diff --git a/drivers/media/platform/rockchip/isp/capture_v21.c b/drivers/media/platform/rockchip/isp/capture_v21.c
index 4a0e2927cdcf..45119e61cfa3 100644
--- a/drivers/media/platform/rockchip/isp/capture_v21.c
+++ b/drivers/media/platform/rockchip/isp/capture_v21.c
@@ -1150,7 +1150,8 @@ static void rdbk_frame_end(struct rkisp_stream *stream)
 			if (!ret) {
 				denominator = sensor->fi.interval.denominator;
 				numerator = sensor->fi.interval.numerator;
-				time = numerator * 1000 / denominator * 1000 * 1000;
+				if (denominator)
+					time = numerator * 1000 / denominator * 1000 * 1000;
 				if (numerator)
 					fps = denominator / numerator;
 			}
diff --git a/drivers/media/platform/rockchip/isp/common.c b/drivers/media/platform/rockchip/isp/common.c
index 1f3e0a14494b..46a70063ebe4 100644
--- a/drivers/media/platform/rockchip/isp/common.c
+++ b/drivers/media/platform/rockchip/isp/common.c
@@ -318,6 +318,11 @@ int rkisp_attach_hw(struct rkisp_device *isp)
 		return -EINVAL;
 	}
 
+	if (hw->dev_num >= DEV_MAX) {
+		dev_err(isp->dev, "failed attach isp hw, max dev:%d\n", DEV_MAX);
+		return -EINVAL;
+	}
+
 	isp->dev_id = hw->dev_num;
 	hw->isp[hw->dev_num] = isp;
 	hw->dev_num++;
diff --git a/drivers/media/platform/rockchip/isp/csi.c b/drivers/media/platform/rockchip/isp/csi.c
index c7a288c71f59..efa37149079c 100644
--- a/drivers/media/platform/rockchip/isp/csi.c
+++ b/drivers/media/platform/rockchip/isp/csi.c
@@ -82,6 +82,8 @@ static int rkisp_csi_link_setup(struct media_entity *entity,
 		id = local->index - 1;
 		if (id && id < RKISP_STREAM_DMATX3)
 			stream = &csi->ispdev->cap_dev.stream[id + 1];
+		if (id >= ARRAY_SIZE(csi->sink))
+			return -EINVAL;
 		if (flags & MEDIA_LNK_FL_ENABLED) {
 			if (csi->sink[id].linked) {
 				ret = -EBUSY;
diff --git a/drivers/media/platform/rockchip/isp/isp_params.c b/drivers/media/platform/rockchip/isp/isp_params.c
index ae795152fb2e..753d618847e7 100644
--- a/drivers/media/platform/rockchip/isp/isp_params.c
+++ b/drivers/media/platform/rockchip/isp/isp_params.c
@@ -210,36 +210,23 @@ static void rkisp_params_vb2_stop_streaming(struct vb2_queue *vq)
 	struct rkisp_device *dev = params_vdev->dev;
 	struct rkisp_buffer *buf;
 	unsigned long flags;
-	int i;
 
 	/* stop params input firstly */
 	spin_lock_irqsave(&params_vdev->config_lock, flags);
 	params_vdev->streamon = false;
 	wake_up(&dev->sync_onoff);
-	spin_unlock_irqrestore(&params_vdev->config_lock, flags);
-
-	for (i = 0; i < RKISP_ISP_PARAMS_REQ_BUFS_MAX; i++) {
-		spin_lock_irqsave(&params_vdev->config_lock, flags);
-		if (!list_empty(&params_vdev->params)) {
-			buf = list_first_entry(&params_vdev->params,
-					       struct rkisp_buffer, queue);
-			list_del(&buf->queue);
-			spin_unlock_irqrestore(&params_vdev->config_lock,
-					       flags);
-		} else {
-			spin_unlock_irqrestore(&params_vdev->config_lock,
-					       flags);
-			break;
-		}
-
+	while (!list_empty(&params_vdev->params)) {
+		buf = list_first_entry(&params_vdev->params,
+				       struct rkisp_buffer, queue);
+		list_del(&buf->queue);
 		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
 	}
-
 	if (params_vdev->cur_buf) {
 		buf = params_vdev->cur_buf;
 		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
 		params_vdev->cur_buf = NULL;
 	}
+	spin_unlock_irqrestore(&params_vdev->config_lock, flags);
 
 	rkisp_params_disable_isp(params_vdev);
 	/* clean module params */
diff --git a/drivers/media/platform/rockchip/isp/isp_params_v21.c b/drivers/media/platform/rockchip/isp/isp_params_v21.c
index 509554d63532..6fac6ab466d1 100644
--- a/drivers/media/platform/rockchip/isp/isp_params_v21.c
+++ b/drivers/media/platform/rockchip/isp/isp_params_v21.c
@@ -4337,7 +4337,7 @@ int rkisp_init_params_vdev_v21(struct rkisp_isp_params_vdev *params_vdev)
 		ret = rkisp_alloc_buffer(params_vdev->dev, &priv_val->buf_3dlut[i]);
 		if (ret) {
 			dev_err(dev, "can not alloc buffer\n");
-			goto err;
+			goto err_3dlut;
 		}
 	}
 
@@ -4348,7 +4348,7 @@ int rkisp_init_params_vdev_v21(struct rkisp_isp_params_vdev *params_vdev)
 		ret = rkisp_alloc_buffer(params_vdev->dev, &priv_val->buf_lsclut[i]);
 		if (ret) {
 			dev_err(dev, "can not alloc buffer\n");
-			goto err;
+			goto err_lsclut;
 		}
 	}
 
@@ -4357,15 +4357,16 @@ int rkisp_init_params_vdev_v21(struct rkisp_isp_params_vdev *params_vdev)
 	params_vdev->priv_ops = &rkisp_v21_isp_params_ops;
 	rkisp_clear_first_param_v2x(params_vdev);
 	return 0;
-
-err:
-	for (i = 0; i < RKISP_PARAM_3DLUT_BUF_NUM; i++)
+err_lsclut:
+	for (i -= 1; i >= 0; i--)
+		rkisp_free_buffer(params_vdev->dev, &priv_val->buf_lsclut[i]);
+	i = RKISP_PARAM_3DLUT_BUF_NUM;
+err_3dlut:
+	for (i -= 1; i >= 0; i--)
 		rkisp_free_buffer(params_vdev->dev, &priv_val->buf_3dlut[i]);
 
-	for (i = 0; i < RKISP_PARAM_LSC_LUT_BUF_NUM; i++)
-		rkisp_free_buffer(params_vdev->dev, &priv_val->buf_lsclut[i]);
 	vfree(params_vdev->isp21_params);
-
+	kfree(priv_val);
 	return ret;
 }