kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Fix EP11 secure key reencipher function

Browse Source 
Re-enciphering an EP11 secure key may fail with an error message like:
  "zkey-cryptsetup: Failed to re-encipher the secure volume key for device
  '<device>'"
or
  "zkey: Failed to re-encipher '<key>' from CURRENT to NEW master key"
or similar.

The verbose messages show the following debug message:
  "Command XCP_ADM_REENCRYPT failed. rc = 0x20"

This is due to uninitialized variables, which might cause the EP11 admin
request to contain garbage data, causing it to fail with CKR_DATA_INVALID
(0x20).

Fixes: 0be7efc956 ("zkey: Add support for re-enciphering EP11 secure keys")
Fixes: 4e2ebe0370 ("libseckey: Fix re-enciphering of EP11 secure key")
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2025-05-13 15:44:09 +02:00
committed by Jan Höppner
parent 616d2f52f9
commit 3a3cea0061
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libseckey/sk_ep11.c
View File

@@ -1501,6 +1501,9 @@ int SK_EP11_reencipher_key(const struct sk_ext_ep11_lib *ep11_lib,
return -ENODEV;
}
memset(&rb, 0, sizeof(rb));
memset(&lrb, 0, sizeof(lrb));
rb.domain = domain;
lrb.domain = domain;