Merge "Do not remove the k_k until all users are unlocked" am: 4d20410bf4

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1550295

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Iec47eb1c36b136705a8302cd03497f9290ff9c2c

services/core/java/com/android/server/locksettings/RebootEscrowManager.java

@@ -224,6 +224,10 @@ class RebootEscrowManager {
         for (UserInfo user : rebootEscrowUsers) {
             allUsersUnlocked &= restoreRebootEscrowForUser(user.id, escrowKey, kk);
         }
+
+        // Clear the old key in keystore. A new key will be generated by new RoR requests.
+        mKeyStoreManager.clearKeyStoreEncryptionKey();
+
         onEscrowRestoreComplete(allUsersUnlocked);
     }
 
@@ -273,9 +277,6 @@ class RebootEscrowManager {
         } catch (IOException e) {
             Slog.w(TAG, "Could not load reboot escrow data for user " + userId, e);
             return false;
-        } finally {
-            // Clear the old key in keystore. A new key will be generated by new RoR requests.
-            mKeyStoreManager.clearKeyStoreEncryptionKey();
         }
     }