On 31.08.2026 4:47 PM, Srish Srinivasan wrote:
plpks_gen_wrapping_key() returns a negative errno when default wrapping key
generation fails. However, trusted_pkwm_init() returns -EINVAL for all such
failures, discarding the original error.
Propagate the error returned by plpks_gen_wrapping_key() unchanged.
Fixes: c99fcb0d735b ("keys/trusted_keys: establish PKWM as a trusted source")
Cc: [email protected]
Signed-off-by: Srish Srinivasan <[email protected]>
Tested-by: R Nageswara Sastry <[email protected]>
Tested on ppc64le PowerVM LPARs on firmware with wrap/unwrap support,
with and without Secure Boot enabled.
Verified that PKWM initialisation succeeds on first boot (wrapping key
created) and also when the wrapping key already exists from a previous
boot, confirming the error from plpks_gen_wrapping_key() is now correctly
propagated rather than replaced with a hardcoded -EINVAL.
---
security/keys/trusted-keys/trusted_pkwm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/keys/trusted-keys/trusted_pkwm.c
b/security/keys/trusted-keys/trusted_pkwm.c
index b6b5697426a8..633a7674d065 100644
--- a/security/keys/trusted-keys/trusted_pkwm.c
+++ b/security/keys/trusted-keys/trusted_pkwm.c
@@ -170,7 +170,7 @@ static int trusted_pkwm_init(void)
ret = plpks_gen_wrapping_key();
if (ret) {
pr_err("Failed to generate default wrapping key\n");
- return -EINVAL;
+ return ret;
}
return register_key_type(&key_type_trusted);
--
Thanks and Regards
R.Nageswara Sastry
