src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java

*** 147,161 ****
              if (p11Key.token == token) {
                  if (extraAttrs != null) {
                      Session session = null;
                      try {
                          session = token.getObjSession();
!                         long newKeyID = token.p11.C_CopyObject(session.id(),
                                  p11Key.keyID, extraAttrs);
                          p11Key = (P11Key) (P11Key.secretKey(session,
                                  newKeyID, p11Key.algorithm, p11Key.keyLength,
!                                 extraAttrs));
                      } catch (PKCS11Exception p11e) {
                          throw new InvalidKeyException
                                  ("Cannot duplicate the PKCS11 key", p11e);
                      } finally {
                          token.releaseSession(session);
--- 147,167 ----
              if (p11Key.token == token) {
                  if (extraAttrs != null) {
                      Session session = null;
                      try {
                          session = token.getObjSession();
!                         p11Key.incNativeKeyRef();
!                         long newKeyID;
!                         try {
!                             newKeyID = token.p11.C_CopyObject(session.id(),
                                  p11Key.keyID, extraAttrs);
+                         } finally {
+                             p11Key.decNativeKeyRef();
+                         }
                          p11Key = (P11Key) (P11Key.secretKey(session,
                                  newKeyID, p11Key.algorithm, p11Key.keyLength,
!                                 extraAttrs, true));
                      } catch (PKCS11Exception p11e) {
                          throw new InvalidKeyException
                                  ("Cannot duplicate the PKCS11 key", p11e);
                      } finally {
                          token.releaseSession(session);
*** 262,272 ****
              attributes = token.getAttributes
                  (O_IMPORT, CKO_SECRET_KEY, keyType, attributes);
              session = token.getObjSession();
              long keyID = token.p11.C_CreateObject(session.id(), attributes);
              P11Key p11Key = (P11Key)P11Key.secretKey
!                 (session, keyID, algorithm, keyLength, attributes);
              return p11Key;
          } catch (PKCS11Exception e) {
              throw new InvalidKeyException("Could not create key", e);
          } finally {
              token.releaseSession(session);
--- 268,278 ----
              attributes = token.getAttributes
                  (O_IMPORT, CKO_SECRET_KEY, keyType, attributes);
              session = token.getObjSession();
              long keyID = token.p11.C_CreateObject(session.id(), attributes);
              P11Key p11Key = (P11Key)P11Key.secretKey
!                 (session, keyID, algorithm, keyLength, attributes, true);
              return p11Key;
          } catch (PKCS11Exception e) {
              throw new InvalidKeyException("Could not create key", e);
          } finally {
              token.releaseSession(session);