Re: [PATCH] tpm: use kfree_sensitive() for context and session buffers

[Jarkko Sakkinen <jarkko@kernel.org>]

On Wed, Jul 15, 2026 at 06:03:55PM -0600, Ivy Lopez wrote:
> The context_buf and session_buf fields in struct tpm_space contain
> TPM context blobs which may include sensitive cryptographic material.
> Use kfree_sensitive() instead of kfree() to ensure the memory is
> zeroed before being freed, consistent with how chip->auth is handled
> in the same tpm_dev_release() function since commit c424d2664f08
> ("tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()")
> 
> Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
> ---
>  drivers/char/tpm/tpm-chip.c   | 4 ++--
>  drivers/char/tpm/tpm2-space.c | 6 +++---
>  2 files changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
> index 12b7394b34bd..6f16fc358175 100644
> --- a/drivers/char/tpm/tpm-chip.c
> +++ b/drivers/char/tpm/tpm-chip.c
> @@ -244,8 +244,8 @@ static void tpm_dev_release(struct device *dev)
>  	idr_remove(&dev_nums_idr, chip->dev_num);
>  	mutex_unlock(&idr_lock);
>  
> -	kfree(chip->work_space.context_buf);
> -	kfree(chip->work_space.session_buf);
> +	kfree_sensitive(chip->work_space.context_buf);
> +	kfree_sensitive(chip->work_space.session_buf);
>  #ifdef CONFIG_TCG_TPM2_HMAC
>  	kfree_sensitive(chip->auth);
>  #endif
> diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
> index 60354cd53b5c..a7200e6dc462 100644
> --- a/drivers/char/tpm/tpm2-space.c
> +++ b/drivers/char/tpm/tpm2-space.c
> @@ -46,7 +46,7 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size)
>  
>  	space->session_buf = kzalloc(buf_size, GFP_KERNEL);
>  	if (space->session_buf == NULL) {
> -		kfree(space->context_buf);
> +		kfree_sensitive(space->context_buf);
>  		/* Prevent caller getting a dangling pointer. */
>  		space->context_buf = NULL;
>  		return -ENOMEM;
> @@ -64,8 +64,8 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)
>  		tpm_put_ops(chip);
>  	}
>  
> -	kfree(space->context_buf);
> -	kfree(space->session_buf);
> +	kfree_sensitive(space->context_buf);
> +	kfree_sensitive(space->session_buf);
>  }
>  
>  int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
> -- 
> 2.55.0
> 

Yep, as James said, there's no plain text to uncover.

BR, Jarkko