyShift(const CHAR *cmdKey, CHAR *cmdOut, UI
     /* Restore the 'output' start address */
     output = outputBak;
     len = strlen(output);
-    /* Clear the space which is located at the first charactor in buffer */
+    /* Clear the space which is located at the first character in buffer */
     if (*outputBak == ' ') {
         output++;
         len--;
diff --git a/shell/full/src/base/shell_lk.c b/shell/full/src/base/shell_lk.c
index 5cf41387..3320f1d9 100644
--- a/shell/full/src/base/shell_lk.c
+++ b/shell/full/src/base/shell_lk.c
@@ -106,7 +106,7 @@ VOID OsLkLogFileSet(const CHAR *str)
     }
     fp = fopen(str, "w+");
     if (fp == NULL) {
-        printf("Error can't open the %s file\n",str);
+        printf("Error can't open the %s file\n", str);
         return;
     }
 
diff --git a/shell/full/src/base/shmsg.c b/shell/full/src/base/shmsg.c
index 9c92de2f..cf07fa48 100644
--- a/shell/full/src/base/shmsg.c
+++ b/shell/full/src/base/shmsg.c
@@ -250,7 +250,7 @@ STATIC UINT32 ShellMsgNameGetAndExec(CmdParsed *cmdParsed, const CHAR *output, U
             continue;
         }
         /* If detected a space which the quotes matching status is false */
-        /* which said has detected the first space for seperator, finish this scan operation */
+        /* which said has detected the first space for separator, finish this scan operation */
         if ((*tmpStr == ' ') && (QUOTES_STATUS_CLOSE(quotes))) {
             break;
         }
diff --git a/shell/full/src/cmds/hwi_shellcmd.c b/shell/full/src/cmds/hwi_shellcmd.c
index d36aefbf..4a4a062f 100644
--- a/shell/full/src/cmds/hwi_shellcmd.c
+++ b/shell/full/src/cmds/hwi_shellcmd.c
@@ -74,7 +74,7 @@ LITE_OS_SEC_TEXT_MINOR UINT32 OsShellCmdHwi(INT32 argc, const CHAR **argv)
         }
         /* Different cores has different hwi form implementation */
         if (HWI_IS_REGISTED(i)) {
-            PRINTK(" %10d:%11u%11llu", i, count, cycles);
+            PRINTK(" %10u:%11u%11llu", i, count, cycles);
         } else {
             continue;
         }
diff --git a/syscall/fs_syscall.c b/syscall/fs_syscall.c
old mode 100755
new mode 100644
index 99cd5213..40d4c0c2
--- a/syscall/fs_syscall.c
+++ b/syscall/fs_syscall.c
@@ -2570,7 +2570,9 @@ int SysPselect6(int nfds, fd_set *readfds, fd_set *writefds, fd_set *exceptfds,
     CPY_FROM_USER(exceptfds);
     DUP_FROM_USER(timeout, sizeof(struct timeval));
 
-    ((struct timeval *)timeout)->tv_usec = timeout->tv_nsec / 1000; /* 1000, convert ns to us */
+    if (timeout != NULL) {
+        ((struct timeval *)timeout)->tv_usec = timeout->tv_nsec / 1000; /* 1000, convert ns to us */
+    }
 
     if (data != NULL) {
         retVal = LOS_ArchCopyFromUser(&(setl.sig[0]), (int *)((UINTPTR)data[0]), sizeof(sigset_t));
diff --git a/testsuites/unittest/basic/exc/full/it_test_fexecve_001.cpp b/testsuites/unittest/basic/exc/full/it_test_fexecve_001.cpp
index 7aeb897a..af175ad8 100644
--- a/testsuites/unittest/basic/exc/full/it_test_fexecve_001.cpp
+++ b/testsuites/unittest/basic/exc/full/it_test_fexecve_001.cpp
@@ -62,6 +62,7 @@ static int TestCase(void)
     rc = stat("/bin/shell", &st);
     if (rc == -1) {
         perror("stat");
+        close(shmFd);
         return -1;
     }
 
@@ -69,12 +70,14 @@ static int TestCase(void)
     rc = ftruncate(shmFd, st.st_size);
     if (rc == -1) {
         perror("ftruncate");
+        close(shmFd);
         return -1;
     }
 
     p = mmap(nullptr, st.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, shmFd, 0);
     if (p == MAP_FAILED) {
         perror("mmap");
+        close(shmFd);
         return -1;
     }
 
@@ -83,6 +86,7 @@ static int TestCase(void)
     if (fd == -1) {
         perror("openls");
         munmap(p, st.st_size);
+        close(shmFd);
         return -1;
     }