From: Ingo Franzki Date: Wed, 20 Feb 2019 14:01:39 +0100 Subject: pkey: Indicate old mkvp only if old and current mkvp are different Git-commit: ebb7c695d3bc7a4986b92edc8d9ef43491be183e Patch-mainline: v5.1-rc1 References: bsc#1137827 LTC#178090 When the CCA master key is set twice with the same master key, then the old and the current master key are the same and thus the verification patterns are the same, too. The check to report if a secure key is currently wrapped by the old master key erroneously reports old mkvp in this case. Reviewed-by: Harald Freudenberger Signed-off-by: Ingo Franzki Signed-off-by: Martin Schwidefsky Acked-by: Petr Tesarik --- drivers/s390/crypto/pkey_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/s390/crypto/pkey_api.c +++ b/drivers/s390/crypto/pkey_api.c @@ -1046,7 +1046,7 @@ int pkey_verifykey(const struct pkey_sec rc = mkvp_cache_fetch(cardnr, domain, mkvp); if (rc) goto out; - if (t->mkvp == mkvp[1]) { + if (t->mkvp == mkvp[1] && t->mkvp != mkvp[0]) { DEBUG_DBG("%s secure key has old mkvp\n", __func__); if (pattributes) *pattributes |= PKEY_VERIFY_ATTR_OLD_MKVP;