In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: pdr: Fix the potential deadlock
When some client process A call pdraddlookup() to add the look up for the service and does schedule locator work, later a process B got a new server packet indicating locator is up and call pdrlocatornewserver() which eventually sets pdr->locatorinit_complete to true which process A sees and takes list lock and queries domain list but it will timeout due to deadlock as the response will queued to the same qmi->wq and it is ordered workqueue and process B is not able to complete new server request work due to deadlock on list lock.
Fix it by removing the unnecessary list iteration as the list iteration is already being done inside locator work, so avoid it here and just call schedule_work() here.
Process A Process B
process_scheduled_works()
pdraddlookup() qmidatareadywork() processscheduledworks() pdrlocatornewserver() pdr->locatorinitcomplete=true; pdrlocatorwork() mutexlock(&pdr->listlock);
pdr_locate_service() mutex_lock(&pdr->list_lock);
pdr_get_domain_list()
pr_err("PDR: %s get domain list
txn wait failed: %d\n",
req->service_name,
ret);
Timeout error log due to deadlock:
" PDR: tms/servreg get domain list txn wait failed: -110 PDR: service lookup for msm/adsp/sensor_pd:tms/servreg failed: -110 "
Thanks to Bjorn and Johan for letting me know that this commit also fixes an audio regression when using the in-kernel pd-mapper as that makes it easier to hit this race. [1]
[
{
"signature_type": "Line",
"id": "CVE-2025-22014-11080ecc",
"target": {
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a566a79aca9851fae140536e0fc5b0853c90a90",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277473020571880275696957693316147068741",
"38961130433942872922428109890397837737",
"144346602420830425005099760553882500002",
"88654399193557000256906390339124886955",
"318756931671345483984520476333385012502",
"75799581264963965305351639512025669592",
"136207579621186751771835632905016193916",
"233987880001641927551930761610030434259",
"159978930167071304036742249983626982247",
"287264464822851875695050273388075412167",
"125578468648340666091397902768514195342",
"14393129314704468487370734294150239900",
"18543302984459198581490018461352191359"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2025-22014-208f292d",
"target": {
"function": "pdr_locator_new_server",
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2eeb03ad9f42dfece63051be2400af487ddb96d2",
"signature_version": "v1",
"digest": {
"function_hash": "24513868039515474616605036957403307586",
"length": 605.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2025-22014-568463e5",
"target": {
"function": "pdr_locator_new_server",
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72a222b6af10c2a05a5fad0029246229ed8912c2",
"signature_version": "v1",
"digest": {
"function_hash": "24513868039515474616605036957403307586",
"length": 605.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2025-22014-6029a9d9",
"target": {
"function": "pdr_locator_new_server",
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2bbfd50e95bc117360f0f59e629aa03d821ebd6",
"signature_version": "v1",
"digest": {
"function_hash": "24513868039515474616605036957403307586",
"length": 605.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2025-22014-60767415",
"target": {
"function": "pdr_locator_new_server",
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02612f1e4c34d94d6c8ee75bf7d254ed697e22d4",
"signature_version": "v1",
"digest": {
"function_hash": "24513868039515474616605036957403307586",
"length": 605.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2025-22014-6b5df893",
"target": {
"function": "pdr_locator_new_server",
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4489260f5713c94e1966e5f20445bff262876f4",
"signature_version": "v1",
"digest": {
"function_hash": "24513868039515474616605036957403307586",
"length": 605.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2025-22014-6bddf200",
"target": {
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2eeb03ad9f42dfece63051be2400af487ddb96d2",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277473020571880275696957693316147068741",
"38961130433942872922428109890397837737",
"144346602420830425005099760553882500002",
"88654399193557000256906390339124886955",
"318756931671345483984520476333385012502",
"75799581264963965305351639512025669592",
"136207579621186751771835632905016193916",
"233987880001641927551930761610030434259",
"159978930167071304036742249983626982247",
"287264464822851875695050273388075412167",
"125578468648340666091397902768514195342",
"14393129314704468487370734294150239900",
"18543302984459198581490018461352191359"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2025-22014-7a25f36f",
"target": {
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02612f1e4c34d94d6c8ee75bf7d254ed697e22d4",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277473020571880275696957693316147068741",
"38961130433942872922428109890397837737",
"144346602420830425005099760553882500002",
"88654399193557000256906390339124886955",
"318756931671345483984520476333385012502",
"75799581264963965305351639512025669592",
"136207579621186751771835632905016193916",
"233987880001641927551930761610030434259",
"159978930167071304036742249983626982247",
"287264464822851875695050273388075412167",
"125578468648340666091397902768514195342",
"14393129314704468487370734294150239900",
"18543302984459198581490018461352191359"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2025-22014-85bdba11",
"target": {
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72a222b6af10c2a05a5fad0029246229ed8912c2",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277473020571880275696957693316147068741",
"38961130433942872922428109890397837737",
"144346602420830425005099760553882500002",
"88654399193557000256906390339124886955",
"318756931671345483984520476333385012502",
"75799581264963965305351639512025669592",
"136207579621186751771835632905016193916",
"233987880001641927551930761610030434259",
"159978930167071304036742249983626982247",
"287264464822851875695050273388075412167",
"125578468648340666091397902768514195342",
"14393129314704468487370734294150239900",
"18543302984459198581490018461352191359"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2025-22014-875a6b59",
"target": {
"function": "pdr_locator_new_server",
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@daba84612236de3ab39083e62c9e326a654ebd20",
"signature_version": "v1",
"digest": {
"function_hash": "24513868039515474616605036957403307586",
"length": 605.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2025-22014-8ada767a",
"target": {
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4489260f5713c94e1966e5f20445bff262876f4",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277473020571880275696957693316147068741",
"38961130433942872922428109890397837737",
"144346602420830425005099760553882500002",
"88654399193557000256906390339124886955",
"318756931671345483984520476333385012502",
"75799581264963965305351639512025669592",
"136207579621186751771835632905016193916",
"233987880001641927551930761610030434259",
"159978930167071304036742249983626982247",
"287264464822851875695050273388075412167",
"125578468648340666091397902768514195342",
"14393129314704468487370734294150239900",
"18543302984459198581490018461352191359"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2025-22014-8ddc88e7",
"target": {
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2bbfd50e95bc117360f0f59e629aa03d821ebd6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277473020571880275696957693316147068741",
"38961130433942872922428109890397837737",
"144346602420830425005099760553882500002",
"88654399193557000256906390339124886955",
"318756931671345483984520476333385012502",
"75799581264963965305351639512025669592",
"136207579621186751771835632905016193916",
"233987880001641927551930761610030434259",
"159978930167071304036742249983626982247",
"287264464822851875695050273388075412167",
"125578468648340666091397902768514195342",
"14393129314704468487370734294150239900",
"18543302984459198581490018461352191359"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2025-22014-94d675a3",
"target": {
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@daba84612236de3ab39083e62c9e326a654ebd20",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277473020571880275696957693316147068741",
"38961130433942872922428109890397837737",
"144346602420830425005099760553882500002",
"88654399193557000256906390339124886955",
"318756931671345483984520476333385012502",
"75799581264963965305351639512025669592",
"136207579621186751771835632905016193916",
"233987880001641927551930761610030434259",
"159978930167071304036742249983626982247",
"287264464822851875695050273388075412167",
"125578468648340666091397902768514195342",
"14393129314704468487370734294150239900",
"18543302984459198581490018461352191359"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2025-22014-e4b45132",
"target": {
"function": "pdr_locator_new_server",
"file": "drivers/soc/qcom/pdr_interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a566a79aca9851fae140536e0fc5b0853c90a90",
"signature_version": "v1",
"digest": {
"function_hash": "24513868039515474616605036957403307586",
"length": 605.0
},
"deprecated": false
}
]