Re: [PATCH v2 04/10] keys/trusted_keys: propagate wrapping key generation errors

[R Nageswara Sastry <rnsastry@linux.ibm.com>]

On 31.08.2026 4:47 PM, Srish Srinivasan wrote:
> plpks_gen_wrapping_key() returns a negative errno when default wrapping key
> generation fails. However, trusted_pkwm_init() returns -EINVAL for all such
> failures, discarding the original error.
>
> Propagate the error returned by plpks_gen_wrapping_key() unchanged.
>
> Fixes: c99fcb0d735b ("keys/trusted_keys: establish PKWM as a trusted source")
> Cc: stable@vger.kernel.org
> Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>

Tested on ppc64le PowerVM LPARs on firmware with wrap/unwrap support,
with and without Secure Boot enabled.

Verified that PKWM initialisation succeeds on first boot (wrapping key
created) and also when the wrapping key already exists from a previous
boot, confirming the error from plpks_gen_wrapping_key() is now correctly
propagated rather than replaced with a hardcoded -EINVAL.
> ---
>   security/keys/trusted-keys/trusted_pkwm.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/security/keys/trusted-keys/trusted_pkwm.c b/security/keys/trusted-keys/trusted_pkwm.c
> index b6b5697426a8..633a7674d065 100644
> --- a/security/keys/trusted-keys/trusted_pkwm.c
> +++ b/security/keys/trusted-keys/trusted_pkwm.c
> @@ -170,7 +170,7 @@ static int trusted_pkwm_init(void)
>   	ret = plpks_gen_wrapping_key();
>   	if (ret) {
>   		pr_err("Failed to generate default wrapping key\n");
> -		return -EINVAL;
> +		return ret;
>   	}
>   
>   	return register_key_type(&key_type_trusted);

-- 
Thanks and Regards
R.Nageswara Sastry