src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java

@@ -147,15 +147,21 @@
             if (p11Key.token == token) {
                 if (extraAttrs != null) {
                     Session session = null;
                     try {
                         session = token.getObjSession();
-                        long newKeyID = token.p11.C_CopyObject(session.id(),
+                        p11Key.incNativeKeyRef();
+                        long newKeyID;
+                        try {
+                            newKeyID = token.p11.C_CopyObject(session.id(),
                                 p11Key.keyID, extraAttrs);
+                        } finally {
+                            p11Key.decNativeKeyRef();
+                        }
                         p11Key = (P11Key) (P11Key.secretKey(session,
                                 newKeyID, p11Key.algorithm, p11Key.keyLength,
-                                extraAttrs));
+                                extraAttrs, true));
                     } catch (PKCS11Exception p11e) {
                         throw new InvalidKeyException
                                 ("Cannot duplicate the PKCS11 key", p11e);
                     } finally {
                         token.releaseSession(session);

@@ -262,11 +268,11 @@
             attributes = token.getAttributes
                 (O_IMPORT, CKO_SECRET_KEY, keyType, attributes);
             session = token.getObjSession();
             long keyID = token.p11.C_CreateObject(session.id(), attributes);
             P11Key p11Key = (P11Key)P11Key.secretKey
-                (session, keyID, algorithm, keyLength, attributes);
+                (session, keyID, algorithm, keyLength, attributes, true);
             return p11Key;
         } catch (PKCS11Exception e) {
             throw new InvalidKeyException("Could not create key", e);
         } finally {
             token.releaseSession(session);