From 504ebbe8260871d63f327ac18967e06531a94ecd Mon Sep 17 00:00:00 2001
From: Siteshwar Vashisht <svashisht@redhat.com>
Date: Thu, 3 Sep 2026 09:50:46 +0200
Subject: [PATCH] creds-util: add a check in decrypting credentials

... and avoid continuing decryption in case of failure.
---
 src/shared/creds-util.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/shared/creds-util.c b/src/shared/creds-util.c
index c501074ec1..d99369c809 100644
--- a/src/shared/creds-util.c
+++ b/src/shared/creds-util.c
@@ -1558,7 +1558,9 @@ int decrypt_credential_and_warn(
         if (sd_id128_equal(h->id, CRED_AES256_GCM_BY_NULL) && !FLAGS_SET(flags, CREDENTIAL_ALLOW_NULL))
                 log_warning("Warning: using a null key for decryption and authentication. Confidentiality or authenticity are not provided.");
 
-        sha256_hash_host_and_tpm2_key(&host_key, &tpm2_key, md);
+        r = sha256_hash_host_and_tpm2_key(&host_key, &tpm2_key, md);
+        if (r < 0)
+                return r;
 
         if (CRED_KEY_IS_SCOPED(h->id)) {
                 r = mangle_uid_into_key(uid, md);