diff --git a/drivers/media/platform/tegra/camera/csi/csi.c b/drivers/media/platform/tegra/camera/csi/csi.c
index f9686d3a..e444bb59 100644
--- a/drivers/media/platform/tegra/camera/csi/csi.c
+++ b/drivers/media/platform/tegra/camera/csi/csi.c
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0-only
-// SPDX-FileCopyrightText: Copyright (c) 2022-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-FileCopyrightText: Copyright (c) 2022-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 /*
  * NVIDIA Tegra CSI Device
  */
@@ -1054,8 +1054,9 @@ static int csi_parse_dt(struct tegra_csi_device *csi,
 
 	if (strncmp(node->name, "nvcsi", 5)) {
 		node = of_find_node_by_name(node, "nvcsi");
-		if (sizeof(csi->devname) >= sizeof("nvcsi")) {
-			strncpy(csi->devname, "nvcsi", 6);
+		if (strscpy(csi->devname, "nvcsi", 6) < 0) {
+			dev_err(csi->dev, "Name too long.\n");
+			return -EINVAL;
 		}
 	}
 
diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
index c25fcf28..f44737ac 100644
--- a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
+++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
@@ -1907,14 +1907,28 @@ static uint32_t isp_capture_get_num_progress(
 {
 	struct isp_desc_rec *capture_desc_ctx =
 		&chan->capture_data->capture_desc_ctx;
-	struct isp_capture_descriptor *desc = (struct isp_capture_descriptor *)
-		(capture_desc_ctx->requests.va +
-			req->buffer_index * capture_desc_ctx->request_size);
+	struct isp_capture_descriptor *desc = NULL;
+	uint16_t sliceHeight = 0U;
+	uint16_t height = 0U;
+	uint32_t desc_offset = 0U;
+	uint16_t slice_hight_sub = 1U;
+	uint16_t adjust_slice_height = 0U;
+	uint16_t adjust_height = 0U;
 
-	uint16_t sliceHeight = desc->surface_configs.slice_height;
-	uint16_t height = desc->surface_configs.mr_height;
+	if (check_mul_overflow(req->buffer_index, capture_desc_ctx->request_size, &desc_offset))
+		return 0;
 
-	return ((height + (sliceHeight - 1U)) / sliceHeight);
+	desc = (struct isp_capture_descriptor *)(capture_desc_ctx->requests.va + desc_offset);
+	sliceHeight = desc->surface_configs.slice_height;
+	height = desc->surface_configs.mr_height;
+
+	if (check_sub_overflow(sliceHeight, slice_hight_sub, &adjust_slice_height))
+		return 0;
+
+	if (check_add_overflow(height, adjust_slice_height, &adjust_height))
+		return 0;
+
+	return (adjust_height / sliceHeight);
 }
 
 int isp_capture_request(