src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11ECKeyFactory.java

@@ -250,12 +250,13 @@
                 (O_IMPORT, CKO_PUBLIC_KEY, CKK_EC, attributes);
         Session session = null;
         try {
             session = token.getObjSession();
             long keyID = token.p11.C_CreateObject(session.id(), attributes);
-            return P11Key.publicKey
-                (session, keyID, "EC", params.getCurve().getField().getFieldSize(), attributes);
+            return P11Key.publicKey(session, keyID, "EC",
+                    params.getCurve().getField().getFieldSize(),
+                    attributes, true);
         } finally {
             token.releaseSession(session);
         }
     }
 

@@ -273,12 +274,13 @@
                 (O_IMPORT, CKO_PRIVATE_KEY, CKK_EC, attributes);
         Session session = null;
         try {
             session = token.getObjSession();
             long keyID = token.p11.C_CreateObject(session.id(), attributes);
-            return P11Key.privateKey
-                (session, keyID, "EC", params.getCurve().getField().getFieldSize(), attributes);
+            return P11Key.privateKey(session, keyID, "EC",
+                    params.getCurve().getField().getFieldSize(),
+                    attributes, true);
         } finally {
             token.releaseSession(session);
         }
     }
 

@@ -288,11 +290,17 @@
             session[0] = token.getObjSession();
             CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
                 new CK_ATTRIBUTE(CKA_EC_POINT),
                 new CK_ATTRIBUTE(CKA_EC_PARAMS),
             };
-            token.p11.C_GetAttributeValue(session[0].id(), key.keyID, attributes);
+            key.incNativeKeyRef();
+            try {
+                token.p11.C_GetAttributeValue(session[0].id(), key.keyID,
+                        attributes);
+            } finally {
+                key.decNativeKeyRef();
+            }
             try {
                 ECParameterSpec params = decodeParameters(attributes[1].getByteArray());
                 ECPoint point = decodePoint(attributes[0].getByteArray(), params.getCurve());
                 return keySpec.cast(new ECPublicKeySpec(point, params));
             } catch (IOException e) {

@@ -310,11 +318,17 @@
             session[0] = token.getObjSession();
             CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
                 new CK_ATTRIBUTE(CKA_VALUE),
                 new CK_ATTRIBUTE(CKA_EC_PARAMS),
             };
-            token.p11.C_GetAttributeValue(session[0].id(), key.keyID, attributes);
+            key.incNativeKeyRef();
+            try {
+                token.p11.C_GetAttributeValue(session[0].id(), key.keyID,
+                        attributes);
+            } finally {
+                key.decNativeKeyRef();
+            }
             try {
                 ECParameterSpec params = decodeParameters(attributes[1].getByteArray());
                 return keySpec.cast(
                     new ECPrivateKeySpec(attributes[0].getBigInteger(), params));
             } catch (IOException e) {