[xen staging] xen/xsm: flask: restore sidtab state on policy load failure

[patchbot@xxxxxxx]

commit 7a058df1a42ccd35a5da71dcf6abe8124dd1c9fd
Author:     Sergiy Kibrik <Sergiy_Kibrik@xxxxxxxx>
AuthorDate: Tue Oct 13 11:12:38 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Oct 13 11:12:38 2026 +0200

    xen/xsm: flask: restore sidtab state on policy load failure
    
    Error path of failed sidtab_map() leaves global sidtab in shutdown state and
    from that point system is unable to allocate new SIDs in 
sidtab_context_to_sid().
    To restore sidtab state new function sidtab_cancel_shutdown() is introduced,
    which only resets shutdown flag, rewinding effect of sidtab_shutdown().
    
    Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@xxxxxxxx>
    Acked-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxx>
---
 xen/xsm/flask/ss/services.c | 1 +
 xen/xsm/flask/ss/sidtab.c   | 7 +++++++
 xen/xsm/flask/ss/sidtab.h   | 1 +
 3 files changed, 9 insertions(+)

diff --git a/xen/xsm/flask/ss/services.c b/xen/xsm/flask/ss/services.c
index 57beaafa9f..9e01e8f730 100644
--- a/xen/xsm/flask/ss/services.c
+++ b/xen/xsm/flask/ss/services.c
@@ -1428,6 +1428,7 @@ int security_load_policy(const void *data, size_t len)
     if ( sidtab_map(&sidtab, clone_sid, &newsidtab) )
     {
         rc = -ENOMEM;
+        sidtab_cancel_shutdown(&sidtab);
         goto err;
     }
 
diff --git a/xen/xsm/flask/ss/sidtab.c b/xen/xsm/flask/ss/sidtab.c
index 69fc3389b3..74fafba75b 100644
--- a/xen/xsm/flask/ss/sidtab.c
+++ b/xen/xsm/flask/ss/sidtab.c
@@ -320,3 +320,10 @@ void sidtab_shutdown(struct sidtab *s)
     s->shutdown = 1;
     SIDTAB_UNLOCK(s);
 }
+
+void sidtab_cancel_shutdown(struct sidtab *s)
+{
+    SIDTAB_LOCK(s);
+    s->shutdown = 0;
+    SIDTAB_UNLOCK(s);
+}
diff --git a/xen/xsm/flask/ss/sidtab.h b/xen/xsm/flask/ss/sidtab.h
index 0e48ec6eae..f664cbed60 100644
--- a/xen/xsm/flask/ss/sidtab.h
+++ b/xen/xsm/flask/ss/sidtab.h
@@ -49,5 +49,6 @@ void sidtab_hash_eval(struct sidtab *h, char *tag);
 void sidtab_destroy(struct sidtab *s);
 void sidtab_set(struct sidtab *dst, struct sidtab *src);
 void sidtab_shutdown(struct sidtab *s);
+void sidtab_cancel_shutdown(struct sidtab *s);
 
 #endif    /* _SS_SIDTAB_H_ */
--
generated by git-patchbot for /home/xen/git/xen.git#staging