Re: [PATCH] tpm: use kfree_sensitive() for context and session buffers

[Jarkko Sakkinen <jarkko@kernel.org>]

On Sat, Jul 18, 2026 at 09:39:35PM +0300, Jarkko Sakkinen wrote:
> On Wed, Jul 15, 2026 at 06:03:55PM -0600, Ivy Lopez wrote:
> > The context_buf and session_buf fields in struct tpm_space contain
> > TPM context blobs which may include sensitive cryptographic material.
> > Use kfree_sensitive() instead of kfree() to ensure the memory is
> > zeroed before being freed, consistent with how chip->auth is handled
> > in the same tpm_dev_release() function since commit c424d2664f08
> > ("tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()")
> > 
> > Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
> > ---
> >  drivers/char/tpm/tpm-chip.c   | 4 ++--
> >  drivers/char/tpm/tpm2-space.c | 6 +++---
> >  2 files changed, 5 insertions(+), 5 deletions(-)
> > 
> > diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
> > index 12b7394b34bd..6f16fc358175 100644
> > --- a/drivers/char/tpm/tpm-chip.c
> > +++ b/drivers/char/tpm/tpm-chip.c
> > @@ -244,8 +244,8 @@ static void tpm_dev_release(struct device *dev)
> >  	idr_remove(&dev_nums_idr, chip->dev_num);
> >  	mutex_unlock(&idr_lock);
> >  
> > -	kfree(chip->work_space.context_buf);
> > -	kfree(chip->work_space.session_buf);
> > +	kfree_sensitive(chip->work_space.context_buf);
> > +	kfree_sensitive(chip->work_space.session_buf);
> >  #ifdef CONFIG_TCG_TPM2_HMAC
> >  	kfree_sensitive(chip->auth);
> >  #endif
> > diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
> > index 60354cd53b5c..a7200e6dc462 100644
> > --- a/drivers/char/tpm/tpm2-space.c
> > +++ b/drivers/char/tpm/tpm2-space.c
> > @@ -46,7 +46,7 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size)
> >  
> >  	space->session_buf = kzalloc(buf_size, GFP_KERNEL);
> >  	if (space->session_buf == NULL) {
> > -		kfree(space->context_buf);
> > +		kfree_sensitive(space->context_buf);
> >  		/* Prevent caller getting a dangling pointer. */
> >  		space->context_buf = NULL;
> >  		return -ENOMEM;
> > @@ -64,8 +64,8 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)
> >  		tpm_put_ops(chip);
> >  	}
> >  
> > -	kfree(space->context_buf);
> > -	kfree(space->session_buf);
> > +	kfree_sensitive(space->context_buf);
> > +	kfree_sensitive(space->session_buf);
> >  }
> >  
> >  int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
> > -- 
> > 2.55.0
> > 
> 
> Yep, as James said, there's no plain text to uncover.

And also tied to power cycle.

BR, Jarkko