1 files changed, 15 insertions, 3 deletions

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 5ebc972c0b6d..bff2fa941f60 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2641,10 +2641,22 @@ int drm_mode_getfb(struct drm_device *dev,
         r->depth = fb->depth;
         r->bpp = fb->bits_per_pixel;
         r->pitch = fb->pitches[0];
-        if (fb->funcs->create_handle)
-                ret = fb->funcs->create_handle(fb, file_priv, &r->handle);
-        else
+        if (fb->funcs->create_handle) {
+                if (file_priv->is_master || capable(CAP_SYS_ADMIN)) {
+                        ret = fb->funcs->create_handle(fb, file_priv,
+                                                       &r->handle);
+                } else {
+                        /* GET_FB() is an unprivileged ioctl so we must not
+                         * return a buffer-handle to non-master processes! For
+                         * backwards-compatibility reasons, we cannot make
+                         * GET_FB() privileged, so just return an invalid handle
+                         * for non-masters. */
+                        r->handle = 0;
+                        ret = 0;
+                }
+        } else {
                 ret = -ENODEV;
+        }
 
         drm_framebuffer_unreference(fb);