diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c
index 3a694d4e..d8cc72b6 100644
--- a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c
+++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp-channel.c
@@ -507,14 +507,6 @@ static long isp_channel_ioctl(
 
 		if (copy_from_user(&req, ptr, sizeof(req)))
 			break;
-		if (!req.inputfences_relocs.num_relocs) {
-			dev_err(chan->isp_dev, "req.inputfences_relocs.num_relocs invalid");
-			break;
-		}
-		if (!req.prefences_relocs.num_relocs) {
-			dev_err(chan->isp_dev, "req.prefences_relocs.num_relocs invalid");
-			break;
-		}
 		err = isp_capture_request(chan, &req);
 		if (err)
 			dev_err(chan->isp_dev,
diff --git a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
index 652ef365..27264b9f 100644
--- a/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
+++ b/drivers/media/platform/tegra/camera/fusa-capture/capture-isp.c
@@ -70,6 +70,16 @@
  */
 #define MAX_ISP_UNITS	U32_C(0x2)
 
+/**
+ * @brief Maximum surfaces ISP can read on its input port.
+ */
+#define MAX_ISP_INPUT_SURFACES	U32_C(3)
+
+/**
+ * @brief Maximum number of ISP input prefences.
+ */
+#define MAX_ISP_INPUT_PREFENCES	U32_C(14)
+
 /**
  * @brief The Capture-ISP standalone driver context.
  */
@@ -584,6 +594,11 @@ static int isp_capture_setup_inputfences(
 	if (!req->inputfences_relocs.num_relocs)
 		return 0;
 
+	if (req->inputfences_relocs.num_relocs > MAX_ISP_INPUT_SURFACES) {
+		dev_err(chan->isp_dev, "inputfences num exceeds max allowed\n");
+		return -EINVAL;
+	}
+
 	inpfences_reloc_user = (uint32_t __user *)
 			(uintptr_t)req->inputfences_relocs.reloc_relatives;
 
@@ -709,6 +724,11 @@ static int isp_capture_setup_prefences(
 	if (!req->prefences_relocs.num_relocs)
 		return 0;
 
+	if (req->prefences_relocs.num_relocs > MAX_ISP_INPUT_PREFENCES) {
+		dev_err(chan->isp_dev, "prefences num exceeds max allowed\n");
+		return -EINVAL;
+	}
+
 	prefence_reloc_user = (uint32_t __user *)
 			(uintptr_t)req->prefences_relocs.reloc_relatives;