[PATCH] tpm: use kfree_sensitive() for context and session buffers

[Ivy Lopez <skunkolee@gmail.com>]

The context_buf and session_buf fields in struct tpm_space contain
TPM context blobs which may include sensitive cryptographic material.
Use kfree_sensitive() instead of kfree() to ensure the memory is
zeroed before being freed, consistent with how chip->auth is handled
in the same tpm_dev_release() function since commit c424d2664f08
("tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()")

Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
---
 drivers/char/tpm/tpm-chip.c   | 4 ++--
 drivers/char/tpm/tpm2-space.c | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 12b7394b34bd..6f16fc358175 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -244,8 +244,8 @@ static void tpm_dev_release(struct device *dev)
 	idr_remove(&dev_nums_idr, chip->dev_num);
 	mutex_unlock(&idr_lock);
 
-	kfree(chip->work_space.context_buf);
-	kfree(chip->work_space.session_buf);
+	kfree_sensitive(chip->work_space.context_buf);
+	kfree_sensitive(chip->work_space.session_buf);
 #ifdef CONFIG_TCG_TPM2_HMAC
 	kfree_sensitive(chip->auth);
 #endif
diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
index 60354cd53b5c..a7200e6dc462 100644
--- a/drivers/char/tpm/tpm2-space.c
+++ b/drivers/char/tpm/tpm2-space.c
@@ -46,7 +46,7 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size)
 
 	space->session_buf = kzalloc(buf_size, GFP_KERNEL);
 	if (space->session_buf == NULL) {
-		kfree(space->context_buf);
+		kfree_sensitive(space->context_buf);
 		/* Prevent caller getting a dangling pointer. */
 		space->context_buf = NULL;
 		return -ENOMEM;
@@ -64,8 +64,8 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)
 		tpm_put_ops(chip);
 	}
 
-	kfree(space->context_buf);
-	kfree(space->session_buf);
+	kfree_sensitive(space->context_buf);
+	kfree_sensitive(space->session_buf);
 }
 
 int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
-- 
2.55.0