git: 4435b4fbe0d0 - stable/15 - procdesc: Disallow pddupfd() of non-passable files

The branch stable/15 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=4435b4fbe0d04718705de623ad68d79f44295d9d

commit 4435b4fbe0d04718705de623ad68d79f44295d9d
Author:     Mark Johnston <[email protected]>
AuthorDate: 2026-07-24 20:05:26 +0000
Commit:     Konstantin Belousov <[email protected]>
CommitDate: 2026-08-16 02:41:34 +0000

    procdesc: Disallow pddupfd() of non-passable files
    
    (cherry picked from commit 91e11c8f2b38eb1d1f3a1d57b27378fb2c6ab3c1)
---
 lib/libsys/pdfork.2     |  6 ++++++
 sys/kern/sys_procdesc.c | 10 +++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/lib/libsys/pdfork.2 b/lib/libsys/pdfork.2
index 584c87e17e38..1b99157203c1 100644
--- a/lib/libsys/pdfork.2
+++ b/lib/libsys/pdfork.2
@@ -195,6 +195,8 @@ flag set.
 The
 .Fa flags
 argument is reserved and must be zero.
+Certain file descriptor types cannot be copied this way, namely
+kqueues.
 .Pp
 The following system calls also have effects specific to process descriptors:
 .Pp
@@ -350,6 +352,10 @@ The file descriptor
 is not a valid file descriptor in the specified process.
 .It Bq Er ENOENT
 The specified process does not have a file descriptor table.
+.It Bq Er EOPNOTSUPP
+.Fa remotefd
+refers to a file that cannot be duplicated across a process boundary,
+such as a kqueue.
 .El
 .Sh SEE ALSO
 .Xr close 2 ,
diff --git a/sys/kern/sys_procdesc.c b/sys/kern/sys_procdesc.c
index 6eed8c7f0267..9b007aa8997b 100644
--- a/sys/kern/sys_procdesc.c
+++ b/sys/kern/sys_procdesc.c
@@ -799,9 +799,13 @@ kern_pddupfd(struct thread *td, int pdfd, int fd, int flags)
 		PROC_UNLOCK(p);
 		error = fget_remote(td, p, fd, &fcaps, &fd_flags, &fp);
 		if (error == 0) {
-			error = finstall_refed(td, fp, &fdr, O_CLOEXEC |
-			    ((fd_flags & FD_RESOLVE_BENEATH) != 0 ?
-			    O_RESOLVE_BENEATH : 0), &fcaps);
+			if ((fp->f_ops->fo_flags & DFLAG_PASSABLE) == 0) {
+				error = EOPNOTSUPP;
+			} else {
+				error = finstall_refed(td, fp, &fdr, O_CLOEXEC |
+				    ((fd_flags & FD_RESOLVE_BENEATH) != 0 ?
+				    O_RESOLVE_BENEATH : 0), &fcaps);
+			}
 			if (error != 0) {
 				fdrop(fp, td);
 				filecaps_free(&fcaps);