diff --git a/drivers/media/platform/tegra/camera/camera_common.c b/drivers/media/platform/tegra/camera/camera_common.c
index afd1a4b5..7e80a045 100644
--- a/drivers/media/platform/tegra/camera/camera_common.c
+++ b/drivers/media/platform/tegra/camera/camera_common.c
@@ -560,6 +560,9 @@ int camera_common_enum_mbus_code(struct v4l2_subdev *sd,
 	struct tegra_channel *chan = v4l2_get_subdev_hostdata(sd);
 	const struct camera_common_colorfmt *sensor_fmt;
 
+	if (s_data == NULL)
+		return -EINVAL;
+
 	sensor_fmt = find_matching_color_fmt(s_data, code->index);
 
 	if (sensor_fmt == NULL)
@@ -579,6 +582,9 @@ int camera_common_enum_fmt(struct v4l2_subdev *sd, unsigned int index,
 	struct camera_common_data *s_data = to_camera_common_data(sd->dev);
 	const struct camera_common_colorfmt *sensor_fmt;
 
+	if (s_data == NULL)
+		return -EINVAL;
+
 	sensor_fmt = find_matching_color_fmt(s_data, index);
 
 	if (sensor_fmt == NULL)
diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
index f44737ac..ea4b1855 100644
--- a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
+++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
@@ -655,11 +655,19 @@ static uint32_t isp_capture_get_num_stats_progress(
 	struct tegra_isp_channel *chan,
 	struct isp_program_req *req)
 {
+	uint32_t offset = 0U;
 	struct isp_desc_rec *program_desc_ctx =
 		&chan->capture_data->program_desc_ctx;
-	struct isp5_program *program = (struct isp5_program *)
-		(program_desc_ctx->requests.va + sizeof(struct isp_program_descriptor) +
-		req->buffer_index * program_desc_ctx->request_size);
+	struct isp5_program *program = NULL;
+
+	if (__builtin_umul_overflow(req->buffer_index, program_desc_ctx->request_size, &offset)) {
+		dev_dbg(chan->isp_dev,
+			"%s: calculation of the offset failed due to an overflow\n", __func__);
+		return -EOVERFLOW;
+	}
+
+	program = (struct isp5_program *)
+		(program_desc_ctx->requests.va + sizeof(struct isp_program_descriptor) + offset);
 
 	if (!program) {
 		dev_dbg(chan->isp_dev,