[openssh-commits] [openssh] 18/87: upstream: don't leave ssh-agent is a useless state if `ssh-add

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 551a528f05272594d2a60f4b974187543be5f82a
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 01:41:01 2026 +0000

    upstream: don't leave ssh-agent is a useless state if `ssh-add
    
    -s` is run multiple times with the same PKCS#11 provider. Just refuse the
    operation.
    
    Anthropic ANT-2026-944YIV1E
    
    OpenBSD-Commit-ID: 20dd91339c43d29fb61afa4c208ccd30cfe77f2e
---
 ssh-pkcs11-client.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/ssh-pkcs11-client.c b/ssh-pkcs11-client.c
index 6d74d7280..b6d158bb4 100644
--- a/ssh-pkcs11-client.c
+++ b/ssh-pkcs11-client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11-client.c,v 1.26 2026/02/09 22:11:39 dtucker Exp $ */
+/* $OpenBSD: ssh-pkcs11-client.c,v 1.27 2026/10/30 01:41:01 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  * Copyright (c) 2014 Pedro Martelletto. All rights reserved.
@@ -390,8 +390,15 @@ pkcs11_add_provider(char *name, char *pin, struct sshkey ***keysp,
 	struct sshbuf *msg;
 	struct helper *helper;
 
-	if ((helper = helper_by_provider(name)) == NULL &&
-	    (helper = pkcs11_start_helper(name)) == NULL)
+	/*
+	 * A helper accepts a single add request and may be serving keys
+	 * already, so don't reuse (and below, terminate) an existing one.
+	 */
+	if (helper_by_provider(name) != NULL) {
+		debug_f("provider already registered: %s", name);
+		return -1;
+	}
+	if ((helper = pkcs11_start_helper(name)) == NULL)
 		return -1;
 
 	debug3_f("add %s", helper->path);

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.