[PATCH v1] xen/xsm: flask: restore sidtab state on policy load failure

[Sergiy Kibrik <Sergiy_Kibrik@xxxxxxxx>]

Error path of failed sidtab_map() leaves global sidtab in shutdown state and
system unable to allocate new SIDs in sidtab_context_to_sid().
To restore sidtab state new function sidtab_activate() is introduced, it only
resets shutdown flag, rewinding effect of sidtab_shutdown().

Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@xxxxxxxx>
---
New function is not strictly required, this also can be achieved just by
doing sidtab_set(&sidtab, &sidtab), but this way we would rely on its
undocumented internal behaviour.
---
 xen/xsm/flask/ss/services.c | 1 +
 xen/xsm/flask/ss/sidtab.c   | 7 +++++++
 xen/xsm/flask/ss/sidtab.h   | 1 +
 3 files changed, 9 insertions(+)

diff --git a/xen/xsm/flask/ss/services.c b/xen/xsm/flask/ss/services.c
index 35ad1034ca..f5cee1e0b0 100644
--- a/xen/xsm/flask/ss/services.c
+++ b/xen/xsm/flask/ss/services.c
@@ -1427,6 +1427,7 @@ int security_load_policy(const void *data, size_t len)
     if ( sidtab_map(&sidtab, clone_sid, &newsidtab) )
     {
         rc = -ENOMEM;
+        sidtab_activate(&sidtab);
         goto err;
     }
 
diff --git a/xen/xsm/flask/ss/sidtab.c b/xen/xsm/flask/ss/sidtab.c
index 69fc3389b3..5d1653cd02 100644
--- a/xen/xsm/flask/ss/sidtab.c
+++ b/xen/xsm/flask/ss/sidtab.c
@@ -314,6 +314,13 @@ void sidtab_set(struct sidtab *dst, struct sidtab *src)
     SIDTAB_UNLOCK(src);
 }
 
+void sidtab_activate(struct sidtab *s)
+{
+    SIDTAB_LOCK(s);
+    s->shutdown = 0;
+    SIDTAB_UNLOCK(s);
+}
+
 void sidtab_shutdown(struct sidtab *s)
 {
     SIDTAB_LOCK(s);
diff --git a/xen/xsm/flask/ss/sidtab.h b/xen/xsm/flask/ss/sidtab.h
index 0e48ec6eae..5d2dc9c7e1 100644
--- a/xen/xsm/flask/ss/sidtab.h
+++ b/xen/xsm/flask/ss/sidtab.h
@@ -48,6 +48,7 @@ int sidtab_context_to_sid(struct sidtab *s, struct context 
*context, u32 *sid);
 void sidtab_hash_eval(struct sidtab *h, char *tag);
 void sidtab_destroy(struct sidtab *s);
 void sidtab_set(struct sidtab *dst, struct sidtab *src);
+void sidtab_activate(struct sidtab *s);
 void sidtab_shutdown(struct sidtab *s);
 
 #endif    /* _SS_SIDTAB_H_ */
-- 
2.43.0