Each power-domain ID comes from Device Tree. The driver allocates the
onecell table with max_id + 1 and later uses every saved ID as an index.
If an ID is U32_MAX, the allocation count wraps to zero while the index
remains maximal.

Reject U32_MAX while collecting IDs, before the arithmetic and indexed
store can diverge.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/pmdomain/ti/ti_sci_pm_domains.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/pmdomain/ti/ti_sci_pm_domains.c b/drivers/pmdomain/ti/ti_sci_pm_domains.c
index 949e4115f930..5fad21c317c4 100644
--- a/drivers/pmdomain/ti/ti_sci_pm_domains.c
+++ b/drivers/pmdomain/ti/ti_sci_pm_domains.c
@@ -251,6 +251,12 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
 			if (args.args_count >= 1 && args.np == dev->of_node) {
 				bool is_on;
 
+				if (args.args[0] == U32_MAX) {
+					dev_err(dev, "power-domain ID is too large\n");
+					of_node_put(args.np);
+					return -EINVAL;
+				}
+
 				of_node_put(args.np);
 				if (args.args[0] > max_id) {
 					max_id = args.args[0];
-- 
2.43.0

On 7/22/2026 9:41 AM, Pengpeng Hou wrote:
> Each power-domain ID comes from Device Tree. The driver allocates the
> onecell table with max_id + 1 and later uses every saved ID as an index.
> If an ID is U32_MAX, the allocation count wraps to zero while the index
> remains maximal.
> 
> Reject U32_MAX while collecting IDs, before the arithmetic and indexed
> store can diverge.
> 

Pls add fixes tag and add CC:stable@vger.kernel.org considering this is 
a memory corruption fix. Both should go in the commit description above 
the SOB.

Cheers,
Hari Prasath G.E

> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>   drivers/pmdomain/ti/ti_sci_pm_domains.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/pmdomain/ti/ti_sci_pm_domains.c b/drivers/pmdomain/ti/ti_sci_pm_domains.c
> index 949e4115f930..5fad21c317c4 100644
> --- a/drivers/pmdomain/ti/ti_sci_pm_domains.c
> +++ b/drivers/pmdomain/ti/ti_sci_pm_domains.c
> @@ -251,6 +251,12 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
>   			if (args.args_count >= 1 && args.np == dev->of_node) {
>   				bool is_on;
>   
> +				if (args.args[0] == U32_MAX) {
> +					dev_err(dev, "power-domain ID is too large\n");
> +					of_node_put(args.np);
> +					return -EINVAL;
> +				}
> +
>   				of_node_put(args.np);
>   				if (args.args[0] > max_id) {
>   					max_id = args.args[0];