Commit c424d266 authored by Gunnar Kudrjavets's avatar Gunnar Kudrjavets Committed by Jarkko Sakkinen
Browse files

tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()



tpm_dev_release() uses plain kfree() to free chip->auth, which contains
sensitive cryptographic material including HMAC session keys, nonces,
and passphrase data (struct tpm2_auth).

Every other code path that frees this structure uses kfree_sensitive()
to zero the memory before releasing it: both tpm2_end_auth_session()
and tpm_buf_check_hmac_response() do so. The tpm_dev_release() path
is the only one that does not, leaving key material in freed slab
memory until it is eventually overwritten.

Use kfree_sensitive() for consistency with the rest of the driver and
to ensure session keys are scrubbed during device teardown.

Cc: stable@vger.kernel.org # v6.10+
Fixes: 699e3efd ("tpm: Add HMAC session start and end functions")
Signed-off-by: default avatarGunnar Kudrjavets <gunnarku@amazon.com>
Reviewed-by: default avatarJustinien Bouron <jbouron@amazon.com>
Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
parent f0f75a3d
Loading
Loading
Loading
Loading
+1 −1
Original line number Diff line number Diff line
@@ -247,7 +247,7 @@ static void tpm_dev_release(struct device *dev)
	kfree(chip->work_space.context_buf);
	kfree(chip->work_space.session_buf);
#ifdef CONFIG_TCG_TPM2_HMAC
	kfree(chip->auth);
	kfree_sensitive(chip->auth);
#endif
	kfree(chip);
}