From 3a3cea00611c9393d816dcdec6e4973b3dad3f4f Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 13 May 2025 15:44:09 +0200 Subject: [PATCH] zkey: Fix EP11 secure key reencipher function MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Re-enciphering an EP11 secure key may fail with an error message like: "zkey-cryptsetup: Failed to re-encipher the secure volume key for device ''" or "zkey: Failed to re-encipher '' from CURRENT to NEW master key" or similar. The verbose messages show the following debug message: "Command XCP_ADM_REENCRYPT failed. rc = 0x20" This is due to uninitialized variables, which might cause the EP11 admin request to contain garbage data, causing it to fail with CKR_DATA_INVALID (0x20). Fixes: 0be7efc95634 ("zkey: Add support for re-enciphering EP11 secure keys") Fixes: 4e2ebe0370d9 ("libseckey: Fix re-enciphering of EP11 secure key") Signed-off-by: Ingo Franzki Reviewed-by: Joerg Schmidbauer Signed-off-by: Jan Höppner --- libseckey/sk_ep11.c | 3 +++ zkey/ep11.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/libseckey/sk_ep11.c b/libseckey/sk_ep11.c index e3bd3c9f..8b166873 100644 --- a/libseckey/sk_ep11.c +++ b/libseckey/sk_ep11.c @@ -1501,6 +1501,9 @@ int SK_EP11_reencipher_key(const struct sk_ext_ep11_lib *ep11_lib, return -ENODEV; } + memset(&rb, 0, sizeof(rb)); + memset(&lrb, 0, sizeof(lrb)); + rb.domain = domain; lrb.domain = domain; diff --git a/zkey/ep11.c b/zkey/ep11.c index df8b57df..76c72a09 100644 --- a/zkey/ep11.c +++ b/zkey/ep11.c @@ -403,6 +403,9 @@ static int ep11_adm_reencrypt(struct ep11_lib *ep11, target_t target, return -EINVAL; } + memset(&rb, 0, sizeof(rb)); + memset(&lrb, 0, sizeof(lrb)); + rb.domain = domain; lrb.domain = domain;