The context_buf and session_buf fields in struct tpm_space contain
TPM context blobs which may include sensitive cryptographic material.
Use kfree_sensitive() instead of kfree() to ensure the memory is
zeroed before being freed, consistent with how chip->auth is handled
in the same tpm_dev_release() function since commit c424d2664f08
("tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()")Signed-off-by: Ivy Lopez <[email protected]> --- drivers/char/tpm/tpm-chip.c | 4 ++-- drivers/char/tpm/tpm2-space.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index 12b7394b34bd..6f16fc358175 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -244,8 +244,8 @@ static void tpm_dev_release(struct device *dev) idr_remove(&dev_nums_idr, chip->dev_num); mutex_unlock(&idr_lock); - kfree(chip->work_space.context_buf); - kfree(chip->work_space.session_buf); + kfree_sensitive(chip->work_space.context_buf); + kfree_sensitive(chip->work_space.session_buf); #ifdef CONFIG_TCG_TPM2_HMAC kfree_sensitive(chip->auth); #endif diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c index 60354cd53b5c..a7200e6dc462 100644 --- a/drivers/char/tpm/tpm2-space.c +++ b/drivers/char/tpm/tpm2-space.c @@ -46,7 +46,7 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size) space->session_buf = kzalloc(buf_size, GFP_KERNEL); if (space->session_buf == NULL) { - kfree(space->context_buf); + kfree_sensitive(space->context_buf); /* Prevent caller getting a dangling pointer. */ space->context_buf = NULL; return -ENOMEM; @@ -64,8 +64,8 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space) tpm_put_ops(chip); } - kfree(space->context_buf); - kfree(space->session_buf); + kfree_sensitive(space->context_buf); + kfree_sensitive(space->session_buf); } int tpm2_load_context(struct tpm_chip *chip, u8 *buf, -- 2.55.0
