Merge "Do not remove the k_k until all users are unlocked" am: 4d20410bf4 am: e013e0b98a

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1550295

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Iec8191cf30a4977d234c83156bfac0b0edf344cf

services/core/java/com/android/server/locksettings/RebootEscrowManager.java

@@ -224,6 +224,10 @@ class RebootEscrowManager {
         for (UserInfo user : rebootEscrowUsers) {
             allUsersUnlocked &= restoreRebootEscrowForUser(user.id, escrowKey, kk);
         }
+
+        // Clear the old key in keystore. A new key will be generated by new RoR requests.
+        mKeyStoreManager.clearKeyStoreEncryptionKey();
+
         onEscrowRestoreComplete(allUsersUnlocked);
     }
 
@@ -273,9 +277,6 @@ class RebootEscrowManager {
         } catch (IOException e) {
             Slog.w(TAG, "Could not load reboot escrow data for user " + userId, e);
             return false;
-        } finally {
-            // Clear the old key in keystore. A new key will be generated by new RoR requests.
-            mKeyStoreManager.clearKeyStoreEncryptionKey();
         }
     }