Re: [PATCH v2 04/10] keys/trusted_keys: propagate wrapping key generation errors
From: R Nageswara Sastry <hidden>
Date: 2026-09-04 06:12:59
Also in:
keyrings, linux-integrity, linux-security-module, lkml
On 31.08.2026 4:47 PM, Srish Srinivasan wrote:
plpks_gen_wrapping_key() returns a negative errno when default wrapping key
generation fails. However, trusted_pkwm_init() returns -EINVAL for all such
failures, discarding the original error.
Propagate the error returned by plpks_gen_wrapping_key() unchanged.
Fixes: c99fcb0d735b ("keys/trusted_keys: establish PKWM as a trusted source")
Cc: stable@vger.kernel.org
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>Tested-by: R Nageswara Sastry <redacted> Tested on ppc64le PowerVM LPARs on firmware with wrap/unwrap support, with and without Secure Boot enabled. Verified that PKWM initialisation succeeds on first boot (wrapping key created) and also when the wrapping key already exists from a previous boot, confirming the error from plpks_gen_wrapping_key() is now correctly propagated rather than replaced with a hardcoded -EINVAL.
quoted hunk ↗ jump to hunk
--- security/keys/trusted-keys/trusted_pkwm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/security/keys/trusted-keys/trusted_pkwm.c b/security/keys/trusted-keys/trusted_pkwm.c index b6b5697426a8..633a7674d065 100644 --- a/security/keys/trusted-keys/trusted_pkwm.c +++ b/security/keys/trusted-keys/trusted_pkwm.c@@ -170,7 +170,7 @@ static int trusted_pkwm_init(void) ret = plpks_gen_wrapping_key(); if (ret) { pr_err("Failed to generate default wrapping key\n"); - return -EINVAL; + return ret; } return register_key_type(&key_type_trusted);
-- Thanks and Regards R.Nageswara Sastry