Error path of failed sidtab_map() leaves global sidtab in shutdown state and
from that point system is unable to allocate new SIDs in sidtab_context_to_sid().
To restore sidtab state new function sidtab_activate() is introduced, which only
resets shutdown flag, rewinding effect of sidtab_shutdown().

Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
---
New function is not strictly required, this also can be achieved just by
doing sidtab_set(&sidtab, &sidtab), but this way we would rely on its
undocumented internal behaviour.
---
 xen/xsm/flask/ss/services.c | 1 +
 xen/xsm/flask/ss/sidtab.c   | 7 +++++++
 xen/xsm/flask/ss/sidtab.h   | 1 +
 3 files changed, 9 insertions(+)

diff --git a/xen/xsm/flask/ss/services.c b/xen/xsm/flask/ss/services.c
index 35ad1034ca..f5cee1e0b0 100644
--- a/xen/xsm/flask/ss/services.c
+++ b/xen/xsm/flask/ss/services.c
@@ -1427,6 +1427,7 @@ int security_load_policy(const void *data, size_t len)
     if ( sidtab_map(&sidtab, clone_sid, &newsidtab) )
     {
         rc = -ENOMEM;
+        sidtab_activate(&sidtab);
         goto err;
     }
 
diff --git a/xen/xsm/flask/ss/sidtab.c b/xen/xsm/flask/ss/sidtab.c
index 69fc3389b3..5d1653cd02 100644
--- a/xen/xsm/flask/ss/sidtab.c
+++ b/xen/xsm/flask/ss/sidtab.c
@@ -314,6 +314,13 @@ void sidtab_set(struct sidtab *dst, struct sidtab *src)
     SIDTAB_UNLOCK(src);
 }
 
+void sidtab_activate(struct sidtab *s)
+{
+    SIDTAB_LOCK(s);
+    s->shutdown = 0;
+    SIDTAB_UNLOCK(s);
+}
+
 void sidtab_shutdown(struct sidtab *s)
 {
     SIDTAB_LOCK(s);
diff --git a/xen/xsm/flask/ss/sidtab.h b/xen/xsm/flask/ss/sidtab.h
index 0e48ec6eae..5d2dc9c7e1 100644
--- a/xen/xsm/flask/ss/sidtab.h
+++ b/xen/xsm/flask/ss/sidtab.h
@@ -48,6 +48,7 @@ int sidtab_context_to_sid(struct sidtab *s, struct context *context, u32 *sid);
 void sidtab_hash_eval(struct sidtab *h, char *tag);
 void sidtab_destroy(struct sidtab *s);
 void sidtab_set(struct sidtab *dst, struct sidtab *src);
+void sidtab_activate(struct sidtab *s);
 void sidtab_shutdown(struct sidtab *s);
 
 #endif    /* _SS_SIDTAB_H_ */
-- 
2.43.0

Hey Sergiy,

Apologies for not getting a response on the first send, been a bit 
preoccupied with preparing customer delivery.

On 10/2/26 5:26 AM, Sergiy Kibrik wrote:
> Error path of failed sidtab_map() leaves global sidtab in shutdown state and
> from that point system is unable to allocate new SIDs in sidtab_context_to_sid().
> To restore sidtab state new function sidtab_activate() is introduced, which only
> resets shutdown flag, rewinding effect of sidtab_shutdown().
> 
> Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
> ---
> New function is not strictly required, this also can be achieved just by
> doing sidtab_set(&sidtab, &sidtab), but this way we would rely on its
> undocumented internal behaviour.
> ---
>   xen/xsm/flask/ss/services.c | 1 +
>   xen/xsm/flask/ss/sidtab.c   | 7 +++++++
>   xen/xsm/flask/ss/sidtab.h   | 1 +
>   3 files changed, 9 insertions(+)
> 
> diff --git a/xen/xsm/flask/ss/services.c b/xen/xsm/flask/ss/services.c
> index 35ad1034ca..f5cee1e0b0 100644
> --- a/xen/xsm/flask/ss/services.c
> +++ b/xen/xsm/flask/ss/services.c
> @@ -1427,6 +1427,7 @@ int security_load_policy(const void *data, size_t len)
>       if ( sidtab_map(&sidtab, clone_sid, &newsidtab) )
>       {
>           rc = -ENOMEM;
> +        sidtab_activate(&sidtab);
>           goto err;
>       }
>   
> diff --git a/xen/xsm/flask/ss/sidtab.c b/xen/xsm/flask/ss/sidtab.c
> index 69fc3389b3..5d1653cd02 100644
> --- a/xen/xsm/flask/ss/sidtab.c
> +++ b/xen/xsm/flask/ss/sidtab.c
> @@ -314,6 +314,13 @@ void sidtab_set(struct sidtab *dst, struct sidtab *src)
>       SIDTAB_UNLOCK(src);
>   }
>   
> +void sidtab_activate(struct sidtab *s)
> +{
> +    SIDTAB_LOCK(s);
> +    s->shutdown = 0;
> +    SIDTAB_UNLOCK(s);
> +}
> +

I think calling this sidtab_activate is a bit misleading, as activation 
is really the success path of security_load_policy. Perhaps 
sidtab_cancel_shutdown?


If you're not opposed to the rename, then on respin,

Acked-by: Daniel P. Smith <dpsmith@apertussoutions.com>

On 02.10.2026 11:26, Sergiy Kibrik wrote:
> Error path of failed sidtab_map() leaves global sidtab in shutdown state and
> from that point system is unable to allocate new SIDs in sidtab_context_to_sid().
> To restore sidtab state new function sidtab_activate() is introduced, which only
> resets shutdown flag, rewinding effect of sidtab_shutdown().
> 
> Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
> ---
> New function is not strictly required, this also can be achieved just by
> doing sidtab_set(&sidtab, &sidtab), but this way we would rely on its
> undocumented internal behaviour.
> ---
>  xen/xsm/flask/ss/services.c | 1 +
>  xen/xsm/flask/ss/sidtab.c   | 7 +++++++
>  xen/xsm/flask/ss/sidtab.h   | 1 +
>  3 files changed, 9 insertions(+)

Nothing is being said as to the reason of this resend. Was this perhaps meant
to be a ping?

Jan

On 10/2/26 12:34, Jan Beulich wrote:
> On 02.10.2026 11:26, Sergiy Kibrik wrote:
>> Error path of failed sidtab_map() leaves global sidtab in shutdown state and
>> from that point system is unable to allocate new SIDs in sidtab_context_to_sid().
>> To restore sidtab state new function sidtab_activate() is introduced, which only
>> resets shutdown flag, rewinding effect of sidtab_shutdown().
>>
>> Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
>> ---
>> New function is not strictly required, this also can be achieved just by
>> doing sidtab_set(&sidtab, &sidtab), but this way we would rely on its
>> undocumented internal behaviour.
>> ---
>>   xen/xsm/flask/ss/services.c | 1 +
>>   xen/xsm/flask/ss/sidtab.c   | 7 +++++++
>>   xen/xsm/flask/ss/sidtab.h   | 1 +
>>   3 files changed, 9 insertions(+)
> 
> Nothing is being said as to the reason of this resend. Was this perhaps meant
> to be a ping?
> 
yes, it's kind of a ping. No comments for prev patch, so I'm sending 
once more, in case it was lost.

   -Sergiy