tpm: use kfree_sensitive() for context and session buffers

[PATCH] tpm: use kfree_sensitive() for context and session buffers

Posted by Ivy Lopez 1 week, 2 days ago

The context_buf and session_buf fields in struct tpm_space contain
TPM context blobs which may include sensitive cryptographic material.
Use kfree_sensitive() instead of kfree() to ensure the memory is
zeroed before being freed, consistent with how chip->auth is handled
in the same tpm_dev_release() function since commit c424d2664f08
("tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()")

Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
---
 drivers/char/tpm/tpm-chip.c   | 4 ++--
 drivers/char/tpm/tpm2-space.c | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 12b7394b34bd..6f16fc358175 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -244,8 +244,8 @@ static void tpm_dev_release(struct device *dev)
 	idr_remove(&dev_nums_idr, chip->dev_num);
 	mutex_unlock(&idr_lock);
 
-	kfree(chip->work_space.context_buf);
-	kfree(chip->work_space.session_buf);
+	kfree_sensitive(chip->work_space.context_buf);
+	kfree_sensitive(chip->work_space.session_buf);
 #ifdef CONFIG_TCG_TPM2_HMAC
 	kfree_sensitive(chip->auth);
 #endif
diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
index 60354cd53b5c..a7200e6dc462 100644
--- a/drivers/char/tpm/tpm2-space.c
+++ b/drivers/char/tpm/tpm2-space.c
@@ -46,7 +46,7 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size)
 
 	space->session_buf = kzalloc(buf_size, GFP_KERNEL);
 	if (space->session_buf == NULL) {
-		kfree(space->context_buf);
+		kfree_sensitive(space->context_buf);
 		/* Prevent caller getting a dangling pointer. */
 		space->context_buf = NULL;
 		return -ENOMEM;
@@ -64,8 +64,8 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)
 		tpm_put_ops(chip);
 	}
 
-	kfree(space->context_buf);
-	kfree(space->session_buf);
+	kfree_sensitive(space->context_buf);
+	kfree_sensitive(space->session_buf);
 }
 
 int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
-- 
2.55.0

Re: [PATCH] tpm: use kfree_sensitive() for context and session buffers

Posted by Jarkko Sakkinen 6 days, 21 hours ago

On Wed, Jul 15, 2026 at 06:03:55PM -0600, Ivy Lopez wrote:
> The context_buf and session_buf fields in struct tpm_space contain
> TPM context blobs which may include sensitive cryptographic material.
> Use kfree_sensitive() instead of kfree() to ensure the memory is
> zeroed before being freed, consistent with how chip->auth is handled
> in the same tpm_dev_release() function since commit c424d2664f08
> ("tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()")
> 
> Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
> ---
>  drivers/char/tpm/tpm-chip.c   | 4 ++--
>  drivers/char/tpm/tpm2-space.c | 6 +++---
>  2 files changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
> index 12b7394b34bd..6f16fc358175 100644
> --- a/drivers/char/tpm/tpm-chip.c
> +++ b/drivers/char/tpm/tpm-chip.c
> @@ -244,8 +244,8 @@ static void tpm_dev_release(struct device *dev)
>  	idr_remove(&dev_nums_idr, chip->dev_num);
>  	mutex_unlock(&idr_lock);
>  
> -	kfree(chip->work_space.context_buf);
> -	kfree(chip->work_space.session_buf);
> +	kfree_sensitive(chip->work_space.context_buf);
> +	kfree_sensitive(chip->work_space.session_buf);
>  #ifdef CONFIG_TCG_TPM2_HMAC
>  	kfree_sensitive(chip->auth);
>  #endif
> diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
> index 60354cd53b5c..a7200e6dc462 100644
> --- a/drivers/char/tpm/tpm2-space.c
> +++ b/drivers/char/tpm/tpm2-space.c
> @@ -46,7 +46,7 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size)
>  
>  	space->session_buf = kzalloc(buf_size, GFP_KERNEL);
>  	if (space->session_buf == NULL) {
> -		kfree(space->context_buf);
> +		kfree_sensitive(space->context_buf);
>  		/* Prevent caller getting a dangling pointer. */
>  		space->context_buf = NULL;
>  		return -ENOMEM;
> @@ -64,8 +64,8 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)
>  		tpm_put_ops(chip);
>  	}
>  
> -	kfree(space->context_buf);
> -	kfree(space->session_buf);
> +	kfree_sensitive(space->context_buf);
> +	kfree_sensitive(space->session_buf);
>  }
>  
>  int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
> -- 
> 2.55.0
> 

Yep, as James said, there's no plain text to uncover.

BR, Jarkko

Re: [PATCH] tpm: use kfree_sensitive() for context and session buffers

Posted by Jarkko Sakkinen 6 days, 19 hours ago

On Sat, Jul 18, 2026 at 09:39:35PM +0300, Jarkko Sakkinen wrote:
> On Wed, Jul 15, 2026 at 06:03:55PM -0600, Ivy Lopez wrote:
> > The context_buf and session_buf fields in struct tpm_space contain
> > TPM context blobs which may include sensitive cryptographic material.
> > Use kfree_sensitive() instead of kfree() to ensure the memory is
> > zeroed before being freed, consistent with how chip->auth is handled
> > in the same tpm_dev_release() function since commit c424d2664f08
> > ("tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()")
> > 
> > Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
> > ---
> >  drivers/char/tpm/tpm-chip.c   | 4 ++--
> >  drivers/char/tpm/tpm2-space.c | 6 +++---
> >  2 files changed, 5 insertions(+), 5 deletions(-)
> > 
> > diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
> > index 12b7394b34bd..6f16fc358175 100644
> > --- a/drivers/char/tpm/tpm-chip.c
> > +++ b/drivers/char/tpm/tpm-chip.c
> > @@ -244,8 +244,8 @@ static void tpm_dev_release(struct device *dev)
> >  	idr_remove(&dev_nums_idr, chip->dev_num);
> >  	mutex_unlock(&idr_lock);
> >  
> > -	kfree(chip->work_space.context_buf);
> > -	kfree(chip->work_space.session_buf);
> > +	kfree_sensitive(chip->work_space.context_buf);
> > +	kfree_sensitive(chip->work_space.session_buf);
> >  #ifdef CONFIG_TCG_TPM2_HMAC
> >  	kfree_sensitive(chip->auth);
> >  #endif
> > diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
> > index 60354cd53b5c..a7200e6dc462 100644
> > --- a/drivers/char/tpm/tpm2-space.c
> > +++ b/drivers/char/tpm/tpm2-space.c
> > @@ -46,7 +46,7 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size)
> >  
> >  	space->session_buf = kzalloc(buf_size, GFP_KERNEL);
> >  	if (space->session_buf == NULL) {
> > -		kfree(space->context_buf);
> > +		kfree_sensitive(space->context_buf);
> >  		/* Prevent caller getting a dangling pointer. */
> >  		space->context_buf = NULL;
> >  		return -ENOMEM;
> > @@ -64,8 +64,8 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)
> >  		tpm_put_ops(chip);
> >  	}
> >  
> > -	kfree(space->context_buf);
> > -	kfree(space->session_buf);
> > +	kfree_sensitive(space->context_buf);
> > +	kfree_sensitive(space->session_buf);
> >  }
> >  
> >  int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
> > -- 
> > 2.55.0
> > 
> 
> Yep, as James said, there's no plain text to uncover.

And also tied to power cycle.

BR, Jarkko

Re: [PATCH] tpm: use kfree_sensitive() for context and session buffers

Posted by James Bottomley 1 week, 2 days ago

On Wed, 2026-07-15 at 18:03 -0600, Ivy Lopez wrote:
> The context_buf and session_buf fields in struct tpm_space contain
> TPM context blobs which may include sensitive cryptographic material.

That's not true ... at least not in a way that could be exfiltrated. 
All cryptographically sensitive areas of the context are already
encrypted by the TPM with an internal key so they contain nothing
useful to an attacker.

Regards,

James