From 7a058df1a42ccd35a5da71dcf6abe8124dd1c9fd Mon Sep 17 00:00:00 2001 From: Sergiy Kibrik Date: Tue, 13 Oct 2026 11:12:38 +0200 Subject: [PATCH] xen/xsm: flask: restore sidtab state on policy load failure Error path of failed sidtab_map() leaves global sidtab in shutdown state and from that point system is unable to allocate new SIDs in sidtab_context_to_sid(). To restore sidtab state new function sidtab_cancel_shutdown() is introduced, which only resets shutdown flag, rewinding effect of sidtab_shutdown(). Signed-off-by: Sergiy Kibrik Acked-by: Daniel P. Smith --- xen/xsm/flask/ss/services.c | 1 + xen/xsm/flask/ss/sidtab.c | 7 +++++++ xen/xsm/flask/ss/sidtab.h | 1 + 3 files changed, 9 insertions(+) diff --git a/xen/xsm/flask/ss/services.c b/xen/xsm/flask/ss/services.c index 57beaafa9f..9e01e8f730 100644 --- a/xen/xsm/flask/ss/services.c +++ b/xen/xsm/flask/ss/services.c @@ -1428,6 +1428,7 @@ int security_load_policy(const void *data, size_t len) if ( sidtab_map(&sidtab, clone_sid, &newsidtab) ) { rc = -ENOMEM; + sidtab_cancel_shutdown(&sidtab); goto err; } diff --git a/xen/xsm/flask/ss/sidtab.c b/xen/xsm/flask/ss/sidtab.c index 69fc3389b3..74fafba75b 100644 --- a/xen/xsm/flask/ss/sidtab.c +++ b/xen/xsm/flask/ss/sidtab.c @@ -320,3 +320,10 @@ void sidtab_shutdown(struct sidtab *s) s->shutdown = 1; SIDTAB_UNLOCK(s); } + +void sidtab_cancel_shutdown(struct sidtab *s) +{ + SIDTAB_LOCK(s); + s->shutdown = 0; + SIDTAB_UNLOCK(s); +} diff --git a/xen/xsm/flask/ss/sidtab.h b/xen/xsm/flask/ss/sidtab.h index 0e48ec6eae..f664cbed60 100644 --- a/xen/xsm/flask/ss/sidtab.h +++ b/xen/xsm/flask/ss/sidtab.h @@ -49,5 +49,6 @@ void sidtab_hash_eval(struct sidtab *h, char *tag); void sidtab_destroy(struct sidtab *s); void sidtab_set(struct sidtab *dst, struct sidtab *src); void sidtab_shutdown(struct sidtab *s); +void sidtab_cancel_shutdown(struct sidtab *s); #endif /* _SS_SIDTAB_H_ */