diff --git a/arch/arm64/configs/rk3308_linux_defconfig b/arch/arm64/configs/rk3308_linux_defconfig
index 40f3c46836e7..2724cba765f5 100644
--- a/arch/arm64/configs/rk3308_linux_defconfig
+++ b/arch/arm64/configs/rk3308_linux_defconfig
@@ -188,6 +188,7 @@ CONFIG_REGULATOR_PWM=y
 CONFIG_REGULATOR_RK808=y
 CONFIG_MEDIA_SUPPORT=y
 CONFIG_DRM=y
+CONFIG_DRM_IGNORE_IOTCL_PERMIT=y
 CONFIG_DRM_ROCKCHIP=y
 CONFIG_ROCKCHIP_RGB=y
 CONFIG_DRM_PANEL_SIMPLE=y
diff --git a/drivers/media/i2c/imx464.c b/drivers/media/i2c/imx464.c
index 09a68c72294c..6193a80678bb 100644
--- a/drivers/media/i2c/imx464.c
+++ b/drivers/media/i2c/imx464.c
@@ -1835,7 +1835,7 @@ static int IMX464_set_hdrae(struct IMX464 *IMX464,
 		__LINE__, rhs1, s_exp_time, rhs1_old,
 		(rhs1_old + 2 * BRL - fsc + 2));
 
-	rhs1 = (rhs1 >> 2) * 4 + 1;
+	rhs1 = ((rhs1 + 3) >> 2) * 4 + 1;
 	rhs1_old = rhs1;
 
 	if (rhs1 - s_exp_time <= SHR1_MIN) {
diff --git a/drivers/media/platform/rockchip/isp/isp_rockit.c b/drivers/media/platform/rockchip/isp/isp_rockit.c
index 8a40d09e506d..c452752af967 100644
--- a/drivers/media/platform/rockchip/isp/isp_rockit.c
+++ b/drivers/media/platform/rockchip/isp/isp_rockit.c
@@ -415,6 +415,46 @@ int rkisp_rockit_free_tb_stream_buf(struct rockit_cfg *input_rockit_cfg)
 }
 EXPORT_SYMBOL(rkisp_rockit_free_tb_stream_buf);
 
+int rkisp_rockit_free_stream_buf(struct rockit_cfg *input_rockit_cfg)
+{
+	struct rkisp_stream *stream;
+	struct rkisp_buffer *buf;
+	unsigned long lock_flags = 0;
+
+	if (!input_rockit_cfg)
+		return -EINVAL;
+	stream = rkisp_rockit_get_stream(input_rockit_cfg);
+	if (!stream)
+		return -EINVAL;
+
+	if (stream->streaming)
+		return 0;
+
+	spin_lock_irqsave(&stream->vbq_lock, lock_flags);
+	if (stream->curr_buf) {
+		list_add_tail(&stream->curr_buf->queue, &stream->buf_queue);
+		if (stream->curr_buf == stream->next_buf)
+			stream->next_buf = NULL;
+		stream->curr_buf = NULL;
+	}
+	if (stream->next_buf) {
+		list_add_tail(&stream->next_buf->queue, &stream->buf_queue);
+		stream->next_buf = NULL;
+	}
+
+	while (!list_empty(&stream->buf_queue)) {
+		buf = list_first_entry(&stream->buf_queue,
+			struct rkisp_buffer, queue);
+		list_del(&buf->queue);
+	}
+	rkisp_rockit_buf_state_clear(stream);
+	spin_unlock_irqrestore(&stream->vbq_lock, lock_flags);
+	rkisp_rockit_buf_free(stream);
+
+	return 0;
+}
+EXPORT_SYMBOL(rkisp_rockit_free_stream_buf);
+
 void rkisp_rockit_buf_state_clear(struct rkisp_stream *stream)
 {
 	struct rkisp_stream_cfg *stream_cfg;
@@ -439,6 +479,7 @@ int rkisp_rockit_buf_free(struct rkisp_stream *stream)
 		return -EINVAL;
 
 	stream_cfg = &rockit_cfg->rkisp_dev_cfg[dev_id].rkisp_stream_cfg[stream->id];
+	mutex_lock(&stream_cfg->freebuf_lock);
 	for (i = 0; i < ROCKIT_BUF_NUM_MAX; i++) {
 		if (stream_cfg->rkisp_buff[i]) {
 			isprk_buf = (struct rkisp_rockit_buffer *)stream_cfg->rkisp_buff[i];
@@ -457,12 +498,14 @@ int rkisp_rockit_buf_free(struct rkisp_stream *stream)
 			stream_cfg->rkisp_buff[i] = NULL;
 		}
 	}
+	mutex_unlock(&stream_cfg->freebuf_lock);
 	return 0;
 }
 
 void rkisp_rockit_dev_init(struct rkisp_device *dev)
 {
-	int i;
+	struct rkisp_stream_cfg *stream_cfg;
+	int i, j;
 
 	if (rockit_cfg == NULL) {
 		rockit_cfg = kzalloc(sizeof(struct rockit_cfg), GFP_KERNEL);
@@ -476,6 +519,10 @@ void rkisp_rockit_dev_init(struct rkisp_device *dev)
 				dev->hw_dev->isp[i]->name;
 			rockit_cfg->rkisp_dev_cfg[i].isp_dev =
 				dev->hw_dev->isp[i];
+			for (j = 0; j < RKISP_MAX_STREAM; j++) {
+				stream_cfg = &rockit_cfg->rkisp_dev_cfg[i].rkisp_stream_cfg[j];
+				mutex_init(&stream_cfg->freebuf_lock);
+			}
 		}
 	}
 }
diff --git a/include/soc/rockchip/rockchip_rockit.h b/include/soc/rockchip/rockchip_rockit.h
index 9d3a34b0c8d8..760a864d24bc 100644
--- a/include/soc/rockchip/rockchip_rockit.h
+++ b/include/soc/rockchip/rockchip_rockit.h
@@ -35,6 +35,7 @@ struct rkisp_stream_cfg {
 	int cur_fps;
 	u64 old_time;
 	bool is_discard;
+	struct mutex freebuf_lock;
 };
 
 struct ISP_VIDEO_FRAMES {
@@ -132,6 +133,7 @@ int rkisp_rockit_config_stream(struct rockit_cfg *input_rockit_cfg,
 int rkisp_rockit_get_tb_stream_info(struct rockit_cfg *input_rockit_cfg,
 				    struct rkisp_tb_stream_info *info);
 int rkisp_rockit_free_tb_stream_buf(struct rockit_cfg *input_rockit_cfg);
+int rkisp_rockit_free_stream_buf(struct rockit_cfg *input_rockit_cfg);
 
 void *rkcif_rockit_function_register(void *function, int cmd);
 int rkcif_rockit_get_cifdev(char **name);
@@ -175,6 +177,11 @@ static inline int rkisp_rockit_free_tb_stream_buf(struct rockit_cfg *input_rocki
 	return -EINVAL;
 }
 
+static inline int rkisp_rockit_free_stream_buf(struct rockit_cfg *input_rockit_cfg)
+{
+	return -EINVAL;
+}
+
 #endif
 
 #endif