tpm: use kfree_sensitive() for context and session buffers
Subsystems (2)
PATCH 1/1 tpm: use kfree_sensitive() for context and session buffers
The context_buf and session_buf fields in struct tpm_space contain TPM context blobs which may include sensitive cryptographic material. Use kfree_sensitive() instead of kfree() to ensure the memory is zeroed before being freed, consistent with how chip->auth is handled in the same tpm_dev_release() function since commit c424d2664f08 ("tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()")
--- drivers/char/tpm/tpm-chip.c | 4 ++-- drivers/char/tpm/tpm2-space.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-)
drivers/char/tpm/tpm-chip.c +2 -2
@@ -244,8 +244,8 @@ static void tpm_dev_release(struct device *dev)idr_remove (&dev_nums_idr, chip->dev_num);mutex_unlock (&idr_lock); -kfree (chip->work_space.context_buf); -kfree (chip->work_space.session_buf); +kfree_sensitive (chip->work_space.context_buf); +kfree_sensitive (chip->work_space.session_buf);#ifdef CONFIG_TCG_TPM2_HMAC kfree_sensitive (chip->auth);#endif
drivers/char/tpm/tpm2-space.c +3 -3
@@ -46,7 +46,7 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size) space->session_buf =kzalloc (buf_size,GFP_KERNEL );if (space->session_buf ==NULL ) { -kfree (space->context_buf); +kfree_sensitive (space->context_buf);/* Prevent caller getting a dangling pointer. */ space->context_buf =NULL ;return -ENOMEM ;
@@ -64,8 +64,8 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)tpm_put_ops (chip); } -kfree (space->context_buf); -kfree (space->session_buf); +kfree_sensitive (space->context_buf); +kfree_sensitive (space->session_buf); } int tpm2_load_context(struct tpm_chip *chip, u8 *buf,
Signature · 1 line
2.55.0
James Bottomley
maintainerQuoted 2 lines · Ivy Lopez
The
context_bufandsession_buffields in structtpm_spacecontain TPM context blobs which may include sensitive cryptographic material.
That's not true ... at least not in a way that could be exfiltrated. All cryptographically sensitive areas of the context are already encrypted by the TPM with an internal key so they contain nothing useful to an attacker.
Regards,
James
Jarkko Sakkinen
maintainerQuoted 55 lines · Ivy Lopez
The
context_bufandsession_buffields in structtpm_spacecontain TPM context blobs which may include sensitive cryptographic material. Usekfree_sensitive()instead ofkfree()to ensure the memory is zeroed before being freed, consistent with howchip->authis handled in the sametpm_dev_release()function since commitc424d2664f08("tpm: Usekfree_sensitive()to free auth session intpm_dev_release()")Signed-off-by Ivy Lopez <[email protected]>--- drivers/char/tpm/tpm-chip.c | 4 ++-- drivers/char/tpm/tpm2-space.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-)drivers/char/tpm/tpm-chip.c +2
-2@@ -244,8 +244,8 @@ static void tpm_dev_release(struct device *dev)idr_remove (&dev_nums_idr, chip->dev_num);mutex_unlock (&idr_lock); -kfree (chip->work_space.context_buf); -kfree (chip->work_space.session_buf); +kfree_sensitive (chip->work_space.context_buf); +kfree_sensitive (chip->work_space.session_buf);#ifdef CONFIG_TCG_TPM2_HMAC kfree_sensitive (chip->auth);#endif drivers/char/tpm/tpm2-space.c +3
-3@@ -46,7 +46,7 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size) space->session_buf =kzalloc (buf_size,GFP_KERNEL );if (space->session_buf ==NULL ) { -kfree (space->context_buf); +kfree_sensitive (space->context_buf);/* Prevent caller getting a dangling pointer. */ space->context_buf =NULL ;return -ENOMEM ;@@ -64,8 +64,8 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)tpm_put_ops (chip); } -kfree (space->context_buf); -kfree (space->session_buf); +kfree_sensitive (space->context_buf); +kfree_sensitive (space->session_buf); } int tpm2_load_context(struct tpm_chip *chip, u8 *buf,Signature · 1 line
2.55.0
Yep, as James said, there's no plain text to uncover.
BR, Jarkko
Jarkko Sakkinen
maintainerQuoted 52 lines · Jarkko Sakkinen
Quoted 51 lines · Ivy Lopez
The
context_bufandsession_buffields in structtpm_spacecontain TPM context blobs which may include sensitive cryptographic material. Usekfree_sensitive()instead ofkfree()to ensure the memory is zeroed before being freed, consistent with howchip->authis handled in the sametpm_dev_release()function since commitc424d2664f08("tpm: Usekfree_sensitive()to free auth session intpm_dev_release()")Signed-off-by Ivy Lopez <[email protected]>--- drivers/char/tpm/tpm-chip.c | 4 ++-- drivers/char/tpm/tpm2-space.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-)drivers/char/tpm/tpm-chip.c +2
-2@@ -244,8 +244,8 @@ static void tpm_dev_release(struct device *dev)idr_remove (&dev_nums_idr, chip->dev_num);mutex_unlock (&idr_lock); -kfree (chip->work_space.context_buf); -kfree (chip->work_space.session_buf); +kfree_sensitive (chip->work_space.context_buf); +kfree_sensitive (chip->work_space.session_buf);#ifdef CONFIG_TCG_TPM2_HMAC kfree_sensitive (chip->auth);#endif drivers/char/tpm/tpm2-space.c +3
-3@@ -46,7 +46,7 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size) space->session_buf =kzalloc (buf_size,GFP_KERNEL );if (space->session_buf ==NULL ) { -kfree (space->context_buf); +kfree_sensitive (space->context_buf);/* Prevent caller getting a dangling pointer. */ space->context_buf =NULL ;return -ENOMEM ;@@ -64,8 +64,8 @@ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space)tpm_put_ops (chip); } -kfree (space->context_buf); -kfree (space->session_buf); +kfree_sensitive (space->context_buf); +kfree_sensitive (space->session_buf); }
Quoted 6 lines
Quoted 4 lines
drivers/char/tpm/tpm2-space.c +0
-0int tpm2_load_context(struct tpm_chip *chip, u8 *buf,Signature · 1 line
2.55.0Yep, as James said, there's no plain text to uncover.
And also tied to power cycle.
BR, Jarkko