From 499901dd7a0afc77745ede85c4e6ec063d43a84d Mon Sep 17 00:00:00 2001
From: Konstantin Belousov <kib@FreeBSD.org>
Date: Sun, 4 Oct 2026 03:50:57 +0300
Subject: [PATCH] ufssuspend(4): mark non-passable

This fixes long-standing issue where ufssuspend file descriptor could
leak over fork or be passed over unix domain socket, and then closing it
in the opener would not unsuspend the file system.

It should not affect the well-behaving growfs(8) utility, but makes the
userspace API safer on principle.

Reviewed by:	markj
Tested by:	pho (previous version)
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D60285
---
 sys/ufs/ffs/ffs_suspend.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/ufs/ffs/ffs_suspend.c b/sys/ufs/ffs/ffs_suspend.c
index c35831c4bb96..9eb6d328e6ca 100644
--- a/sys/ufs/ffs/ffs_suspend.c
+++ b/sys/ufs/ffs/ffs_suspend.c
@@ -60,6 +60,7 @@ static struct cdevsw ffs_susp_cdevsw = {
 	.d_write =	ffs_susp_rdwr,
 	.d_ioctl =	ffs_susp_ioctl,
 	.d_name =	"ffs_susp",
+	.d_flags =	D_NONPASSABLE,
 };
 
 static struct cdev *ffs_susp_dev;