Skip to contentSkip to conversation

smb: client: Don't log plaintext credentials in cifs_set_cifscreds

PATCH In review Thorsten Blum 3 participants 3 messages Feb 26

Subsystems (3)
Stable branch SMB client (CIFS) Kernel SMB3 server (ksmbd)
lore
Share & tools
lore

Thorsten Blum

author
#0 lore raw

PATCH 1/1 smb: client: Don't log plaintext credentials in cifs_set_cifscreds

When debug logging is enabled, cifs_set_cifscreds() logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing credentials.

Fixes 8a8798a5ff90 ("cifs: fetch credentials out of keyring for non-krb5 auth multiuser mounts")
Cc [email protected]
Signed-off-by Thorsten Blum <[email protected]>
---
 fs/smb/client/connect.c | 1 -
 1 file changed, 1 deletion(-)
fs/smb/client/connect.c +0 -1
index 33dfe116ca52..038f87062419 100644
@@ -2236,7 +2236,6 @@ cifs_set_cifscreds(struct smb3_fs_context *ctx, struct cifs_ses *ses)
 	/* find first : in payload */
 	payload = upayload->data;
 	delim = strnchr(payload, upayload->datalen, ':');
-	cifs_dbg(FYI, "payload=%s\n", payload);
 	if (!delim) {
 		cifs_dbg(FYI, "Unable to find ':' in payload (datalen=%d)\n",
 			 upayload->datalen);
Signature · 2 lines
Thorsten Blum <[email protected]>
GPG: 1D60 735E 8AEF 3BE4 73B6  9D84 7336 78FD 8DFE EAD4
maintainer Acked-by on v1 1/1
#1 lore raw
Quoted 10 lines · Thorsten Blum

When debug logging is enabled, cifs_set_cifscreds() logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing credentials.

Fixes 8a8798a5ff90 ("cifs: fetch credentials out of keyring for non-krb5 auth multiuser mounts")
Cc [email protected]
Signed-off-by Thorsten Blum <[email protected]>
---
 fs/smb/client/connect.c | 1 -
 1 file changed, 1 deletion(-)
Acked-by Paulo Alcantara (Red Hat) <[email protected]>
#2 lore raw

Added to cifs-2.6.git for-next pending additional testing (also added the Acked-by)

Quoted 15 lines · Paulo Alcantara
Quoted 10 lines · Thorsten Blum

When debug logging is enabled, cifs_set_cifscreds() logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing credentials.

Fixes 8a8798a5ff90 ("cifs: fetch credentials out of keyring for non-krb5 auth multiuser mounts")
Cc [email protected]
Signed-off-by Thorsten Blum <[email protected]>
---
 fs/smb/client/connect.c | 1 -
 1 file changed, 1 deletion(-)
Acked-by Paulo Alcantara (Red Hat) <[email protected]>
Signature · 3 lines
Thanks,

Steve